Messages in this thread | | | Subject | Re: [PATCH try #3] security: Convert LSM into a static interface | From | Arjan van de Ven <> | Date | Thu, 19 Jul 2007 09:54:30 -0700 |
| |
> Right, the ability to boot with security.capability=disabpled (or > whatever) and then load a custom module without having to use a whole > new kernel is something I'm sure end-users want. > > Especially since compiling a kernel which works with, say, a default > fedora install, with lvm etc, is not imo for a novice (where novice > != security novice).
the next step after this patch is to have an option to get rid of all the function pointer chasing (which is expensive) for the case where you know you only want one security module (which you then can turn on or off)... that advantage is a performance gain for a lot of people.... but if the person configuring the kernel selects this, it does mean there's no way to load modules. I don't know what Fedora will do, but they might select such an option. That's CHOICE... they chose a performance improvement over enabling external kernel modules that they don't ship anyway...
but is it really worth blocking such clear improvements in performance?
-- if you want to mail me at work (you don't), use arjan (at) linux.intel.com Test the interaction between Linux and your BIOS via http://www.linuxfirmwarekit.org
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |