Re: [gentoo-hardened] Current proposed way of installing gentoo hardened

[Kevin]

On Thursday 29 April 2004 19:03, Ned Ludd wrote:
> On Thu, 2004-04-29 at 18:24, Ed Wildgoose wrote:
> > >after untarring the stage1 tarball
> > >(stage1-pentium4-pie-ssp-2004.0.tar.bz2), there is no
> > >directory /mnt/gentoo/selinux to use as a mountpoint for an
> > > selinuxfs (as
> >
> > I guess that is because you used the hardened stage 1, not the
> > selinux stage 1 !  I think hardened doesn't need selinux?  As in they
> > are not equivalent (part of the same team though)

Uh... sorry, but I'm confused here.

I was in the middle of reading 
http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?full=1 under "Is 
GRP Available?" and it mentions the Gentoo Hardened project:

"The _Gentoo Hardened_ project offers their own GRP set (and stages) 
focused on building a proactively secure system. Anyone looking to build 
a server on the x86 architecture should investigate this option."

That last sentence describes me, so I go there...

So I follow the _Gentoo Hardened_ link which points to 
http://hardened.gentoo.org from which I get redirected to 
http://www.gentoo.org/proj/en/hardened/

Here I see a link: _SELinux x86 Install Guide_ which I followed.

And now I'm at that URL that I originally listed as my source of docs for 
doing this install.

I started with the liveCD mentioned in that URL:

"So, how does one begin the install process? First, you will want to 
decide which one of our LiveCD ISO images to grab from 
http://gentoo.oregonstate.edu/experimental/x86/livecd/"

I went here, then to x86, then got the latest one, 
livecd-2004.0-x86-selinux-nostages-20040227.iso

I don't see any other option there that looks likely to get me an SELinux 
boot CD.  Am I missing something?  Seeing the fact that the filename 
mentions that there are no stages, I figure I need to get a stage file so 
I download stage1-x86-pie-ssp-2004.0.tar.bz2 from 
http://gentoo.oregonstate.edu/releases/x86/2004.0/stages/x86/hardened/ 
and use that.

Up to this point, have I gone wrong somewhere?

After this, I'm just following along in the docs that originally got me 
started with Hardened, specifically, 
http://www.gentoo.org/proj/en/hardened/selinux/selinux-x86-install.xml

When the docs tell me to use the stage on the cd, I ignore them (since 
there are no stages and the iso filename confirms this for me) and get my 
own as above.  Have I gone wrong somewhere?

And now, as I'm trying to bootstrap using the make.conf file settings that 
I originally asked about, I'm getting several failures with complaints 
about the LDFLAGS setting (-W,-z,...).  Am I doing something wrong here 
mixing Hardened and SELinux?  I see they're different, but how do I build 
a Gentoo system with the best security currently available (and stable).  
I would think that SELinux would be involved.  Am I wrong?

<snip>

> Documentation.. Sigh yeah I suppose you all want this, I can't blame
> you either.  For now let me point you at the pax docs at
> http://pax.grsecurity.net/docs/ (READ ALL OF THIS!) then when you get
> done there go read http://www.trl.ibm.com/projects/security/ssp/
> We really want everybody to understand the concepts of why we opt to
> build this way.
>
> I'll try and see if we can muster up a quick start or two in this
> respect when it's time for us to roll those stages.

Um... I'm trying to build a production server here.  Should I stay away 
from this stuff?  It sounds like kinks and problems and documentation are 
still being worked out.  If I want a Gentoo server and I want it to be 
providing public services on the Internet (albeit through a firewall), 
what plan should I be using here (ie, what combination of boot CD image, 
stage1 tarball, and documentation URL should I be using?)?  I've already 
uncovered a bug in the ebuild for the gs_sources kernel (involving the 
Device Mapper patch) which is supposedly for production servers.  I'm 
starting to get the impression that Gentoo is just not ready (with or 
without Hardened or SELinux) for production servers, and almost certainly 
not with Hardened or SELinux.  Could someone give me the skinny on this?  
Am I barking up the wrong tree trying to use Gentoo to build a production 
server?  Though I'm no developer, I am a reasonably sophisticated Linux 
geek with about 9 years doing sysadmin on Linux boxen, and I'm having 
real problems here.  Should I go back to SuSE?  I really do like the 
concept of ebuilds and portage in Gentoo, and see these as being a huge 
improvement on the other distributions, but I need a stable production 
server.  With that as a goal, should I stay away from Gentoo for the time 
being?  Or maybe just stay away from Gentoo Hardened and/or SELinux for 
now?

Thanks in advance for any suggestions.


-- 
-Kevin

--
gentoo-hardened@g.o mailing list