Gentoo Archives: gentoo-hardened

From: "Tóth Attila" <atoth@××××××××××.hu>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression
Date: Thu, 17 May 2012 21:03:02
Message-Id: 3ac8bab2f7c9462f307998a7b27cf165.squirrel@atoth.sote.hu
In Reply to: Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression by Maxim Kammerer
1 2012.Május 17.(Cs) 17:08 időpontban Maxim Kammerer ezt írta:
2 > On Thu, May 17, 2012 at 5:40 PM, "Tóth Attila" <atoth@××××××××××.hu>
3 > wrote:
4 >> How would I change the way /dev gets mounted? I don't have noexec as an
5 >> option listed by mount for the udev entry.
6 >
7 > I mount devtmpfs on /dev in initramfs, but you can add an entry to
8 > /etc/fstab, too — see /etc/init.d/udev-mount for details (referring to
9 > OpenRC 0.9.8.4 here).
10
11 It works. Thx: Dw.
12 --
13 dr Tóth Attila, Radiológus, 06-20-825-8057
14 Attila Toth MD, Radiologist, +36-20-825-8057
15
16 >
17 >> In my policy file Xorg is permitted to execute /dev/mem: is that no
18 >> longer
19 >> needed? I use the radeon driver, not the proprietary.
20 >
21 > I didn't encounter any issues with radeon. Apparently, executing
22 > /dev/mem is not needed for any open-source Xorg drivers in portage
23 > tree. The only issue I have seen is that sometimes there is a /dev/mem
24 > *write* failure when FB_UVESA kernel module is loaded, but that is
25 > caused by GRKERNSEC_KMEM, not /dev noexec, and is apparently harmless
26 > (however, I use v86d[x86emu], so YMMV).
27 >
28 > --
29 > Maxim Kammerer
30 > Liberté Linux (discussion / support: http://dee.su/liberte-contribute)
31 >
32 >