linux-kernel - Re: [PATCH] lockdown: Only log restrictions once

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhQNGnm6NBSrUmfwoEwAxqedYbHckEkb+J47W5gWjrKBOA@mail.gmail.com>
Date: Wed, 19 Nov 2025 11:05:15 -0500
From: Paul Moore <paul@...l-moore.com>
To: Daniel Tang <danielzgtg.opensource@...il.com>, 
	Nicolas Bouchinet <nicolas.bouchinet@....cyber.gouv.fr>, Xiu Jianfeng <xiujianfeng@...wei.com>
Cc: linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Nathan Lynch <nathanl@...ux.ibm.com>, Matthew Garrett <mjg59@...gle.com>, 
	Kees Cook <keescook@...omium.org>, David Howells <dhowells@...hat.com>, 
	James Morris <jmorris@...ei.org>
Subject: Re: [PATCH] lockdown: Only log restrictions once

On Wed, Nov 19, 2025 at 8:22 AM Daniel Tang
<danielzgtg.opensource@...il.com> wrote:
>
> KDE's lockscreen causes systemd-logind to spam dmesg about hibernation.
> systemd declined to cache /sys/power/state due to runtime changeability.
>
> Link: https://github.com/systemd/systemd/pull/39802
> Signed-off-by: Daniel Tang <danielzgtg.opensource@...il.com>
> ---
>  security/lockdown/lockdown.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

Adding the Lockdown maintainers to the To/CC line.

> diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
> index cf83afa1d879..4ced8c76dc6b 100644
> --- a/security/lockdown/lockdown.c
> +++ b/security/lockdown/lockdown.c
> @@ -62,9 +62,11 @@ static int lockdown_is_locked_down(enum lockdown_reason what)
>                  "Invalid lockdown reason"))
>                 return -EPERM;
>
> +       static volatile unsigned long lockdown_reasons_seen;

I'll let the Lockdown folks comment on the rest, but at the very least
this variable should be declared at the top of the function.  Yes, you
*can* declare it in the middle, but just because you can, doesn't mean
you should ;)

> +       static_assert(ARRAY_SIZE(lockdown_reasons) < sizeof(lockdown_reasons_seen) * 8);
>         if (kernel_locked_down >= what) {
> -               if (lockdown_reasons[what])
> -                       pr_notice_ratelimited("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
> +               if (lockdown_reasons[what] && !test_and_set_bit(what, &lockdown_reasons_seen))
> +                       pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
>                                   current->comm, lockdown_reasons[what]);
>                 return -EPERM;
>         }
> --
> 2.51.0

-- 
paul-moore.com