Hi, a have a couple of question is for Gordon and Nedd regarding
rebuilding an entire desktop system with emerge -e world, both amd64 and
i686. I'm mostly worried about the security implications of the
choices I'm making and I'm not 100% sure of my understanding.
1) Regarding choice of compiler. gcc-config -l gives
[1] x86_64-pc-linux-gnu-3.4.6
[2] x86_64-pc-linux-gnu-3.4.6-hardenednopie
[3] x86_64-pc-linux-gnu-3.4.6-hardenednopiessp
[4] x86_64-pc-linux-gnu-3.4.6-hardenednossp
[5] x86_64-pc-linux-gnu-3.4.6-vanilla
[6] x86_64-pc-linux-gnu-4.1.2
My understanding is that [1] is fully hardened and that [2]-[5] are
exactly what they say, respectively no pie, no pie nor ssp, no ssp and
fully vanilla. My confusion is about 4.1.2. What hardening is present
in it? (Did some hardening which wasn't present in gcc-3 make it to
gcc-4 vanilla?) What's the best practice here?
2) Regarding the choice of profiles on amd64. I have
[6] hardened/amd64
[7] hardened/amd64/multilib *
[10] hardened/linux/amd64
I'm using the multilib and I'm wondering what the security implications
of this decision. Also, should I be thinking about the newer [10] on
amd64? What about the similar choice on i686?
Thanks guys.
--
Anthony G. Basile, Ph.D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
USA
(716) 829-8197
