trust: Forcibly mark "Default Trust" read-only

The "Default Trust" token is typically mounted as $datadir, which is
considered as read-only on modern OSes.

Suggestd by Kai Engert in:
https://bugzilla.redhat.com/show_bug.cgi?id=1523630

1 files changed, 7 insertions, 1 deletions

diff --git a/trust/token.h b/trust/token.h
index 1180b27..87641d0 100644
--- a/trust/token.h
+++ b/trust/token.h
@@ -40,11 +40,17 @@
 #include "parser.h"
 #include "pkcs11.h"
 
+enum {
+	P11_TOKEN_FLAG_NONE = 0,
+	P11_TOKEN_FLAG_WRITE_PROTECTED = 1 << 0,
+};
+
 typedef struct _p11_token p11_token;
 
 p11_token *     p11_token_new         (CK_SLOT_ID slot,
                                        const char *path,
-                                       const char *label);
+                                       const char *label,
+                                       int flags);
 
 void            p11_token_free        (p11_token *token);