| 1 |
On Thu, 14 Jul 2011 19:19:11 -0400 |
| 2 |
Mike Frysinger <vapier@g.o> wrote: |
| 3 |
|
| 4 |
> > 3) Since a hardened kernel can be configure with various flavors of |
| 5 |
> > "pax" or "grsec" or "selinux", there should be useflags to reflect |
| 6 |
> > userland needs to conform. There already is a "selinux" flag which |
| 7 |
> > is set by selinux profiles. Currently we don't see a need for a |
| 8 |
> > "grsec" flag, however, there is a need for a "pax" global use flag |
| 9 |
> > which we propose calling "pax_kernel". (If nothing else to |
| 10 |
> > distinguish it from app-arch/pax.) |
| 11 |
> > |
| 12 |
> > Userland binaries which will run under a pax enabled kernel may need |
| 13 |
> > special treatment to run, or else they'll be killed by the kernel. |
| 14 |
> > The best example here is an RWX mmapping. Although the ideal case |
| 15 |
> > is to "fix the code" this is not always feasible and so binaries |
| 16 |
> > will still need markings with paxctl -m. |
| 17 |
> |
| 18 |
> if `paxctl` is installed, then i say always run `paxctl` on the |
| 19 |
> problematic binaries regardless of USE flags. have the |
| 20 |
> hardened-sources package depend on paxctl, and then that takes care |
| 21 |
> of the dependency. -mike |
| 22 |
|
| 23 |
Do we support migrating existing systems to hardened? If so, then this |
| 24 |
solution will leave users with a need to manually remerge pax-setting |
| 25 |
packages. Though, I guess, it's pretty easy to grab that package list |
| 26 |
on pax-utils.eclass inherit. |
| 27 |
|
| 28 |
-- |
| 29 |
Best regards, |
| 30 |
Michał Górny |
Archives