[22:03:57] 1.0 Toolchain [22:04:24] gcc 4.8.1 will be out sone [22:04:54] haven't done any thing with it from the last meeting [22:05:21] some not much from me [22:05:29] blueness: do you have any thing? [22:05:53] just that i'm still maintaining the uclibc hardened stuff [22:05:54] does 4.8.1 fix the plugin header install problem? [22:06:04] most of that is automated now through catalyst [22:06:08] and it just runs [22:06:27] oh hi pipacs ltns [22:06:36] pipacs: haven't seen any respons in the upstream bug [22:06:44] i've been hitting a lot of multilib bugs with uclibc, but they are not hardened specific [22:06:50] other than that nothing much more [22:07:04] pipacs: patch is pasted on the gcc-patch ml and on the bug [22:07:20] yeah i know but didn't see any comments on the bug since [22:07:28] i thought they just fixed it since it's trivial [22:07:40] will gentoo include the fix at least? [22:07:44] blueness: you know SpanKY wrote the amd64 support for uclibc. I doubt he was trying to make it multilib aware [22:07:49] 'cos it's a deal breaker for the pax plugins [22:08:29] yep and some more gcc-plugin did depend on it [22:08:42] solar, no no that's not what i mean [22:08:52] uclibc is *not* multilib aware [22:09:04] any one else? [22:09:13] so as a result a lot of packages that assume certain false things about multilib fails [22:09:35] Zorry: so the (trivial) fix for the plugin header install is available in gentoo's releaes? [22:09:36] eg. audio-jack-kit always installs in /usr/lib64 when it should install in /usr/lib [22:09:42] solar, ^^ [22:10:01] SwifT: the fix is included in the gentoo gcc patchset [22:10:06] Zorry: k [22:10:18] i'm done [22:10:46] next then? [22:10:55] yes [22:11:10] 2.0 Kernel and Grsec/PaX [22:11:21] okay [22:11:38] first about the xattr_pax migration, i've been too busy the past month to finish that [22:12:21] what remains to be done is 1) xattr copying in install for packages that do pax markings before src_install() and 2) xattr user.pax namespace patch for gentoo-soruces [22:12:52] this will silence errors for non-hardened users and fix the loss of xattr markings for those packages that do pax-mark before install [22:12:59] i know what to do, i just have not had the time to do it [22:13:09] then document it and see what else might fail [22:13:36] finally, i will test on both hardened and vanilla systems if PAX_MARKINGS="XT" causes issues and if not, i will turn it back on again [22:13:54] any questions/concerns with that before moving to my next point? [22:14:25] can we add a pax-mark bash script? [22:14:48] so we can use that when stuff is hardcoded in compile [22:14:51] Zorry, to elfix? sure but i'm still not sure how it would be used, you mean like an eblit? [22:15:12] so you can call on it during ebuild's test phase? [22:15:15] blueness: call that insted of paxctl/paxctl-ng [22:15:45] Zorry, the reason i'm confused is because that's done in the eclass [22:15:57] so under what circumstances do you need a separate bash script? [22:16:00] for now most ebuild that have hardcoded calls to paxctl [22:16:14] java/mono ... [22:16:14] Zorry, they should not [22:16:39] anybody know what provides mkinitrd these days? [22:16:41] okay so instead of ebuils directly calling paxctl you want the bash script called, i can do that [22:17:09] blueness: is not the ebuild that call it is the make script [22:17:29] oh i see [22:17:47] hmmm ... that's a bit harder, show me after a good example and i'll see what i can do [22:17:51] java&mono need to pax mark it selve to compile the rest [22:18:02] sheesh [22:18:04] okay [22:18:29] we can talk about afer the meeting [22:18:58] blueness: go on [22:19:20] Zorry, yes if you show me an ebuild where we have an issue i'll fix it and add the stuff to elfix [22:19:30] blueness, bug 467238 [22:19:48] okay ... next quick point about hardened-sources and what versions are stabilized [22:20:18] so there was a secrurity issue with socks_diag code, and i had to rapid stabilize the versions you see in the topic [22:20:39] but now Azoff tells me he's having issues with the nfsd code and that 3.2.44 (and that set) fix it [22:20:59] so i will need to stabilize another round ... hopefully there are no issues with that [22:21:09] but with the kernel, there is always a bug somewhere :( [22:21:22] just to let people know that in the next few days i'll be doing that [22:21:33] 0kay i'm done with kernel & grsec/pax [22:21:55] pipacs: any thing ? [22:22:13] else next [22:22:25] 3.0 Selinux [22:22:43] SwifT: [22:23:03] more recent policycoreutils packages now contain a command "selocal" that allows users to simply enhance the local policy, without them needing to create their own modules to manage [22:23:20] the script is a simple wrapper on top of the commands to do so, but might help, especially in resolving bugs [22:23:41] I can just ask a user to "selocal -a -c "bug 12345" -Lb" and the statement is activated [22:24:15] setools also had an old bug related to swig-1 [22:24:27] so i'm happy to say swig-1 is now slotted and setools uses the slotted version [22:24:33] no more dependency breakage (hopefully) [22:24:36] :) [22:25:00] end of april, new userland utilities were released as well as new policy set; both are in the tree already, ~arch'ed [22:25:31] the userland utilities had some stupid bugs in them, i've sent the paches upstream but there's not that much movement on it yet (but ok, it's only been a few weeks) [22:25:49] i was also quite stupid to test the new userspace on a vm... that didn't have the new userspace [22:26:04] but the versions in the tree now should work out fine [22:26:34] finally, the policy ebuilds have been enhanced with epatch_user so that users (feandil and/or amade were asking for it) can do quick patching/testing as well [22:26:48] that's it for selinux from me [22:27:14] any one else? [22:27:23] i have a question [22:27:41] SwifT, now that tar has xattr support, it should be possible to build a stage3-...