On Sun, Apr 19, 2009 at 9:44 AM, Thomas Sachau <[email protected]> wrote: > basile schrieb: >> >> Hi, a have a couple of question is for Gordon and Nedd regarding >> rebuilding an entire desktop system with emerge -e world, both amd64 and >> i686. I'm mostly worried about the security implications of the >> choices I'm making and I'm not 100% sure of my understanding. >> >> 1) Regarding choice of compiler. gcc-config -l gives >> >> [1] x86_64-pc-linux-gnu-3.4.6 >> [2] x86_64-pc-linux-gnu-3.4.6-hardenednopie >> [3] x86_64-pc-linux-gnu-3.4.6-hardenednopiessp >> [4] x86_64-pc-linux-gnu-3.4.6-hardenednossp >> [5] x86_64-pc-linux-gnu-3.4.6-vanilla >> [6] x86_64-pc-linux-gnu-4.1.2 >> >> My understanding is that [1] is fully hardened and that [2]-[5] are >> exactly what they say, respectively no pie, no pie nor ssp, no ssp and >> fully vanilla. My confusion is about 4.1.2. What hardening is present >> in it? (Did some hardening which wasn't present in gcc-3 make it to >> gcc-4 vanilla?) What's the best practice here? > > You are right with gcc-3.4.6-r2. How did you install gcc-4? It should be > masked as that version does > not have any builtin hardened features, so is only a normal, none-hardened > gcc-4.1.2
This can happen when using a non-hardened stage3 tarball during the install, then switching to the hardened profile later. I've noticed it's not immediately clear where to get hardened stages in the documentation. For those wondering, the mirror URL can be found in the topic on #gentoo-hardened, i.e.: http://gentoo.osuosl.org/releases/${ARCH}/2008.0/stages/hardened/ > >> >> >> 2) Regarding the choice of profiles on amd64. I have >> >> [6] hardened/amd64 >> [7] hardened/amd64/multilib * >> [10] hardened/linux/amd64 >> >> I'm using the multilib and I'm wondering what the security implications >> of this decision. Also, should I be thinking about the newer [10] on >> amd64? What about the similar choice on i686? >> >> Thanks guys. >> > > What security implications should be there? > The newer [10] is still experimental and may change without warning. Use > either [6] or [7] for now. > > -- > Thomas Sachau > > Gentoo Linux Developer > > -- Mansour Moufid http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xDF2862BA
