Re: [PATCH try #3] security: Convert LSM into a static interface

david
2007-07-19T03:42:53Z

On Wed, 18 Jul 2007, James Morris wrote:

>
> On Wed, 18 Jul 2007, Andrew Morton wrote:
>
>>> The SECURITY_FRAMEWORK_VERSION macro has also been removed.
>>
>> I'd like to understand who is (or claims to be) adversely affected by this
>> change, and what their complaints (if any) will be.
>>
>> Because I prefer my flamewars pre- rather than post-merge.
>
> This was already discussed and resolved during previous postings of the
> patch.
>
> In a nutshell, there is no safe way to unload an LSM. The modular
> interface is thus unecessary and broken infrastructure. It is used only
> by out-of-tree modules, which are often binary-only, illegal, abusive of
> the API and dangerous, e.g. silently re-vectoring SELinux.

there's a difference between 'often' and 'always'. I really don't think
you want to start that sort of argument (after all, would you like it if
the MPAA argued "dvd burners are often used to make pirate copies, let's
make it so that they won't burn anything without being given a special
key"?)

and arguing that the LSM is only used by out-of-tree modules and then
strenuously opposing mergeing of such modules means that one of your
arguments is bogus

David Lang

> Chris has already agreed to take the patch:
> http://lkml.org/lkml/2007/6/24/152
>
>
>> aww man, you passed over an opportunity to fix vast amounts of coding style
>> cruftiness.
>
> GregKH-esque :-)
>
>> <does whizzy things>
>>
>> Here you go..
>
> Thanks.
>
>
>