AFAIK, init should already be immune against any signals which are still
associated with the default action. If not, this would be an (IMHO) easy and
(IMNSHO) necessary patch (I gleaned over the kernel code, and I think this is
not yet there).
Would it be an idea to make securelev a set of flags? So you could flag that
ext2 attributes can't be changed, that modules can't be loaded, that
networking setup is frozen, etcetera, etcetera. I think you could identify a
number of subsystems which need their configuration frozen, but not
necessarily in a sequential order (like you implied with ``once securelev is
sufficiently high'').
-- Cees de Groot <C.deGroot@inter.NL.net> OpenLink Software, Inc.