From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org)
	by finch.gentoo.org with esmtp (Exim 4.60)
	(envelope-from <gentoo-commits+bounces-346757-garchives=archives.gentoo.org@lists.gentoo.org>)
	id 1QOGJ5-0002yb-EP
	for garchives@archives.gentoo.org; Sun, 22 May 2011 21:35:28 +0000
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id 8DD771C060;
	Sun, 22 May 2011 21:35:20 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
	by pigeon.gentoo.org (Postfix) with ESMTP id 148971C060
	for <gentoo-commits@lists.gentoo.org>; Sun, 22 May 2011 21:35:19 +0000 (UTC)
Received: from pelican.gentoo.org (unknown [66.219.59.40])
	(using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits))
	(No client certificate requested)
	by smtp.gentoo.org (Postfix) with ESMTPS id 213F11B4024
	for <gentoo-commits@lists.gentoo.org>; Sun, 22 May 2011 21:35:19 +0000 (UTC)
Received: from localhost.localdomain (localhost [127.0.0.1])
	by pelican.gentoo.org (Postfix) with ESMTP id 6D2FB80509
	for <gentoo-commits@lists.gentoo.org>; Sun, 22 May 2011 21:35:18 +0000 (UTC)
From: "Sven Vermeulen" <sven.vermeulen@siphos.be>
To: gentoo-commits@lists.gentoo.org
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" <sven.vermeulen@siphos.be>
Message-ID: <30fc4bb43b43456288c250ed48d13972c00f5055.SwifT@gentoo>
Subject: [gentoo-commits] proj/hardened-docs:master commit in: xml/
X-VCS-Repository: proj/hardened-docs
X-VCS-Files: xml/roadmap.xml
X-VCS-Directories: xml/
X-VCS-Committer: SwifT
X-VCS-Committer-Name: Sven Vermeulen
X-VCS-Revision: 30fc4bb43b43456288c250ed48d13972c00f5055
Date: Sun, 22 May 2011 21:35:18 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: quoted-printable
X-Archives-Salt: 
X-Archives-Hash: 17416f0590109ee7e0ed5b0acfdf3a90

commit:     30fc4bb43b43456288c250ed48d13972c00f5055
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sun May 22 21:34:25 2011 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sun May 22 21:34:25 2011 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=3Dproj/hardened-docs=
.git;a=3Dcommit;h=3D30fc4bb4

Improve roadmap (still wip)

---
 xml/roadmap.xml |  528 ++++++++++++++++++++++++++++++++++++++-----------=
------
 1 files changed, 364 insertions(+), 164 deletions(-)

diff --git a/xml/roadmap.xml b/xml/roadmap.xml
index e8a46d8..eab839e 100644
--- a/xml/roadmap.xml
+++ b/xml/roadmap.xml
@@ -1,7 +1,22 @@
 <?xml version=3D"1.0" encoding=3D"UTF-8"?>
 <!DOCTYPE guide SYSTEM "/dtd/guide.dtd">
=20
-<guide link=3D"roadmap.xml">
+<!--
+  TODO BEFORE REMOVING THE DISCLAIMER !!!
+
+  - Update document to use a generic structure (cfr until the "@HERE" si=
gn)
+  - Move support tables out of the document, make it a
+    'supported-architectures.xml' file or something like that. People wi=
ll
+    eventually ask if this or that is supported on their architecture, a=
nd then
+    that page is better suited than a roadmap page (with a roadmap page,=
 people
+    think it isn't supported).=20
+    Instead, in the roadmap, use something like 'Support currently unsup=
ported
+    architectures (mips, ppc64, ...)' -> Unassigned, and for each one th=
at is
+    progressing have a specific entry.
+  - Suggest changes to the document (make milestones benchmarkable, move=
 other
+    stuff as goals).
+-->
+<guide disclaimer=3D"draft" link=3D"roadmap.xml">
 <title>Hardened Gentoo Roadmap</title>
 <author title=3D"Author">
   <mail link=3D"tocharian@gentoo.org">Adam Mondl</mail>
@@ -46,28 +61,366 @@ Hardened Gentoo project.
