Hi! On Fri, Apr 10, 2009 at 11:35:36AM +0800, Pavel Labushev wrote: > A simple cron job or slightly-less-simple RBAC policy can do the trick. > There's no need to mess with portage, imho.
Cron job is just waste of time (this is one-time task after installing package, not once-per-minute task) and race condition (after installing package but before running cron job it may be run and will segfault). That's not mess with portage because portage right now control PaX flags for many packages anyway. But it doesn't set PaX flags for firefox or mplayer, because they able to work without this (if you don't use flash with firefox and don't use win32codecs with mplayer) and probably because these packages unlikely will be installed on hardened server. Also using given /etc/portage/bashrc I not only set paxctl -m, but also switch gcc to hardened-nossp while compiling several packets (to workaround http://bugs.gentoo.org/show_bug.cgi?id=217112) and rebuild CPAN module Scalar::Util after recompiling perl (needed because I don't use portage to manage perl modules). So, it used not to mess with portage, but to automate some tasks required while/after emerging packages to keep system working in my configuration. -- WBR, Alex.
