SoylentNews

martyb writes:

Linux to get Kernel 'Lockdown' Feature:

After years of countless reviews, discussions, and code rewrites, Linus Torvalds approved on Saturday a new security feature for the Linux kernel, named "lockdown."

The new feature will ship as a LSM (Linux Security Module) in the soon-to-be-released Linux kernel 5.4 branch, where it will be turned off by default; usage being optional due to the risk of breaking existing systems.

[...] The new feature's primary function will be to strengthen the divide between userland processes and kernel code by preventing even the root account from interacting with kernel code -- something that it's been able to do, by design, until now.

[...] "The lockdown module is intended to allow for kernels to be locked down early in [the] boot [process]," said Matthew Garrett, the Google engineer who proposed the feature a few years back.

"When enabled, various pieces of kernel functionality are restricted," said Linus Torvalds, Linux kernel creator, and the one who put the final stamp of approval on the module yesterday.

This includes restricting access to kernel features that may allow arbitrary code execution via code supplied by userland processes; blocking processes from writing or reading /dev/mem and /dev/kmem memory; block access to opening /dev/port to prevent raw port access; enforcing kernel module signatures; and many more others, detailed here.

[...] The new module will support two lockdown modes, namely "integrity" and "confidentiality." Each is unique, and restricts access to different kernel functionality.

"If set to integrity, kernel features that allow userland to modify the running kernel are disabled," said Torvalds.

"If set to confidentiality, kernel features that allow userland to extract confidential information from the kernel are also disabled."

If necessary, additional lockdown modes can also be added on top, but this will require an external patch, on top of the lockdown LSM.

Original Submission