8 ms·

Oracle continue to circumvent EXPORT_SYMBOL_GPL()

151 points by fafner 12y ago

Karunamon 12y ago
Very interesting article; I wasn't aware that the kernel had this level of legalese/license shenaniganery built in.
- userbinator 12y ago
  It's basically a form of DRM, and the first time I saw it I was pretty taken aback too. Although this time, I'm actually on Oracle's side, since their workaround is yet another example that shows how technological measures to enforce copyright are an awfully bad idea. Maybe when more people realise the distinctly unique aspects of digital data and how, for lack of better words, pliable and copyable it is, we can have a real copyright reform. Of course that requires the population understand this type of thing, but a copyright reform is exactly what companies like Oracle don't want, so the probability is pretty low...
adriancooney 12y ago
Programming like that must be an absolute nightmare. Not only would have to understand the convoluted API scheme, you'd have to research the origins to see if you can legally use it. Things have gone too far when you start namespacing by license.
- awda 12y ago
  The usual and suggested way is to get it included in the mainline kernel. This reduces the pain a lot.
  - plantain 12y ago
    How does that help exactly? Here's an example of Microsoft suing TomTom over components of the off-the-shelf Linux kernel. http://en.wikipedia.org/wiki/Microsoft_Corp._v._TomTom_Inc http://en.wikipedia.org/wiki/Microsoft_Corp._v._TomTom_Inc.
    - awda 12y ago
      > > The usual and suggested way is to get it included in the mainline kernel. This reduces the pain a lot. > How does that help exactly? Here's what GP asked about: > Programming like that must be an absolute nightmare. Not only would have to understand the convoluted API scheme, you'd have to research the origins to see if you can legally use it. So, I guess the answer is "because if you take my (and every other kernel developer's) advice, you don't have to program like that." Was the not clear? Sorry. I guess the follow up question is, what the hell does the Tom Tom case have to do with GP's question?
- catern 12y ago
  Sure, but all you have to do to avoid this nightmare use the GPL. So since this encourages people to contribute their code back to the community (by releasing it under the GPL or a GPL-compatible license), I think it's a good thing.
  - nly 12y ago
    Nice in theory, but many commercial shops will just use BSD instead. And that's fine.
    - awda 12y ago
      They are welcome to license kernel contributions under dual BSD/GPL ;-).
  - poolpool 12y ago
    It doesn't encourage. It forces. Which could be another nightmare.
    - elipsey 12y ago
      Yes, if you use gpl'd code for free, the license forces you to share the improvements you make. That's the whole point of the GPL. No one forces you to use gpl'd code; if you don't like it, go write your own code.
th3iedkid 12y ago
i still remember the day in a meeting when someone spoke of my employer having acquired some lic for a product which they designed to modify and i asked if we have a legal team to analyze it , well the director came back shouting another team should take the job!
zobzu 12y ago
making stuff open source seems much easier than battling for inserting proprietary code. hint hint.
- protomyth 12y ago
  DTrace is open source and found in OS X and FreeBSD. DTrace is not proprietary code.
  - justincormack 12y ago
    And there are no barriers to it being licensed so that it could be included in Linux, other than Oracle not wanting to.
    - micampe 12y ago
      Just like there are no barriers to changing the GPL so it is compatible with the CDDL, other than the FSF not wanting to?
      - jordigh 12y ago
        There is a barrier to changing Linux's license: way too many copyright holders, several of which are dead.
        Sanddancer 12y ago
        Which also exists in CDDL code. Viral copyright makes it real difficult to share things if various parties have different ideas as to how to best require others to share files.
        jordigh 12y ago
        The comparison at hand is with DTrace, which has afaik only Oracle as the copyright holder, so they could change the license if they wanted to. CDDL is a bit weird. It's a free license that has a pointless restriction merely in order to make it GPL incompatible. Why people want to make things deliberately GPL incompatible is beyond me.
diakritikal 12y ago
Oracle are their own worst problem right now. My managing director dictated Libre Office over Open Office because it solves his problems with OO. My dev team are keen as mustard to replace the remaining MySQL instances with MariaDB. Supporting an opaque platform that in turn is not likely to be supported by the distro's we use is not an appealing proposition. Oracle respin of Red Hat was never an appealing option. We're a SUSE crowd at heart anyway. From Oracles offerings (the ones they bought, we'll never use oracle DB) that leaves Java as a language and tool set. Dev time is too costly, the language is too clunky, the memory pressure is too high.
- AndrewBissell 12y ago
  > ... that leaves Java as a language and tool set. Dev time is too costly, the language is too clunky, the memory pressure is too high. Are there languages out there with lower memory pressure that cost less in dev time?
  - higherpurpose 12y ago
    Isn't Go's purpose to be a high-performance language that improves worker productivity?
    - sliverstorm 12y ago
      Relative to what other languages, though? The competition gives important context. I can say, "Language X is designed to be fast". But that doesn't tell you what it is good for. What if I say "Language X is designed to be faster than Python"? Doesn't that tell you way more about Language X?
