Re: [gentoo-security] tripwire policy generator

[Tom Hosiawa]

Just forwarding it to the list, as I seemed to have left out the list on
my last email.


> Hi Tom,
>
> The first approach (new tripwire-<package>) ebuilds could be done without
> directly involving the package maintainer, but as you point out, would
> increase the number of ebuilds.  I doubt we'd get to the stage of
> duplicating every package in portage however - that's a major job ;-)
>
> The second approach would be, where each package is 'tripwire aware' is
> definitely the cleanest solution, but requires input from package
> maintainers.
>
> A third possible solution would be to develop a standalone package which
> contains <package> -> policy mappings for many packages.  It could
> perhaps, scan the emerge log or /var/db/pkg and create conf.d/ entries
> accordingly.
>
>
> -Ronan
>
> On Thu, 25 Mar 2004, Tom Hosiawa wrote:
>
> > > I had a quick look at this a couple of months ago, however it's not an
> > > easy task.  I think the simplest way to do it would be to take the conf.d/
> > > approach many packages use.  Multiple tripwire-<package> ebuilds could
> > > be created which could be emerged to populate this directory - or the
> > > <package> ebuild could place files in this directory.
> >
> > Do you mean having a tripwire-<package> ebuild for every package in
> > portage? I think this would take to much effort, considering how many
> > packages are already in portage.
> >
> > Now if each package ebuild would put entries in conf.d that need to be
> > protected, that might be possible. But would this not be placing too
> > much burden on every package maintainer?
> >
> > Tom


--
gentoo-security@g.o mailing list