linux-kernel - Re: [PATCH RESEND net-next] ipv6: provide Kconfig switch to disable accept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 17 Apr 2018 15:05:39 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     mschiffer@...verse-factory.net
Cc:     netdev@...r.kernel.org, kuznet@....inr.ac.ru,
        yoshfuji@...ux-ipv6.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND net-next] ipv6: provide Kconfig switch to
 disable accept_ra by default

From: Matthias Schiffer <mschiffer@...verse-factory.net>
Date: Tue, 17 Apr 2018 12:04:50 +0200

> Many distributions and users prefer to handle router advertisements in
> userspace; one example is OpenWrt, which includes a combined RA and DHCPv6
> client. For such configurations, accept_ra should not be enabled by
> default.
> 
> As setting net.ipv6.conf.default.accept_ra via sysctl.conf or similar
> facilities may be too late to catch all interfaces and common sysctl.conf
> tools do not allow setting an option for all existing interfaces, this
> patch provides a Kconfig option to control the default value of
> default.accept_ra.
> 
> Using default.accept_ra is preferable to all.accept_ra for our usecase,
> as disabling all.accept_ra would preclude users from explicitly enabling
> accept_ra on individual interfaces.
> 
> Signed-off-by: Matthias Schiffer <mschiffer@...verse-factory.net>

This kind of Kconfig option makes an irreversible behavior choice at
compile time, which satisfies one set of users whilst completely
precluding another set.

So no matter what setting a distribution chooses, one set of users are
basically out of luck.

For that reason I consider this a poor approach.

I hate module options, but at least with that the user can choose
regardless of what the distribution maker decided to do with their
kernel.

This is essentially how we handle "disable_ipv6"

I'm not applying this, because it is as much of a step backwards as
it is a step forward, sorry.