kernel_lockdown(7)

💖 kernel_lockdown — bestie's guide to keeping the kernel image off-limits 💖

okay so. this is a page about kernel_lockdown, aka the kernel image access prevention feature, and it lives in the Miscellaneous Information Manual section of your friendly neighbourhood man pages. grab a boba, we're doing security ✨

---

🌸 NAME 🌸

kernel_lockdown — the kernel image access prevention feature 🛡️

---

🦋 DESCRIPTION 🦋

so the Kernel Lockdown feature is literally designed to stop both direct and indirect access to a running kernel image. the whole point is to protect against unauthorized modification of the kernel image, and to prevent anybody from getting at the security and cryptographic data chillin' in kernel memory — whilst still permitting driver modules to be loaded. yes bestie, you read that right, modules still load, we're not that dramatic 💅

if a prohibited or restricted feature gets accessed or used, the kernel will emit a message that looks like this:

Lockdown: X: Y is restricted, see man kernel_lockdown.7

where X indicates the process name and Y indicates what is restricted. so if you ever see that in your dmesg, that's the vibe check failing, not you 🔥

---

✨ Coverage ✨

when lockdown is in effect, a whole bunch of features get disabled or have their use restricted. this includes special device files and kernel services that allow direct access of the kernel image:

/dev/mem
/dev/kmem
/dev/kcore
/dev/ioports
BPF
kprobes

and also the ability to directly configure and control devices, so that nobody can use a device to access or modify a kernel image:

• The use of module parameters that directly specify hardware parameters to drivers through the kernel command line or when loading a module.
• The use of direct PCI BAR access.
• The use of the ioperm and iopl instructions on x86.
• The use of the KD*IO console ioctls.
• The use of the TIOCSSERIAL serial ioctl.
• The alteration of MSR registers on x86.
• The replacement of the PCMCIA CIS.
• The overriding of ACPI tables.
• The use of ACPI error injection.
• The specification of the ACPI RDSP address.
• The use of ACPI custom methods.

and certain facilities are restricted (not gone, just on a leash 🎀):

• Only validly signed modules may be loaded (waived if the module file being loaded is vouched for by IMA appraisal).
• Only validly signed binaries may be kexec'd (waived if the binary image file to be executed is vouched for by IMA appraisal).
• Unencrypted hibernation/suspend to swap are disallowed as the kernel image is saved to a medium that can then be accessed. yeah that one's a real one, pls respect it 😭
• Use of debugfs is not permitted as this allows a whole range of actions including direct configuration of, access to and driving of hardware.
• IMA requires the addition of the "secure_boot" rules to the policy, whether or not they are specified on the command line, for both the built-in and custom policies in secure boot lockdown mode.

---

🌈 VERSIONS 🌈

The Kernel Lockdown feature was added in Linux 5.4. vintage-ish but iconic 👑

---

⭐ NOTES ⭐

The Kernel Lockdown feature is enabled by CONFIG_SECURITY_LOCKDOWN_LSM. 🫶

The lsm=lsm1,...,lsmN command line parameter controls the sequence of the initialization of Linux Security Modules. it must contain the string lockdown to enable the Kernel Lockdown feature.

If the command line parameter is not specified, the initialization falls back to the value of the deprecated security= command line parameter, and further to the value of CONFIG_LSM.

deprecated things still work but bestie… they're deprecated for a reason, iykyk 🙈

---

and that's the whole page, no cap. every flag, every file, every caveat — all accounted for 💜

stay safe out there and don't let anyone touch your kernel image ✨ this has been your girl running Linux man-pages 6.20, dated 2026-02-10 — mwah, catch you in the next man page 💅🎀🦋