netdev - [PATCH v2] net: disable BRIDGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 19 Feb 2020 13:40:06 -0800
From:   rkir@...gle.com
To:     davem@...emloft.net, kuba@...nel.org
Cc:     rammuthiah@...gle.com, adelva@...gle.com, lfy@...gle.com,
        netdev@...r.kernel.org, Roman Kiryanov <rkir@...gle.com>
Subject: [PATCH v2] net: disable BRIDGE_NETFILTER by default

From: Roman Kiryanov <rkir@...gle.com>

The description says 'If unsure, say N.' but
the module is built as M by default (once
the dependencies are satisfied).

When the module is selected (Y or M), it enables
NETFILTER_FAMILY_BRIDGE and SKB_EXTENSIONS
which alter kernel internal structures.

We (Android Studio Emulator) currently do not
use this module and think this it is more consistent
to have it disabled by default as opposite to
disabling it explicitly to prevent enabling
NETFILTER_FAMILY_BRIDGE and SKB_EXTENSIONS.

Signed-off-by: Roman Kiryanov <rkir@...gle.com>
---
Changes in v2:
 - added cc:netdev@...r.kernel.org

 net/Kconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/Kconfig b/net/Kconfig
index b0937a700f01..2eeb0e55f7c9 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -189,7 +189,6 @@ config BRIDGE_NETFILTER
 	depends on NETFILTER_ADVANCED
 	select NETFILTER_FAMILY_BRIDGE
 	select SKB_EXTENSIONS
-	default m
 	---help---
 	  Enabling this option will let arptables resp. iptables see bridged
 	  ARP resp. IP traffic. If you want a bridging firewall, you probably
-- 
2.25.0.265.gbab2e86ba0-goog