Re: Plan for Guix security (was Re: Long term plan for GuixSD security: microkernels, ocap, RISC-V support)

[Marius Bakke <mbakke@fastmail.com>]

[-- Attachment #1: Type: text/plain, Size: 894 bytes --]

Hello!

Alex Vong <alexvong1995@gmail.com> writes:

> Besides, I remember we have discuss about hardening before. Should I
> start a new hardening branch? (although I don't time to work on it right
> now). I think this is something we can do now.
>
> My idea is to create a new guix module (guix build hardening) which
> should contains various build flags. Then we should modifiy each build
> system to import from this new module and fix any build error caused by
> it. We can ask the build farm to evaluate this new branch, right?
>
>
> What do you think?

Thank you for taking the initiative!  This sounds great to me.  I
imagine the build systems could get an argument along the lines of
#:hardening-flags '(pie fortify stack-protector ...).

For gnu-build-system, I suppose we'd build up CFLAGS, LDFLAGS and
friends?  We'll also have to modify all packages that override those
variables.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]