[gentoo-hardened] Grsec X11 Rbac Selinux Priviledged/Raw I/O Mprotect Firefox

[Kevin Chadwick]

I've been using OpenBSD for a while now which has priv dropping X and
the machdep.allowaperture=[0|1|2]. Theo has said firefox also
annoyingly uses it's own memory management.

I have a few questions about Grsec that I'd love some input on as I am
struggling to find the answers to them at the moment.

I've read on the Gentoo-hardened archive and grsec config help that the
iopl and ioperm should be protected with rbac if priviledged I/O is
allowed.

So you can disable the RAW_IO capability to all and sacrifice xrestarts.
But if X already has all priviledges then I guess your just adding a
hurdle which is made a bit higher with grsec, so obfuscation really
and not complete security. Is there anything else you can do or is that
what is meant by "You should use RBAC if you allow priviledged I/O"?

The gentoo-handbook says something like the question of selinux|rbac|
rsbac is a controversial one. It seems rsbac is the most secure but
more difficult to use and has less starter policies around. Gentoo
seems to have selinux policies. Does selinux have any more to offer than
rbac for protecting X?

Does CONFIG_PAX_MPROTECT_COMPAT have any effect on firefox and did
mozilla refuse to patch their sources with the if !jit patch?

Thanks

Kc