Re: [gentoo-hardened] A way to combine grsec with selinux?

[Ned Ludd]

On Mon, 2004-03-01 at 10:54, Jan Dušek wrote:
> Hi, I was just wondering - is there a way to combine some non-ACL
> related grsec features (such as randomization of TCP ports, etc.) with
> SELinux?

Yes sorta. If your willing to use 2.6.x then you can get a kernel mixed
with the some of the features your looking for. grsecurity does not
exist yet however for 2.6.x so a few people have been putting a patch
together for 2.6.x testing.

so far whats done. (more to come)

iopl,ioperm,kmem
ip/pid randomizations
restricted /proc, dmesg
selinux-hooks for pax
/proc/#pid/ipaddr
/proc/#pid/status (display PAX runtime flags)
seed entropy via AT_ENTROPY as per a previous topic of discussion from
this mailing list.
some sysctl options.

unpack linux-2.6.3
cd linux-2.6.3

wget http://pax.grsecurity.net/pax-linux-2.6.3-200402250000.patch \
http://dev.gentoo.org/~solar/pax/openpax/linux-2.6.3-openpax-0.11.patch
patch -p1 < ../pax-linux-2.6.3-200402250000.patch
patch -p1 < ../linux-2.6.3-openpax-0.11.patch

# example kernel.config
wget -O - -q
http://dev.gentoo.org/~solar/pax/openpax/openpax-2.6.3.config | tail -n
89

make menuconfig

# enjoy.
# http://pax.grsecurity.net/
# http://openpax.net/
# kernel 2.6.x already supports selinux out of the box.

>
> I don't think I can straightly patch my kernel with both, can I?
>
> --jd
>
> --
> gentoo-hardened@g.o mailing list
-- 
Ned Ludd <solar@g.o>
Gentoo Linux Developer