Re: [PATCH 01/13 net-next] net: ipv4: introduce CONFIG_IPV4 to decouple the IPv4 stack

On 9/11/26 7:46 PM, Casey Schaufler wrote:

On 9/10/2026 7:48 AM, Fernando Fernandez Mancera wrote:

quoted

Historically, the IPv4 protocol has been linked to the core INET
subsystem. Because shared infrastructure like the TCP/UDP engine,
routing or INET hashtables live inside net/ipv4/, it has been impossible
to compile a kernel with only IPv6 support.

This patch introduces the CONFIG_IPV4 Kconfig symbol, which is set to
'def_bool y' for now. This does not allow to completely disable the
IPv4 stack yet but it lays the necessary build-system work for that
goal.

In addition, multiple subsystems Kconfig symbols across networking
features like tunnels, drivers and filesystems have been adjusted to
depend on IPv4. Keep on mind that follow-up work is required to convert
the Kconfig symbol to bool and remove the dependency on IPv4 where it
makes sense.

Signed-off-by: Fernando Fernandez Mancera <redacted>
---
  

...

quoted

  security/smack/Kconfig                        |  1 +
  54 files changed, 126 insertions(+), 66 deletions(-)

...

quoted

diff --git a/security/smack/Kconfig b/security/smack/Kconfig
index 5a8dfad469c3..b4e6d0168bd1 100644
--- a/security/smack/Kconfig
+++ b/security/smack/Kconfig

@@ -3,6 +3,7 @@ config SECURITY_SMACK
  	bool "Simplified Mandatory Access Control Kernel Support"
  	depends on NET
  	depends on INET
+	depends on IPV4
  	depends on SECURITY
  	select NETLABEL
  	select SECURITY_NETWORK

Why would this make sense? You're introducing the capability to use
IP6 by itself, which is admirable, but you're disallowing that configuration
with the Smack LSM. It appears that you've done a mechanical lookup in the
Kconfig files and applied the minimal change to make the kernel compile,
which probably works for most cases. It does not work for Smack. Unless
there's a strong argument that Smack with IPv6 and without IPv4 is and always
will be a pointless configuration you have my NAK.

Right, that was kind of the point. The idea was to be able to compile 
core networking without IPv4. There are still plenty of modules that 
depends on IPv4. It does not mean that they will remain like that 
forever as I mentioned my idea was a follow-up on the series to avoid 
having a too long series.

Anyway, I can make Smack to do not depend on IPv4 on this series if that 
could grant an ACK.

Thanks,
Fernando.