jonathan@dsg.stanford.edu wrote:

> If i can put i this way: Elad seems to find it important to offer
> finer-grained *EN*ablement of specific actions. 

No. This is more FUD.

> Whereas in contrast,
> Thor and I find it essential to globally *DIS*able certain actions
> (irrespective of which process issues them); and secondarily, to have
> a hierarchy of such disablement.

Jonathan, what part of "you can do whatever you want" did you not
understand?

> If what you want is a totally-ordered, monotonically-nondecreasing,
> hierarchy of *disabling* specific actions, that really doesn't fit
> with an independent set of individual bits --- where, by definition,
> any one bit in t the collection of bits is *NOT* ordered vis-a-vis the
> others.

Jonathan, do you know what's the difference between an interface and
an implementation?

If I told you that with the new code you would be able to do *exactly*
what you are doing today -- accessing a raise-only kern.securelevel --
and it would have the exactly same affects there are today, would that
satisfy you? because that is the case.

In fact, not only that is the case, but for people who are not you, who
*do* want multiple monotonically-increasing knobs, it is a matter of
1-line-change to the kernel config file to achieve that.

Like I said, I expected some people to want to retain existing behavior,
and my original post does mention that this is, unlike you claim,
possible.

> Am I repeatedly missing it?

Yes.

-e.

-- 
Elad Efrat