Add a a sysctl, hw.kbd.keymap_restrict_change, which acts a bit

like secure level but which restricts changes to the keymap. Its
values impose the following restrictions:

0: No restriction - this is the default.
1: Only root can change restricted keys (like boot, panic, ...)
2: Only root can change restricted keys and regular keys.
   Other users still can change accents and function keys.
3: Only root can change restricted keys, regular keys and accents.
4: Only root can change any of the keymap (restricted keys, regular
      keys, accents and function keys).

Unfortunately, the keyboard's accent map is cleared when a new keymap
is loaded, which makes the distinction between level 3 and level 4
less useful.

The MAC guys might like to make this a policy?

No objections from: -audit about 6 moths ago

0 files changed, 0 insertions, 0 deletions