Re: [gentoo-hardened] Re: GPL stuff with binary modules - FSF ruling

[Alex Efros]

Hi!

On Fri, Jun 30, 2006 at 01:08:10PM +0200, pageexec@××××××××.hu wrote:
> > Heads up to nvidia users... If you use nvidia-glx and a hardened profile
> > it's going to be package.masked
> does it have to be that drastic? how about CONFIG_CHECK="~PAX_NOELFRELOCS"
> in the ebuilds?

I think users should decide which level of security they need. Choice
between 'don't use hardened' or 'don't use nvidia drivers' sounds very
undesirable.

For example, I don't use nvidia drivers, but I use ati drivers - which
require Xorg compiled with vanilla gcc. :-( I prefer to have at home
hardened system with some weak places (Xorg compiled with vanilla gcc;
some paxctl/chpax for mplayer/xine/xmms/skype) than have no hardened at all.

And this isn't just question of trading performance to security: I need
ati drivers because core Xorg driver doesn't support TvOUT and because
core Xorg driver too slow to support quick switching between virtual
desktops (my X configured to simulate text console environment with
switching between full-screen xterm's running in different virtual
desktops using Alt-Fx). So this is question of trading [critical]
functionality to security, not just performance.

But, as far as I understand, it isn't "that drastic" because user can just
unmask nvidia drivers and continue using both hardened and nvidia drivers..?

-- 
			WBR, Alex.
-- 
gentoo-hardened@g.o mailing list