[gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Grant]

One of my desktops runs a hardened profile:

# eselect profile list
Available profile symlink targets:
  [1]   default/linux/x86/10.0
  [2]   default/linux/x86/10.0/selinux
  [3]   default/linux/x86/10.0/desktop
  [4]   default/linux/x86/10.0/desktop/gnome
  [5]   default/linux/x86/10.0/desktop/kde
  [6]   default/linux/x86/10.0/developer
  [7]   default/linux/x86/10.0/server
  [8]   hardened/linux/x86 *
  [9]   hardened/linux/x86/selinux

I noticed USE="jpeg" is not enabled by default so I took a look around
and noticed these:

# locate hardened/linux/x86
/usr/portage/profiles/hardened/linux/x86/10.0
/usr/portage/profiles/hardened/linux/x86/desktop
/usr/portage/profiles/hardened/linux/x86/developer
/usr/portage/profiles/hardened/linux/x86/minimal
/usr/portage/profiles/hardened/linux/x86/server

Why can't I eselect a profile like hardened/linux/x86/desktop which
would hopefully have more desktop-oriented USE defaults than
hardened/linux/x86?

- Grant

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Paul Hartman]

On Thu, Jun 7, 2012 at 12:39 AM, Grant <emailgrant@gmail.com> wrote:
> One of my desktops runs a hardened profile:
>
> # eselect profile list
> Available profile symlink targets:
>  [1]   default/linux/x86/10.0
>  [2]   default/linux/x86/10.0/selinux
>  [3]   default/linux/x86/10.0/desktop
>  [4]   default/linux/x86/10.0/desktop/gnome
>  [5]   default/linux/x86/10.0/desktop/kde
>  [6]   default/linux/x86/10.0/developer
>  [7]   default/linux/x86/10.0/server
>  [8]   hardened/linux/x86 *
>  [9]   hardened/linux/x86/selinux
>
> I noticed USE="jpeg" is not enabled by default so I took a look around
> and noticed these:
>
> # locate hardened/linux/x86
> /usr/portage/profiles/hardened/linux/x86/10.0
> /usr/portage/profiles/hardened/linux/x86/desktop
> /usr/portage/profiles/hardened/linux/x86/developer
> /usr/portage/profiles/hardened/linux/x86/minimal
> /usr/portage/profiles/hardened/linux/x86/server
>
> Why can't I eselect a profile like hardened/linux/x86/desktop which
> would hopefully have more desktop-oriented USE defaults than
> hardened/linux/x86?

I have never used hardened and am not in any way informed about it,
but I seem to recall reading that hardened on desktop was not
supported and that it is primarily intended for use on servers.

Maybe that profile is masked. You may still be able to use it by
manually updating your profile symlink (rather than having eselect do
it for you).

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Grant]

>> One of my desktops runs a hardened profile:
>>
>> # eselect profile list
>> Available profile symlink targets:
>>  [1]   default/linux/x86/10.0
>>  [2]   default/linux/x86/10.0/selinux
>>  [3]   default/linux/x86/10.0/desktop
>>  [4]   default/linux/x86/10.0/desktop/gnome
>>  [5]   default/linux/x86/10.0/desktop/kde
>>  [6]   default/linux/x86/10.0/developer
>>  [7]   default/linux/x86/10.0/server
>>  [8]   hardened/linux/x86 *
>>  [9]   hardened/linux/x86/selinux
>>
>> I noticed USE="jpeg" is not enabled by default so I took a look around
>> and noticed these:
>>
>> # locate hardened/linux/x86
>> /usr/portage/profiles/hardened/linux/x86/10.0
>> /usr/portage/profiles/hardened/linux/x86/desktop
>> /usr/portage/profiles/hardened/linux/x86/developer
>> /usr/portage/profiles/hardened/linux/x86/minimal
>> /usr/portage/profiles/hardened/linux/x86/server
>>
>> Why can't I eselect a profile like hardened/linux/x86/desktop which
>> would hopefully have more desktop-oriented USE defaults than
>> hardened/linux/x86?
>
> I have never used hardened and am not in any way informed about it,
> but I seem to recall reading that hardened on desktop was not
> supported and that it is primarily intended for use on servers.

