[gentoo-dev] ProPolice enabled gcc/gentoo and chrooted Apache

[Matt Rickard]

I had previously posted this in the forum, but now that I've made some
more progress I'm trying to key a few more people in on what I'm doing. 
The original thread is available at
<http://forums.gentoo.org/viewtopic.php?t=33614>

I've implemented a ProPolice
<http://www.trl.ibm.com/projects/security/ssp/> patched gcc ebuild.  This
patch will build stack-smashing protection into your code at compile time.
 This is an excellent security measure -- one that has just recently been
implemented in OpenBSD-current.  It can be enabled explicitly through the
CFLAG -fstack-protector or turned on by default with a separate patch.  As
I have it now, it is by default turned off, as there are several ebuilds
that have problems with it (most notably portage).  For more information
on this have a look at my site
at<http://frogger974.homelinux.org/gentoo_propolice.html>

 I've also put together a script which will copy an Apache install into a
chroot under /var/chroot/apache. There is also a new new startup script to
start/stop/restart the chrooted daemon. The script requires apache to be
merged to run, but after it has been installed, you can feel free to
unmerge the old non-chrooted apache. Again, more information is available
at <http://frogger974.homelinux.org/gentoo_propolice.html> . This doesn't
require ProPolice, but it runs fine being built with the stack protection
if you're interested in trying. 

I'd eventually like to implement this chrooted Apache as its own ebuild. 
This script is easier for now, and allows me to do the testing I need. 
It is also completely parallel to the regular Apache build, just moved to
/var/chroot/apache.  This might not be the best idea, since we don't
really need the obscure file locations/symlinks from the original build if
it's all just going under /var/chroot/apache.

So anyway, if anyone would like to test any of this stuff feel free.  Let
me know how it turns out.  I'm also open to any suggestions on things I
should change or other things I should implement.  I would like to start
by chrooting other daemons including bind and ntpd.

I think all of these things would make a good addition to a 'Secure
Gentoo'.

-Matt Rickard

--
gentoo-dev@g.o mailing list