-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


>>>>> "der" == der Mouse <mouse@Rodents.Montreal.QC.CA> writes:
    der> Rather, I read it as having knobs for x, y, and z in the
    der> kernel; additionally, kern.securelevel, a set-only variable,
    der> would, when set, raise the knobs for x, y, and z.  There would
    der> be no single kernel variable corresponding to kern.securelevel;
    der> it would not exist in any form that could be checked against.

    der> If we want to continue to support reading kern.securelevel, the
    der> read routine for it would have to take the minimum of all the
    der> relevant variables.  I don't see that as a big deal.

  You can maintain the variable as such. It won't tell the whole truth,
but it will tell that for certain that if it has value FOO, that
features that are <FOO are not enabled.

    der> Of course, I could be misunderstanding.

  I think you are bang on.

- -- 
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr@xelerance.com      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

  
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Finger me for keys

iQEVAwUBQ9krP4CLcPvd0N1lAQJL7Af/fHsgpm6BMrtvpfB+s8fEFkCc61f1u671
glg1Znk8sAWezELuuQKFlmXxEJUwOxLf7RXsw+ffrvmy5QE5r2kZCibw41ZUbkcQ
d1y/DHMEAGPO6btF7v7Hxala8bgT68nKeLZqdk94vRJrpou6M14kNJNuZssKPBmi
hjdHi+cDPkgl8mOxyse8X/cwvE3gSDM5ZLhyzGQ3vkEGyXA0Iwrnw7VBakZXfaPF
eZEl1EH8PzIx9aho8laciSX5sMHZGlpfaWiO+O2oAhUA2UvKEpFG3rQBAXFEY+wr
u7ooSKy/fVm1A952d6fiGahcPtPTQnIZNbZTGNiC+YbpMpN5umzepw==
=KyjL
-----END PGP SIGNATURE-----