Re: [PATCH 0/2] Allow individual features to be locked down

[Nikolay Borisov]

On 9.04.25 г. 18:45 ч., Dan Williams wrote:
> Paul Moore wrote:
> > On Fri, Mar 21, 2025 at 6:24 AM Nikolay Borisov <nik.borisov@xxxxxxxx> wrote:
> > > This simple change allows usecases where someone might want to  lock only specific
> > > feature at a finer granularity than integrity/confidentiality levels allows.
> > > The first likely user of this is the CoCo subsystem where certain features will be
> > > disabled.
> > >
> > > Nikolay Borisov (2):
> > >    lockdown: Switch implementation to using bitmap
> > >    lockdown/kunit: Introduce kunit tests
> >
> > Hi Nikolay,
> >
> > Thanks for the patches!  With the merge window opening in a few days,
> > it is too late to consider this for the upcoming merge window so
> > realistically this patchset is two weeks out and I'm hopeful we'll
> > have a dedicated Lockdown maintainer by then so I'm going to defer the
> > ultimate decision on acceptance to them.
>
> The patches in this thread proposed to selectively disable /dev/mem
> independent of all the other lockdown mitigations. That goal can be
> achieved with more precision with this proposed patch:
>
> http://lore.kernel.org/67f5b75c37143_71fe2949b@xxxxxxxxxxxxxxxxxxxxxxxxx.notmuch


True, however I think increasing the granularity of the lockdown 
subsystem merits its own discussion, notwithstanding COCO use case.