The Linux kernel lockdown patchset is shipped by most major Linux vendors, but has been outside the mainline kernel for almost 6 years. Why does it exist? Why do people want to ship it? Why is it still out of tree?
This presentation will describe the design motivations behind the patchset, the politics that have ensued and why it's still a worthwhile thing to ship. It will cover various security features that have real-world benefits to end users and which are enabled by enhanced separation between the kernel and root.