 <date>2011-05-22</date>
=20
 <chapter>
-<title>Short-Term Goals</title>
+<title>Vision</title>
+<section>
+<body>
+
+<!--
+  What is the main vision that Gentoo Hardened strives towards?
+  Why does Gentoo Hardened exist? In light of which vision do we
+  take our decisions?
+-->
+
+<p>
+Within Gentoo Linux, the Gentoo Hardened project wants to be a shepherd =
for all
+security oriented projects. The project wants to make Gentoo viable for =
highly
+secure, high stability production environments.=20
+</p>
+
+</body>
+</section>
+</chapter>
+
+<chapter>
+<title>Strategy</title>
+<section>
+<title>Introduction</title>
+<body>
+
+<!--
+  Our strategy should reflect our high-level choices and focuses. It sho=
uld
+  describe what we aim for (in light of our vision) in a generic descrip=
tive
+  approach. The strategy of Gentoo Hardened should be what we envision t=
o be the
+  way to go forward to implement our vision. It should not change much i=
n time.
+-->
+
+<p>
+In order to succesfully strive towards our vision, Gentoo Hardened aims =
to
+provide subprojects that test, develop, enhance, implement and integrate=
=20
+specific security measures in Gentoo Linux. Although each of these proje=
cts has
+operational responsibilities (after all, the technologies that they supp=
ort are
+used by users all around) they continue to research and develop, making =
Gentoo
+Linux even better than it is today.
+</p>
+
+<p>
+The direction that each of these projects is heading towards is describe=
d in
+their <e>roadmap</e>, a combination of strategic directions and shorter =
term
+milestones. These roadmaps are combined in this very document, allowing =
users to
+get a general overview of where Gentoo Hardened is evolving towards.
+</p>
+
+</body>
+</section>
+<section>
+<title>Documentation</title>
+<body>
+
+<p>
+Documentation is Gentoo Hardened's first asset that users come in contac=
t with.
+It is important that Gentoo Hardened's documentation is well structured,=
 easily
+accessible and correctly written. Although we currently focus on technic=
ally
+educated users and system administrators, this focus should not lower ou=
r
+responsibility of creating the necessary documents to guide new users in=
 Gentoo
+Hardened's realms.
+</p>
+
+</body>
+</section>
+<section>
+<title>Vulnerability Mitigation</title>
+<body>
+
+<p>
+Users use a <e>toolchain</e>, a set of libraries and tools like compiler=
s,
+linkers and more, to build their systems with. To fight potential
+vulnerabilities and future exploits, Gentoo Hardened maintains a toolcha=
in that
+supports additional security-enhancing features like SSP, PIE and PIC.
+Our focus is to enhance and maintain this toolchain and help the integra=
tion of
+these security-enhancing patchsets within the upstream communities so th=
at the
+benefits are available for all Linux users.
+</p>
+
+<p>
+Yet toolchains are not the only method where risks can be reduced. Speci=
fic
+patch sets that enhance Linux' security-related capabilities exist, such=
 as
+PAX, that help users mitigate the risk of succesful exploitation of
+vulnerabilities. Gentoo Hardened positions and integrates these patches =
in the
+distribution.
+</p>
+
+</body>
+</section>
+<section>
+<title>Access Control</title>
+<body>
+
+<p>
+Although definitely not the only security component of a system, proper =
access
+control is a prerequisite for a safer environment. Within Gentoo Hardene=
d,
+support of proper access control systems is important, and reflected in =
our
+choices of enhanced development of SELinux, grSecurity RSBAC and more.
+</p>
+
+</body>
+</section>
+<section>
+<title>Architecture Support</title>
+<body>
+
+<p>
+The current primary development activities take place within the popular=
 and
+commodity architectures x86 and amd64 (x86_64). Yet many other architect=
ures
+exist, especially within the server and embedded/mobile environments. Th=
ese
+architectures need to be properly supported as well.
+</p>
+
+</body>
+</section>
+<section>
+<title>Staffing</title>
+<body>
+
+<p>
+In order to sustain or even grow our research and development pace and k=
eep
+supporting operational tasks and help out users, the Gentoo Hardened tea=
m is
+always looking for fresh blood. Users who take a proactive approach to f=
inding
+places for improvement and filling in the holes should and will be notic=
ed and
+probably recruited. Yet recruitment is not mandatory to help out our pro=
ject.=20
+The necessary resources are put in place to let contributors efficiently=
 help=20
+out the project.
