Re: [gentoo-hardened] Tin Hat = hardened Gentoo distro in RAM

Let me draw your attention to an effort on gcc-4.x based hardened toolchain:
https://hardened.gentooexperimental.org/secure/

Any interest from a professional would be greatly appreciated (or a PhD
student specializing in the internals of the hardened toolchain -
perhaps...).

Regards,
Dwokfur
-- 
dr Tóth Attila, Radiológus Szakorvos jelölt, 06-20-825-8057, 06-30-5962-962
Attila Toth MD, Radiologist in Training, [phone], [phone]

On Ked, Augusztus 5, 2008 14:39, dante wrote:
> Ned Ludd wrote:
>> On Fri, 2008-08-01 at 08:24 -0400, dante wrote:
>>
>>> Hi everyone,
>>>
>>> My students and I have started a new gnome-based desktop linux distro
>>> derived from hardened Gentoo.   It may be of interest to people on this
>>> list.
>>>
>>> Tin Hat is pretty much Gentoo, but it runs purely in RAM.  It boots
>>> from
>>> CD or pen drive, but is not a liveCD in that it doesn't mount a file
>>> system from the boot device.  Rather it copies its squashfs from CD to
>>> tmpfs in RAM.  Booting is slow, it requres 4 GB of RAM or more, but it
>>> is lightening fast once up.  ("emerge --sync" takes about a minute
>>> between a Tin Hat system offering portage, and one sync-ing from
>>> scratch.  Firefox starts in about 1 second.)
>>>
>>> Tin Hat was started before the recent coldboot attacks.  Within the
>>> limit of such attacks, Tin Hat aims at "zero information loss" if
>>> physical access is obtained to a system which is powered down.  We add
>>> Ruusu's loop-aes patch to the kernel so that any hard drives are
>>> mounted
>>> using one of the best implimentations of block cipher encryptions we
>>> know of.  During power up, Tin Hat uses GRSEC/PaX hardening to hedge
>>> against all the usual attacks.  We are now thinking about our own patch
>>> to obfuscate data in RAM to protect against coldboot --- but to be
>>> honest, we think we can only make it harder, not impossible.
>>>
>>> Tin Hat is stable.  We run 6 systems persistently on clean power and
>>> have typical up times of a couple of months.
>>>
>>> We never intended on releasing Tin Hat, but the students love it so
>>> much
>>> (the speed!) we thought of announcing it on freshmeat.  I thought I'd
>>> post to this list because of it is a successful implementation of
>>> hardened Gentoo.
>>>
>>> Home page: http://opensource.dyc.edu/tinhat
>>> Freshmeat: http://freshmeat.net/projects/tinhat
>>>
>>
>>
>> I absolutely love seeing others create things with hardened.
>>
>> Feel free to keep this list apprised of regular updates.
>>
>>
> Thanks Ned.   When there are more updates, I'll post.  And, thanks to
> whoever mentioned the project to Josh Saddler.  He says he wants to
> mention the project in the next Gentoo Monthly Newsletter.
>
> I'm very indebted to hardened gentoo.  I use it for any project where I
> need an operating system environment.  Eg, another project on that web
> site (tor-ramdisk) uses a micro hardened gentoo uclibc-based
> environment.  The entire portage system of gentoo let's me build it as I
> need it, and hardened-gentoo brings in all those extra security
> features.  So, I teach about gentoo in my modern operating systems
> course and I use hardened gentoo to teach kernel hardening in my
> security course.  The team's work is appreciated.
>
> Anthony G. Basile, Ph.D.
> Chair of Information Technology
> D'Youville College
> Buffalo NY 14201
> USA
>
> [phone]
>
>
>
>
>
>
>
>