  - euank 12y ago
    You will doubtlessly get many opinions on this. It's worth keeping in mind that the "dev time" is a function of existing libraries, internal and external. At any fairly large company (e.g. Google) that has many existing internal libraries in some language (java), the dev time will be massive to switch. By this logic, the dev time is too costly for absolutely any language you pick other than the one being used. There is little exception to this. For a programmer or programmers with no legacy cruft, I'd argue that dev time is more a function of the programmer's familiarity with a language than the language itself. Perhaps there are a few exceptions to that, but in general I don't think that a language should be described as "too" anything. Java might be memory inefficient, but does that mean it's usage "too high"? Clearly not for some people as it's still used frequently.
fiatmoney 12y ago
I wonder if, with the right septuagenarian judge, this constitutes unauthorized access to a protected computer system?
dredmorbius 12y ago
Seems to me that the appropriate attack might be fraud and misrepresentation, if not copyright abuse. That's an attack which could be levied on Oracle by any party (oh, say, someone who's already upset at them for some reason, perhaps Google), not just a kernel copyright holder or The Linux Foundation.
- dredmorbius 12y ago
  I'm curious about the apparent disagreement here. The misrepresentation is of the module as being validly licensed under the GNU GPL where it clearly isn't. In an earlier case concerning copyright, the question rose whether or not a brief citation for functional reasons was valid or an infringement of copyright. The court's decision was that a literal quoting that served functional purpose was not, in fact, a violation of copyright. https://en.wikipedia.org/wiki/Sega_v._Accolade https://en.wikipedia.org/wiki/Sega_v._Accolade The case with regards Oracle involves the use of one of two largely equivalent mechanisms. As the article discusses: The kernel actually has two levels of exposed (non-userspace) API - those exported via EXPORT_SYMBOL() and those exported via EXPORT_SYMBOL_GPL(). Symbols exported via EXPORT_SYMBOL_GPL() may only be used by modules that claim to be GPLed, with the kernel refusing to load them otherwise. There is no technical limitation on the use of symbols exported via EXPORT_SYMBOL(). Use of EXPORT_SYMBOL and EXPORT_SYMBOL_GPL are equivalent except for the expressed compatibility with the GPL license. Use of EXPORT_SYMBOL_GPL where it's not justified is making a claim about suitability of use. That is the basis for my fraud claim.
fafner 12y ago
SystemTap is a tracing framework for GNU/Linux without such license issues and available on several distributions: https://sourceware.org/systemtap/ https://sourceware.org/systemtap/
varkson 12y ago
Can someone explain the point of having EXPORT_SYMBOL_GPL() and EXPORT_SYMBOL()? Is it trying to protect the user from accidentally violating the GPL? More importantly, why is there no high resolution clock available from EXPORT_SYMBOL()? Is it deliberately gimped, or is there issues with getting such a piece of software into the kernel whilst not being GPL'd?
- _pghu 12y ago
  > Is it deliberately gimped Yes. It's deliberately gimped because the author of the function decided Freedom™ is more important than functionality and so they hid it behind a license check. Most new symbols exported after its introduction are exported with the GPL check. See this for more info: http://lkml.iu.edu/hypermail/linux/kernel/0110.2/0369.html http://lkml.iu.edu/hypermail/linux/kernel/0110.2/0369.html
  - lawl 12y ago
    > Yes. It's deliberately gimped because the author of the function decided Freedom™ is more important than functionality and so they hid it behind a license check. Would have been a good comment without that remark, and almost certainly why you got downvoted. I gave you an upvote anyways, because the link is actually relevant and helpful.
    - Dylan16807 12y ago
      I think that remark makes the comment better. It's ridiculous to claim that a simple timer has relevance to creating a derivative work, and the implication of zealotry in anyone making that claim via EXPORT_SYMBOL_GPL is appropriate.
      - pmjordan 12y ago
        The whole reason this is even an issue is the ambiguity of the license on the subject of dynamic linking and what precisely constitutes a derived work. Of course, if Linus wanted proprietary kernel extensions, he should have picked LGPL, but the issue arose long after the license was originally picked (and there being any possibility of changing/clarifying it). Also, no "or any higher version" clause, so the only way this is ever going to be resolved one way or another is in court. FWIW, my impression is GPLv3 wouldn't have helped here either.
userbinator 12y ago
with the kernel refusing to load them otherwise This makes me wonder how easy it would be to write a (GPL'd) kernel module whose only purpose is to scan for and NOP out these silly checks! Props to Oracle for taking the "fuck you" approach with this. And a "fuck you" to Oracle for everything else they've done...
CrispEditor 12y ago
Note that DTrace/Linux exists outside of Oracle. (Search github for dtrace4linux). As that author of the product, I took a different approach to the GPL symbols - one which may be questionable, but nobody has raised the issue as yet. Yes, GPL symbols are problematic, and the dtrace4linux is CDDL - the GPL vs CDDL - means its impossible, from a legal perspective to get the balance right. That does not preclude generation of a useful tool - the beauty of all open source - is the ability to learn from it.

