Re: [gentoo-hardened] Updates: a way too simplified security question I am asking anyway

[RB <aoz.syn@gmail.com>]

> Complexity matter again... Theoretically.. is it possible to enumerate all the
> possible scenarios for a file server? (or, I might have wrote - all of its
> states) Oh, sure, it has finite amount of memory :)

Those firmly on the "Threat modeling" side of the camp say you can.
The key is limiting your system's scope and using a positive
(default-deny) security model.  It's resource-intensive for the
implementer on the front end and inflexible, but can work for some
scenarios.

> I started this as a "flame", but the rest might go out of scope of this list
> and send me to theoretical computer science.

In spite of my CS degree (and probable pursuit of an advanced degree),
I don't esteem academia very highly.  Theory makes for pretty graphs
on thesis papers, but real-world application is the only way anything
will actually be solved.

> Javier Martínez:
> "control the execution of perl an python (between
> others) scripts (in the way of perl blablabla.pl, which does not need
> execution rights). You under this two frameworks you can do it. Can
> you do this under OpenBSD ;)"
>
> Thanks, just you put me on my way, if I really need a reliable system, that I
> can get NOW AND HERE :)

Yes - good, actionable suggestions.  Of course, the threat modeling
crew makes a good argument that anything beyond a MAC (selinux, RSBAC,
etc.) is wasted effort.  That, of course, assumes you've perfectly
succeeded in least-privilege.