Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Kevin Groeneveld]

On Thu, Jan 18, 2018 at 1:47 AM, Johannes Berg
 wrote:
> On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
>> "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
>> is not set) to 4.15-rc, gets into asking lots of new questions, and
>> configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
>> it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
>> be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.
>
> No, this is wrong - we want default configurations to be able to load a
> signed regulatory database and validate the signature.

I had a similar reaction as Hugh when I recently updated a kernel
config from 4.14 to 4.15.  I barely understand the kernel config
options in question so I don't really know what is right or wrong.
But it seems strange to me that when you turn off
CFG80211_CERTIFICATION_ONUS in menuconfig that the options which get
hidden are forced on.  When options are hidden like this I assume
(maybe incorrectly) that they are dependent on the option I just
turned off and that the now hidden options will also be off.

Kevin

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Kevin Groeneveld]

On Thu, Jan 18, 2018 at 1:47 AM, Johannes Berg
 wrote:
> On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
>> "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
>> is not set) to 4.15-rc, gets into asking lots of new questions, and
>> configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
>> it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
>> be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.
>
> No, this is wrong - we want default configurations to be able to load a
> signed regulatory database and validate the signature.

I had a similar reaction as Hugh when I recently updated a kernel
config from 4.14 to 4.15.  I barely understand the kernel config
options in question so I don't really know what is right or wrong.
But it seems strange to me that when you turn off
CFG80211_CERTIFICATION_ONUS in menuconfig that the options which get
hidden are forced on.  When options are hidden like this I assume
(maybe incorrectly) that they are dependent on the option I just
turned off and that the now hidden options will also be off.

Kevin

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Johannes Berg]

On Thu, 2018-01-18 at 13:07 -0800, Hugh Dickins wrote:

> Perhaps you did not try on a system without SYSTEM_DATA_VERIFICATION
> already enabled - that "select SYSTEM_DATA_VERIFICATION" seems to be
> taking effect even when CFG80211_REQUIRE_SIGNED_REGDB is not enabled,
> and pulls in a boatload.

I kinda know actually.

> In fact, I cannot even build the resulting config, without scurrying
> around to update userspace with stuff I never needed before:
> 
>   HOSTCC  scripts/extract-cert
> scripts/extract-cert.c:21:25: fatal error: openssl/bio.h: No such file or 
> directory

Fun.

I think the only thing we can do is make REGDB_AS_FW a (new) Kconfig
option that you can then turn off.

johannes

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Johannes Berg]

On Thu, 2018-01-18 at 13:07 -0800, Hugh Dickins wrote:

> Perhaps you did not try on a system without SYSTEM_DATA_VERIFICATION
> already enabled - that "select SYSTEM_DATA_VERIFICATION" seems to be
> taking effect even when CFG80211_REQUIRE_SIGNED_REGDB is not enabled,
> and pulls in a boatload.

I kinda know actually.

> In fact, I cannot even build the resulting config, without scurrying
> around to update userspace with stuff I never needed before:
> 
>   HOSTCC  scripts/extract-cert
> scripts/extract-cert.c:21:25: fatal error: openssl/bio.h: No such file or 
> directory

Fun.

I think the only thing we can do is make REGDB_AS_FW a (new) Kconfig
option that you can then turn off.

johannes

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Hugh Dickins]

A familiar error, let's try to attach this time...

