[gentoo-user] Module philosophy: Compile-in or Load

[gentoo-user] Module philosophy: Compile-in or Load

[Anthony E. Caudel]

I was wondering what gentoo-users think and practice about kernel
modules.  Do most compile them in the kernel or load them at boot-up.

Note that I'm _NOT_ talking about those modules that have to be compiled
in such as for your filesystem. This is about the other ones.

I generally like to load them at boot-up.  One reason is that I have
heard that for suspend or hibernate to work, some modules have to be
unloaded.

On the other hand, compiling them in results in faster boot times.

So, what do gentoo-users think?

Tony
-- 
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
   -- Benjamin Franklin
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Teresa and Dale]

Anthony E. Caudel wrote:

>I was wondering what gentoo-users think and practice about kernel
>modules.  Do most compile them in the kernel or load them at boot-up.
>
>Note that I'm _NOT_ talking about those modules that have to be compiled
>in such as for your filesystem. This is about the other ones.
>
>I generally like to load them at boot-up.  One reason is that I have
>heard that for suspend or hibernate to work, some modules have to be
>unloaded.
>
>On the other hand, compiling them in results in faster boot times.
>
>So, what do gentoo-users think?
>
>Tony
>  
>


Care to guess how much I like modules:

> root@smoker / # lsmod
> Module                  Size  Used by
> nvidia               4551892  12
> root@smoker / #


I would have that one in there if I could.  I never did like them.

Dale
:-) :-)

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Anthony E. Caudel]

Teresa and Dale wrote:

> Care to guess how much I like modules:
> 
>> root@smoker / # lsmod
>> Module                  Size  Used by
>> nvidia               4551892  12
>> root@smoker / #
> 
> 
> I would have that one in there if I could.  I never did like them.
> 
Why?

-- 
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
   -- Benjamin Franklin
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Teresa and Dale]

Anthony E. Caudel wrote:

>Teresa and Dale wrote:
>
>  
>
>>Care to guess how much I like modules:
>>
>>    
>>
>>>root@smoker / # lsmod
>>>Module                  Size  Used by
>>>nvidia               4551892  12
>>>root@smoker / #
>>>      
>>>
>>I would have that one in there if I could.  I never did like them.
>>
>>    
>>
>Why?
>
>  
>


I read somewhere once that it is harder to mess with the kernel than the
modules, as in someone putting something evil in it.  The kernel is one
big file but the modules are not.  I think they are in /usr/lib/modules
ot something like that.  I figure if someone messes with the kernel,
they will mess it up or something and it will not boot at all.

I just read it is not as secure is what I am saying I guess.  Besides, I
just hate have to edit the module file to get them to load, plus you
ahve to wait when booting.

My sorry $.02 worth.

Dale
:-) :-)
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[gentuxx]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Anthony E. Caudel wrote:
> I was wondering what gentoo-users think and practice about kernel
> modules.  Do most compile them in the kernel or load them at boot-up.
>
> Note that I'm _NOT_ talking about those modules that have to be compiled
> in such as for your filesystem. This is about the other ones.
>
> I generally like to load them at boot-up.  One reason is that I have
> heard that for suspend or hibernate to work, some modules have to be
> unloaded.
>
> On the other hand, compiling them in results in faster boot times.
>
> So, what do gentoo-users think?
>
> Tony
I'm certainly not the end-all-be-all in kernel knowledge.  But, I tend
to look at it based on the particular modules being loaded and the
likeliness that I will actually use that module.

If it seems like something is fundamental to the operation of the OS
(filesystems, core drivers like USB, chipset, etc.) then I compile it
in.  If it's something that makes sense to unload and load (in my
mind, this is something like network drivers, audio drivers, netfilter
modules, etc.), then I'll compile it as a separate module.

It's not a hard and fast rule, and there are always exceptions.  For
example, there are programs that expect to find the module, and if you
compile it into the kernel that program won't work right, even though
you have the (whatever) functionality built into the kernel.

