Messages in this thread | | | Date | Wed, 5 Sep 2012 22:41:42 +0100 | From | Matthew Garrett <> | Subject | Re: [PATCH 07/11] kexec: Disable in a secure boot environment |
| |
On Wed, Sep 05, 2012 at 05:13:49PM -0400, Mimi Zohar wrote:
> Normally capabilities provide additional permissions. So if you don't > have the capability, an errno is returned. CAP_SYS_BOOT is a good > example. With CAP_SECURE_FIRMWARE, it reads backwards - if not > CAP_SECURE_FIRMWARE, return error. I think you want to invert the name > to CAP_NOT_SECURE_FIRMWARE, CAP_NOT_SECURE_BOOT or perhaps > CAP_UNSECURED_BOOT.
Yeah, I think renaming the cap is a given.
-- Matthew Garrett | mjg59@srcf.ucam.org
| |