151 points by fafner 12y ago

Karunamon 12y ago

Very interesting article; I wasn't aware that the kernel had this level of legalese/license shenaniganery built in.

userbinator 12y ago
It's basically a form of DRM, and the first time I saw it I was pretty taken aback too. Although this time, I'm actually on Oracle's side, since their workaround is yet another example that shows how technological measures to enforce copyright are an awfully bad idea. Maybe when more people realise the distinctly unique aspects of digital data and how, for lack of better words, pliable and copyable it is, we can have a real copyright reform. Of course that requires the population understand this type of thing, but a copyright reform is exactly what companies like Oracle don't want, so the probability is pretty low...

adriancooney 12y ago

Programming like that must be an absolute nightmare. Not only would have to understand the convoluted API scheme, you'd have to research the origins to see if you can legally use it. Things have gone too far when you start namespacing by license.

awda 12y ago
The usual and suggested way is to get it included in the mainline kernel. This reduces the pain a lot.
- plantain 12y ago
  How does that help exactly? Here's an example of Microsoft suing TomTom over components of the off-the-shelf Linux kernel. http://en.wikipedia.org/wiki/Microsoft_Corp._v._TomTom_Inc http://en.wikipedia.org/wiki/Microsoft_Corp._v._TomTom_Inc.
  - awda 12y ago
    > > The usual and suggested way is to get it included in the mainline kernel. This reduces the pain a lot. > How does that help exactly? Here's what GP asked about: > Programming like that must be an absolute nightmare. Not only would have to understand the convoluted API scheme, you'd have to research the origins to see if you can legally use it. So, I guess the answer is "because if you take my (and every other kernel developer's) advice, you don't have to program like that." Was the not clear? Sorry. I guess the follow up question is, what the hell does the Tom Tom case have to do with GP's question?
catern 12y ago
Sure, but all you have to do to avoid this nightmare use the GPL. So since this encourages people to contribute their code back to the community (by releasing it under the GPL or a GPL-compatible license), I think it's a good thing.
- nly 12y ago
  Nice in theory, but many commercial shops will just use BSD instead. And that's fine.
  - awda 12y ago
    They are welcome to license kernel contributions under dual BSD/GPL ;-).
- poolpool 12y ago
  It doesn't encourage. It forces. Which could be another nightmare.
  - elipsey 12y ago
    Yes, if you use gpl'd code for free, the license forces you to share the improvements you make. That's the whole point of the GPL. No one forces you to use gpl'd code; if you don't like it, go write your own code.

