From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org)
	by finch.gentoo.org with esmtp (Exim 4.60)
	(envelope-from <gentoo-hardened+bounces-2461-garchives=archives.gentoo.org@lists.gentoo.org>)
	id 1LXcRl-0000Nu-Iq
	for garchives@archives.gentoo.org; Thu, 12 Feb 2009 14:21:45 +0000
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id 20259E021D;
	Thu, 12 Feb 2009 14:21:31 +0000 (UTC)
Received: from yx-out-1718.google.com (yx-out-1718.google.com [74.125.44.158])
	by pigeon.gentoo.org (Postfix) with ESMTP id EE107E021D
	for <gentoo-hardened@lists.gentoo.org>; Thu, 12 Feb 2009 14:21:30 +0000 (UTC)
Received: by yx-out-1718.google.com with SMTP id 3so422050yxi.46
        for <gentoo-hardened@lists.gentoo.org>; Thu, 12 Feb 2009 06:21:30 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=domainkey-signature:mime-version:received:in-reply-to:references
         :date:message-id:subject:from:to:content-type;
        bh=E9sURE8pThXfQFCf6C2VDdnnkQYDAhppMbb803qZzMo=;
        b=rG2meS3v5gDl83Jqw17DEpM2mlawbevsuB0SBQnnvLpnryiFUKZxsKXit798RTsDPv
         IuRqHRf+Wm9q4k/hE+iXU039rwOWNx6bvyYQhVa3yq6up6d17i1mIrOjhvhsWUf5CaE1
         /OvVs25WQcbWy7gym5oDu2vyjSECL36MXuBFQ=
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=AnCjAPjyeo2Fpn29widQHc334dZtrWLlXlpXy9f3L9ZNjysyKiyKuI5hEBRZKZ2O7Y
         Db1OsQnh6sZXAE07vukDRewuSaDdhgSOjeZ/MEFJI8PJX07U0LobTPemOLUqrdCjfVX+
         H0b5WKhQEM7HJVDNu2e0isVW870RiEKgmPpA4=
Precedence: bulk
List-Post: <mailto:gentoo-hardened@lists.gentoo.org>
List-Help: <mailto:gentoo-hardened+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-hardened+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-hardened+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-hardened.gentoo.org>
X-BeenThere: gentoo-hardened@lists.gentoo.org
Reply-to: gentoo-hardened@lists.gentoo.org
MIME-Version: 1.0
Received: by 10.150.52.10 with SMTP id z10mr1035121ybz.100.1234448490734; Thu, 
	12 Feb 2009 06:21:30 -0800 (PST)
In-Reply-To: <4993D604.6030803@whyscream.net>
References: <1234258730.28777.12.camel@caguiar-linux.madeiratecnopolo.pt>
	 <1234345043.28777.34.camel@caguiar-linux.madeiratecnopolo.pt>
	 <49931EBA.8090307@whyscream.net>
	 <200902111423.13355.gengor@gentoo.org>
	 <4993D604.6030803@whyscream.net>
Date: Thu, 12 Feb 2009 08:21:30 -0600
Message-ID: <c8b556060902120621h5a65618fvf38d61a9ac47e613@mail.gmail.com>
Subject: Re: [gentoo-hardened] Which profile?
From: Matthew Summers <msummers42@gmail.com>
To: gentoo-hardened@lists.gentoo.org
Content-Type: multipart/alternative; boundary=000e0cd6ae90c8a6130462b96f00
X-Archives-Salt: 368f3e06-e9b2-403c-9bc0-6893b1cb4397
X-Archives-Hash: 08f5613cabfaa76875527aa0be591498

--000e0cd6ae90c8a6130462b96f00
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On Thu, Feb 12, 2009 at 1:55 AM, Tom Hendrikx <tom@whyscream.net> wrote:

