On Mon, 2005-05-30 at 02:31 +0100, Luke Kenneth Casson Leighton wrote: > i've just installed gentoo/hardened on a laptop, and i wanted to run > Xorg on it. > > bearing in mind the warnings about gentoo/hardened not having > "workstation" capability, i noted these and carried on, happy in the > knowledge that i would be able to sort it out. > > ... then i found out what chris had done. You make it sound like I did something nefarious! > chris - i hope you don't mind me saying this... > > ... but you have made a _lot_ of work for yourself, and for > people like myself who would be happy to contribute / get > things working. > > what chris has done is, rather than create (for example, as one > possible way forward) a gentoo_hardened define and comment out > blocks of code is... he's started from the sf.net cvs policy > and REMOVED entire sections from the gentoo released selinux > policy (including a large number of booleans). This has been discussed on the list before. We simply have different goals then other distros. The NSA example policy is being pushed by Red Hat for widespread use, and the policy is developed in that direction, which is fine. The tunable policy was converted over to use booleans and conditional policy support, which is to Red Hat's advantage, since they don't want to install policy sources on people's system by default. I don't have a problem with any of this, since widespread adoption helps SELinux, which is good. Gentoo users are willing to give up more functionality, especially legacy support, for more security. We also don't want a bunch of dead policy, since its wasteful, and leaves more possibility of unwanted information flows. So the 'base policy' is only the policy needed for the core system packages. As a user merges more packages, policy is pulled in as a dependency as required. Configurability is a big thing for Gentoo users, and thus they are willing to get down into the details, so we definitely install the policy sources. Most of the tunable policy does not need to be toggled at runtime; therefore, I reverted the conditional policy back to m4 ifdefs so there isn't extra unneeded policy in memory. The main divergence is the conditional policy being switched back to m4 ifdefs. This wouldn't be sanely handled with distro tunables. Most everything else is just the fact that I don't keep up with sourceforge CVS religiously. If it ain't broke, don't fix it. -- Chris PeBenito <pebenito@xxxxxxxxxx> Developer, Hardened Gentoo Linux Embedded Gentoo Linux Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243 Key fingerprint = B0E6 877A 883F A57A 8E6A CB00 BC8E E42D E6AF 9243 -- Chris PeBenito <pebenito@xxxxxxxxxx> Developer, Hardened Gentoo Linux Embedded Gentoo Linux Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243 Key fingerprint = B0E6 877A 883F A57A 8E6A CB00 BC8E E42D E6AF 9243
Attachment:
signature.asc
Description: This is a digitally signed message part