Gentoo Archives: gentoo-hardened

From: "Anthony G. Basile" <basile@××××××××××××××.edu>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] various pax-marking problems
Date: Mon, 08 Jul 2013 13:02:01
Message-Id: 51DAB8AF.6030107@opensource.dyc.edu
In Reply to: Re: [gentoo-hardened] various pax-marking problems by Alex Efros
1 On 07/07/2013 08:15 PM, Alex Efros wrote:
2 > Hi!
3 >
4 > On Mon, Jul 08, 2013 at 01:34:07AM +0200, "Tóth Attila" wrote:
5 >> I have a feeling some system settings are wrong. These things happen the
6 >> same way on my laptop and the server.
7 >
8 > I'm too sleepy now and may misunderstood your issue, but at glance:
9 > 1) don't enable both PT and XT in kernel, choose only one (XT)
10 > 2) https://bugs.gentoo.org/show_bug.cgi?id=465000 may be actual for you,
11 > maybe you should try >=portage-2.1.12.9 (~ARCH now)
12 >
13
14 >=portage-2.1.12.9 contains an install wrapper I wrote which preserves
15 xattr pax markings no matter where they are in the ebuild (before or
16 after install). While it is possible for ebuilds to do something crazy
17 like using cp instead of install and circumvent this (these should be
18 fixed anyhow), this bug should now be fixed.
19
20 @Toth. Please enable either PAX_PT_PAX_FLAGS or PAX_XATTR_PAX_FLAGS in
21 your kernel, not both. It is problematic to set both.
22
23 In your make.conf set PAX_MARKINGS="PT" in the former case or
24 PAX_MARKINGS="XT". It is safe to set both: PAX_MARKINGS="PT XT"
25
26 On my system, I have "PAX_PT_PAX_FLAGS not set", PAX_XATTR_PAX_FLAGS=y
27 in my kernel, PAX_MARKINGS="PT XT" in my make.conf and I am using
28 >=portage-2.1.12.9. So far everything works. Markings get where they
29 are supposed to go and all the usual problematic packages work.
30
31
32 --
33 Anthony G. Basile, Ph. D.
34 Chair of Information Technology
35 D'Youville College
36 Buffalo, NY 14201
37 (716) 829-8197

Replies

Subject Author
Re: [gentoo-hardened] various pax-marking problems Alex Efros <powerman@××××××××.name>