From mboxrd@z Thu Jan 1 00:00:00 1970 From: ng0 Subject: Re: Hardening (was: Re: tor: update to 0.2.9.9) Date: Tue, 24 Jan 2017 21:18:55 +0000 Message-ID: <8760l42m2o.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> References: <20170124111934.16080-1-contact.ng0@cryptolab.net> <20170124190726.GB6110@jasmine> <87bmuw2n3j.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> <20170124210233.GB30771@jasmine> <878tq02mij.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:50956) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cW8TL-0000mz-0D for guix-devel@gnu.org; Tue, 24 Jan 2017 16:17:47 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cW8TH-0000dU-R9 for guix-devel@gnu.org; Tue, 24 Jan 2017 16:17:46 -0500 Received: from latitanza.investici.org ([2001:888:2000:56::19]:27920) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cW8TH-0000cY-HB for guix-devel@gnu.org; Tue, 24 Jan 2017 16:17:43 -0500 Received: from [82.94.249.234] (latitanza [82.94.249.234]) (Authenticated sender: niasterisk@grrlz.net) by localhost (Postfix) with ESMTPSA id 814C712884C for ; Tue, 24 Jan 2017 21:17:41 +0000 (UTC) In-Reply-To: <878tq02mij.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org ng0 writes: > Leo Famulari writes: > >> On Tue, Jan 24, 2017 at 08:56:48PM +0000, ng0 wrote: >>> Leo Famulari writes: >>> > Should we build Tor with "--enable-expensive-hardening"? >>>=20 >>> I will take a look later what can be applied other than the >>> default configure flags. >>>=20 >>> I'm all for hardening, but it seems that the first basic ideas >>> for Guix are stuck in the idea state. >> >> As far as I can tell, --enable-expensive-hardening is specific to Tor, >> so it's not relevant to the project of hardening all Guix packages. > > Yes. > > I'm building this change right now: > > + (arguments > + `(#:configure-flags (list "--enable-expensive-hardening" > + "--enable-gcc-hardening" > + "--enable-linker-hardening"))) > > Taken from Gentoo, I trust their hardening project to debug and > discover good usage. > >>> It would be great to see some movement on this during this >>> year. I volunteer to help with it, though I don't have as much >>> experience with SELinux (and only basic experience with >>> GrSecurity without a modular kernel like GuixSD uses). >> >> Yes, this effort needs a champion. No, I would say this needs an effort of more than one person. At best a team of people who either are willing to learn about system hardening or already know enough, maybe even a combination of both to share knowledge :) --=20 =E2=99=A5=E2=92=B6 ng0 -- https://www.inventati.org/patternsinthechaos/