Re: SLFS as an extention to LFS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Robert Day schrieb:
> Anyhow, if it is decided finally that SLFS is to be patched into LFS,
> then I cannot change that, but I also cannot help much. It goes against
> what I believe security to be, and until it is complete, and prooven to
> be secure, and stable as the goals dictate it is to be, I can't trust it
> - I would feel constantly like I am building Fort Knox on top of a
> sandpit, instead of a reinforced concrete foundation with all the latest
> alarm technology.

Well, there have been people who tried the same. The whole thing is a
microkernel that was verified as far as possible.

http://os.inf.tu-dresden.de/vfiasco/

Indeed, you have the problem that you need to build a system completely
new and examine every part under the security aspect. Entire research
groups have worked on this. vfiasco is not the only example for this,
another one is mikrosina.

http://os.inf.tu-dresden.de/mikrosina

You might want to read into that to get some idea of how you can
approach the whole thing.

I love your idea and a lot of other people do, at least from what I
heard from some students here in the department for computer science
(I'm a stundent myself).

There's one thing that mikrosina and vfiasco tell us: until the kernel
is not secure and proven, all other security measures are a Fort Knox
build on a sandpit.
So there's a serios point in not using the latest kernel but a version
that has been quite long released ... this one was tested for a longer
time and it's less likely to find another vulnerability. Or you might
even try to use a microkernel, this would be a quite interesting task,
because you can use fiasco and then put an L4 on it but only with a
kernel version 2.2.*.

Regards,

Björn Thalheim


- -- 
* Knghtbrd notes he has mashed potatoes for brains tonight
<Valkyrie> yum, can I have some?
<Knghtbrd> um ...
* Knghtbrd hides from Valkyrie
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE/6Xuvc9uiQ6kr+VcRAvSkAKCMgwTJlc7WB7GNr99HmrdGRgf5lgCfQOPV
JojhX4SkWBCoUJC7debOrbg=
=cSN0
-----END PGP SIGNATURE-----


-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page