Re: [gentoo-hardened] SElinux

[Chris PeBenito]

On Tue, 2005-04-19 at 11:24 -0600, Jason K Larson wrote:
> Is this the best method for all archs, or was this just the suggestion
> for AMD64?

You're talking about three different architectures so I'm a little
confused, but I'll try to answer anyway.

> I'm looking to deploy 2x PPC G4s as (secured) Internet Kiosks using
> hardened and selinux.  The traffic will be controled by a third PPC G4
> that will act as a firewall/gateway for the other two running an
> iptables firewall.

There is no PPC pie-ssp SELinux profile, since no one has requested it.
In fact I only know of 1 or 2 people that even use SELinux on PPC other
then me (though that doesn't mean that there isn't more).  I don't know
what the status of pie-ssp on non-x86 archs is.

> If I understand this correctly from watching the lists.  The best method
> is to use the no-multilib profile and add the hardened (+pic +pie?) to
> USE flags and then follow the selinux guide to convert to selinux.  Is
> it really that different to use a hardened profile?

The SELinux AMD64 profile is multilib, and there is no option for
no-multilib.  If you try to convert a no-multilib system over to the
SELinux profile, I don't know what will happen.  So if pie-ssp on AMD64
wants to be no-multilib, then you will be out of luck.

> Also, when converting to selinux, I noticed a
> selinux/2004.1/x86/hardened profile, while that doesn't help me for the
> PPC platform, is that a recommened route for my x86 boxes?

If you are looking for SELinux-pie-ssp, yes.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243