| 1 |
On 6/24/17 6:04 AM, Alexis Ballier wrote: |
| 2 |
> On Fri, 23 Jun 2017 12:28:27 -0400 |
| 3 |
> "Anthony G. Basile" <blueness@g.o> wrote: |
| 4 |
> |
| 5 |
>> Hardened Gentoo has two sides to it, kernel hardening (done via |
| 6 |
>> hardened-sources) and toolchain/executable hardening. The two are |
| 7 |
>> interrelated but independent enough that toolchain hardening can |
| 8 |
>> continue on its own. The hardened kernel, however, provided PaX |
| 9 |
>> protection for executables and this will be lost. We did a lot of |
| 10 |
>> work to properly maintain PaX markings in our package management |
| 11 |
>> system and there was no part of Gentoo that wasn't touched by issues |
| 12 |
>> stemming from PaX support. |
| 13 |
> |
| 14 |
> |
| 15 |
> Good luck to them at providing a complete userland ecosystem for using |
| 16 |
> pax protection. Good luck at getting people accept and review their |
| 17 |
> often crashing asm patches at upstream projects that won't even be able |
| 18 |
> to test their benefits. |
| 19 |
> |
| 20 |
> Maybe we should start a business for this ? :) |
| 21 |
> http://static.sstic.org/videos2015/SSTIC_2015-06-03_P08_CLIP.mp4 |
| 22 |
> (This is for Patrice) |
| 23 |
|
| 24 |
Correct. Zorry, myself and others on the hardened team did a lot to |
| 25 |
make userland play nice with the hardened-kernel. It represents most of |
| 26 |
my effort in Gentoo. |
| 27 |
|
| 28 |
> |
| 29 |
> |
| 30 |
> |
| 31 |
> We'll need to decide what to do with things like USE=pic. For media |
| 32 |
> packages this is not something you usually want to enable as you can |
| 33 |
> bear the 10Mb relocations at startup to have 10% or more performance |
| 34 |
> improvement when reading your 2hours long movie. |
| 35 |
|
| 36 |
It will be a mess going forward. We will necessarily have to start |
| 37 |
dropping pax related stuff, if for no other reason than we can't support |
| 38 |
making a package work under pax if we have no pax enabled kernel to test |
| 39 |
on. Once this is gone, such bugs will float upstream to pipacs and |
| 40 |
spender. "Good luck" is right. |
| 41 |
|
| 42 |
> |
| 43 |
> |
| 44 |
> Alexis. |
| 45 |
> |
| 46 |
|
| 47 |
|
| 48 |
-- |
| 49 |
Anthony G. Basile, Ph.D. |
| 50 |
Gentoo Linux Developer [Hardened] |
| 51 |
E-Mail : blueness@g.o |
| 52 |
GnuPG FP : 1FED FAD9 D82C 52A5 3BAB DC79 9384 FA6E F52D 4BBA |
| 53 |
GnuPG ID : F52D4BBA |
Archives