From mboxrd@z Thu Jan 1 00:00:00 1970 From: ng0 Subject: Re: server and client in one package -> security issue (was: Add murmur) Date: Tue, 14 Feb 2017 09:51:11 +0000 Message-ID: <20170214095111.mlehnt2mkqm57nza@wasp> References: <20170201204312.3005-1-contact.ng0@cryptolab.net> <87mvdvxq9v.fsf@gnu.org> <20170209182030.ngn2dsdfbzsmymdj@wasp> <87efz7asit.fsf@gnu.org> <96fa2c02-f5da-d4f5-6074-04b29f5376fb@crazy-compilers.com> <20170214101651.068fb59a@scratchpost.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:45951) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cdZjq-0006WQ-IC for guix-devel@gnu.org; Tue, 14 Feb 2017 04:49:36 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cdZji-00074G-Uh for guix-devel@gnu.org; Tue, 14 Feb 2017 04:49:30 -0500 Received: from latitanza.investici.org ([2001:888:2000:56::19]:29342) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cdZji-00072z-KV for guix-devel@gnu.org; Tue, 14 Feb 2017 04:49:26 -0500 Content-Disposition: inline In-Reply-To: <20170214101651.068fb59a@scratchpost.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Danny Milosavljevic Cc: guix-devel@gnu.org On 17-02-14 10:16:51, Danny Milosavljevic wrote: > Hi, > > I think the argument that things that don't exist can't be abused is a good one. > > However, a regular user can install it anyway. I don't remember when I last ran "guix package -i" as root. I just run it using my regular user account. > > So to separate the outputs adds just a miniscule step. > > In the end, there's a trade-off to be made. Either we trust users to develop, too, or not. Obviously they can use it for good or bad, then. > > I myself am a free software hacker and I'd prefer if systems automatically had the development stuff installed so others can be free software hackers, too. > > And an experienced hacker doesn't need header files either. I made up some of my own just searching Google - it's not difficult and takes about 30 min at most. > > If we want hardened critical production systems, I agree it should only contain absolutely required files with programs as simple as one can get them, use SELinux and use hardened gcc and someone should have reviewed the base libraries and any other stuff that runs (basically until a reasonable confidence level is reached). > > I don't think Guix should do that, though. IMO locking down everything for users is basically the antithesis of the FSF. > Interjecting here my opinion for a short moment, I think with hardening gcc and other parts of the toolchain more can be achieved. I don't want to be too optimistic, but I hope to be done with one part of this by summer (doing work in parallel). Whatever results from this discussion should be written down in the documentation, as this is obviously an impression and question which could arise. What makes my gut feeling (practical experience with hardening is limited to the SysOps and compiling side with me) okay is that Gentoo doesn't do much more than some Elf, PaX kernel (at your choice), GrSec or SELinux, some tools for pax etc, and hardening the libcs. -- ng0 -- https://www.inventati.org/patternsinthechaos/