Re: [gentoo-user] Choosing between system profiles: hardened and desktop for desktop installation.

[james]

On 07/04/17 01:12, Ста Деюс wrote:
> Hi.
>
> I'm new to Gentoo, and before new installation on my PC, keep trying to
> choose between system profiles. I want to use the PC as desktop, but am
> concerned on security and minimalism. So, I would like to use the
> hardened profile and then add the desktop packages, namely openbox w/o
> any X-session managers -- just logging in w/ text console and then
> startx.
>
> So, is my setup wise, or i miss something because do not know something
> on the distro. regarding this points of installation?
>
> Thank you for your time,
> Sthu.

Minimalism does reduce attack surfaces, but on a workstation, if later
on you want some complex and fancy software, often you have to start
adding codes, flags and recompiling quite a lot. On specific task
machines, I always go the minimal route, ymmv.  I run lxde but it
is morphing into lxqt (or at least that's what is commonly posted.
I've run openbox and actually now use a mixture of codes to build up
one minimized workstation, but it is a pita to get happy.

W. Dnes is the king of minimalist here, so when he gives advise
realize it has decades of experimentation to get to where he is on
minimization. I've been hacking on codes for minimized Hi Performance
Computing (HPC) gentoo style, but not ready to release anything as it is
a moving target. "Unikernels" are my pathway forward but this path is a
huge time sink... Caveat Emptor!


Hardened is changing, do to the fact that the patches provided to the
linux kernel team, are not being provided for free anymore. There is
much angst as to the pathway forward. Much of the work is being carried
forward in the kernel, compiler projects and some apps but what to do,
post kernel 4.9.x is not clear for gentoo, atm. This thread by blueness
on gentoo-dev is a good place to start reading, look in the archives::

[gentoo-dev] The status of grsecurity upstream and hardened-sources
downstream


Here's the [thread]intro::


"Since late April, grsecurity upstream has stop making their patches
available publicly.  Without going into details, the reason for their
decision revolves around disputes about how their patches were being
(ab)used.

Since the grsecurity patch formed the main core of our hardened-sources
kernel, their decision has serious repercussions for the Hardened Gentoo
project.  I will no longer be able to support hardened-sources and will
have to eventually mask and remove it from the tree.

Hardened Gentoo has two sides to it, kernel hardening (done via
hardened-sources) and toolchain/executable hardening.  The two are
interrelated but independent enough that toolchain hardening can
continue on its own.  The hardened kernel, however, provided PaX
protection for executables and this will be lost.  We did a lot of work
to properly maintain PaX markings in our package management system and
there was no part of Gentoo that wasn't touched by issues stemming from
PaX support.

I waited two months before saying anything because the reasons were more
of a political nature than some technical issue.  At this point, I think
its time to let the community know about the state of affairs with
hardened-sources.

I can no longer get into the #grsecurity/OFTC channel (nothing personal,
they kicked everyone), and so I have not spoken to spengler or pipacs.
I don't know if they will ever release grsecurity patches again.

My plan then is as follows.  I'll wait one more month and then send out
a news item and later mask hardened-sources for removal.  I don't
recommend we remove any of the machinery from Gentoo that deals with PaX
markings. "


Personally, I'd suggest following Anthony (blueness) as to the
gentoo-hardened pathway forward, but surely others in the extended
gentoo community are surefooted with gentoo security. (Pentoo) might be
of interest as a workstation pathway forward.... If you cannot block them,
join them....?

;-)	


hth,
James


And more links for your convenience::

https://www.theregister.co.uk/2015/08/27/grsecurity

https://www.wilderssecurity.com/threads/grsecurity-patches-going-private.393068/

https://lwn.net/Articles/662219/

https://lwn.net/Articles/698891/

https://grsecurity.net/compare.php

https://www.theregister.co.uk/2015/08/27/grsecurity