From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sonic309-27.consmr.mail.ne1.yahoo.com (sonic309-27.consmr.mail.ne1.yahoo.com [66.163.184.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D77940244D for ; Fri, 11 Sep 2026 18:59:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.184.153 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789153199; cv=none; b=BahQyQVGZG8rT5arJxX3cOO6TZGhAXRO/oomVPGCrM3gHJ8PNNeY6DuTpMI4h6erDgXN5hhuexLAQA3vh/sS5GsVsgsya4jtIa5IoOhZQpQE4uS6aL9NKMbmkdwjTuWw2KhmHg1/M9/2vVZJEZsFY8BsGiywN/gQDxChkA8I8oI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789153199; c=relaxed/simple; bh=j2KmhlXONrKBmB8LioVo80v7kvdpDGCasJKpOD3AEpI=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=dVcVVNH0jd3Mhuu/fo7S1orwos0KtO6LVZFvT9a9jGNiCnsDpu4cB6qpbkxlV8EoSFK/xfHwKf9fZzvd6G2n1ULeI2WJk4tzVf2cyPvwehwswzg4/i6Kq8Krsf6Lo/Ez80UtFheHtiP9LUBCIMM8US9Y/yFBx+i8vyij4uKzk2Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=mtnVsO1V; arc=none smtp.client-ip=66.163.184.153 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="mtnVsO1V" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1789153195; bh=zPVAGvXA6BnDWmfJT3hQO0CB11Qqf66yZudh5n1EjA4=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From:Subject:Reply-To; b=mtnVsO1VgKbez7SKzhsZplk6k0C9XTTXVlxzDnocNXEcQseScGzBI7NWgOkXr4UILYLp6xbh3FIHjwLdF+94WxMDb6ujNlEcAFFKECqG920WYAFTuiITuNW7RthvaIhN2AGu1tuq2GVpBfCumq35u7066l2/TlrAMDkZmZlUvAigViqjupi7aBGwM9ZfIWBkvefsp7nBcyrkSTSqOsa7ztb5+NPXMFhRnRdMy9gfukC2ZSMaXT2zEFTPBCWkqYo2lirWEQBy5QRK0sCqVkOeCrTj8u7fNeZOIN/CP0VXPWlqAHIOyz7yk4QRsYpt/9dz6e+97O94sev9f7/GzTpfMA== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1789153195; bh=8D6wX+F6GVfY3825euMFl9WpyXMjynR9Yldv18g8cqJ=; h=X-Sonic-MF:Date:Subject:To:From:From:Subject; b=bu4h9TPqgz2/xWApTNwcDeX3xsfNIFng8n/Rtz3yUlQCrPCz+m2kDMyd3M9a6Pms/kzWOPV43nupzqMml3jzOYsaiLLPly+AkpJFunibZo005zZSyijIaAunEVowe0JkVkRQWqOp3EyjFNwnYUBwktLOD74qKN3sUJjX3iT+AbTuQVUXuxCWnSHC8A/cGDFK6WSahfUHLR5Es1J3SpdWDOemGlmdMRQbZ7mhtYCUeOSYpeLQzl3jnYI9DzlW5RN8oiwsfwkf4cKnC3dFl7o/M6y2kWAU4NLhB44efnNs/WkreEBGwafOavMDhpRceTX4GcgwwjSW0pqGP8TqOam0tQ== X-YMail-OSG: 8IyxdVsVM1mOeDHP02iAS1e9vux4wp6Hm34349yjZZrE7KsVj4bJUTR76BW4BsK t19TLIIWTyEsL_xO6KYI6B3mIpTeWkCM7DlTvfoOQfuCsksf_DXfrnK4xY9kwKnB_FwtGMbXBVdX AwHEtPMyDd0o.V_n5VGZNusTss9eVCLkYUnExyioYPyx.Ad4XLy1Yhw66DZ6.cR7ayiSRijYW.xl 305XtUrCNu_HX0zlFhl1UhhhGTmHJWDT71o9fTQtscG7_EeuKRlbSitXpH3h2TWZBa1RvmugXEHt NXIrMOJrZi6l.PxmX8gxMKPF7q1N60fwVrVibI3BInE.6oUKBezs64Ge8lnfaH6urMLx_mS7NELj fXVYAq93FCVN6TNK0NO4G.DDrLjcDRa6hhwWgZ6gQzEbJo2rpUwMXusCpi7RZb5Xl3sf4c2Idq5Z 0YImN5yN2Urf87vmiFS8KvS6LQ8PAxxZyfXHUJ3TEbGILnbZXPD5AE_DFX2IpeDORzsdcSFaaNsu PJkDjGDNOOvznQ5FlWaMAh4HXH3i3.mQ0coMj6GUf4QwkG4eANVdkaMTdWJZeTV84xjq7hqr6XKn