Re: SLFS

On December 22, 2003 02:19 pm, Archaic wrote:
> On Mon, Dec 22, 2003 at 02:02:53PM -0500, ashes wrote:
> > As I suggested before, I would like to see this book begin by developing
> > gcc-3.4, glibc-2.3.3, kernel-2.6. This would put the stable version of
> > the book maybe two years from now (when gcc-3.4 is stabilized). Giving us
> > time to make all kinds of changes.
>
> I see no reason why we should have to wait so long to release a stable
> version of the book. We have enough information floating amongst us to
> produce a more secure system now. We can run propolice and libsafe, drop
> et_dyn, patch security holes in packages, configure for proper logging,
> teach some basics on admin practices, split the filesystems, chroot
> services, restrict perms, etc. We can write what we know now, then
> consider things like grsecurity, selinux, et_dyn, etc. later.

Propolice and libsafe don't actually offer any policy enforcement. Thats what 
we'll need pax and acl's for. Some want a BLFS approach where basicly the 
existing LFS book is patched. While this is faster to produce, its harder to 
enforce a security policy on. How are we supposed to *know* our system is 
secure unless we audit every package one by one. Its not fast or glamours, 
but it is more secure. I feel that we have a lot of catch up to play with the 
other vendors. It wouldn't do anyone a favor to write a book with only basic 
implementations, those books already exist. The release goals must include 
policy enforcement, restrictions on real/local users, something along the 
lines of orange book B1 (with suid proccess accounting). This policy can work 
with a desktop running kde, or of course a router. In the long run the BLFS 
approach will be too hard to manage or audit. We don't need to hurry to 
reinvent the wheel, the stable book should offer something we can't get 
anywhere else, not just a bunch of links. Security without enforcement is 
like a police without a gun, its not much more secure then nothing at all.


-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page