th3iedkid 12y ago

i still remember the day in a meeting when someone spoke of my employer having acquired some lic for a product which they designed to modify and i asked if we have a legal team to analyze it , well the director came back shouting another team should take the job!

zobzu 12y ago

making stuff open source seems much easier than battling for inserting proprietary code. hint hint.

protomyth 12y ago
DTrace is open source and found in OS X and FreeBSD. DTrace is not proprietary code.
- justincormack 12y ago
  And there are no barriers to it being licensed so that it could be included in Linux, other than Oracle not wanting to.
  - micampe 12y ago
    Just like there are no barriers to changing the GPL so it is compatible with the CDDL, other than the FSF not wanting to?
    - jordigh 12y ago
      There is a barrier to changing Linux's license: way too many copyright holders, several of which are dead.
      - Sanddancer 12y ago
        Which also exists in CDDL code. Viral copyright makes it real difficult to share things if various parties have different ideas as to how to best require others to share files.
        jordigh 12y ago
        The comparison at hand is with DTrace, which has afaik only Oracle as the copyright holder, so they could change the license if they wanted to. CDDL is a bit weird. It's a free license that has a pointless restriction merely in order to make it GPL incompatible. Why people want to make things deliberately GPL incompatible is beyond me.

diakritikal 12y ago

Oracle are their own worst problem right now. My managing director dictated Libre Office over Open Office because it solves his problems with OO. My dev team are keen as mustard to replace the remaining MySQL instances with MariaDB. Supporting an opaque platform that in turn is not likely to be supported by the distro's we use is not an appealing proposition. Oracle respin of Red Hat was never an appealing option. We're a SUSE crowd at heart anyway. From Oracles offerings (the ones they bought, we'll never use oracle DB) that leaves Java as a language and tool set. Dev time is too costly, the language is too clunky, the memory pressure is too high.

AndrewBissell 12y ago
> ... that leaves Java as a language and tool set. Dev time is too costly, the language is too clunky, the memory pressure is too high. Are there languages out there with lower memory pressure that cost less in dev time?
- higherpurpose 12y ago
  Isn't Go's purpose to be a high-performance language that improves worker productivity?
  - sliverstorm 12y ago
    Relative to what other languages, though? The competition gives important context. I can say, "Language X is designed to be fast". But that doesn't tell you what it is good for. What if I say "Language X is designed to be faster than Python"? Doesn't that tell you way more about Language X?
- euank 12y ago
  You will doubtlessly get many opinions on this. It's worth keeping in mind that the "dev time" is a function of existing libraries, internal and external. At any fairly large company (e.g. Google) that has many existing internal libraries in some language (java), the dev time will be massive to switch. By this logic, the dev time is too costly for absolutely any language you pick other than the one being used. There is little exception to this. For a programmer or programmers with no legacy cruft, I'd argue that dev time is more a function of the programmer's familiarity with a language than the language itself. Perhaps there are a few exceptions to that, but in general I don't think that a language should be described as "too" anything. Java might be memory inefficient, but does that mean it's usage "too high"? Clearly not for some people as it's still used frequently.

fiatmoney 12y ago

I wonder if, with the right septuagenarian judge, this constitutes unauthorized access to a protected computer system?

dredmorbius 12y ago

Seems to me that the appropriate attack might be fraud and misrepresentation, if not copyright abuse. That's an attack which could be levied on Oracle by any party (oh, say, someone who's already upset at them for some reason, perhaps Google), not just a kernel copyright holder or The Linux Foundation.