o1scllR7Z5GUkeTy8KNCbUrtqv5E7kUADSyywm2a.wUqCoxo5Q3A_YP0K0NZvpEKIs__FnlhdUI. q6m1Q09A2eYBeXmEIYZVeEkeB6sdw07Xxs8UUJuHZE0QHuKHXMrXD_xXTsGItQCvTPP8CDbX0kKe ImJUDil.4vy3ev72uHxHJEEWTnnuXYA_JydfBvosMnQg1N3bxdnWSWbU2Hkt3TqOn6I.FzGn6QG_ wsFBAfZcXdPDj4v8n_Tn.11J7xLNj.C3Aoi_G63Dg8IjAO6.e7VyY4IIR7JohfOWwH7InWSPpd09 L29Cgia4I5UJL8gTvOEtfAvKgJVnNCz.yi5pOsZY4j1II_vQDkb6oXyLuPEDAyPzDAFFnOiaNrKy x__Q1X.5B_1hlU32VDdlR0ZzLRLA1TJ22OXVHP7afTQZ2CEoO7JYf46la6agBDr8b5v6ACnNyYi0 GhQZCLFp11jCoUSoTlX.swZ.VjvjiKiFxK1Ye.Y6beRQedZ1ShvRS3cGHZHLn0swNHUkffkG9fb3 wOfjV.FBc9wUaDKFQWfxyDbjXO0IH0ejj1F4V87qTPUt2sRlRHwco_cjX6g8TQk3W1CWHZtJA8Pg tO3nnFPJrvQPKZpn49aFsX1c5K2ek4fcHTXgnHk4H1.HrFvV3xEMDEis4jnnSAlsgA8Rm6LvLdIz lUg33b0GLbxZzg0mpAIxtqrcQSofu5UyShBm.JhuDp9auiAWoHUZSz0qhhAGEt_GOhTOREfqCBZC G6fI4Yi.C177vKFVtiV63RCPKV3rxhhPlhyBZpV1ZUxEcqMjslksyvWTd6aT7vgXecZzbEB6Bbui PugKq5FvUYO.LajsfrgW6MxwegEMCwQHnJMQsa2Iiv_WjPIMQuqDSEH9zrUbp_k8Xt_MeBiTqXQs nXvD7ppdbgFMJjhFv1sbwFcotEUmdosnZNJTFj_.B9RbrhQTms0KTlTxt_kE8.NgiydL256Tokh1 HbALEC9RtboqkogXmLNqhc9AtDZczzRhCNRn7Z2X3503NCMm88agdrjLobSs1H5d7xBdfXfFzDWy Nz0tAs4FjfupGpoHER0xGTafNDNwQhDzAsAi3Ns1zjs3AtY5PvuGfAWSa8fMSFBU03tXksZYFxo1 ciJ0G1CvL1rd97I47QzrDWZ_28XKoUL8AUG1lo9hZdautcKmTjHBsHXCLAZuNOQ3VbTsaUcfqmee .irw7XZlKDpogx7TQrdIKjc686.9W3GLbec8PuplPYGKvHJJhuSP9jlcnM383VDSt8cLbmPuXq9q UfjAsSbY4zvrKu6HdDJcxvB8cx34WFQXftbm93mMXhuwnptgfKF5CDKWcQBHwqRHYsXSxAFpKM8S qTa3rFjIKqr1IO0XflZkb9XFSArGJix7oo_Xxz5tbTfxDmTZDSh6g_DFbDgKseITvTHLKJIf.Srg zVnCjD4ejDk1_J0rl97idNrtwcyBVrtsm8.34xwlrjrR25Rurg9citobqWcZ.BDfjnhc_fKhZQyb r8KhLp1zYO8PYT1BKGbEHUeMHroTq.j3oed5iHJ6xgxNJfL4MoCriV4lpnAthSrrU4GyoV4x2VqX oF_R8TC4LfHd6y98CdJloF.SZ2BtSQy89uStonDjpuGCXoEaZ98PKpIPceNx_hW37SyYRbmrBaKQ gu6._.5jHmTHesUwGqpIpKbbNaYhF7Q3yiS79YqO5LS7oubsSfX7dqeASC8h1m47H6U5NdATLY3r Y73pK8ITPNSGyICENKhMFqA-- X-Sonic-MF: X-Sonic-ID: 155296a8-f4ef-4124-9fbd-d64e0f082663 Received: from sonic.gate.mail.ne1.yahoo.com by sonic309.consmr.mail.ne1.yahoo.com with HTTP; Fri, 11 Sep 2026 18:59:55 +0000 Received: by hermes--production-gq1-678d9dd684-n95jq (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 54d69622036feeec9e5203b92a9973ac; Fri, 11 Sep 2026 18:59:50 +0000 (UTC) Message-ID: <6f01eff3-20c9-488b-84f4-8c6456f2e54d@schaufler-ca.com> Date: Fri, 11 Sep 2026 11:59:47 -0700 Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 01/13 net-next] net: ipv4: introduce CONFIG_IPV4 to decouple the IPv4 stack To: Fernando Fernandez Mancera , netdev@vger.kernel.org Cc: horms@kernel.org, kuba@kernel.org, pabeni@redhat.com, edumazet@google.com, davem@davemloft.net, Jason Gunthorpe , Leon Romanovsky , Andrew Lunn , Tony Nguyen , Przemek Kitszel , Elad Nachman , Saeed Mahameed , Tariq Toukan , Mark Bloch , Ido Schimmel , Petr Machata , Edward Cree , Maxime Chevallier , Maxime Coquelin , Alexandre Torgue , Arend van Spriel , Miri Korenblit , Keith Busch , Jens Axboe , Christoph Hellwig , Sagi Grimberg , Chaitanya Kulkarni , Saurav Kashyap , Javed Hasan , GR-QLogic-Storage-Upstream@marvell.com, "James E.J. Bottomley" , "Martin K. Petersen" , Nilesh Javali , Manish Rangankar , Varun Prakash , Alexander Viro , Christian Brauner , Jan Kara , David Howells , Marc Dionne , Trond Myklebust , Anna Schumaker , Chuck Lever , Jeff Layton , NeilBrown , Olga Kornievskaia , Dai Ngo , Tom Talpey , Marek Lindner , Simon Wunderlich , Antonio Quartulli , Sven Eckelmann , Nikolay Aleksandrov , Pablo Neira Ayuso , Florian Westphal , Phil Sutter , Johannes Berg , Matthieu Baerts , Mat Martineau , Geliang Tang , Julian Anastasov , Aaron Conole , Eelco Chaudron , Ilya Maximets , Allison Henderson , Jamal Hadi Salim , Jiri Pirko , Marcelo Ricardo Leitner , Xin Long , "D. Wythe" , Dust Li , Sidraya Jayagond , Mahanta Jambigi , Tony Lu , Wen Gu , Jon Maloy , Tung Quang Nguyen , Steffen Klassert , Herbert Xu , Paul Moore , James Morris , "Serge E. Hallyn" , Vikas Gupta , Bhargava Marreddy , Rajashekar Hudumula , Nicolai Buchwitz , =?UTF-8?Q?Markus_Bl=C3=B6chl?= , Arnd Bergmann , Heiner Kallweit , Florian Fainelli , Krzysztof Kozlowski , Qingfang Deng , Julian Braha , Ethan Nelson-Moore , Greg Kroah-Hartman , Eric Biggers , Ard Biesheuvel , Neal Cardwell , Kuniyuki Iwashima , Willem de Bruijn , Alyssa Ross , Joel Granados , Oleg Nesterov , linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, intel-wired-lan@lists.osuosl.org, oss-drivers@corigine.com, linux-net-drivers@amd.com, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-wireless@vger.kernel.org, brcm80211@lists.linux.dev, brcm80211-dev-list.pdl@broadcom.com, linux-nvme@lists.infradead.org, linux-scsi@vger.kernel.org, target-devel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-afs@lists.infradead.org, linux-nfs@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org, bridge@lists.linux.dev, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, mptcp@lists.linux.dev, lvs-devel@vger.kernel.org, dev@openvswitch.org, rds-devel@oss.oracle.com, linux-sctp@vger.kernel.org, linux-s390@vger.kernel.org, tipc-discussion@lists.sourceforge.net, linux-security-module@vger.kernel.org, Casey Schaufler References: <20260910144914.8025-1-fmancera@suse.de> <20260910144914.8025-2-fmancera@suse.de> Content-Language: en-US From: Casey Schaufler In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Mailer: WebService/1.1.26525 mail.backend.jedi.jws.acl:role.jedi.acl.token.atz.jws.hermes.yahoo On 9/11/2026 11:31 AM, Fernando Fernandez Mancera wrote: > On 9/11/26 7:46 PM, Casey Schaufler wrote: >> On 9/10/2026 7:48 AM, Fernando Fernandez Mancera wrote: >>> Historically, the IPv4 protocol has been linked to the core INET >>> subsystem. Because shared infrastructure like the TCP/UDP engine, >>> routing or INET hashtables live inside net/ipv4/, it has been >>> impossible >>> to compile a kernel with only IPv6 support. >>> >>> This patch introduces the CONFIG_IPV4 Kconfig symbol, which is set to >>> 'def_bool y' for now. This does not allow to completely disable the >>> IPv4 stack yet but it lays the necessary build-system work for that >>> goal. >>> >>> In addition, multiple subsystems Kconfig symbols across networking >>> features like tunnels, drivers and filesystems have been adjusted to >>> depend on IPv4. Keep on mind that follow-up work is required to convert >>> the Kconfig symbol to bool and remove the dependency on IPv4 where it >>> makes sense. >>> >>> Signed-off-by: Fernando Fernandez Mancera >>> --- >>>   >> >> ... >> >> >>>   security/smack/Kconfig                        |  1 + >>>   54 files changed, 126 insertions(+), 66 deletions(-) >>> >> ... >> >>> diff --git a/security/smack/Kconfig b/security/smack/Kconfig >>> index 5a8dfad469c3..b4e6d0168bd1 100644 >>> --- a/security/smack/Kconfig >>> +++ b/security/smack/Kconfig >>> @@ -3,6 +3,7 @@ config SECURITY_SMACK >>>       bool "Simplified Mandatory Access Control Kernel Support" >>>       depends on NET >>>       depends on INET >>> +    depends on IPV4 >>>       depends on SECURITY >>>       select NETLABEL >>>       select SECURITY_NETWORK >> >> Why would this make sense? You're introducing the capability to use >> IP6 by itself, which is admirable, but you're disallowing that >> configuration >> with the Smack LSM. It appears that you've done a mechanical lookup >> in the >> Kconfig files and applied the minimal change to make the kernel compile, >> which probably works for most cases. It does not work for Smack. Unless >> there's a strong argument that Smack with IPv6 and without IPv4 is >> and always >> will be a pointless configuration you have my NAK. >> >> > > Right, that was kind of the point. The idea was to be able to compile > core networking without IPv4. There are still plenty of modules that > depends on IPv4. It does not mean that they will remain like that > forever as I mentioned my idea was a follow-up on the series to avoid > having a too long series. > > Anyway, I can make Smack to do not depend on IPv4 on this series if > that could grant an ACK. Yes, that would be acceptable. I apologize in advance for the Smack IPv6 implementation. Replacing it with a proper CALIPSO stack has been on the todo list since CALIPSO was introduced. > > Thanks, > Fernando. >