[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: gentoo/hardened


On Mon, 2005-05-30 at 02:31 +0100, Luke Kenneth Casson Leighton wrote:
> i've just installed gentoo/hardened on a laptop, and i wanted to run
> Xorg on it.
> 
> bearing in mind the warnings about gentoo/hardened not having
> "workstation" capability, i noted these and carried on, happy in the
> knowledge that i would be able to sort it out.
> 
> ... then i found out what chris had done.

You make it sound like I did something nefarious!

> chris - i hope you don't mind me saying this...
> 
> ... but you have made a _lot_ of work for yourself, and for
> people like myself who would be happy to contribute / get
> things working.
> 
> what chris has done is, rather than create (for example, as one
> possible way forward) a gentoo_hardened define and comment out
> blocks of code is... he's started from the sf.net cvs policy
> and REMOVED entire sections from the gentoo released selinux
> policy (including a large number of booleans).

This has been discussed on the list before.  We simply have different
goals then other distros.  The NSA example policy is being pushed by Red
Hat for widespread use, and the policy is developed in that direction,
which is fine.  The tunable policy was converted over to use booleans
and conditional policy support, which is to Red Hat's advantage, since
they don't want to install policy sources on people's system by default.
I don't have a problem with any of this, since widespread adoption helps
SELinux, which is good.  

Gentoo users are willing to give up more functionality, especially
legacy support, for more security.  We also don't want a bunch of dead
policy, since its wasteful, and leaves more possibility of unwanted
information flows.  So the 'base policy' is only the policy needed for
the core system packages.  As a user merges more packages, policy is
pulled in as a dependency as required.  Configurability is a big thing
for Gentoo users, and thus they are willing to get down into the
details, so we definitely install the policy sources.  Most of the
tunable policy does not need to be toggled at runtime; therefore, I
reverted the conditional policy back to m4 ifdefs so there isn't extra
unneeded policy in memory.

The main divergence is the conditional policy being switched back to m4
ifdefs.  This wouldn't be sanely handled with distro tunables.  Most
everything else is just the fact that I don't keep up with sourceforge
CVS religiously.  If it ain't broke, don't fix it.

-- 
Chris PeBenito
<pebenito@xxxxxxxxxx>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243

-- 
Chris PeBenito
<pebenito@xxxxxxxxxx>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243

Attachment: signature.asc
Description: This is a digitally signed message part



This mailing list archive is a service of Copilot Consulting.