Re: [PATCH try #3] security: Convert LSM into a static interface

[Arjan van de Ven <arjan@infradead.org>]

> Right, the ability to boot with security.capability=disabpled (or
> whatever) and then load a custom module without having to use a whole
> new kernel is something I'm sure end-users want.
> 
> Especially since compiling a kernel which works with, say, a default
> fedora install, with lvm etc, is not imo for a novice (where novice
> != security novice).

the next step after this patch is to have an option to get rid of all
the function pointer chasing (which is expensive) for the case where you
know you only want one security module (which you then can turn on or
off)... that advantage is a performance gain for a lot of people.... but
if the person configuring the kernel selects this, it does mean there's
no way to load modules. I don't know what Fedora will do, but they might
select such an option. That's CHOICE... they chose a performance
improvement over enabling external kernel modules that they don't ship
anyway...

but is it really worth blocking such clear improvements in performance?

-- 
if you want to mail me at work (you don't), use arjan (at) linux.intel.com
Test the interaction between Linux and your BIOS via http://www.linuxfirmwarekit.org