Re: [PATCH try #3] security: Convert LSM into a static interface

[Marcus Meissner <meissner@suse.de>]

In article <Line.LNX.4.64.0706251953020.25122@localhost.localdomain.suse.lists.linux.kernel> you wrote:
> Convert LSM into a static interface, as the ability to unload a security
> module is not required by in-tree users and potentially complicates the
> overall security architecture.
> 
> Needlessly exported LSM symbols have been unexported, to help reduce API
> abuse.
> 
> Parameters for the capability and root_plug modules are now specified
> at boot.
> 
> The SECURITY_FRAMEWORK_VERSION macro has also been removed.
> 
> Signed-off-by: James Morris <jmorris@namei.org>

NAK.

First, such an interface should be obsoleted by first making an entry
to Documentation/feature-removal-schedule.txt and waiting for some months.

Second, security modules that cannot be loaded/unloaded can just marked
so and the LSM interface kept as-is.

You are aware of the out of tree users, like AppArmor and other security
modules and there are also several antivirus modules like dazuko, mcafee
(got riddance for the latter, but in general) using LSM.

Ciao, Marcus