Gentoo Archives: gentoo-hardened

From: Michael Orlitzky <michael@××××××××.com>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] XATTR_PAX migration
Date: Mon, 09 Sep 2013 14:19:34
Message-Id: 522DD8EF.8070301@orlitzky.com
In Reply to: Re: [gentoo-hardened] XATTR_PAX migration by Alex Efros
1 On 09/09/2013 09:49 AM, Alex Efros wrote:
2 > Hi!
3 >
4 > On Mon, Sep 09, 2013 at 09:30:56AM -0400, Michael Orlitzky wrote:
5 >> That is, can I disable PT_PAX, enable XATTR_PAX, reboot, and run
6 >> migrate-pax? Or might that cause problems?
7 >
8 > You can migrate with just one reboot, but order of actions is different:
9 >
10 > 1. Build new kernel with PT_PAX disabled and XATTR_PAX enabled.
11 > 2. Run `migrate-pax -m`.
12 > 3. Reboot using new kernel.
13
14 Thanks, I'll give it a try (on the router in the building where I have
15 keys, first...).
16
17
18 > I'm not really sure, but you may also need to add PAX_MARKINGS="XT" into
19 > /etc/make.conf.
20 >
21
22 pax-utils.eclass has this to say:
23
24 To control what markings are made, set PAX_MARKINGS in /etc/portage
25 /make.conf to contain either "PT", "XT" or "none". The default is to
26 attempt both PT_PAX and XATTR_PAX.
27
28 But then again, right below that, I see,
29
30 # @ECLASS-VARIABLE: PAX_MARKINGS
31 # @DESCRIPTION:
32 # Control which markings are made:
33 # PT = PT_PAX markings, XT = XATTR_PAX markings
34 # Default to PT markings.
35 PAX_MARKINGS=${PAX_MARKINGS:="PT"}
36
37 So I'm not really sure either.

Replies

Subject Author
Re: [gentoo-hardened] XATTR_PAX migration "Anthony G. Basile" <basile@××××××××××××××.edu>