Re: [gentoo-hardened] stage3's openssl has TEXTREL

[Ned Ludd]

zhen,
Peter is right openssl in the stage3 does contain TEXTREL.
This needs to be fixed for the final grp stages are released.  For all
arches that GRP is going to handle (not just hardened).

I've also noticed that our desired FEATURES don't seem to be kicking in
until after a the user has rsyncd. 

Lets take a look at basic file permissions.
# 04000.

1825457   28 -rwsr-xr-x   1 root     root        26732 Jan  6 12:17
/bin/su
1825515   40 -rwsr-xr-x   1 root     root        37072 Jan  6 12:07 /bin/ping
1825449   96 -rws--x--x   1 root     root        90808 Jan  6 12:22 /bin/mount
1825451   32 -rwsr-xr-x   1 root     root        32304 Jan  6 12:07 /bin/ping6
1825429   56 -rws--x--x   1 root     root        50572 Jan  6 12:22 /bin/umount
408439   36 -rwsr-xr-x   1 root     root        33484 Jan  6 12:17 /usr/bin/chfn
408378   36 -rwsr-xr-x   1 root     root        33548 Jan  6 12:17 /usr/bin/chsh
408312   44 -rwsr-xr-x   1 root     root        43880 Jan  6 12:17 /usr/bin/chage
408543   16 -rwsr-xr-x   1 root     root        14612 Jan  6 12:07 /usr/bin/traceroute6
408733   12 -rwsr-xr-x   1 root     root        10332 Jan  6 12:07 /usr/bin/tracepath6
408346   24 -rwsr-xr-x   1 root     root        20552 Jan  6 12:17 /usr/bin/expiry
408730 1072 -rws--x--x   2 root     root      1091093 Jan  6 11:59 /usr/bin/sperl5.8.0
408476   28 -rwsr-xr-x   1 root     root        25000 Jan  6 12:17 /usr/bin/newgrp
408656   32 -rwsr-xr-x   1 root     root        31208 Jan  6 12:17 /usr/bin/passwd
408614   44 -rwsr-xr-x   1 root     root        41460 Jan  6 12:17 /usr/bin/gpasswd
408426   12 -rwsr-xr-x   1 root     root        10260 Jan  6 12:07 /usr/bin/tracepath
408730 1072 -rws--x--x   2 root     root      1091093 Jan  6 11:59 /usr/bin/suidperl
603864  180 -rws--x--x   1 root     root       179236 Jan  6 12:24 /usr/lib/misc/ssh-keysign
603865    8 -rws--x--x   1 root     root         6104 Jan  6 10:08 /usr/lib/misc/pt_chown
1564576   24 -r-sr-xr-x   1 root     root        22495 Jan  6 12:16 /usr/sbin/unix_chkpwd
1564569   20 -r-sr-xr-x   1 root     root        19652 Jan  6 12:16 /usr/sbin/pwdb_chkpwd
1564531   12 -r-s--x--x   1 root     root        11411 Jan  6 12:16 /usr/sbin/pam_timestamp_check

# 02000
408563   48 -r-xr-sr-x   1 root     man         48840 Jan  6 11:45 /usr/bin/man
408507   12 -rwxr-sr-x   1 root     tty          9200 Jan  6 12:22 /usr/bin/write
408540   36 -rwx--s--x   1 root     2601        36561 Jan  6 12:17 /usr/bin/slocate

# all these setuid files should be go-rw and setgid files should be o-rw
out of the box.

# We dont have ipv6 enabled in our USE flags so I don't see why we
should be getting tracepath6, traceroute6 in the first place (odd eh?).

# It also appears ccache is getting enabled. I'm not sure if we want
this or not. I would assume NO as it's been known to cause problems with
old __guard symbols laying around. But it might not be a problem as long
as the __guard symbol is found at glibc vs libgcc. Perhaps pappy can
comment on if he thinks this feature should be disabled in our profile.

# stripping. I've still got one small addition to go into portage itself
to handle sripping better of shared objects. Don't let it hold you up as
it only shaved off 2 megs off of /{,usr/}{s,}bin/

On Thu, 2004-01-08 at 16:10, John Davis wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Peter S. Mazinger wrote:
> | Hello!
> |
> | On my first attempt with gentoo starting from stage3 (oregonstate
> | december) tarball, chroot, and running emerge --help shows libcrypto
> | (0.9.6) having TEXTREL (I have checked all other libs in /lib, /usr/lib,
> | they are clean). Could this also be the case for the mainstream openssl?
> |
> | Peter
> |
> Are you using hardened stages - if so, use the ones from the
> experimental directory that are datestamped 20040105. I do not know if
> they have TEXTREL removed, but if hgcc 2.4.5 supports that, then yes.
>
> Cheers,
> //zhen
> - --
> John Davis
> Gentoo Linux Developer
> <http://dev.gentoo.org/~zhen>
>
> - ----
> Knowledge can be more terrible than ignorance if you're powerless to
> change your world.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQE//cc+ZlASNRlGLUcRArHoAJ9gR+l2tEGjP8QbDCv51YZYOYSyEgCgtddi
> jxx89FMJSWzKCRXV0lPQi7c=
> =t0Wl
> -----END PGP SIGNATURE-----
>
>
> --
> gentoo-hardened@g.o mailing list
-- 
Ned Ludd <solar@g.o>
Gentoo Linux Developer