dredmorbius 12y ago
I'm curious about the apparent disagreement here. The misrepresentation is of the module as being validly licensed under the GNU GPL where it clearly isn't. In an earlier case concerning copyright, the question rose whether or not a brief citation for functional reasons was valid or an infringement of copyright. The court's decision was that a literal quoting that served functional purpose was not, in fact, a violation of copyright. https://en.wikipedia.org/wiki/Sega_v._Accolade https://en.wikipedia.org/wiki/Sega_v._Accolade The case with regards Oracle involves the use of one of two largely equivalent mechanisms. As the article discusses: The kernel actually has two levels of exposed (non-userspace) API - those exported via EXPORT_SYMBOL() and those exported via EXPORT_SYMBOL_GPL(). Symbols exported via EXPORT_SYMBOL_GPL() may only be used by modules that claim to be GPLed, with the kernel refusing to load them otherwise. There is no technical limitation on the use of symbols exported via EXPORT_SYMBOL(). Use of EXPORT_SYMBOL and EXPORT_SYMBOL_GPL are equivalent except for the expressed compatibility with the GPL license. Use of EXPORT_SYMBOL_GPL where it's not justified is making a claim about suitability of use. That is the basis for my fraud claim.

fafner 12y ago

SystemTap is a tracing framework for GNU/Linux without such license issues and available on several distributions: https://sourceware.org/systemtap/ https://sourceware.org/systemtap/

varkson 12y ago

Can someone explain the point of having EXPORT_SYMBOL_GPL() and EXPORT_SYMBOL()? Is it trying to protect the user from accidentally violating the GPL? More importantly, why is there no high resolution clock available from EXPORT_SYMBOL()? Is it deliberately gimped, or is there issues with getting such a piece of software into the kernel whilst not being GPL'd?

_pghu 12y ago
> Is it deliberately gimped Yes. It's deliberately gimped because the author of the function decided Freedom™ is more important than functionality and so they hid it behind a license check. Most new symbols exported after its introduction are exported with the GPL check. See this for more info: http://lkml.iu.edu/hypermail/linux/kernel/0110.2/0369.html http://lkml.iu.edu/hypermail/linux/kernel/0110.2/0369.html
- lawl 12y ago
  > Yes. It's deliberately gimped because the author of the function decided Freedom™ is more important than functionality and so they hid it behind a license check. Would have been a good comment without that remark, and almost certainly why you got downvoted. I gave you an upvote anyways, because the link is actually relevant and helpful.
  - Dylan16807 12y ago
    I think that remark makes the comment better. It's ridiculous to claim that a simple timer has relevance to creating a derivative work, and the implication of zealotry in anyone making that claim via EXPORT_SYMBOL_GPL is appropriate.
    - pmjordan 12y ago
      The whole reason this is even an issue is the ambiguity of the license on the subject of dynamic linking and what precisely constitutes a derived work. Of course, if Linus wanted proprietary kernel extensions, he should have picked LGPL, but the issue arose long after the license was originally picked (and there being any possibility of changing/clarifying it). Also, no "or any higher version" clause, so the only way this is ever going to be resolved one way or another is in court. FWIW, my impression is GPLv3 wouldn't have helped here either.

userbinator 12y ago

with the kernel refusing to load them otherwise This makes me wonder how easy it would be to write a (GPL'd) kernel module whose only purpose is to scan for and NOP out these silly checks! Props to Oracle for taking the "fuck you" approach with this. And a "fuck you" to Oracle for everything else they've done...

CrispEditor 12y ago

Note that DTrace/Linux exists outside of Oracle. (Search github for dtrace4linux). As that author of the product, I took a different approach to the GPL symbols - one which may be questionable, but nobody has raised the issue as yet. Yes, GPL symbols are problematic, and the dtrace4linux is CDDL - the GPL vs CDDL - means its impossible, from a legal perspective to get the balance right. That does not preclude generation of a useful tool - the beauty of all open source - is the ability to learn from it.