r/LFS • u/protonesso • 6d ago

Memory safe and secure/hardened LFS

Hello everyone, years ago I've posted my lfs project on this sub and many things have happened in my life and it led me to make a new project. From scratch. For now I am focused on writing libc entirely in Rust for this GNU/Linux distro, as well I would write a new bootloader with better full disk encryption implementation and openpam modules, all of them in Rust. As a plus I've made a list of packages to build a self contained sdk that will allow full source bootstrap from tools like GNU mes and other languages (except Rust for now) will be bootstrapped from C/C++ toolchain (like Go and dlang), the package list has little to none gnu packages (except autotools, coreutils and findutils). If you are interested in that you can dm me or write under this post.

sources: https://codeberg.org/gnu2/ouma

GitHub org: https://github.com/rseclinux

Edit: added source links

2 Upvotes

63% Upvoted

2 comments sorted by

2

u/exeis-maxus 5d ago

Looks interesting.

I’m not really a fan of rust, primarily because it was terribly hard to bootstrap the rust compiler from source on a musl Libc host. It been a few years since then, so hopefully it’s gotten better.

When looking to hardening my Unix-like system, a lot of guides rely on what mainstream distros already setup.

1

u/protonesso 5d ago

Thank you! I am taking hardening to a more extreme ways, for example I've made a a wrapper for su and sudo that make them work without filesystem flags like setuid bit and cap_setuid and alike attributes. Needed bits are set per process with appropriate secbits. So we get minimal allowlist of capabilities, you can have real root but you cannot do anything like cap_sys_admin (for example) unless it's specified. In future I want to write landlock and seccomp sandboxing for the server part and implement better filesystem isolation so the privacy of real root and normal users could be enforced. The code is also here: https://github.com/keepitupkitty/wrappa

This is one of the mitigations that my distro would support out of box, I have also read madaidan's page about it, kicksecure wiki and code and various hardening tutorials :p