Gentoo Archives: gentoo-hardened

From: Ed W <lists@××××××××××.com>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] New uclibc profiles will hit the tree soon
Date: Fri, 14 Dec 2012 12:02:21
Message-Id: 50CB0002.6070805@wildgooses.com
In Reply to: Re: [gentoo-hardened] New uclibc profiles will hit the tree soon by "Anthony G. Basile"
1 Hey, cool!
2
3 Sorry, bit slow keeping up with the list. Great work though! I have
4 been using x86 uclibc for a year now on an embedded router distro, so
5 completely behind this. With new uclibc+nptl there are generally very
6 few build problems. Main problem is builds which exclude iconv and
7 gettext... (eg glib needs some hacking)
8
9 Just a couple of random thoughts:
10
11 - You pull in libiconv as a required package? Wasn't the complaint that
12 this could cause problems with GCC upgrades later? Note I have some
13 patches that I submitted in the past which allow uclibc to build a
14 partly working iconv (almost certainly got bugs, but seems to pass the
15 obvious tests)
16
17 - You have -iconv as a git use, but I think most git ebuilds are forcing
18 it back on again no matter what you say?
19
20 - You appear to mask nls? How about defaulting it to off rather than
21 forcing it off? I'm still unclear what problems are actually caused by
22 installing gettext? Seems like it can cause a permanent dep with gcc
23 linking to it, but for some situations that is probably not the end of
24 the world? Surely some people want nls on... (not me)
25
26
27 It would definitely be good to try and get people building uclibc with
28 iconv - as in, hopefully people will file bugs and fix them and quickly
29 we might end up with a proper working iconv in uclibc. Also canvasing
30 for a mini gettext implementation for runtime use...
31
32
33 Thanks for your work on this!
34
35 Ed W
36
37
38 On 02/11/2012 11:24, Anthony G. Basile wrote:
39 > Hi everyone,
40 >
41 > Can I get feedback regarding the subproject page at
42 >
43 > http://www.gentoo.org/proj/en/hardened/uclibc/
44 >
45 > before I link it up and announce it to the rest of the world.
46 >
47 > BTW, newer stage3's for amd64 and x86 uclibc are on the tree now under
48 > experimental.
49 >
50 > --Tony
51 >
52 >
53 > On 10/27/2012 06:17 AM, Anthony G. Basile wrote:
54 >> Hi everyone,
55 >>
56 >> Either today or tomorrow, there will be two new experimental hardened
57 >> profiles, one on amd64 and the other x86. These will be:
58 >>
59 >> hardened/linux/uclibc/amd64
60 >>
61 >> and
62 >>
63 >> hardened/linux/uclibc/x86
64 >>
65 >> Please be careful with them! Do not try to switch to these profiles from
66 >> a glibc system. portage will complain about blocking and not let you
67 >> proceed, but for the truly stubborn who will hack away until it does
68 >> work, trust me, it will not work. It will utterly break everything.
69 >>
70 >> Aside: while this is an extreme case, switching profiles is never to be
71 >> taken lightly. Eg. hardened <-> non-hardened or selinux <-> non-selinux.
72 >>
73 >> For the curious, you can play with these using the stage3's at
74 >>
75 >> http://http://67.151.215.237/
76 >>
77 >> Notice there are 4 combinations
78 >>
79 >> amd64 hardened
80 >> amd64 vanilla
81 >>
82 >> i686 hardened
83 >> i686 vanilla
84 >>
85 >> The amd64 are completely done. I'm working on i686 now so you may want
86 >> to wait on those. Any stage marked on or later than oct 25 should be
87 >> good.
88 >>
89 >> Note: the vanilla is just hardened with USE="-hardened" set in
90 >> make.conf. They are being built as a comparison to the hardened.
91 >>
92 >>
93 >>
94 >
95 >

Replies

Subject Author
Re: [gentoo-hardened] New uclibc profiles will hit the tree soon "Anthony G. Basile" <basile@××××××××××××××.edu>