rtas syscall allow userspace to request any RTAS call (firmware services). This should not be unrestricted under lockdown, so filter all requests in any case, to allow only those legitimate requests that might be used by real tools.