[Gelistirici] [paketler-commits] r40631 - in playground/caglar/kernel/kernel: . files files/fedora

[S.Çağlar Onur]

03 Şub 2008 Paz tarihinde, paketler-commits at pardus.org.tr şunları yazmıştı: 
> Author: cartman
> Date: Sun Feb  3 21:41:06 2008
> New Revision: 40631
> 
> Added:
>    playground/caglar/kernel/kernel/files/fedora/linux-2.6-execshield.patch
> Modified:
>    playground/caglar/kernel/kernel/files/pardus-kernel-config.patch
>    playground/caglar/kernel/kernel/pspec.xml
> Log:
> Bring Ingo Molnar's exec-shield [0] to Pardus, what does this mean for us?
> 
> - 4 years of work, stable now
> - NX protection on 32bit without need for 64bit system
> - PIE randomization
> - brk() randomization
> 
> This is the best you can get on Linux security, next level is AppArmor/SELinux/Tomoyo Linux
> 
> Exec shield needs PAE to work so it needs HIGHMEM_64G tested on my box with success and easily can be disabled with
> 
> echo 0 > /proc/sys/kernel/exec-shield
> 
> Please test it!

pie-randomization.patch ve randomize-brk.patch zaten exec-shield'ın parçalarıydı, NX biti için PAE açıyorsun PentiumPro'dan daha eski sistemler artık boot etmeyecek, HIGHMEM64'ün getirdiği LKML'de bir türlü ölçülemeyen ama %3 ile %40 arasında olduğu _iddia_ edilen overhead bana kabul edilebilir gelmiyor. Özetle bu hamleyi sevmedim :)

-- 
S.Çağlar Onur <caglar at pardus.org.tr>
http://cekirdek.pardus.org.tr/~caglar/

Linux is like living in a teepee. No Windows, no Gates and an Apache in house!
-------------- sonraki bölüm --------------
A non-text attachment was scrubbed...
Name: kullanılamıyor
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part.
URL: <http://liste.pardus.org.tr/gelistirici/attachments/20080203/03798444/attachment-0002.pgp>