[gentoo-hardened] Re: uclibc base system

[Ned Ludd]

Quite impressive Peter.
I have mirrored your files to
http://dev.gentoo.org/~solar/uclibc/peter_mirror/portage-uclibc-overlay-20040614.tar.bz2
and exploded the tarball to
http://dev.gentoo.org/~solar/uclibc/peter_mirror/portage-uclibc/
then diffed out the .org files and the .ebuilds the ebuild's patch is
here 
http://dev.gentoo.org/~solar/uclibc/peter_mirror/portage-uclibc-ebuilds-20040614.patch
and the profile/script data is here
http://dev.gentoo.org/~solar/uclibc/peter_mirror/org-uclibc-20040614.patch

This will be quite a bit of an undertaking I'm hoping mutex, dragonheat
can help with some of these commits.

How may megs is your resulting stage/images after the initial bootstrap
process?

I'm CC: the hardened mailing list as others there may have an interest
in your work as this uses the hardened profile and all :)

On Mon, 2004-06-14 at 19:25, Peter S. Mazinger wrote:
> Hello!
>
> This is the overlay directory I used parallel to portage (it has to be
> there for now, else the included links won't work), that allowed me to
> build gentoo fully uclibc based (starting from a buildroot config,
> building manually python/portage, running emerge sync ...)
>
> 1. the files directories have only new files and links to the originally
> used (for x86), the digest/Manifest files were needed to rebuild fully
> with these configs as an overlay directory, the links because portage
> can't handle "properly (my opinion)" the overlay directory
>
> 2. the ebuilds can be diffed to the corresponding version (as of emerge
> sync 20040613) to see what I have done
>
> 3. some of the changes are not directly uclibc related, they correct
> typos etc. in the originals, add support to build w/o nls, or strip down
> the package somewhat
>
> 4. the directories profiles, scripts include the original version (*.org)
> of files too, the new ones have to be copied over the original tree, the
> overlay support does not allow to have these files at another location.
>
> 5. distfiles include new patches for binutils-2.14.90/15.91 and gcc-3.3.3
> (these have to be copied to the main distfiles, because again the overlay
> structure does not support it in another location)
>
> 6. I haven't tried yet cascaded profiles, the only profile tested is what
> I delivered.
>
> 7. it builds as it is (haven't tried w/ nls, and that is not really
> correct in uclibc yet), don't enable nls for now
>
> 8. stage building and bootstraping was not tested, because I didn't find
> an "elegant" way to make a stage1/2/3 from .tbz2 files (any help
> appreciated, then I could also provide a stage1)
>
> 9. for now gettext, yacc (replaced by bison -y), ncompress
> (uncompress replaced by gzip), bc, bin86, groff, man[-pages] are not a
> part of an 'emerge system', cracklib got support for gzipped files (so
> miscfiles is much smaller), w/o groff and man-pages it is not a
> requirement to have c++ compiler either (this is not implemented, should
> probably be a flag in gcc, like f77, objc), gnuconfig_update is only
> needed where configure is run directly, not by econf (econf is hacked to
> provide the same functionality, as gnuconfig_update), ncurses does not
> deliver the addon libraries (menu,panel,form). Some told me that gettext
> can't be removed, else autotools won't run, well I think, the .m4 from
> gettext could be added to autotools, and than it should be no problem w/o
> it.
>
> 10. added also my make.conf and package.keywords, to show which versions
> where used, the most is stable stuff, but some have to be ~x86.
>
> 11. mainly the shared libs will have problems, to add support for new
> libs, look at the libtool patches (ltconfig-uclibc for older configures
> and libtool-1.4.3-uclibc for newer ones)
>
> 12. be aware that you have to build the buildroot w/ the same config (and
> patches), as deduced from the uclibc.ebuild (using in both places the
> same cvs too). Do not start from uclibc-0.9.26 stable, because it is not
> binary compatible w/ the current cvs.
>
> 13. hardened stuff: gcc uses pie and ssp, but relro/now are disabled,
> relro is also completely removed from binutils, uclibc does not have
> support for it (any volunteer to add this to the uclibc's ldso?)
>
> 14. CHOST has to be set to *linux-uclibc (not linux-gnu)
>
> Peter
-- 
Ned Ludd <solar@g.o>
Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer