kernel lockdown
also: lockdown, kernel lockdown mode
A Linux kernel security feature that restricts privileged operations and access to kernel internals, even when running as root, to prevent malicious code from modifying the running kernel.
Kernel lockdown is a security mechanism that enforces restrictions on what privileged users and processes can do to the kernel at runtime. When enabled, it prevents operations like loading unsigned kernel modules, accessing kernel memory directly, and disabling security features—even for the root user.
This is particularly valuable in secure boot environments and on systems where the kernel integrity must be guaranteed after boot. For example, on a locked-down system, an attacker who gains root access cannot load a malicious kernel module to gain deeper control.
Kernel lockdown operates in two modes: integrity mode (stricter) and confidentiality mode (most restrictive). It's often used alongside Secure Boot and other firmware-level protections on modern systems.
You can check the current lockdown status by reading /sys/kernel/security/lockdown, and it is typically configured at boot time via kernel command-line parameters like lockdown=integrity.