- --
gentux
echo "hfouvyyAhnbjm/dpn" | perl -pe 's/(.)/chr(ord($1)-1)/ge'

gentux's gpg fingerprint ==> 5495 0388 67FF 0B89 1239  D840 4CF0 39E2
18D3 4A9E
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEjP2bTPA54hjTSp4RAi44AKCx0cjGLdyoVGw1F8EZtC/STATGlQCgg4VL
l7NW4j0HQugR70OADkBDCTU=
=ExLX
-----END PGP SIGNATURE-----

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Steven Susbauer]

On Mon, 12 Jun 2006, Anthony E. Caudel wrote:

> I was wondering what gentoo-users think and practice about kernel
> modules.  Do most compile them in the kernel or load them at boot-up.
>
> Note that I'm _NOT_ talking about those modules that have to be compiled
> in such as for your filesystem. This is about the other ones.
>
> I generally like to load them at boot-up.  One reason is that I have
> heard that for suspend or hibernate to work, some modules have to be
> unloaded.
>
> On the other hand, compiling them in results in faster boot times.
>
> So, what do gentoo-users think?
>
> Tony
>


I have never used any modules that I didn't have to. At this point, I use
none. They are all compiled into the kernel, because I don't have a point
to unloading or loading. The only point for modules in any of my
experience is if you're often changing hardware (possibly a laptop with a
base station... or something?)
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Mike Huber]

Well, all mileage may vary.

Personally, I prefer to not have things loaded into the kernel when
I'm not using them.  It's not really a performance or a memory saving
thing, but more of an OCD thing.  I'm sure that, in the grand scheme
of things, the little time/power/whatever I save by keeping them out
of the kernel is far outweighed by the amount of time it takes to type
"modprobe x" when i remember I need to load the thing.  Afterall, my
time at the command prompt is significantly more valuable than a few
extra cycles, or an extra 70-500K memory footprint.

The thing is, it really depends on how clean you keep your kernel
config.  If you seriously go through the kernel config an make sure
that you only select the things which are appropriate for your system,
then you're fine.  I've known people who just have almost everything
built as a module, and let kernel autoloading take care of figuring
out which one they need for their system (yes, terribly stupid and
inelegant, but it does solve the problem when you don't know how else
to do it).  Also, compiling a whole tree of modules can be a simple
way of figuring out exactly which set of code corresponds to your
chipset, but that is not relevant to the current discussion.

Basically, I'd say that if it doesn't matter how the thing is loaded
into the kernel (I.E., no outside code relies on it being a module),
and if it's going to be loaded more than some threshold percentage of
time, just build it in.  Unless you are facing some weird constraints,
anything resembling modern hardware can handle the slightly larger
kernel, and if you are facing those constraints, you probably already
know what you're doing much better than I'll ever be able to say.

As a side question for the list, when you load a module, you can pass
module options to it (at least, last I checked, this could be done to
specify things like the name of the interface on an internet driver,
debugging level, etc...).  When you build something into the kernel,
is there an easy way to pass such options off to it?  boot time
options? anyone know?

--Mike

On 6/12/06, Steven Susbauer <stupendoussteve@gmail.com> wrote:
>
>
> On Mon, 12 Jun 2006, Anthony E. Caudel wrote:
>
> > I was wondering what gentoo-users think and practice about kernel
> > modules.  Do most compile them in the kernel or load them at boot-up.
> >
> > Note that I'm _NOT_ talking about those modules that have to be compiled
> > in such as for your filesystem. This is about the other ones.
> >
> > I generally like to load them at boot-up.  One reason is that I have
> > heard that for suspend or hibernate to work, some modules have to be
> > unloaded.
> >
> > On the other hand, compiling them in results in faster boot times.
> >
> > So, what do gentoo-users think?
> >
> > Tony
> >
>
>
> I have never used any modules that I didn't have to. At this point, I use
> none. They are all compiled into the kernel, because I don't have a point
> to unloading or loading. The only point for modules in any of my
> experience is if you're often changing hardware (possibly a laptop with a
> base station... or something?)
> --
> gentoo-user@gentoo.org mailing list
>
>
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Mike Huber]

oh, there is one thing where it is useful to have modules.  That would
be projects where the codebase will be updated more often than you
update your kernels (I'm looking at you ALSA).  In those circumstances
it may be more valuable to have the flexibility to update code without
having to reboot (or kexec).

