FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo Hardened

 
 
LinkBack Thread Tools
 
Old 11-27-2007, 07:18 PM
आशीष Ashish
 
Default Help required in creating a new profile

Hi,

I wanted to install *Hardened* Gentoo Linux 2007.0 on my AMD64 architecture
box with *SELinux* support and no *multilib* support. I'm in the initial
stage of installation. I've just extracted the stage3 'hardened' tarball and
portage snapshot.

The 'hardened' stage3 tarball ships with a default hardened profile, to which
I wanted to add *selinux* support. I've created a profile, which is not
working as expected. Following is the my profile, which I saved
in "/usr/local/portage/profiles/selinux-hardened-amd64" .

- ----8<----8<----
chatteau selinux-hardened-amd64 # file *
make.defaults: symbolic link to
`../../../../portage/profiles/selinux/2007.0/amd64/hardened/make.defaults'
package.mask: symbolic link to
`../../../../portage/profiles/selinux/2007.0/amd64/hardened/package.mask'
parent: ASCII text
use.mask: symbolic link to
`../../../../portage/profiles/selinux/2007.0/amd64/hardened/use.mask'
chatteau selinux-hardened-amd64 # cat parent
../../../../portage/profiles/selinux/2007.0/amd64
../../../../portage/profiles/hardened/amd64
selinux-hardened-amd64 # file /etc/make.profile
/etc/make.profile: symbolic link to
`/usr/local/portage/profiles/selinux-hardened-amd64'
- ---->8---->8----

Following is my "make.conf" :

- ----8<----8<----
CFLAGS="-O2 -pipe -ggdb -fforce-addr -mtune=nocona -march=nocona
- -fstack-protector-all"
CXXFLAGS="${CFLAGS}"
CHOST="x86_64-pc-linux-gnu"
FEATURES="ccache collision-protect buildpkg parallel-fetch splitdebug
userfetch"
- ---->8---->8----

Following is the output of 'euse -a', on the basis of which I'm concluding
its not working:

- ----8<----8<----
chatteau selinux-hardened-amd64 # euse -a
berkdb [+ D ]
cli [+ D ]
cracklib [+ ]
crypt [+ D ]
cups [+ D ]
dri [+ D ]
fbdev [+ ]
fortran [+ D ]
gdbm [+ D ]
gpm [+ D ]
hardened [+ D ]
iconv [+ D ]
ipv6 [+ D ]
isdnlog [+ D ]
justify [+ ]
ladspa [+ ]
midi [+ ]
mudflap [+ D ]
ncurses [+ D ]
nls [+ D ]
nptl [+ D ]
nptlonly [+ D ]
openmp [+ D ]
pam [+ D ]
pcre [+ D ]
perl [+ D ]
pic [+ D ]
pppd [+ D ]
python [+ D ]
readline [+ D ]
reflection [+ D ]
session [+ D ]
spl [+ D ]
sse [+ D ]
sse2 [+ D ]
ssl [+ D ]
tcpd [+ D ]
text [+ ]
tga [+ ]
unicode [+ D ]
urandom [+ ]
v4l [+ ]
vga [+ ]
xorg [+ D ]
zlib [+ D ]
- ---->8---->8----

I'm not expert in gentoo, so if I'm wrong somewhere please correct me.

[I've also posted this message alt.os.linux.gentoo.]

