Re: [gentoo-hardened] XATTR_PAX migration wiki

2014-06-14 Thread Anthony G. Basile
On 06/14/14 06:49, PaX Team wrote: On 13 Jun 2014 at 16:40, subscr...@gmail.com wrote: I suggest a little improvement to the wiki: state the fact that user_xattr must be enabled in fstab for the relevant filesystems (at least /) as this isn't default AFAIK. i already forcibly enable the gener

Re: [gentoo-hardened] XATTR_PAX migration wiki

2014-06-14 Thread PaX Team
On 13 Jun 2014 at 16:40, subscr...@gmail.com wrote: > I suggest a little improvement to the wiki: state the fact that > user_xattr must be enabled in fstab for the relevant filesystems (at > least /) as this isn't default AFAIK. i already forcibly enable the general xattr support in filesystems

Re: [gentoo-hardened] XATTR_PAX migration wiki

2014-06-13 Thread Anthony G. Basile
On 06/13/14 10:40, subscr...@gmail.com wrote: I suggest a little improvement to the wiki: state the fact that user_xattr must be enabled in fstab for the relevant filesystems (at least /) as this isn't default AFAIK. I stumbled into this problem today and at first I couldn't understand what was h

Re: [gentoo-hardened] XATTR_PAX migration wiki

2014-06-13 Thread Andre Reinke
Yeah, I think that's a good improvement. Same happened to me having tmp as tmpfs which didn't have that option turned on. A lot of mess began. Am 13.06.2014 16:40 schrieb : > I suggest a little improvement to the wiki: state the fact that user_xattr > must be enabled in fstab for the relevant file

Re: [gentoo-hardened] XATTR_PAX migration

2013-10-04 Thread Anthony G. Basile
On 10/04/2013 12:23 AM, Alex Efros wrote: Hi! On Mon, Sep 09, 2013 at 05:26:57PM -0400, Anthony G. Basile wrote: You can use XT_PAX provided you're not running something like a tinderbox, ie doing massive amounts of ebuilds. The problem is that install is being wrapped by install.py. As a res

Re: [gentoo-hardened] XATTR_PAX migration

2013-10-03 Thread Alex Efros
Hi! On Mon, Sep 09, 2013 at 05:26:57PM -0400, Anthony G. Basile wrote: > You can use XT_PAX provided you're not running something like a > tinderbox, ie doing massive amounts of ebuilds. The problem is that > install is being wrapped by install.py. As a result every instance of > install mean

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Alex Xu
On 10/09/13 10:03 AM, Sven Vermeulen wrote: > On Sep 10, 2013 3:59 PM, "Anthony G. Basile" > wrote: >>> >>> If the project developers don't mind end user changes the documents can > be >>> moved to the general location (like we did with many SELinux related >>> documents). >>> >>> You can always p

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Anthony G. Basile
On 09/10/2013 10:40 AM, "Tóth Attila" wrote: 2013.Szeptember 10.(K) 16:00 időpontban Anthony G. Basile ezt írta: On 09/10/2013 08:52 AM, "Tóth Attila" wrote: 2013.Szeptember 10.(K) 13:50 időpontban Anthony G. Basile ezt írta: On 09/09/2013 06:06 PM, Alex Efros wrote: Hi! On Mon, Sep 09, 2013

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Anthony G. Basile
On 09/10/2013 10:03 AM, Sven Vermeulen wrote: On Sep 10, 2013 3:59 PM, "Anthony G. Basile" wrote: If the project developers don't mind end user changes the documents can be moved to the general location (like we did with many SELinux related documents). You can always put edits in your pers

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Tóth Attila
2013.Szeptember 10.(K) 16:00 időpontban Anthony G. Basile ezt írta: > On 09/10/2013 08:52 AM, "Tóth Attila" wrote: >> 2013.Szeptember 10.(K) 13:50 időpontban Anthony G. Basile ezt írta: >>> On 09/09/2013 06:06 PM, Alex Efros wrote: Hi! On Mon, Sep 09, 2013 at 05:26:57PM -0400, Anthon

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Sven Vermeulen
On Sep 10, 2013 3:59 PM, "Anthony G. Basile" wrote: >> >> If the project developers don't mind end user changes the documents can be >> moved to the general location (like we did with many SELinux related >> documents). >> >> You can always put edits in your personal space and have a developer rev

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Anthony G. Basile
On 09/10/2013 08:52 AM, "Tóth Attila" wrote: 2013.Szeptember 10.(K) 13:50 időpontban Anthony G. Basile ezt írta: On 09/09/2013 06:06 PM, Alex Efros wrote: Hi! On Mon, Sep 09, 2013 at 05:26:57PM -0400, Anthony G. Basile wrote: install is being wrapped by install.py. As a result every instance

