27

Recently, all entries with Russian email addresses were removed from the Linux MAINTAINERS file which lists people "maintaining" parts of the kernel. "Maintaining" here means, if I understand correctly, that they keep their part of the kernel in working order by reviewing and merging code from others. They often also contribute code themselves, but that is not a requirement.

The reason stated for the change was "various compliance requirements". Now I would understand fears of backdoor injection, and I understand that Linus feels hostile towards Russia, but I have a hard time seeing how sanctions apply here: The contributions are essentially gifts (even if the contributors may be paid to produce them by Russian companies). it is also noteworthy that the MAINTAINERS file is informational only: It provides links to people that can be contacted with questions or patches. The file also does not carry a copyright and therefore, unless I miss something, simply falls under the GPL.

The patch was supplied by Greg Kroah-Hartman who is, like Linus Torvalds, employed by the Linux Foundation which is based in San Francisco, thus underlying U.S. law. But the Foundation does not "host" the Linux kernel.

How do American sanctions affect Linux? What role does the Linux Foundation play? After all, Linux is hosted on a distributed version control system (even if the actual development is essentially broadly hierarchical, with Linus as the final arbiter).

Improve this question
13

3 Answers 3

Reset to default
26

According to James Bottomley, the legal advice that led to this change was:

If your company is on the U.S. OFAC SDN lists, subject to an OFAC sanctions program, or owned/controlled by a company on the list, our ability to collaborate with you will be subject to restrictions, and you cannot be in the MAINTAINERS file.

OFAC is the United States Treasury Office of Foreign Assets Control, and SDN is the Specially Designated Nationals list, which you can search at the Sanctions List Search.

One of the maintainers who was removed is Sergey Semin, who recently, as of February 2024, used an email address @baikalelectronics.ru for contributions to the Linux kernel. Baikal Electronics JSC is listed on the OFAC SDN as subject to Executive Order 14024, which prohibits, among other things,

[§ 2(b)] the receipt of any contribution or provision of funds, goods, or services from any such person,

and is generally targeted at the Russian Federation.

This explains the removal of Sergey Semin from the MAINTAINERS file, which Bottomley confirmed:

In your [Sergey Semin's] specific case, the problem is your employer is on that list. If there's been a mistake and your employer isn't on the list, that's the documentation Greg is looking for.

The other maintainers who were removed were all the maintainers with .ru email addresses in the MAINTAINERS file, and in order to be reinstated, James Bottomley reports Greg Kroah-Hartman has asked that they provide documentation that they and their employers are not on the sanctions list:

The documentation Greg is looking for (which a group of Lawyers at the LF will verify) is that someone in the removed list doesn't actually work for an OFAC SDN sanctioned entity.

It is unclear whether any other of the removed maintainers are actually subject to sanctions under EO 14024 or similar, so this doesn't explain why Russian contributors other than Sergey Semin were summarily removed, but one might guess that the Linux Foundation's legal counsel overshot in an abundance of caution.

In contrast, although Huawei is sanctioned too, the sanctions on Huawei are under EO 13959/14032, which prohibits US entities from investing in Huawei but is not as restrictive as EO 14024. According to Theodore Ts'o, this is why Huawei engineers remain in the MAINTAINERS file while the Baikal engineer was removed.

Improve this answer
9
  • 1
    Does this mean that they won't be able to commit in the future (while the sanctions are in place)? Does it mean that certain extablished code would have to be removed from the Kernel?
    – Brandin
    Commented Oct 25 at 8:41
  • Bottomley says above that, for affected persons, "our ability to collaborate with you will be subject to restrictions, and you cannot be in the MAINTAINERS file". So the only definitive requirement is the MAINTAINERS one, which has been done. As I read that, patches henceforth might well be affected, but we don't yet know. Generally speaking, everyone tries to avoid passing retroactive laws, it being generally held that it's wrong to punish people for actions that weren't against the law when they were committed, so I'd be very surprised if existing code had to be removed.
    – MadHatter ♦
    Commented Oct 25 at 9:05
  • @Brandin Unclear. Nobody has, to my knowledge, published any credible legal analysis of sanctions on free software collaboration beyond the terse one-sentence advice quoted at the top from LF attorneys. The US Constitution prohibits ex post facto laws, which plainly precludes US law from retroactively punishing past collaboration (similarly for European state signatories to ECHR and many other states). Future patches from @baikalelectronics.ru addresses are almost certain to be rejected. Contributors in Russia are likely required to furnish documentation to LF about their employers.
    – Sanctified Brethren
    Commented Oct 25 at 13:32
  • 4
    I really like Serge's good-bye letter (the first post in the thread James Bottomley answered to in the first link). The journey of a probably fairly typical Linux enthusiast and contributor, learning by doing, with all the ups and downs and different personalities one encounters over the years, who all share a goal: To keep this unlikely blob of code afloat. And eventually, out of all these small and big achievements, sometimes in strides, sometimes in coughs and fits: A miraculous and epic result.
    – Peter - Reinstate Monica
    Commented Oct 25 at 15:37
  • 3
    @Peter-ReinstateMonica: The publication of legal advice is very likely to waive at least some attorney-client privilege that might otherwise have attached (because the said privilege is usually limited to confidential communications with one's lawyer). As you might imagine, lawyers are rather cagey about making that sort of waiver, because it can expose their clients to legal liability.
    – Kevin
    Commented Oct 25 at 23:59
20

LWN, who are generally pretty well-informed on free software matters, have so far reported this only in passing. They do note that the change was released in such a manner as, arguably, to make it likely to be missed; read into that what you will.

Examination of Greg's patch reveals it's not just .ru addresses; some maintainers with gmail addresses were also removed, so this doesn't look like an uninformed snap decision. No public discussion happened beforehand, and Greg's patch (and Linus' followup) contain nothing other than a single sentence about "compliance", so as has been pointed out we can't (yet) know what motivated this.

Linus has since noted that the change was driven by actual legal advice to the maintainers. He won't say what that was, but again, there are grounds for thinking this isn't just some performative stunt.

As for the whole Linux-Foundation-is-controlled-by-the-US-gummint thing, well, it certainly has to obey US laws. But Linus is the guy with final say on what goes into the kernel, not the Foundation, and I don't think the Foundation is so foolish as to assume that their paying him means they get to tell him what to do in that regard. In the limiting case, Linus still has Finnish citizenship, so as an EU national has nearly thirty other countries he could go and live in if the US government decided to get hot and heavy with him.

Edit: since I wrote this, more information has become available. At the time of writing this edit, the latest news is ably summarised by Sanctified Brethren in his/her answer, which I think is well-worth reading.

Improve this answer
8
  • 3
    heise.de wrote that Linux Foundation comments state that the maintainers, which have been removed, were employed by companies, which are on the EU and US sanctions list due to their links with the Russian Army. So sanctions seem to be the driving force.
    – Martin_in_AUT
    Commented Oct 24 at 11:54
  • @Martin_in_AUT thank you for that. I've removed my (slightly flip) comment about SOX compliance, and most of my speculation (which in retrospect I don't think was helpful). More facts, less flannel, I hope!
    – MadHatter ♦
    Commented Oct 24 at 12:02
  • 2
    I have seen the idea that the removal was (perhaps additionally) for the benefit of the removed maintainers before, and I think it is plausible. It is all very unpleasant. What strikes me as odd is that threats like that (pressure maintainers, or have maintainer be undercover agents outright) are ubiquitous, by no means restricted to Russia and certainly not solved by purging what are essentially email contact lists.
    – Peter - Reinstate Monica
    Commented Oct 24 at 12:05
  • 5
    What we deal with is essentially a Linux supply chain attack. State level actors will approach it with the same depth of resources and long-term perspective as, say, Israel approached the recent pager supply chain attack. That is, entire companies will be founded solely for this purpose, key players will build up trust over years, etc. The true depth of this problem is not addressed by removing official, known maintainers. (Openness and building expertise among contributors and reviewers is key here.)
    – Peter - Reinstate Monica
    Commented Oct 24 at 12:10
  • 1
    That's definitely one way of looking at it. My preferred way is to note that (a) duplication of information in a single page is wasteful, and (b) my answer hasn't yet been made canonical by the OP's acceptance, so (c) what I hope will happen is that my answer, which was well-received in the early days of this furore when little was known, will gradually get superseded by votes for the later-but-more-informative answer. If you think what Sanctified said was worth saying (which I hope you do, as you repeated it) feel free to upvote his/her answer. I have!
    – MadHatter ♦
    Commented Oct 25 at 6:53
10

Here is the Linus response that I think at least partially answers the question:

It's entirely clear why the change was done, it's not getting reverted, and using multiple random anonymous accounts to try to "grass root" it by Russian troll factories isn't going to change anything.

And FYI for the actual innocent bystanders who aren't troll farm accounts - the "various compliance requirements" are not just a US thing.

If you haven't heard of Russian sanctions yet, you should try to read the news some day. And by "news", I don't mean Russian state-sponsored spam.

As to sending me a revert patch - please use whatever mush you call brains. I'm Finnish. Did you think I'd be supporting Russian aggression? Apparently it's not just lack of real news, it's lack of history knowledge too.":

At least some maintainers actually maintained drivers for Russian devices, such as Baikal processors. The inability to maintain these drivers in a standard kernel makes using these devices more difficult. As with any other processor, the Baikal processor can also be installed in a system for military purposes.

Improve this answer
2
  • 1
    Baikal (the whole family) has no purpose other than military. They are expensive as hell, underpowered and generally unavailable.
    – fraxinus
    Commented Oct 26 at 6:50
  • 1
    Does not matter even if it would. Name the CPU that cannot quide a combat drone.
    – x64
    Commented Oct 26 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.