Re: [gentoo-hardened] persistent paxctl -m?

[Alex Efros]

Hi!

On Fri, Apr 10, 2009 at 11:35:36AM +0800, Pavel Labushev wrote:
> A simple cron job or slightly-less-simple RBAC policy can do the trick.
> There's no need to mess with portage, imho.

Cron job is just waste of time (this is one-time task after installing
package, not once-per-minute task) and race condition (after installing
package but before running cron job it may be run and will segfault).

That's not mess with portage because portage right now control PaX flags
for many packages anyway. But it doesn't set PaX flags for firefox or
mplayer, because they able to work without this (if you don't use flash
with firefox and don't use win32codecs with mplayer) and probably because
these packages unlikely will be installed on hardened server.

Also using given /etc/portage/bashrc I not only set paxctl -m, but also
switch gcc to hardened-nossp while compiling several packets (to workaround
http://bugs.gentoo.org/show_bug.cgi?id=217112) and rebuild CPAN module
Scalar::Util after recompiling perl (needed because I don't use portage to
manage perl modules).

So, it used not to mess with portage, but to automate some tasks required
while/after emerging packages to keep system working in my configuration.

-- 
			WBR, Alex.