[lkml]   [2010]   [Nov]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH RFC] Restrictions on module loading

    > NAK - Its a long standing ABI.

    As far as I can tell, modules_disabled was first included in 2.6.31, so
    it's hardly what I'd call "long standing". However, I see your point -
    it's definitely not my intention to surprise anyone by changing security
    features out from under them.

    I do think merging the features makes sense in this case. I'll rework
    this to keep the "modules_disabled" name, where a value of "0" means
    default behavior, a value of "1" means no loading or unloading (and no
    changing it back), and the new value of "2" incorporates the
    restrictions I'm intending to enforce.

    > I've no objection to modules_restrict although I doubt it'll ever get
    > used in the real world, but better to extend the meaning of the existing
    > interface, not remove stuff.

    There has been interest in improving the ease with which users can
    enforce restrictions on automatic module loading. No one is being
    forced to use it.


     \ /
      Last update: 2010-11-08 13:27    [W:0.021 / U:46.868 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site