[gentoo-hardened] Grsecurity 2 in hardened-sources

[Ned Ludd]

I would like to thank frogger for taking the time to put together
hardened-sources-r3 for us (good work frogger)

-r3 introduces the grsecurity-2.0-pre4-2.4.20.patch which has
some very cool/needed new features for us grsecuirty users such as role
based access control, variable support within acls including unions,
intersections, differences of sets, and an learning device,daemon as
well as nested subjects. All these features plus what it already had
should make grsecurity2 the most well rounded complete host based
security solution available for linux to date.

These new features should be transparent to our users not using the
access control list features of grsecurity, however for those of that
will be be using them we have a few things to consider. 

First grsecurity 2 has not been officialy released yet, and no
documentation exists for these features of grsecuity2 outside of the
grsec mailing list itself.

Second item is gradm itself,
<=gradm-2 installs to /sbin/gradm and reads /etc/grsec/acl
>gradm-2 also installs to /sbin/gradm and also reads /etc/grsec/acl
But they dont play together well at all, and if we were to park gradm2
which is really gradm in sys-apps/gradm It would always get prefered
over gradm-1.9.x when ~arch is set. This would affect users using
gentoo-sources. I dont want to introduce another apache{1,2} SLOT type
of mess.

My simple solution would be to park gradm 2 in sys-apps/gradm2, install
gradm 2 as /sbin/gradm2  with /etc/grsec2/acl and leave it this way
untill grsecurity1 becomes deprecated. This would allow people to have
both systems installed without any conflict. (Any comments before it
gets set in stone?)

-- 
Ned Ludd <solar@g.o>
Gentoo Linux (Hardened)


--
gentoo-hardened@g.o mailing list