Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 3/5] Add the ability to lock down access to the running kernel image | Date | Thu, 25 May 2017 07:53:22 +0100 |
| |
Casey Schaufler <casey@schaufler-ca.com> wrote:
> > +#ifdef CONFIG_LOCK_DOWN_KERNEL > > +extern bool kernel_is_locked_down(void); > > +#else > > +static inline bool kernel_is_locked_down(void) > > Should this be a bool or an int? I can imagine that someone is going to want > various different degrees of lock down for kernels. As an int you could > return a bitmap indicating which features were locked. This would allow > additional things to be locked down without changing the interface.
At the moment it makes no difference, since the return value is only ever passed directly to an if-statement.
Also, do you have an idea as to how is should be divided up?
There aren't so many cases, at least not yet, that they can't be fixed up, perhaps with a coccinelle script.
David
| |