Re: [gentoo-hardened] Current proposed way of installing gentoo hardened

[Kevin]

Hi Ed-

Again, thanks for the long and thoughtful reply.  From it, I think I 
discovered a part of my problem and that part lies with semantics.  What 
I mean is this: when I see someone say Hardened Gentoo Project I have 
been thinking that this implicitly involves the SELinux subproject (not 
as one-and-the-same, but as an implicitly included subproject).  After 
all, SELinux is clearly one of the subprojects of the Hardened Project 
and apparently a rather major one.  From your last post, I now see that 
one can have a Hardened Gentoo System with SELinux or a Hardened Gentoo 
system without SELinux.  Or at least, I think that's right.  Could you 
confirm that?  Can one also have a non-Hardened Gentoo system with 
SELinux?  Is that what one gets by strictly following the SELinux install 
guide (no mention of special compiler or linker flags in there)?

In case other folks out there suffer from the same misconception, someone 
involved in the Project or subprojects might want to include something on 
the Hardened web pages that says, "...this is what we mean by 
Hardened..." like you've done here.  Or maybe even some naming 
convention: "Gentoo Hardened with SELinux", "Gentoo Hardened without 
SELinux, but with these subprojects", etc.  I don't know, but that has 
been a part of my problem: a misunderstanding of definitions.

Another part of my problem is that I didn't realize that to install a 
Hardened Gentoo system without SELinux, one could use the Gentoo Handbook 
(not the SELinux install guide which is the only install guide at the 
Hardened web pages) and do something very similar to a normal install.  
Thanks for clarifying that.

Another part of my problem is that (as you said initially) I got the wrong 
stage1 tarball.  Before I read your last post here, I reread the SELinux 
install guide and noticed that the SELinux stage1 tarballs come from 
the /experimental branch and nowhere else.  So I was reading the SELinux 
install guide, got an iso image that would allow me to do all sorts of 
different things (Hardened with SELinux, Hardened without SELinux, etc.), 
then I got a stage1 tarball that was apparently for Hardened without 
SELinux, but I'm proceeding according to guidance in the SELinux install 
guide.  I'm sure that accounts for some (many?  most?) of my problems.  
So, my mistake here.  I saw a few differences between reality and the 
SELinux install guide and so I started reading it with an editor's eye, 
and filling in details and adding stuff of my own in interpretation that 
wasn't there.  I should have stayed exactly with the written docs and I 
would have avoided this part of my problem.

So, one last thing if I could.  I was in the midst of doing an SELinux 
install from the SELinux install guide when I saw this thread (with 
subject: Current proposed way of installing gentoo _hardened_ (my 
emphasis because I read it differently now)) and added my questions to it 
about these compiler and linker flags:
On Monday 29 March 2004 01:41, Tóth Attila wrote:
> A quote from Ned Ludd:
>
> CFLAGS="-fPIC -fforce-addr -fomit-frame-pointer -fstack-protector-all"
> LDFLAGS="-pie -W,-z,noexecstack -W,-z,noexecheap"

I guess that Tóth Attila was asking about Gentoo Hardened without SELinux 
here?  And especially because I was reading the SELinux install guide at 
the time and doing an SELinux install, I read that and misunderstood him 
to be asking about doing a Hardened Project install including SELinux.

But now may I ask: should I use these flags for doing an SELinux install?  
They are not mentioned in the SELinux install guide.  But I'm trying to 
make this system as secure as reasonably possible right now (without 
compromising on stability) and so maybe I want a Hardened Gentoo system 
with SELinux.  If so, should I set up these flags in make.conf before I 
run the bootstrap.sh script?

When I was using the hardened stage1 tarball and I set these flags, many 
builds included in the bootstrap script failed with complaints about 
those LDFLAGS.

Again... Thanks very kindly for your patience in explaining these details 
to me, Ed.  I think I may be close to a path that will get me to my goal 
now, and without your help, I would not be.  Many thanks.

 
-- 
-Kevin

--
gentoo-hardened@g.o mailing list