{
  "id": "org.fwupd.hsi.Kernel.Lockdown",
  "name": "Kernel Lockdown",
  "description": [
    "Kernel lockdown is an important mechanism to limit what hardware actions userspace programs can perform.",
    "Turning on this feature means that often-used mechanisms like /dev/mem used to raise privileges or exfiltrate data are no longer available."
  ],
  "failure-impact": [
    "An unlocked kernel can be easily abused by a malicious userspace program running as root, which can include replacing system firmware."
  ],
  "failure-results": {
    "not-valid": "could not read lockdown status, perhaps from an old kernel",
    "not-enabled": "lockdown is set to `none`"
  },
  "success-results": {
    "enabled": "lockdown is set to either `integrity` or `confidentiality`."
  },
  "resolution": "Ensure Secure Boot is enabled in the UEFI firmware setup.",
  "fwupd-version": "1.5.0"
}
