* [PATCH] lockdown: Only log restrictions once
@ 2025-11-19 13:22 Daniel Tang
2025-11-19 16:05 ` Paul Moore
0 siblings, 1 reply; 7+ messages in thread
From: Daniel Tang @ 2025-11-19 13:22 UTC (permalink / raw)
To: linux-security-module
Cc: linux-kernel, Nathan Lynch, Paul Moore, Matthew Garrett,
Kees Cook, David Howells, James Morris
KDE's lockscreen causes systemd-logind to spam dmesg about hibernation.
systemd declined to cache /sys/power/state due to runtime changeability.
Link: https://github.com/systemd/systemd/pull/39802
Signed-off-by: Daniel Tang <danielzgtg.opensource@gmail.com>
---
security/lockdown/lockdown.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index cf83afa1d879..4ced8c76dc6b 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -62,9 +62,11 @@ static int lockdown_is_locked_down(enum lockdown_reason what)
"Invalid lockdown reason"))
return -EPERM;
+ static volatile unsigned long lockdown_reasons_seen;
+ static_assert(ARRAY_SIZE(lockdown_reasons) < sizeof(lockdown_reasons_seen) * 8);
if (kernel_locked_down >= what) {
- if (lockdown_reasons[what])
- pr_notice_ratelimited("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
+ if (lockdown_reasons[what] && !test_and_set_bit(what, &lockdown_reasons_seen))
+ pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
current->comm, lockdown_reasons[what]);
return -EPERM;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] lockdown: Only log restrictions once
2025-11-19 13:22 [PATCH] lockdown: Only log restrictions once Daniel Tang
@ 2025-11-19 16:05 ` Paul Moore
2025-11-19 18:07 ` [PATCH v2] " Daniel Tang
0 siblings, 1 reply; 7+ messages in thread
From: Paul Moore @ 2025-11-19 16:05 UTC (permalink / raw)
To: Daniel Tang, Nicolas Bouchinet, Xiu Jianfeng
Cc: linux-security-module, linux-kernel, Nathan Lynch,
Matthew Garrett, Kees Cook, David Howells, James Morris
On Wed, Nov 19, 2025 at 8:22 AM Daniel Tang
<danielzgtg.opensource@gmail.com> wrote:
>
> KDE's lockscreen causes systemd-logind to spam dmesg about hibernation.
> systemd declined to cache /sys/power/state due to runtime changeability.
>
> Link: https://github.com/systemd/systemd/pull/39802
> Signed-off-by: Daniel Tang <danielzgtg.opensource@gmail.com>
> ---
> security/lockdown/lockdown.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
Adding the Lockdown maintainers to the To/CC line.
> diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
> index cf83afa1d879..4ced8c76dc6b 100644
> --- a/security/lockdown/lockdown.c
> +++ b/security/lockdown/lockdown.c
> @@ -62,9 +62,11 @@ static int lockdown_is_locked_down(enum lockdown_reason what)
> "Invalid lockdown reason"))
> return -EPERM;
>
> + static volatile unsigned long lockdown_reasons_seen;
I'll let the Lockdown folks comment on the rest, but at the very least
this variable should be declared at the top of the function. Yes, you
*can* declare it in the middle, but just because you can, doesn't mean
you should ;)
> + static_assert(ARRAY_SIZE(lockdown_reasons) < sizeof(lockdown_reasons_seen) * 8);
> if (kernel_locked_down >= what) {
> - if (lockdown_reasons[what])
> - pr_notice_ratelimited("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
> + if (lockdown_reasons[what] && !test_and_set_bit(what, &lockdown_reasons_seen))
> + pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
> current->comm, lockdown_reasons[what]);
> return -EPERM;
> }
> --
> 2.51.0
--
paul-moore.com
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v2] lockdown: Only log restrictions once
2025-11-19 16:05 ` Paul Moore
@ 2025-11-19 18:07 ` Daniel Tang
2025-11-20 7:37 ` Xiujianfeng
0 siblings, 1 reply; 7+ messages in thread
From: Daniel Tang @ 2025-11-19 18:07 UTC (permalink / raw)
To: Nicolas Bouchinet, Xiu Jianfeng, Paul Moore
Cc: linux-security-module, linux-kernel, Nathan Lynch,
Matthew Garrett, Kees Cook, David Howells, James Morris
KDE's lockscreen causes systemd-logind to spam dmesg about hibernation.
systemd declined to cache /sys/power/state due to runtime changeability.
