Public SourceMage Discussion List

[Thomas Houssin <thomas.houssin AT gmail.com>]

Arjan Bouter wrote:
<snip>
> 
> 
> Hardened smgl is a very vague description ;)
> we already have grsec and ACL support (all optional) and as soon as someone 
> can
> get the selinux patches applied to coreutils we also have selinux support in
> smgl. That is pretty much as complete as other 'hardened' distros are, while
> we've got it in the normal grimoires.

To be more precise, by hardened I mean adding to the distro the various
patches and programs improving security, for example to prevent buffer
overflow attacks or add ACL support, and document them.

We could add several things : stack-smashing protector, PaX patch on
binutils, Arc4Random, RSBAC support (and probably others). There're also
several patches to build Position-Independent-Executable. HLFS
(http://www.linuxfromscratch.org/hlfs/news.html) could be a good place
to begin with and find patches and ideas.
> 
> As choice is very high on the smgl priorities list, i don't think we can 
> make
> it the default.
> 
> What we could do is add some profile spells to get the full selinux chain of
> spells installed. (as an example.)
> 
> On the documentation part of the story, IMHO the wiki is the right place to 
> have
> this kind of info.
> 

I agree, we must let the user choose. My idea was adding options to the
different spells, or creating a "hardened" section (or may be a
grimoire) with the "hardened" spells.

May be the biggest part of the work would be on the documentation : from
iptables configuration or pam configuration to ACL, explaining what you
can do, spells you can cast, and how it improves the security of your
system.

Finally, profile spells as Arjan suggested and why not inspection
spells, to check the system for obvious security mistakes (possible use
of Bastille ?)


-- 
Thomas Houssin


Key ID = 42404C36
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature