[gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/uclibc: index.xml

[Anthony G. Basile (blueness)]

blueness    12/11/02 03:22:31

  Added:                index.xml
  Log:
  add page for hardened uclibc project

Revision  Changes    Path
1.1                  xml/htdocs/proj/en/hardened/uclibc/index.xml

file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/uclibc/index.xml?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/uclibc/index.xml?rev=1.1&content-type=text/plain

Index: index.xml
===================================================================
<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet href="/xsl/project.xsl" type="text/xsl"?>
<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
<!DOCTYPE project SYSTEM "/dtd/project.dtd">
<project>

<name>Hardened uClibc</name>
<longname>Porting Tool chain and Kernel Hardening to uClibc based systems</longname>

<description>
This subproject aims to port both tool chain and kernel hardening to uClibc
based systems for a variety of architectures.  The project treats uClibc as an
alternative to glibc, and not necessarily as "embedded".  The aim is a fully
featured system, and not one based primarily on busybox.
</description>

<longdescription>
<p>
All modern operating systems are comprised of a kernel and user land.  The
former deals with hardware and resource management at the highest privilege
level (ring 0) while the later deals with the end user and operates at the lowest
privilege level (ring 3).  The two interface at one central library referred to
as "the C standard library."  By far, the most popular is "The GNU C library", or
<uri link="http://www.gnu.org/software/libc/">glibc</uri> for short; but, for
embedded systems <uri link="http://www.uclibc.org/">uClibc</uri> is the standard
library of choice, although there are other competitors (see <uri link="http://www.musl-libc.org/">musl</uri>).
uClibc (where the "u" is sometimes written as the Greek "mu" for "micro") is much
smaller than glibc, less bloated, much faster, and very configurable.
</p>

<p>
Continued developments in uClibc have made it increasingly suitable for fully
featured systems, even desktops.  The recent addition of the native POSIX thread
library (see <uri link="http://en.wikipedia.org/wiki/Native_POSIX_Thread_Library">nptl</uri>)
meant that we could finally implement our complete complement of tool chain
hardening from glibc:
</p>

<ul>
<li>stack smashing protection (<uri link="http://en.wikipedia.org/wiki/Buffer_overflow_protection">ssp</uri>),
which came with nptl</li>
<li>position independent execution (<uri link="http://en.wikipedia.org/wiki/Position-independent_code">pie</uri>)</li>
<li>bind now and relro, linker hardening to protect the global offset table</li>
</ul>

<p>
These are complemented by the kernel hardening, especially
<uri link="http://pax.grsecurity.net/">PaX</uri>'s enhanced address space
layout randomization (<uri link="http://pax.grsecurity.net/docs/aslr.txt">aslr</uri>).
</p>

<p>
So, this subproject aims to port both tool chain and kernel hardening to uClibc
based systems for a variety of architectures, treating uClibc more as a
drop in alternative to glibc, and not necessarily as "embedded".  Embedded
systems aim to produce kernels and user lands with tiny footprints, and so
tend to use busybox as their "Swiss Army Knife" of common UNIX utilities.
While not excluding this possibility, we aim at making most (all?) of Gentoo's
packages both hardened and uClibc compatible.
</p>
</longdescription>

<goals>
<p>
The project goals can be best summarized by the following chart:
</p>

<table>
<tr>
	<th>Arch</th>
	<th>Subarchs</th>
	<th>Tool Chain Hardening</th>
	<th>Kernel Hardening</th>
	<th>Installation Media</th>
	<th>Downloads</th>
</tr>
<tr>
	<ti>amd64</ti>
	<ti>Generic</ti>
	<ti>Yes</ti>
	<ti>Yes</ti>
	<ti>stage3 livecd desktop</ti>
	<ti>[mirror]/experimental/amd64/uclibc</ti>
</tr>
<tr>
	<ti>arm</ti>
	<ti>armv7a/softfloat</ti>
	<ti>Yes</ti>
	<ti>No</ti>
	<ti>stage4</ti>
	<ti>[mirror]/experimental/arm/uclibc</ti>
</tr>
<tr>
	<ti>mips</ti>
	<ti>mips32r2 mipsel32r2</ti>
	<ti>Yes</ti>
	<ti>No</ti>
	<ti>stage4</ti>
	<ti>[mirror]/experimental/mips/uclibc</ti>
</tr>
<tr>
	<ti>ppc</ti>
	<ti>Not Yet</ti>
	<ti>Not Yet</ti>
	<ti>Not Yet</ti>
	<ti>Not Yet</ti>
	<ti>Not Yet</ti>
</tr>
<tr>
	<ti>x86</ti>
	<ti>i686</ti>
	<ti>Yes</ti>
	<ti>Yes</ti>
	<ti>stage3</ti>
	<ti>[mirror]/experimental/x86/uclibc</ti>
</tr>
</table>

<ul>
<li>Yes = competed</li>
<li>Not Yet = in progress</li>
<li>No = no plans</li>
<li>NA = not applicable</li>
<li>stage3 = catalyst built stages 1, 2 and 3 available (ideal)</li>
<li>stage4 = manually tarballed minimal system</li>
<li>livecd = minimal (installation) live CD</li>
<li>desktop = manually tarballed full desktop system</li>
<li>[mirror] = any <uri link="http://www.gentoo.org/main/en/mirrors2.xml">Gentoo mirror</uri></li>
</ul>

</goals>


<dev role="lead">blueness</dev>
<dev role="member">zorry</dev>


<extrachapter position="bottom">
<title>I Want to Participate</title>
<section>
<body>
<p>
To participate in the Hardened uClibc project join the mailing list at
<c>gentoo-hardened@g.o</c> and visit our online IRC channel at
<c>#gentoo-hardened</c> on <c>irc.freenode.net</c>.
</p>
</body>
</section>
</extrachapter>

</project>