Re: [GIT PULL] tomoyo update for v6.12

[Tetsuo Handa]

On 2024/09/28 22:54, Jonathan Corbet wrote:
>> I was delivering pure LKM version of TOMOYO (named AKARI) to users who
>> cannot afford rebuilding their distro kernels with TOMOYO enabled. But
>> since the LSM framework was converted to static calls, it became more
>> difficult to deliver AKARI to such users. Therefore, I decided to update
>> TOMOYO so that people can use mostly LKM version of TOMOYO with minimal
>> burden for both distributors and users.
> 
> I must confess that this change confuses me a bit.  Loadable LSM modules
> have been out of the picture for a long time, has that changed now?

No, the loadable LSM modules had been in the picture since 2010. There had been
many on-list and off-list discussions for how to support loadable LSM modules.

Since Casey Schaufler had been working on multiple concurrent LSM modules,
with a promise that we won't make changes that make loadable LSMs impossible
( https://lkml.kernel.org/r/ed785c86-a1d8-caff-c629-f8a50549e05b@xxxxxxxxxxxxxxxxxxx ),
I was waiting for Casey's work to complete. Meanwhile, I was using loadable
LSMs as out-of-tree code.

> Even stranger, to me at least, is the backdoor symbol-export mechanism.
> That seems like ... not the way we do things.  Was the need for this so
> urgent that you couldn't try to get those symbols exported properly?

Yes. This is a chicken-and-egg problem. Symbols not used by in-tree kernel
code cannot be justified for export, but I can't prove that loadable LSM
can work unless I export symbols. This became an urgent chicken-and-egg
problem due to "static calls" changes which went to this merge window
( https://lkml.kernel.org/r/caafb609-8bef-4840-a080-81537356fc60@xxxxxxxxxxxxxxxxxxx ).

KP Singh has suggested an approach
( https://lkml.kernel.org/r/CACYkzJ7_42dhynhmuCBF6z0hyMkYL_FxLR9rM1beCwJVkEv9gQ@xxxxxxxxxxxxxx )
and I posted what KP Singh has suggested
( https://lkml.kernel.org/r/d1e5b74a-5161-4906-96eb-4987ff440d19@xxxxxxxxxxxxxxxxxxx )
but Paul Moore refused what KP Singh has suggested
( https://lkml.kernel.org/r/CAHC9VhT_eBGJq5viU8R_HVWT=BTcxesWAi3nLcMgG8NfswKesA@xxxxxxxxxxxxxx ).

Since Paul Moore continues ignoring my concerns, waiting for support of loadable
LSMs at LSM framework layer won't help. I had to express my concerns and
demonstrate/prove that loadable LSM can work immediately. I know that people shall
forget my concerns if I didn't take action right now.

This backdoor symbol-export mechanism is a transitional hack needed for
demonstrating that loadable LSM can work. This hack will be replaced with
proper symbol-export via appropriate trees after this merge window closes.