Gentoo hardened profile - Revision history

95.225.12.24: typo corrected

2012-08-29T16:49:47Z

typo corrected

Rh1 at 03:00, 28 May 2011

2011-05-28T03:00:56Z

Damex at 19:24, 4 February 2011

2011-02-04T19:24:59Z

Damex at 19:21, 4 February 2011

2011-02-04T19:21:57Z

Damex at 19:19, 4 February 2011

2011-02-04T19:19:58Z

Damex at 21:15, 17 January 2011

2011-01-17T21:15:26Z

Slashbeast: moved Hardened to Gentoo hardened profile

2011-01-11T00:53:18Z

moved Hardened to Gentoo hardened profile

Slashbeast at 00:51, 11 January 2011

2011-01-11T00:51:58Z

Damex: /* Hardened toolchain */

2010-12-14T17:11:12Z

‎Hardened toolchain

Damex: /* Hardened toolchain */

2010-12-10T21:29:13Z

‎Hardened toolchain

← Older revision		Revision as of 16:49, 29 August 2012
Line 1:		Line 1:
−	{{fancywarning\|Things, described at that wiki page is _NOT_ supported by funtoo upstream and this is a sure way to destroy your system if you ~~are~~ do not know what are you doing, following this wiki.}}	+	{{fancywarning\|Things, described at that wiki page is _NOT_ supported by funtoo upstream and this is a sure way to destroy your system if you do not know what are you doing, following this wiki.}}

	[http://www.gentoo.org/proj/en/hardened/primer.xml overview of hardened things by gentoo devs]		[http://www.gentoo.org/proj/en/hardened/primer.xml overview of hardened things by gentoo devs]

@@ Line 110: / Line 110: @@
 #git clone git://github.com/damex/hardened-overlay.git
 </nowiki>}}
-after that we need to make proper /etc/make.profile
+Previously it was possible to make use of /etc/make.profile to add the hardened profile but this method is now broken. Currently, the easiest way to accomplish this is to switch to the new funtoo-path version of portage. This can be accomplished by emerging portage-9999. More information on how to setup this new version can be found in [http://forums.funtoo.org/viewtopic.php?id=194 this thread] from Funtoo forums. After switching simply add '/overlay/hardened-overlay/profiles' to the end of your /etc/portage/parent file and add '/overlay/hardened-overlay' to /etc/portage/overlays.
-{{Root|<nowiki>#rm /etc/make.profile
-#mkdir /etc/make.profile
+Once you have everything set up run:
-#touch /etc/make.profile/parent
-#echo /usr/portage/profiles/default/linux/amd64/2008.0 /etc/make.profile/parent
-#echo /overlay/hardened-overlay/profiles /etc/make.profile/parent
-</nowiki>}}
-st echo - for your current profile. 2nd - for the overlay's. only that priority.
-now we'r need to add out overylay to the make.conf
-{{Root|<nowiki>/etc/make.conf
-PORTDIR_OVERLAY="/overlay/hardened-overlay"
-</nowiki>}}
-and run
 {{Root|<nowiki>#env-update && source /etc/profile
 </nowiki>}}
-few new flags like 'hardened' will be used system wide now.
+A few new flags like 'hardened' will now be enabled globaly.
 now we can emerge our toolchain
 {{Root|<nowiki>#emerge -av linux-headers gcc libtool
 </nowiki>}}
-few new flags like 'hardened' will be used system wide now. current gcc (4.3x) have only PIE support (i mean those gcc's that funtoo tree have now ~_~).to use all features of hardened toolchain (PIE/SSP) - we will use gcc-4.4.3-r3 or gcc-4.4.4-r2 (they'r from overlay one). to use that gcc - we may need newer glibc - it must be automatically pickupped form overlay/portage tree. now we can emerge our toolchain
+ current gcc (4.3x) have only PIE support (i mean those gcc's that funtoo tree have now ~_~).to use all features of hardened toolchain (PIE/SSP) - we will use gcc-4.4.3-r3 or gcc-4.4.4-r2 (they'r from overlay one). to use that gcc - we may need newer glibc - it must be automatically pickupped form overlay/portage tree. now we can emerge our toolchain
 now we need to enable our new gcc:
 {{Root|<nowiki>#gcc-config -l

