Description of problem:

I can disable a locked module. According to detailed functional requirements specification this should not be possible.

See below.

Version-Release number of selected component (if applicable):
dnf-2.7.5-4.fc26.modularity.1.3fb9e5c.git.8052.52e0d41None.noarch

[root@ac872f34caa2 /]# dnf module enable ModuleA:f26
Last metadata expiration check: 0:00:20 ago on Mon Oct 23 21:51:11 2017.
'ModuleA:f26' is enabled
[root@ac872f34caa2 /]# dnf module lock ModuleA      
Last metadata expiration check: 0:00:29 ago on Mon Oct 23 21:51:11 2017.
'ModuleA' is locked (stream: f26, version: 2)
[root@ac872f34caa2 /]# dnf module disable ModuleA
Last metadata expiration check: 0:00:36 ago on Mon Oct 23 21:51:11 2017.
'ModuleA' is disabled
[root@ac872f34caa2 /]# dnf module list
Last metadata expiration check: 0:00:42 ago on Mon Oct 23 21:51:11 2017.
modularityABDE
Name                Stream            Version            Profiles                       
ModuleA             f26               2 [l]              client, default, ...           
ModuleB             f26               2                  default                        
ModuleD             f26               1                  default                        
ModuleE             f26               1                  default                        

Hint: [d]efault, [i]nstalled, [l]ocked
[root@ac872f34caa2 /]# cat /etc/dnf/modules.d/ModuleA.module 
[ModuleA]
locked = 1
name = ModuleA
stream = f26
enabled = 0
profiles =
version = 2