From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: Hardening Date: Wed, 25 Jan 2017 14:04:28 +0100 Message-ID: <87tw8nxpcz.fsf@gnu.org> References: <20170124111934.16080-1-contact.ng0@cryptolab.net> <20170124190726.GB6110@jasmine> <87bmuw2n3j.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> <20170124210233.GB30771@jasmine> <878tq02mij.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> <8760l42m2o.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> <20170124213259.GA17982@jasmine> <87vat49l6p.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:49657) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cWNFb-0002Do-C3 for guix-devel@gnu.org; Wed, 25 Jan 2017 08:04:39 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cWNFY-0000nF-3e for guix-devel@gnu.org; Wed, 25 Jan 2017 08:04:35 -0500 In-Reply-To: <87vat49l6p.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> (ng0's message of "Tue, 24 Jan 2017 21:56:14 +0000") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: ng0 Cc: guix-devel@gnu.org Hi! ng0 skribis: > For starters, I think we could have an "hardened-wip" branch on > savannah (I can't commit anyway directly) and that we can target > SELinux for now, look at Hardened-gentoo and other systems how > they solve issues. Afterwards we need to address the toolchain > level, which to our advantage can be an make and break by hydra > and everyone who wants to contribute to fixing issues can run > their system from the hardening-toolchain-wip branch to > contribute to fixing all the breaking applications. > > Then we need to discuss wether we want to provide this by default > (my choice) OR if we want to offer a branch-choice model. > Supporting both vanilla and hardened might take some more burden > on fixing issues, that's why I'm all for forming a team of people > who work on this, and when they no longer want to, other people > join the rest of the old team, etc. Before creating a branch, I think we need a plan. :-) Alex Vong proposed ways to achieve it a while back: https://lists.gnu.org/archive/html/guix-devel/2015-12/msg00702.html I suggest taking a look at the discussion and starting from there. The best option is probably to start small (limited set of features/flags/options) and then incrementally improve that. Ludo=E2=80=99.