Re: Proposal: Disable autoload of compat_xyz modules

[Maxime Villard <max%m00nbsd.net@localhost>]

Le 02/08/2017 à 20:02, Taylor R Campbell a écrit :
> > Date: Wed, 2 Aug 2017 16:11:16 +0000
> > From: maya%netbsd.org@localhost
> >
> > I can 'cd pkgsrc/www/opera; make install; opera' and get a closed source
> > browser that works as is, without even realizing it relies on
> > COMPAT_LINUX to work.
>
> % cd www/opera && bmake package
> ERROR: This package has set PKG_FAIL_REASON:
> ERROR: opera-12.16 has an unacceptable license condition:
> ERROR:     opera-1200-license
> ERROR: You can mark the license ``opera-1200-license'' as acceptable by adding
> ERROR:     ACCEPTABLE_LICENSES+= opera-1200-license
> ERROR: to /home/riastradh/pkgsrc/current/pkg/etc/mk.conf or by adding
> ERROR:     ACCEPTABLE_LICENSES= opera-1200-license
> ERROR: to /home/riastradh/pkgsrc/current/pkg/etc/pkg_install.conf.
> ERROR: The following command will show you the license text:
> ERROR:     /home/riastradh/pkgsrc/current/pkg/bin/bmake show-license
>
> > Unless some miracle happens, NetBSD will remain an esoteric operating
> > system, and we won't have many closed source programs if any. A fairly
> > small amount of code gives us access to a large number of programs that
> > we would otherwise not have access to.
>
> I'm not proposing removing the code.  Just having a knob to turn it on
> before you're exposed to its attack surface.
>
> But it sounds like there are a number of people who want compat_linux
> to remain enabled, and of the compat modules I expect it is the best-
> maintained, so I will withdraw the proposal to disable it by default.

I disagree. The cost of doing a modload is low enough compared to the
configuration needed to use compat_linux. Just like the command you quoted.

People who regularly use compat_linux can modify /etc/modules.conf, and will
never have to worry about it anymore. They may have to worry about the
potential vulnerabilities in it, but what's more important, is that those who
do not use compat_linux (still a majority of people) don't.