[PATCH] lockdown: Only log restrictions once

[Paul Moore]

On Wed, Nov 19, 2025 at 8:22 AM Daniel Tang
<danielzgtg.opensource at gmail.com> wrote:
>
> KDE's lockscreen causes systemd-logind to spam dmesg about hibernation.
> systemd declined to cache /sys/power/state due to runtime changeability.
>
> Link: https://github.com/systemd/systemd/pull/39802
> Signed-off-by: Daniel Tang <danielzgtg.opensource at gmail.com>
> ---
>  security/lockdown/lockdown.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

Adding the Lockdown maintainers to the To/CC line.

> diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
> index cf83afa1d879..4ced8c76dc6b 100644
> --- a/security/lockdown/lockdown.c
> +++ b/security/lockdown/lockdown.c
> @@ -62,9 +62,11 @@ static int lockdown_is_locked_down(enum lockdown_reason what)
>                  "Invalid lockdown reason"))
>                 return -EPERM;
>
> +       static volatile unsigned long lockdown_reasons_seen;

I'll let the Lockdown folks comment on the rest, but at the very least
this variable should be declared at the top of the function.  Yes, you
*can* declare it in the middle, but just because you can, doesn't mean
you should ;)

> +       static_assert(ARRAY_SIZE(lockdown_reasons) < sizeof(lockdown_reasons_seen) * 8);
>         if (kernel_locked_down >= what) {
> -               if (lockdown_reasons[what])
> -                       pr_notice_ratelimited("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
> +               if (lockdown_reasons[what] && !test_and_set_bit(what, &lockdown_reasons_seen))
> +                       pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
>                                   current->comm, lockdown_reasons[what]);
>                 return -EPERM;
>         }
> --
> 2.51.0

-- 
paul-moore.com