Re: [gentoo-hardened] Current proposed way of installing gentoo hardened

[Tóth Attila]

Hi there,

I felt, I have to add my own ideas about this topic.

Before I start I want to thank for all Hardened Gentoo developers for
their valuable efforts.Keep it on guys, it worth it.

Ed Wildgoose said:
>
>>Again, thanks for the long and thoughtful reply.  From it, I think I
>>discovered a part of my problem and that part lies with semantics.
>>What  I mean is this: when I see someone say Hardened Gentoo Project I
>>have  been thinking that this implicitly involves the SELinux
>>subproject (not  as one-and-the-same, but as an implicitly included
>>subproject).  After  all, SELinux is clearly one of the subprojects of
>>the Hardened Project  and apparently a rather major one.  From your
>>last post, I now see that  one can have a Hardened Gentoo System with
>>SELinux or a Hardened Gentoo  system without SELinux.  Or at least, I
>>think that's right.  Could you  confirm that?  Can one also have a
>>non-Hardened Gentoo system with  SELinux?  Is that what one gets by
>>strictly following the SELinux install  guide (no mention of special
>>compiler or linker flags in there)?
I begin from the roots, so here I quote some parts of the Hardened Gentoo
Project's introduction page:
"Hardened Gentoo

1. Project Description
Hardened Gentoo is a project which oversees the research, implementation,
and maintainence of security oriented projects for Gentoo Linux. We are a
team of very competent individuals dedicated to bringing advanced security
to Gentoo with a number of subprojects."
"4. Subprojects

a. SELinux
-  Chris PeBenito
   SELinux is a system of mandatory access controls. SELinux can enforce
   the  security policy over all processes and objects in the system.
b. Propolice
-  pappy,solar
   Propolice is gcc Stack Smashing Protection that was written by Hiroaki
   Etoh of IBM.
c. PaX/Grsecurity
-  Ned Ludd
   Grsecurity is a complete security solution providing such features as a
   MAC or RBAC system, Chroot restrictions, address space modification
   protection (via PaX), auditing features, randomization features,
   linking restrictions to prevent file race conditions, ipc protections
   and so much more. The hardened project provides examples of 1.9.x
   example MAC policies.
d. Hardened GCC
-  Alexander Gabert
   Transparent implementation of PaX address space layout randomizations
   and stack smashing protections using ELF shared objects as executables.
e. Hardened-Sources
-  Andrea Luzzardi
   A kernel which provides patches for hardened subprojects, and
   stability/security oriented patches. Includes Grsecurity or SELinux
   depending on USE flags.
f. Hardened Stages
-  John P. Davis
   Complete x86 Gentoo Linux installation stages, enhanced with
   transparent Position Independent Executables and Propolice Stack
   Smashing Protection to take full advantage when used with PaX/Address
   Space Randomization Layouts"
Comments:

1. So "Hardened Gentoo" refers to the whole project including all kinds of
subprojects, which are trying to enhance the security features of the
distro.
4.a. SELinux is a NSA project providing kernel space and user space
modificaions of the system. This subproject is heading toward a state,
when it will offer a working implementation of this a kind of access
control.
4.b. This subproject is about the pie/ssp (featuring solar, known well
since 2.0.x times) stuff. The aim here is to provide enforced binaries,
immune to stack smashing.
4.c. This is based on a kernel patch and some user space utilities. The
patch incorporates an other type of access control implementation totally
different from SELinux, the PaX patch for kernel level stack smashing
protection and many other security enhancements missing from other patches
(read features list).PaX is a separate software project about stack smashing protection at
kernel level. One can compile all binaries with support for it to make it
more effective. Grsecurity is designed to include this beside many other
improvements.
4.d. Started to provide compile time support for stack-smashing protection
and layout randomisation.It is a product of 4.b. on one hand and in conjunction with 4.c. on the
other.
4.e. Offers patches depending on the USE flag set.

4.f. SELinux stages are separate from pie-ssp stages now.

Theoretically it can be possible to combine these two, but practically
these two need to be worked out at least separately.I suppose there will be another subproject about RSBAC, which is even
another type of access control system for the kernel. It also provides
unique features (eg. virus scanning). Visit their homepage or
adamantix.org (Debian RSBAC/pie/ssp implementation initiative). It
collides with Grsec and SELinux on the access controll level. But it can
be applied in combination with PaX.
When I asked for an optimal flagset on this list, my question was related
to the pie/ssp stages installation. There are some quite exotic flags I've
never seen before.
For the future: I think every OS is about to incorporate built in
protection for well known types of security issues (OpenBSD, upcoming
NetBSD). Even WinXP SP2 is told to be equipped with some kind of
hardening. As we can conclude base don open source experiences: it's quite
easy to specify, but difficult to implement. SP2 seems to be late... I
suspect "hardened" will be a default flag some time.
Hardened flag will solve a lot of headaches, when it will be ready for use.

Regards,
Dw.

>>
>>
>>
> Think about "Hardened" with a big "H" meaning the overall project.  And
>  "hardened" with a little "h" meaning something you can do to your
> binaries!
>
> SELinux is a set of kernel patches to enforce ACL's on files.  You
> probably want this + the hardened gcc (ie "hardened" with a little
> "h").  The only complication is this flux between how the hardened gcc
> is used
>
> Actually I wonder if it might be easier to start with grsecurity in the
>  kernel rather than selinux...?  At least for us dumbo's who can't read
>  the docs properly?  I wonder if it is possible to have grsecurity in
> the  kernel and also selinux...? (especially under 2.6?)
>
>>But now may I ask: should I use these flags for doing an SELinux
>>install?   They are not mentioned in the SELinux install guide.  But
>>I'm trying to  make this system as secure as reasonably possible right
>>now (without  compromising on stability) and so maybe I want a Hardened
>>Gentoo system  with SELinux.  If so, should I set up these flags in
>>make.conf before I  run the bootstrap.sh script?
>>
>>
>
> Forget about selinux.  This is independent to your gcc flags.  The
> other  hardened is all about gcc flags.  The flags you refer too are
> "aparently" the old way to do hardened without the hardened-gcc
> compiler... (See a previous thread a few days back where it was
> explained to *me*).
>
> The suggestion I got was to upgrade to the latest stable gcc (3.3.2)
> and  add -fstack-protector to your CFLAGS.  Once some time has passed
> and
> >=gcc-3.3.3r2 is in stable then you can remove that CFLAG item and
> replace it with USE="hardened" instead.  You could even do that today
> apparently, but beware some problems with the not fully tested
> gcc-3.3.3
>
> So hardened and selinux appear to be complementary.  The former refers
> to how you build your binaries.  The later is a kernel patch.
>
> I'm going to have to stop there though because I am a beginner like
> yourself, and probably starting to give bogus advice if I go any
> further.
>
> Good luck
>
> Ed W
>
> --
> gentoo-hardened@g.o mailing list


-- 
dr Tóth Attila, Radiológus Rezidens, 06-30-5962-962
Attila Toth MD, Radiology Resident, [phone]



--
gentoo-hardened@g.o mailing list