1 |
Looks like the thread I started about moving more hardened features to |
2 |
default |
3 |
<http://archives.gentoo.org/gentoo-dev/msg_ef3dbd4ba400a5936cd5b7546b86d875.xml> |
4 |
got a lot of positive feedback. Kernel hardening features are more |
5 |
problematic, but hardening the toolchain seems to be within reach. |
6 |
|
7 |
I'd like to produce some implementation plan for that, and my suggestion |
8 |
is to change the meaning of the "hardened" USE flag for GCC. I'd like to |
9 |
build all 4 or so specs for gcc always, and the "hardened" USE flag |
10 |
would just control which one is the default: the vanilla one or |
11 |
full-hardening one. |
12 |
|
13 |
This would allow people to manually start using hardened toolchain |
14 |
without even switching profile, and should be a no-op for everyone else. |
15 |
From there we can later proceed to apply more features. |
16 |
|
17 |
Thoughts? |