Re: Use of Kernel Headers

[Jim Gifford <maillist@jg555.com>]

Henrik Nordstrom wrote:

> On Tue, 17 Aug 2004, Jim Gifford wrote:
>
>> It has been stated numerous times that userspace programs should not 
>> be compiled against raw kernel headers, but iptables does compile 
>> against userspace headers and breaks this rule. With the advent of 
>> the linux-libc-headers package, should iptables be compiled against 
>> the linux-libc-headers or the raw kernel headers since iptables is a 
>> user space program?
>
>
> This depends on if you build iptables for your custom patched kernel 
> or a standard kernel.
>
> For a standard kernel it should be sufficient with linux-libc-headers 
> I think, but it is possible some required linux iptables headers is 
> missing from the iptables package (include/linux/netfilter_ipv[46]/). 
> If you find some missing please report here which files needs to be 
> added from the kernel tree and maybe it can be cleaned up.
>
>> Should patch-o-matic update the headers in the proper location, 
>> /usr/include/linux/netfilter_ipv4 etc?
>
>
> patch-o-matic should always update the kernel source tree and your 
> iptables should then be built to this source tree. This to make sure 
> the view of iptables and your kernel matches. But to be honest it 
> should only be the include/linux/netfilter_ipv[46]/ directories which 
> is required by iptables.
>
> Regards
> Henrik
>
Ok so we build iptables against the linux-libc-headers, then we then use 
patch-o-matic-ng to add new support for psd(insert you own example). But 
iptables is set to compile using the linux-libc-headers, won't the 
compile fail since it can't find ipt_psd.h in the linux-libc-headers.

If patch-o-matic changes a header, it should also check 
/usr/include/linux/netfilter{whatever} and patch that file also so they 
are insync with each other. Which presents a headache since the 
linux-libc-headers are only released when a new release is out. Unless 
you check the version.h file that comes with linux-libc-headers and 
verfiy the value of  LIBC_HEADERS_VERSION.

So it's a double edge sword the way I see it.

-- 
----
Jim Gifford
maillist@jg555.com