[gentoo-hardened] Re: Intel quad core and hardened

[7v5w7go9ub0o]

dexters84 wrote:

> I've setup a hardened gentoo on the following settings:
>
> CHOST="x86_64-pc-linux-gnu"
> CFLAGS="-march=nocona -O2 -pipe"
>
> My cpu is quad core xeon + 4 GB ram, it is working without any problems.
> While it is perfectly doable to create a hardened setup for mentioned
> CPU i think that for a desktop machine it makes little sense.
>
> The choice is, as always with gentoo, up to You.

Thanks for the reply, dexter!

Another question, please.   FWICT, a year ago
http://www.irqbalance.org/documentation.php in userland was generally
considered better than the in-kernel algorithm.

Do you think that is still the case for 2.6.23+?

If so, IIUC I'd disable the kernel irq balancing algorithm within the
kernel!?

TIA

(As far as hardened on a desktop is concerned I admit it is a bit
non-traditional, but managing one's financial accounts via desktop is 
non-traditional, and there seems today to be an increasing amount of 
serious energy directed toward compromising desktops (for financial 
information or bot service). So a very strong appeal of Gentoo is its 
hardened sources and the OpenBSD-like chroot jails. It has worked 
smoothly for me for years now, and I'd simply maintain the current boxes 
(desktop is copied to the laptop).

I am on the road a lot, and frequently use open hotspots to conduct
business (i.e. a hostile LAN). After one reads of the latest browser,
media-streaming, or IM memory attacks, it is reassuring to know that
each of my WAN-connected clients is in its own individual, hardened jail
(this is GRSecurity, not SELinux - a lot easier for a home user to
maintain).

Heh.. in fact, to make it even farther over the top, I run the browser
chroot jails in RamDisk :-) )






-- 
gentoo-hardened@l.g.o mailing list