Re: [PATCH try #3] security: Convert LSM into a static interface

[david@lang.hm]

On Wed, 18 Jul 2007, James Morris wrote:

> On Wed, 18 Jul 2007, Andrew Morton wrote:
>
> > > The SECURITY_FRAMEWORK_VERSION macro has also been removed.
> > I'd like to understand who is (or claims to be) adversely affected by this
> > change, and what their complaints (if any) will be.
> >
> > Because I prefer my flamewars pre- rather than post-merge.
> This was already discussed and resolved during previous postings of the
> patch.
>
> In a nutshell, there is no safe way to unload an LSM.  The modular
> interface is thus unecessary and broken infrastructure.  It is used only
> by out-of-tree modules, which are often binary-only, illegal, abusive of
> the API and dangerous, e.g. silently re-vectoring SELinux.
there's a difference between 'often' and 'always'. I really don't think 
you want to start that sort of argument (after all, would you like it if 
the MPAA argued "dvd burners are often used to make pirate copies, let's 
make it so that they won't burn anything without being given a special 
key"?)
and arguing that the LSM is only used by out-of-tree modules and then 
strenuously opposing mergeing of such modules means that one of your 
arguments is bogus
David Lang

> Chris has already agreed to take the patch:
> http://lkml.org/lkml/2007/6/24/152
>
>
> > aww man, you passed over an opportunity to fix vast amounts of coding style
> > cruftiness.
> GregKH-esque :-)
>
> > <does whizzy things>
> >
> > Here you go..
> Thanks.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/