Linus
Torvalds has launched a blistering attack on security programmers who object
to adding the Smack application to the upcoming 2.6.24 Linux kernel.
In an often heated exchange, Torvalds accused security programmers of being
too concerned with theoretical problems and not enough with practical
applications.
Smack uses Linux Security Modules (LSM) which some researchers believe could
be used to aid attacks on systems using the code. The researchers would prefer
to see Security-Enhanced Linux as the option of choice.
"If LSM remains, security will never be a first class citizen of the kernel,
" said Linux developer James Morris.
"Application developers will see multiple security schemes, and either burn
themselves trying to support them, or more likely ignore them.
"On a broader scale, we will miss the potential of Linux having a coherent,
semantically strong security architecture."
But this set Torvalds off on a rant about the impossibility of satisfying the
demands of security researchers.
"You security people are insane. I am tired of this 'only my version is
correct' crap," he wrote.
"The whole and only point of LSM was to get away from that. And anybody who
claims that there is 'consensus' on Security-Enhanced Linux is just in denial."
Torvalds got so riled that he started posting some comments in block
capitals, which in discussion terms represents shouting.
"If you guys had been able to argue on hard data and be in agreement, LSM
would not have been needed in the first place. BUT THAT WAS NOT THE CASE," he
wrote.
"And perhaps more importantly: BUT THAT IS *STILL* NOT THE CASE. Sorry for
the shouting, but I am serious about this."
Torvalds concluded by stating that LSM will stay in the kernel and that this
is his final decision.
He added that he might change his mind if security people made decent
arguments, but that this was as likely as "hell freezing over or pigs nesting in
trees".
Do you agree?
Have your say on this article