Restricting automatic kernel-module loading [LWN.net]

Restricting automatic kernel-module loading

Posted Dec 4, 2017 21:43 UTC (Mon) by simcop2387 (subscriber, #101710)
In reply to: Restricting automatic kernel-module loading by edeloget
Parent article: Restricting automatic kernel-module loading

I think he's proposing that we add another bit of information. The last kernel version that this module had changes in.

to post comments

Restricting automatic kernel-module loading

Posted Dec 4, 2017 21:53 UTC (Mon) by gutschke (subscriber, #27910) [Link] (3 responses)

That's exactly right. It would be a manually maintained field. It doesn't *technically* require that this is the last time the source has changed. But it would be the last time a maintainer re-affirmed that the module is still actively maintained. Frequently, that would go hand-in-hand with making source code changes. But it doesn't have to.

Similarly, it is possible for somebody to change the source code (e.g. to make adjustments for kernel-wide API changes) without asserting the responsibility of a full-time committed maintainer. In that case, they would not bump up the version number.

The important part is that this number would never be changed automatically. It is always a conscious decision by a human developer.

Restricting automatic kernel-module loading

Posted Dec 4, 2017 22:05 UTC (Mon) by nix (subscriber, #2304) [Link] (1 responses)

The existing MODULE_VERSION macro shows what the fate of any such field is likely to be: rotting unnoticed even though the module *is* in fact actively maintained.

Restricting automatic kernel-module loading

Posted Dec 4, 2017 22:09 UTC (Mon) by gutschke (subscriber, #27910) [Link]

But that's OK, isn't it. The only people making use of this field are those maintainers who explicitly want to request enhanced permissions for their code.

If updating the field isn't something they can fit into their workflow, then maybe their code doesn't deserve these extra permissions. After all, it sounds as if the long-term goal would be for auto-loading to become the exception rather than the rule.

There probably would be a lengthy transition path before any of these policies would be widely and uniformly enforced anyway.

Restricting automatic kernel-module loading

Posted Dec 5, 2017 0:46 UTC (Tue) by edeloget (subscriber, #88392) [Link]

I get it.