Linux 4.14-rc7 No Longer Clashes With AppArmor To Break Networking

[phoronix]

Phoronix: Linux 4.14-rc7 No Longer Clashes With AppArmor To Break Networking

Earlier this month I warned about using Linux 4.14 with AppArmor can cause headaches, namely with the stock rules on distributions like Ubuntu and Debian you can find your networking support broken. That work has now been reverted after Linus Torvalds realized this issue as well...

http://www.phoronix.com/scan.php?page=news_item&px=Linux-4.14-rc7-Reverts-AA-Reg

[theghost]

As always, harsh but true words by Linus.
Let's hope the AppArmor maintainers understood it.

[starshipeleven]

When I read "Linus reverted the patch" I was expecting some flaming. Was not disappointed.

[boxie]

I am happy that this has been reverted, I am idly wondering what the security layer devs can do to make Linus happy with their work?

[cyberwizzard]

I am happy that this has been reverted, I am idly wondering what the security layer devs can do to make Linus happy with their work?

I reckon its as simple as first making sure user-space tools are forwards compatible with potential API changes and then change the kernel to follow once the tools are stable. Breaking compatibility and then suggesting user-space is updated means there is a huge gap between the point of breaking and end-users getting a working system.

My thoughts on the language in such emails aside, he is right that such a situation is unacceptable for mainlining code.

Does anyone know why Linus is 'unhappy' with AppArmor as it is?

[Drago]

As always the coin has 2 sides:
1. There is an issue/bug/stupid implementation in the kernel.
2. Userspace somewhat works around the kernel issue.
3. Kernel devs want to fix/cleanup the root issue & fix the user space.

How are we going to resolve this circle? Is leaving bugs/inefficiencies in the kernel forever the right decision?
Programming is hard. The more the LOCs, the harder.

[Drago]

I reckon its as simple as first making sure user-space tools are forwards compatible with potential API changes and then change the kernel to follow once the tools are stable. Breaking compatibility and then suggesting user-space is updated means there is a huge gap between the point of breaking and end-users getting a working system.

Is anywhere defined how big this window should be?

[boxie]

As always the coin has 2 sides:
1. There is an issue/bug/stupid implementation in the kernel.
2. Userspace somewhat works around the kernel issue.
3. Kernel devs want to fix/cleanup the root issue & fix the user space.

How are we going to resolve this circle? Is leaving bugs/inefficiencies in the kernel forever the right decision?
Programming is hard. The more the LOCs, the harder.

A Versioned API would allow you to have both. depreciate the old API and eventually remove it once user space no longer needs it

[garegin]

Who uses apparmour besides Ubuntu and derivates?

[starshipeleven]

Who uses apparmour besides Ubuntu and derivates?

SUSE and derivatives, SUSE is also the trademark owner and the main developer of AppArmor.