+</p>
+
+</body>
+</section>
+</chapter>
+
+<chapter>
+<title>Documentation Goals and Milestones</title>
 <section>
-<title>Hardened Toolchain</title>
+<title>Current State</title>
 <body>
=20
 <p>
-Now is the time to take a step back and examine the work that has been d=
one so
-far. A review of the current approach that the hardened toolchain takes =
is
-needed. There may be ways to strengthen the current implementation or ar=
eas of
-code that can be cleaned up to allow changes to be pushed upstream easie=
r.
+The Gentoo Hardened project is currently lagging behind a bit on documen=
tation.
+Recent upstaffing and contributions have helped this out, but we still n=
eed to
+focus on the toolchain documentation (both toolchain-specific documentat=
ion
+as wel as documents that relate to the toolchain) such as SSP, PIE and P=
IC
+information.
 </p>
=20
 <p>
-As a side effect of the previous hardened toolchain, many ebuilds curren=
tly
-filter hardened CFLAGS such as -fPIE and -fstack-protector. Work will al=
so be
-dedicated to reviewing those packages and seeking alternate solutions fo=
r the
-filters.
+Also, comparative documents should be written to explain the choices tha=
t Gentoo
+Hardened has made, such as tool selection.
 </p>
=20
 </body>
 </section>
+<section>
+<title>Goals and Milestones</title>
+<body>
+
+<!--
+  TODO I just verbatimly copied it from the previous version. However, I=
 think
+  we should set goals (what to go for) and milestones (specific points t=
hat are
+  benchmarkable and - most likely - be strengthened by the availability =
of bug
+  reports)
+-->
+
+<table>
+<tr>
+  <th>Description</th>
+  <th>ETA</th>
+  <th>Status</th>
+  <th>Coordinator(s)</th>
+  <th>Related Bugs</th>
+</tr>
+<tr>
+  <ti>Document the Hardened Toolchain</ti>
+  <ti></ti>
+  <ti><keyword>In Progress</keyword></ti>
+  <ti>Zorry</ti>
+  <ti />
+</tr>
+<tr>
+  <ti>Comparative analysis of security approaches taken by distributions=
</ti>
+  <ti></ti>
+  <ti><comment>Unassigned</comment></ti>
+  <ti></ti>
+  <ti />
+</tr>
+<tr>
+  <ti>Rework grSecurity documentation</ti>
+  <ti></ti>
+  <ti><comment>Unassigned</comment></ti>
+  <ti></ti>
+  <ti />
+</tr>
+<tr>
+  <ti>Update/rewrite propolice documentation</ti>
+  <ti></ti>
+  <ti><comment>Unassigned</comment></ti>
+  <ti></ti>
+  <ti />
+</tr>
+</table>
+
+</body>
+</section>
+</chapter>
=20
+<chapter>
+<title>Hardened Toolchain Goals and Milestones</title>
+<section>
+<title>Current State</title>
+<body>
+
+<p>
+Our toolchain so far has seen a tremendous evolution. Some of the integr=
ated
+patches have been accepted upstream (like SSP), but work can still impro=
ve.
+To allow changes to be pushed upstream more easily, we might need improv=
ements
+on the ways to strengthen the current implementation, and work on the ar=
eas of
+code that need clean-up.
+</p>
+
+<p>
+Our next steps are to take a step backwards and examine the work that ha=
s been
+done so far. We need to improve our existing documents, but also review =
the
+packages available in the Portage tree and help out the package maintain=
ers in
+handling CFLAG filters for a hardened toolchain in a proper way.