On Thu, 18 Jan 2018, Hugh Dickins wrote:
> On Thu, 18 Jan 2018, Johannes Berg wrote:
> > On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
> > > "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
> > > is not set) to 4.15-rc, gets into asking lots of new questions, and
> > > configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
> > > it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
> > > be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.
> > 
> > No, this is wrong - we want default configurations to be able to load a
> > signed regulatory database and validate the signature.
> 
> Great to enable that, but not so great to force new stuff on everyone.
> It doesn't surprise me at all if the patch here is the wrong one,
> but something needs to be done differently in this configuration.
> 
> Perhaps you did not try on a system without SYSTEM_DATA_VERIFICATION
> already enabled - that "select SYSTEM_DATA_VERIFICATION" seems to be
> taking effect even when CFG80211_REQUIRE_SIGNED_REGDB is not enabled,
> and pulls in a boatload.  I agree that seems strange: perhaps the
> Kconfig problem is somewhere else entirely.
> 
> Attached my old 4.14 config, so you can see for yourself - thanks.
> 
> In fact, I cannot even build the resulting config, without scurrying
> around to update userspace with stuff I never needed before:
> 
>   HOSTCC  scripts/extract-cert
> scripts/extract-cert.c:21:25: fatal error: openssl/bio.h: No such file or 
> directory
> 
> Hugh
> 
> > 
> > johannes
> > 
> > > 
> > > Signed-off-by: Hugh Dickins 
> > > ---
> > > 
> > >  net/wireless/Kconfig |2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > --- 4.15-rc8/net/wireless/Kconfig 2017-12-03 10:22:51.928845056 -0800
> > > +++ linux/net/wireless/Kconfig2018-01-14 19:20:22.595472965 -0800
> > > @@ -89,7 +89,7 @@ config CFG80211_CERTIFICATION_ONUS
> > >  
> > >  config CFG80211_REQUIRE_SIGNED_REGDB
> > >   bool "require regdb signature" if CFG80211_CERTIFICATION_ONUS
> > > - default y
> > > + default CFG80211_CERTIFICATION_ONUS
> > >   select SYSTEM_DATA_VERIFICATION
> > >   help
> > > Require that in addition to the "regulatory.db" file a

config.414.gz
Description: GNU Zip compressed data

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Hugh Dickins]

A familiar error, let's try to attach this time...

On Thu, 18 Jan 2018, Hugh Dickins wrote:
> On Thu, 18 Jan 2018, Johannes Berg wrote:
> > On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
> > > "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
> > > is not set) to 4.15-rc, gets into asking lots of new questions, and
> > > configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
> > > it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
> > > be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.
> > 
> > No, this is wrong - we want default configurations to be able to load a
> > signed regulatory database and validate the signature.
> 
> Great to enable that, but not so great to force new stuff on everyone.
> It doesn't surprise me at all if the patch here is the wrong one,
> but something needs to be done differently in this configuration.
> 
> Perhaps you did not try on a system without SYSTEM_DATA_VERIFICATION
> already enabled - that "select SYSTEM_DATA_VERIFICATION" seems to be
> taking effect even when CFG80211_REQUIRE_SIGNED_REGDB is not enabled,
> and pulls in a boatload.  I agree that seems strange: perhaps the
> Kconfig problem is somewhere else entirely.
> 
> Attached my old 4.14 config, so you can see for yourself - thanks.
> 
> In fact, I cannot even build the resulting config, without scurrying
> around to update userspace with stuff I never needed before:
> 
>   HOSTCC  scripts/extract-cert
> scripts/extract-cert.c:21:25: fatal error: openssl/bio.h: No such file or 
> directory
> 
> Hugh
> 
> > 
> > johannes
> > 
> > > 
> > > Signed-off-by: Hugh Dickins 
> > > ---
> > > 
> > >  net/wireless/Kconfig |2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > --- 4.15-rc8/net/wireless/Kconfig 2017-12-03 10:22:51.928845056 -0800
> > > +++ linux/net/wireless/Kconfig2018-01-14 19:20:22.595472965 -0800
> > > @@ -89,7 +89,7 @@ config CFG80211_CERTIFICATION_ONUS
> > >  
> > >  config CFG80211_REQUIRE_SIGNED_REGDB
> > >   bool "require regdb signature" if CFG80211_CERTIFICATION_ONUS
> > > - default y
> > > + default CFG80211_CERTIFICATION_ONUS
> > >   select SYSTEM_DATA_VERIFICATION
> > >   help
> > > Require that in addition to the "regulatory.db" file a

config.414.gz
Description: GNU Zip compressed data

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Randy Dunlap]

On 01/18/2018 01:07 PM, Hugh Dickins wrote:
> On Thu, 18 Jan 2018, Johannes Berg wrote:
>> On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
>>> "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
>>> is not set) to 4.15-rc, gets into asking lots of new questions, and
>>> configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
>>> it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
>>> be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.
>>
>> No, this is wrong - we want default configurations to be able to load a
>> signed regulatory database and validate the signature.
> 
> Great to enable that, but not so great to force new stuff on everyone.
> It doesn't surprise me at all if the patch here is the wrong one,
> but something needs to be done differently in this configuration.
> 
> Perhaps you did not try on a system without SYSTEM_DATA_VERIFICATION
> already enabled - that "select SYSTEM_DATA_VERIFICATION" seems to be
> taking effect even when CFG80211_REQUIRE_SIGNED_REGDB is not enabled,
> and pulls in a boatload.  I agree that seems strange: perhaps the
> Kconfig problem is somewhere else entirely.
> 
> Attached my old 4.14 config, so you can see for yourself - thanks.

