Gilbert Fernandes wrote:
> Could we have a single "securelevel" option, that would be either 1 or 0.
> When it's set to 1 it would parse a configuration file that lists what
> happens when the machine gets "locked down". We could have a default file
> with some "knobs" turned on, and other turned off. So people could continue
> to use "securelevel" to lock down some aspects of their operating system,
> and give the freedom to administrators to edit the config file (in
...
> This would give us flexibility while keeping a single userlevel knob :)

I do not see that this differs in essence from the many-sysctls-
protected-by-a-knob proposed earlier, and the concerns would be the
same. Perhaps the kernel or init could do a little analysis of the
configuration file, and add the following in dmesg:

requested securelevel: 1
SU-complete restrictions turned off: 6
securelevel effectively: 0

-Chap