Link: https://github.com/systemd/systemd/pull/39802
Signed-off-by: Daniel Tang <danielzgtg.opensource@gmail.com>
---
security/lockdown/lockdown.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index cf83afa1d879..83b50de52f21 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -58,13 +58,16 @@ early_param("lockdown", lockdown_param);
*/
static int lockdown_is_locked_down(enum lockdown_reason what)
{
+ static volatile unsigned long lockdown_reasons_seen;
+ static_assert(ARRAY_SIZE(lockdown_reasons) < sizeof(lockdown_reasons_seen) * 8);
+
if (WARN(what >= LOCKDOWN_CONFIDENTIALITY_MAX,
"Invalid lockdown reason"))
return -EPERM;
if (kernel_locked_down >= what) {
- if (lockdown_reasons[what])
- pr_notice_ratelimited("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
+ if (lockdown_reasons[what] && !test_and_set_bit(what, &lockdown_reasons_seen))
+ pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
current->comm, lockdown_reasons[what]);
return -EPERM;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v2] lockdown: Only log restrictions once
2025-11-19 18:07 ` [PATCH v2] " Daniel Tang
@ 2025-11-20 7:37 ` Xiujianfeng
2025-11-20 9:26 ` Daniel Tang
2025-11-25 10:00 ` Nicolas Bouchinet
0 siblings, 2 replies; 7+ messages in thread
From: Xiujianfeng @ 2025-11-20 7:37 UTC (permalink / raw)
To: Daniel Tang, Nicolas Bouchinet, Xiu Jianfeng, Paul Moore
Cc: linux-security-module, linux-kernel, Nathan Lynch,
Matthew Garrett, Kees Cook, David Howells, James Morris
Hi Daniel,
On 11/20/2025 2:07 AM, Daniel Tang wrote:
> KDE's lockscreen causes systemd-logind to spam dmesg about hibernation.
> systemd declined to cache /sys/power/state due to runtime changeability.
>
> Link: https://github.com/systemd/systemd/pull/39802
> Signed-off-by: Daniel Tang <danielzgtg.opensource@gmail.com>
> ---
> security/lockdown/lockdown.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
> index cf83afa1d879..83b50de52f21 100644
> --- a/security/lockdown/lockdown.c
> +++ b/security/lockdown/lockdown.c
> @@ -58,13 +58,16 @@ early_param("lockdown", lockdown_param);
> */
> static int lockdown_is_locked_down(enum lockdown_reason what)
> {
> + static volatile unsigned long lockdown_reasons_seen;
> + static_assert(ARRAY_SIZE(lockdown_reasons) < sizeof(lockdown_reasons_seen) * 8);
> +
> if (WARN(what >= LOCKDOWN_CONFIDENTIALITY_MAX,
> "Invalid lockdown reason"))
> return -EPERM;
>
> if (kernel_locked_down >= what) {
> - if (lockdown_reasons[what])
> - pr_notice_ratelimited("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
> + if (lockdown_reasons[what] && !test_and_set_bit(what, &lockdown_reasons_seen))
> + pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
> current->comm, lockdown_reasons[what]);
Currently lockdown does not support the audit function, so I believe the
logs here serve a purpose similar to auditing. Based on this, I think
this change will meaningfully degrade the quality of the logs, making it
hard for users to find out what happens when lockdown is active，
especially after a long time running.
Is it possible to adjust the printk_ratelimit & printk_ratelimit_burst
in /proc/sys/kernel/ to reduce the logs in your scenario?
