Linus Torvalds writes: (Summary)
So really, it's not the "global sysctl" as much as the "global
request_module()" that annoys me.
request_module()" that annoys me.
I'll happily take the request_module_cap() part and the thing that makes networking use that.
makes networking use that.
But the flag that we have to default to off because it breaks every single box otherwise? It doesn't matter if it's one single global or just a "global behavior for request_module() for this process" at that point, it's still a pointless security flag that is opt-in.
request_module()" that annoys me.
I'll happily take the request_module_cap() part and the thing that makes networking use that.
makes networking use that.
But the flag that we have to default to off because it breaks every single box otherwise? It doesn't matter if it's one single global or just a "global behavior for request_module() for this process" at that point, it's still a pointless security flag that is opt-in.