Re: [gentoo-hardened] Current proposed way of installing gentoo hardened

[Ed Wildgoose]

Hi Kevin,

>Well, I saw that from the beginning.  That page (above) lists all of those
>different technologies (or maybe most of them) as the subprojects of the
>Hardened Project.  But knowing a little bit about how SELinux works, I
>figured that it was a fundamental part of the Hardened Project and that
>it needed to be integrated from the very beginning; during the install
>process.  Plus, with SELinux being the first Subproject listed in the
>collection of Subprojects for Hardened, it lends credence to that
>impression (IMO).  And under "6. Resources" on that page, I see an
>Install Guide for x86 architectures (only install guide there), so I used
>it, realizing that it was for only one subproject (SELinux) of the
>Hardened Project, but thinking that I could add in the other subprojects
>after getting a fully functional Gentoo box with SELinux support running.
>
>

I think you are getting a bit frustrated with the docs, not gentoo.  
Lets just agree that the docs are "misleading", but lets focus on what I 
think are the facts

- For the purposes of argument, there are three builds of gentoo: 
Normal, hardened, and selinux. 
- Your "Hardened" install guide is only for selinux. 
- Hardened is basically just a normal install, but using a different set 
of compiler options (which probably means a slightly different stage1 
build, but I'm sure if you new what you were doing you could start with 
a normal stage-1).
- Selinux seems to me to be too undeveloped if you aren't quite sure 
what is going on and prepared to fix a few things.  (IMHO).  Give it a 
try and see if you can live with it, otherwise come back in X months.
- Hardened seems to be the way ahead, but right now gentoo is 
transitioning from an old style tricky to use method to a new and slick 
method.  Work around it, it won't be a problem in the long run
- Selinux *only* needs to be built from stage 1 using a special boot 
disk, (I think because it needs the /selinux partition to be 
available).  Everything else including hardened can be built from a 
knoppix CD, or whatever you have handy.  There are stage2/3 tarballs in 
the same place you got your stage 1 tarball (and in fact there are 
Pent4, etc hardened stages if you go up and down a few dirs.). 
- To install hardened, pretty much follow the normal install I think 
(use your head though, perhaps skim the selinux install docs in case 
there are some tips there)

- *YOU CAN CONVERT ANY INSTALL TO SELINUX LATER ON....*

>The iso image that I downloaded in accordance with the Gentoo x86 SELinux
>Installation Guide
>(http://www.gentoo.org/proj/en/hardened/selinux/selinux-x86-install.xml)
>and then burned onto a CD comes right out and says something along the
>lines of: "Welcome to the Gentoo Hardened Project."  I mean, I'm reading
>docs for SELinux (an apparently major subproject of the Hardened Project)
>which tell me to get an iso image, and after booting, I get a splash
>screen that states: Hardened Gentoo (cap H).
>
>
>
I'll have to check, but you got the right boot cd, but the wrong stage 
install.  Its all moot anyway, use ANY boot cd to install hardened and 
the normal install instructions

>(docs say Hardened can only be
>built this way, not via stage2 or 3), and some documentation.
>

They *mean* Selinux can only be built as a stage 1.  There are stages 
2/3 for hardened at the same link you sent earlier.  (Se stages are 
under experimental)


>Exactly what is it that's bleeding edge right now?  I see "bleeding edge"
>and think, "not appropriate for production servers."  Is that what you
>mean?  So what's bleeding edge?  SELinux?  All of the Hardened
>subprojects?  Just some of them?  Which ones?
>
>
>
Just my 2p, but selinux is only for people who know what they are doing 
right now.  I suggest that you get a spare box setup and start playing.  
However, otherwise I suspect that too many things will go wrong. 

