Aaaand we're back - hardened monthly meeting
by Sven Vermeulen, post on Thu 26 September 2013It almost feels like we had our monthly online meeting just a week ago. Below a small write-up of the highlights. If you want to know the gory details, just wait a few hours/days until the IRC logs are sent out ;-) Now remember, the project does more than what …
Underestimated or underused: Portage (e)logging
by Sven Vermeulen, post on Wed 25 September 2013Within 30 minutes of each other, two people on the #gentoo channel
asked if Portage kept logs of the messages displayed during the build
and installation of a package. Of course, the answer is a sounding "yes"
- and depending on your needs, you can even save more of the logging …
Gentoo Hardened progress report
by Sven Vermeulen, post on Thu 29 August 2013Today, we had our monthly online meeting to discuss the progress amongst the various Gentoo Hardened projects. As usual, here is a small write-up.
Lead election
As every year, we also reviewed the current project leads. No surprises here, everybody is happy with the current leads so they are re-elected …
Why our policies don't like emerge --config
by Sven Vermeulen, post on Fri 23 August 2013One of the features that Portage provides is to have post-processing
done on request of the administrator for certain packages. For instance,
for the dev-db/postgresql-server package we can call its
pkg_config() phase to create the PostgreSQL instance and configure it
so that the configuration of the database is …
Using CUSTOM_BUILDOPT in refpolicy for USE flag-alike functionality?
by Sven Vermeulen, post on Fri 16 August 2013As you are probably aware, Gentoo uses the reference
policy as its base for
SELinux policies. Yes, we do customize it and not everything is already
pushed upstream (for instance, our approach to use xdg_*_home_t
customizable types to further restrict user application access has been
sent up for …
And now, 31 days later...
by Sven Vermeulen, post on Thu 01 August 2013... the Gentoo Hardened team had its monthly online meeting again ;-)
On the agenda were the usual suspects, such as the toolchain. In this
category, Zorry mentioned that he has a fix for GCC 4.8.1 for the
hardenedno* and vanilla gcc-config options which will be added to
the tree …
Adding mcstrans to Gentoo
by Sven Vermeulen, post on Sun 07 July 2013If you use SELinux, you might be using an MLS-enabled policy. These are
policies that support sensitivity labels on resources and domains. In
Gentoo, these are supported in the mcs and mls policy stores. Now
sensitivity ranges are fun to work with, but the moment you have several
sensitivity levels …
Hardening is our business... new monthly report ;-)
by Sven Vermeulen, post on Thu 27 June 2013We're back with another report on the Gentoo Hardened project. Please excuse my brevity, as you've noticed I'm not that active (yet) due to work on an external project - I'll be back mid-July though. I promise.
On the Toolchain side, GCC 4.8.1 is in the tree and has …
Gentoo Hardened spring notes
by Sven Vermeulen, post on Thu 16 May 2013We got back together on the #gentoo-hardened chat channel to discuss
the progress of Gentoo
Hardened, so it's time for
another write-up of what was said.
Toolchain
GCC 4.8.1 will be out soon, although nothing major has occurred with it since the last meeting. There is a plugin …
Overriding the default SELinux policies
by Sven Vermeulen, post on Wed 15 May 2013Extending SELinux policies with additional rules is easy. As SELinux uses a deny by default approach, all you need to do is to create a policy module that contains the additional (allow) rules, load that and you're all set. But what if you want to remove some rules?
Well, sadly …