[gentoo-dev] Re: udev-ng? (Was: Summary Council meeting Tuesday 13 November 2012)

[Duncan]

Chí-Thanh Christopher Nguyễn posted on Sun, 18 Nov 2012 12:14:48 +0100 as
excerpted:

> Matt Turner schrieb:
>>> Then udev switched to kmod as a build-time dep.  I could no longer
>>> package.provide kmod as I had module-init-tools, because it was
>>> required to /build/ udev.  For no valid reason on my system.  Like any
>>> unnecessary feature that can be used to load an exploit, it's worse
>>> than useless.
>
>> # du -sh /var/tmp/portage/sys-apps/kmod-11-r1/image/
>> 240K	/var/tmp/portage/sys-apps/kmod-11-r1/image/
>
> I think the complaint was not about the installed size. Some people have
> "install as little unnecessary code as possible" as part of their
> security concepts.

That's true, but as a long-term gentooer, I've found over the years it's 
more than that.  Every single installed package is another package that 
must be repeatedly rebuilt, as upgrades come in and/or as the system core 
toolchain changes over time and one wants to be sure the whole system is 
consistent and still buildable (emerge --emptytree @world).  Every 
installed package I don't use is thus an installed package I'll spend a 
lot of otherwise unnecessary time on, over the years, simply keeping it 
and the system in general upto date.

As one realizes the cost over time, one gets a rather higher motivation 
to keep the system as lean and mean as possible.  I look at it this way, 
it's just that much more incentive to practice what has always been known 
as good security practice in any case, keeping everything off the system 
that doesn't have a solid, known reason, for being there.

kmod itself is trivial in size time and space requirements, but it's the 
principle as much as anything, and in the case of an unneeded module 
loader there's an additional security concern as well, since an 
opportunity to load kernel modules is just that much more opportunity to 
install a kernel module that hides otherwise visible tell-tail (logs, 
strange open ports on netstat, strange startup services, etc) signs of 
being rooted.  Sure, if someone has module-loading access already, it's 
not a big increased risk, but given that it's an unnecessary, any non-
negative non-zero increase in risk or maintenance cost over time is 
unacceptable, and on a monolithic kernel gentoo system, a kernel module 
loader increases both, trivially sure, but when there's no justifiable 
reason for it in the first place...

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman