On 09/09/2013 10:19 AM, Michael Orlitzky wrote:
On 09/09/2013 09:49 AM, Alex Efros wrote:
Hi!
On Mon, Sep 09, 2013 at 09:30:56AM -0400, Michael Orlitzky wrote:
That is, can I disable PT_PAX, enable XATTR_PAX, reboot, and run
migrate-pax? Or might that cause problems?
You can migrate with just one reboot, but order of actions is different:
1. Build new kernel with PT_PAX disabled and XATTR_PAX enabled.
2. Run `migrate-pax -m`.
3. Reboot using new kernel.
Thanks, I'll give it a try (on the router in the building where I have
keys, first...).
I'm not really sure, but you may also need to add PAX_MARKINGS="XT" into
/etc/make.conf.
pax-utils.eclass has this to say:
To control what markings are made, set PAX_MARKINGS in /etc/portage
/make.conf to contain either "PT", "XT" or "none". The default is to
attempt both PT_PAX and XATTR_PAX.
But then again, right below that, I see,
# @ECLASS-VARIABLE: PAX_MARKINGS
# @DESCRIPTION:
# Control which markings are made:
# PT = PT_PAX markings, XT = XATTR_PAX markings
# Default to PT markings.
PAX_MARKINGS=${PAX_MARKINGS:="PT"}
So I'm not really sure either.
That was my mistake. When I dropped XT I forgot to update the comment.
We tried XT right off the bat, but discovered a couple of problems: 1)
install doesn't preserve xattr. we have a solution but it isn't working
that well, and 2) there were lots of warning thrown for non hardened
users which annoyed them. So we dropped to just PT.
--
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197
