hardened desktop

katfish · Tux's lil' helper Joined: 14 Nov 2011 Posts: 147

Since I successfully build my server with PaX and RBACS enabled,
I wanna make use of the hardened toolchain and Pax on my notebook as well.

As building and running the hardened kernel is as easy as the standard kernel,
I'm not sure about the tool chain and the desktop related stuff like console and policy kit.

When I emerge world -uDNt with the hardened profile (hardened/linux/amd64),
Portage wants to rebuild some essential packages without console and polkit...

jpc22 · Apprentice Joined: 29 Jan 2012 Posts: 195

Basicaly your system will begin to pull in packages and install them with the defaults options that have been set for the hardened profile.

Some programs are harder to get working with hardened on certain hardware or with some combination of programs, but just switching to hardened is not going to break as many things as if you were to enable selinux grsec pax and all the other availlable security features at the same time.

Those features basicaly lock many things till you unlock them because you need them. (example: lost usb wireless mice support when i dumbly activated all of those)

If you dont install something preventing you to mount drives automounting should still work.

as for graphical login manager, i cant say, im trying to get it to work on a fresh hardened install for the first time. (doing abuild for my bro and he wants it) personally i dont mind startx from shell.
I dont however think that it is impossible to have graphical login on hardened, might take extra config and workarounds.

Hardened kernels dont play nice with proprietary nvidia drivers, so if you go that route you will likely have to use nouveau.

In doubt make a stage4 before trying in case you want to revert back or mess up something really bad.

Hardened is just a matter of mre config to get things to play nicely with each other in your system.

N8Fear · Posted: Tue Nov 18, 2014 10:08 am Post subject:

If you really want to switch from a non-hardened to a hardened profile you should do the following:
1. switch to hardened profile
2. rebuild gcc, glibc (or other libc - whatever you use) and binutils
3. switch to hardened gcc version (gcc-config -l, use the one that has no nopie, nossp, nopiessp or vanilla - the one without suffix is the actual hardened one)
4. rebuild gcc, glibc and binutils again (this is optional, but recommended, because you make sure that everything works and builds against you hardened toolchain
5. emerge -evDN @world (this rebuilds everything with the hardened toolchain - in theory there are packages that don't need to be rebuild (mostly the non-C/non-C++ ones), but there is no way that I know that you can select just the ones that need to be rebuild).

Done - you can test your system with checksec.sh (--proc-all after reboot) to see that it's actually hardened.

229566 · Tux's lil' helper Joined: 16 Aug 2010 Posts: 127

N8Fear · Posted: Tue Nov 18, 2014 12:36 pm Post subject:

Hardened userland and nvidia is no problem at all. The problems arose from Pax/grsec + nvidia.
Afaik you have to paxmark half of your system (which greatly reduces security, even though it'll likely still be more secure than vanilla), to get X to work. IIRC there was some progress in recent times, though.

Gentoo64 · n00b Joined: 21 Oct 2011 Posts: 52 Location: ::

[quote="N8Fear"]Hardened userland and nvidia is no problem at all. The problems arose from Pax/grsec + nvidia.
Afaik you have to paxmark half of your system (which greatly reduces security, even though it'll likely still be more secure than vanilla), to get X to work. IIRC there was some progress in recent times, though.[/quote]

It works fine with Nvidia, you need to unmask the X USE flag on nvidia-drivers using /etc/portage/profile/use.mask -X, and need to disable opengl on couple of packages like cairo in order to not have to pax -m a ton of stuff X related (opengl is the killer on hardened, will always need -m). I've had a hardened desktop with apparmor and all the hardening in kernel on running for years and really rarely run into any problems. Couple of things need pax -m as I came across them, also be careful of some of the kernel security options, a couple of them can interfere with systemd, zfs and no doubt a load of other stuff but it's pretty easy to figure out with Gentoo being minimal so errors will normally stand out and be quite obvious.

mv · Watchman Joined: 20 Apr 2005 Posts: 6747

N8Fear · Posted: Tue Nov 18, 2014 7:13 pm Post subject:

Gentoo64 · n00b Joined: 21 Oct 2011 Posts: 52 Location: ::

[quote="mv"][quote="Gentoo64"]and need to disable opengl on couple of packages like cairo[/quote]
But do you still get acceptable speed if e.g. you view of movie?
On one of my systems, I had success to use the nvidia kernerl driver and nouveau userland.
However, on another system also nouveau userland is too broken to be used.[/quote]

Yeah all runs completely fine. I use mpv with vdpau and haven't had to pax -m anything.

steveL · Posted: Fri Nov 21, 2014 5:03 am Post subject:

@Gentoo64

Please enable bbcode in your profile, so your quote tags (et al) don't look like crap. ;)