Re: Agenda for the meeting 2013-10-24 20:00UTC

On 10/22/2013 07:52 PM, Rick "Zero_Chaos" Farina wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 10/22/2013 02:15 PM, Anthony G. Basile wrote:
>> On 10/22/2013 02:06 PM, Anthony G. Basile wrote:
>>> On 10/22/2013 01:09 PM, Rick "Zero_Chaos" Farina wrote:
>>>> 4.0 Selinux 5.0 System Integrity 6.0 Profile I'd like to
>>>> specifically discuss bringing back the desktop profile by user
>>>> request.
>>>>
>>>>
>>> The old desktop/server/developer profiles were removed for a
>>> good reason.  They cannot stack properly given their directory
>>> location and conflicting inheritance requirements.  We cannot
>>> bring them back as they were else we will re-introduce the
>>> ancient multilib vs non-mutlilib selinux issue in one
>>> manifestation or another.
>>>
>>> Nonetheless, I think a desktop profile for hardened is possible
>>> along the lines of what was done for selinux, ie put it in
>>> features.  Only if the desktop profile lands at the very bottom
>>> of the profile stack will this work.  Alternatively, you can
>>> duplicate the desktop profile from default/linux in
>>> hardened/linux and do a simple inheritance from its parent.  This
>>> "duplication" would really not be much of a duplication because
>>> there's probably stuff you want to tweak for your own purposes.
>>>
>>> I was going to remove those deprecated directories today, but I
>>> can hold off.  To be clear, I'm not against a hardened desktop
>>> profile, just not the implementation we had which was broken.
>>>
>> Actually I was wrong in saying "only if it lands at the bottom of
>> the profile stack" ... That is in fact the problem:
>>
>> /usr/portage/profiles/base /usr/portage/profiles/default/linux
>> /usr/portage/profiles/arch/base
>> /usr/portage/profiles/features/multilib
>> /usr/portage/profiles/features/multilib/lib32
>> /usr/portage/profiles/arch/amd64 /usr/portage/profiles/releases
>> /usr/portage/profiles/eapi-5-files
>> /usr/portage/profiles/releases/13.0
>>
>> /usr/portage/profiles/hardened/linux
>> /usr/portage/profiles/hardened/linux/amd64
>> /usr/portage/profiles/targets/desktop
>> /usr/portage/profiles/hardened/linux/amd64/desktop
>>
>> So "profiles/targets/desktop" basically trump
>> "profiles/hardened/linux/amd64" which is the problem: a
>> non-hardened profile can undo the hardening.  We have to get
>> something like this:
>>
>>
>> /usr/portage/profiles/base /usr/portage/profiles/default/linux
>> /usr/portage/profiles/arch/base
>> /usr/portage/profiles/features/multilib
>> /usr/portage/profiles/features/multilib/lib32
>> /usr/portage/profiles/arch/amd64 /usr/portage/profiles/releases
>> /usr/portage/profiles/eapi-5-files
>> /usr/portage/profiles/releases/13.0
>>
>> /usr/portage/profiles/targets/desktop
>> /usr/portage/profiles/hardened/linux
>> /usr/portage/profiles/hardened/linux/amd64
>>
> I was essentially thinking to make a /desktop directory in each
> profile and then parent would be targets/desktop and .. to ensure
> hardened overrides default.  Certainly it is not perfect and some
> things from desktop may be lost, but it's a lot better than not having
> a desktop profile at all.
>
> - -Zero

If the parent file has

..
../../../../targets/desktop

then you get the above order with targets/desktop trumping 
hardened/amd64 which is bad.  If the order is

../../../../targets/desktop
..

then you get and even worse stacking where target/desktop is prior to base.

/usr/portage/profiles/targets/desktop
/usr/portage/profiles/base
/usr/portage/profiles/default/linux
/usr/portage/profiles/arch/base
/usr/portage/profiles/features/multilib
/usr/portage/profiles/features/multilib/lib32
/usr/portage/profiles/arch/amd64
/usr/portage/profiles/releases
/usr/portage/profiles/eapi-5-files
/usr/portage/profiles/releases/13.0
/usr/portage/profiles/hardened/linux
/usr/portage/profiles/hardened/linux/amd64
/usr/portage/profiles/hardened/linux/amd64/desktop

Because of the way stacking works, you cannot get the desired order by 
inheriting both target/desktop and hardened.  As I said, we removed 
those profiles for a good reason.

-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : [email protected]
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA