Public SourceMage Discussion List

[Arjan Bouter <abouter AT sourcemage.org>]

Begin forwarded message:

Date: Sun, 03 Apr 2005 00:01:10 +0200
From: Thomas Houssin <thomas.houssin AT gmail.com>
To: Arjan Bouter <abouter AT sourcemage.org>
Subject: Re: [SM-Discuss] Quality Assurance Team and Security Team Leader
openings.


Arjan Bouter wrote:

>>We could add several things : stack-smashing protector, PaX patch on
>>> binutils, Arc4Random, RSBAC support (and probably others). There're also
>>> several patches to build Position-Independent-Executable. HLFS
>>> (http://www.linuxfromscratch.org/hlfs/news.html) could be a good place
>>> to begin with and find patches and ideas.
> 
> 
> Lot's of new options to spells, nice  ;) 
> 
>>I agree, we must let the user choose. My idea was adding options to the
>>different spells, or creating a "hardened" section (or may be a
>>grimoire) with the "hardened" spells.
> 
> 
> like the security(-libs) section we've got now?

In fact as we don't want to break glibc, gcc,... I thought about a
hardened (or whatever we want to call it) section/grimoire, with spells
we could break/test without messing everybody's box.
Using a section different would also allow to easily distinguish between
security tools (nmap, ethereal, chkrootkit...) and spells involving
bigger changes (for example, recompiling every application we want to
protect with stack smashing protector).

> 
>>May be the biggest part of the work would be on the documentation : from
>>iptables configuration or pam configuration to ACL, explaining what you
>>can do, spells you can cast, and how it improves the security of your
>>system.
> 
> 
> I'll add the PAM info to my todo list, any takers for the others?
> 

I'm ok to write about iptables (when we'll have decided how to integrate
these changes, I can begin to test and write about SSP and friends).

Cheers,
Thomas

PS: you may want to forward this mail to sm-discuss : you only answered
to me with your previous email ;)

-- 
Thomas Houssin


Key ID = 42404C36
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36



Oops ;)

Arjan


+=======
Source Mage GNU/Linux developer,
Linux so advanced, it may as well be magic.
http://www.sourcemage.org

Registered as user #310617 with the Linux Counter,
http://counter.li.org.

GnuPG Key 79D4B14E = 94AD 3FD1 E259 67ED 632E  2B06 CFBE 1154 79D4 B14E
+===

Attachment: pgpZm8S5R9266.pgp
Description: PGP signature