Re: [gentoo-hardened] Which profile?

[Ned Ludd <solar@gentoo.org>]

On Tue, 2009-02-10 at 19:17 +0100, Thomas Sachau wrote:
> Cyprien Nicolas schrieb:
> > 2009/2/10 Matthew Summers <msummers42@gmail.com>:
> >> On Tue, Feb 10, 2009 at 4:04 AM, Tom Hendrikx <tom@whyscream.net> wrote:
> >>> Clemente Aguiar schreef:
> >>>> I understand that the profiles where updated recently (last year?).
> >>>>
> >>>> Available profile symlink targets:
> >>>>   [1]   hardened/amd64 *
> >>>>   [2]   hardened/amd64/multilib
> >>>>   [3]   selinux/2007.0/amd64
> >>>>   [4]   selinux/2007.0/amd64/hardened
> >>>>   [5]   default/linux/amd64/2008.0
> >>>>   [6]   default/linux/amd64/2008.0/desktop
> >>>>   [7]   default/linux/amd64/2008.0/developer
> >>>>   [8]   default/linux/amd64/2008.0/no-multilib
> >>>>   [9]   default/linux/amd64/2008.0/server
> >>>>   [10]  hardened/linux/amd64
> >>>>
> >>>> Available profile symlink targets:
> >>>>   [1]   hardened/x86/2.6 *
> >>>>   [2]   selinux/2007.0/x86
> >>>>   [3]   selinux/2007.0/x86/hardened
> >>>>   [4]   default/linux/x86/2008.0
> >>>>   [5]   default/linux/x86/2008.0/desktop
> >>>>   [6]   default/linux/x86/2008.0/developer
> >>>>   [7]   default/linux/x86/2008.0/server
> >>>>   [8]   hardened/linux/x86
> >>>>
> >>>>
> >>>> I would like to know what hardened profile I should use when I build new
> >>>> machines? (AMD64 as well as x86)
> >>>>
> >>>> Thanks.
> >>>>
> >>>>
> >>>>
> >>> A few days ago I switched an x86 machine from "default/linux/x86/2008.0"
> >>> to "hardened/linux/x86/2008.0/server" after some arbitrary rummaging in
> >>> the profiles directory. This gave me no problems other than the expected
> >>> gcc-4 -> gcc-3 downgrade.
> >>>
> >>> I'm not sure why this profile isn't listed in the eselect profile
> >>> listing above. It doesn't give me a big fat "unsupported profile"
> >>> warning though...
> >>>
> >>> Regards,
> >>>        Tom
> >>>
> >>
> >> This is a confusing situation.  I am currently using
> >> /usr/portage/profiles/hardened/linux/amd64/2008.0.
> >>
> >> This is not explicitly listed in the output of 'eselect profile list'.
> >>
> >> Perhaps we could sort this out on the list & then I will write a quick doc
> >> to place in the hardened web space to assist other users.
> >>
> >> --
> >> M. Summers
> >>
> >> "...there are no rules here -- we're trying to accomplish something."
> >>  - Thomas A. Edison
> >>
> > 
> > On #gentooo-hardened, I got this answer :
> > 
> > Feb 04 20:10:51 <Tommy[D]>      Anyone can say, which profile of the 2
> > hardened ones are supported here?
> > Feb 04 20:12:01 <gengor>        Tommy[D]: use hardened/${ARCH}/2.6
> > 
> > But it was not listed by Clemente for amd64
> > 
> > --
> > Cyprien
> > 
> > 
> 
> So he should use either /hardened/amd64 or /hardened/amd64/multilib. If i rememember it right, the
> other profile (/hardened/linux/* ) is not under control by the hardened team and because of that not
> supported.

Correct.

amd64 #1 or #2 (suggested #2)
x86   #1


-- 
Ned Ludd <solar@gentoo.org>
Gentoo Linux