[gentoo-dev] Making the hardened toolchain the default

[Travis Tilley]

...ok, once again not really, but i cant use that trick to get people's 
attention after today so i figured i might as well use it twice. :)

recent gcc ebuilds have been patched to recognise an environment 
variable, GCC_SPECS, that sets which specs-file should be used. the gcc 
3.4.2-r2 ebuild also builds both hardened and non-hardened specs files 
for all users (though it doesnt make hardened the default specs file for 
non-hardened users).

so, what does this mean? it means that everyone can now assist in fixing 
hardened toolchain related bugs in the packages they maintain without 
having to recompile gcc to get a hardened toolchain up. good stuff, eh? :)


ayanami root # gcc main.c -o main ; file main
main: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for 
GNU/Linux 2.4.1, dynamically linked (uses shared libs), not stripped

ayanami root # export 
GCC_SPECS=/usr/lib/gcc/x86_64-pc-linux-gnu/3.4.2/hardened.specs

ayanami root # gcc main.c -o main ; file main
main: ELF 64-bit LSB shared object, AMD x86-64, version 1 (SYSV), not 
stripped


so now, for anyone interested, helping with hardened now requires the 
absolute minimum effort possible and shouldnt be a pain for devs who 
dont want to have a full hardened install. go team! *high-fives Rob 
Holland for writing the patch*

patched ebuilds:
gcc-3.3.4-r2
gcc-3.4.1-r3
gcc-3.4.2-r2


Travis Tilley
Gentoo/AMD64

--
gentoo-dev@g.o mailing list