Re: [gentoo-hardened] Help testing full end-to-end xattr support in portage

[Anthony G. Basile]

On 06/26/14 18:17, Luis Ressel wrote:
> My kernel has been XT-only for ages now, so no change required here. I
> installed install-xattr and applied the portage patch. So far I've
> reemerged python:2.7 - it worked fine and the duration was much more
> bearable than with the python-based install wrapper (down from 8
> minutes to 4 minutes, but still worse than the ~2 minutes in the good
> ol' days with vanilla install). I'll test more ebuilds in the next days.
>
> PS: I wonder if sys-apps/paxctl could be removed from the @system set
> now, as it's obsolete and superseded by elfix.
>
>
> Regards,
> Luis Ressel
>

There are two advantages to paxctl over paxctl-ng from elfix: 1) It 
doesn't depend on elfutils to do its manipulation of elf phdr's.  2) It 
does try to convert or create a PT_PAX_FLAGS phdr by either creating 
(-C) or converting (-c) a PT_GNU_STACK phdr.

The advantage of paxctl-ng over paxctl is 1) it is designed to do both 
PT_PAX and/or XATTR_PAX markings, 2) it is consciously designed to not 
try to create/convert ELF phdr's.

If we ever drop the PT_PAX_FLAGS patch from binutils then paxctl would 
no longer be needed and paxctl-ng can be reduced to just doing XATTR_PAX 
markings.

One step at a time ;)


-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
[phone]