Re: Secure Linux From Scratch

Brainstorm:
Grsecurity has trusted path features. Meaning programs which are not in a 
directory owned by root can't be executed. I think normal user should be able 
to run whatever they find on the system, or build. For reasons of trust, I 
think it might be a good idea if root wasn't able to execute programs unless 
root owns the directory. In this case a package-builder, I'll name Bin, would 
own /usr/local, _maybe_ even /usr/bin. So now Bin wouldn't need sudo make 
install to upgrade non vital components, and user Bin wouldn't be able to 
install an suid program without us knowing in advance. This also teaches the 
admin to use root less and less.

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page