Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Gentoo User (http://www.linux-archive.org/gentoo-user/)
-   -   USE="jpeg" not part of hardened/linux/x86 profile (http://www.linux-archive.org/gentoo-user/677596-use-jpeg-not-part-hardened-linux-x86-profile.html)

Alecks Gates 06-27-2012 02:38 AM

USE="jpeg" not part of hardened/linux/x86 profile
 
On Tue, Jun 26, 2012 at 8:48 PM, Francisco Blas Izquierdo Riera
(klondike) <klondike@gentoo.org> wrote:
> Hello,
>
> First sorry for taking this long to answer this, somehow this mail
> slipped through my radar and couldn't find it when somebody moved it to
> the gentoo-hardened list, add to that an... interesting live and we are set.
>
> And now let's get answers:
>
> First the Gentoo Hardened team DOES support the use of Gentoo Hardened
> on desktop and this has been so for a long time, there are many reasons
> for this amongst others the fact that currently desktops tend to be more
> vulnerable to attacks than servers. As a matter of fact I do tend to
> state that my laptop is running Gentoo Hardened whenever I have to give
> a talk on it and I can tell you I'm not the only user here, amongst
> other examples I recall an interesting remotely managed kiosk project by
> another user.
>
> Regarding the profiles the main reason why they don't exist is the non
> existence of a desktop feature that makes it easier for us to have it
> (as it happens for example with the selinux or multilib features). This
> said we tend to be very open to people wanting to join the community so
> if you want to create them feel free to come to the meeting we are
> holding on 2012-06-27 20:00 at #GentooHardened and say so when we touch
> the profiles topic, be warned though that profiles tend to be very
> complex and fragile so are a thing not to be taken easily.
>
Which timezone is this in? I don't normally pay attention to this
type of thing, but this would be very interesting to watch.

> Regarding skype, in theory you can use it but you need to paxmark it
> with legacy USE flags and well it is quite awkward, another option is
> using the new xattr based marks but I think this is still in
> development. You will also need to disable TPE.
>
What about the new version of Skype, 4.0.0.7, is it? Seeing as
Microsoft isn't leaving Skype on Linux dead, who knows, they might be
willing to work with the community on something.

> Regarding things like totem check also dmesg, at times you need to
> disable TPE to get orc code to work properly. Anyway I have no problems
> like that with kaffeine.
>
> Finally regarding Gwibber and Hotot make sure you don't have the jit USE
> flag set, jit code and hardened match just as well as a bobcat and a
> pitbull in a small closed box with a lit firecracker to startle them.
> Worst case try choqok it works well for me.
>
> That covers all on this thread, I hope this e-mail is useful and as
> always feel free to come back with any questions you have.
> klondike
>
This was nice to read, and I am (personally) feeling more inclined to
use Gentoo Hardened for the desktop now.

"Francisco Blas Izquierdo Riera (klondike)" 06-27-2012 04:27 PM

USE="jpeg" not part of hardened/linux/x86 profile
 
El 27/06/12 04:38, Alecks Gates escribió:
> On Tue, Jun 26, 2012 at 8:48 PM, Francisco Blas Izquierdo Riera
> (klondike) <klondike@gentoo.org> wrote:
>> Hello,
>>
>> First sorry for taking this long to answer this, somehow this mail
>> slipped through my radar and couldn't find it when somebody moved it to
>> the gentoo-hardened list, add to that an... interesting live and we are set.
>>
>> And now let's get answers:
>>
>> First the Gentoo Hardened team DOES support the use of Gentoo Hardened
>> on desktop and this has been so for a long time, there are many reasons
>> for this amongst others the fact that currently desktops tend to be more
>> vulnerable to attacks than servers. As a matter of fact I do tend to
>> state that my laptop is running Gentoo Hardened whenever I have to give
>> a talk on it and I can tell you I'm not the only user here, amongst
>> other examples I recall an interesting remotely managed kiosk project by
>> another user.
>>
>> Regarding the profiles the main reason why they don't exist is the non
>> existence of a desktop feature that makes it easier for us to have it
>> (as it happens for example with the selinux or multilib features). This
>> said we tend to be very open to people wanting to join the community so
>> if you want to create them feel free to come to the meeting we are
>> holding on 2012-06-27 20:00 at #GentooHardened and say so when we touch
>> the profiles topic, be warned though that profiles tend to be very
>> complex and fragile so are a thing not to be taken easily.
>>
> Which timezone is this in? I don't normally pay attention to this
> type of thing, but this would be very interesting to watch.
UTC So if your mail headers don't lie that should be 15:00 in your local
timezone.
>> Regarding skype, in theory you can use it but you need to paxmark it
>> with legacy USE flags and well it is quite awkward, another option is
>> using the new xattr based marks but I think this is still in
>> development. You will also need to disable TPE.
>>
> What about the new version of Skype, 4.0.0.7, is it? Seeing as
> Microsoft isn't leaving Skype on Linux dead, who knows, they might be
> willing to work with the community on something.
If they still have the ugly ELF self checking procedure it depends it
should work always with ourxattr based paxmarks and maybe TPE disabled
(depending on its new requisites) but for the traditional paxmarks which
modify the ELF file this may not be the case specially since the older
paxmarking method is no longer allowed by newer glibc versions.
>> Regarding things like totem check also dmesg, at times you need to
>> disable TPE to get orc code to work properly. Anyway I have no problems
>> like that with kaffeine.
>>
>> Finally regarding Gwibber and Hotot make sure you don't have the jit USE
>> flag set, jit code and hardened match just as well as a bobcat and a
>> pitbull in a small closed box with a lit firecracker to startle them.
>> Worst case try choqok it works well for me.
>>
>> That covers all on this thread, I hope this e-mail is useful and as
>> always feel free to come back with any questions you have.
>> klondike
>>
> This was nice to read, and I am (personally) feeling more inclined to
> use Gentoo Hardened for the desktop now.
I'm glad to hear it, I have to recognize the Gentoo Hardened Comunity
has changed a lot in the last years (to the point that currently the
only old school member of the team who is actively contributing is
Swift) which in turn changed a lot the project.

Jorge Martínez López 06-28-2012 08:02 PM

USE="jpeg" not part of hardened/linux/x86 profile
 
Thanks Klondike for the tips!

2012/6/27 Francisco Blas Izquierdo Riera (klondike) <klondike@gentoo.org>:
[...]
> Finally regarding Gwibber and Hotot make sure you don't have the jit USE
> flag set, jit code and hardened match just as well as a bobcat and a
> pitbull in a small closed box with a lit firecracker to startle them.
> Worst case try choqok it works well for me.

I will test disabling the jit USE flag as soon as I can access my
machine (I am moving).

Does anyone know the performance impact of disabling "jit". Is it noticeable?

Cheers,
--
Jorge Martínez López <jorgeml@gmail.com> http://www.jorgeml.net


All times are GMT. The time now is 07:42 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.