Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-18 Thread Matthew Thode
On 05/17/2012 01:42 PM, RB wrote: > On Thu, May 17, 2012 at 6:04 AM, Anthony G. Basile > wrote: >> Please open a bug, attach both config files. It would be useful if you also >> identify on which options it breaks. Liberte, last I looked, has quite a >> few hardening features off. Pay attention

Re: [gentoo-hardened] systemd and gentoo

2012-05-18 Thread Kevin Chadwick
On Fri, 18 May 2012 03:01:00 +0200 Tóth Attila wrote: > Somebody should pull the brakes, please. Your too polite, you mean, Somebody should give some people a slap for breaking unix philosophies and not understanding what Unix is already capable of. I've already disabled consolekit and udisks. T

Re: [gentoo-hardened] systemd and gentoo

2012-05-18 Thread Kevin Chadwick
On Fri, 18 May 2012 02:56:06 + Pavel Labushev wrote: > try making your own custom scripts for runit, minit or > similar minimalistic supervisor together with sudo or su for PAM > support (setuid-root isn't required for root->unprivileged uid > changes). It's simple, fast, maintainable and coul

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-18 Thread Hinnerk van Bruinehsen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 18.05.2012 09:18, Matthew Thode wrote: > On 05/17/2012 01:42 PM, RB wrote: >> On Thu, May 17, 2012 at 6:04 AM, Anthony G. Basile >> wrote: >>> Please open a bug, attach both config files. It would be >>> useful if you also identify on which optio

Re: [gentoo-hardened] systemd and gentoo

2012-05-18 Thread Pavel Labushev
On Fri, 18 May 2012 08:56:03 +0100 Kevin Chadwick wrote: > What's wrong with init respawn or supervise and/or monit? sysvinit: - adding/removing/stopping a service requires editing inittab or ad-hoc solutions - no integrated logging - no dependency tracking system monit: - depends on external s

Re: [gentoo-hardened] systemd and gentoo

2012-05-18 Thread Kevin Chadwick
On Fri, 18 May 2012 10:29:41 + Pavel Labushev wrote: > does pid file inspection has regex matching now Fair enough but for me, I prefer a simple and scripted init system.

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-18 Thread RB
On Fri, May 18, 2012 at 2:11 AM, Hinnerk van Bruinehsen wrote: > For me X works fine with UDEREF enabled. I'm using xorg-server-1.12.1 > and xf86-video-intel-2.19.0. (2 laptops, 1 core2 duo, 1 first > generation i5, if that has got something to do with it) That's because (as I just found by testi

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-18 Thread PaX Team
On 18 May 2012 at 13:29, RB wrote: > That's because (as I just found by testing) PAX_KERNEXEC "mitigates" > the oops. To put it in something of a boolean form, the following > produces the crashes: > > PAX_MEMORY_UDEREF && !(PAX_MEMORY_UDEREF && PAX_KERNEXEC) do you have any slab debugging opti

Re: [gentoo-hardened] hardened-sources-3.2.11 + i965 + x.org: possible regression

2012-05-18 Thread RB
On Fri, May 18, 2012 at 4:18 PM, PaX Team wrote: >> PAX_MEMORY_UDEREF && !(PAX_MEMORY_UDEREF && PAX_KERNEXEC) > > do you have any slab debugging options enabled by any chance? None intentionally, and none unintentionally that I can tell. SLUB_DEBUG is on, but that's forced on by having SLUB as th