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Anthony G. Basile
On 09/10/2013 09:08 AM, Sven Vermeulen wrote: On Sep 10, 2013 3:03 PM, "Michael Orlitzky" wrote: On 09/10/2013 07:44 AM, Anthony G. Basile wrote: On 09/09/2013 07:45 PM, Michael Orlitzky wrote: On 09/09/2013 05:26 PM, Anthony G. Basile wrote: You can use XT_PAX provided you're not running

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Sven Vermeulen
On Sep 10, 2013 3:03 PM, "Michael Orlitzky" wrote: > > On 09/10/2013 07:44 AM, Anthony G. Basile wrote: > > On 09/09/2013 07:45 PM, Michael Orlitzky wrote: > >> On 09/09/2013 05:26 PM, Anthony G. Basile wrote: > >>> > >>> You can use XT_PAX provided you're not running something like a > >>> tinder

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Michael Orlitzky
On 09/10/2013 07:44 AM, Anthony G. Basile wrote: > On 09/09/2013 07:45 PM, Michael Orlitzky wrote: >> On 09/09/2013 05:26 PM, Anthony G. Basile wrote: >>> >>> You can use XT_PAX provided you're not running something like a >>> tinderbox, ie doing massive amounts of ebuilds. The problem is that >>>

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Tóth Attila
2013.Szeptember 10.(K) 13:50 időpontban Anthony G. Basile ezt írta: > On 09/09/2013 06:06 PM, Alex Efros wrote: >> Hi! >> >> On Mon, Sep 09, 2013 at 05:26:57PM -0400, Anthony G. Basile wrote: >>> install is being wrapped by install.py. As a result every instance of >>> install mean invoking the py

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Anthony G. Basile
On 09/09/2013 06:06 PM, Alex Efros wrote: Hi! On Mon, Sep 09, 2013 at 05:26:57PM -0400, Anthony G. Basile wrote: install is being wrapped by install.py. As a result every instance of install mean invoking the python interpreter. With lots and lots of installs, this adds up to being very slow.

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-10 Thread Anthony G. Basile
On 09/09/2013 07:45 PM, Michael Orlitzky wrote: On 09/09/2013 05:26 PM, Anthony G. Basile wrote: You can use XT_PAX provided you're not running something like a tinderbox, ie doing massive amounts of ebuilds. The problem is that install is being wrapped by install.py. As a result every instan

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-09 Thread Michael Orlitzky
On 09/09/2013 05:26 PM, Anthony G. Basile wrote: > > You can use XT_PAX provided you're not running something like a > tinderbox, ie doing massive amounts of ebuilds. The problem is that > install is being wrapped by install.py. As a result every instance of > install mean invoking the python

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-09 Thread Alex Efros
Hi! On Mon, Sep 09, 2013 at 05:26:57PM -0400, Anthony G. Basile wrote: > install is being wrapped by install.py. As a result every instance of > install mean invoking the python interpreter. With lots and lots of > installs, this adds up to being very slow. Why not just add a patch for `insta

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-09 Thread Anthony G. Basile
On 09/09/2013 01:56 PM, Michael Orlitzky wrote: On 09/09/2013 01:47 PM, Anthony G. Basile wrote: That was my mistake. When I dropped XT I forgot to update the comment. We tried XT right off the bat, but discovered a couple of problems: 1) install doesn't preserve xattr. we have a solution

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-09 Thread Michael Orlitzky
On 09/09/2013 01:47 PM, Anthony G. Basile wrote: > > That was my mistake. When I dropped XT I forgot to update the comment. > We tried XT right off the bat, but discovered a couple of problems: 1) > install doesn't preserve xattr. we have a solution but it isn't working > that well, and 2)

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-09 Thread Anthony G. Basile
On 09/09/2013 10:19 AM, Michael Orlitzky wrote: On 09/09/2013 09:49 AM, Alex Efros wrote: Hi! On Mon, Sep 09, 2013 at 09:30:56AM -0400, Michael Orlitzky wrote: That is, can I disable PT_PAX, enable XATTR_PAX, reboot, and run migrate-pax? Or might that cause problems? You can migrate with jus

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-09 Thread Michael Orlitzky
On 09/09/2013 09:49 AM, Alex Efros wrote: > Hi! > > On Mon, Sep 09, 2013 at 09:30:56AM -0400, Michael Orlitzky wrote: >> That is, can I disable PT_PAX, enable XATTR_PAX, reboot, and run >> migrate-pax? Or might that cause problems? > > You can migrate with just one reboot, but order of actions is

Re: [gentoo-hardened] XATTR_PAX migration

2013-09-09 Thread Alex Efros
Hi! On Mon, Sep 09, 2013 at 09:30:56AM -0400, Michael Orlitzky wrote: > That is, can I disable PT_PAX, enable XATTR_PAX, reboot, and run > migrate-pax? Or might that cause problems? You can migrate with just one reboot, but order of actions is different: 1. Build new kernel with PT_PAX disabled