lkml.org 
[lkml]   [2008]   [Jul]   [21]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
DateMon, 21 Jul 2008 10:40:24 -0700 (PDT)
FromLinus Torvalds <>
SubjectRe: [GIT]: Networking

On Mon, 21 Jul 2008, David Miller wrote:

> From: Patrick McHardy <kaber@trash.net>
> Date: Mon, 21 Jul 2008 14:05:57 +0200
> 
> > The idea was that NETFILTER_ADVANCED=n enables everything needed
> > by mainstream distributions and hides the rest. We can certainly
> > change the default for this option, but that makes NETFILTER_ADVANCED
> > pretty much useless.
> 
> A new feature cannot possibly be used by existing distributions.  I
> think that's the main gripe.

Well, if the feature really is going to be something that a _normal_ 
netfilter config needs, then it should indeed be turned on.

However, nothing in the docs imply that at all. Can you explain? Why 
should IP_NF_SECURITY be on, and why should a default netfilter table 
enable it? And if it should, WHY THE HELL IS IT DOCUMENTED THAT YOU SHOULD 
SAY 'N'?

Patrick, see my original report:

> Grr. And I quote:
> 
>         Security table (IP_NF_SECURITY) [Y/n/?] (NEW) ?
> 
>       This option adds a `security' table to iptables, for use
>       with Mandatory Access Control (MAC) policy.
> 
>       If unsure, say N.


That option as it stands now MAKES NO SENSE. Either you should say 'Y' 
(and you should explain _why_), or you should say 'N' (as documented) and 
it should damn well default to 'N' too!

		Linus


\
 
 \ /
  Last update: 2008-07-21 19:43    [from the cache]
©2003-2008