netdev - Re: [PATCH bpf-next] libbpf: relicense bpf_helpers.h and bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190816221025.239e9e94@carbon>
Date:   Fri, 16 Aug 2019 22:10:25 +0200
From:   Jesper Dangaard Brouer <brouer@...hat.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andriin@...com>, bpf@...r.kernel.org,
        netdev@...r.kernel.org, andrii.nakryiko@...il.com,
        kernel-team@...com, Michael Holzheu <holzheu@...ux.vnet.ibm.com>,
        "Naveen N . Rao" <naveen.n.rao@...ux.vnet.ibm.com>,
        "David S . Miller" <davem@...emloft.net>,
        Michal Rostecki <mrostecki@...nsuse.org>,
        John Fastabend <john.fastabend@...il.com>,
        Sargun Dhillon <sargun@...gun.me>, brouer@...hat.com
Subject: Re: [PATCH bpf-next] libbpf: relicense bpf_helpers.h and
 bpf_endian.h

On Fri, 16 Aug 2019 19:15:29 +0200
Greg KH <gregkh@...uxfoundation.org> wrote:

> On Fri, Aug 16, 2019 at 05:29:27PM +0200, Daniel Borkmann wrote:
> > On 8/16/19 2:10 PM, Jesper Dangaard Brouer wrote:  
> > > On Thu, 15 Aug 2019 22:45:43 -0700
> > > Andrii Nakryiko <andriin@...com> wrote:
> > >   
> > > > bpf_helpers.h and bpf_endian.h contain useful macros and BPF helper
> > > > definitions essential to almost every BPF program. Which makes them
> > > > useful not just for selftests. To be able to expose them as part of
> > > > libbpf, though, we need them to be dual-licensed as LGPL-2.1 OR
> > > > BSD-2-Clause. This patch updates licensing of those two files.  
> > > 
> > > I've already ACKed this, and is fine with (LGPL-2.1 OR BSD-2-Clause).
> > > 
> > > I just want to understand, why "BSD-2-Clause" and not "Apache-2.0" ?
> > > 
> > > The original argument was that this needed to be compatible with
> > > "Apache-2.0", then why not simply add this in the "OR" ?  
> > 
> > It's use is discouraged in the kernel tree, see also LICENSES/dual/Apache-2.0 (below) and
> > statement wrt compatibility from https://www.apache.org/licenses/GPL-compatibility.html:
> > 
> >   Valid-License-Identifier: Apache-2.0
> >   SPDX-URL: https://spdx.org/licenses/Apache-2.0.html
> >   Usage-Guide:
> >     Do NOT use. The Apache-2.0 is not GPL2 compatible. [...]  

You didn't quote the continuation from LICENSES/dual/Apache-2.0

Usage-Guide:
  Do NOT use. The Apache-2.0 is not GPL2 compatible. It may only be used
  for dual-licensed files where the other license is GPL2 compatible.
  If you end up using this it MUST be used together with a GPL2 compatible
  license using "OR".

The way I read it, is that you can use it with "OR", like:
 SPDX-License-Identifier: GPL-2.0 OR Apache-2.0

> That is correct, don't use Apache-2 code in the kernel please.  Even as
> a dual-license, it's a total mess.

Good, I just wanted to understand why.  

> Having this be BSD-2 is actually better, as it should be fine to use
> with Apache 2 code, right?

Yes, that is also my understanding. And it better be as this is needed,
as we want libbpf to be used by https://github.com/iovisor/bcc/ which
is Apache-2.0.

> Jesper, do you know of any license that BSD-2 is not compatible with
> that is needed?

No.

-- 
Best regards,
  Jesper Dangaard Brouer
  MSc.CS, Principal Kernel Engineer at Red Hat
  LinkedIn: http://www.linkedin.com/in/brouer