From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1LFt6N-0000Q4-La for garchives@archives.gentoo.org; Thu, 25 Dec 2008 16:30:23 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 1FF2AE02AB; Thu, 25 Dec 2008 16:30:22 +0000 (UTC) Received: from fk-out-0910.google.com (fk-out-0910.google.com [209.85.128.191]) by pigeon.gentoo.org (Postfix) with ESMTP id B6B78E02AB for ; Thu, 25 Dec 2008 16:30:21 +0000 (UTC) Received: by fk-out-0910.google.com with SMTP id 18so1754638fks.2 for ; Thu, 25 Dec 2008 08:30:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=CYw/L13yk4jLcvuP+LZxcfR8mY3uz4TdSyqfsq64eiI=; b=Jq2X3KTtN7Ffk6C1KsE/eRIcQNAhjjMfk21IBNSrEdWbEhhwZHCYotSa4NL5razDLk hHUaBeRtNmjZ8UMAKh3K8O5MeazhYIOKwfSoltrF557SKEzbi1ph13tupK22TPizGKIO FxoAihi2JC7FVYcBgIE8rNb8I51phihtIxRnc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=v0uCiwFOi1pA0LzWZLJs5RjHO8i8m1b3N2j9hBrmOO1+sxPRKoaWBwxPibn41/G2gM 2YPngSnKreIpQ/pGZAU91QD55sNwSGbd4UrsUPk4l02h6WlktufiId3kUN5kcpyzVHqG B/kCcq6cBC1oqNKmMKc1xCcIoCm0eFLFkD16g= Received: by 10.103.175.8 with SMTP id c8mr3536993mup.117.1230222621022; Thu, 25 Dec 2008 08:30:21 -0800 (PST) Received: by 10.103.214.9 with HTTP; Thu, 25 Dec 2008 08:30:20 -0800 (PST) Message-ID: <897813410812250830i2f910883n62b426dbe5a0329a@mail.gmail.com> Date: Thu, 25 Dec 2008 17:30:20 +0100 From: "=?ISO-8859-1?Q?Javier_J._Mart=EDnez_Cabez=F3n?=" To: gentoo-hardened@lists.gentoo.org Subject: Re: [gentoo-hardened] Profile switch: hardened to non-hardened? In-Reply-To: <49bf44f10812250712u35f87d71l750fd67f97204dad@mail.gmail.com> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-hardened@lists.gentoo.org Reply-to: gentoo-hardened@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <49bf44f10812231323t7b5371eaj6a082f56f17b01e0@mail.gmail.com> <49515B9F.4030006@moremagic.com> <49bf44f10812240903r5de4963blb6c9c4e295adf7f7@mail.gmail.com> <200812241621.13188.gengor@gentoo.org> <49bf44f10812250712u35f87d71l750fd67f97204dad@mail.gmail.com> X-Archives-Salt: 1f69c399-c116-4e48-bd25-0269b2b455b6 X-Archives-Hash: af698b7778d218dfecdea194e099155d In terms of userland, non hardened profile doesn't protect you at all against buffer overflows, you are removing one important security layer. SSP protects you against buffer overflows in terms that the vulnerable application gets killed when the canary is modified before the execution of the arbitrary code. PIE protects you against return into libc attacks that doesn't need an executable stack. PaX is not perfect and needs them as complementary solutions. For example I think that RANDEXEC was removed from PaX time ago, one buffer overflow that uses return into libc attack could be succesfully against one non-hardened binary. Since skype is a network oriented software... 2008/12/25 Grant : >> Hardened profiles: Yes there's a difference, no you should not switch to >> hardened/linux/${ARCH} at this time. > > Is hardened/x86/2.6 still available for new installations? My other > systems are amd64 but none of them list hardened/amd64/2.6. > >> You can get skype working by downloading or building gcc 4.1.x and pointing >> LD_LIBRARY_PATH at the shared object directory when starting skype. skype >> won't be using hardened toolchain but since its closed source and you're >> willing to switch the whole machine to non-hardened I figure you probably >> don't mind. ;) >> >> Example: >> 1. Download >> http://tinderbox.dev.gentoo.org/default-linux/x86/sys-devel/gcc-4.1.2.tbz2 >> 2. unpack the archive to ${HOME}/tinderbox-pkgs/sys-devel/gcc/ >> 3. Run it: >> LD_LIBRARY_PATH="${HOME}/tinderbox-pkgs/sys-devel/gcc/usr/lib/gcc/i686-pc-linux-gnu/4.1.2/" >> skype >> >> If you only require VoIP capability and not skype specifically you might be >> interested net-im/ekiga. > > Thank you very much for that, but I'm trying to simplify. You see, > I'm only a fake sysadmin. Does using a hardened kernel with a > non-hardened profile still offer good protection? > > - Grant > >>> > I've been able to do so; basically I switched over to the standard >>> > profile, disabled selinux in the kernel, and re-emerged system for new >>> > use flags. There were some other details but overall the process was >>> > pretty painless, anyone ambitious enough to configure a hardened system >>> > can probably handle the switch without much problem. Not that I'm >>> > encouraging you to drop hardened (especially on a laptop that could be >>> > exposed to random wifi networks ;-) >>> >>> Is there any difference between 1 and 8 here? Should I switch to 8? >>> >>> # eselect profile list >>> Available profile symlink targets: >>> [1] hardened/x86/2.6 * >>> [2] selinux/2007.0/x86 >>> [3] selinux/2007.0/x86/hardened >>> [4] default/linux/x86/2008.0 >>> [5] default/linux/x86/2008.0/desktop >>> [6] default/linux/x86/2008.0/developer >>> [7] default/linux/x86/2008.0/server >>> [8] hardened/linux/x86 >>> >>> - Grant >>> >>> >> Can I switch my laptop's profile from a hardened one to a non-hardened >>> >> one? I thought this was impossible without a complete reinstall but >>> >> folks on the gentoo-user list seem to think it's not a problem. >>> >> >>> >> - Grant > >