Re: [gentoo-hardened] Some teething problems with 2004.1 and cascaded profiles

[Ed Wildgoose]

Chris PeBenito wrote:

>On Tue, 2004-04-27 at 08:58, Ed Wildgoose wrote:
>
>
>>Hi I'm having some teething problems with the 2004.1 cascaded profile.
>>
>>
>
>I need to know what version of portage you are using.
>
>

I'm using 2.0.50-r6 - which should be the latest unmasked build in portage?

I couldn't bootstrap at all with the cascaded profiles, 
bootstrap-cascade.sh would only pickup about 4-5 of the packages, and 
then the script would drop out fairly soon with a portage message asking 
me what to do (presumably the script fed in the empty package, and hence 
the error)

So what I had to do to bootstrap was use the selinux-1.4, and then 
switch back to 2004.1 profile before doing the emerge system.  This 
however, didn't work completely - a whole host of packages werent merged 
and I had to write a little script to go through everything in 
profiles/base/packages and check they were actually installed (it left 
me without stuff like ifconfig and other essential tools).  However, 
probably a symptom of the same thing, I still have problems emerging 
stuff with a virtual dependency, seems like it isn't finding that base 
directory

Any ideas?

>>compiling (I'm assuming that everything is given as compiler flags now,
>>so there should be no issues mixing selinux and normal machines with
>>distcc...?)  If not, then is there an easy way to enable this?
>>
>>
>
>SELinux doesn't care about distcc, just as long as you have it's policy
>(which should be installed when you merge distcc on a SELinux machine).
>If you're using hardened gcc, then thats a different story; all of the
>machines need to have the same version gcc and hardened gcc.
>
>

OK, I am confusing selinux with hardened, but what I meant to write was 
that I want a hardened + selinux machine.  The docs have suddenly got 
really confused about what hardened means now... At one point you needed 
hardened-gcc, however, right now the hardened gcc appears to be 
deprecated and not in use?  Apparently you just need to "use hardened" 
to get the same effect...?  I added -fstack-protector to my CFLAGS to 
try and make sure that it is happening as widely as possible though (is 
this sensible). 

It's really not clear what needs to be done to get a "hardened" system 
right now?  For example, do we need any other flags adding to 
make.conf...?  Any chance of a pointer to some updated advice?  This is 
my first bash with "hardened", so I'm still rather wet around the ears 
and unsure what I will actually be getting (but I needed to rebuild my 
webserver, so it seems like a good thing to investigate...)

Thanks

Ed W

--
gentoo-hardened@g.o mailing list