Re: [gentoo-hardened] Which profile?

[Clemente Aguiar]

Ter, 2009-02-10 às 10:40 -0800, Ned Ludd escreveu:
> On Tue, 2009-02-10 at 19:17 +0100, Thomas Sachau wrote:
> > Cyprien Nicolas schrieb:
> > > 2009/2/10 Matthew Summers <msummers42@×××××.com>:
> > >> On Tue, Feb 10, 2009 at 4:04 AM, Tom Hendrikx <tom@×××××××××.net> wrote:
> > >>> Clemente Aguiar schreef:
> > >>>> I understand that the profiles where updated recently (last year?).
> > >>>>
> > >>>> Available profile symlink targets:
> > >>>>   [1]   hardened/amd64 *
> > >>>>   [2]   hardened/amd64/multilib
> > >>>>   [3]   selinux/2007.0/amd64
> > >>>>   [4]   selinux/2007.0/amd64/hardened
> > >>>>   [5]   default/linux/amd64/2008.0
> > >>>>   [6]   default/linux/amd64/2008.0/desktop
> > >>>>   [7]   default/linux/amd64/2008.0/developer
> > >>>>   [8]   default/linux/amd64/2008.0/no-multilib
> > >>>>   [9]   default/linux/amd64/2008.0/server
> > >>>>   [10]  hardened/linux/amd64
> > >>>>
> > >>>> Available profile symlink targets:
> > >>>>   [1]   hardened/x86/2.6 *
> > >>>>   [2]   selinux/2007.0/x86
> > >>>>   [3]   selinux/2007.0/x86/hardened
> > >>>>   [4]   default/linux/x86/2008.0
> > >>>>   [5]   default/linux/x86/2008.0/desktop
> > >>>>   [6]   default/linux/x86/2008.0/developer
> > >>>>   [7]   default/linux/x86/2008.0/server
> > >>>>   [8]   hardened/linux/x86
> > >>>>
> > >>>>
> > >>>> I would like to know what hardened profile I should use when I build new
> > >>>> machines? (AMD64 as well as x86)
> > >>>>
> > >>>> Thanks.
> > >>>>
> > >>>>
> > >>>>
> > >>> A few days ago I switched an x86 machine from "default/linux/x86/2008.0"
> > >>> to "hardened/linux/x86/2008.0/server" after some arbitrary rummaging in
> > >>> the profiles directory. This gave me no problems other than the expected
> > >>> gcc-4 -> gcc-3 downgrade.
> > >>>
> > >>> I'm not sure why this profile isn't listed in the eselect profile
> > >>> listing above. It doesn't give me a big fat "unsupported profile"
> > >>> warning though...
> > >>>
> > >>> Regards,
> > >>>        Tom
> > >>>
> > >>
> > >> This is a confusing situation.  I am currently using
> > >> /usr/portage/profiles/hardened/linux/amd64/2008.0.
> > >>
> > >> This is not explicitly listed in the output of 'eselect profile list'.
> > >>
> > >> Perhaps we could sort this out on the list & then I will write a quick doc
> > >> to place in the hardened web space to assist other users.
> > >>
> > >> --
> > >> M. Summers
> > >>
> > >> "...there are no rules here -- we're trying to accomplish something."
> > >>  - Thomas A. Edison
> > >>
> > >
> > > On #gentooo-hardened, I got this answer :
> > >
> > > Feb 04 20:10:51 <Tommy[D]>      Anyone can say, which profile of the 2
> > > hardened ones are supported here?
> > > Feb 04 20:12:01 <gengor>        Tommy[D]: use hardened/${ARCH}/2.6
> > >
> > > But it was not listed by Clemente for amd64
> > >
> > > --
> > > Cyprien
> > >
> > >
> >
> > So he should use either /hardened/amd64 or /hardened/amd64/multilib. If i rememember it right, the
> > other profile (/hardened/linux/* ) is not under control by the hardened team and because of that not
> > supported.
>
> Correct.
>
> amd64 #1 or #2 (suggested #2)
> x86   #1
>

This is what I wanted to know. Thanks.