Re: [gentoo-security] tripwire policy generator

[Koon]

>The first approach (new tripwire-<package>) ebuilds could be done without
>directly involving the package maintainer, but as you point out, would
>increase the number of ebuilds.  I doubt we'd get to the stage of
>duplicating every package in portage however - that's a major job ;-)
>
>The second approach would be, where each package is 'tripwire aware' is
>definitely the cleanest solution, but requires input from package
>maintainers.
>
>A third possible solution would be to develop a standalone package which
>contains <package> -> policy mappings for many packages.  It could
>perhaps, scan the emerge log or /var/db/pkg and create conf.d/ entries
>accordingly.

I think all three approaches are too much work for a very small 
improvement in results. You can use Tripwire with global categories like 
"userland binaries", "configuration files", etc... with good results (I 
do). Per-package configuration seems overkill to me.

Also note that the first two solutions are not realistic : even if it 
was very interesting to do so, I don't see anyone approve changing all 
ebuilds (or doubling all ebuilds) just to make one package work better. 
Better start your own tripwire-aware distribution...

That said, the third approach is possible : it's a lot of work, but at 
least it does not require infrastructure or global ebuild changes ;)

-K

--
gentoo-security@g.o mailing list