+</p>
+
+</body>
+</section>
+<section>
+<title>Goals and Milestones</title>
+<body>
+
+<table>
+<tr>
+  <th>Description</th>
+  <th>ETA</th>
+  <th>Status</th>
+  <th>Coordinator(s)</th>
+  <th>Related Bugs</th>
+</tr>
+<tr>
+  <th colspan=3D"5">Improve and sustain support for multiple architectur=
es</th>
+</tr>
+<tr>
+  <ti>x86 support</ti>
+  <ti />
+  <ti><keyword>In place</keyword></ti>
+  <ti>Zorry</ti>
+  <ti />
+</tr>
+<tr>
+  <ti>amd64 (x86_64) support</ti>
+  <ti />
+  <ti><keyword>In place</keyword></ti>
+  <ti>Zorry</ti>
+  <ti />
+</tr>
+<tr>
+  <ti>sparc32 support</ti>
+  <ti />
+  <ti><comment>Unassigned</comment></ti>
+  <ti />
+  <ti />
+</tr>
+<tr>
+  <ti>sparc64 support</ti>
+  <ti />
+  <ti><comment>Unassigned</comment></ti>
+  <ti />
+  <ti />
+</tr>
+<tr>
+  <ti>ppc support</ti>
+  <ti />
+  <ti><keyword>In place</keyword></ti>
+  <ti>nixnut, Zorry, blueness</ti>
+  <ti />
+</tr>
+<tr>
+  <ti>ppc64 support</ti>
+  <ti />
+  <ti><keyword>In place</keyword></ti>
+  <ti>blueness</ti>
+  <ti />
+</tr>
+<tr>
+  <ti>s390 support</ti>
+  <ti />
+  <ti><comment>Unassigned</comment></ti>
+  <ti />
+  <ti />
+</tr>
+<tr>
+  <ti>hppa support</ti>
+  <ti />
+  <ti><comment>Unassigned</comment></ti>
+  <ti />
+  <ti />
+</tr>
+<tr>
+  <ti>arm support</ti>
+  <ti />
+  <ti><var>In progress</var></ti>
+  <ti>blueness</ti>
+  <ti />
+</tr>
+<tr>
+  <ti>mips support</ti>
+  <ti />
+  <ti><var>In progress</var></ti>
+  <ti>blueness</ti>
+  <ti />
+</tr>
+<tr>
+  <ti>ia64 support</ti>
+  <ti />
+  <ti><keyword>In place</keyword></ti>
+  <ti>Zorry, blueness</ti>
+  <ti />
+</tr>
+<tr>
+  <th colspan=3D"5">Enhance documentation</th>
+</tr>
+<tr>
+  <ti>Document the toolchain feature set</ti>
+  <ti />
+  <ti><var>In progress</var></ti>
+  <ti />
+  <ti />
+</tr>
+<tr>
+  <ti>Describe the grSecurity RBAC system</ti>
+  <ti />
+  <ti><comment>Unassigned</comment></ti>
+  <ti />
+  <ti />
+</tr>
+<tr>
+  <th colspan=3D"5">Kernel development and maintenance</th>
+</tr>
+<tr>
+  <ti>Release hardened-sources-2.6.37</ti>
+  <ti />
+  <ti><keyword>Done</keyword></ti>
+  <ti>blueness</ti>
+  <ti />
+</tr>
+</table>
+
+<!-- @HERE -->
+
+</body>
+</section>
+</chapter>
+
+<chapter>
+<title>Short-Term Goals</title>
 <section>
 <title>Access Control Systems</title>
 <body>
@@ -132,115 +485,8 @@ contact us.
 </chapter>
=20
 <chapter>
-<title>Long-Term Goals</title>
-<section>
-<title>Documentation</title>
-<body>
-
-<p>
-The Hardened Gentoo Project is currently very lacking in documentation. =
The
-hardened toolchain needs to be documented fully, and older documents tha=
t have a
-relationship to the  toolchain need to be updated, such as the SSP, PIE,=
 and PIC
-documents. Also, comparative documents should be written to explain the =
choices
-that Hardened Gentoo has made in deciding which security tools to suppor=
t and
-which not to support.
-</p>
-
-</body>
-</section>
-
-<section>
-<title>Support More Architectures</title>
-<body>
-
-<p>
-A long-term goal of the Hardened Gentoo Project is to support all of the
-architectures that are officially supported by Gentoo. The only strong s=
upport
-that exists at the moment is for  x86 and amd64.
-</p>
-
-<p>
-The hardened toolchain supports x86, amd64, ppc, ppc64, arm, ia64 and wo=
uld like
-to extend support to sparc and similar architectures. With access to dif=
ferent
-kinds of hardware,  hardened support can slowly be extended to those
-architectures as well.
