The Linux kernel and digital rights management

In most Linux users' view, there is little intersection between this sort of digital rights management (DRM) code and free software. After all, what's to keep us from simply yanking out any code which gets in the way of what we want to do? So some people were surprised when Linus Torvalds posted a message stating "I want to make it clear that DRM is perfectly ok with Linux!"

There is, you see, a scenario where DRM software can be embedded within the Linux kernel, and there is very little that can be done about it. It is not that hard to build hardware that refuses to boot a kernel which has not been signed with a particular private key. That kernel could restrict access to devices, or refuse outright to run applications which have not also been signed with a given key. Such a kernel could take away all of the control we would otherwise have over our systems whether we like it or not. Yes, whoever distributes the kernel must provide source, but, without the private key (and, thus, the ability to create a signed, binary kernel), a Linux user cannot make changes and get them to run on the target system.

Linus gives two reasons for his position: distributing signed binaries is acceptable under the GPL, and he does not want to be in a position of saying what can or cannot be done with the Linux kernel.

The GPL argument is interesting. Anybody who distributes a GPL-licensed program in binary form must make the associated source available. That source is defined by the GPL as:

One could well question whether a private key used to sign the binary is covered by this language. Most commenters seem to think that it is not. If the GPL has nothing to say about keys, then the distribution of signed binaries (without the associated private keys) is clearly within the bounds of the license.

If a private key is considered part of the program's installation scripts, there could be a problem. Linus has stated his opinion, but he cannot speak for the others who hold copyrights on code in the kernel. One of those people could conceivably mount a legal challenge should he or she object to the signed binary distribution. Kernel hackers in general seem uninclined to make this sort of challenge, but one never knows.

Linus's other reason - not wanting to regulate what others can do with Linux - goes to the core of the philosophy of free software. Any free (or open source) software definition will include a statement that the license cannot discriminate based on the use of the software. The purpose is to exclude licenses that, say, prohibit use by the military, by people with the wrong religion, citizens of certain countries, or drinkers of light beer. Similarly, Linus does not want to discriminate against those who would only allow certain software to run on their systems.

Besides, the techniques which implement DRM can also be used to implement a higher level of security for Linux users. A system that can only run signed executables is certainly going to be more secure than one which will run any binary presented to it. Some users may well want that kind of security, and they should be able to have it. It would be difficult to allow this sort of use while simultaneously forbidding DRM uses.

Ultimately, it comes down to what people are willing to buy. In an ideal world, Linux-based systems which implement oppressive DRM schemes would languish on the shelves, while those which are better suited to the needs and wishes of their users will succeed. The sad fact is that things often do not work that way; when products like DVD players, the Xbox, or Tivo are what's available, that is what people will buy. The marketplace does not work as well as one would like in this regard. But the GPL is not the tool that can fix it.