Re: Penalty of SELinux?

2007-09-29 Thread Douglas A. Tutty
On Thu, Sep 27, 2007 at 07:55:47PM +0200, Michelle Konzack wrote: Am 2007-09-23 11:14:57, schrieb Douglas A. Tutty: On small systems, what about the penalty of just larger binaries? I have some older boxes with 16-64 MB ram. Doug. - END OF REPLIED MESSAGE

Re: Penalty of SELinux?

2007-09-28 Thread Chris Bannister
On Sun, Sep 23, 2007 at 11:13:13AM -0400, Douglas A. Tutty wrote: Linux's target is the modern desktop and the focus is on keeping up with new hardware. The BSDs keep the drivers for old hardware but patches require building and that building relies on gcc which isn't optimized for use on old

Re: Penalty of SELinux?

2007-09-27 Thread Michelle Konzack
Am 2007-09-22 11:29:09, schrieb Douglas A. Tutty: I run a bunch of old machines. Now that SELinux is integrated (compiled in) to various pieces of Debian, is there a penalty even if its not activated? Thanks, Doug. - END OF REPLIED MESSAGE

Re: Penalty of SELinux?

2007-09-27 Thread Michelle Konzack
Am 2007-09-24 10:01:12, schrieb David Brodbeck: Same basic problem, I think. To apply security patches you have to recompile. To recompile, you have to use GCC, which is a resource hog. You'd get old and die waiting for make world to finish on a machine with 64 megs of RAM. One

Re: Penalty of SELinux?

2007-09-27 Thread Michelle Konzack
Am 2007-09-24 18:16:32, schrieb Mike McCarty: I beg to differ. One of the selling points of DSL is that it has a small RAM footprint. I have run it on a 486 with 16MB of RAM. I was runnin Debian GNU/Linux 2.1 Slink on a Tohiba T1950CT with a 486dx50 and 12 MByte of Ram. in 2005 I have up

Re: Penalty of SELinux?

2007-09-27 Thread Michelle Konzack
Am 2007-09-23 11:14:57, schrieb Douglas A. Tutty: On small systems, what about the penalty of just larger binaries? I have some older boxes with 16-64 MB ram. Doug. - END OF REPLIED MESSAGE - Look at http://www.ebay.com/ to get FPM's for

Re: Penalty of SELinux?

2007-09-27 Thread Michelle Konzack
Hi John and *, Am 2007-09-23 20:08:04, schrieb John Hasler: consultores writes: The real problem with SELinux is that it come from a really well known untrusted organization around the globe... Has it occurred to you that if NSA wanted to slip a backdoor into Linux and thought that they

Re: Penalty of SELinux?

2007-09-27 Thread Michelle Konzack
Am 2007-09-24 17:26:01, schrieb Ron Johnson: On 09/24/07 15:46, David Brodbeck wrote: But if you're worried that the NSA is targeting you, you've got a lot of more serious concerns. Your monitor is radiating signals that can be picked up and decoded. Even LCD monitors? YES. Even

Re: Penalty of SELinux?

2007-09-27 Thread Michelle Konzack
Am 2007-09-24 22:16:02, schrieb Mumia W..: However, the dependency upon SElinux is more recent. There may be time to remove it before it becomes too entrenched and before its tentacles probe too deeply into Debian. I hope it's not too late. I wish I'd educated myself about SELinux

Re: Penalty of SELinux?

2007-09-27 Thread Michelle Konzack
Am 2007-09-25 03:11:39, schrieb Mike McCarty: It would take more than just kernel, of course. I am investigating LFS. Gentoo seems to have accepted SELinux as well, though since it is a source distro most of the work would be easier in that case, perhaps. And where is the problem with Debian?

Re: Penalty of SELinux?

2007-09-27 Thread Mike McCarty
Michelle Konzack wrote: Am 2007-09-25 03:11:39, schrieb Mike McCarty: It would take more than just kernel, of course. I am investigating LFS. Gentoo seems to have accepted SELinux as well, though since it is a source distro most of the work would be easier in that case, perhaps. And where is

Re: Penalty of SELinux?

2007-09-27 Thread David Brodbeck
On Sep 27, 2007, at 10:54 AM, Michelle Konzack wrote: Am 2007-09-24 10:01:12, schrieb David Brodbeck: Same basic problem, I think. To apply security patches you have to recompile. To recompile, you have to use GCC, which is a resource hog. You'd get old and die waiting for make world to

Re: Penalty of SELinux?