TIA
--
Ashish Shukla आशीष शुक्ल http://wahjava.wordpress.com/
·-- ·- ···· ·--- ·- ···- ·- ·--·-· --· -- ·- ·· ·-·· ·-·-·- -·-· --- --
 
Old 11-27-2007, 08:12 PM
"John Eckhart"
 
Default Help required in creating a new profile

Ashish,

*** The preferred way to go about using hardened would be to link an existing hardened profile: (i.e. /usr/portage/profiles/selinux/2007.0/amd64/hardened) to /etc/make.conf:


ln -sf /usr/portage/selinux/2007.0/amd64/hardened /etc/make.conf
If you have additional profile overrides (i.e. changes to the use masking), you can put them in /etc/portage/profile (see the portage(5) manpage for more information)


On Nov 27, 2007 3:18 PM, आशीष Ashish <wahjava.ml@gmail.com> wrote:

Hi,

I wanted to install *Hardened* Gentoo Linux 2007.0 on my AMD64 architecture
box with *SELinux* support and no *multilib* support. I'm in the initial
stage of installation. I've just extracted the stage3 'hardened' tarball and

portage snapshot.

The 'hardened' stage3 tarball ships with a default hardened profile, to which
I wanted to add *selinux* support. I've created a profile, which is not
working as expected. Following is the my profile, which I saved

in "/usr/local/portage/profiles/selinux-hardened-amd64" .

- ----8<----8<----
chatteau selinux-hardened-amd64 # file *
make.defaults: symbolic link to
`../../../../portage/profiles/selinux/2007.0/amd64/hardened/make.defaults'

package.mask: *symbolic link to
`../../../../portage/profiles/selinux/2007.0/amd64/hardened/package.mask'
parent: * * * *ASCII text
use.mask: * * *symbolic link to
`../../../../portage/profiles/selinux/2007.0/amd64/hardened/use.mask'

chatteau selinux-hardened-amd64 # cat parent
../../../../portage/profiles/selinux/2007.0/amd64
../../../../portage/profiles/hardened/amd64
selinux-hardened-amd64 # file /etc/make.profile
/etc/make.profile: symbolic link to

`/usr/local/portage/profiles/selinux-hardened-amd64'
- ---->8---->8----

Following is my "make.conf" :

- ----8<----8<----
CFLAGS="-O2 -pipe -ggdb -fforce-addr -mtune=nocona -march=nocona

- -fstack-protector-all"
CXXFLAGS="${CFLAGS}"
CHOST="x86_64-pc-linux-gnu"
FEATURES="ccache collision-protect buildpkg parallel-fetch splitdebug
userfetch"
- ---->8---->8----


Following is the output of 'euse -a', on the basis of which I'm concluding
its not working:

- ----8<----8<----
chatteau selinux-hardened-amd64 # euse -a
berkdb * * * * * * *[+ *D ]

cli * * * * * * * * [+ *D ]
cracklib * * * * * *[+ * *]
crypt * * * * * * * [+ *D ]
cups * * * * * * * *[+ *D ]
dri * * * * * * * * [+ *D ]
fbdev * * * * * * * [+ * *]
fortran * * * * * * [+ *D ]

gdbm * * * * * * * *[+ *D ]
gpm * * * * * * * * [+ *D ]
hardened * * * * * *[+ *D ]
iconv * * * * * * * [+ *D ]
ipv6 * * * * * * * *[+ *D ]
isdnlog * * * * * * [+ *D ]
justify * * * * * * [+ * *]
ladspa * * * * * * *[+ * *]

midi * * * * * * * *[+ * *]
mudflap * * * * * * [+ *D ]
ncurses * * * * * * [+ *D ]
nls * * * * * * * * [+ *D ]
nptl * * * * * * * *[+ *D ]
nptlonly * * * * * *[+ *D ]
openmp * * * * * * *[+ *D ]

pam * * * * * * * * [+ *D ]
pcre * * * * * * * *[+ *D ]
perl * * * * * * * *[+ *D ]
pic * * * * * * * * [+ *D ]
pppd * * * * * * * *[+ *D ]
python * * * * * * *[+ *D ]
readline * * * * * *[+ *D ]
reflection * * * * *[+ *D ]

session * * * * * * [+ *D ]
spl * * * * * * * * [+ *D ]
sse * * * * * * * * [+ *D ]
sse2 * * * * * * * *[+ *D ]
ssl * * * * * * * * [+ *D ]
tcpd * * * * * * * *[+ *D ]
text * * * * * * * *[+ * *]

tga * * * * * * * * [+ * *]
unicode * * * * * * [+ *D ]
urandom * * * * * * [+ * *]
v4l * * * * * * * * [+ * *]
vga * * * * * * * * [+ * *]
xorg * * * * * * * *[+ *D ]
zlib * * * * * * * *[+ *D ]
- ---->8---->8----


I'm not expert in gentoo, so if I'm wrong somewhere please correct me.

