IRC channel logs
2026-10-12.log
back to list of logs
<FransFaase>I also created a T-diagram in a webpage that can visualize trust rules in the sense that the output of program can be trusted if both the input and the program itself can be trusted. The webpage also allows you to review all the files that you need to trust in order to trust the final output. See: <FransFaase>If you click on a T-shape of a filename the page will show additional information. <LaurentH>FransFaase: Great work! Very useful to see how many files are involved in getting to TCC <LaurentH>I have a few questions on the visualization. Since you need the complete list of source files and prebuilt executables to make the diagram, it could be useful to show the total source size (in addition to the number of files). This could be a useful metric to optimize for <FransFaase>You could try to call your scripts with 'trace -f -o trace.txt -e trace=fork,execve chroot' just to get an idea how many programs are executed when executing the script. <FransFaase>(I did not notice that I was off-line, I will repost some answers): Currently the gen_graph.cpp program is rather specific. It parses three files: a file with output for the make file (with -n option), the script file itself to get the cp commands that are used for copying files into the chroot environment, and a file with output from the strace <FransFaase>The tricking thing with reading the output of the strace command is that when you start a bash script a lot happens before first actual command in the script is executed. <FransFaase>There is also some dead code in the gen_graph.cpp program that it inherited from the scan_trace.cpp program. <stikonas>also anything in early bootstrap before perhaps bash is built, should be very easily readable from kaem scripts and makefiles <stikonas>it's only afterwards (and especially when autotools gets involved) where things become too complex to trace by hand