Setup Hardened/SE-Linux

[Spargeltarzan]

Hello dear community,

I want to setup hardened and selinux and I planned to follow this Hardened Guide

I use profile 17 with gnome/systemd.

Will I need to change to default/linux/amd64/17.0/hardened/selinux? (how can I ensure gnome/systemd still works?) Or should I stay on gnome/systemd and add somehow hardened features (since PIE is already enabled)?

As I understand the Wiki right, I miss PaX, SELinux and Integrity. However, for PaX and Integrity it seams the kernel needs to be rebuild, is this done automatically when I choose the right profile?

ADD: What is the role of AppArmor for hardened?
"AppArmor is a MAC (Mandatory Access Control) system, implemented upon LSM (Linux Security Modules)." --> sounds like I should want it (I thought AppArmor is only for Ubuntu)

What is the best way to change my Notebook to a fully hardened system with selinux enabled?

ADD: Is hardened indeed a dead project now, will we not be able to use it with recent kernels?
_________________
___________________
Regards

Spargeltarzan

Notebook: Lenovo YOGA 900-13ISK: Gentoo stable amd64, GNOME systemd, KVM/QEMU
Desktop-PC: Intel Core i7-4770K, 8GB Ram, AMD Radeon R9 280X, ZFS Storage, GNOME openrc, Dantrell, Xen

[littletux]

As I know both ways are possible, and both ways need a lot of changes to do so all your USEFLAG related things can be resolved after.

If you change to the hardened profile, you will have to add a lot of USEFLAGS related to gnome, because the hardened profile is only a standard profile with all security related flags added.
If you rest on your actual profile, you have to find out yourself which USEFLAGS are set on the hardened profile.

So in my opinion, it will be easier to change to hardened, and then find out the now missing USEFLAGS for gnome. But be aware if you do a

[Spargeltarzan]

[littletux]

[Spargeltarzan]

Thank you for your support!

I will wait until we have got a documented approach. Does somebody have insights in Gentoo-Hardened and knows what they plan? Did someone change to hardened/selinux these days?

Following NeddySeagoons advice to identify threats firstly, I have collected:
-) Firewall Protection against attacks, especially because I am in untrusted networks regularily. (university, hotels, coffee shops, ...)
-) Using a VPN when I am in these networks to protect my traffic
-) encryption of my system for protection agains thiefs (I have got ext4 currently. Would consider changing to ZFS, but I do not rely to use it as a root pool - for my data pool it is excellent, Btrfs is too unmature for me)
-) Protection against malicious code on my system
-) isolation of activities (e.g. banking I want to do in a fully trusted zone/virtual machine)
_________________
___________________
Regards

Spargeltarzan

Notebook: Lenovo YOGA 900-13ISK: Gentoo stable amd64, GNOME systemd, KVM/QEMU
Desktop-PC: Intel Core i7-4770K, 8GB Ram, AMD Radeon R9 280X, ZFS Storage, GNOME openrc, Dantrell, Xen

[Shoaloak]

I am currently running a Gentoo system with Systemd, Gnome and some Hardening.

What I did was combine two profiles, I named it hardened/linux/amd64/13.0/desktop/gnome/systemd.
It's only to get the basic compiler added protection, since SELinux requires quite some config. (still have to add it when i have the time )
Also, grsecurity and/or PaX are now a paid, GPL infringing service and their devs are jerkoffs, so unless you want to stick to an older kernel, I wouldn't recommend it.
Also, sticking to an older kernel isn't probably the best idea with the Spectre and Meltdown attacks going on.

Anywho, after succesfully creating a new profile (from combining two others), recompile to get moar security:

[Spargeltarzan]

Shoaloak,

Thank you for your detailed help! Yes, I am already on profile 17.0 with PIE enabled.

When I consult the Hardened Project Page, the following would be possible:
1) Enabling specific options in the toolchain (compiler, linker ...) such as forcing position-independent executables (PIE), stack smashing protection and compile-time buffer checks.
2) Enabling PaX extensions in the Linux kernel, which offer additional protection measures like address space layout randomization and non-executable memory.
3) Enabling grSecurity extensions in the Linux kernel, including additional chroot restrictions, additional auditing, process restrictions, etc..
4) Enabling SELinux extensions in the Linux kernel, which offers a Mandatory Access Control system enhancing the standard Linux permission restrictions.
5) Enabling Integrity related technologies, such as Integrity Measurement Architecture, for making systems resilient against tampering

In 1) we have got PIE with profile 17.0, but what's about "stack smashing protection" and "compile-time buffer checks"?
2) 3) is dead in the moment unless using the old 4.9 kernel; yes, I want to stay on a newer one like you also recommend
4) Same for me, when I have got the time for it I will play around and consider it
Finally, what's about 5) in profile 17.0?

To protect against Spectre and Meltdown I have found a Gentoo User Mail recommending to activate a kernel option, but this will also mean a performance hit. On 9th of January Ubuntu will provide a patch to fix this issue, probably without a performance hit. We will see if the patch will be in Gentoo repos soon too.

Additionally, I am working on mount options and a firewall.
_________________
___________________
Regards

Spargeltarzan

Notebook: Lenovo YOGA 900-13ISK: Gentoo stable amd64, GNOME systemd, KVM/QEMU
Desktop-PC: Intel Core i7-4770K, 8GB Ram, AMD Radeon R9 280X, ZFS Storage, GNOME openrc, Dantrell, Xen

[Hu]

I think you may have misparsed some ambiguous phrasing in that mail. The advice is to "Remove the kernel mapping in user mode". The implementation of that advice is to enable (not deactivate, as you said above) CONFIG_PAGE_TABLE_ISOLATION.

[Spargeltarzan]

Hu,

Thank you!!!
_________________
___________________
Regards

Spargeltarzan

Notebook: Lenovo YOGA 900-13ISK: Gentoo stable amd64, GNOME systemd, KVM/QEMU
Desktop-PC: Intel Core i7-4770K, 8GB Ram, AMD Radeon R9 280X, ZFS Storage, GNOME openrc, Dantrell, Xen