Can anyone confirm that a hardened profile is only supported for
servers?  I'm seeking a more desktop-friendly hardened profile but I
don't want to use an unsupported one.

- Grant

> Maybe that profile is masked. You may still be able to use it by
> manually updating your profile symlink (rather than having eselect do
> it for you).

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Pandu Poluan]

[-- Attachment #1: Type: text/plain, Size: 1811 bytes --]

On Jun 8, 2012 12:59 PM, "Grant" <emailgrant@gmail.com> wrote:
>
> >> One of my desktops runs a hardened profile:
> >>
> >> # eselect profile list
> >> Available profile symlink targets:
> >>  [1]   default/linux/x86/10.0
> >>  [2]   default/linux/x86/10.0/selinux
> >>  [3]   default/linux/x86/10.0/desktop
> >>  [4]   default/linux/x86/10.0/desktop/gnome
> >>  [5]   default/linux/x86/10.0/desktop/kde
> >>  [6]   default/linux/x86/10.0/developer
> >>  [7]   default/linux/x86/10.0/server
> >>  [8]   hardened/linux/x86 *
> >>  [9]   hardened/linux/x86/selinux
> >>
> >> I noticed USE="jpeg" is not enabled by default so I took a look around
> >> and noticed these:
> >>
> >> # locate hardened/linux/x86
> >> /usr/portage/profiles/hardened/linux/x86/10.0
> >> /usr/portage/profiles/hardened/linux/x86/desktop
> >> /usr/portage/profiles/hardened/linux/x86/developer
> >> /usr/portage/profiles/hardened/linux/x86/minimal
> >> /usr/portage/profiles/hardened/linux/x86/server
> >>
> >> Why can't I eselect a profile like hardened/linux/x86/desktop which
> >> would hopefully have more desktop-oriented USE defaults than
> >> hardened/linux/x86?
> >
> > I have never used hardened and am not in any way informed about it,
> > but I seem to recall reading that hardened on desktop was not
> > supported and that it is primarily intended for use on servers.
>
> Can anyone confirm that a hardened profile is only supported for
> servers?  I'm seeking a more desktop-friendly hardened profile but I
> don't want to use an unsupported one.
>
> - Grant
>

IIRC, once upon a time I selected the "default...server" profile, and got
informed by eselect that "I better be using the hardened profile for a
server" (or something to that effect).

So, yes I think 'hardened' is more aimed toward servers than desktops.

Rgds,

[-- Attachment #2: Type: text/html, Size: 2468 bytes --]

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Ron Adee]

[-- Attachment #1: Type: text/plain, Size: 2429 bytes --]

Hi. I'm Ron A.

I do believe "eselect profile list" shows a hardened desktop option, if I'm
mistaking I DO have a hardened desktop that runs openbox seamlessly.

Not sure as to the default USE flags, because I always review and add them
via /etc/portage/package.use. I do know of an gentoo based distro that has
a working e17 environment using the  hardened tool-chain.

I've learned much through gentoo and these mail lists. 1st post to list.
Gentoo++
On Jun 8, 2012 12:33 AM, "Pandu Poluan" <pandu@poluan.info> wrote:

