[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Hardening

From: ng0
Subject: Re: Hardening
Date: Mon, 30 Jan 2017 12:16:01 +0000

ng0 <address@hidden> writes:

> Ludovic Courtès <address@hidden> writes:
>> Hi!
>> ng0 <address@hidden> skribis:
>>> For starters, I think we could have an "hardened-wip" branch on
>>> savannah (I can't commit anyway directly) and that we can target
>>> SELinux for now, look at Hardened-gentoo and other systems how
>>> they solve issues.  Afterwards we need to address the toolchain
>>> level, which to our advantage can be an make and break by hydra
>>> and everyone who wants to contribute to fixing issues can run
>>> their system from the hardening-toolchain-wip branch to
>>> contribute to fixing all the breaking applications.
>>> Then we need to discuss wether we want to provide this by default
>>> (my choice) OR if we want to offer a branch-choice model.
>>> Supporting both vanilla and hardened might take some more burden
>>> on fixing issues, that's why I'm all for forming a team of people
>>> who work on this, and when they no longer want to, other people
>>> join the rest of the old team, etc.
>> Before creating a branch, I think we need a plan.  :-)
>> Alex Vong proposed ways to achieve it a while back:
>> I suggest taking a look at the discussion and starting from there.
> Okay, I did and I don't see right now how this new (guix build
> build-flags) module would be applied to the gnu build system for
> example.
> Would the (gnu build system) just use it somehow? I'd like to
> test it, but I didn't write it.

Sorry, correction:
I must have skipped the explanation at the beginning, I do
understand it.
And it makes sense… it's in the interest of my blend of GuixSD,
so unless someone really has a burning desire to work on this, I
will try to produce something functional with changes to the
build system(s) to use hardened flags by default, with opt-out
for: other build-systems I do not understand, and whatnot.
There's no harm in not providing something like:

  #:hardened? #f

for those applications which still need to be patched, but I
prefer to fix rather than provide the easy way out.

> I also would like to rename it to (guix build build-flags-glibc)
> (or -gcc) as I want to see a point where we have more than just
> glibc. We don't have to build them (the substitutes,packages) all
> on hydra. musl and uclibc-ng can be without substitutes as long
> as the means of distribution or diskspace are not working out for us.
> And both can (and will) get hardened builds aswell.
>> The best option is probably to start small (limited set of
>> features/flags/options) and then incrementally improve that.
>> Ludo’.
> -- 
> ng0 --

ng0 --

reply via email to

[Prev in Thread] Current Thread [Next in Thread]