Re: [gentoo-hardened] denied RWX mmap by layman

[Michael Orlitzky]

On 06/10/2014 01:50 PM, Anthony G. Basile wrote:
>>
>> Can linux-info.eclass be used to spit out a warning during a python emerge?
>>
>> This,
>>
>>    use hardened && CONFIG_CHECK+=" ~CONFIG_PAX_EMUTRAMP"
>>
>> seems like a common pattern. With a little more ingenuity we can
>> probably have it check the running/installed kernel and not the USE flag.
>>
>
> Yes and no.  I could add that as a warning but ....  There is no
> guarantee that the kernel you are building under is the kernel you will
> be running under.  So there's no way to warn against future stupidity.
> Or current stupidity if your running kernel and kernel sources are out
> of sync.
>
> So I'm not a fan of linux-info.eclass.
>

It's not 100%, but it has to be more accurate than manually replying to
each bug report, right?

I think it's easy to overestimate the number of corner cases that normal
users run into with their kernels. Even on my home/work desktops, which
are a mess, most of the kernels that are lying around are pretty much
the same. If one of them has EMUTRAMP set, the rest do.

This might even be done once and for all in pax-utils.eclass. If a
package needs an -E marking, the user will probably want EMUTRAMP set at
runtime.