-</p>
-
-</body>
-</section>
-
-<section>
-<title>Expand the Hardened Team</title>
-<body>
-
-<p>
-There will always be unfinished tasks for the Hardened Team. Users who t=
ake a
-proactive approach to finding places for improvement and filling in the =
holes
-will be noticed and probably recruited. Current Hardened Team members wi=
ll be
-responsible for training new developers to fill new roles. If you are in=
terested
-in helping out, stop by the IRC channel and let someone know what you ar=
e
-interested in and what you will be doing about it.
-</p>
-
-<p>
-Input/peer review should always be welcome as it helps everyone out in t=
he long
-run.
-</p>
-
-
-</body>
-</section>
-</chapter>
-
-<chapter>
 <title>Roadmap Tracking</title>
 <section>
-<title>Hardened Toolchain</title>
-<body>
-
-<table>
-  <tr>
-    <th>Description</th><th>Coordinator(s)</th><th>Status</th>
-  </tr>
-  <tr>
-    <ti>x86 Support</ti><ti>zorry</ti><ti>Complete</ti>
-  </tr>
-  <tr>
-    <ti>amd64 Support</ti><ti>zorry</ti><ti>Complete</ti>
-  </tr>
-  <tr>
-    <ti>sparc32 Support</ti><ti></ti><ti>Unassigned</ti>
-  </tr>
-  <tr>
-    <ti>sparc64 Support</ti><ti></ti><ti>Unassigned</ti>
-  </tr>
-  <tr>
-    <ti>ppc Support</ti><ti>nixnut,zorry,blueness</ti><ti>Complete</ti>
-  </tr>
-  <tr>
-    <ti>ppc64 Support</ti><ti>blueness</ti><ti>Complete</ti>
-  </tr>
-  <tr>
-    <ti>s390 Support</ti><ti></ti><ti>Unassigned</ti>
-  </tr>
-  <tr>
-    <ti>hppa Support</ti><ti></ti><ti>Not supported</ti>
-  </tr>
-  <tr>
-    <ti>arm Support</ti><ti>blueness</ti><ti>In progress</ti>
-  </tr>
-  <tr>
-    <ti>mips Support</ti><ti>blueness</ti><ti>In progress</ti>
-  </tr>
-  <tr>
-    <ti>ia64 Support</ti><ti>zorry,blueness</ti><ti>Complete</ti>
-  </tr>
-</table>
-
-</body>
-</section>
-
-<section>
 <title>Hardened GCC</title>
 <body>
=20
@@ -266,27 +512,6 @@ run.
 </section>
=20
 <section>
-<title>Hardened Toolchain</title>
-<body>
-
-<table>
-  <tr>
-    <th>Description</th><th>Coordinator(s)</th><th>Status</th>
-  </tr>
-  <tr>
-    <ti>Document the feature set</ti><ti>none</ti><ti>In Progress</ti>
-  </tr>
-  <tr>
-    <ti>Describe the RBAC system</ti><ti>none</ti><ti>Unassigned</ti>
-  </tr>
-  <tr>
-    <ti>Release hardened-sources-2.6.37</ti><ti>blueness</ti><ti>Complet=
e</ti>
-  </tr>
-</table>
-
-</body>
-</section>
-<section>
 <title>Hardened Sources</title>
 <body>
=20
@@ -383,31 +608,6 @@ run.
 </body>
 </section>
=20
-<section>
-<title>Documentation</title>
-<body>
-
-<table>
-  <tr>
-    <th>Description</th><th>Coordinator(s)</th><th>Status</th>
-  </tr>
-  <tr>
-    <ti>Comparative analysis of security approaches taken by distributio=
ns.</ti>
-    <ti></ti><ti>Unassigned</ti>
-  </tr>
-  <tr>
-    <ti>Rework Grsecurity Documentation</ti><ti></ti><ti>Unassigned</ti>
-  </tr>
-  <tr>
-    <ti>Update/Rewrite Propolice Documentation</ti><ti></ti><ti>Unassign=
ed</ti>
-  </tr>
-  <tr>
-    <ti>Document the Hardened Toolchain</ti><ti>zorry</ti><ti>In Progres=
s</ti>
-  </tr>
-</table>
-
-</body>
-</section>
 </chapter>
=20
 </guide>