All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Marta Rybczynska" <rybczynska@gmail.com>
To: akuster808 <akuster808@gmail.com>, yocto@lists.yoctoproject.org
Cc: Marta Rybczynska <marta.rybczynska@huawei.com>
Subject: Re: [meta-hardening][PATCH] meta-hardening/binutils: harden installation permissions
Date: Mon, 30 Aug 2021 18:26:24 +0200	[thread overview]
Message-ID: <CAApg2=TNUjBuK4RPBQ1SRYQzZ5WC0OZM4ouFb0ymKJUz82JXBw@mail.gmail.com> (raw)
In-Reply-To: <4aa7aca3-2de1-8cc4-123b-f0f4e44ccfb2@gmail.com>

[-- Attachment #1: Type: text/plain, Size: 1210 bytes --]

(correcting the wrong list address)

On Fri, Aug 27, 2021 at 6:07 AM akuster808 <akuster808@gmail.com> wrote:

> Marta,
>
> On 8/24/21 11:05 PM, Marta Rybczynska wrote:
> > Compilers and related utils are better restricted on production
> platforms.
> > Change permissions of all installed binutils tools to remove access from
> > users outside of the root group.
> >
> > This also demonstrates how to restrict file permissions in a hardened
> > distribution.
>
> Have you looked into FILESYSTEM_PERMS_TABLES? An example of the format
> can be found @ /meta/files/fs-perms.txt
>
> For more info see
> https://www.yoctoproject.org/docs/3.1/ref-manual/ref-manual.html
>
> Maybe having something like fs-perms.txt in meta-hardening may achieve
> the same?
>
>
It looks like a possibility, I will give it a try. I have a question about
the future,
however. Currently meta-hardening is defining its own distribution. When
hardening
will be in DISTRO_FEATURES (you were working on it some time ago
https://patchwork.openembedded.org/patch/174773/),
it would be less obvious to use, wouldn't it?

A bonus question, do you still plan to make it in DISTRO_FEATURES?

Regards,
Marta

[-- Attachment #2: Type: text/html, Size: 1852 bytes --]

       reply	other threads:[~2021-08-30 16:26 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20210825060532.8379-1-rybczynska@gmail.com>
     [not found] ` <4aa7aca3-2de1-8cc4-123b-f0f4e44ccfb2@gmail.com>
2021-08-30 16:26   ` Marta Rybczynska [this message]
2021-08-25  6:15 [meta-hardening][PATCH] meta-hardening/binutils: harden installation permissions Marta Rybczynska

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAApg2=TNUjBuK4RPBQ1SRYQzZ5WC0OZM4ouFb0ymKJUz82JXBw@mail.gmail.com' \
    --to=rybczynska@gmail.com \
    --cc=akuster808@gmail.com \
    --cc=marta.rybczynska@huawei.com \
    --cc=yocto@lists.yoctoproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.