[PATCH master] security: hide CRYPTO_BUILTIN_DEVELOPMENT_KEYS behind INSECURE

[Ahmad Fatoum]

CONFIG_HAS_INSECURE_DEFAULTS is meant for options that may be insecure
by default and need extra care when used in secure deployments.

CONFIG_CRYPTO_BUILTIN_DEVELOPMENT_KEYS can't be used in a secure manner
at all and the help text spells it out, so it's more appropriate to have
it explicitly depending on INSECURE.

Cc: Jonas Rebmann <jre at pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
 security/Kconfig | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/Kconfig b/security/Kconfig
index 7ac92e4af760..40d468ae07d2 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -16,6 +16,7 @@ config INSECURE
 	  This option is a moving target. Currently it:
 
 	    - changes the default of global.env.autoprobe to 1
+	    - allows enablement of CRYPTO_BUILTIN_DEVELOPMENT_KEYS
 
 source "security/Kconfig.policy"
 
@@ -79,7 +80,7 @@ endchoice
 endif
 
 config CRYPTO_BUILTIN_DEVELOPMENT_KEYS
-	select HAS_INSECURE_DEFAULTS
+	depends on INSECURE
 	depends on CRYPTO_BUILTIN_KEYS
 	bool "Include development keys in build"
 	help
-- 
2.47.3