NOT attached.


> In fact, I cannot even build the resulting config, without scurrying
> around to update userspace with stuff I never needed before:
> 
>   HOSTCC  scripts/extract-cert
> scripts/extract-cert.c:21:25: fatal error: openssl/bio.h: No such file or 
> directory
> 
> Hugh
> 
>>
>> johannes
>>
>>>
>>> Signed-off-by: Hugh Dickins 
>>> ---
>>>
>>>  net/wireless/Kconfig |2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> --- 4.15-rc8/net/wireless/Kconfig   2017-12-03 10:22:51.928845056 -0800
>>> +++ linux/net/wireless/Kconfig  2018-01-14 19:20:22.595472965 -0800
>>> @@ -89,7 +89,7 @@ config CFG80211_CERTIFICATION_ONUS
>>>  
>>>  config CFG80211_REQUIRE_SIGNED_REGDB
>>> bool "require regdb signature" if CFG80211_CERTIFICATION_ONUS
>>> -   default y
>>> +   default CFG80211_CERTIFICATION_ONUS
>>> select SYSTEM_DATA_VERIFICATION
>>> help
>>>   Require that in addition to the "regulatory.db" file a


-- 
~Randy

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Randy Dunlap]

On 01/18/2018 01:07 PM, Hugh Dickins wrote:
> On Thu, 18 Jan 2018, Johannes Berg wrote:
>> On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
>>> "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
>>> is not set) to 4.15-rc, gets into asking lots of new questions, and
>>> configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
>>> it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
>>> be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.
>>
>> No, this is wrong - we want default configurations to be able to load a
>> signed regulatory database and validate the signature.
> 
> Great to enable that, but not so great to force new stuff on everyone.
> It doesn't surprise me at all if the patch here is the wrong one,
> but something needs to be done differently in this configuration.
> 
> Perhaps you did not try on a system without SYSTEM_DATA_VERIFICATION
> already enabled - that "select SYSTEM_DATA_VERIFICATION" seems to be
> taking effect even when CFG80211_REQUIRE_SIGNED_REGDB is not enabled,
> and pulls in a boatload.  I agree that seems strange: perhaps the
> Kconfig problem is somewhere else entirely.
> 
> Attached my old 4.14 config, so you can see for yourself - thanks.

NOT attached.


> In fact, I cannot even build the resulting config, without scurrying
> around to update userspace with stuff I never needed before:
> 
>   HOSTCC  scripts/extract-cert
> scripts/extract-cert.c:21:25: fatal error: openssl/bio.h: No such file or 
> directory
> 
> Hugh
> 
>>
>> johannes
>>
>>>
>>> Signed-off-by: Hugh Dickins 
>>> ---
>>>
>>>  net/wireless/Kconfig |2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> --- 4.15-rc8/net/wireless/Kconfig   2017-12-03 10:22:51.928845056 -0800
>>> +++ linux/net/wireless/Kconfig  2018-01-14 19:20:22.595472965 -0800
>>> @@ -89,7 +89,7 @@ config CFG80211_CERTIFICATION_ONUS
>>>  
>>>  config CFG80211_REQUIRE_SIGNED_REGDB
>>> bool "require regdb signature" if CFG80211_CERTIFICATION_ONUS
>>> -   default y
>>> +   default CFG80211_CERTIFICATION_ONUS
>>> select SYSTEM_DATA_VERIFICATION
>>> help
>>>   Require that in addition to the "regulatory.db" file a


-- 
~Randy

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Hugh Dickins]

On Thu, 18 Jan 2018, Johannes Berg wrote:
> On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
> > "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
> > is not set) to 4.15-rc, gets into asking lots of new questions, and
> > configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
> > it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
> > be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.
> 
> No, this is wrong - we want default configurations to be able to load a
> signed regulatory database and validate the signature.

Great to enable that, but not so great to force new stuff on everyone.
It doesn't surprise me at all if the patch here is the wrong one,
but something needs to be done differently in this configuration.

