Re: server and client in one package -> security issue (was: Add murmur)

[ng0]

On 17-02-14 10:16:51, Danny Milosavljevic wrote:
> Hi,
> 
> I think the argument that things that don't exist can't be abused is a good 
> one.
> 
> However, a regular user can install it anyway. I don't remember when I last 
> ran "guix package -i" as root. I just run it using my regular user account.
> 
> So to separate the outputs adds just a miniscule step.
> 
> In the end, there's a trade-off to be made. Either we trust users to develop, 
> too, or not. Obviously they can use it for good or bad, then. 
> 
> I myself am a free software hacker and I'd prefer if systems automatically 
> had the development stuff installed so others can be free software hackers, 
> too.
> 
> And an experienced hacker doesn't need header files either. I made up some of 
> my own just searching Google - it's not difficult and takes about 30 min at 
> most.
> 
> If we want hardened critical production systems, I agree it should only 
> contain absolutely required files with programs as simple as one can get 
> them, use SELinux and use hardened gcc and someone should have reviewed the 
> base libraries and any other stuff that runs (basically until a reasonable 
> confidence level is reached).
> 
> I don't think Guix should do that, though. IMO locking down everything for 
> users is basically the antithesis of the FSF.
> 

Interjecting here my opinion for a short moment, I think with hardening
gcc and other parts of the toolchain more can be achieved.
I don't want to be too optimistic, but I hope to be done with one part
of this by summer (doing work in parallel).

Whatever results from this discussion should be written down in the
documentation, as this is obviously an impression and question which
could arise.

What makes my gut feeling (practical experience with hardening is
limited to the SysOps and compiling side with me) okay is that Gentoo
doesn't do much more than some Elf, PaX kernel (at your choice), GrSec
or SELinux, some tools for pax etc, and hardening the libcs.

-- 
ng0 -- https://www.inventati.org/patternsinthechaos/