Re: Plan for Guix security (was Re: Long term plan for GuixSD security: microkernels, ocap, RISC-V support)

2019-01-05 Thread Ludovic Courtès
Hello, Marius Bakke skribis: > Alex Vong writes: > >> Besides, I remember we have discuss about hardening before. Should I >> start a new hardening branch? (although I don't time to work on it right >> now). I think this is something we can do now. >> >> My idea is to create a new guix module (

Re: Plan for Guix security (was Re: Long term plan for GuixSD security: microkernels, ocap, RISC-V support)

2018-12-26 Thread Joshua Branson
Alex Vong writes: > Hello everyone, > > For microkernel, sel4 being a formally verified microkernel (developed > by security researchers?) looks promising to me. Maybe someday we can > rebase hurd on top of it (replacing mach)... I suppose it may be possible, but many of the original hurd develo

Re: Plan for Guix security (was Re: Long term plan for GuixSD security: microkernels, ocap, RISC-V support)

2018-12-26 Thread Marius Bakke
Hello! Alex Vong writes: > Besides, I remember we have discuss about hardening before. Should I > start a new hardening branch? (although I don't time to work on it right > now). I think this is something we can do now. > > My idea is to create a new guix module (guix build hardening) which > sh

Plan for Guix security (was Re: Long term plan for GuixSD security: microkernels, ocap, RISC-V support)

2018-12-25 Thread Alex Vong
Hello everyone, For microkernel, sel4 being a formally verified microkernel (developed by security researchers?) looks promising to me. Maybe someday we can rebase hurd on top of it (replacing mach)... For ocap, I've no idea about it. I've heard of apparmor and selinux but not ocap. Btw, debian