diff --git a/sys-kernel/hardened-sources/Manifest b/sys-kernel/hardened-sources/Manifest index 004c314..a301033 100644 --- a/sys-kernel/hardened-sources/Manifest +++ b/sys-kernel/hardened-sources/Manifest @@ -1,15 +1,10 @@ AUX wireless_injection.patch 2140 RMD160 233b4482fbe8b93dc8896246889735939ecb48b4 SHA1 024efaa500ed46dede438edbce1694acc94f4bb0 SHA256 0313d017d667e48b5ad59c74d893efca0afd39be2e8183e9756fdb0f8eaddb94 -DIST deblob-3.2 107602 RMD160 56f1dfe4f0254c802b49ea5220c4f67e56649852 SHA1 83421184d88d02e24de2adbc5debfb03454a7f4b SHA256 5db88405af6d51a77d84354afc3b2bdf673b1a5dcff37bb8db4ccbd12d91db20 DIST deblob-3.4 109026 RMD160 ef9be1bdfbca2bfe4d5e60dd33ed6ec30a1e5c52 SHA1 83b455ad2db0470704225d1e81864af8fd3516c3 SHA256 2fca296bccfa7dc25447f36975971597f67730168a9bc4db0853e55347950680 -DIST deblob-check-3.2 423268 RMD160 8cb0c1b4a289db94543396c4445c4c7a35d2ba70 SHA1 01e50f824a577d15749f24643fdd136180342808 SHA256 9e67dd0885aa8ef356dbc15d487c8dea5a54f74c5b03a5d7946b65ee43f12638 DIST deblob-check-3.4 448778 RMD160 a00d430d137cd9d653a3c42cb36c6e31330ed007 SHA1 4d54aa271cebc0e770e152802f4cadf0dcc9471e SHA256 28ce952c082e765784f9e5b63f5a3a4fb93545e5e788dc94d094c0b3ae8ea3a0 -DIST genpatches-3.2-11.base.tar.bz2 210269 RMD160 634409abf6d2cfdacd7c4c2a7dcebc6acf9b17ea SHA1 64bed713dfb941f699e3c32f419475fb6e10cee3 SHA256 22eb160b9c3bf1fd04f6ab5a5e481ead4054c2a42ce274354b03a34bca1bc341 -DIST genpatches-3.2-11.extras.tar.bz2 17208 RMD160 8324da51ce71afb0d375f34b0dd05209079bd7a3 SHA1 c2f4e029aebbc0ae82221aa2643de06a2d08cbd8 SHA256 7f60ab18e2965d024b7a36327577bcc771061f2cfac221ed475a6fd6b2ab89c7 -DIST genpatches-3.4-2.base.tar.bz2 53731 RMD160 4218a0094a864240fe8ee4844df61d9caff15e6e SHA1 2c1c71a689a0f6343b8f3f152e050cc3a584a8e7 SHA256 165de5663fc5f600777744d9614cdfad9a4f96c07e56660f5f956375df2b1053 -DIST genpatches-3.4-2.extras.tar.bz2 17502 RMD160 c5b834a28335f9a173e8e863b377aff513c791e5 SHA1 7278ac0434a59c1981c585e6a49305351b60573c SHA256 2b537431a408445cd1091562755234e840016f26ad63ab3a73812ac7f7e1c8d9 -DIST hardened-patches-3.2.11-1.extras.tar.bz2 504890 RMD160 be00ee149bb33bbeeaf0c9fa67fc1449704cb4ce SHA1 58ff19b7025356eff2395a5513f06df7f5138cbe SHA256 ee4fc083bc137b76f9d017b63497732c7e6985b16eedb1b6fcad1837411e684a -DIST hardened-patches-3.4.2-2.extras.tar.bz2 547441 RMD160 0580673c4be633b81ea8be2400697720e3131600 SHA1 0a3e8436a50bf197bda7ac9ab3fc896b68971c29 SHA256 183726315c7e4e82d8f02e4eede81e561284300b52205c490d26e6ff6d448d09 -DIST linux-3.2.tar.bz2 78147838 RMD160 15eb022305dfc8b0e1d59e396911fa86eb9c3bdf SHA1 3460afa971049aa79b8f914e1bfd619eedd19f55 SHA256 c881fc2b53cf0da7ca4538aa44623a7de043a41f76fd5d0f51a31f6ed699d463 +DIST genpatches-3.4-6.base.tar.bz2 145231 RMD160 ace521e58b9f5b718904ba9c713d9a28a2541640 