Re: [gentoo-hardened] Using PaX / Need to recompile whole gentoo?

[Rumen Yotov]

Michael Decker wrote:

>	Hi,
>
>i'm confused. Perhaps somebody could help me, please.
>
>I thought, if I use "hardened gentoo" sources, it would be compiled with
>PIE/SSP, or not?
>
>But http://www.gentoo.org/proj/en/hardened/pax-quickstart.xml tells:
>
>	--- SNIP ---
>5. Building a PIE/SSP Enabled Userland
>Hardened Gentoo has added support for transparent PIE/SSP building via
>GCC's specfile. This means that any users upgrading an older Hardened
>install should remove any LDFLAGS or CFLAGS used to trigger PIE/SSP.
>Also, the hardened-gcc package is now deprecated and should be unmerged
>(version 5.0 is a dummy package). To get the current GCC, add
>USE="hardened pic" to /etc/make.conf if not using the hardened profile.
>To maintain a consistant toolchain, first emerge binutils gcc
>virtual/libc. Next, rebuild the entire system with emerge -e world. All
>future packages will be built with PIE/SSP.
>	--- SNAP ---
>
>So I start "emerge binutils gcc virtual/libc"... But it take now more
>then three hours on my old machine and I think it would take additional
>  four or more hours... And I think "emerge -e world" would take more
>time, or not?
>
>Is it really necessary to recompile that whole stuff?
>
>Thanks a lot.
>
>Bye,
>	Mike
>
>
Hi,
The name "hardened-sources" applies just to the kernel-sources, they are 
*hardened* so to say.
To have a hardened (so to say) userland you need a hardened-toolchain 
and consequently this will result in having hardened userland programs 
(SSP,PIC,PIE) + PaX from the kernel.
But better use a "hardened-stage3" tarball right from the install (less 
compilation).
HTH.Rumen
-- 
gentoo-hardened@g.o mailing list