>
> On Jun 8, 2012 12:59 PM, "Grant" <emailgrant@gmail.com> wrote:
> >
> > >> One of my desktops runs a hardened profile:
> > >>
> > >> # eselect profile list
> > >> Available profile symlink targets:
> > >>  [1]   default/linux/x86/10.0
> > >>  [2]   default/linux/x86/10.0/selinux
> > >>  [3]   default/linux/x86/10.0/desktop
> > >>  [4]   default/linux/x86/10.0/desktop/gnome
> > >>  [5]   default/linux/x86/10.0/desktop/kde
> > >>  [6]   default/linux/x86/10.0/developer
> > >>  [7]   default/linux/x86/10.0/server
> > >>  [8]   hardened/linux/x86 *
> > >>  [9]   hardened/linux/x86/selinux
> > >>
> > >> I noticed USE="jpeg" is not enabled by default so I took a look around
> > >> and noticed these:
> > >>
> > >> # locate hardened/linux/x86
> > >> /usr/portage/profiles/hardened/linux/x86/10.0
> > >> /usr/portage/profiles/hardened/linux/x86/desktop
> > >> /usr/portage/profiles/hardened/linux/x86/developer
> > >> /usr/portage/profiles/hardened/linux/x86/minimal
> > >> /usr/portage/profiles/hardened/linux/x86/server
> > >>
> > >> Why can't I eselect a profile like hardened/linux/x86/desktop which
> > >> would hopefully have more desktop-oriented USE defaults than
> > >> hardened/linux/x86?
> > >
> > > I have never used hardened and am not in any way informed about it,
> > > but I seem to recall reading that hardened on desktop was not
> > > supported and that it is primarily intended for use on servers.
> >
> > Can anyone confirm that a hardened profile is only supported for
> > servers?  I'm seeking a more desktop-friendly hardened profile but I
> > don't want to use an unsupported one.
> >
> > - Grant
> >
>
> IIRC, once upon a time I selected the "default...server" profile, and got
> informed by eselect that "I better be using the hardened profile for a
> server" (or something to that effect).
>
> So, yes I think 'hardened' is more aimed toward servers than desktops.
>
> Rgds,
>

[-- Attachment #2: Type: text/html, Size: 3264 bytes --]

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Jorge Martínez López]

Hi there!

I run Hardened in my desktop and it mostly works.

When I switched profiles I looked at which use flags changed using
"emerge -pudvN world" and then I enabled them manually using ufed.

With Hardened forget using Skype. PaX will kill multimedia
applications such as Totem, use paxctl to solve this. I have some
issues with Phython applications such as Gwibber and Hotot, the only
way to solve it seems to use paxctl with the python binary, which I am
not willing to.

Greetings,
-- 
Jorge Martínez López <jorgeml@gmail.com> http://www.jorgeml.net

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Bryan Gardiner]

On Fri, 8 Jun 2012 16:07:56 +0100
Jorge Martínez López <jorgeml@gmail.com> wrote:

> Hi there!
> 
> I run Hardened in my desktop and it mostly works.
> 
> When I switched profiles I looked at which use flags changed using
> "emerge -pudvN world" and then I enabled them manually using ufed.
> 
> With Hardened forget using Skype. PaX will kill multimedia
> applications such as Totem, use paxctl to solve this. I have some
> issues with Phython applications such as Gwibber and Hotot, the only
> way to solve it seems to use paxctl with the python binary, which I am
> not willing to.
> 
> Greetings,

+1 for using Hardened as a desktop.  Skype should work with PaX now;
it used to need an exact paxctl command to get running but its ebuild
now sets that.

Is there a nice way that you can un-pax-mark Python(/etc.) through
Portage, or do you have to do it manually?  (And does that horribly
break Portage?)  Personally I'm a little concerned about the Firefox +
Chromium pax-marks; one day I'll get grsec set up...

It would be nice if there were desktop Hardened profiles though.  The
only reason I maintain a full set of USE flags in make.conf is so that
it is portable between hardened and regular.

Cheers,
Bryan

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Jorge Martínez López]

Hi!


2012/6/8 Bryan Gardiner <bog@khumba.net>:
[...]
>
> +1 for using Hardened as a desktop.  Skype should work with PaX now;
> it used to need an exact paxctl command to get running but its ebuild
> now sets that.

Great to know Skype works now. Back then it did not even install. I am
not using Skype any more though.
>
> Is there a nice way that you can un-pax-mark Python(/etc.) through
> Portage, or do you have to do it manually?  (And does that horribly
> break Portage?)  Personally I'm a little concerned about the Firefox +
> Chromium pax-marks; one day I'll get grsec set up...
>

No idea, I identified pywebkitgtk as the culprit of Gwibber / Hotot
not running and I opened a bug for that:
https://bugs.gentoo.org/show_bug.cgi?id=405549

Those are the only two applications I recall I can't run.

> It would be nice if there were desktop Hardened profiles though.  The
> only reason I maintain a full set of USE flags in make.conf is so that
> it is portable between hardened and regular.

