Linux 5.4 Pulls In LOCKDOWN Support For Opt-In Hardware/Kernel Security Restrictions
Written by Michael Larabel in Linux Kernel on 28 September 2019 at 12:23 PM EDT. 24 Comments
LINUX KERNEL --
While yesterday Linus Torvalds was still undecided on whether to pull in the long-revised "LOCKDOWN" kernel patches and wanted to review them patch-by-patch, following that lengthy examination he has decided to indeed land this opt-in restricted functionality for Linux 5.4.

The Linux LOCKDOWN patches have been found in various distribution kernels for years and for the mainline process went through dozens of rounds of review to address various issues and ensure all bases are covered for tightening up the kernel's interaction with the system hardware when desired as well as ensuring the running kernel image cannot be manipulated.

When enabled, the Linux LOCKDOWN mode prevents the system from hibernating as one example of a user-facing restriction as well as blocking writes to /dev/mem even as root, blocking kernel module parameters that touch hardware bits, restricting CPU MSR access, and a variety of other restrictions in the name of tightening up security. Most use-cases for Linux Lockdown functionality is for pairing with UEFI SecureBoot or other security sensitive environments.

The now-merged lockdown functionality doesn't place any restrictions by default. The support can be activated with the lockdown= kernel parameter. Setting lockdown=integrity will block kernel features that allow user-space to modify the running kernel. Setting lockdown=confidentiality will block user-space from extracting "confidential information" from the running kernel, further restrictions on top of the integrity mode. All of the bits are controlled via the Kconfig SECURITY_LOCKDOWN_LSM option for enabling this Linux security module. Via SECURITY_LOCKDOWN_LSM_EARLY is also the ability to permanently force the integrity/confidentiality lockdown modes if desired.

The support made it in time for the Linux 5.4-rc1 release expected on Sunday that will mark the closure of the feature merge window for this last stable kernel release of 2019.
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related Linux Kernel News
Popular News This Week