Re: [gentoo-hardened] hardened-sources + vserver

[Ned Ludd]

On Tue, 2007-07-17 at 18:44 +0200, Christian Parpart wrote:
> On Sunday 08 July 2007 23:23:26 Christian Heim wrote:
> > On Saturday 07 July 2007 10:26:58 Natanael Copa wrote:
> > > hmm....
> > >
> > > I compared with the vserver+grsec patch from http://linux-vserver.org
> > > and just copied the patched file on rejected files. There is no vserver
> > > +grsec patch for 2.6.20 there so its more work.
> > >
> > > However, if there would be any interest in a official gentoo hardened
> > > vserver kernel, I might put some extra effort in it.
> >
> > It won't get any more "official" than my overlay, sorry :)
>
> for what reason?
>
> I mean, there seems to be an interest in it, not just him (and me, most
> obviousely).
>
> I guess most ppl who want to setup a vserver environment also want to be a
> little bit *more* secure than the standard way - i'm thinking about grsec
> here.
>
> why isn't there an option to (by default) provide this to the vserver-sources
> (or optional via hardened useflag that is enabled in a hardened profile
> anyways?) - makes sense to me at least ;)


Manpower/stability/security.. There are many reasons why hardened wont
be including vserver in hardened-sources (unless mainline takes 
vserver). There are probably many reasons why vserver-sources might not 
want to include hardened patches. Like not being bound to wait on 
pax/grsec upstream for new releases of vserver. My personal feelings 
however is if it were ever to be considered for inclusion it would be 
better for vserver to include hardened vs hardened including vserver as 
they require a special kernel etc..



> Regards,
> Christian Parpart.
-- 
Ned Ludd <solar@g.o>
Gentoo Linux

-- 
gentoo-hardened@g.o mailing list