+1

Cheers,

-- 
Jorge Martínez López <jorgeml@gmail.com> http://www.jorgeml.net

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Francisco Blas Izquierdo Riera (klondike)]

[-- Attachment #1: Type: text/plain, Size: 2169 bytes --]

Hello,

First sorry for taking this long to answer this, somehow this mail
slipped through my radar and couldn't find it when somebody moved it to
the gentoo-hardened list, add to that an... interesting live and we are set.

And now let's get answers:

First the Gentoo Hardened team DOES support the use of Gentoo Hardened
on desktop and this has been so for a long time, there are many reasons
for this amongst others the fact that currently desktops tend to be more
vulnerable to attacks than servers. As a matter of fact I do tend to
state that my laptop is running Gentoo Hardened whenever I have to give
a talk on it and I can tell you I'm not the only user here, amongst
other examples I recall an interesting remotely managed kiosk project by
another user.

Regarding the profiles the main reason why they don't exist is the non
existence of a desktop feature that makes it easier for us to have it
(as it happens for example with the selinux or multilib features). This
said we tend to be very open to people wanting to join the community so
if you want to create them feel free to come to the meeting we are
holding on 2012-06-27 20:00 at #GentooHardened and say so when we touch
the profiles topic, be warned though that profiles tend to be very
complex and fragile so are a thing not to be taken easily.

Regarding skype, in theory you can use it but you need to paxmark it
with legacy USE flags and well it is quite awkward, another option is
using the new xattr based marks but I think this is still in
development. You will also need to disable TPE.

Regarding things like totem check also dmesg, at times you need to
disable TPE to get orc code to work properly. Anyway I have no problems
like that with kaffeine.

Finally regarding Gwibber and Hotot make sure you don't have the jit USE
flag set, jit code and hardened match just as well as a bobcat and a
pitbull in a small closed box with a lit firecracker to startle them.
Worst case try choqok it works well for me.

That covers all on this thread, I hope this e-mail is useful and as
always feel free to come back with any questions you have.
klondike


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 262 bytes --]

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Alecks Gates]

On Tue, Jun 26, 2012 at 8:48 PM, Francisco Blas Izquierdo Riera
(klondike) <klondike@gentoo.org> wrote:
> Hello,
>
> First sorry for taking this long to answer this, somehow this mail
> slipped through my radar and couldn't find it when somebody moved it to
> the gentoo-hardened list, add to that an... interesting live and we are set.
>
> And now let's get answers:
>
> First the Gentoo Hardened team DOES support the use of Gentoo Hardened
> on desktop and this has been so for a long time, there are many reasons
> for this amongst others the fact that currently desktops tend to be more
> vulnerable to attacks than servers. As a matter of fact I do tend to
> state that my laptop is running Gentoo Hardened whenever I have to give
> a talk on it and I can tell you I'm not the only user here, amongst
> other examples I recall an interesting remotely managed kiosk project by
> another user.
>
> Regarding the profiles the main reason why they don't exist is the non
> existence of a desktop feature that makes it easier for us to have it
> (as it happens for example with the selinux or multilib features). This
> said we tend to be very open to people wanting to join the community so
> if you want to create them feel free to come to the meeting we are
> holding on 2012-06-27 20:00 at #GentooHardened and say so when we touch
> the profiles topic, be warned though that profiles tend to be very
> complex and fragile so are a thing not to be taken easily.
>
Which timezone is this in?  I don't normally pay attention to this
type of thing, but this would be very interesting to watch.

> Regarding skype, in theory you can use it but you need to paxmark it
> with legacy USE flags and well it is quite awkward, another option is
> using the new xattr based marks but I think this is still in
> development. You will also need to disable TPE.
>
What about the new version of Skype, 4.0.0.7, is it?  Seeing as
Microsoft isn't leaving Skype on Linux dead, who knows, they might be
willing to work with the community on something.

> Regarding things like totem check also dmesg, at times you need to
> disable TPE to get orc code to work properly. Anyway I have no problems
> like that with kaffeine.
>
> Finally regarding Gwibber and Hotot make sure you don't have the jit USE
> flag set, jit code and hardened match just as well as a bobcat and a
> pitbull in a small closed box with a lit firecracker to startle them.
> Worst case try choqok it works well for me.
>
> That covers all on this thread, I hope this e-mail is useful and as
> always feel free to come back with any questions you have.
> klondike
>
This was nice to read, and I am (personally) feeling more inclined to
use Gentoo Hardened for the desktop now.