On 6/12/06, Mike Huber <michael.huber@gmail.com> wrote:
> Well, all mileage may vary.
>
> Personally, I prefer to not have things loaded into the kernel when
> I'm not using them.  It's not really a performance or a memory saving
> thing, but more of an OCD thing.  I'm sure that, in the grand scheme
> of things, the little time/power/whatever I save by keeping them out
> of the kernel is far outweighed by the amount of time it takes to type
> "modprobe x" when i remember I need to load the thing.  Afterall, my
> time at the command prompt is significantly more valuable than a few
> extra cycles, or an extra 70-500K memory footprint.
>
> The thing is, it really depends on how clean you keep your kernel
> config.  If you seriously go through the kernel config an make sure
> that you only select the things which are appropriate for your system,
> then you're fine.  I've known people who just have almost everything
> built as a module, and let kernel autoloading take care of figuring
> out which one they need for their system (yes, terribly stupid and
> inelegant, but it does solve the problem when you don't know how else
> to do it).  Also, compiling a whole tree of modules can be a simple
> way of figuring out exactly which set of code corresponds to your
> chipset, but that is not relevant to the current discussion.
>
> Basically, I'd say that if it doesn't matter how the thing is loaded
> into the kernel (I.E., no outside code relies on it being a module),
> and if it's going to be loaded more than some threshold percentage of
> time, just build it in.  Unless you are facing some weird constraints,
> anything resembling modern hardware can handle the slightly larger
> kernel, and if you are facing those constraints, you probably already
> know what you're doing much better than I'll ever be able to say.
>
> As a side question for the list, when you load a module, you can pass
> module options to it (at least, last I checked, this could be done to
> specify things like the name of the interface on an internet driver,
> debugging level, etc...).  When you build something into the kernel,
> is there an easy way to pass such options off to it?  boot time
> options? anyone know?
>
> --Mike
>
> On 6/12/06, Steven Susbauer <stupendoussteve@gmail.com> wrote:
> >
> >
> > On Mon, 12 Jun 2006, Anthony E. Caudel wrote:
> >
> > > I was wondering what gentoo-users think and practice about kernel
> > > modules.  Do most compile them in the kernel or load them at boot-up.
> > >
> > > Note that I'm _NOT_ talking about those modules that have to be compiled
> > > in such as for your filesystem. This is about the other ones.
> > >
> > > I generally like to load them at boot-up.  One reason is that I have
> > > heard that for suspend or hibernate to work, some modules have to be
> > > unloaded.
> > >
> > > On the other hand, compiling them in results in faster boot times.
> > >
> > > So, what do gentoo-users think?
> > >
> > > Tony
> > >
> >
> >
> > I have never used any modules that I didn't have to. At this point, I use
> > none. They are all compiled into the kernel, because I don't have a point
> > to unloading or loading. The only point for modules in any of my
> > experience is if you're often changing hardware (possibly a laptop with a
> > base station... or something?)
> > --
> > gentoo-user@gentoo.org mailing list
> >
> >
>
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Kristian Poul Herkild]

Anthony E. Caudel wrote:
> I was wondering what gentoo-users think and practice about kernel
> modules.  Do most compile them in the kernel or load them at boot-up.
> 
> Note that I'm _NOT_ talking about those modules that have to be compiled
> in such as for your filesystem. This is about the other ones.
> 
> I generally like to load them at boot-up.  One reason is that I have
> heard that for suspend or hibernate to work, some modules have to be
> unloaded.
> 
> On the other hand, compiling them in results in faster boot times.
> 
> So, what do gentoo-users think?
> 
> Tony

I have 23 modules (loaded), most related to the soundcard, and a few
related to nvidia, a few for the webcam. It appears I could unload 4
modules but the rest are necessary, and cannot be compiled inside the
kernel without breaking functionality of other drivers, or applications.

-Kristian
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Michael Weyershäuser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I usualy start with a kernel with almost everything compiled in (but
only things I definitely need), only using modules when I have to
(USB for suspend2 comes to my mind). Over time whenever I need
something new (filesystem, hardware driver,...) I tend to compile it
as a module to avoid a reboot. As I do not upgrade my kernel very
often this happens more often than you might think (last upgrade was
from 2.6.11 to 2.6.16, on my laptop from 2.6.10 to 2.6.16).

I don't really care about the 300k more used memory (hardly worth a
thought on systems with 1 GB RAM and more) or the 0.3 seconds faster
boot process. Modules just come in handy when it comes to avoiding a
reboot.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEjShO6q4f+IV6B/wRAqqVAJ4nJm00PUpjPWQKEXii+j3vN/8zowCfQImC
+m69YW947xYOCsZM+sUyqTA=
=FNqr
-----END PGP SIGNATURE-----
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Daniel da Veiga]

On 6/12/06, Michael Weyershäuser <thedude0001@gmx.de> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I usualy start with a kernel with almost everything compiled in (but
> only things I definitely need), only using modules when I have to
> (USB for suspend2 comes to my mind). Over time whenever I need
> something new (filesystem, hardware driver,...) I tend to compile it
> as a module to avoid a reboot. As I do not upgrade my kernel very
> often this happens more often than you might think (last upgrade was
> from 2.6.11 to 2.6.16, on my laptop from 2.6.10 to 2.6.16).
>
> I don't really care about the 300k more used memory (hardly worth a
> thought on systems with 1 GB RAM and more) or the 0.3 seconds faster
> boot process. Modules just come in handy when it comes to avoiding a
> reboot.

I agree. I use the basic modules for sound card, video, wireless and
USB, just because it something hangs I can work it without a reboot.
Besides, unloading modules is an excelent feature when you're using a
laptop in presentations or trips where you just want to read that
e-book or show that pdf, so you can unload all that you don't need (in
my case almost everything) and save battery.

-- 
Daniel da Veiga
Computer Operator - RS - Brazil
-----BEGIN GEEK CODE BLOCK-----
Version: 3.1
GCM/IT/P/O d-? s:- a? C++$ UBLA++ P+ L++ E--- W+++$ N o+ K- w O M- V-
PS PE Y PGP- t+ 5 X+++ R+* tv b+ DI+++ D+ G+ e h+ r+ y++
------END GEEK CODE BLOCK------

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Anthony E. Caudel]

Michael Weyershäuser wrote:
> I usualy start with a kernel with almost everything compiled in (but
> only things I definitely need), only using modules when I have to
> (USB for suspend2 comes to my mind). Over time whenever I need
> something new (filesystem, hardware driver,...) I tend to compile it
> as a module to avoid a reboot. As I do not upgrade my kernel very
> often this happens more often than you might think (last upgrade was
> from 2.6.11 to 2.6.16, on my laptop from 2.6.10 to 2.6.16).
> 
> I don't really care about the 300k more used memory (hardly worth a
> thought on systems with 1 GB RAM and more) or the 0.3 seconds faster
> boot process. Modules just come in handy when it comes to avoiding a
> reboot.

OK, this seems to confirm something I had suspected but never
investigated: - that you can compile just a module without the need to
recompile and install a revised kernel.  This is possible?

How?  "make modules_install" or the whole thing: "make && make
modules_install" then just modprobe the new module?

Tony
-- 
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
   -- Benjamin Franklin
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Mike Huber]

Yea, of course you can do that, though you have to be careful if your
kernel tree has changed to a different version than the one you're
booted from (usually you can still just force the module to load, but
a module from a different kernel tree may not want to play nicely with
everything else).

