Re: [PATCH 01/13 net-next] net: ipv4: introduce CONFIG_IPV4 to decouple the IPv4 stack
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2026-09-11 17:56:25
Also in:
batman, bridge, intel-wired-lan, linux-fsdevel, linux-nfs, linux-nvme, linux-rdma, linux-s390, linux-scsi, linux-sctp, linux-security-module, linux-wireless, lkml, lvs-devel, mptcp, netfilter-devel, target-devel
On 9/10/2026 7:48 AM, Fernando Fernandez Mancera wrote:
Historically, the IPv4 protocol has been linked to the core INET subsystem. Because shared infrastructure like the TCP/UDP engine, routing or INET hashtables live inside net/ipv4/, it has been impossible to compile a kernel with only IPv6 support. This patch introduces the CONFIG_IPV4 Kconfig symbol, which is set to 'def_bool y' for now. This does not allow to completely disable the IPv4 stack yet but it lays the necessary build-system work for that goal. In addition, multiple subsystems Kconfig symbols across networking features like tunnels, drivers and filesystems have been adjusted to depend on IPv4. Keep on mind that follow-up work is required to convert the Kconfig symbol to bool and remove the dependency on IPv4 where it makes sense. Signed-off-by: Fernando Fernandez Mancera <redacted> ---
...
security/smack/Kconfig | 1 + 54 files changed, 126 insertions(+), 66 deletions(-)
...
quoted hunk ↗ jump to hunk
diff --git a/security/smack/Kconfig b/security/smack/Kconfig index 5a8dfad469c3..b4e6d0168bd1 100644 --- a/security/smack/Kconfig +++ b/security/smack/Kconfig@@ -3,6 +3,7 @@ config SECURITY_SMACK bool "Simplified Mandatory Access Control Kernel Support" depends on NET depends on INET + depends on IPV4 depends on SECURITY select NETLABEL select SECURITY_NETWORK
Why would this make sense? You're introducing the capability to use IP6 by itself, which is admirable, but you're disallowing that configuration with the Smack LSM. It appears that you've done a mechanical lookup in the Kconfig files and applied the minimal change to make the kernel compile, which probably works for most cases. It does not work for Smack. Unless there's a strong argument that Smack with IPv6 and without IPv4 is and always will be a pointless configuration you have my NAK.