On Friday, November 25, 2016 at 8:52:01 AM UTC-5, jkitt wrote: > On Friday, 25 November 2016 11:38:21 UTC, [email protected] wrote: > > can you just tell us the options so we can compile it ourselves? paste the > > cfg or something. > > https://wiki.gentoo.org/wiki/Hardened/FAQ#Do_I_need_to_pass_any_flags_to_LDFLAGS.2FCFLAGS_in_order_to_turn_on_hardened_building.3F > > Also: > > > Can I add -fstack-protector-all or -fstack-protector in the make.conf > > CFLAGS? > > > No, they will likely break the building of many packages, amongst others > > glibc. > > in other words these options will break some packages - particularly glibc; > ulibc is more flexible in that regards. > > There's also: https://wiki.gentoo.org/wiki/Hardened/Toolchain > > It's not as straightforward as you think. Perhaps you can build selected > applications as statically linked with PIE, and place it in a grsec chroot > instead - it would be a lot simpler. > > I'd really like to see Gentoo (hardened) support, that and OpenBSD.
I've always used a grsec kernel with baremetal debian. I just slete the default security over performance option. But I'm assuming some pax settings conflict with xen? So wanted to see your working .config file. Or maybe i'm wrong and should just try it myself... I just kind of figure that since I'm using qubes whats the point is it really worth all the effort... -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/e61ade92-fb40-4bdd-b9de-fd6110d8047a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
