Re: SLFS book

This is the direction I'm headed:

Beta1

Propolice
A model for user lfs to be used for all code building in chapter 6 and beyond.
Read only / on first boot. Strict mount permissions.
Create chroot user policy.
Chroot syslogd.
I think it looks like we're going to need specific cflags for each package.
Consider testing optimizations.

Release 1.0

Iptables on first boot, assuming TCP/IP is installed.
GCC -pie will be released in gcc-3.4
Support will be added in glibc-2.3.3
And to binutils-2.14+
Non executable stack on first boot.
Root will not run any daemons on networking ports.

I think it would be a good idea to rewrite the propolice hint, and maybe more, 
so people can install propolice without SLFS, to satisfy both angles. This 
can be done whereever posible. And perhaps updated in the LFS security hint. 
Some people will only want propolice on apache, or whatever. The SLFS book 
would show all posible security implementations from a standalone install. We 
need to keep it all in one procedure so we know the system can rebuild 
itself. Already I see gcc pass 1 should build C++ so -pie or 
-fstack-protector can be in CXXFLAGS for building glibc chapter 5.

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page