On 06/06/17 13:54, Tetsuo Handa wrote: [...]
> "Loading modules which are not compiled as built-in" is correct. > My use case is to allow users to use LSM modules as loadable kernel > modules which distributors do not compile as built-in. Ok, so I suppose someone should eventually lock down the header, after the additional modules are loaded. Who decides when enough is enough, meaning that all the needed modules are loaded? Should I provide an interface to user-space? A sysfs entry? [...] > Unloading LSM modules is dangerous. Only SELinux allows unloading > at the risk of triggering an oops. If we insert delay while removing > list elements, we can easily observe oops due to free function being > called without corresponding allocation function. Ok. But even in this case, the sys proposal would still work. It would just stay unused. -- igor