Re: [gentoo-hardened] Some advise regarding recompiling an entire hardened systems

[Thomas Sachau]

basile schrieb:
> Thomas Sachau wrote:
>> basile schrieb:
>>
>>> Mansour Moufid wrote:
>>>
>>>> On Sun, Apr 19, 2009 at 9:44 AM, Thomas Sachau <tommy@g.o>
>>>> wrote:
>>>>
>>>>
>>>>> basile schrieb:
>>>>>
>>>>>> Hi, a have a couple of question is for Gordon and Nedd regarding
>>>>>> rebuilding an entire desktop system with emerge -e world, both amd64
>>>>>> and
>>>>>> i686.   I'm mostly worried about the security implications of the
>>>>>> choices I'm making and I'm not 100% sure of my understanding.
>>>>>>
>>>>>> 1) Regarding choice of compiler.  gcc-config -l gives
>>>>>>
>>>>>> [1] x86_64-pc-linux-gnu-3.4.6
>>>>>> [2] x86_64-pc-linux-gnu-3.4.6-hardenednopie
>>>>>> [3] x86_64-pc-linux-gnu-3.4.6-hardenednopiessp
>>>>>> [4] x86_64-pc-linux-gnu-3.4.6-hardenednossp
>>>>>> [5] x86_64-pc-linux-gnu-3.4.6-vanilla
>>>>>> [6] x86_64-pc-linux-gnu-4.1.2
>>>>>>
>>>>>> My understanding is that [1] is fully hardened and that [2]-[5] are
>>>>>> exactly what they say, respectively no pie, no pie nor ssp, no ssp
>>>>>> and
>>>>>> fully vanilla.  My confusion is about 4.1.2.  What hardening is
>>>>>> present
>>>>>> in it?  (Did some hardening which wasn't present in gcc-3 make it to
>>>>>> gcc-4 vanilla?)  What's the best practice here?
>>>>>>
>>>>> You are right with gcc-3.4.6-r2. How did you install gcc-4? It should
>>>>> be masked as that version does
>>>>> not have any builtin hardened features, so is only a normal,
>>>>> none-hardened gcc-4.1.2
>>>>>
>>>> This can happen when using a non-hardened stage3 tarball during the
>>>> install, then switching to the hardened profile later.
>>>>
>>>> I've noticed it's not immediately clear where to get hardened stages
>>>> in the documentation. For those wondering, the mirror URL can be found
>>>> in the topic on #gentoo-hardened, i.e.:
>>>> http://gentoo.osuosl.org/releases/${ARCH}/2008.0/stages/hardened/
>>>>
>>>>
>>> I followed a variation of the upgrade process discussed here:
>>>
>>> http://www.gentoo.org/proj/en/hardened/toolchain-upgrade-guide.xml
>>>
>>> The differences are I used binutils-2.18 and glibc-2.8_p20080602-r1
>>>
>>> I understand that its a VERY EARLY draft, but it proceeded without any
>>> problems on both i686 and amd64.  I'm pretty sure I didn't loose PIE,
>>> but I'm not so sure about SSP.  I'm playing around now with
>>> -fstack-protector-all in my CFLAGS.
>>>
>>>
>>>
>>>>>> 2) Regarding the choice of profiles on amd64.  I have
>>>>>>
>>>>>>  [6]   hardened/amd64
>>>>>>  [7]   hardened/amd64/multilib *
>>>>>>  [10]  hardened/linux/amd64
>>>>>>
>>>>>> I'm using the multilib and I'm wondering what the security
>>>>>> implications
>>>>>> of this decision.  Also, should I be thinking about the newer [10] on
>>>>>> amd64?  What about the similar choice on i686?
>>>>>>
>>>>>> Thanks guys.
>>>>>>
>>>>>>
>>>>> What security implications should be there?
>>>>> The newer [10] is still experimental and may change without warning.
>>>>> Use either [6] or [7] for now.
>>>>>
>>>>> --
>>>>> Thomas Sachau
>>>>>
>>>>> Gentoo Linux Developer
>>>>>
>>>>>
>>> I remember reading about lots of security bugs with emulating
>>> libraries.  I just googled for it to remind myself.  So I'm wondering
>>> whether profile 6 is better than 7.
>>>
>>
>> There may be open bugs with those emul-linux-* packages which
>> currently provide some basic 32bit
>> libs, but they are not installed by using the profile nor are you
>> forced to use them. If your
>> reading was about something different, please specify it.
>>
>>
>>
> http://blog.flameeyes.eu/tag/multilib
>
>

As i said: Only the library packages are the problem, not the profile itself.

-- 
Thomas Sachau

Gentoo Linux Developer