Re: [PATCH] remove sys_security

[Jeff Garzik <jgarzik@pobox.com>]

Andreas Steinmetz wrote:
> David S. Miller wrote:
> 
>> The more I look at LSM the more and more I dislike it, it sticks it's
>> fingers everywhere.  Who is going to use this stuff?  %99.999 of users
>> will never load a security module, and the distribution makers are
>> going to enable this NOP overhead for _everyone_ just so a few telcos
>> or government installations can get their LSM bits?
>>
> 
> I'm going to ignore the overhead stated above here. And please take the 
> following as a comment/personal opinion you may as well ignore. But I'm 
> somewhat irritated, so:
> 
> <sarcasm>
> So users are dumb in general, why not apply the "Single user linux" 
> patch? If you don't remember: http://www.surriel.com/potm/apr2001.shtml
> </sarcasm>
> 
> Honestly, if you don't offer a patchless option to tighter security you 
> can't estimate usage.
> 
> Given that LSM becomes a standard part of the kernel it would be easy 
> for distros to offer "trusted" installations based on LSM. And in this 
> case advanced security will spread.

No offense, please, but I really think David is being very reasonable.

The normal "Linux way" is to have zero overhead unless something is 
actually used -- witness spinlocks on UP versus SMP.

Regardless of whether some people feel the "majority" will be using LSM 
at some point in the future, David's point is very valid today, and for 
some time to come.

Finally, I was under the impression that Greg KH agreed that it is 
possible to eliminate this overhead?  Maybe I recall incorrectly.

Respectfully,

	Jeff