2007-09-27 Thread consultores agropecuarios
El jue, 27-09-2007 a las 19:54 +0200, Michelle Konzack escribió: Am 2007-09-22 11:29:09, schrieb Douglas A. Tutty: I run a bunch of old machines. Now that SELinux is integrated (compiled in) to various pieces of Debian, is there a penalty even if its not activated? Thanks,

Re: Penalty of SELinux?

2007-09-25 Thread Mike McCarty
Manoj Srivastava wrote: On Mon, 24 Sep 2007 18:54:34 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: On Mon, 24 Sep 2007 18:21:16 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: Firstly: Very few packages have been actively patched to link Something

Re: Penalty of SELinux?

2007-09-25 Thread Kevin Mark
On Tue, Sep 25, 2007 at 03:11:39AM -0500, Mike McCarty wrote: Manoj Srivastava wrote: On Mon, 24 Sep 2007 18:54:34 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: On Mon, 24 Sep 2007 18:21:16 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote:

Re: Penalty of SELinux?

2007-09-25 Thread Ron Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/24/07 22:16, Mumia W.. wrote: On 09/24/2007 07:52 PM, Miles Bader wrote: Mike McCarty [EMAIL PROTECTED] writes: even 708 old hardware seems to be running it fine for me. My objection is to having on my machine at all. I object to having

Re: Penalty of SELinux?

2007-09-25 Thread Manoj Srivastava
On Tue, 25 Sep 2007 03:11:39 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: On Mon, 24 Sep 2007 18:54:34 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: On Mon, 24 Sep 2007 18:21:16 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava

Re: Penalty of SELinux?

2007-09-25 Thread Manoj Srivastava
on pathname don't get you there. There is no system view in AA, just a bunch of disconnected profiles. Bad security is dangerous, really dangerous. As an aside on the penalty of SELinux, the upfront labeling cost of labeled MAC is not characteristically different

Re: Penalty of SELinux?

2007-09-25 Thread Mumia W..
On 09/25/2007 08:41 AM, Ron Johnson wrote: On 09/24/07 22:16, Mumia W.. wrote: [...] Your Debian machine is probably not dependent upon tcl, but Debian has been dependent upon python for a long time. Base install is dependent on Python? I find that very hard to believe. Well what do you

Re: Penalty of SELinux?

2007-09-25 Thread Mike McCarty
Manoj Srivastava wrote: On Tue, 25 Sep 2007 03:11:39 -0500, Mike McCarty [EMAIL PROTECTED] said: [snip] packages. It is fewer than that. Compared to 10k source packages, however, even the bloated figure of 50 is few. BTW, I count 29 packages. I was using the published figure for Red Hat.

Re: Penalty of SELinux?

2007-09-25 Thread Manoj Srivastava
On Tue, 25 Sep 2007 11:28:13 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: As I said, it might be a good starting place. If the patching of the source is done right, it's dependent upon a define anyway. I don't have high hopes for that. All the patches I have

OT: Alternative OSes [was Re: Penalty of SELinux?]

2007-09-24 Thread Andrew Sackville-West
On Sun, Sep 23, 2007 at 10:30:38PM -0400, Douglas A. Tutty wrote: On Sun, Sep 23, 2007 at 03:43:11PM -0700, Andrew Sackville-West wrote: On Sun, Sep 23, 2007 at 11:13:13AM -0400, Douglas A. Tutty wrote: I know there are minidistros like DSL but DSL is small as in how much can they

Re: Penalty of SELinux?

2007-09-24 Thread David Brodbeck
On Sep 23, 2007, at 8:27 AM, Ron Johnson wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/23/07 10:13, Douglas A. Tutty wrote: [snip] My biggest problem is that there is not OS designed to be great for a stand-alone old small computer. An OS that can both fit on small resources,

Re: Penalty of SELinux?

2007-09-24 Thread Ron Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/24/07 12:01, David Brodbeck wrote: On Sep 23, 2007, at 8:27 AM, Ron Johnson wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/23/07 10:13, Douglas A. Tutty wrote: [snip] My biggest problem is that there is not OS designed to

Re: Re: Penalty of SELinux?

