netdev - Re: [PATCH] bridge: make bridge-nf-call-*tables default configurable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 01 Jul 2009 12:51:06 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Mark McLoughlin <markmc@...hat.com>
CC:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
	herbert@...dor.apana.org.au
Subject: Re: [PATCH] bridge: make bridge-nf-call-*tables default configurable

Mark McLoughlin wrote:
> On Tue, 2009-06-30 at 20:16 -0700, David Miller wrote:
>> From: Mark McLoughlin <markmc@...hat.com>
>> Date: Tue, 30 Jun 2009 17:27:47 +0100
>>
>>> For these reasons, it makes sense to allow distributions to disable
>>> netfilter on the bridge by default and require those specialized users
>>> to enable it explicitly via sysctl.
>> I heard that distributions ship some file, what's it called...
>> something like /etc/sysctl.conf :-)
>>
>> Really, if someone thinkgs the default stinks and dists don't like it
>> for their users, they can use sysctl.conf to set it how they please.
> 
> If upstream agrees the default stinks, then upstream could start making
> moves towards rectifying it :-)
> 
> I like Patrick's idea of adding it to feature-removal-schedule
> 
>> Notwithstanding that changing this default can break working
>> setups and scripts.  Yes they can "change", but they were just
>> (rightly) using the kernel as it came to them.
> 
> Yep, that's a valid concern.
> 
> Weighing up the impact on the small number of people who use it versus
> the ongoing impact on everyone else, I think it's best to make the
> change.

I agree, this has already caused an endless amount of problems for
users due to the unexpected behaviour and, in some cases, bugs.

Dave's point is certainly valid as well, until we change the defaults,
distributions can use sysctl.conf. But I think we should move towards
changing the defaults.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html