Anyway, I will wait for Nicolas's comment.
> return -EPERM;
> }
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] lockdown: Only log restrictions once
2025-11-20 7:37 ` Xiujianfeng
@ 2025-11-20 9:26 ` Daniel Tang
2025-11-20 13:35 ` Xiujianfeng
2025-11-25 10:00 ` Nicolas Bouchinet
1 sibling, 1 reply; 7+ messages in thread
From: Daniel Tang @ 2025-11-20 9:26 UTC (permalink / raw)
To: Nicolas Bouchinet, Xiu Jianfeng, Paul Moore, Xiujianfeng
Cc: linux-security-module, linux-kernel, Nathan Lynch,
Matthew Garrett, Kees Cook, David Howells, James Morris
On Thursday, 20 November 2025, 02:37:56 EST Xiujianfeng <xiujianfeng@huaweicloud.com> wrote:
> Is it possible to adjust the printk_ratelimit & printk_ratelimit_burst
> in /proc/sys/kernel/ to reduce the logs in your scenario?
It's not working. Watching the console after setting the sysctl and
repeatedly clicking org.freedesktop.login1.Manager.CanSuspend in
qdbusviewer (simulating what the lockscreen does), I see:
```console
root@daniel-desktop3:~# uname -a
Linux daniel-desktop3 6.17.0-6-generic #6-Ubuntu SMP PREEMPT_DYNAMIC Tue Oct 7 13:34:17 UTC 2025 x86_64 GNU/Linux
root@daniel-desktop3:~# sysctl kernel.printk_ratelimit_burst=1
kernel.printk_ratelimit_burst = 1
root@daniel-desktop3:~# sysctl kernel.printk_ratelimit=999999
kernel.printk_ratelimit = 999999
root@daniel-desktop3:~# dmesg -W
[14385.334698] lockdown_is_locked_down: 3 callbacks suppressed
[14385.334701] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14385.614738] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14385.878857] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14386.166744] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14386.454771] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14386.750900] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14387.038795] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14387.334770] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14387.622696] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14387.926763] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14390.366582] lockdown_is_locked_down: 7 callbacks suppressed
[14390.366585] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14390.798744] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14391.118802] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14391.422728] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14391.742754] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14392.046735] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14392.350745] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14392.654992] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14392.974797] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
[14393.270741] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
```
At my desk, I lock my screen every 5 hours. In public, I might lock my
screen every 1 minute, 5 minute, or 15 *minutes*. printk_ratelimit
seems to be targeted towards things that happen every N *seconds*.
> logs here serve a purpose similar to auditing. Based on this, I think
> this change will meaningfully degrade the quality of the logs, making it
> hard for users to find out what happens when lockdown is active，
> especially after a long time running.
For v3 in December, I'm thinking of adding a code path to special-case
*reads* from /sys/power/state. What do you think?
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] lockdown: Only log restrictions once
2025-11-20 9:26 ` Daniel Tang
@ 2025-11-20 13:35 ` Xiujianfeng
0 siblings, 0 replies; 7+ messages in thread
From: Xiujianfeng @ 2025-11-20 13:35 UTC (permalink / raw)
To: Daniel Tang, Nicolas Bouchinet, Xiu Jianfeng, Paul Moore
Cc: linux-security-module, linux-kernel, Nathan Lynch,
Matthew Garrett, Kees Cook, David Howells, James Morris
Hi Daniel,
On 11/20/2025 5:26 PM, Daniel Tang wrote:
> On Thursday, 20 November 2025, 02:37:56 EST Xiujianfeng <xiujianfeng@huaweicloud.com> wrote:
>> Is it possible to adjust the printk_ratelimit & printk_ratelimit_burst
>> in /proc/sys/kernel/ to reduce the logs in your scenario?
