[RFC] x86/ioperm: boot-time switch to disable iopl()/ioperm()?

[Andrey Zakharov]

Hi,

KSPP issue #97 (https://github.com/KSPP/linux/issues/97) asks for a way
to disable iopl() and ioperm() at boot time, so that a distro can keep
CONFIG_X86_IOPL_IOPERM enabled while system owners can still turn the
syscalls off.

I read Thomas's recent explanation in the "iopl - change I/O privilege
level" man page thread, and Andy's reply that iopl() is low maintenance.
So before writing any code I would like to ask whether such a knob is
wanted at all, or whether CONFIG_X86_IOPL_IOPERM=n and lockdown are
considered enough.

As far as I can tell, the options today are the build-time
CONFIG_X86_IOPL_IOPERM and lockdown=integrity, which also restricts
/dev/mem, kexec and other features. I did not find a boot parameter for
this in next-20261022, nor a previous series on lore (I searched for
iopl and ioperm).

If it is wanted, the change would be small:

 - an early parameter, modelled on ia32_emulation= (kstrtobool() in an
   early_param handler), that sets an __ro_after_init flag;
 - a check of that flag in ksys_ioperm() and SYSCALL_DEFINE1(iopl) in
   arch/x86/kernel/ioport.c, next to the existing capable(CAP_SYS_RAWIO)
   / security_locked_down(LOCKDOWN_IOPORT) checks, which today already
   reject only requests to gain port access;
 - an entry in Documentation/admin-guide/kernel-parameters.txt;
 - default behaviour unchanged.

Questions:

1. Is a boot parameter wanted, given lockdown and the compile-time
   option?
2. Thomas mentioned that the permission bitmap can also be changed
   through x86-specific VT ioctls. Should such a knob cover those as
   well, or would it be incomplete without them? I have not looked at
   that code yet.
3. Which error should be returned when access is refused this way:
   -EPERM, as for lockdown, or -ENOSYS, as when CONFIG_X86_IOPL_IOPERM
   is disabled?

No patch yet. I will send one only if there is interest, and I am fine
with "not needed" as an answer.

Thanks,
Andrey Zakharov