SHA1 84d26b315a3cc9bb112b8c1692cefe87e1ec1c95 SHA256 34b7e934f849ef10d706ea2d81878ac91d95b45e029f3d059b484e43686cdc01 +DIST genpatches-3.4-6.extras.tar.bz2 17508 RMD160 b8b83573526b50f38768bb9b51d9ed0941de2dfd SHA1 413a4d2cb7adaab147488a69941f9c4a4731a3c1 SHA256 be8e087b3a0508e88bd36d2d4bec07e0756a3e7f7b31de4dbfd51d79412c2a96 +DIST hardened-patches-3.4.5-1.extras.tar.bz2 548697 RMD160 600afa8ae088e46caf6961bf00eb88f3effe3cb0 SHA1 8c4f746d3f5f7ed0c006bb72eb0095df3fa31db4 SHA256 f77fdd4450cfaa051058383d4c7bce9ae7cf40cc39948a265870c8806fcdc2ef DIST linux-3.4.tar.bz2 80173484 RMD160 e0bcaa53b6eb3de9498f51b2c8b90d6c52d54889 SHA1 dfc54e7fbee81f77aba85d3d8ff2d992e1e49573 SHA256 a797a15d0b6228381507c14ecf4eec4a6cc5c77cfd521ba3b3e1325e85b5b16d -EBUILD hardened-sources-3.2.11-r1.ebuild 1995 RMD160 61b11bc5c70226cfc9dc637a0e46862032b922b1 SHA1 42f64d8aabb8afff80ef076335a79df9f40f46a5 SHA256 82bef49f5774806aa4eff60251cf6226eda70070c6f15eae4b9d7d9e2587e2af -EBUILD hardened-sources-3.4.2-r1.ebuild 1926 RMD160 6a24f792ed592ae0fb5dc5b228882930ee2f77da SHA1 5ae5249ed5f8237c7665b9490f82e719ecdb787d SHA256 211412b294420868a8f1dee95fdda08c1bb921017aee937ab98e7b776a1aca16 +EBUILD hardened-sources-3.4.5.ebuild 1922 RMD160 d613dedcb55ca94cc57b3ad34dacb18054c9860f SHA1 a57e0a4bf3d53a450bb3796ef80f6291d70bfada SHA256 5635b171b177b42399e53cc35d57e1eda566fdec2c187f462a0730470a6258ce +MISC ebuild.diff 637 RMD160 4d5ad5146419a4acf0d92acb24710d0d0c9ed51e SHA1 b46348068a8a4db8bf8c2e1a10b35c2414548fc5 SHA256 06b9b56d77e3b4a9154797d86207b7c4068bf1b3bbf18993c0225ef2d49f722d +MISC kernel-config-3.4.2-hardened-r1 105732 RMD160 3a658a0cfd246c11722285ff336da20e970a2ef7 SHA1 482239454a824669c3b0e8776502cade486de736 SHA256 28de645ae2803b3ae90053d5e8a254425123c4886b18d00ca4a2d69b700471aa diff --git a/sys-kernel/hardened-sources/ebuild.diff b/sys-kernel/hardened-sources/ebuild.diff new file mode 100644 index 0000000..0c084e0 --- /dev/null +++ b/sys-kernel/hardened-sources/ebuild.diff @@ -0,0 +1,22 @@ +--- /mnt/portage/portage/sys-kernel/hardened-sources/hardened-sources-3.4.5.ebuild 2012-08-09 02:31:30.000000000 -0700 ++++ hardened-sources-3.4.5.ebuild 2012-08-11 12:27:13.379563909 -0700 +@@ -21,12 +21,18 @@ + + DESCRIPTION="Hardened kernel sources (kernel series ${KV_MAJOR}.${KV_MINOR})" + HOMEPAGE="http://www.gentoo.org/proj/en/hardened/" +-IUSE="deblob" ++IUSE="deblob -injection" + + KEYWORDS="~alpha amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc x86" + + RDEPEND=">=sys-devel/gcc-4.5" + ++pkg_setup() { ++ if use injection; then ++ UNIPATCH_LIST+=" ${FILESDIR}/wireless_injection.patch" ++ fi ++} ++ + pkg_postinst() { + kernel-2_pkg_postinst + diff --git a/sys-kernel/hardened-sources/hardened-sources-3.2.11-r1.ebuild