From mboxrd@z Thu Jan 1 00:00:00 1970 From: ng0 Subject: Re: Hardening (was: Re: tor: update to 0.2.9.9) Date: Tue, 24 Jan 2017 21:09:24 +0000 Message-ID: <878tq02mij.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> References: <20170124111934.16080-1-contact.ng0@cryptolab.net> <20170124190726.GB6110@jasmine> <87bmuw2n3j.fsf@wasp.i-did-not-set--mail-host-address--so-tickle-me> <20170124210233.GB30771@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48204) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cW8KB-0004jS-CN for guix-devel@gnu.org; Tue, 24 Jan 2017 16:08:20 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cW8K6-00066e-Sw for guix-devel@gnu.org; Tue, 24 Jan 2017 16:08:19 -0500 Received: from latitanza.investici.org ([2001:888:2000:56::19]:61649) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cW8K6-00066B-JO for guix-devel@gnu.org; Tue, 24 Jan 2017 16:08:14 -0500 In-Reply-To: <20170124210233.GB30771@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org Leo Famulari writes: > On Tue, Jan 24, 2017 at 08:56:48PM +0000, ng0 wrote: >> Leo Famulari writes: >> > Should we build Tor with "--enable-expensive-hardening"? >>=20 >> I will take a look later what can be applied other than the >> default configure flags. >>=20 >> I'm all for hardening, but it seems that the first basic ideas >> for Guix are stuck in the idea state. > > As far as I can tell, --enable-expensive-hardening is specific to Tor, > so it's not relevant to the project of hardening all Guix packages. Yes. I'm building this change right now: + (arguments + `(#:configure-flags (list "--enable-expensive-hardening" + "--enable-gcc-hardening" + "--enable-linker-hardening"))) Taken from Gentoo, I trust their hardening project to debug and discover good usage. >> It would be great to see some movement on this during this >> year. I volunteer to help with it, though I don't have as much >> experience with SELinux (and only basic experience with >> GrSecurity without a modular kernel like GuixSD uses). > > Yes, this effort needs a champion. --=20 =E2=99=A5=E2=92=B6 ng0 -- https://www.inventati.org/patternsinthechaos/