Beside modifying profile symlink you shouldn't need "pic" and "pie" flags in your make.conf any more. You can use "hardened" instead. To my best knowledge: compiling gcc and glibc first to get the new toolchain running and going on with "emerge -ve" world thereafter seems to be the method of choice for you. In this way it is ensured that every component will experince the beneficial effect of hardening during world compilation. You can postpone bringing up your grsecurity RBAC system as you wish.
Regards, Dw. Jason K Larson said: > What is the best procedure for taking a system > from: default-linux/x86/2005.0 > to: hardened/x86/2.6 > > So far I'm thinking just update the profile symlink and `emerge -ve > system`, but I've seen a few threads about needing to emerge gcc and/or > glibc a few times first, whats the purpose and correct order to do this > in to get a system to start building correctly for hardened. > > I'm not planning to do anything with selinux yet, but I want to be in a > hardened state to prepare for that direction, along with pax and > grsecurity options. > > Thanks in advance, > > -- > Jason K Larson > > -- > [email protected] mailing list -- dr Tóth Attila, Radiológus Szakorvos jelölt, 06-30-5962-962 Attila Toth MD, Radiology Radiologist in Training, +36-30-5962-962 -- [email protected] mailing list
