From owner-freebsd-arch Wed Mar 14 19: 6:40 2001 Delivered-To: freebsd-arch@freebsd.org Received: from acampi.inet.it (acampi.inet.it [213.92.4.194]) by hub.freebsd.org (Postfix) with SMTP id EF15F37B718 for ; Wed, 14 Mar 2001 19:06:37 -0800 (PST) (envelope-from andrea@webcom.it) Received: (qmail 2904 invoked from network); 15 Mar 2001 04:05:51 -0000 Received: from unknown (HELO webcom.it) (212.239.10.243) by acampi.inet.it with SMTP; 15 Mar 2001 04:05:51 -0000 Received: (qmail 5697 invoked by uid 1000); 15 Mar 2001 03:03:15 -0000 Date: Thu, 15 Mar 2001 04:03:14 +0100 From: Andrea Campi To: freebsd-arch@freebsd.org Subject: Re: flags settings for modules Message-ID: <20010315040314.H3277@webcom.it> References: <20010314111629.A1018@dragon.nuxi.com> <20010315032215.G3277@webcom.it> <20010314184051.A64088@hub.freebsd.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20010314184051.A64088@hub.freebsd.org>; from TrimYourCC@nuxi.com on Wed, Mar 14, 2001 at 06:40:51PM -0800 X-Echelon: BND CIA NSA Mossad KGB MI6 IRA detonator nuclear assault strike Sender: owner-freebsd-arch@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Wed, Mar 14, 2001 at 06:40:51PM -0800, David O'Brien wrote: > On Thu, Mar 15, 2001 at 03:22:16AM +0100, Andrea Campi wrote: > > Why don't we make it a make(1) variable? > > I would like to fight the "lets make everything a tuneable knob" syndrom > I think we've falling into lately. First lets see if anyone really needs > or wants those flag values. Well, I understand your point of view, but in my opinion there are 2 user groups involved here: security conscious guys, who would like to have all "immutable" files, including all binaries on /, all libraries, whatever (heck, on production machines I'd have /etc/* schg), and more casual users (or users with particular needs) who don't want that because it incomodates that. Apart from the kernel, where I feel schg should stay no matter what, I feel both of these user groups have good reasons. Which one would you favor? Having a knob, probably defaulting to "only kernel schg" for POLA, would be perfect and trivial to implement. On the other hand, this kind of hardening is a candidate for ports/misc/harden... Bye, Andrea -- There's no place like ~ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message