On Mon, 2019-06-24 at 17:02 -0700, Matthew Garrett wrote:

On Mon, Jun 24, 2019 at 2:27 PM Mimi Zohar [off-list ref] wrote:

quoted

I agree with Dave.  There should be a stub lockdown function to
prevent enforcing lockdown when it isn't enabled.

Sorry, when what isn't enabled? If no LSMs are enforcing lockdown then
the check will return 0. The goal here is for distributions to be able
to ship a kernel that has CONFIG_KEXEC_SIG=y, CONFIG_KEXEC_SIG_FORCE=n
and at runtime be able to enforce a policy that requires signatures on
kexec payloads.

Never mind, the call can't be moved earlier.