Simplicity is a form of art...

Hunting fuser
by Sven Vermeulen, post on Mon 12 March 2012

I am able to work on Gentoo and SELinux about one hour per day. It's more in total time, but being a bit exhausted makes me act a bit more slowly which boils down to about one hour per day. And one hour per day isn't bad, you're able to …

Introducing 2.20120215 policies
by Sven Vermeulen, post on Sun 26 February 2012

A few weeks after being released, we now have the 20120215-based policies available for our users (and also the newer userspace utilities). The packages currently reside in the hardened-dev overlay as they will need to see sufficient testing before we merge those to the main tree. For most users, nothing …

Transitioning to MCS policies
by Sven Vermeulen, post on Fri 24 February 2012

Since I started maintaining the SELinux policies for Gentoo Hardened, the policy types we supported were primarily strict and targeted. About half a year ago, we also started supported mcs and offered the possibility for using mls as well (but didn't really support that one).

With the recent release of …

This months' stabilization done, more to come
by Sven Vermeulen, post on Sun 29 January 2012

A small notification to tell you that the SELinux policies that were pushed to the main tree 30 days (or more) ago have now been stabilized (none of them introduced problems, although some of them have other bugs still open which are either fixed in \~arch or will be fixed …

Trying out initramfs with selinux and grsec
by Sven Vermeulen, post on Sun 15 January 2012

I'm no fan of initramfs. All my systems boot up just fine without it, so I often see it as an additional layer of obfuscation. But there are definitely cases where initramfs is needed, and from the looks of it, we might be needing to push out some documentation and …

Unix domain sockets are files
by Sven Vermeulen, post on Sat 31 December 2011

Probably not a first for many seasoned Linux administrators, and probably not correct accordingly to more advanced users than myself, but I just found out that Unix domain sockets are files. Even when they're not.

I have been looking at a weird SELinux denial I had occuring on my system …

Gentoo WiKi & Knowledge Base
by Sven Vermeulen, post on Mon 26 December 2011

I have been playing with the Gentoo Wiki the last few days and am very impressed with the work that both the wiki teams as well as existing contributors have already done to the place. The look and feel is very slick and editing works just as expected. One of …

Supporting fix scripts for XCCDF content and maintaining the documents
by Sven Vermeulen, post on Fri 23 December 2011

One of the features supported through OVAL (and Open-SCAP) is to generate fix scripts when a test has failed. The administrator can then verify this script (of course) and then execute it to correct wrong settings. So I decided to play around with this as well and enhanced the Gentoo …

SELinux Gentoo/Hardened state 2011-12-19
by Sven Vermeulen, post on Mon 19 December 2011

On december 14th, the Gentoo Hardened project had its monthly online meeting to discuss the current state of affairs of its projects and subprojects. Amongst them, the updates on the SELinux-front were presented as well.

Since last meeting, the follow topics passed the revue.

Supporting CC-BY-SA 3.0
by Sven Vermeulen, post on Tue 29 November 2011

Until now, documents on the Gentoo website all had to be licensed under the Creative Commons Attribution/Share Alike license, version 2.5. Why? Because at the time of the license choice, that was probably the latest version at hand. In the XML code itself, the license tagging was done …