[gentoo-hardened] Re: hardened workstation - is that worth it?

[7v5w7go9ub0o]

atoth-J1cgac+wqeJaB7pSnPOuKA@××××××××××××.org wrote:
> On Sze, November 26, 2008 03:02, 7v5w7go9ub0o wrote:
>> I run the "old" hardened toolchain, grsecurity-enhanced hardened kernel,
>> rbac control, and jails for anything that accesses the LAN/WAN.(heh... I
>> even chroot and kill dhcpcd after 5 seconds). Avira has hundreds of
>> Linux rootkit signatures in its database, so I run Avira and Dazuko
>> realtime/on-access scanning on my /home directory, the chroot jails, and
>> on the portage workspace used during download and compilation.
>
> patch-dazuko-2.6.26 cannot be applied on 2.6.27 any more, because of some
> API changes. There are signs of a redirfs-based patch for 2.6.27. I
> haven't downloaded it, yet. Upstream pushes dazukofs. What type of dazuko
> setup do you use? What are your experiences with redirfs or dazukofs?

Sigh... yes, it becomes murky for me beyond 2.6.26.

I'm presently using patch-dazuko-linux-2.6.25.diff.gz on
hardened-sources-2.6.25-r10, and don't have any experience with redirfs
or dazukofs.

ISTM there is now (finally) a LOT of interest in real-time file access
control, along with competing approaches including dazuko, dazukofs,
redirfs, and "libmalware.so" (under discussion at kerneltrap).

Things I'd like to pursue :-) :

1. Signature and heuristic scanning of anything that downloads into my
box, or anything that may be compiled from otherwise innocent looking
code. Dazuko/Antivir provides that now.

2. "whitelist" scanning. This would be a realtime "integrity management
system" challenge/update. So if, for e.g., the MD5 of an LKM or other
system file changed, the scanner would stop, popup, and challenge the
validity of the modified LKM.

3. "changed folder" monitoring. e.g. if I get activity in a usenet
application, I could get a popup and "beep".