On 6/12/06, Anthony E. Caudel <acaudel@gt.rr.com> wrote:
> Michael Weyershäuser wrote:
> > I usualy start with a kernel with almost everything compiled in (but
> > only things I definitely need), only using modules when I have to
> > (USB for suspend2 comes to my mind). Over time whenever I need
> > something new (filesystem, hardware driver,...) I tend to compile it
> > as a module to avoid a reboot. As I do not upgrade my kernel very
> > often this happens more often than you might think (last upgrade was
> > from 2.6.11 to 2.6.16, on my laptop from 2.6.10 to 2.6.16).
> >
> > I don't really care about the 300k more used memory (hardly worth a
> > thought on systems with 1 GB RAM and more) or the 0.3 seconds faster
> > boot process. Modules just come in handy when it comes to avoiding a
> > reboot.
>
> OK, this seems to confirm something I had suspected but never
> investigated: - that you can compile just a module without the need to
> recompile and install a revised kernel.  This is possible?
>
> How?  "make modules_install" or the whole thing: "make && make
> modules_install" then just modprobe the new module?
>
> Tony
> --
> Those who would give up essential Liberty, to purchase a little temporary
> Safety, deserve neither Liberty nor Safety.
>    -- Benjamin Franklin
> --
> gentoo-user@gentoo.org mailing list
>
>

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Ryan Tandy]

Anthony E. Caudel wrote:
> 
> How?  "make modules_install" or the whole thing: "make && make
> modules_install" then just modprobe the new module?

# make modules modules_install
# modprobe <module>
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Mick]

On 13/06/06, Ryan Tandy <tarpman@gmail.com> wrote:
> Anthony E. Caudel wrote:
> >
> > How?  "make modules_install" or the whole thing: "make && make
> > modules_install" then just modprobe the new module?
>
> # make modules modules_install
> # modprobe <module>

Do you also need to run "&& make install" or is it not necessary to
copy anything to /boot?
-- 
Regards,
Mick
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Michael Weyershäuser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mick wrote:
 > Do you also need to run "&& make install" or is it not necessary to
> copy anything to /boot?

No need for that if you have only added modules. "make modules" only
builds the modules, not the kernel itself, so copying the kernel to
/boot wouldn't make any difference as it hasn't changed.

But (as stated earlier) you should be sure that you are building the
modules for the right kernel version. Maintaining an updated
/usr/src/linux symlink helps with that (and is needed for other kernel
related ebuilds, too).
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2-ecc0.1.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFElAZS6q4f+IV6B/wRAofUAJ4+A/+czQpL3NIC9z7MZf/uyUQEowCghFxr
5MzfAQLxBJfcxFS9hNZfbt8=
=eL7D
-----END PGP SIGNATURE-----
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Anthony E. Caudel]

Mick wrote:
> On 13/06/06, Ryan Tandy <tarpman@gmail.com> wrote:
>> Anthony E. Caudel wrote:
>> >
>> > How?  "make modules_install" or the whole thing: "make && make
>> > modules_install" then just modprobe the new module?
>>
>> # make modules modules_install
>> # modprobe <module>
> 
> Do you also need to run "&& make install" or is it not necessary to
> copy anything to /boot?

Not necessary.

-- 
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
   -- Benjamin Franklin
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Mick]

On 17/06/06, Anthony E. Caudel <acaudel@gt.rr.com> wrote:
> Mick wrote:
> > On 13/06/06, Ryan Tandy <tarpman@gmail.com> wrote:
> >> Anthony E. Caudel wrote:
> >> >
> >> > How?  "make modules_install" or the whole thing: "make && make
> >> > modules_install" then just modprobe the new module?
> >>
> >> # make modules modules_install
> >> # modprobe <module>
> >
> > Do you also need to run "&& make install" or is it not necessary to
> > copy anything to /boot?
>
> Not necessary.

