[gentoo-dev] Re: Improve the security of the default profile

2013-09-08 Thread Martin Vaeth
Ryan Hill dirtye...@gentoo.org wrote: * -Wl,-z,relro Enabled by default since binutils 2.18 This gives its real impact on secutiry only when combined with * -Wl,-z,now The latter is not enabled by default AFAIK. That's a bit misleading. Immediate binding does allow the GOT to be made

[gentoo-dev] [PATCH systemd.eclass] Introduce systemd_install_serviced().

2013-09-08 Thread Michał Górny
This function can be used to install service configuration templates. Usage: systemd_install_serviced ${FILESDIR}/foo.service.conf or: systemd_install_serviced ${FILESDIR}/barbaz foo.service with the latter specifying related service name explicitly, former expecting it to match

[gentoo-dev] Re: Improve the security of the default profile

2013-09-08 Thread Martin Vaeth
Ryan Hill dirtye...@gentoo.org wrote: Martin Vaeth va...@mathematik.uni-wuerzburg.de wrote: * -fstack-protector{-all} No thank you. -fstack-protector has very limited coverage I'd say it covers most cases where bugs can be made, [...] The numbers I've seen show a maximum of 5% coverage

[gentoo-dev] About perl-5.18 unmasking

2013-09-08 Thread Mikle Kolyada
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi guys! Few days ago i was surprised, when i saw perl-5.18 unhardmasked. So, i want ask here. @Patrick, why you unmask it? You even not ack perl herd about it. It was in the tree about two weeks, too early for unmasking, furthermore, you added

Re: [gentoo-dev] Re: Improve the security of the default profile

2013-09-08 Thread Hinnerk van Bruinehsen
On Sat, Sep 07, 2013 at 07:12:04PM -0400, Rich Freeman wrote: On Sat, Sep 7, 2013 at 7:08 PM, Rick Zero_Chaos Farina zeroch...@gentoo.org wrote: Personally I'm using the hardened profile already and find the performance penalties negligible for a desktop user, and someone trying to run

[gentoo-dev] Reference Implementation for GLEP RAP Draft

2013-09-08 Thread heroxbd
Dear all, We have just pushed out a reference implementation for GLEP RAP (i.e. Prefix with libc) draft: http://article.gmane.org/gmane.linux.gentoo.alt/6663 Hope this will help people grab the idea behind it and help the council review and decide on the GLEP draft[1]. At the moment,

Re: [gentoo-dev] [PATCH systemd.eclass] Introduce systemd_install_serviced().

2013-09-08 Thread Gilles Dartiguelongue
Le dimanche 08 septembre 2013 à 13:12 +0200, Michał Górny a écrit : This function can be used to install service configuration templates. Usage: systemd_install_serviced ${FILESDIR}/foo.service.conf or: systemd_install_serviced ${FILESDIR}/barbaz foo.service with the latter

Re: [gentoo-dev] [PATCH systemd.eclass] Introduce systemd_install_serviced().

2013-09-08 Thread Pacho Ramos
El dom, 08-09-2013 a las 17:14 +0200, Gilles Dartiguelongue escribió: Le dimanche 08 septembre 2013 à 13:12 +0200, Michał Górny a écrit : This function can be used to install service configuration templates. Usage: systemd_install_serviced ${FILESDIR}/foo.service.conf or:

Re: [gentoo-dev] About perl-5.18 unmasking

2013-09-08 Thread Markos Chandras
On 8 September 2013 14:00, Mikle Kolyada zlog...@gentoo.org wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi guys! Few days ago i was surprised, when i saw perl-5.18 unhardmasked. So, i want ask here. @Patrick, why you unmask it? You even not ack perl herd about it. It was in

Re: [gentoo-dev] [PATCH systemd.eclass] Introduce systemd_install_serviced().

2013-09-08 Thread Michał Górny
Dnia 2013-09-08, o godz. 17:14:54 Gilles Dartiguelongue e...@gentoo.org napisał(a): Le dimanche 08 septembre 2013 à 13:12 +0200, Michał Górny a écrit : This function can be used to install service configuration templates. Usage: systemd_install_serviced ${FILESDIR}/foo.service.conf

[gentoo-dev] Re: About perl-5.18 unmasking

2013-09-08 Thread Michael Palimaka
On 9/09/2013 02:40, Markos Chandras wrote: Moreover, I don't think raising this issue to the mailing list is appropriate as a first step. Based on the number of replies to -commits that end up on here, it's no surprise that it can appear appropriate to raise an issue like this here

Re: [gentoo-dev] [PATCH systemd.eclass] Introduce systemd_install_serviced().

2013-09-08 Thread Alexis Ballier
On Sun, 8 Sep 2013 17:46:28 +0200 Michał Górny mgo...@gentoo.org wrote: suffix + + local INSDESTTREE I guess this is a leftover ? Nope. 'insinto' sets INSDESTTREE. Due to lack of proper scoping support in bash, we need to localize this variable to restore previous 'insinto' scope

[gentoo-dev] Re: Improve the security of the default profile

2013-09-08 Thread Ryan Hill
On Sat, 07 Sep 2013 19:08:57 -0400 Rick \Zero_Chaos\ Farina zeroch...@gentoo.org wrote: Personally I think this would be a great stepping stone. If we add - -fstack-protector to 4.8.1 it will improve security (only a little I know) and give us an idea of what issues we may have. After a

[gentoo-dev] Automated Package Removal and Addition Tracker, for the week ending 2013-09-08 23h59 UTC

2013-09-08 Thread Robin H. Johnson
The attached list notes all of the packages that were added or removed from the tree, for the week ending 2013-09-08 23h59 UTC. Removals: kde-misc/todo-list 2013-09-04 16:53:43 creffett dev-python/multiprocessing 2013-09-05 09:55:22 mgorny

[gentoo-dev] Re: Improve the security of the default profile

2013-09-08 Thread Ryan Hill
On Sun, 8 Sep 2013 11:05:16 + (UTC) Martin Vaeth va...@mathematik.uni-wuerzburg.de wrote: Ryan Hill dirtye...@gentoo.org wrote: In any case this is a firm no. The increase in loading times for apps that link lots of libraries is significant (if it wasn't, we wouldn't need lazy loading