Re: Out of tree module using LSM

[Crispin Cowan <crispin@crispincowan.com>]

James Morris wrote:
> On Fri, 30 Nov 2007, Crispin Cowan wrote:
>> restored faces a lot of challenges, but I hope that some kind of
>> solution can be found, because the alternative is to effectively force
>> vendors like Sophos to do it the "dirty" way by fishing in memory for
>> the syscall table.
>>     
> I don't think this is quite correct.
>
> The alternative is to engage with the kernel community to become part of 
> the development process, to ensure that appropriate APIs are implemented, 
> and to get code upstream before shipping it.
>   
That would be part of the "some kind of solution can be found" so I
think we are in agreement here.

> In any case, a patch to revert the dynamic aspect of LSM has been posted 
> by Arjan (and acked by myself) for the case of valid out of tree users.  
> The only case of this so far has been Multiadm, although there seems to be 
> no reason for it to stay out of tree.
>   
Dazuko. It has the same yucky code issues as Talpa, but AFAIK is pure
GPL2 and thus is clean on the license issues.

That these modules are valid modules that users want to use, are GPL
clean, and are *not* something LKML wants to upstream because of code
issues, is precisely why the LSM interface makes sense.

Crispin

-- 
Crispin Cowan, Ph.D.               http://crispincowan.com/~crispin
CEO, Mercenary Linux		   http://mercenarylinux.com/
	       Itanium. Vista. GPLv3. Complexity at work