Re: [gentoo-hardened] persistent paxctl -m?

[atoth@atoth.sote.hu]

Don't agree.

If you employ GRsecurity's RBAC, you can use PAX flags, like
"PAX_MPROTECT" on a given subject (binary). Take a look at on the example
policy file.

Regards:
Dw.
-- 
dr Tóth Attila, Radiológus, 06-20-825-8057, 06-30-5962-962
Attila Toth MD, Radiologist, +36-20-825-8057, +36-30-5962-962

On Pén, Április 10, 2009 18:29, Grant wrote:
>>>> and create executable shell script in that dir:
>>>> mozilla-firefox-bin.postinst
>>>> ---cut---
>>>> #!/bin/bash
>>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on
>>>> flash!"
>>>> chpax -m /opt/firefox/firefox-bin
>>>> ---cut---
>>>>
>>>
>>> Of course, if you compile firefox instead of using firefox-bin, then
>>> file
>>> should be named mozilla-firefox.postinst and you should use there
>>> paxctl
>>> instead of chpax.
>>>
>> A simple cron job or slightly-less-simple RBAC policy can do the trick.
>> There's no need to mess with portage, imho.
>
> Thanks for the suggestions everyone.  I think this type of persistence
> should be built into portage.  Maybe /etc/portage/package.nomprotect.
> Do you agree?  Should I file a bug?
>
> - Grant
>