b/sys-kernel/hardened-sources/hardened-sources-3.2.11-r1.ebuild deleted file mode 100644 index b2f0420..0000000 --- a/sys-kernel/hardened-sources/hardened-sources-3.2.11-r1.ebuild +++ /dev/null @@ -1,57 +0,0 @@ -# Copyright 1999-2012 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-sources/hardened-sources-3.2.11.ebuild,v 1.2 2012/04/19 22:13:17 blueness Exp $ - -EAPI="4" - -ETYPE="sources" -K_WANT_GENPATCHES="base extras" -K_GENPATCHES_VER="11" -K_DEBLOB_AVAILABLE="1" - -inherit kernel-2 -detect_version - -HGPV="${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-1" -HGPV_URI="http://dev.gentoo.org/~blueness/hardened-sources/hardened-patches/hardened-patches-${HGPV}.extras.tar.bz2" -SRC_URI="${KERNEL_URI} ${HGPV_URI} ${GENPATCHES_URI} ${ARCH_URI}" - -UNIPATCH_LIST="${DISTDIR}/hardened-patches-${HGPV}.extras.tar.bz2" -UNIPATCH_EXCLUDE="4200_fbcondecor-0.9.6.patch" -! use xtpax && UNIPATCH_EXCLUDE+=" 4425_grsec_enable_xtpax.patch" - -DESCRIPTION="Hardened kernel sources (kernel series ${KV_MAJOR}.${KV_MINOR})" -HOMEPAGE="http://www.gentoo.org/proj/en/hardened/" -IUSE="deblob -xtpax -injection" - -KEYWORDS="~alpha amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc x86" - -RDEPEND=">=sys-devel/gcc-4.5" - -pkg_setup() { - if use injection; then - UNIPATCH_LIST+=" ${FILESDIR}/wireless_injection.patch" - fi -} - -pkg_postinst() { - kernel-2_pkg_postinst - - local GRADM_COMPAT="sys-apps/gradm-2.9" - - ewarn - ewarn "Hardened Gentoo provides three different predefined grsecurity level:" - ewarn "[server], [workstation], and [virtualization]. Those who intend to" - ewarn "use one of these predefined grsecurity levels should read the help" - ewarn "associated with the level. Because some options require >=gcc-4.5," - ewarn "users with more, than one version of gcc installed should use gcc-config" - ewarn "to select a compatible version." - ewarn - ewarn "Users of grsecurity's RBAC system must ensure they are using" - ewarn "${GRADM_COMPAT}, which is compatible with ${PF}." - ewarn "It is strongly recommended that the following command is issued" - ewarn "prior to booting a ${PF} kernel for the first time:" - ewarn - ewarn "emerge -na =${GRADM_COMPAT}*" - ewarn -} diff --git a/sys-kernel/hardened-sources/hardened-sources-3.4.2-r1.ebuild b/sys-kernel/hardened-sources/hardened-sources-3.4.5.ebuild similarity index 89% rename from sys-kernel/hardened-sources/hardened-sources-3.4.2-r1.ebuild rename to sys-kernel/hardened-sources/hardened-sources-3.4.5.ebuild index cd3ff4a..907e916 100644 --- a/sys-kernel/hardened-sources/hardened-sources-3.4.2-r1.ebuild +++ b/sys-kernel/hardened-sources/hardened-sources-3.4.5.ebuild @@ -1,18 +1,18 @@ # Copyright 1999-2012 