Re: [gentoo-hardened] Current proposed way of installing gentoo hardened

[Kevin]

Hi All-

I'm late getting in on this thread, but I have to ask:

Do I need to add these settings to my make.conf before I execute 
scripts/bootstrap.sh?

There's nothing in the hardened install docs about that.  Or rather, 
nothing in the docs that I'm using.  Then again, I've noticed some 
differences between what the docs say and what I find on the liveCD (ie. 
after untarring the stage1 tarball 
(stage1-pentium4-pie-ssp-2004.0.tar.bz2), there is no 
directory /mnt/gentoo/selinux to use as a mountpoint for an selinuxfs (as 
directed in the docs below with the commands below): .  I just worked 
around them using my knowledge of the Gentoo install process and the 
regular Gentoo Handbook, but maybe I shouldn't have?

Code Listing 8.3: Prepping and entering the chroot environment

# mount -t proc proc /mnt/gentoo/proc
# mount -t selinuxfs none /mnt/gentoo/selinux   <- no such mountpoint so I
						   made one
# cp /etc/resolv.conf /mnt/gentoo/etc/resolv.conf
# chroot /mnt/gentoo /bin/bash
# env-update
Regenerating /etc/ld.so.cache...
# source /etc/profile
(The above points your shell to the new paths and updated binaries.)

I'm using this:
http://www.gentoo.org/proj/en/hardened/selinux/selinux-x86-install.xml

as my install docs (and it's the source of the Code Listing 8.3 above).  
Is this the right source for installing Gentoo Hardened & SELinux?  Are 
there other docs?

I used these settings (below) for my make.conf before running 
bootstrap.sh.  Should I redo this step using the settings described in 
this thread?

=================================================================
CFLAGS="-O3 -march=pentium4 -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
USE="afs sse krb4 kerberos samba ldap sasl doc apache2 acpi apm berkdb 
crypt cups emacs em
acs-w3 encode ethereal evo firebird flac foomaticdb gpm gstreamer guile 
hardened imap inno
db jabber jack java jikes libwww mad mcal mysql ncurses odbc oggvorbis pam 
pda ppds pdflib
 perl plotutils png prelude python readline ruby slp spell ssl svga tcltk 
tetex tiff truet
ype unicode usb vhosts X kde qt gnome gtk gtk2 quicktime jpeg gif xinerama 
X Xaw3d xml xml
2 xmms xv zeo alsa avi bonobo acl caps imagemagick icq ipv6"
CXXFLAGS="${CFLAGS}"
MAKEOPTS="-j3"
GENTOO_MIRRORS="http://gentoo.oregonstate.edu/"
SYNC="rsync://rsync.namerica.gentoo.org/gentoo-portage"
=================================================================

On Monday 29 March 2004 07:25, Brandon Hale wrote:
> On Mon, 2004-03-29 at 08:41 +0200, Tóth Attila wrote:
>
> The suggested settings are exactly the ones you quoted.
> If you find these too agressive, try:
>
> CFLAGS="-fPIC -fomit-frame-pointer -fstack-protector"
> LDFLAGS="-pie -W,-z,noexecstack -W,-z,noexecheap"
>
> > Hi there,
> >
> > I recently installed gentoo hardened. After emerging system I found,
> > that hardened-gcc was removed. Is there a workaround? Should I take
> > care of it? What flags are advised in make.conf?
> >
> > A quote from Ned Ludd:
> >
> > CFLAGS="-fPIC -fforce-addr -fomit-frame-pointer
> > -fstack-protector-all" LDFLAGS="-pie -W,-z,noexecstack
> > -W,-z,noexecheap"
> >
> > So what are the suggested setting for a new hardened install starting
> > from stage2 or stage3?
> > Thx,
> > Attila Toth
> >
> > --
> > dr Tóth Attila, Radiológus Rezidens, 06-30-5962-962
> > Attila Toth MD, Radiology Resident, [phone]
> >
> >
> >
> > --
> > gentoo-hardened@g.o mailing list

-- 
-Kevin

--
gentoo-hardened@g.o mailing list