| Main Archive Page > Month Archives > gentoo-hardened archives |
Re: [gentoo-hardened] persistent paxctl -m?
From: <atoth_at_nospam>Date: Sun Apr 12 2009 - 06:49:17 GMT
To: gentoo-hardened@lists.gentoo.org
On Vas, Április 12, 2009 02:03, Grant wrote:
>> If you employ GRsecurity's RBAC, you can use PAX flags, like
>> "PAX_MPROTECT" on a given subject (binary). Take a look at on the
>> example
>> policy file.
>
> Do you guys think RBAC or /etc/portage/bashrc is a better choice for
> this? Maybe RBAC is overkill if this is all I'll be using it for?
>
It takes time to refine a policy and it needs some tuning from time to
time. If you haven't utilized any RBAC (Grsecurity, RSBAC) on your system
yet, it's high time to give it a try.
So I should say, that bashrc is not the best choice from the security
point of view, but in the mean time it's not an overkill either...
Regards:
Dw.
>
>>>>>> and create executable shell script in that dir:
>>>>>> mozilla-firefox-bin.postinst
>>>>>> ---cut---
>>>>>> #!/bin/bash
>>>>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on
>>>>>> flash!"
>>>>>> chpax -m /opt/firefox/firefox-bin
>>>>>> ---cut---
>>>>>>
>>>>>
>>>>> Of course, if you compile firefox instead of using firefox-bin, then
>>>>> file
>>>>> should be named mozilla-firefox.postinst and you should use there
>>>>> paxctl
>>>>> instead of chpax.
>>>>>
>>>> A simple cron job or slightly-less-simple RBAC policy can do the
>>>> trick.
>>>> There's no need to mess with portage, imho.
>>>
>>> Thanks for the suggestions everyone. I think this type of persistence
>>> should be built into portage. Maybe /etc/portage/package.nomprotect.
>>> Do you agree? Should I file a bug?
>>>
>>> - Grant
>