From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id E9C841381F3 for ; Sat, 7 Sep 2013 06:36:36 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 1CAF8E0B3A; Sat, 7 Sep 2013 06:36:32 +0000 (UTC) Received: from mail-wg0-f47.google.com (mail-wg0-f47.google.com [74.125.82.47]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 2ABAFE0B2A for ; Sat, 7 Sep 2013 06:36:30 +0000 (UTC) Received: by mail-wg0-f47.google.com with SMTP id f12so3607642wgh.26 for ; Fri, 06 Sep 2013 23:36:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=P2dsLvGe6AH1ElvMfMi8w+DUPZ+2yIaW+waMBsyMxZY=; b=KFBtTfhQIUAQPXluHH4Y3bHDi0idDOvA1r2VGupmyN5WKAdQSmRuqvwDMsKhtpyO0o Xh0QocJVCSyrUZLKOTra5WLXmtBXqdrEScT6MY6piOV5ANNhXDxrEs8FhPRegZZQS698 rCllDNOhl6XUKo8B/XtUmXdvZEIvQEdqJEUu35Vh25TDvI5IOrieJuefR4HQtahUSKZ9 IH2d0efYmYScOYSTlWuRMA24AmLn8s/De0wkylnU/9Q8lt3TJqvUTlF9t2BTIP3qoFXy 4NMmKVLekpNO0otuEXoXxsFhHLA5Cylna/QvSJ5q4ycG/NKmfN1mppCO+S74Pqcuhlnc Afmw== Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 X-Received: by 10.180.198.115 with SMTP id jb19mr1175835wic.28.1378535789565; Fri, 06 Sep 2013 23:36:29 -0700 (PDT) Received: by 10.194.47.235 with HTTP; Fri, 6 Sep 2013 23:36:29 -0700 (PDT) In-Reply-To: <522AA218.8000005@gentoo.org> References: <2258190.ks74ypJstN@devil> <201309050706.13467.vapier@gentoo.org> <522AA218.8000005@gentoo.org> Date: Sat, 7 Sep 2013 06:36:29 +0000 Message-ID: Subject: Re: [gentoo-dev] Re: Improve the security of the default profile From: Parker Schmitt To: gentoo-dev@lists.gentoo.org Content-Type: multipart/alternative; boundary=047d7b624e7e0c1c5104e5c56085 X-Archives-Salt: 1c17b519-0622-4235-ad31-f90da6fe357f X-Archives-Hash: b1ea358b2f5903bac9128725badf72cb --047d7b624e7e0c1c5104e5c56085 Content-Type: text/plain; charset=ISO-8859-1 Perhaps a hardened desktop profile might be nice. Possibly even an selinux profile with the popular WMs. From what I remember users of the server profile are given a warning to switch to hardened though it would be nice to add hardened options to other "specialized" profiles. On Sat, Sep 7, 2013 at 3:48 AM, Rick "Zero_Chaos" Farina < zerochaos@gentoo.org> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 09/05/2013 07:06 AM, Mike Frysinger wrote: > > On Thursday 05 September 2013 06:13:28 Agostino Sarubbo wrote: > >> during an irc debate, me and other people just noticed that the default > >> profile could use more flags to enhance the security. > >> > >> An hint is here: > >> https://wiki.ubuntu.com/ToolChain/CompilerFlags > >> > >> Please argue about what we _don't_ use. > > > > the only thing we don't use by default is SSP. and we have hardened for > that. > > > > fairly certain the other flags we've been using in Gentoo for years. > > -mike > > > > Since I don't see this in the profile and I know almost nothing about > how the toolchain works, perhaps you could grace us with how to see the > fact that "we've been using in Gentoo for years" :-) > > Thanks, > Zero > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.20 (GNU/Linux) > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ > > iQIcBAEBAgAGBQJSKqIYAAoJEKXdFCfdEflKCwkP/Rdlo2rk+g8qyfB9SlsFgoP0 > 4b+/qkB8WmwNBEURhR7kwF/SJa6kh0BOcorz33e/YO4jayn/yW1ve36HrKOGR52G > 56oNWWtRYzsiscObpOVxf+JM9EMm2RVrhfM1Z9FIP8pTFS8gj31fR8caPJssjUGv > xl0wSUahs1+q44xOX+NB+7y47nhrjwfq2OTUHsekMdOWt43MoLp86qEMJKlPFG9a > djEpkshTpE2pZZMQ8jGGASmITcWlHhuipeWkwDCblcxMMCWgFr+CfovEqJXeoz5I > jI4rtpe4QNl7QA+eXY1fygiAiVgx15BYq2SIBC51AluvVgaYRw8ANr8qSUhCakXM > Af49vhzp8/Id3/aytOrllprucPHTICMARKbYhAJyGtfJtKkQ3iGHHOlrIN2ufnrO > gO/EZUqb+NRlHrv845a0HQA3zmYDNBJw5zu6GymV4aMsUcVQE/uSbqAZ7BxuWlV2 > LxLvE9pn48WvcvBYp4R36DRQg955D34GKI1VRojgESsyLIgq4Q0wLjarY1fsG4O/ > iUZRyXOI5erVCiOGey42kCr19fw1ta35XtKrEQPwWJkb2na1RB7PHbGBdVBlU/Lq > mLAWFSCwocg+wNBuBWcpJlFdLV4eQYxSqyTqeFdxYBv9qxvqqLzkGUxqDy8L4bAT > KglCdavI5Y2UBcFuv4/w > =yb4E > -----END PGP SIGNATURE----- > > --047d7b624e7e0c1c5104e5c56085 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Perhaps a hardened desktop profile might be nice. Possibly= even an selinux profile with the popular WMs. From what I remember users o= f the server profile are given a warning to switch to hardened though it wo= uld be nice to add hardened options to other "specialized" profil= es.


On Sat,= Sep 7, 2013 at 3:48 AM, Rick "Zero_Chaos" Farina <zerochaos@= gentoo.org> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/05/2013 07:06 AM, Mike Frysinger wrote:
> On Thursday 05 September 2013 06:13:28 Agostino Sarubbo wrote:
>> during an irc debate, me and other people just noticed that the de= fault
>> profile could use more flags to enhance the security.
>>
>> An hint is here:
>> https://wiki.ubuntu.com/ToolChain/CompilerFlags
>>
>> Please argue about what we _don't_ use.
>
> the only thing we don't use by default is SSP. =A0and we have hard= ened for that.
>
> fairly certain the other flags we've been using in Gentoo for year= s.
> -mike
>

Since I don't see this in the profile and I know almost not= hing about
how the toolchain works, perhaps you could grace us with how to see the
fact that "we've been using in Gentoo for years" :-)

Thanks,
Zero
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.20 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJSKqIYAAoJEKXdFCfdEflKCwkP/Rdlo2rk+g8qyfB9SlsFgoP0
4b+/qkB8WmwNBEURhR7kwF/SJa6kh0BOcorz33e/YO4jayn/yW1ve36HrKOGR52G
56oNWWtRYzsiscObpOVxf+JM9EMm2RVrhfM1Z9FIP8pTFS8gj31fR8caPJssjUGv
xl0wSUahs1+q44xOX+NB+7y47nhrjwfq2OTUHsekMdOWt43MoLp86qEMJKlPFG9a
djEpkshTpE2pZZMQ8jGGASmITcWlHhuipeWkwDCblcxMMCWgFr+CfovEqJXeoz5I
jI4rtpe4QNl7QA+eXY1fygiAiVgx15BYq2SIBC51AluvVgaYRw8ANr8qSUhCakXM
Af49vhzp8/Id3/aytOrllprucPHTICMARKbYhAJyGtfJtKkQ3iGHHOlrIN2ufnrO
gO/EZUqb+NRlHrv845a0HQA3zmYDNBJw5zu6GymV4aMsUcVQE/uSbqAZ7BxuWlV2
LxLvE9pn48WvcvBYp4R36DRQg955D34GKI1VRojgESsyLIgq4Q0wLjarY1fsG4O/
iUZRyXOI5erVCiOGey42kCr19fw1ta35XtKrEQPwWJkb2na1RB7PHbGBdVBlU/Lq
mLAWFSCwocg+wNBuBWcpJlFdLV4eQYxSqyTqeFdxYBv9qxvqqLzkGUxqDy8L4bAT
KglCdavI5Y2UBcFuv4/w
=3Dyb4E
-----END PGP SIGNATURE-----


--047d7b624e7e0c1c5104e5c56085--