tech-kern archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Proposal: Disable autoload of compat_xyz modules





On 3 August 2017 at 12:11, Maxime Villard <max%m00nbsd.net@localhost> wrote:
Le 03/08/2017 à 10:42, matthew green a écrit :
Otherwise it has to be balanced.

Certainly. It does not seem to me that moving compat_linux* into modules is in
any way illegitimate or unbalanced. That's the opinion I was stating.

if you want to move useful and used by a large number of users
functionality out of GENERIC and into modules then first perhaps
you should consider fixing modules.

there are a large number of basic functionality issues that no
one pushing modules has solved yet.  for a start, see lukem's
original proposal about having a kernel+modules container,
the functionality of which is a _essential_ before it's going
to be considered OK to remove standard functionality from
GENERIC.

If your argument now is that there are technical difficulties that make
switching to a module approach a complicated business, beyond the simplistic "I
don't want to type modload" stuff - which I don't agree with -, then that's a
fair point.

As I said, doing this work certainly involves, among others, finding a way to
remove the many #ifdefs spread across the tree; and having tried to do so two
years ago, I know it is a painful work.

claiming that compat_linux isn't a major piece of usability
is simply ignoring reality.

I have never claimed it is not used. It is an important feature, but it also
happens to have many places that need special care, which regularly turn out to
be exploitable. If we can reduce the attack surface and at the same time keep
the feature nearby, in a balanced way that does not impose too much burden on
the regular users, then we should do it. But that's indeed ignoring the
technical difficulties behind achieving this goal.

How about a sysctl to enable/disable any non netbsd_ compat usage.
With it off compat code in GENERIC will not be run and (non netbsd32 etc) compat modules not loaded.

David


Home | Main Index | Thread Index | Old Index