-selinux [22:27:51] have you looked into that? [22:28:04] you'd think right? jmbsvicetto looked into that, but its a hornets nest [22:28:06] it could be added as a hook at the end of the stage3 catalyst code [22:28:21] SwifT, can you give me the jist of it? [22:28:31] ie why its a hornets nest? [22:28:55] the problem is that the file context setting during chroots doesn't work out well, and that selinux-aware apps are failing to find proper feedback from the selinux security server [22:28:55] it would seem all you have to do is automate the installation of selinux as per the selinux-handbook [22:29:32] i think jmbsvicetto first needed to get a seed that already was selinux-enabled, but i'm not sure if he got through with it [22:29:53] building selinux stages is still on the horizon though, i'm just not sure when [22:30:34] SwifT, would this work for you ... write a bash script which takes a stage3, unpacks it, selinux-ifies it, repacks it [22:30:55] so its not exactly the flow one has with catalyst, but an add-on at the end [22:31:12] it might "dirty" the stage3, but it might do the trick [22:31:57] I tried just adding all the files of the packages that should be in a stage3 in a tarball from my system (which is SELinux-enabled), but that then failed because of the context issue... perhaps that might now work with xattr-enabled tar [22:32:27] selinux-ifying still means rebuilding a lot of code, so I think copying it for a seed is faster [22:32:54] SwifT, i know it means rebuidling but it has a better chance of working [22:33:03] but if someone has a good tutorial on how to use catalyst to create the proper stages... I went with a script that vapier (i think) has online [22:33:05] okay let's move on .... [22:33:15] 4.0 System Integrity [22:33:50] SwifT: [22:34:06] not much to say... the patches accepted by the ima team haven't made it to the main kernel yet, so we currently only support "default" IMA/EVM setups [22:34:23] as long as those patches aren't in, we can't use custom policies and need to run with EVM=fix mode [22:34:41] but that's just a matter of time, there was noone disagreeing with the patch [22:34:59] SwifT / blueness: I did create a stage3 seed [22:35:20] that's all for integrity for now [22:35:34] (given a userspace release of selinux and new policies, that was the major work the last month :p [22:35:38] http://www.jmbsvicetto.name/stage3-hardened-selinux-20130420.tar.xz [22:36:08] SwifT / blueness: we can talk later, but stage1 was failing to build [22:36:09] next [22:36:32] 5.0 Profiles [22:36:48] jmbsvicetto, k later [22:36:59] Zorry, shall i mention the problem with no-multi? [22:37:06] have fixed two no-multilib bugs [22:37:14] so there is an issue with hardened/amd64/no-multilib [22:37:15] in the profile [22:37:43] the 1 one was a qa and that is fixed [22:38:34] because of the awkward profile stacking, hardened/amd64/nomutlilib does not inherit from arch/amd64/no-multilib [22:38:40] 2 is a mess we miss to include on profile but with that included we get a lot of dups profiles in the profiles [22:38:50] as a result we are missig some maskings [22:39:00] so i mirror the needed changes [22:39:18] i think so too, mirror those maskings [22:39:35] i was going to do that after the meeting if everyone is in agreement with the mirroring [22:39:37] will wait for the real fix in the real no-multilib profile [22:39:42] because changing the stack is uncontrolable [22:39:57] Zorry, so you think wait? [22:40:14] to include the profile [22:40:38] i mirror the change now [22:41:04] Zorry, oh you did it already? [22:41:11] yep [22:41:14] okay [22:41:19] did you test? [22:41:34] nope but is was trevel changes [22:41:36] i guess i'll find out in a bit since all my severs are amd64/no-multilib :) [22:41:45] yeah they were just maskings [22:41:50] for the emu* stuff [22:41:54] yep [22:42:13] and some stuff for the new emu* stuff [22:42:15] Zorry, actually i did mirroring too for uclibc [22:42:35] it was easier then trying to control the stack [22:43:01] yep [22:43:02] Zorry, when did you mirror because i'm not seeing it yet? did you do it todya? [22:43:33] 1h ago type [22:43:44] ah okay that explains it [22:44:25] and i have added a ChangeLog in the hardened profile so we don't need to do it on the main changelog [22:44:28] also i will remove the experimental hardened/linux/13.0 directory since all hardened profiles are now 13.0 [22:44:34] that's just clean up [22:44:42] i wanted to wait a month after deprecating [22:45:00] no more from me on profiles [22:45:12] any one else? [22:45:42] noep [22:45:52] next [22:45:56] 6.0 Docs [22:46:36] SwifT: klondike any thing? [22:46:49] two things; the updates in selinux have been added to the selinux handbook as well [22:47:07] and i'm slowly but surely writing a set of "tutorials" for users who want to learn selinux on the gentoo wiki [22:47:20] the Grsecruity 2.0 doc is way out of date, i should probably fix that [22:47:23] https://wiki.gentoo.org/wiki/SELinux/Tutorials for those interested [22:48:39] next ? [22:48:49] 7.0 Bugs [22:49:09] any one? [22:49:25] nothing major from me [22:50:32] on the libffi thing i still wait for upstream [22:50:49] else i don't have any thing [22:51:00] 8.0 Media [22:51:06] klondike: ? [22:51:33] he mentioned on twitter he'll be late... probably too late apparently [22:51:43] looks that way [22:51:54] next then? [22:52:04] 9,0 Open floor [22:52:22] any thing else meeting is done [22:52:42] ty all for the meeting [22:52:50] ty all for the work!