2007-09-24 Thread heaven . cassanova
give me some sex clips -- This message was sent on behalf of [EMAIL PROTECTED] at openSubscriber.com http://www.opensubscriber.com/message/debian-user@lists.debian.org/7633342.html -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Penalty of SELinux?

2007-09-24 Thread John Stumbles
Manoj Srivastava wrote: On Sun, 23 Sep 2007 17:13:59 -0700, consultores agropecuarios [EMAIL PROTECTED] said: The real problem with SELinux is that it come from a really well known untrusted organization around the globe; This is one place I differ. I know and like Stephen

Re: Penalty of SELinux?

2007-09-24 Thread David Brodbeck
On Sep 24, 2007, at 1:24 PM, John Stumbles wrote: Manoj Srivastava wrote: On Sun, 23 Sep 2007 17:13:59 -0700, consultores agropecuarios [EMAIL PROTECTED] said: The real problem with SELinux is that it come from a really well known untrusted organization around the globe; This is

Re: Penalty of SELinux?

2007-09-24 Thread Ron Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/24/07 15:46, David Brodbeck wrote: [snip] But if you're worried that the NSA is targeting you, you've got a lot of more serious concerns. Your monitor is radiating signals that can be picked up and decoded. Even LCD monitors?

Re: Penalty of SELinux?

2007-09-24 Thread David Brodbeck
On Sep 24, 2007, at 3:26 PM, Ron Johnson wrote: But if you're worried that the NSA is targeting you, you've got a lot of more serious concerns. Your monitor is radiating signals that can be picked up and decoded. Even LCD monitors? Them too:

Re: Penalty of SELinux?

2007-09-24 Thread Mike McCarty
Douglas A. Tutty wrote: Its not their thing either. I know there are minidistros like DSL but DSL is small as in how much can they pack onto a small CD, not how to shoehorn into 16-32 MB ram. I'm also not sure how they keep up with security fixes. I beg to differ. One of the selling points

Re: Penalty of SELinux?

2007-09-24 Thread Mike McCarty
Manoj Srivastava wrote: On Sun, 23 Sep 2007 11:14:57 -0400, Douglas A Tutty [EMAIL PROTECTED] said: On small systems, what about the penalty of just larger binaries? I have some older boxes with 16-64 MB ram. Firstly: Very few packages have been actively patched to link

Re: Penalty of SELinux?

2007-09-24 Thread Mike McCarty
consultores agropecuarios wrote: The real problem with SELinux is that it come from a really well known untrusted organization around the globe; and if the Debian Team accep it blindly, Debian is going to become as Windows; remember that, who I don't think anyone has accepted SELinux blindly.

Re: Penalty of SELinux?

2007-09-24 Thread Manoj Srivastava
On Mon, 24 Sep 2007 21:24:10 +0100, John Stumbles [EMAIL PROTECTED] said: Manoj Srivastava wrote: On Sun, 23 Sep 2007 17:13:59 -0700, consultores agropecuarios [EMAIL PROTECTED] said: The real problem with SELinux is that it come from a really well known untrusted organization around the

Re: Penalty of SELinux?

2007-09-24 Thread Manoj Srivastava
On Mon, 24 Sep 2007 18:21:16 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: On Sun, 23 Sep 2007 11:14:57 -0400, Douglas A Tutty [EMAIL PROTECTED] said: On small systems, what about the penalty of just larger binaries? I have some older boxes with 16-64 MB ram.

Re: Penalty of SELinux?

2007-09-24 Thread Mike McCarty
Manoj Srivastava wrote: On Mon, 24 Sep 2007 18:21:16 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: Firstly: Very few packages have been actively patched to link Something like 50 or so. ls, mv, cp, etc. Source packages. All those are from coreutils, no? I

Re: Penalty of SELinux?

2007-09-24 Thread Ron Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/24/07 17:43, David Brodbeck wrote: On Sep 24, 2007, at 3:26 PM, Ron Johnson wrote: But if you're worried that the NSA is targeting you, you've got a lot of more serious concerns. Your monitor is radiating signals that can be picked up and

Re: Penalty of SELinux?

2007-09-24 Thread Ron Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/24/07 18:23, Mike McCarty wrote: consultores agropecuarios wrote: The real problem with SELinux is that it come from a really well known untrusted organization around the globe; and if the Debian Team accep it blindly, Debian is going to

Re: Penalty of SELinux?

