[gentoo-hardened] I have trouble installing

Hi list!

I would like to switch to hardened gentoo from Adamantix. I need a linux
that has PaX, SSP and RSBAC at least. And support, QA. That's what is
missing from Adamantix.

So this is the first time I try to install gentoo, by the book, and it
fails. Since I have no experience with gentoo I write here what I did,
so you can tell me if I have missed a step, or made some other mistake.

I am sorry, but it is a little bit long.

Booted from CD, have net, partitioned, formatted, mounted, downloaded
stage3-i686-2006.1.tar.bz2

 # cd /mnt/gentoo
 # tar xjSpf stage3-i686-2006.1.tar.bz2
 # tar xjf portage-latest.tar.bz2 -C usr/
 # cd /mnt/gentoo/etc
 # mirrorselect -i -o >> /mnt/gentoo/etc/make.conf
 # mirrorselect -i -r -o >> /mnt/gentoo/etc/make.conf
 # cat make.conf
  # These settings were set by the catalyst build script that
  # automatically built this stage
  # Please consult /etc/make.conf.example for a more detailed example
  CFLAGS="-O2 -march=i686 -pipe"
  CHOST="i686-pc-linux-gnu"
  CXXFLAGS="${CFLAGS}"
  GENTOO_MIRRORS="http://gentoo.inf.elte.hu/ "
  SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
 # cp -L /etc/resolv.conf resolv.conf
 # mount -t proc none /mnt/gentoo/proc
 # mount -o bind /dev /mnt/gentoo/dev
 # cd ../..
 # chroot /mnt/gentoo bin/bash
 # env-update
 # source /etc/profile
 # emerge --sync
 # emerge portage
  * Applying portage-2.1.1-r2.patch ...
  * Setting portage.VERSION to 2.1.1-r2 ...           
 # find /etc -iname '._cfg????_*'
 # cd /etc
 # mv ._cfg0000_make.conf.example make.conf.example
 # mv ._cfg0000_etc-update.conf etc-update.conf
 # rm /etc/make.profile
 # ln -s /usr/portage/profiles/hardened/x86/2.6/ make.profile
 # env-update
 # source /etc/profile
 # emerge gcc binutils virtual/libc

Downloads gcc 3.4.6 patches, etc. compiles for hours

  * The current gcc config appears valid, so it will not be
  * automatically switched for you.  If you would like to
  * switch to the newly installed gcc version, do the
  * following:

  * gcc-config i686-pc-linux-gnu-3.4.6
  * source /etc/profile

  * Switching native-compiler to i686-pc-linux-gnu-4.1.1 ...
 ...
 >>> sys-devel/gcc-3.4.6-r2 merged.

Does this mean that the new, SSP patched gcc is installed, but not in
use at this point?
If it is so, isn't it a problem, that binutils and libc is compiled with
the old gcc?
And why is this version 3.4.6?

I have expected to see the same version of gcc that I already had (from
stage3 I suppose), which is 4.1.1, recompiled with SSP, and possibly
other patches, and the new hardened version to replace the current one.

Why does emerge give me an older version? Is this normal?

And it seems that the method written in
http://www.gentoo.org/proj/en/hardened/hardenedfaq.xml#hardenedprofile
does not work.

emerge downloads binutils, compiles for about half an hour, unmerges
original, merges binutils-2.16.1-r3

 emerging sys-libs/glibc-2.3.6-r5 to /

downloads, then:

  * checking ebuild checksums ;-) ...
            [ ok ]
  * checking auxfile checksums ;-) ...
            [ ok ]
  * checking miscfile checksums ;-) ...
            [ ok ]
  * checking glibc-2.3.6.tar.bz2 ;-) ...
            [ ok ]
  * checking glibc-linuxthreads-2.3.6.tar.bz2 ;-) ...
            [ ok ]
  * checking glibc-libidn-2.3.6.tar.bz2 ;-) ...
            [ ok ]
  * checking glibc-2.3.6-patches-1.19.tar.bz2 ;-) ...
            [ ok ]
  * checking glibc-manpages-2.3.6-1.tar.bz2 ;-) ...
            [ ok ]
  * checking glibc-infopages-2.3.6.tar.bz2 ;-) ...
            [ ok ]
  * Sanity check to keep you from breaking your system:
  *  Downgrading glibc is not supported and a sure way to destruction

 !!! ERROR: sys-libs/glibc-2.3.6-r5 failed.
 Call stack:
   ebuild.sh, line 1562:   Called dyn_setup
   ebuild.sh, line 665:   Called pkg_setup
   glibc-2.3.6-r5.ebuild, line 1037:   Called die

 !!! aborting to save your system
 !!! If you need support, post the topmost build error, and the call stack if relevant.

So, emerging libc has failed. I thought that when I switch to the hardened
profile, it only has to recompile the same version that I already have.
But it seems that it tries an older version? Just as it did with gcc.
Why?

So what do I do now?

Do I have to manually switch to the hardened gcc? Then I have to recompile
binutils, as it was compiled with the unhardened gcc. How do I emerge the libc?

Cheers,
Gabor
-- 
gentoo-hardened@g.o mailing list