Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-17 Thread Anthony G. Basile
On 05/17/2012 12:16 AM, RB wrote: On Wed, May 16, 2012 at 5:40 PM, "Tóth Attila" wrote: What's the difference between your kernel konfig and Liberté Linux 2012.1's kernel konfig? Because you told it worked for you. Quite a lot, not the least of which theirs is a 32-bit kernel and mine's 64-bi

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-17 Thread Maxim Kammerer
On Thu, May 17, 2012 at 3:04 PM, Anthony G. Basile wrote: > Liberte, last I looked, has quite a few hardening features off. True — this is made necessary by having to support virtualized environments (and, of course, Xorg, wrt. GRKERNSEC_IO). Since out last discussion on the subject, I have “disc

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-17 Thread Tóth Attila
2012.Május 17.(Cs) 15:07 időpontban Maxim Kammerer ezt írta: > On Thu, May 17, 2012 at 3:04 PM, Anthony G. Basile > wrote: >> Liberte, last I looked, has quite a few hardening features off. > > True — this is made necessary by having to support virtualized > environments (and, of course, Xorg, wrt

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-17 Thread Maxim Kammerer
On Thu, May 17, 2012 at 5:40 PM, "Tóth Attila" wrote: > How would I change the way /dev gets mounted? I don't have noexec as an > option listed by mount for the udev entry. I mount devtmpfs on /dev in initramfs, but you can add an entry to /etc/fstab, too — see /etc/init.d/udev-mount for details

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-17 Thread Matthew Thode
On 05/17/2012 10:08 AM, Maxim Kammerer wrote: > On Thu, May 17, 2012 at 5:40 PM, "Tóth Attila" wrote: >> How would I change the way /dev gets mounted? I don't have noexec as an >> option listed by mount for the udev entry. > > I mount devtmpfs on /dev in initramfs, but you can add an entry to > /

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-17 Thread Maxim Kammerer
On Thu, May 17, 2012 at 6:50 PM, Matthew Thode wrote: > Is there a bug open for this? There is now (bug #416415). The issue is with reading EBDA area (not with writing as I wrote previously). I think I didn't open the bug previously because after looking at v86d sources, the issue seemed harmless

Re: [gentoo-hardened] Paxmarkings on mail-client/thunderbird

2012-05-17 Thread Radek Madej
Hi, On Wednesday 16 May 2012 17:29:44 Anthony G. Basile wrote: > On 05/16/2012 12:12 PM, PaX Team wrote: > > On 16 May 2012 at 16:39, Hinnerk van Bruinehsen wrote: > > > >> at the moment the thunderbird-ebuild in the tree does a "pax mark m" > >> on the binary. > >> At least for me thunderbird wor

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-17 Thread Tóth Attila
2012.Május 17.(Cs) 17:08 időpontban Maxim Kammerer ezt írta: > On Thu, May 17, 2012 at 5:40 PM, "Tóth Attila" > wrote: >> How would I change the way /dev gets mounted? I don't have noexec as an >> option listed by mount for the udev entry. > > I mount devtmpfs on /dev in initramfs, but you can add

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-17 Thread RB
On Thu, May 17, 2012 at 6:04 AM, Anthony G. Basile wrote: > Please open a bug, attach both config files.  It would be useful if you also > identify on which options it breaks.  Liberte, last I looked, has quite a > few hardening features off.  Pay attention to GRKERNSEC_IO, PAX_PAGEEXEC, > PAX_KER

Re: [gentoo-hardened] Paxmarkings on mail-client/thunderbird

2012-05-17 Thread Hinnerk van Bruinehsen
On 17.05.2012 20:25, Radek Madej wrote: > Hi, > > On Wednesday 16 May 2012 17:29:44 Anthony G. Basile wrote: >> On 05/16/2012 12:12 PM, PaX Team wrote: >>> On 16 May 2012 at 16:39, Hinnerk van Bruinehsen wrote: >>> at the moment the thunderbird-ebuild in the tree does a "pax mark m" on t

[gentoo-hardened] systemd and gentoo

2012-05-17 Thread Tóth Attila
I've recently come across some articles about the hal - dbus - udev - consolekit - upower udisks - systemd movement. And there's openrc. A couple of months before I converted the systems to openrc. What we should prepare for next? When will it happen? Is it already happening? Somebody should pull t

Re: [gentoo-hardened] systemd and gentoo

2012-05-17 Thread Pavel Labushev
On Fri, 18 May 2012 03:01:00 +0200 "Tóth Attila" wrote: > Somebody should pull the brakes, please. My humble advise: try making your own custom scripts for runit, minit or similar minimalistic supervisor together with sudo or su for PAM support (setuid-root isn't required for root->unprivileged

Re: [gentoo-hardened] systemd and gentoo

2012-05-17 Thread Alex Efros
Hi! On Fri, May 18, 2012 at 02:56:06AM +, Pavel Labushev wrote: > > Somebody should pull the brakes, please. > My humble advise: try making your own custom scripts for runit, minit or Actually, if you decide to go this way, you probably find packages from my overlay 'powerman' is good startin