[PATCH v2] net: disable BRIDGE_NETFILTER by default

From: Roman Kiryanov <redacted>

The description says 'If unsure, say N.' but
the module is built as M by default (once
the dependencies are satisfied).

When the module is selected (Y or M), it enables
NETFILTER_FAMILY_BRIDGE and SKB_EXTENSIONS
which alter kernel internal structures.

We (Android Studio Emulator) currently do not
use this module and think this it is more consistent
to have it disabled by default as opposite to
disabling it explicitly to prevent enabling
NETFILTER_FAMILY_BRIDGE and SKB_EXTENSIONS.

Signed-off-by: Roman Kiryanov <redacted>
---
Changes in v2:
 - added cc:netdev@vger.kernel.org

 net/Kconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/Kconfig b/net/Kconfig
index b0937a700f01..2eeb0e55f7c9 100644
--- a/net/Kconfig
+++ b/net/Kconfig

@@ -189,7 +189,6 @@ config BRIDGE_NETFILTER
 	depends on NETFILTER_ADVANCED
 	select NETFILTER_FAMILY_BRIDGE
 	select SKB_EXTENSIONS
-	default m
 	---help---
 	  Enabling this option will let arptables resp. iptables see bridged
 	  ARP resp. IP traffic. If you want a bridging firewall, you probably

-- 
2.25.0.265.gbab2e86ba0-goog

rkir@google.com [off-list ref] wrote:

From: Roman Kiryanov <redacted>

The description says 'If unsure, say N.' but
the module is built as M by default (once
the dependencies are satisfied).

Acked-by: Florian Westphal <fw@strlen.de>

From: rkir@google.com
Date: Wed, 19 Feb 2020 13:40:06 -0800

From: Roman Kiryanov <redacted>

The description says 'If unsure, say N.' but
the module is built as M by default (once
the dependencies are satisfied).

When the module is selected (Y or M), it enables
NETFILTER_FAMILY_BRIDGE and SKB_EXTENSIONS
which alter kernel internal structures.

We (Android Studio Emulator) currently do not
use this module and think this it is more consistent
to have it disabled by default as opposite to
disabling it explicitly to prevent enabling
NETFILTER_FAMILY_BRIDGE and SKB_EXTENSIONS.

Signed-off-by: Roman Kiryanov <redacted>

Applied.