Re: [gentoo-hardened] die() required on pax-mark?

[Michael Orlitzky]

On 10/20/2013 07:39 PM, Anthony G. Basile wrote:
>
> The profile idea is a good one, but I'm always worried about people who
> switch profiles. If we don't do the markings on *all* gentoo systems,
> then someone switching from vanilla to hardened may have to re-emerge
> lots of packages.  Unlike PT_PAX which is guaranteed to be there for
> systems compiled on gentoo, XT_PAX markings are more fragile and depend
> on the filesystem being able to sustain them.
>


I thought about this, but it isn't as bad as it looks initially.

As long as we have PT_PAX, there's nothing to worry about. Even with a
profile-based solution, we could set PAX_MARKINGS="PT" in the base
make.defaults. So no problem for now.

But eventually, we're going to drop PT_PAX in favor of XT_PAX. As I
mentioned, many ebuilds in the tree are calling "pax-mark || die". That
will block the switch, since packages would begin to fail for users
without xattr support. There are two obvious ways to fix it: remove the
die calls, or implement a profile-based solution that doesn't annoy
non-hardened users. So maybe we have to implement a profile-based
solution anyway, and the point is moot.

But lets say for the sake of argument that everyone removes the "|| die"
from their pax-marks. We still have two cases:

  1. The users that have xattr-enabled filesystems. They can switch
     to hardened freely, since the pax-marks have been succeeding.

     But are you *sure* you've had xattrs enabled the entire time we've
     been doing XT_PAX markings?

     a. If so, great.

     b. If not, you'd better `emerge -e world` anyway to avoid
        surprises.

  2. Users without xattr support. The calls to pax-mark didn't do
     anything, but they didn't fail. A full `emerge -e world` is
     necessary to avoid mysterious breakage.

This is in contrast to the profile-based solution, which only has one
case: everybody has to `emerge -e world` once to get the markings. But,
after we drop PT_PAX, this is only *worse* for the people in (1.a).
That's a much smaller group than /everyone/ who switches to hardened.