Add kernel lockdown utility functions

[maramsmurthy]

This commit adds three new utility functions to avocado.utils.linux for managing kernel lockdown security feature:

1. is_kernel_lockdown_enabled(): Check current lockdown state

   • Returns tuple of (mode, is_enabled)
   • Supports none, integrity, and confidentiality modes
   • Handles cases where lockdown feature is unavailable

2. enable_kernel_lockdown_integrity(): Enable integrity mode

   • Prevents kernel modification
   • Verifies mode change via sysfs
   • Validates dmesg for lockdown message

3. enable_kernel_lockdown_confidentiality(): Enable confidentiality mode

   • Most restrictive mode (prevents modification and data exposure)
   • Verifies mode change via sysfs
   • Validates dmesg for lockdown message

All functions follow PEP 8 standards and include comprehensive docstrings. Lockdown mode transitions are one-way at runtime and require reboot to downgrade.

[maramsmurthy]

All 3 definitions are functioning as expected

from avocado.utils import linux
linux.is_kernel_lockdown_enabled()
('none', False)
linux.enable_kernel_lockdown_integrity()
True
linux.is_kernel_lockdown_enabled()
('integrity', True)
linux.enable_kernel_lockdown_confidentiality()
True
linux.is_kernel_lockdown_enabled()
('confidentiality', True)

[gemini-code-assist]

Code Review

This pull request introduces functionality to manage kernel lockdown states in avocado/utils/linux.py, including functions to check the current mode and enable integrity or confidentiality modes via sysfs. The review feedback correctly identifies that the dmesg log verification used during the enablement process is redundant and fragile, as the state change is already confirmed by reading the sysfs file. Consequently, it is recommended to remove these checks and the associated dmesg module import to improve reliability and performance.

[gemini-code-assist]

The dmesg verification is redundant and fragile. If the kernel log buffer is cleared or wraps around, this check will return False even if the lockdown was successfully enabled. Since the state change is already verified by checking the sysfs file content via new_mode, this extra check should be removed to improve reliability and performance (as collect_errors_dmesg is an expensive operation that also requires sudo privileges).

    try:
        genio.write_one_line(lockdown_path, "integrity")
        new_mode, _ = is_kernel_lockdown_enabled()
        return new_mode in ["integrity", "confidentiality"]
    except (PermissionError, IOError):
        return False

[gemini-code-assist]

The dmesg verification is redundant and fragile. If the kernel log buffer is cleared or wraps around, this check will return False even if the lockdown was successfully enabled. Since the state change is already verified by checking the sysfs file content via new_mode, this extra check should be removed to improve reliability and performance (as collect_errors_dmesg is an expensive operation that also requires sudo privileges).

    try:
        genio.write_one_line(lockdown_path, "confidentiality")
        new_mode, _ = is_kernel_lockdown_enabled()
        return new_mode == "confidentiality"
    except (PermissionError, IOError):
        return False

[gemini-code-assist]

If the dmesg verification is removed from the lockdown functions as suggested, the dmesg module import becomes unused and should be removed to keep the code clean.

Suggested change

	from avocado.utils import dmesg, genio, process
	from avocado.utils import genio, process

[codecov]

Codecov Report

❌ Patch coverage is 0% with 53 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.14%. Comparing base (74b7379) to head (e0f48e3).
⚠️ Report is 107 commits behind head on master.

Files with missing lines	Patch %	Lines
avocado/utils/linux.py	0.00%	53 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #6306      +/-   ##
==========================================
- Coverage   73.48%   72.14%   -1.34%     
==========================================
  Files         206      206              
  Lines       22494    23309     +815     
==========================================
+ Hits        16530    16817     +287     
- Misses       5964     6492     +528     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.