s390/hypfs: Enable limited access during lockdown

JIRA: https://issues.redhat.com/browse/RHEL-111203

commit 3868f91
Author: Peter Oberparleiter <oberpar@linux.ibm.com>
Date:   Thu Aug 21 15:12:37 2025 +0200

    s390/hypfs: Enable limited access during lockdown

    When kernel lockdown is active, debugfs_locked_down() blocks access to
    hypfs files that register ioctl callbacks, even if the ioctl interface
    is not required for a function. This unnecessarily breaks userspace
    tools that only rely on read operations.

    Resolve this by registering a minimal set of file operations during
    lockdown, avoiding ioctl registration and preserving access for affected
    tooling.

    Note that this change restores hypfs functionality when lockdown is
    active from early boot (e.g. via lockdown=integrity kernel parameter),
    but does not apply to scenarios where lockdown is enabled dynamically
    while Linux is running.

    Tested-by: Mete Durlu <meted@linux.ibm.com>
    Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
    Fixes: 5496197 ("debugfs: Restrict debugfs when the kernel is locked down")
    Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
    Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>

Signed-off-by: Mete Durlu <mdurlu@redhat.com>

Author: Mete Durlu

arch/s390/hypfs/hypfs_dbfs.c

@@ -6,6 +6,7 @@
  * Author(s): Michael Holzheu <holzheu@linux.vnet.ibm.com>
  */
 
+#include <linux/security.h>
 #include <linux/slab.h>
 #include "hypfs.h"
 
@@ -84,7 +85,7 @@ void hypfs_dbfs_create_file(struct hypfs_dbfs_file *df)
 {
 	const struct file_operations *fops = &dbfs_ops;
 
-	if (df->unlocked_ioctl)
+	if (df->unlocked_ioctl && !security_locked_down(LOCKDOWN_DEBUGFS))
 		fops = &dbfs_ops_ioctl;
 	df->dentry = debugfs_create_file(df->name, 0400, dbfs_dir, df, fops);
 	mutex_init(&df->lock);