On Vas, Április 12, 2009 02:03, Grant wrote: >> If you employ GRsecurity's RBAC, you can use PAX flags, like >> "PAX_MPROTECT" on a given subject (binary). Take a look at on the >> example >> policy file. > > Do you guys think RBAC or /etc/portage/bashrc is a better choice for > this? Maybe RBAC is overkill if this is all I'll be using it for? >
It takes time to refine a policy and it needs some tuning from time to time. If you haven't utilized any RBAC (Grsecurity, RSBAC) on your system yet, it's high time to give it a try. So I should say, that bashrc is not the best choice from the security point of view, but in the mean time it's not an overkill either... Regards: Dw. > >>>>>> and create executable shell script in that dir: >>>>>> mozilla-firefox-bin.postinst >>>>>> ---cut--- >>>>>> #!/bin/bash >>>>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on >>>>>> flash!" >>>>>> chpax -m /opt/firefox/firefox-bin >>>>>> ---cut--- >>>>>> >>>>> >>>>> Of course, if you compile firefox instead of using firefox-bin, then >>>>> file >>>>> should be named mozilla-firefox.postinst and you should use there >>>>> paxctl >>>>> instead of chpax. >>>>> >>>> A simple cron job or slightly-less-simple RBAC policy can do the >>>> trick. >>>> There's no need to mess with portage, imho. >>> >>> Thanks for the suggestions everyone. I think this type of persistence >>> should be built into portage. Maybe /etc/portage/package.nomprotect. >>> Do you agree? Should I file a bug? >>> >>> - Grant >
