Re: [gentoo-hardened] Ports Security

[Jan Krueger]

On Friday 05 September 2003 18:34, Joshua Brindle wrote:
> based on the openbsd page you pasted, and my own intuitions i'll
> just say this isn't ever going to be done. There is no reason to
> add this kind of checking into the user side of portage.

Well, there is, for sure.

(The posted OpenBSD page defines a policy somehow and gives recommendations 
for/to ports developers to make sure the resulting software doesnt comprise 
the overall security of the system)

(gh=gentoo hardened)

Such a policy, from my point of view, is required for gh too.
It is too easy, eben with ProPolice, grsecurtiy, PaX whatever, to create a 
open system by installing software that does the wrong thing.
(old classic: sendmail spawning uudecode overwriting /etc/passwd)

I, as a Sysadmin, on the other hand, dont have the time audit every package.
But at least, those tools would help me to estimate
1. if the software i would like to install is somehow risky
2. risky to what extend

So i can define a System/Site wide policy what ebuilds i accept an which not.

On the third hand it is impossible for gh to bring all >4000 ebuilds to a high 
security level, also it is impossible to enforce a secure ebuild policy on 
all contributers, some simply dont care. I dont care if unreal tournament is 
secure or not, but i do care about other things, server related. For sure, 
some important core stuff will be hardened, what about the rest?

So i as a sysadmin or user should have an easy way to check the possible 
impact of an ebuild i would like install. and then i will decide: i do or 
dont. I also would like to define a policy that allows install only of known 
secure ebuilds and ebuilds that pass the checks.

A secure ebuild policy it would help to define gh.
All ebuilds (lets say maybe 100, base things) that implement this policy 
belong to gh and are proven and userverifyablesecure.

Jan


--
gentoo-hardened@g.o mailing list