linux-kernel - Re: GPLv3 Position Statement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	29 Sep 2006 12:59:42 +0100
From:	Sanjoy Mahajan <sanjoy@...o.cam.ac.uk>
To:	James Bottomley <James.Bottomley@...elEye.com>
CC:	Neil Brown <neilb@...e.de>, tridge@...ba.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: GPLv3 Position Statement

James Bottomley <James.Bottomley@...elEye.com> writes:
> I'm asserting that producing something (an appliance say, or a PCI
> card) that runs linux to achieve its function is a "use" (an act of
> running the program) within the meaning of GPLv2 clause 0.  Selling
> the Box (or card, or whatever) also becomes a distribution.

The vendor did many acts covered by copyright law (taking US copyright
law here), and it's important to distinguish the effects of the
license on each act:

1. Use: Vendor runs Linux on prototype hardware to see where it fails
   to boot, in order to write new drivers.  The GPL places no
   restriction on this act, and probably cannot do so since US
   copyright law doesn't cover running a program.

2. Prepare a derivative work: Vendor writes drivers for their
   hardware, builds a new Linux kernel.  The GPLv2 places no
   restriction on this act.  The GPLv3 restricts this act a bit in the
   patent retaliation clause.

3. Use the derivative work: Vendor tests (runs) the modified Linux.
   There are no restrictions placed by the GPL (v2 or v3).  If you can
   make the derivative work (e.g. don't fall foul of the
   patent-retaliation clause in GPLv3), then you can use it how you
   want.

4. Distribute the derivative work: Vendor sells the hardware with
   embedded Linux.  Now the GPL places restrictions.  v2 says that if
   you distribute, you must make source code available and (if I
   understand Alan Cox's argument correctly) make the installation
   keys available.  v3 tightens the installation-keys requirement.
   But it's not a use restriction.

> However I claim that, the GPLv3 requirement that you be able to "execute
> modified versions from source code in the recommended or principal
> context of use" does constitute an end use restriction on the embedded
> system because the appliance (or card, or whatever) must be designed in
> such a way as to allow this.

Not necessarily.  If the vendor makes devices for internal use, they
are not distributing the kernel, so no GPL requirements (except
perhaps the GPLv3 patent retaliation clause) are triggered.  Only when
they distribute does the GPL place requirements on what they must do:
provide source code and installation keys.  So it's not the use that
is restricted (they can do what they like 'at home'), only the
distribution.

Regards,
-Sanjoy

`Never underestimate the evil of which men of power are capable.'
         --Bertrand Russell, _War Crimes in Vietnam_, chapter 1.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/