From owner-freebsd-arch Wed Mar 14 18:18: 9 2001 Delivered-To: freebsd-arch@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id 8A33137B718 for ; Wed, 14 Mar 2001 18:18:06 -0800 (PST) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.11.1/8.11.1) with SMTP id f2F2I5h87542 for ; Wed, 14 Mar 2001 21:18:05 -0500 (EST) (envelope-from robert@fledge.watson.org) Date: Wed, 14 Mar 2001 21:18:05 -0500 (EST) From: Robert Watson X-Sender: robert@fledge.watson.org To: freebsd-arch@freebsd.org Subject: Re: flags settings for modules In-Reply-To: <20010314111629.A1018@dragon.nuxi.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-arch@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG The effects of schg can be mitigated by circumventing securelevels, which is trivial in most installs, especially in our default installs. Enabling schg in the default install offers little benefit (in fact, it's rather inconvenient). There are hardened environments where schg can be useful, but ours is not one of them. I'd like schg turned off in the default install to unbreak various forms of NFS stuff, and because it's a royal pain to keep stripping schg from binaries, libraries, modules, and the kernel when I need to manually twiddle as opposed to using the Makefile, which happens with surprising frequency as a result of a still-too-small root partition relative to the size of (kernel + modules). Robert N M Watson FreeBSD Core Team, TrustedBSD Project robert@fledge.watson.org NAI Labs, Safeport Network Services On Wed, 14 Mar 2001, David O'Brien wrote: > I committed a change sys/conf/kmod.mk such that modules are now installed > with flags "schg" as the kernel has been forever. > > It was asked of me if the "schg" flags do much more than get in the > way now? Some feel we're really using "schg" mainly to inhibit foot > shooting. It doesn't really help security or we would set it on more > libraries than libc.so.* and a couple of crypto shared libraries. > > So the question is do we want to keep my change? If so, shouldn't we use > "schg" in a *lot* more places? Otherwise it's use is nebulous > > -- > -- David (obrien@FreeBSD.org) > GNU is Not Unix / Linux Is Not UniX > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-arch" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message