>
> It's not working. Watching the console after setting the sysctl and
> repeatedly clicking org.freedesktop.login1.Manager.CanSuspend in
> qdbusviewer (simulating what the lockscreen does), I see:
>
> ```console
> root@daniel-desktop3:~# uname -a
> Linux daniel-desktop3 6.17.0-6-generic #6-Ubuntu SMP PREEMPT_DYNAMIC Tue Oct 7 13:34:17 UTC 2025 x86_64 GNU/Linux
> root@daniel-desktop3:~# sysctl kernel.printk_ratelimit_burst=1
> kernel.printk_ratelimit_burst = 1
> root@daniel-desktop3:~# sysctl kernel.printk_ratelimit=999999
> kernel.printk_ratelimit = 999999
> root@daniel-desktop3:~# dmesg -W
> [14385.334698] lockdown_is_locked_down: 3 callbacks suppressed
> [14385.334701] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14385.614738] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14385.878857] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14386.166744] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14386.454771] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14386.750900] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14387.038795] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14387.334770] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14387.622696] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14387.926763] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14390.366582] lockdown_is_locked_down: 7 callbacks suppressed
> [14390.366585] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14390.798744] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14391.118802] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14391.422728] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14391.742754] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14392.046735] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14392.350745] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14392.654992] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14392.974797] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> [14393.270741] Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
> ```
>
> At my desk, I lock my screen every 5 hours. In public, I might lock my
> screen every 1 minute, 5 minute, or 15 *minutes*. printk_ratelimit
> seems to be targeted towards things that happen every N *seconds*.
Sorry for misleading.
After reading the code, I found that the macro of printk_ratelimited is
#define printk_ratelimited(fmt, ...) \
({ \
static DEFINE_RATELIMIT_STATE(_rs, \
DEFAULT_RATELIMIT_INTERVAL, \
DEFAULT_RATELIMIT_BURST); \
\
if (__ratelimit(&_rs)) \
printk(fmt, ##__VA_ARGS__); \
})
It seems that the rate is fixed and can not be modified via sysctl.
While another interface with a modifiable rate, which is
printk_ratelimit(), is marked as "don't use".
>
>> logs here serve a purpose similar to auditing. Based on this, I think
>> this change will meaningfully degrade the quality of the logs, making it
>> hard for users to find out what happens when lockdown is active，
>> especially after a long time running.
>
> For v3 in December, I'm thinking of adding a code path to special-case
> *reads* from /sys/power/state. What do you think?
Sorry, I am not familiar with hibernation, maybe you can CC hibernation
maintainers.
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] lockdown: Only log restrictions once
2025-11-20 7:37 ` Xiujianfeng
2025-11-20 9:26 ` Daniel Tang
@ 2025-11-25 10:00 ` Nicolas Bouchinet
1 sibling, 0 replies; 7+ messages in thread
From: Nicolas Bouchinet @ 2025-11-25 10:00 UTC (permalink / raw)
To: Xiujianfeng
Cc: Daniel Tang, Xiu Jianfeng, Paul Moore, linux-security-module,
linux-kernel, Nathan Lynch, Matthew Garrett, Kees Cook,
David Howells, James Morris
Hi,
> Currently lockdown does not support the audit function, so I believe the
> logs here serve a purpose similar to auditing. Based on this, I think
> this change will meaningfully degrade the quality of the logs, making it
> hard for users to find out what happens when lockdown is active，
> especially after a long time running.
I agree with Xiu.
I'm not sure to understand how this is a kernel issue. I mean beside
that we do not support hibernation in Lockdown for now.
Can't you just disable hibernation with systemd-logind using someting like
'AllowHibernation=no' ?
Best regards,
Nicolas
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-11-25 10:21 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-19 13:22 [PATCH] lockdown: Only log restrictions once Daniel Tang
2025-11-19 16:05 ` Paul Moore
2025-11-19 18:07 ` [PATCH v2] " Daniel Tang
2025-11-20 7:37 ` Xiujianfeng
2025-11-20 9:26 ` Daniel Tang
2025-11-20 13:35 ` Xiujianfeng
2025-11-25 10:00 ` Nicolas Bouchinet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).