@@ Line 409: / Line 409: @@
 to revert back you need to produce these steps:
-. shut off grbac/pax things
+{{Root|<nowiki>1. shut off grbac/pax things on system/bins
-. revert your lovely non-hardened kernel back
+</nowiki>}}
 . remerge non-hardened toolchain
-. remerge world with non-hardened toolchan
+{{Root|<nowiki>2. bring your lovely non-hardened kernel back
-. PROFIT!1111
+</nowiki>}}
 [[Category:HOWTO]]

← Older revision		Revision as of 19:21, 4 February 2011
Line 1:		Line 1:
−	{{fancywarning\|~~This document~~ is ~~_not_~~ supported by funtoo upstream and this is a sure way to destroy your system if you are do not know what are you doing, following this wiki.}}	+	{{fancywarning\|Things, described at that wiki page is _NOT_ supported by funtoo upstream and this is a sure way to destroy your system if you are do not know what are you doing, following this wiki.}}

	[http://www.gentoo.org/proj/en/hardened/primer.xml overview of hardened things by gentoo devs]		[http://www.gentoo.org/proj/en/hardened/primer.xml overview of hardened things by gentoo devs]

@@ Line 1: / Line 1: @@
-{{fancywarning|This document is Questionable quality and describe a sure way to destroy your system. There is no easy revert beside reinstall.}}
+{{fancywarning|This document is _not_ supported by funtoo upstream and this is a sure way to destroy your system if you are do not know what are you doing, following this wiki.}}
 [http://www.gentoo.org/proj/en/hardened/primer.xml overview of hardened things by gentoo devs]
@@ Line 403: / Line 403: @@
 * "..." mean your defined options.
 [[Category:HOWTO]]

← Older revision		Revision as of 00:51, 11 January 2011
Line 1:		Line 1:
		+	{{fancywarning\|This document is Questionable quality and describe a sure way to destroy your system. There is no easy revert beside reinstall.}}
		+
	[http://www.gentoo.org/proj/en/hardened/primer.xml overview of hardened things by gentoo devs]		[http://www.gentoo.org/proj/en/hardened/primer.xml overview of hardened things by gentoo devs]

@@ Line 97: / Line 97: @@
 for using hardened system with gentoo - you was need to change your portage profile to the hardened one.
-like tha
+like that
 {{Root|<nowiki>#ln -sfn /usr/portage/profiles/hardened/linux/2.6/amd64/10.0 /etc/make.profile
 #env-update && source /etc/profile

@@ Line 125: / Line 125: @@
 few new flags like 'hardened' will be used system wide now.
 now we can emerge our toolchain
-{{Root|<nowiki>#sudo emerge -av linux-headers gcc libtool
+{{Root|<nowiki>#emerge -av linux-headers gcc libtool
 </nowiki>}}
 few new flags like 'hardened' will be used system wide now. current gcc (4.3x) have only PIE support (i mean those gcc's that funtoo tree have now ~_~).to use all features of hardened toolchain (PIE/SSP) - we will use gcc-4.4.3-r3 or gcc-4.4.4-r2 (they'r from overlay one). to use that gcc - we may need newer glibc - it must be automatically pickupped form overlay/portage tree. now we can emerge our toolchain
@@ Line 139: / Line 139: @@
 </nowiki>}}
 now just emerge other part of toolchain
-{{Root|<nowiki>#sudo emerge -av linux-headers glibc binutils libtool
+{{Root|<nowiki>#emerge -av linux-headers glibc binutils libtool
 </nowiki>}}
 now its time to run
-{{Root|<nowiki>#sudo etc-update
+{{Root|<nowiki>#etc-update
 </nowiki>}}
 and recheck your config files.
 after config check - its time to remerge whole world.
-{{Root|<nowiki>#sudo emerge -uDeav world
+{{Root|<nowiki>#emerge -uDeav world
 </nowiki>}}
 dont forget to make sure that you have all use flags that you want enabled. it will take too long so you can just go away from keyboard.