Messages in this thread |  | | | Date | Wed, 10 Oct 2007 08:40:31 -0700 | | From | Randy Dunlap <> | | Subject | Re: [PATCH 1/6] SELinux: change Kconfig to use select instead of depends |
| |
Stephen Smalley wrote: > On Tue, 2007-10-09 at 16:28 -0700, Randy Dunlap wrote: >> On Wed, 10 Oct 2007 09:19:55 +1000 (EST) James Morris wrote: >> >>> From: Eric Paris <eparis@redhat.com> >>> >>> Changes the security/selinux/Kconfig to use select instead of depends >>> for most of the SELinux requirements. This allows the SELinux option to >>> show up when people do a make config without already knowing they had to >>> enable audit and other non-obvious choices. Added a depends on SECURITY >>> (which previously existed through SECURITY_NETWORK) so that SELinux >>> would not always show up, but would be easy and intuitive to find. >>> >>> Signed-off-by: Eric Paris <eparis@redhat.com> >>> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> >>> Signed-off-by: James Morris <jmorris@e.namei> >>> --- >>> security/selinux/Kconfig | 7 ++++++- >>> 1 files changed, 6 insertions(+), 1 deletions(-) >>> >>> diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig >>> index b32a459..40b97e6 100644 >>> --- a/security/selinux/Kconfig >>> +++ b/security/selinux/Kconfig >>> @@ -1,6 +1,10 @@ >>> config SECURITY_SELINUX >>> bool "NSA SELinux Support" >>> - depends on SECURITY_NETWORK && AUDIT && NET && INET >>> + depends on SECURITY >>> + select SECURITY_NETWORK >>> + select AUDIT >>> + select NET >>> + select INET >>> select NETWORK_SECMARK >>> default n >>> help >> I doth protest. Enabling the entire NET subsystem thru a hidden >> select is awful. Select should be used (sparingly) to enable >> library code only. If someone wants NET enabled, they should >> enable it overtly, not covertly. > > Does that apply to all the options, or only to NET (e.g. is it ok to > select AUDIT)? I thought that this patch came out of earlier > discussions about proper use of select vs. depends. It may have gone > too far, but I'm not sure it should be discarded entirely.
AUDIT isn't quite library code, still I don't have a (big) problem with selecting it or NETWORK_SECMARK. (other than select is evil :)
OTOH, NET and INET are large config options, not library-like code, and should not be selected.
-- ~Randy - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |