Matthew Garrett [off-list ref] wrote:

 enum lockdown_reason {
 	LOCKDOWN_NONE,
+	LOCKDOWN_MODULE_SIGNATURE,
 	LOCKDOWN_INTEGRITY_MAX,
 	LOCKDOWN_CONFIDENTIALITY_MAX,
 };

Aren't you mixing disjoint sets?

+	[LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",

Wouldn't it be better to pass this string as a parameter to
security_locked_down()?

David