Linux 4.14-rc7 No Longer Clashes With AppArmor To Break Networking

[starshipeleven]

What then makes sense and doesn't has nothing to do with rules. Sense comes from context and if a change makes sense, or if it doesn't, depends on the context. If then the only context you can find is that it broke a rule then fuck the rule and move on, or you just end up digging yourself into a pile of BS without any substance and for you to be believable.

Wtf is this? The Teenage Programmer Manifesto?

If your work is a pile of hacks with no stable external interface none will use it, as people don't like using their valuable time adjusting their application to yet another of your "changes that makes sense".

And what is worse, it will become progressively harder to maintain even for yourself.

[sdack]

Wtf is this? ...

It's you failing to get it.

[c117152]

Wtf is this? The Teenage Programmer Manifesto?

If your work is a pile of hacks with no stable external interface none will use it, as people don't like using their valuable time adjusting their application to yet another of your "changes that makes sense".

And what is worse, it will become progressively harder to maintain even for yourself.

AppArmor is a reduced and cleaned-up SELinux which is a hacked together partial knockoff of grsecurity which is in itself a compromise aiming at "hardening" the kernel's key structs and many similar other features. Oh, and it's all running on top of x86 hardware and C so you're effectively starting this discussion off "a pile of hacks" at every abstraction layer above the microcode.

Back to topic, security devs tend to develop a security-state like bias towards user-land breakage; Where, at first they'll only break APIs if a credible discovery and proof-of-concept were issued; But then, over-time, become your typical American cop that prefers to shoot first and ask questions later.

So, 3 weeks into it with no end in sight, Linus decided to pull the curtains on this over / poorly produced security theater matinee. The timing isn't perfect since user-land was just about to catch up... But I guess for Linus enough is enough.

[L_A_G]

It's what the AppArmor guy did. The distros were already adding patches to their existing software (or rather their AppArmor rule sets) to work with the upcoming 4.14. This wasn't a bug, just business as usual, until Linus decided to take a dump on somebody ...

It may have to some extent been business as usual, but definitely not in a good way. Yes, Linus took a figurative dump, but he took it on someone who actually deserved it. The fact that you work with security doesn't mean that you get a free pass with your mistakes and it's somehow everyone else's job to compensate for your mistakes. If you make a mistake, you fix it or at least try to help the people trying to fix it.

Seeing how you just don't seem to get it: It wasn't the added feature itself that broke AppArmor, it was a bug that was introduced with the push that broke AppArmor.

We're not talking about an academic research OS like Barrelfish here, we're talking about an OS used in actual production environments so leaving in mistakes into code simply because the people who made that mistake can't be bothered to fix it is simply not acceptable. If this is too hard for you to understand, you probably should do everyone a favor and stay out of working on mainline Linux.

Also, do yourself a favour and look at the headline of the article:

Linux 4.14-rc7 No Longer Clashes With AppArmor ...

Notice anything? It names the exact kernel version, but doesn't say a word about what version of AppArmor it is it clashes with. That's messed up. It's almost as if AppArmor is of more significance than the kernel development itself.

Doesn't really matter what version/versions of AppArmor that it clashes with when it's not actually AppArmor's fault. If you make a mistake and break other people's applications, it's your fault, not theirs. It's as simple as that.

[sdack]

Yes, Linus took a figurative dump, but he took it on someone who actually deserved it.

Nobody deserves it. Backing it up is the same as trying to find idiotic reasons and explanations for Donald Trump's behavior towards army veterans, or to give a worse example, why this guy did what he did.

And then there are people who walk across a red-light when they are completely alone with no traffic around, because they want to be somewhere. Others smoke weed in countries and states where it isn't allowed. One can bend and break rules without anyone throwing a tantrum.

We then need to compile a new version of perf with almost every new kernel. It isn't even a tool only for admins and maintainers, but it's of use to anyone. And yet is it not a regression when we cannot use an old version of perf with a newer kernel.

The whole talk about how this was a regression remains bogus, because we know these rules get ignored, bend and broken, or only watered down by distro maintainers for many reasons - perfectly good and understandable reasons. Just in this situation did common sense fail and an idiot got to throw a tantrum.

Now you want to talk about whose fault it is when an idiot throws a tantrum. That's like being a woman in Hollywood and working for Weinstein.

[GreatEmerald]

Seeing how you just don't seem to get it: It wasn't the added feature itself that broke AppArmor, it was a bug that was introduced with the push that broke AppArmor.

I was under the opposite impression. Didn't they introduce a new security feature that, given that access is denied by default, would deny access to the internet unless given permission to the application?

[starshipeleven]

AppArmor is a reduced and cleaned-up SELinux which is a hacked together partial knockoff of grsecurity which is in itself a compromise aiming at "hardening" the kernel's key structs and many similar other features. Oh, and it's all running on top of x86 hardware and C so you're effectively starting this discussion off "a pile of hacks" at every abstraction layer above the microcode.

Uhm.... I was not talking of that. I was talking of structuring your own project so that it is maintainable.

And I find questionable your statements on AppArmor and SELinux, neither are hacked-together knockoffs of grsecurity, as they focus on mostly other stuff entirely.

[nils_]

There is no mess. No distro is expected to work out-of-the-box with every new kernel. The distros in question actually create their own set of kernel patches and take their time in adopting new kernels. There is always plenty of patching going on before these distros start using a newer kernel. To there complain about a new kernel not working with existing distributions, because a commit fixes something while older software still only tries to work around it, is just pure hypocrisy.

I disagree. The kernel is usually remarkably stable, I'm usually able to use newer kernels if it weren't for using out of tree software (ZFS), and even that usually works pretty quickly. I think the distros applying lots of patches to the kernel is a mistake. Too much effort goes into maintaining out-of-tree things already.

[starshipeleven]

Nobody deserves it.

There are rules set down by Torvalds and others and he has agreed to follow them, if he breaks them then he deserves to be punished.

We then need to compile a new version of perf with almost every new kernel. It isn't even a tool only for admins and maintainers, but it's of use to anyone. And yet is it not a regression when we cannot use an old version of perf with a newer kernel.

Heh, perf is a tool living in the kernel repo, and is shipped together with it. https://git.kernel.org/pub/scm/linux...ree/tools/perf
Same story for other kernel development/debugging tools. They use/rely on unstable APIs like driver stuff or whatever else depending on kernel internals they are profiling/debugging.

The whole talk about how this was a regression remains bogus, because we know these rules get ignored, bend and broken,

So far all provided examples were invalid.

[starshipeleven]

And then there are people who walk across a red-light when they are completely alone with no traffic around, because they want to be somewhere. Others smoke weed in countries and states where it isn't allowed. One can bend and break rules without anyone throwing a tantrum.

As long as he isn't caught by the authority, or peers.
It's a bit hard to do in kernel development.