basile schrieb: > > Hi, a have a couple of question is for Gordon and Nedd regarding > rebuilding an entire desktop system with emerge -e world, both amd64 and > i686. I'm mostly worried about the security implications of the > choices I'm making and I'm not 100% sure of my understanding. > > 1) Regarding choice of compiler. gcc-config -l gives > > [1] x86_64-pc-linux-gnu-3.4.6 > [2] x86_64-pc-linux-gnu-3.4.6-hardenednopie > [3] x86_64-pc-linux-gnu-3.4.6-hardenednopiessp > [4] x86_64-pc-linux-gnu-3.4.6-hardenednossp > [5] x86_64-pc-linux-gnu-3.4.6-vanilla > [6] x86_64-pc-linux-gnu-4.1.2 > > My understanding is that [1] is fully hardened and that [2]-[5] are > exactly what they say, respectively no pie, no pie nor ssp, no ssp and > fully vanilla. My confusion is about 4.1.2. What hardening is present > in it? (Did some hardening which wasn't present in gcc-3 make it to > gcc-4 vanilla?) What's the best practice here?
You are right with gcc-3.4.6-r2. How did you install gcc-4? It should be masked as that version does not have any builtin hardened features, so is only a normal, none-hardened gcc-4.1.2 > > > 2) Regarding the choice of profiles on amd64. I have > > [6] hardened/amd64 > [7] hardened/amd64/multilib * > [10] hardened/linux/amd64 > > I'm using the multilib and I'm wondering what the security implications > of this decision. Also, should I be thinking about the newer [10] on > amd64? What about the similar choice on i686? > > Thanks guys. > What security implications should be there? The newer [10] is still experimental and may change without warning. Use either [6] or [7] for now. -- Thomas Sachau Gentoo Linux Developer
signature.asc
Description: OpenPGP digital signature