2007-09-24 Thread Miles Bader
Mike McCarty [EMAIL PROTECTED] writes: even 708 old hardware seems to be running it fine for me. My objection is to having on my machine at all. I object to having python and tcl on my machine. -Miles -- `There are more things in heaven and earth, Horatio, Than are dreamt of in your

Re: Penalty of SELinux?

2007-09-24 Thread Steve Lamb
Miles Bader wrote: I object to having python and tcl on my machine. I can understand TCL but Python, c'mon, that's just crazy talk! -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Penalty of SELinux?

2007-09-24 Thread Mumia W..
On 09/24/2007 07:52 PM, Miles Bader wrote: Mike McCarty [EMAIL PROTECTED] writes: even 708 old hardware seems to be running it fine for me. My objection is to having on my machine at all. I object to having python and tcl on my machine. -Miles Your Debian machine is probably not

Re: Penalty of SELinux?

2007-09-24 Thread Manoj Srivastava
On Mon, 24 Sep 2007 18:54:34 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: On Mon, 24 Sep 2007 18:21:16 -0500, Mike McCarty [EMAIL PROTECTED] said: Manoj Srivastava wrote: Firstly: Very few packages have been actively patched to link Something like 50 or so. ls,

Re: Penalty of SELinux?

2007-09-24 Thread Manoj Srivastava
On Mon, 24 Sep 2007 22:16:02 -0500, Mumia W [EMAIL PROTECTED] said: On 09/24/2007 07:52 PM, Miles Bader wrote: Mike McCarty [EMAIL PROTECTED] writes: even 708 old hardware seems to be running it fine for me. My objection is to having on my machine at all. I object to having python and tcl

Re: Penalty of SELinux?

2007-09-23 Thread Douglas A. Tutty
On Sat, Sep 22, 2007 at 09:51:52PM -0500, Ron Johnson wrote: On 09/22/07 20:44, Douglas A. Tutty wrote: Well, it speeded up somewhat by ditching the install-by-default locales stuff and sticking with 'C'. I use icewm. On Etch, xorg takes a lot more memory than on OBSD. Enough that with

Re: Penalty of SELinux?

2007-09-23 Thread Douglas A. Tutty
On Sat, Sep 22, 2007 at 11:38:29PM -0500, Manoj Srivastava wrote: On Sat, 22 Sep 2007 11:29:09 -0400, Douglas A Tutty [EMAIL PROTECTED] said: I run a bunch of old machines. Now that SELinux is integrated (compiled in) to various pieces of Debian, is there a penalty even if its not

Re: Penalty of SELinux?

2007-09-23 Thread Ron Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/23/07 10:13, Douglas A. Tutty wrote: [snip] My biggest problem is that there is not OS designed to be great for a stand-alone old small computer. An OS that can both fit on small resources, and be kept up-to-date without a separate build

Re: Penalty of SELinux?

2007-09-23 Thread Henrique de Moraes Holschuh
On Sun, 23 Sep 2007, Douglas A. Tutty wrote: On small systems, what about the penalty of just larger binaries? I have some older boxes with 16-64 MB ram. Ever looked at just how many 'non-essential' libs we link (from a small-system PoV)? Debian is *not* the distro for anyone that needs to

Re: Penalty of SELinux?

2007-09-23 Thread Manoj Srivastava
On Sun, 23 Sep 2007 11:14:57 -0400, Douglas A Tutty [EMAIL PROTECTED] said: On small systems, what about the penalty of just larger binaries? I have some older boxes with 16-64 MB ram. Firstly: Very few packages have been actively patched to link with selinux. Second, the selinux

Re: Penalty of SELinux?

2007-09-23 Thread Alex Samad
On Sun, Sep 23, 2007 at 11:13:13AM -0400, Douglas A. Tutty wrote: On Sat, Sep 22, 2007 at 09:51:52PM -0500, Ron Johnson wrote: On 09/22/07 20:44, Douglas A. Tutty wrote: Well, it speeded up somewhat by ditching the install-by-default locales stuff and sticking with 'C'. I use icewm. On

Re: Penalty of SELinux?