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-sources/hardened-sources-3.4.2-r1.ebuild,v 1.3 2012/07/08 13:09:49 blueness Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-sources/hardened-sources-3.4.5.ebuild,v 1.2 2012/08/09 09:28:05 blueness Exp $ EAPI="4" ETYPE="sources" K_WANT_GENPATCHES="base extras" -K_GENPATCHES_VER="2" +K_GENPATCHES_VER="6" K_DEBLOB_AVAILABLE="1" inherit kernel-2 detect_version -HGPV="${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-2" +HGPV="${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-1" HGPV_URI="http://dev.gentoo.org/~blueness/hardened-sources/hardened-patches/hardened-patches-${HGPV}.extras.tar.bz2" SRC_URI="${KERNEL_URI} ${HGPV_URI} ${GENPATCHES_URI} ${ARCH_URI}" @@ -23,7 +23,7 @@ DESCRIPTION="Hardened kernel sources (kernel series ${KV_MAJOR}.${KV_MINOR})" HOMEPAGE="http://www.gentoo.org/proj/en/hardened/" IUSE="deblob -injection" -KEYWORDS="~alpha amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86" +KEYWORDS="~alpha amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc x86" RDEPEND=">=sys-devel/gcc-4.5" diff --git a/sys-kernel/hardened-sources/kernel-config-3.4.2-hardened-r1 b/sys-kernel/hardened-sources/kernel-config-3.4.5-hardened similarity index 99% rename from sys-kernel/hardened-sources/kernel-config-3.4.2-hardened-r1 rename to sys-kernel/hardened-sources/kernel-config-3.4.5-hardened index fa19e90..334d4ed 100644 --- a/sys-kernel/hardened-sources/kernel-config-3.4.2-hardened-r1 +++ b/sys-kernel/hardened-sources/kernel-config-3.4.5-hardened @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 3.4.2-hardened-r1 Kernel Configuration +# Linux/x86_64 3.4.5-hardened Kernel Configuration # CONFIG_64BIT=y # CONFIG_X86_32 is not set @@ -4176,7 +4176,7 @@ CONFIG_DEFAULT_IO_DELAY_TYPE=0 # CONFIG_DEBUG_BOOT_PARAMS is not set # CONFIG_CPA_DEBUG is not set CONFIG_OPTIMIZE_INLINING=y -CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y +# CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set # CONFIG_DEBUG_NMI_SELFTEST is not set # @@ -4186,14 +4186,62 @@ CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y # # Grsecurity # +CONFIG_PAX_KERNEXEC_PLUGIN=y +CONFIG_PAX_PER_CPU_PGD=y +CONFIG_TASK_SIZE_MAX_SHIFT=42 CONFIG_GRKERNSEC=y -# CONFIG_GRKERNSEC_LOW is not set -# CONFIG_GRKERNSEC_MEDIUM is not set -# CONFIG_GRKERNSEC_HIGH is not set -# CONFIG_GRKERNSEC_HARDENED_SERVER is not set -# CONFIG_GRKERNSEC_HARDENED_WORKSTATION is not set -# CONFIG_GRKERNSEC_HARDENED_VIRTUALIZATION is not set -CONFIG_GRKERNSEC_CUSTOM=y +# CONFIG_GRKERNSEC_CONFIG_AUTO is not set +CONFIG_GRKERNSEC_CONFIG_CUSTOM=y + +# +# Customize Configuration +# + +# +# PaX +# +CONFIG_PAX=y + +# +# PaX Control +# +# CONFIG_PAX_SOFTMODE is not set +# CONFIG_PAX_EI_PAX is not set +CONFIG_PAX_PT_PAX_FLAGS=y +CONFIG_PAX_XATTR_PAX_FLAGS=y +CONFIG_PAX_NO_ACL_FLAGS=y +# CONFIG_PAX_HAVE_ACL_FLAGS is not set +# CONFIG_PAX_HOOK_ACL_FLAGS is not set + +# +# Non-executable pages +# +CONFIG_PAX_NOEXEC=y +CONFIG_PAX_PAGEEXEC=y +# CONFIG_PAX_EMUTRAMP is not set +# CONFIG_PAX_MPROTECT is not set +CONFIG_PAX_KERNEXEC=y +CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y +# CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR is not set +CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts" + +# +# Address Space Layout Randomization +# +CONFIG_PAX_ASLR=y +CONFIG_PAX_RANDKSTACK=y +CONFIG_PAX_RANDUSTACK=y +CONFIG_PAX_RANDMMAP=y + +# +# Miscellaneous hardening features +# +# CONFIG_PAX_MEMORY_SANITIZE is not set +# CONFIG_PAX_MEMORY_STACKLEAK is not set +CONFIG_PAX_MEMORY_UDEREF=y +CONFIG_PAX_REFCOUNT=y +CONFIG_PAX_USERCOPY=y +# CONFIG_PAX_SIZE_OVERFLOW is not set # # Memory Protections @@ -4218,10 +4266,10 @@ CONFIG_GRKERNSEC_ACL_TIMEOUT=30 # Filesystem Protections # CONFIG_GRKERNSEC_PROC=y -CONFIG_GRKERNSEC_PROC_USERGROUP=y -CONFIG_GRKERNSEC_PROC_GID=100 +CONFIG_GRKERNSEC_PROC_USER=y CONFIG_GRKERNSEC_PROC_ADD=y CONFIG_GRKERNSEC_LINK=y +# CONFIG_GRKERNSEC_SYMLINKOWN is not set CONFIG_GRKERNSEC_FIFO=y # CONFIG_GRKERNSEC_SYSFS_RESTRICT is not set # CONFIG_GRKERNSEC_ROFS is not set @@ -4272,7 +4320,7 @@ CONFIG_GRKERNSEC_BLACKHOLE=y # CONFIG_GRKERNSEC_SOCKET is not set # -# Sysctl support +# Sysctl Support # # CONFIG_GRKERNSEC_SYSCTL is not set @@ -4281,55 +4329,6 @@ CONFIG_GRKERNSEC_BLACKHOLE=y # CONFIG_GRKERNSEC_FLOODTIME=10 CONFIG_GRKERNSEC_FLOODBURST=4 - -# -# PaX -# -CONFIG_PAX_KERNEXEC_PLUGIN=y -CONFIG_PAX_PER_CPU_PGD=y -CONFIG_TASK_SIZE_MAX_SHIFT=42 -CONFIG_PAX=y - -# -# PaX Control -# -# CONFIG_PAX_SOFTMODE is not set -# CONFIG_PAX_EI_PAX is not set -CONFIG_PAX_PT_PAX_FLAGS=y -CONFIG_PAX_XATTR_PAX_FLAGS=y -CONFIG_PAX_NO_ACL_FLAGS=y -# CONFIG_PAX_HAVE_ACL_FLAGS is not set -# CONFIG_PAX_HOOK_ACL_FLAGS is not set - -# -# Non-executable pages -# -CONFIG_PAX_NOEXEC=y -CONFIG_PAX_PAGEEXEC=y -# CONFIG_PAX_EMUTRAMP is not set -# CONFIG_PAX_MPROTECT is not set -CONFIG_PAX_KERNEXEC=y -# CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR is not set -CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y -CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts" - -# -# Address Space Layout Randomization -# -CONFIG_PAX_ASLR=y -CONFIG_PAX_RANDKSTACK=y -CONFIG_PAX_RANDUSTACK=y -CONFIG_PAX_RANDMMAP=y - -# -# Miscellaneous hardening features -# -# CONFIG_PAX_MEMORY_SANITIZE is not set -# CONFIG_PAX_MEMORY_STACKLEAK is not set -CONFIG_PAX_MEMORY_UDEREF=y -CONFIG_PAX_REFCOUNT=y -CONFIG_PAX_USERCOPY=y -# CONFIG_PAX_SIZE_OVERFLOW is not set CONFIG_KEYS=y CONFIG_TRUSTED_KEYS=m CONFIG_ENCRYPTED_KEYS=m