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Francisco Blas Izquierdo Riera (klondike)]

[-- Attachment #1: Type: text/plain, Size: 3587 bytes --]

El 27/06/12 04:38, Alecks Gates escribió:
> On Tue, Jun 26, 2012 at 8:48 PM, Francisco Blas Izquierdo Riera
> (klondike) <klondike@gentoo.org> wrote:
>> Hello,
>>
>> First sorry for taking this long to answer this, somehow this mail
>> slipped through my radar and couldn't find it when somebody moved it to
>> the gentoo-hardened list, add to that an... interesting live and we are set.
>>
>> And now let's get answers:
>>
>> First the Gentoo Hardened team DOES support the use of Gentoo Hardened
>> on desktop and this has been so for a long time, there are many reasons
>> for this amongst others the fact that currently desktops tend to be more
>> vulnerable to attacks than servers. As a matter of fact I do tend to
>> state that my laptop is running Gentoo Hardened whenever I have to give
>> a talk on it and I can tell you I'm not the only user here, amongst
>> other examples I recall an interesting remotely managed kiosk project by
>> another user.
>>
>> Regarding the profiles the main reason why they don't exist is the non
>> existence of a desktop feature that makes it easier for us to have it
>> (as it happens for example with the selinux or multilib features). This
>> said we tend to be very open to people wanting to join the community so
>> if you want to create them feel free to come to the meeting we are
>> holding on 2012-06-27 20:00 at #GentooHardened and say so when we touch
>> the profiles topic, be warned though that profiles tend to be very
>> complex and fragile so are a thing not to be taken easily.
>>
> Which timezone is this in?  I don't normally pay attention to this
> type of thing, but this would be very interesting to watch.
UTC So if your mail headers don't lie that should be 15:00 in your local
timezone.
>> Regarding skype, in theory you can use it but you need to paxmark it
>> with legacy USE flags and well it is quite awkward, another option is
>> using the new xattr based marks but I think this is still in
>> development. You will also need to disable TPE.
>>
> What about the new version of Skype, 4.0.0.7, is it?  Seeing as
> Microsoft isn't leaving Skype on Linux dead, who knows, they might be
> willing to work with the community on something.
If they still have the ugly ELF self checking procedure it depends it
should  work always with ourxattr based paxmarks and maybe TPE disabled
(depending on its new requisites) but for the traditional paxmarks which
modify the ELF file this may not be the case specially since the older
paxmarking method is no longer allowed by newer glibc versions.
>> Regarding things like totem check also dmesg, at times you need to
>> disable TPE to get orc code to work properly. Anyway I have no problems
>> like that with kaffeine.
>>
>> Finally regarding Gwibber and Hotot make sure you don't have the jit USE
>> flag set, jit code and hardened match just as well as a bobcat and a
>> pitbull in a small closed box with a lit firecracker to startle them.
>> Worst case try choqok it works well for me.
>>
>> That covers all on this thread, I hope this e-mail is useful and as
>> always feel free to come back with any questions you have.
>> klondike
>>
> This was nice to read, and I am (personally) feeling more inclined to
> use Gentoo Hardened for the desktop now.
I'm glad to hear it, I have to recognize the Gentoo Hardened Comunity
has changed a lot in the last years (to the point that currently the
only old school member of the team who is actively contributing is
Swift) which in turn changed a lot the project.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 262 bytes --]

Re: [gentoo-user] USE="jpeg" not part of hardened/linux/x86 profile

[Jorge Martínez López]

Thanks Klondike for the tips!

2012/6/27 Francisco Blas Izquierdo Riera (klondike) <klondike@gentoo.org>:
[...]
> Finally regarding Gwibber and Hotot make sure you don't have the jit USE
> flag set, jit code and hardened match just as well as a bobcat and a
> pitbull in a small closed box with a lit firecracker to startle them.
> Worst case try choqok it works well for me.

I will test disabling the jit USE flag as soon as I can access my
machine (I am moving).

Does anyone know the performance impact of disabling "jit". Is it noticeable?

Cheers,
-- 
Jorge Martínez López <jorgeml@gmail.com> http://www.jorgeml.net