> Gordon Malm wrote:
> > On Wednesday, February 11, 2009 10:53:46 Tom Hendrikx wrote:
> >> Then I'll be the one to ask the annoying questions:)
> >>
> >> 1) Why are they there (could be related to some over-enthousiast
> >> non-hardened devs)?
> >>
> >> 2) Why do the profiles in the released hardened stages point to
> >> "../usr/portage/profiles/hardened/linux/x86/2008.0" by default? I
> >> checked this in stage1-x86-hardened-2008.0.tar.bz2 and
> >> stage3-i686-hardened-2008.0.tar.bz2
> >>
> >> 3) As these profiles seem to reflect the new "preferred layout", I
> >> understand that someone added them. But why aren't settings from
> >> supported hardened profiles ported to this new layout, to remove the
> >> ambiguity?
> >
> > To make a long story short one hand didn't know what the other was doing.
>  The
> > new profiles are the way I'd like to go, but they need some adjustment
> and
> > the old profiles should be used for now.  The situation is what it is
> today
> > because nobody (me) has gotten around to fixing+testing the new profiles
> and
> > dealing with the transition.  Not what you wanted to hear probably, but
> > there's much to do in hardened land and not many to do it.
> >
> > Gordon Malm (gengor)
> >
>
> My questions arose from curiosity, so thanks for clearing up. It's too
> bad that the situation is like it is, but I understand that there is
> more than enough work to be done, and not enough man power.
>
> Just know that testing stuff can be easily 'outsourced', just abuse the
> mailing list:)
>
> --
> Regards,
>         Tom
>
>
Gengor,

I had been running the profile in the stage3 with no issues for about a
month on a couple of servers without any issues.

Would it be possible to place a README in the dir with the new hardened
stages briefly explaining the situation so our users don't make this mistake
again?

Cheers & thanks for all the fish!

-- 
M. Summers

"...there are no rules here -- we're trying to accomplish something."
 - Thomas A. Edison

--000e0cd6ae90c8a6130462b96f00
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 12, 2009 at 1:55 AM, Tom Hendrikx <s=
pan dir=3D"ltr">&lt;<a href=3D"mailto:tom@whyscream.net">tom@whyscream.net<=
/a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"border-=
left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left=
: 1ex;">
<div><div></div><div class=3D"Wj3C7c">Gordon Malm wrote:<br>
&gt; On Wednesday, February 11, 2009 10:53:46 Tom Hendrikx wrote:<br>
&gt;&gt; Then I&#39;ll be the one to ask the annoying questions:)<br>
&gt;&gt;<br>
&gt;&gt; 1) Why are they there (could be related to some over-enthousiast<b=
r>
&gt;&gt; non-hardened devs)?<br>
&gt;&gt;<br>
&gt;&gt; 2) Why do the profiles in the released hardened stages point to<br=
>
&gt;&gt; &quot;../usr/portage/profiles/hardened/linux/x86/2008.0&quot; by d=
efault? I<br>
&gt;&gt; checked this in stage1-x86-hardened-2008.0.tar.bz2 and<br>
&gt;&gt; stage3-i686-hardened-2008.0.tar.bz2<br>
&gt;&gt;<br>
&gt;&gt; 3) As these profiles seem to reflect the new &quot;preferred layou=
t&quot;, I<br>
&gt;&gt; understand that someone added them. But why aren&#39;t settings fr=
om<br>
&gt;&gt; supported hardened profiles ported to this new layout, to remove t=
he<br>
&gt;&gt; ambiguity?<br>
&gt;<br>
&gt; To make a long story short one hand didn&#39;t know what the other was=
 doing. &nbsp;The<br>
&gt; new profiles are the way I&#39;d like to go, but they need some adjust=
ment and<br>
&gt; the old profiles should be used for now. &nbsp;The situation is what i=
t is today<br>
&gt; because nobody (me) has gotten around to fixing+testing the new profil=
es and<br>
&gt; dealing with the transition. &nbsp;Not what you wanted to hear probabl=
y, but<br>
&gt; there&#39;s much to do in hardened land and not many to do it.<br>
&gt;<br>
&gt; Gordon Malm (gengor)<br>
&gt;<br>
<br>
</div></div>My questions arose from curiosity, so thanks for clearing up. I=
t&#39;s too<br>
bad that the situation is like it is, but I understand that there is<br>
more than enough work to be done, and not enough man power.<br>
<br>
Just know that testing stuff can be easily &#39;outsourced&#39;, just abuse=
 the<br>
mailing list:)<br>
<br>
--<br>
Regards,<br>
<font color=3D"#888888"> &nbsp; &nbsp; &nbsp; &nbsp;Tom<br>
<br>
</font></blockquote></div><br>Gengor, <br><br>I had been running the profil=
e in the stage3 with no issues for about a month on a couple of servers wit=
hout any issues.<br><br>Would it be possible to place a README in the dir w=
ith the new hardened stages briefly explaining the situation so our users d=
on&#39;t make this mistake again?<br>
<br>Cheers &amp; thanks for all the fish!<br clear=3D"all"><br>-- <br>M. Su=
mmers<br><br>&quot;...there are no rules here -- we&#39;re trying to accomp=
lish something.&quot;<br> &nbsp;- Thomas A. Edison<br>

--000e0cd6ae90c8a6130462b96f00--