Of course not necessary for the kernel (as Michael Weyershäuser
already said), but what about the copy of the .config file?
-- 
Regards,
Mick

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Erik Westenbroek]

I like compile-in, generally less work must be done (just a hair, but
it is less)

On 6/17/06, Mick <michaelkintzios@gmail.com> wrote:
> On 17/06/06, Anthony E. Caudel <acaudel@gt.rr.com> wrote:
> > Mick wrote:
> > > On 13/06/06, Ryan Tandy <tarpman@gmail.com> wrote:
> > >> Anthony E. Caudel wrote:
> > >> >
> > >> > How?  "make modules_install" or the whole thing: "make && make
> > >> > modules_install" then just modprobe the new module?
> > >>
> > >> # make modules modules_install
> > >> # modprobe <module>
> > >
> > > Do you also need to run "&& make install" or is it not necessary to
> > > copy anything to /boot?
> >
> > Not necessary.
>
> Of course not necessary for the kernel (as Michael Weyershäuser
> already said), but what about the copy of the .config file?
> --
> Regards,
> Mick
>
> --
> gentoo-user@gentoo.org mailing list
>
>


-- 
Erik

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Michael Weyershäuser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mick wrote:
> 
> Of course not necessary for the kernel (as Michael Weyershäuser
> already said), but what about the copy of the .config file?

OK, copying the .config file to /boot/ would be a good idea if you do
so. However it is not necessary to do so, nothing relies on config being
present in /boot/, ebuilds that need information about kernel config
take that from /usr/src/linux/.config. It is just a (good) practice to
keep the config in /boot/ in case you ever need a backup.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2-ecc0.1.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFElUsZ6q4f+IV6B/wRAoxPAJsGTejGfL59p75sdAw9iVyI6NxdRwCfWKqp
PaKSrkwY6bVf3xME8jtNZZ8=
=1+FQ
-----END PGP SIGNATURE-----
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Evan Klitzke]

On 6/11/06, Anthony E. Caudel <acaudel@gt.rr.com> wrote:
> I was wondering what gentoo-users think and practice about kernel
> modules.  Do most compile them in the kernel or load them at boot-up.

I have heard a security argument made that it is safer to compile
everything into the kernel, and disable support for modules entirely.
The reason for this is that if someone can load malicious modules on
your system they can basically circumvent any security systems you are
using, including things like SELinux and grsec.

-- Evan Klitzke
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Jarry]

Evan Klitzke wrote:
> I have heard a security argument made that it is safer to compile
> everything into the kernel, and disable support for modules entirely.

I would say this is "a must" on server. This way you would close
one potential security leak. Of course, it does not help if you
leave a few others opened...  :-)

Jarry

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Module philosophy: Compile-in or Load

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 653 bytes --]

On Mon, 12 Jun 2006 11:16:56 -0700, Evan Klitzke wrote:

> I have heard a security argument made that it is safer to compile
> everything into the kernel, and disable support for modules entirely.
> The reason for this is that if someone can load malicious modules on
> your system they can basically circumvent any security systems you are
> using, including things like SELinux and grsec.

This is only relevant is all your hardware can be supported by in-kernel
modules. Add one item that needs a 3rd party module and you are forced to
enable module loading.


-- 
Neil Bothwick

"Bother," said Pooh, as the vice squad took his GIFS

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Module philosophy: Compile-in or Load

[kashani]

Evan Klitzke wrote:
> On 6/11/06, Anthony E. Caudel <acaudel@gt.rr.com> wrote:
>> I was wondering what gentoo-users think and practice about kernel
>> modules.  Do most compile them in the kernel or load them at boot-up.
> 
> I have heard a security argument made that it is safer to compile
> everything into the kernel, and disable support for modules entirely.
> The reason for this is that if someone can load malicious modules on
> your system they can basically circumvent any security systems you are
> using, including things like SELinux and grsec.

	If an attacker can load malicious modules into your kernel I'd argue 
that your security model has already failed and failed spectacularly. 
Sounds like security as thought up by someone who has never had to 
managed a system unless someone has a plausible attack scenario.

kashani
-- 
gentoo-user@gentoo.org mailing list