[I've also posted this message alt.os.linux.gentoo.]

TIA
--
Ashish Shukla आशीष शुक्ल * * * * * * * * * * *
http://wahjava.wordpress.com/
·-- ·- ···· ·--- ·- ···- ·- ·--·-· --· -- ·- ·· ·-·· ·-·-·- -·-· --- --
 
Old 11-27-2007, 08:52 PM
Alex Brandt
 
Default Help required in creating a new profile

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

John Eckhart wrote:
> Ashish,
>
> The preferred way to go about using hardened would be to link an
> existing hardened profile: (i.e. /usr/portage/profiles
> /selinux/2007.0/amd64/hardened) to /etc/make.conf:
>
> ln -sf /usr/portage/selinux/2007.0/amd64/hardened /etc/make.conf
>
> If you have additional profile overrides (i.e. changes to the use
> masking), you can put them in /etc/portage/profile (see the
> portage(5) manpage for more information)
>
You mean /etc/make.profile.

Regards,

Alex Brandt

- --
Student, B.S. Physics & Computer Science
Department of Physics and Astronomy, MSUM
Department of Computer Science and Information Services, MSUM
www.alunduil.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHTJGnvpZ9jByxpScRAteSAJ9rjOqOAcwJhQsSiM9C99 vX8Xb3IQCffZql
AP373ZsqmqSl3at1DAhNDN4=
=4Slw
-----END PGP SIGNATURE-----

--
gentoo-hardened@gentoo.org mailing list
 
Old 11-27-2007, 08:54 PM
brant williams
 
Default Help required in creating a new profile

Wouldn't you want the symlink to be to /etc/make.profile and not
/etc/make.conf?



brant williams
FCAA CDCA 20BC 3925 D634 F5C4 7420 6784 4DEB 6002



On Tue, 27 Nov 2007, John Eckhart wrote:


Date: Tue, 27 Nov 2007 16:12:58 -0500
From: John Eckhart <jweckhart@gmail.com>
Reply-To: gentoo-hardened@lists.gentoo.org
To: gentoo-hardened@lists.gentoo.org
Subject: Re: [gentoo-hardened] Help required in creating a new profile

Ashish,

The preferred way to go about using hardened would be to link an
existing hardened profile: (i.e.
/usr/portage/profiles/selinux/2007.0/amd64/hardened)
to /etc/make.conf:

ln -sf /usr/portage/selinux/2007.0/amd64/hardened /etc/make.conf

If you have additional profile overrides (i.e. changes to the use masking),
you can put them in /etc/portage/profile (see the portage(5) manpage for
more information)

On Nov 27, 2007 3:18 PM, आशीष Ashish <wahjava.ml@gmail.com> wrote:


Hi,

I wanted to install *Hardened* Gentoo Linux 2007.0 on my AMD64
architecture
box with *SELinux* support and no *multilib* support. I'm in the initial
stage of installation. I've just extracted the stage3 'hardened' tarball
and
portage snapshot.

The 'hardened' stage3 tarball ships with a default hardened profile, to
which
I wanted to add *selinux* support. I've created a profile, which is not
working as expected. Following is the my profile, which I saved
in "/usr/local/portage/profiles/selinux-hardened-amd64" .

