Re: [gentoo-hardened] hardened versus grsec-sources and related questions

[Ned Ludd]

On Tue, 2004-06-08 at 09:19, Alby Lash wrote:
> Hello,
>
> I have compiled and installed the grsec-sources (2.4.26-grsec-2.0) on
> x86 platform with ease, and now I am trying to configure my acls. Per
> the document:
>
> http://www.gentoo.org/proj/en/hardened/grsecurity.xml

All references to this document have been removed for a reason which you
I'll explain in a sec.

> In code listing 8.1, I was unable to emerge grsecurity-base-policy as
> it has been deprecated. I found selinux-base-policy and emerged it
> along with gradm and chpax with no problems but now cannot find the
> init script for enabling the grsecurity service (which might be
> entitled something different?).

Ok slow down here guy.. selinux and grsecurity are not the same thing
(almost not even close). Trying to intermix polices will get you nowhere
fast.

> Furthermore, when I gradm -E  to start
> the service, I always get an error, such as:

Ok what your doing wrong is your trying to use 1.9.x policies with a 2.0
system which will never work. Forget the idea of 1.9.x or hand patch
your own kernel to support it. Gentoo no longer supports 1.9.x in any of
it's kernels that I'm aware of.

grsec-2 however provides a powerful learning mode which you can and
should use on your own system to build a set of policies thats right for
your system vs some canned ones that we could waste our time and try to
provide you with.

I'm a slacker and writing docs is not something I enjoy doing for free.
So... this is all you get from me for now on the subject of creating
roles for your 2.x system
http://dev.gentoo.org/~solar/xml/grsecurity2.html



> Error on line 2 of /etc/grsec/acl.  Attempt to add an object without a
> subject declaration.
> The RBAC system will not load until this error is fixed.
>
> With the ACL contents (default from earlier referenced page):
>
> / {
>      /
>      /opt                    rx
>      /home                   rwx
>      /mnt                    r
>      /dev
>      /dev/mem                h
>      /dev/kmem               h
>      /dev/port               h
>      /dev/null               rw
>      /dev/pts                rw
>      /dev/ptmx               rw
>      /dev/dsp                rw
>      /dev/mixer              rw
>      /dev/console            rw
>      /dev/log                h
>      /dev/zero               rw
>      /dev/random             r
>      /dev/urandom            r
>      /dev/input              rw
>      /dev/initctl            rw
>      /dev/psaux              rw
>      /dev/tty                rw
>      /dev/tty?               rw
>      /dev/tty1?              rw
>      /dev/vc                 rw
>      /bin                    rx
>      /sbin                   rx
>      /lib                    rx
>      /lib/security           rx
>      /usr                    rx
>      /usr/lib                rx
>      /boot                   r
>      /etc/grsec              h
>      /etc                    rx
>      /etc/init.d             rx
>      /etc/shadow-            h
>      /etc/shadow             h
>      /etc/postfix            r
>      /proc                   rwx
>      /proc/sys               r
>      /proc/kcore             h
>      /root                   r
>      /root/.bash_history     ra
>      /root/.history          ra
>      /tmp                    rw
>      /var                    rx
>      /var/cache              rw
>      /var/run                rw
>      /var/tmp                rw
>      /var/log                h
>      /var/log/wtmp           a
>      /var/spool              rw
>      /var/spool/postfix/lib  rx
>      /etc/ld.so.preload      rw
>      /mnt/.init.d            rwx
>
>      -CAP_ALL
> }
>
>
> Any idea what is going on with gradm? What is the difference between
> selinux-base-policy and grsecurity-base-policy?
>

> Is grsec-sources being deprecated in lieu of hardened-sources? I chose
> grsec-sources because they are used in Gentoo infrastructure servers.

No not at all. Gentoo is about giving users options. IE install what
ever the hell you want.
grsec-sources is a pure vanilla sources with the grsec current patches
(misc CAN patches if/when need be).
 
hardened-sources offers a little more in it's base (selinux||grsec)
depending on USE flags. It's not always quite as up2date as grsec
sources on the grsec side of things due to the nature of both how large
grsec patches are playing the offset game with patching (time becomes a
limit factor). There should be a README in the patch tarball of the
hardened-sources if you care to know whats provided by it.

>
> Would I be better off following documentation for hardened servers
> instead of the grsecurity guide referenced above?




> Anything I can do to help?

Probably not right away. You have quite a few concepts to learn about it
seems. You can write documentation, make a donation to the hardened
project, submit patches, etc..

I'd suggest that leaning the concepts of everything would be the ideal
route for you to go now.

-- PaX --
http://pax.grsecurity.net/docs/index.html

-- grsec2 --
http://grsecurity.net/quickstart.pdf
http://grsecurity.net/researchpaper.pdf


>
> Thanks!
>
> Alby
>
>
> --
> gentoo-hardened@g.o mailing list
-- 
Ned Ludd <solar@g.o>
Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer