Re: Secure Linux From Scratch
ashes <[email protected]>
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Organization | Utopia Inc |
| Message-ID | <[email protected]> |
I have been actively developing a hardened Linux from Scratch for about a month or two. I have propolice, gcc-3.4's -pie backport, which takes advatage of the Pax kernel patch for randomized memory address space, and the entire LFS system builds with both protections with the exception of the kernel itself, and grub. Adding a read only encrypted filesystem would be trivial. Building a trusted system takes a trusted host system. In my opinion it would take two simutainious LFS builds to construct a trusted system (trusted by us). If there is enough interest in designing a Secure LFS book count me in. We will need some sort of website and maybe a seperate mailing list. More importantly we need a security policy for the design. What I consider important to security maybe isn't what others think. I have also been doing some light auditing, the grades depend on version of the software. For example coreutils-5.0.91 software was less submissive to attack then coreutils-5.0 (using bfbtester). I am not too impressed with selinux, it's policies are not manditory; the attacker just needs to exploit a protocol not recognised by selinux, such as ipv6 (who knows what else). I would also like to note there are countless "secure" linux implementations, and if we are to start a new one it better be good or its not worth doing. In most, if not all, distributions, security is sacrificed for marketing and user friendlyness. I dont mean this as a rant, but more as the truth, systems like debain, gentoo, redhat, and even openbsd, care more about the money in their pocket then the quality of the system they ship. I hope this is where LFS is different since its not marketed for the masses. Security starts with the toolchain, and no software is exempt from audit. Sorry for the late follow up. -- cendres at videotron dot ca gpg --keyserver wwwkeys.pgp.net --recv-keys 0xD4E26E10 -- http://linuxfromscratch.org/mailman/listinfo/lfs-security FAQ: http://www.linuxfromscratch.org/faq/ Unsubscribe: See the above information page