Re: [gentoo-hardened] Which profile?

[Thomas Sachau]

Cyprien Nicolas schrieb:
> 2009/2/10 Matthew Summers <msummers42@×××××.com>:
>> On Tue, Feb 10, 2009 at 4:04 AM, Tom Hendrikx <tom@×××××××××.net> wrote:
>>> Clemente Aguiar schreef:
>>>> I understand that the profiles where updated recently (last year?).
>>>>
>>>> Available profile symlink targets:
>>>>   [1]   hardened/amd64 *
>>>>   [2]   hardened/amd64/multilib
>>>>   [3]   selinux/2007.0/amd64
>>>>   [4]   selinux/2007.0/amd64/hardened
>>>>   [5]   default/linux/amd64/2008.0
>>>>   [6]   default/linux/amd64/2008.0/desktop
>>>>   [7]   default/linux/amd64/2008.0/developer
>>>>   [8]   default/linux/amd64/2008.0/no-multilib
>>>>   [9]   default/linux/amd64/2008.0/server
>>>>   [10]  hardened/linux/amd64
>>>>
>>>> Available profile symlink targets:
>>>>   [1]   hardened/x86/2.6 *
>>>>   [2]   selinux/2007.0/x86
>>>>   [3]   selinux/2007.0/x86/hardened
>>>>   [4]   default/linux/x86/2008.0
>>>>   [5]   default/linux/x86/2008.0/desktop
>>>>   [6]   default/linux/x86/2008.0/developer
>>>>   [7]   default/linux/x86/2008.0/server
>>>>   [8]   hardened/linux/x86
>>>>
>>>>
>>>> I would like to know what hardened profile I should use when I build new
>>>> machines? (AMD64 as well as x86)
>>>>
>>>> Thanks.
>>>>
>>>>
>>>>
>>> A few days ago I switched an x86 machine from "default/linux/x86/2008.0"
>>> to "hardened/linux/x86/2008.0/server" after some arbitrary rummaging in
>>> the profiles directory. This gave me no problems other than the expected
>>> gcc-4 -> gcc-3 downgrade.
>>>
>>> I'm not sure why this profile isn't listed in the eselect profile
>>> listing above. It doesn't give me a big fat "unsupported profile"
>>> warning though...
>>>
>>> Regards,
>>>        Tom
>>>
>>
>> This is a confusing situation.  I am currently using
>> /usr/portage/profiles/hardened/linux/amd64/2008.0.
>>
>> This is not explicitly listed in the output of 'eselect profile list'.
>>
>> Perhaps we could sort this out on the list & then I will write a quick doc
>> to place in the hardened web space to assist other users.
>>
>> --
>> M. Summers
>>
>> "...there are no rules here -- we're trying to accomplish something."
>>  - Thomas A. Edison
>>
>
> On #gentooo-hardened, I got this answer :
>
> Feb 04 20:10:51 <Tommy[D]>      Anyone can say, which profile of the 2
> hardened ones are supported here?
> Feb 04 20:12:01 <gengor>        Tommy[D]: use hardened/${ARCH}/2.6
>
> But it was not listed by Clemente for amd64
>
> --
> Cyprien
>
>

So he should use either /hardened/amd64 or /hardened/amd64/multilib. If i rememember it right, the
other profile (/hardened/linux/* ) is not under control by the hardened team and because of that not
supported.

-- 
Thomas Sachau

Gentoo Linux Developer