1 |
On 14/06/2012 17:04, "Paweł Hajdan, Jr." wrote: |
2 |
> On 6/14/12 4:51 PM, Anthony G. Basile wrote: |
3 |
>> 1) We still have the old 10.0 hardened profiles on the tree. They've |
4 |
>> been marked deprecated for about two years and I have no idea what state |
5 |
>> they're in. I'm going to punt them in a day unless someone gives me a |
6 |
>> really good reason to keep them. |
7 |
> Sounds good. |
8 |
> |
9 |
> If you have some more time (maybe later) it would be nice to restructure |
10 |
> the profiles so that hardened bits are in profiles/features, to allow |
11 |
> e.g. easy creation of hardened-developer profile. |
12 |
> |
13 |
> Paweł |
14 |
|
15 |
+1 |
16 |
|
17 |
I create my own: /usr/local/portage/profiles/myname/xxx |
18 |
|
19 |
And in there I create my own sub profiles for all my linux-vserver builds. |
20 |
|
21 |
Actually, there isn't anything I currently need splitting out of the |
22 |
current profiles, so not quite sure what I'm +1-ing, but I guess more to |
23 |
raise awareness that this is quite easy and works extremely nicely |
24 |
|
25 |
Oh, as an aside, I have settled on linux-vservers+grsec+pax as my tool |
26 |
of choice for servers (I guess that's roughly a hardened kernel + |
27 |
linux-vserver). I find that vservers are extremely lightweight and easy |
28 |
to maintain and the hardened stuff makes me sleep a little easier (the |
29 |
linux-vserver code already includes all the important restrictions to |
30 |
make it hard to escape from chroots, the grsec/patch parts for that are |
31 |
unnecessary). I would recommend that solution to anyone with a server |
32 |
requirement |
33 |
|
34 |
Cheers |
35 |
|
36 |
Ed W |