Perhaps you did not try on a system without SYSTEM_DATA_VERIFICATION
already enabled - that "select SYSTEM_DATA_VERIFICATION" seems to be
taking effect even when CFG80211_REQUIRE_SIGNED_REGDB is not enabled,
and pulls in a boatload.  I agree that seems strange: perhaps the
Kconfig problem is somewhere else entirely.

Attached my old 4.14 config, so you can see for yourself - thanks.

In fact, I cannot even build the resulting config, without scurrying
around to update userspace with stuff I never needed before:

  HOSTCC  scripts/extract-cert
scripts/extract-cert.c:21:25: fatal error: openssl/bio.h: No such file or 
directory

Hugh

> 
> johannes
> 
> > 
> > Signed-off-by: Hugh Dickins 
> > ---
> > 
> >  net/wireless/Kconfig |2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > --- 4.15-rc8/net/wireless/Kconfig   2017-12-03 10:22:51.928845056 -0800
> > +++ linux/net/wireless/Kconfig  2018-01-14 19:20:22.595472965 -0800
> > @@ -89,7 +89,7 @@ config CFG80211_CERTIFICATION_ONUS
> >  
> >  config CFG80211_REQUIRE_SIGNED_REGDB
> > bool "require regdb signature" if CFG80211_CERTIFICATION_ONUS
> > -   default y
> > +   default CFG80211_CERTIFICATION_ONUS
> > select SYSTEM_DATA_VERIFICATION
> > help
> >   Require that in addition to the "regulatory.db" file a

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Hugh Dickins]

On Thu, 18 Jan 2018, Johannes Berg wrote:
> On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
> > "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
> > is not set) to 4.15-rc, gets into asking lots of new questions, and
> > configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
> > it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
> > be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.
> 
> No, this is wrong - we want default configurations to be able to load a
> signed regulatory database and validate the signature.

Great to enable that, but not so great to force new stuff on everyone.
It doesn't surprise me at all if the patch here is the wrong one,
but something needs to be done differently in this configuration.

Perhaps you did not try on a system without SYSTEM_DATA_VERIFICATION
already enabled - that "select SYSTEM_DATA_VERIFICATION" seems to be
taking effect even when CFG80211_REQUIRE_SIGNED_REGDB is not enabled,
and pulls in a boatload.  I agree that seems strange: perhaps the
Kconfig problem is somewhere else entirely.

Attached my old 4.14 config, so you can see for yourself - thanks.

In fact, I cannot even build the resulting config, without scurrying
around to update userspace with stuff I never needed before:

  HOSTCC  scripts/extract-cert
scripts/extract-cert.c:21:25: fatal error: openssl/bio.h: No such file or 
directory

Hugh

> 
> johannes
> 
> > 
> > Signed-off-by: Hugh Dickins 
> > ---
> > 
> >  net/wireless/Kconfig |2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > --- 4.15-rc8/net/wireless/Kconfig   2017-12-03 10:22:51.928845056 -0800
> > +++ linux/net/wireless/Kconfig  2018-01-14 19:20:22.595472965 -0800
> > @@ -89,7 +89,7 @@ config CFG80211_CERTIFICATION_ONUS
> >  
> >  config CFG80211_REQUIRE_SIGNED_REGDB
> > bool "require regdb signature" if CFG80211_CERTIFICATION_ONUS
> > -   default y
> > +   default CFG80211_CERTIFICATION_ONUS
> > select SYSTEM_DATA_VERIFICATION
> > help
> >   Require that in addition to the "regulatory.db" file a

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Johannes Berg]

On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
> "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
> is not set) to 4.15-rc, gets into asking lots of new questions, and
> configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
> it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
> be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.

No, this is wrong - we want default configurations to be able to load a
signed regulatory database and validate the signature.

johannes

Re: [PATCH] cfg80211: stop demanding lots of new stuff

[Johannes Berg]

On Wed, 2018-01-17 at 14:55 -0800, Hugh Dickins wrote:
> "make oldconfig" from 4.14 (when CONFIG_CFG80211_CERTIFICATION_ONUS
> is not set) to 4.15-rc, gets into asking lots of new questions, and
> configuring in unwanted stuff: I'm unsure of my Kconfig skills, but
> it looks like CFG80211_REQUIRE_SIGNED_REGDB's "default y" needs to
> be toned down when we don't even have CFG80211_CERTIFICATION_ONUS.

No, this is wrong - we want default configurations to be able to load a
signed regulatory database and validate the signature.

johannes