security/lockdown/lockdown.c

File Facts

System

Linux kernel

Corpus path

security/lockdown/lockdown.c

Extension

.c

Size

4344 bytes

Lines

173

Domain

Core OS

Bucket

Security And Isolation

Inferred role

Core OS: operation-table or driver-model contract

Status

pattern implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

• Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
• Defines an operation table; this is where Linux turns generic core objects into subsystem-specific behavior.
• Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.

Dependency Surface

• linux/security.h
• linux/export.h
• linux/lsm_hooks.h
• uapi/linux/lsm.h

Detected Declarations

• function lock_kernel_down
• function lockdown_param
• function lockdown_is_locked_down
• function lockdown_lsm_init
• function lockdown_read
• function lockdown_write
• function lockdown_secfs_init

Annotated Snippet

static const struct file_operations lockdown_ops = {
	.read  = lockdown_read,
	.write = lockdown_write,
};

static int __init lockdown_secfs_init(void)
{
	struct dentry *dentry;

	dentry = securityfs_create_file("lockdown", 0644, NULL, NULL,
					&lockdown_ops);
	return PTR_ERR_OR_ZERO(dentry);
}

#ifdef CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
DEFINE_EARLY_LSM(lockdown) = {
#else
DEFINE_LSM(lockdown) = {
#endif
	.id = &lockdown_lsmid,
	.init = lockdown_lsm_init,
	.initcall_core = lockdown_secfs_init,
};

Annotation

• Immediate include surface: `linux/security.h`, `linux/export.h`, `linux/lsm_hooks.h`, `uapi/linux/lsm.h`.
• Detected declarations: `function lock_kernel_down`, `function lockdown_param`, `function lockdown_is_locked_down`, `function lockdown_lsm_init`, `function lockdown_read`, `function lockdown_write`, `function lockdown_secfs_init`.
• Atlas domain: Core OS / Security And Isolation.
• Implementation status: pattern implementation candidate.

Implementation Notes

• This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
• Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
• Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.