Re: [gentoo-hardened] State of Hardened + AMD64?

[Matthew Summers]

On Thu, Feb 21, 2008 at 8:21 AM, Kerin Millar <kerframil@×××××.com> wrote:

> On 21/02/2008, Calum <caluml@×××××.com> wrote:
>
> [snip]
>
> > Yes, that's what I did. There is a hardened/amd64/ and a
> >  hardened/amd64/multilib/ profile. Does that mean then, that if I use
> >  the multilib amd64 profile, I should have less problems?
>
> Yes.
>
> >  >  Regardless of whether that was the case or not, I wouldn't
> personally
> >  >  recommend migrating systems in this manner in-situ as it is a
> complex
> >  >  procedure at the best of times. I'd suggest to use a recent stage
> >  >  tarball (see the topic in the #gentoo-hardened channel), roll a new
> >  >  chroot and use that as a basis for preparing your new base system.
> >
> >
> > No, it's not something I'd normally want to do, given the choice. But
> >  life is never perfect, is it? :)
> >  It's a box that's up and running, and I wanted to migrate it with
> >  minimal downtime.
>
> Preparing a chroot need not entail any downtime. You could use the
> quickpkg tool to generate binary packages from within the chroot then
> consume those packages on your live system. There are still many
> factors to consider but it's a lot more reliable than a "direct"
> migration.
>
> >
> >  Other than that, though - is the AMD64 Hardened as well polished as
> >  the X86 variety?
>
> Yes.
>
> Regards,
>
> --Kerin
> --
> gentoo-hardened@l.g.o mailing list
>
>
I have been running hardened amd64 in production for some time now with
great results.  I did, however, start from a hardened stage3 on all the
machines. From what you have said, downtime is an issue, so I agree with
Kerin Miller above, build in a chroot, perhaps on another drive, then reboot
after everything (hardened kernel) is done.

Regards,
-- 
M. Summers

msummers42@×××××.com

"...there are no rules here -- we're trying to accomplish something."
- Thomas A. Edison