Re: die() required on pax-mark?
Allan Wegan <allanwegan-ORSfXGZZcQqShm5Tz/[email protected]>
| Newsgroups | gmane.linux.gentoo.hardened |
|---|---|
| Message-ID | <[email protected]> |
> But, after we drop PT_PAX, this is only *worse* for the people in > (1.a). That's a much smaller group than /everyone/ who switches to > hardened. There seems to be the theoretical possibility of dropping XT_PAX instead of PT_PAX. The correct work of PAX markings would then not depend on the file system used. Therefore users with and without capable file systems could switch to hardened freely, since all the pax-markings would have been succeessfully applied to the executables. I am only a user of Gentoo Hardened (amd64) and do not know, why that option seems would not be a viable path. Is it because of self-checking binary blobs? Perhaps, it should be at least a valid choice to not drop (legacy?) PT_PAX markings - just in case you want to use hardened without xattr or want to upgrade from vanilla. -- Allan Wegan
signature.asc
(application/pgp-signature, 836 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQIcBAEBAgAGBQJSZNG7AAoJEMO3lVyIy1Qu1HIP/RuhHfJAT171EvV4YktylZAV zf4UYH7/CsfDzSDNO00FJmmWT6Sc6mgiyGi0KYel5h6DjSgoXH+Fu0fFvQHiz7vA fNf0AVNVzhpZVHf1Z77ZMhyFNUydkQd0j0TGxOfeQ2iuxzHuW9GIj2LkOzWFrQXm WGQFgOK03zXdZ2uFLnP7SXt5EU1eAswIUzCOSivKtn5kZO/LRmmRQm7tQovE4CTz 3VKqvIy/MPd3r7sRquB9lrzWCfsDc/HnaPb2QGNzYd78tiQsd8FvQVQnggwsTS9W x7RXJGYk+CT1mpyVHEoro7SXtNS6EBIR1XDWf7BjJ1P1nEXfNdh2JhmBGtePET6K caC4sc3hsICbNJJ2i7AR7hUVxtmyMFa3x0V+50MxDkq+S2Z/RaZy/j3k3xlSJiyN S7NvzHuxjFM0VjwgAOitmJHR9e/piiSly2GHpx7aSDwsJ+w2H5xBK6K8LYDaTJt4 R83Zw69+AZVOprz/G4318OlGwwg77nEe+arx0youpXAnaTq3F44LS1zahRPOkMNu j8BMvjc+L3ve1sh5NUPcc81wt/HtKOyWjx1ur14GX4OjqN5/06NZhxV2/8pt8CUj sVuHsZZXZf2BE67jftgHk+eap0xic1MhvVW7nfBwZIs1DWbQoI1sfEGvLRKG1s+y jdC8Asc+IJ623sFa1+jT =45JF -----END PGP SIGNATURE-----