Re: [gentoo-hardened] XATTR_PAX migration

[Anthony G. Basile]

On 09/09/2013 10:19 AM, Michael Orlitzky wrote:
> On 09/09/2013 09:49 AM, Alex Efros wrote:
>> Hi!
>>
>> On Mon, Sep 09, 2013 at 09:30:56AM -0400, Michael Orlitzky wrote:
>>> That is, can I disable PT_PAX, enable XATTR_PAX, reboot, and run
>>> migrate-pax? Or might that cause problems?
>>
>> You can migrate with just one reboot, but order of actions is different:
>>
>> 1. Build new kernel with PT_PAX disabled and XATTR_PAX enabled.
>> 2. Run `migrate-pax -m`.
>> 3. Reboot using new kernel.
>
> Thanks, I'll give it a try (on the router in the building where I have
> keys, first...).
>
>
>> I'm not really sure, but you may also need to add PAX_MARKINGS="XT" into
>> /etc/make.conf.
>>
>
> pax-utils.eclass has this to say:
>
>    To control what markings are made, set PAX_MARKINGS in /etc/portage
>    /make.conf to contain either "PT", "XT" or "none". The default is to
>    attempt both PT_PAX and XATTR_PAX.
>
> But then again, right below that, I see,
>
>    # @ECLASS-VARIABLE: PAX_MARKINGS
>    # @DESCRIPTION:
>    # Control which markings are made:
>    # PT = PT_PAX markings, XT = XATTR_PAX markings
>    # Default to PT markings.
>    PAX_MARKINGS=${PAX_MARKINGS:="PT"}
>
> So I'm not really sure either.
>

That was my mistake.  When I dropped XT I forgot to update the comment. 
  We tried XT right off the bat, but discovered a couple of problems: 1) 
install doesn't preserve xattr.  we have a solution but it isn't working 
that well, and 2) there were lots of warning thrown for non hardened 
users which annoyed them.  So we dropped to just PT.


-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
[phone]