Messages in this thread | | | Date | Thu, 20 Apr 2006 08:00:37 -0700 | From | Greg KH <> | Subject | Removing EXPORT_SYMBOL(security_ops) (was Re: Time to remove LSM) |
| |
On Thu, Apr 20, 2006 at 08:39:51AM -0400, Stephen Smalley wrote: > On Wed, 2006-04-19 at 11:10 -0700, Greg KH wrote: > > On Wed, Apr 19, 2006 at 12:33:24PM -0400, James Morris wrote: > > > The LSM interface is also being abused by several proprietary kernel > > > modules, some of which are not even security related. In one case, > > > there's code which dangerously revectors SELinux with a shim layer > > > designed to try and bypass the GPL. Some of this is a response to > > > unexporting the syscall table, where projects which abused that have now > > > switched to LSM. > > > > I agree that this is happening today. Which makes me wonder, why is the > > variable "security_ops" exported through "EXPORT_SYMBOL()" and not > > "EXPORT_SYMBOL_GPL()"? It seems that people are taking advantage of > > this and changing it would help slow them down a bit. > > > > Chris, would you take a patch to change this? > > Seems like a rather weak mechanism. Compared to eliminating > security_ops altogether.
I agree. In looking over the code some more, I'm trying to figure out why we are exporting that variable at all. Is it because of people wanting to stack security modules?
I see selinux code using it, but you are always built into the kernel, right? So unexporting it would not be an issue to you.
Tony, would AppArmor have problems if we don't export that variable anymore?
thanks,
greg k-h - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |