Re: [gentoo-hardened] Keeping gentoo-hardened alive (WAS: latest kernel exploit patch for vmsplice coming?)

[Geoff Kassel]

Hi Ned,

(Whoops, accidentally posted from my work email address before.)

> We Hardened/Gentoo are short staffed at the moment..
> Not about to go KABOOM..

Ah, good. I was worried for a little there :) I don't monitor the hardened 
list very closely, so seeing messages all titled 'Keeping gentoo-hardened 
alive' was a bit concerning.

> I'd actually like to talk with you more about the Hardened-QA topic
> later if we could.

No problems. My background in QA is primarily regression testing and code 
quality reviews (although it's been ages since I've done any of this with 
C) - my formal methods background is formal specification, model checking, 
theorem proving, and formal derivation of code from formal specification. 
(Yes, I'm a recovering academic :)

Please feel free to contact me off list if you want more specifics.

> It pretty much is covered. I've got a few hardened tinderboxes running
> to test these various setups.

I'd thought as much, but I wasn't sure how well resourced Hardened was 
compared to the main Gentoo efforts.

> Feel free to review hardened-toolchain.xml

Okay, I'll give it a look over for clarity later today. I'll summarise any 
changes I'd like to make and send it to you off-list, okay?

> Go take a peek at bugzilla and see if there are any open bugs related to
> hardened with are BOGUS, or can be resolved. If you have some tips for
> others. Perhaps offer them.

I can do that.

> "How can I best use my existing skills to make the hardened project a
> little more kickass?"

Hmm, that's a good way to put it. I'd have to say my main day-to-day peeve is 
the lack of PaX considerations in a number of key projects in the Portage 
tree. (Wine and Mono especially.) I've written ebuilds before for private 
use - perhaps it's time I started submitted patches for existing projects.

More blue-sky things are getting Coverity to apply their automated code 
quality analysis tools to the 2.6 kernel sources with the hardened Gentoo 
patchset applied - I'm sure getting the project registered with them wouldn't 
be too hard, and it'd make maintaining code quality in the patchset easier. 
(An course of action for Hardened-QA, perhaps?)

While I'm dreaming I'd also like to do something about making GRSEC easier to 
set up (an upstream issue, I know) as it has so much promise, and the basic 
configuration isn't nearly as paranoid as I'd like it to be :) and it's very 
difficult and time-consuming to make it so. I gave up doing so, and I like to 
think I'm not a complete n00b. PaX, PIE and SSP are practically 
fire-and-forget in comparison.

Speaking of PaX, another great, impossible thing would be to have a 
kernel-level feature for handling PaX violations in a less violent manner 
(core dumps are violent, in my mind) - perhaps suspension of the process in 
question until investigated, with the possibility of resumption or 
termination by someone with sufficient security permissions. (Perhaps I'm 
just unaware of an already existing feature.) Again, an upstream issue.

Let's see how many little things I get done first, shall we? :)

On Tue, 12 Feb 2008, Ned Ludd wrote:
> On Tue, 2008-02-12 at 11:15 +1000, Geoff Kassel wrote:
> > Another wagon jumper here :)
> >
> > My fledgling hosting and software development business is based on
> > hardened Gentoo, so I'd hate to see this project die.
>
> I work for a rather large online game hosting company and we also rely
> heavily on the use of hardened for nearly all DIA facing nodes. I've
> gone out of my way to make sure it's stable for what we need. No matter
> what I'll be maintaining something somewhere and I'm always willing to
> share my work, which should work for ~90% of all enterprise cases. So
> don't worry there. We Hardened/Gentoo are short staffed at the moment..
> Not about to go KABOOM..
>
> Anyway my biggest problem is I lack the time to test user configurations
> of services in bugzilla. That's alot of work! And many times people are
> reporting whats already been fixed elsewhere. Another one of my biggest
> problems is I fix something locally and forget that it never got pushed
> to the tree. So when I sometimes see bugs in zilla I simply ignore them
> because in my mind I think they are non problem.
>
> > I'm quite time and money poor as
> > a new business owner,
>
> Hey don't worry there. This is not a finical problem or a lack of
> hardware. As well as a dev I'm also a sponsor to Gentoo of many of it's
> core infrastructure boxes. (10G backbone to 1G IBM Blades)
>
> > but I have a fair skill set to offer when I do get
> > time. I'm a reasonably experienced Python, PHP, and C programmer.
> > (Although my C is a bit rusty, having lost ground to the others through
> > under use.)
> >
> >
> > I've got a formal methods and QA background, if that's useful in any way.
>
> Hell fscking yeah it is.
>
> I'd actually like to talk with you more about the Hardened-QA topic
> later if we could.
>
> > I'm
> > handy with VMWare, so I can test experimental kernels and Portage trees,
> > if that's not already covered by a build farm elsewhere.
>
> It pretty much is covered. I've got a few hardened tinderboxes running
> to test these various setups.
> * hardened/amd64/multilib
>   * hardened/ia64
>   * hardened/ppc
>   * hardened/x86
>
> http://tinderbox.dev.gentoo.org/html/
>
> > I'm reasonably
> > literate, if documentation needs to be written or revised.
>
> Yeah actually that might be a good idea.
> Feel free to review hardened-toolchain.xml
>
> > Is there a way the time-poor can help out? I can immediately offer some
> > hosting, if that's not already covered by the Gentoo Foundation -
> > monetary donations are probably a few months away. (Is there a way to
> > donate specifically to the hardened project, by the way?) I can also
> > offer some CPU time on two mid-range hardened Gentoo servers with shared
> > storage in a high-availability data centre in Australia for compilation
> > nodes, if that's any use.
>
> Not needed. As noted the game hosting provider I'm affiliated with has
> spare 632 blades across 75 chassis at the moment that are all Dual and
> Quad Core. I rarely ever need more than 2 per datacenter.
>
> > How may I be of assistance?
>
> Go take a peek at bugzilla and see if there are any open bugs related to
> hardened with are BOGUS, or can be resolved. If you have some tips for
> others. Perhaps offer them.
> Or..
> Well other than asking how you can help.. How about trying to look at it
> from a perspective of.
> "How can I best use my existing skills to make the hardened project a
> little more kickass?"
>
> > Kind regards,
> >
> > Geoff Kassel.
> >
> > On Tue, 12 Feb 2008, Asaf Gery wrote:
> > > OK,
> > > I would also jump on this wagon... :-)
> > > My experience with C is minimal, although I do have some. I have years
> > > of experience with Java, I love Linux in general and specifically
> > > Gentoo. How can I support the effort?
> > > Asaf
> > >
> > > On Feb 11, 2008 8:21 PM, Mateusz Mierzwinski <mateuszmierzwinski@××.pl>
> > >
> > > wrote:
> > > > RB pisze:
> > > > >> help?  Know this, you are not alone.
> > > > >
> > > > > Ditto.  I'm not always the sharpest tool in the shed or have the
> > > > > greatest C skills, but am willing to help with whatever is needed.
> > > > > I've even considered devship (and been "recruited"), but was unsure
> > > > > I wanted to join in the politics and whether my existing
> > > > > contributions were... sufficient.
> > > > >
> > > > >
> > > > > RB
> > > >
> > > > Hi! I have C programming experience and I can help. Still got some
> > > > work, but I can wrote some code in free time ;).
> > > >
> > > > Mateusz M.
> > > > --
> > > > gentoo-hardened@l.g.o mailing list
-- 
gentoo-hardened@l.g.o mailing list