The other stuff I *think* is ready for prime time, and even if it were 
slightly buggy, it would be worth the effort.  Ultimately you are 
talking about a few compiler options.  If stuff seems a bit wierd, just 
rebuild without the hardened options.  Shouldn't be any worse than that

>From
>http://www.gentoo.org/proj/en/hardened/selinux/selinux-x86-install.xml:
>================================================
>8. Stage tarballs and chroot
>
>Selecting the desired stage tarball
>
>Now, you need to decide which one you would like to use as a basis for the
>install if you have not already.
>
>Since we are compiling everything "from-scracth", as is currently required
>by the Gentoo SELinux install...                  ^^^^^^^^^^^^^^^^^^^^^^^
>================================================
>
>
>
Yes, but we agree that this is talking about the selinux stuff, not the 
hardened stuff.  The former means a kernel which enforces ACLs, the 
later refers to the rest of the system being built with a compiler that 
adds traps for stack overflows (and a bit more...)

Yes, the docs are misleading, but nothing worse than that. 

>From the Gentoo Linux Kernel Guide
>(http://www.gentoo.org/doc/en/gentoo-kernel.xml):
>================================================
>gs-sources
>
>For users to whom desktop interactive performance comes as a secondary
>priority to reliability and hardware support, we have the gs-sources. GS
>stands for Gentoo Stable (creative, aren't we?). This patch set is tuned
>and tested to provide the best support for the latest hardware and
>ensures that your mission critical servers will be up when you need them.
>================================================
>
>
>

Fair point, but I have had quite a few problems with stock kernels not 
compiling with extra patches.  The intent is clearly to have a stable 
patch set, but at the end of the day, this kernel is composed of patch 
sets sent to the kernel dev list, and then applied here.  It's not 
actually something that consists only of patches written by some gentoo 
person.  It's not a lot different really to the old -mm or -ac or -ck 
kernel sets.

Perhaps try WOLK instead?  This has similar goals of stability, but for 
sure I have had problems compiling with certain combinations of 
options... I guess that's why the real kernel tree trails these various 
patch sets.

Sorry...

>No, I recently patched a plain Linux kernel from kernel.org with the
>Device Mapper patch (and some others) myself and built it and am running
>it on one of my production servers in a SuSE distro.
>
>
>

Sounds like the thing to do then.  Keep it mostly stable and only apply 
the patches you need.  gs-sources is just this, but adding in lots more 
patches...

>Well, I need to use OpenAFS for which there is currently no support in the
>2.6.x kernels.
>
>
>
Ahh.  Anyone working on it?  2.6-MM has readonly, no security AFS...

>Well, see above...  My first install I did a stage1 and no problems
>whatsoever.  Now, I can't get gentoo-sources or gs-sources to build in a
>standard (normal) gentoo stage1 process.
>
>
>

OK, do the same again, but starting with a hardened-stage1 this time.  
Should be identical, except different compiler options were used.  No 
different really to the way the pent4 build is different to the pent3 
build... (roughly)

As for kernel.  Pick another one... Or roll back to a previous 
version...  Or build your own...

>As far as I can tell, there is no hardened install guide other than the
>SELinux install guide.
>
>
>

I think there is no reason for one yet?  I would expect the docs and 
situation to be changing when the new gcc goes live.  Until then I think 
we just need to read the list and work out what the transition is.

>What I really need is for someone with more experience than you or me to
>either say, "Hey Kev, Hardened Gentoo with SELinux and the other
>subprojects will work and this is how you do it: get this iso image, get
>this stage1 tarball, and read these docs (for there are so many of each
>of these three that it's quite difficult to figure out which are meant
>for which) and you'll have a perfectly sound and stable system that is
>fine for use in a production server." or... "Hey Kev, we're really still
>hashing out problems in the Hardened Gentoo project and/or several of the
>subprojects, so you might want to stay away from these subprojects for
>now unless you want to help us test them."
>
>
>

OK, get any boot cd, get a stage2/3 hardened image (can't see the point 
of building too much stuff).  Then pick a kernel that actually works 
with your .config file!

You need to get one important question answered though!  What to do 
while the gcc ebuild transitions.  Do you stick with hardened-gcc 
package, or move to the stable, or move to the testing build and work 
around any problems...  Not sure which is appropriate for a production 
box. 

I think stable build is safest, but you will be compiling stuff without 
all the hardened options, so expect to come back later and recompile 
those packages.  (Starting with a stage2/3 will make this easier...)

Good luck

Ed  W

--
gentoo-hardened@g.o mailing list