Re: [gentoo-hardened] Grsecurity 2 in hardened-sources

[Jesse Jacobs]

Good morning,

Please forgive my boldness (I'm Dutch). :)
Last night I was functioning on 2 hours of sleep.
The alias (a CnP from a previous e-mail in a "From Memory" context) is
totally open for suggestions, criticism, improvement.
In fact I was hoping to roll this around a little.

I was wondering when gradm-2* would be put in portage?
Would there be any sort of docs for this too? (Humble Plea) :)

Thanks Again Gentoo-Hardened!
j


DOH!
pressed reply!
j

-------- Original Message --------
Subject: Re: [gentoo-hardened] Grsecurity 2 in hardened-sources
From: "Jesse Jacobs" <jesse@×××××××××××.net>
Date: Tue, June 10, 2003 11:21 pm
To: <solar@g.o>

Hello,

First, THANKS!!!

Huge Appreciation here!

Why use SLOTS?

Would u be willing to try using a hard mask?

When the grsec2 transition takes place across all kernels...

we can use grsec2 by removing the hardmask.

Anyone that want's to use grsec2 must maintain package.mask
ie.
alias realsync='emerge sync && diff -u /root/package.mask
/usr/portage/profiles/package.mask > /root/package.mask.diff && cp
/root/package.mask /usr/portage/profiles/package.mask && source
/etc/profile && echo "Maintaining Your Package Limits."'

Then update the box with:
realsync; emerge -uUvp world;

j

Ned Ludd said:
> On Mon, 2003-06-09 at 16:12, Joshua Brindle wrote:
>> I'd rather you use SLOT's, this is what they are for..
>> otherwise in a few months you are going to have a
>> sys-apps/gradm2 and you won't be able to move it
>> (you can but it's overly complicated).
>>
>> you can just have gradm-1 in slot one that installs to
>> /usr/sbin/gradm and gradm-2 in slot two that installs to
>> /usr/sbin/gradm2 and they won't conflict, you could even
>> give them different policy directories so that they don't
>> collide.
>
>> You could then have both slots merged in next to each other
>> and it wouldn't be an issue..
>
> I dont see how this could/would prevent users that have ~arch keywords
> from installing gradm-2 when using -sources other than
> hardened-sources.
>
> Ok say we have ~arch in our keywords and we are using
> gentoo-sources-2.4.20-r5(grsecurity 1.9.x) and we do emerge world the
> next time we come back to this box it would end up having >=gradm-2
> installed and we would not be able to enable/disable the acl system.
>
>> the apache apache2 slot mess is really not SLOT'S fault, it's
>> something different altogether, we have plenty of apps that
>> have been happily slotted for a very long time (db, gtk, et al)
>
> SLOTS do not seem to properly address who is using what sources.
> Example ever had a box running apache1 and had ~x86 in your keywords
> and did 'emerge world' portage will override your previous install of
> apache1 and force you to use apache2 [doh!]. This is my concern with
> gradm-1 & gradm-2.
>
> If you or anybody on this list knows of a way to make this behave
> correctly with these settings then please by all meens submit your
> ebuild for gradm-2.0_pre4 (or fix portage so it honors whats installed
> already when using ~arch flags)
>
> --
> Ned Ludd <solar@g.o>
> Gentoo Linux (Hardened)
>
>
> --
> gentoo-hardened@g.o mailing list




--
gentoo-hardened@g.o mailing list



Ned Ludd said:
> On Mon, 2003-06-09 at 16:12, Joshua Brindle wrote:
>> I'd rather you use SLOT's, this is what they are for..
>> otherwise in a few months you are going to have a
>> sys-apps/gradm2 and you won't be able to move it
>> (you can but it's overly complicated).
>>
>> you can just have gradm-1 in slot one that installs to
>> /usr/sbin/gradm and gradm-2 in slot two that installs to
>> /usr/sbin/gradm2 and they won't conflict, you could even
>> give them different policy directories so that they don't
>> collide.
>
>> You could then have both slots merged in next to each other
>> and it wouldn't be an issue..
>
> I dont see how this could/would prevent users that have ~arch keywords
> from installing gradm-2 when using -sources other than hardened-sources.
>
> Ok say we have ~arch in our keywords and we are using
> gentoo-sources-2.4.20-r5(grsecurity 1.9.x) and we do emerge world
> the next time we come back to this box it would end up having >=gradm-2
> installed and we would not be able to enable/disable the acl system.
>
>> the apache apache2 slot mess is really not SLOT'S fault, it's
>> something different altogether, we have plenty of apps that
>> have been happily slotted for a very long time (db, gtk, et al)
>
> SLOTS do not seem to properly address who is using what sources. Example
> ever had a box running apache1 and had ~x86 in your keywords and did
> 'emerge world' portage will override your previous install of apache1
> and force you to use apache2 [doh!]. This is my concern with gradm-1 &
> gradm-2.
>
> If you or anybody on this list knows of a way to make this behave
> correctly with these settings then please by all meens submit your
> ebuild for gradm-2.0_pre4 (or fix portage so it honors whats installed
> already when using ~arch flags)
>
> --
> Ned Ludd <solar@g.o>
> Gentoo Linux (Hardened)
>
>
> --
> gentoo-hardened@g.o mailing list




--
gentoo-hardened@g.o mailing list