I've been using OpenBSD for a while now which has priv dropping X and the machdep.allowaperture=[0|1|2]. Theo has said firefox also annoyingly uses it's own memory management.
I have a few questions about Grsec that I'd love some input on as I am struggling to find the answers to them at the moment. I've read on the Gentoo-hardened archive and grsec config help that the iopl and ioperm should be protected with rbac if priviledged I/O is allowed. So you can disable the RAW_IO capability to all and sacrifice xrestarts. But if X already has all priviledges then I guess your just adding a hurdle which is made a bit higher with grsec, so obfuscation really and not complete security. Is there anything else you can do or is that what is meant by "You should use RBAC if you allow priviledged I/O"? The gentoo-handbook says something like the question of selinux|rbac| rsbac is a controversial one. It seems rsbac is the most secure but more difficult to use and has less starter policies around. Gentoo seems to have selinux policies. Does selinux have any more to offer than rbac for protecting X? Does CONFIG_PAX_MPROTECT_COMPAT have any effect on firefox and did mozilla refuse to patch their sources with the if !jit patch? Thanks Kc