- ----8<----8<----
chatteau selinux-hardened-amd64 # file *
make.defaults: symbolic link to
`../../../../portage/profiles/selinux/2007.0/amd64/hardened/make.defaults'
package.mask: symbolic link to
`../../../../portage/profiles/selinux/2007.0/amd64/hardened/package.mask'
parent: ASCII text
use.mask: symbolic link to
`../../../../portage/profiles/selinux/2007.0/amd64/hardened/use.mask'
chatteau selinux-hardened-amd64 # cat parent
../../../../portage/profiles/selinux/2007.0/amd64
../../../../portage/profiles/hardened/amd64
selinux-hardened-amd64 # file /etc/make.profile
/etc/make.profile: symbolic link to
`/usr/local/portage/profiles/selinux-hardened-amd64'
- ---->8---->8----

Following is my "make.conf" :

- ----8<----8<----
CFLAGS="-O2 -pipe -ggdb -fforce-addr -mtune=nocona -march=nocona
- -fstack-protector-all"
CXXFLAGS="${CFLAGS}"
CHOST="x86_64-pc-linux-gnu"
FEATURES="ccache collision-protect buildpkg parallel-fetch splitdebug
userfetch"
- ---->8---->8----

Following is the output of 'euse -a', on the basis of which I'm concluding
its not working:

- ----8<----8<----
chatteau selinux-hardened-amd64 # euse -a
berkdb [+ D ]
cli [+ D ]
cracklib [+ ]
crypt [+ D ]
cups [+ D ]
dri [+ D ]
fbdev [+ ]
fortran [+ D ]
gdbm [+ D ]
gpm [+ D ]
hardened [+ D ]
iconv [+ D ]
ipv6 [+ D ]
isdnlog [+ D ]
justify [+ ]
ladspa [+ ]
midi [+ ]
mudflap [+ D ]
ncurses [+ D ]
nls [+ D ]
nptl [+ D ]
nptlonly [+ D ]
openmp [+ D ]
pam [+ D ]
pcre [+ D ]
perl [+ D ]
pic [+ D ]
pppd [+ D ]
python [+ D ]
readline [+ D ]
reflection [+ D ]
session [+ D ]
spl [+ D ]
sse [+ D ]
sse2 [+ D ]
ssl [+ D ]
tcpd [+ D ]
text [+ ]
tga [+ ]
unicode [+ D ]
urandom [+ ]
v4l [+ ]
vga [+ ]
xorg [+ D ]
zlib [+ D ]
- ---->8---->8----

I'm not expert in gentoo, so if I'm wrong somewhere please correct me.

[I've also posted this message alt.os.linux.gentoo.]

TIA
--
Ashish Shukla आशीष शुक्ल
http://wahjava.wordpress.com/
·-- ·- ···· ·--- ·- ···- ·- ·--·-· --· -- ·- ·· ·-·· ·-·-·- -·-· --- --
 
Old 11-27-2007, 09:16 PM
आशीष Ashish
 
Default Help required in creating a new profile

,--[ On Wednesday 28 Nov 2007, John Eckhart wrote:
| Ashish,
|
| The preferred way to go about using hardened would be to link an
| existing hardened profile: (i.e.
| /usr/portage/profiles/selinux/2007.0/amd64/hardened)
| to /etc/make.conf:
|
| ln -sf /usr/portage/selinux/2007.0/amd64/hardened /etc/make.conf
|
| If you have additional profile overrides (i.e. changes to the use masking),
| you can put them in /etc/portage/profile (see the portage(5) manpage for
| more information)
|

Thanks for the reply.

Okay, so you mean I should place "no-multilib" stuff
inside /etc/portage/profile whereas my default profile points to
SELinux+Hardened, right. hmm... ?

TIA
--
Ashish Shukla आशीष शुक्ल http://wahjava.wordpress.com/
·-- ·- ···· ·--- ·- ···- ·- ·--·-· --· -- ·- ·· ·-·· ·-·-·- -·-· --- --
 

Thread Tools




All times are GMT. The time now is 04:23 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org