LOCKDOWN_DEV_MEM
rc = security_locked_down(LOCKDOWN_DEV_MEM);
ret = security_locked_down(LOCKDOWN_DEV_MEM);
if (!security_locked_down(LOCKDOWN_DEV_MEM) && capable(CAP_SYS_RAWIO))
[LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",