Segmentation fault when emerging packages after libpcre upgrade?
by Sven Vermeulen, post on Wed 09 July 2014SELinux users might be facing failures when emerge is merging a package to the file system, with an error that looks like so:
>>> Setting SELinux security labels
/usr/lib64/portage/bin/misc-functions.sh: line 1112: 23719 Segmentation fault /usr/sbin/setfiles "${file_contexts_path}" -r "${D}" "${D}"
* ERROR: dev-libs/libpcre-8 …Gentoo Hardened, June 2014
by Sven Vermeulen, post on Sun 15 June 2014Friday the Gentoo Hardened project had its monthly online meeting to talk about the progress within the various tools, responsibilities and subprojects.
On the toolchain part, Zorry mentioned that GCC 4.9 and 4.8.3 will have SSP enabled by default. The hardened profiles will still have a different …
Revamped our SELinux documentation
by Sven Vermeulen, post on Mon 12 May 2014In the move to the Gentoo wiki, I have updated and revamped most of our SELinux documentation. The end result can be seen through the main SELinux page. Most of the content is below this page (as subpages).
We start with a new introduction to SELinux article which goes over …
Dropping sesandbox support
by Sven Vermeulen, post on Fri 09 May 2014A vulnerability in
seunshare,
part of policycoreutils, came to light recently (through bug
509896). The issue is
within libcap-ng actually, but the specific situation in which the
vulnerability can be exploited is only available in seunshare.
Now, seunshare is not built by default on Gentoo. You need to define
USE …
Online hardened meeting of March
by Sven Vermeulen, post on Thu 27 March 2014I'm back from the depths of the unknown, so time to pick up my usual write-up of the online Gentoo Hardened meeting.
Toolchain
GCC 4.9 is being worked on, and might be released by end of April (based on the amount of open bugs). You can find the changes …
Fixing the busybox build failure
by Sven Vermeulen, post on Wed 26 March 2014Since a few months I have a build failure every time I try to generate
an initial ram file system (as my current primary workstation uses a
separate /usr and LVM for everything except /boot):
* busybox: >> Compiling...
* ERROR: Failed to compile the "all" target...
*
* -- Grepping log... --
*
* - busybox-1.7.4-signal-hack.patch …Create your own SELinux Gentoo profile
by Sven Vermeulen, post on Mon 24 March 2014Or any other profile for that matter ;-)
A month or so ago we got the question how to enable SELinux on a Gentoo
profile that doesn't have a <some profilename>/selinux equivalent.
Because we don't create SELinux profiles for all possible profiles out
there, having a way to do this …
Can Gentoo play a role in a RHEL-only environment?
by Sven Vermeulen, post on Thu 09 January 2014Sounds like a stupid question, as the answer is already in the title. If a company has only RedHat Enterprise Linux as allowed / supported Linux platform (be it for a support model requirement, ISV certification, management tooling support or what not) how could or would Gentoo still play a role …
Limiting file access with SELinux alone?
by Sven Vermeulen, post on Tue 31 December 2013While writing a small script to handle simple certificate authority activities using OpenSSL, I considered how to properly protect the files that OpenSSL uses for these activities. As you are probably aware, a system that hosts the necessary files for CA activities (like signing certificate requests) should be very secure …
Upgrading old Gentoo installations
by Sven Vermeulen, post on Sun 29 December 2013Today I got "pinged" on bug #463240 about the difficulty of upgrading a Gentoo Linux deployment after a long time of inactivity on the system. We already have an Upgrading Gentoo article on the Gentoo wiki that describes in great detail how upgrades can be accomplished. But one of the …