Re: [gentoo-user] nvidia-kernel p.masked by hardened profile

[Richard Fish]

On 7/11/06, Willie Wong <wwong@×××××××××.edu> wrote:
>  1. nv still doesn't do 3D acceleration, right?

Yes.

>  2. Is there more information about what "more harm than good" means?
>    I tried googling but the only thing I found was a commit log on
>    solar's website with a one-liner about p.masking nvidia-kernel. I
>    want to know what kind of problems that nvidia drivers incur so I
>    can decided whether to give up 3D acceleration, the hardened
>    profile, or ignore solar's advice and unmask the packages.

Well, see what the hardened handbook has to say about binary drivers and x.org:
http://www.gentoo.org/proj/en/hardened/hardenedxorg.xml#doc_chap4

I also found this bug:
http://bugs.gentoo.org/show_bug.cgi?id=139047

There may also be a valid security concern with binary-only kernel
modules: since they cannot be audited for security, one should assume
that they are horribly insecure.  Any exploit here could comprimise
the entire system, so one could argue they are totally inappropriate
for a 'hardened' system.

>  3. Is this (the fact that I am running a hardened profile) the reason
>    that if I 'emerge --pretend --update xorg-x11 --verbose', among the
>    list of VIDEO_CARDS options displayed, I do not see nvidia?

That is correct.  video_cards_nvidia is in the hardened profile's use.mask.

-Richard
-- 
gentoo-user@g.o mailing list