[gentoo-hardened] SELinux updates

[Chris PeBenito]

There are several bits of news:

* The updated livecd and stages have been moved to the mirrors:
http://gentoo.oregonstate.edu/experimental/hardened/

* I'm going to be releasing a new base-policy that has one large change
plus (in addition to a few minor fixes), which changes the behavior or
sysadm_r.  I have removed sysadm_r's access from almost all files except
the obvious ones, such as in /etc, /root, /usr/src, etc.  This is to
increase the separation between portage_t and sysadm_t.  The
admin_separation tunable controls this behavior.  Since we are
security-oriented, this is default on.  Of course, those who want the
previous behavior can disable admin_separation to regain the access. 
The daemon policies in portage will soon be updated accordingly.

* The NSA has stopped maintaining the 2.4 SELinux patches.  We will try
to update them as long as we can; however, this means that the days are
numbered for selinux-sources, and hardened-sources-2.4.*/with
USE=selinux.  2.4 Users are encouraged to begin evaluating 2.6 for use.

* The 2.6.8 kernel will have some new SELinux classes for security
enhanced X.  The problem is that these will collide with our PaX
support.  This means that the kernel and the policy will have to be
updated at the same time, as the kernel will not load a policy whose
headers don't match its own.  When 2.6.8 comes out, I will put out a
policy with the new headers, and also bump all kernels that have the PaX
SELinux hooks.  Fortunately the PaX headers have been accepted upstream,
so this won't happen again.  2.6.8 will also bring policy version 18,
since fine-grained netlink socket support has been added.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243