2007-09-23 Thread Andrew Sackville-West
On Sun, Sep 23, 2007 at 11:13:13AM -0400, Douglas A. Tutty wrote: On Sat, Sep 22, 2007 at 09:51:52PM -0500, Ron Johnson wrote: On 09/22/07 20:44, Douglas A. Tutty wrote: Well, it speeded up somewhat by ditching the install-by-default locales stuff and sticking with 'C'. I use icewm. On

Re: Penalty of SELinux?

2007-09-23 Thread consultores agropecuarios
El dom, 23-09-2007 a las 14:41 -0500, Manoj Srivastava escribió: On Sun, 23 Sep 2007 11:14:57 -0400, Douglas A Tutty [EMAIL PROTECTED] said: On small systems, what about the penalty of just larger binaries? I have some older boxes with 16-64 MB ram. Firstly: Very few packages

Re: Penalty of SELinux?

2007-09-23 Thread John Hasler
consultores writes: The real problem with SELinux is that it come from a really well known untrusted organization around the globe... Has it occurred to you that if NSA wanted to slip a backdoor into Linux and thought that they could slip it past all the prying eyes that they just might be

Re: Penalty of SELinux?

2007-09-23 Thread Manoj Srivastava
On Sun, 23 Sep 2007 17:13:59 -0700, consultores agropecuarios [EMAIL PROTECTED] said: The real problem with SELinux is that it come from a really well known untrusted organization around the globe; This is one place I differ. I know and like Stephen Smalley, and I do not look at

Re: Penalty of SELinux?

2007-09-23 Thread Douglas A. Tutty
On Sun, Sep 23, 2007 at 03:43:11PM -0700, Andrew Sackville-West wrote: On Sun, Sep 23, 2007 at 11:13:13AM -0400, Douglas A. Tutty wrote: I know there are minidistros like DSL but DSL is small as in how much can they pack onto a small CD, not how to shoehorn into 16-32 MB ram. I'm also

Penalty of SELinux?

2007-09-22 Thread Douglas A. Tutty
I run a bunch of old machines. Now that SELinux is integrated (compiled in) to various pieces of Debian, is there a penalty even if its not activated? Thanks, Doug. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Penalty of SELinux?

2007-09-22 Thread Henrique de Moraes Holschuh
On Sat, 22 Sep 2007, Douglas A. Tutty wrote: Now that SELinux is integrated (compiled in) to various pieces of Debian, is there a penalty even if its not activated? Apart from one copy of the libs on RAM that is shared by all other stuff, and (maybe) some extra grow in the data segments, no.

Re: Penalty of SELinux?

2007-09-22 Thread Douglas A. Tutty
On Sat, Sep 22, 2007 at 07:39:49PM -0300, Henrique de Moraes Holschuh wrote: On Sat, 22 Sep 2007, Douglas A. Tutty wrote: Now that SELinux is integrated (compiled in) to various pieces of Debian, is there a penalty even if its not activated? Apart from one copy of the libs on RAM that is

Re: Penalty of SELinux?

2007-09-22 Thread Henrique de Moraes Holschuh
On Sat, 22 Sep 2007, Douglas A. Tutty wrote: Apart from one copy of the libs on RAM that is shared by all other stuff, and (maybe) some extra grow in the data segments, no. And if you care about that, you'd better be pissed off at something else than SE Linux, which is small... we have

Re: Penalty of SELinux?

2007-09-22 Thread Douglas A. Tutty
On Sat, Sep 22, 2007 at 09:44:36PM -0300, Henrique de Moraes Holschuh wrote: I know. my 486 won't run debian anymore. Not enough ram. Runs great with OBSD. My P-II runs quite slow with Etch (OK with Sarge). Also runs great with OBSD. Etch should run great on a P-II, as long as you

Re: Penalty of SELinux?

2007-09-22 Thread Ron Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/22/07 20:44, Douglas A. Tutty wrote: On Sat, Sep 22, 2007 at 09:44:36PM -0300, Henrique de Moraes Holschuh wrote: I know. my 486 won't run debian anymore. Not enough ram. Runs great with OBSD. My P-II runs quite slow with Etch (OK with

Re: Penalty of SELinux?

2007-09-22 Thread Manoj Srivastava
On Sat, 22 Sep 2007 11:29:09 -0400, Douglas A Tutty [EMAIL PROTECTED] said: I run a bunch of old machines. Now that SELinux is integrated (compiled in) to various pieces of Debian, is there a penalty even if its not activated? Not that one can discern. An active SELinux running in