Profile 17.0

[mv]

[LIsLinuxIsSogood]

Ok I just updated the toolchain, and now running a emerge @system. As I was led to believe it would be wise to update static libraries so that is going to be my next course of action.

So that I can free up the processor time and be running stuff in between updates, my hope is to be completing the rest of the changes more slowly, like I said, I'm running emerge @system right now, and next onto the updating of the static libraries, but I am curious to know where does that leave in terms of all the rest of the previously built packages using the old compiler tools, and will this transition be possible by just waiting for package upgrades to be available in the portage tree? I don't mind reinstalling just the packages that need it, but I don't see the point in updating the ones that just won't be using PIE at all now or before.

Does that actually make any sense?

[mv]

[LIsLinuxIsSogood]

Great...so my system will have the PIE updates within any application that has static libraries involved in it. What about any other static libraries on the disk/system that were installed from outside of portage tree? Are those as well the same common set of intstructions here to replace those packages and libraries with a rebuild of the more security compliant gcc with position independent whatever....

[krinn]

[LIsLinuxIsSogood]

While I get that this is generally going to be true for the situation that I'm asking about, maybe my question is better reworded to be asking about a good source for reading up on the process of improving the builds of packages on my system with the new toolchain. In other words, howevery the package maintainers that are working on it are doing it, since some of the reasons for building out of the portage tree for me includes keeping multiple versions without the need for slots of certain applications like vlc media player, for which I have like 3 or 4 different binaries built. I'm just wondering to cover the security concern for whatever the profile change is really about (eliminating the previous easily hacked libraries from the system, I suppose) what kind of information does Gentoo developers source for the reason for changing over. Then I could read that and implement on my system in the other ways I'm describing such as with out of portage tree package installations. If not, then the gentoo developers are pretty much telling me that I have to go find out for myself, and at that point whatever I find out could logically be more reason to not have the PIE implemnted as much as yes having it implemented.

What I understand about that is the build problems that will exist when trying to use the -pie and pie CFLAG settings. So that really can only impact the dependencies within Portage though. But if I go through the process as I want to convert the local out of tree builds into ebuilds in a local repo I will likely be faced with this as a problem, and so I'm trying to be getting ahead of the curve in terms of whether or not the profile change is designed to eliminate all non-positional independent environment for the code, or does that not really matter so long as the bulk of it is done in the more secure profile. Just a matter of opinion but if the reason for the profile change was to add this feature I would think the name of the profile should somehow reflect the change of feature, rather than just the number of the year in which it was done.

EDIT: I'd like to add a note to keep in mind I am not a production environment or system admin, just a user and therefore I have no issues with the handling of the issue however it is needed to satisfy whatever common setups exist out there among the other gentoo linux community. However personally, as someone else may have mentioned I don't like the idea of being forced to update the system. Especially this laptop I have, which I rely on for a lot of different purposes. My home desktop, seems like a straightforward thing and I will go ahead with the instructions as provided in the announcement for that.

[nokilli]

So I'm a good Gentoo citizen and I dutifully do the 17.0 thing and just as it completes and I'm set to revel in my oh-so-much-more-secure system I turn on the news and there's Spectre and Meltdown.

:::facepalm:::
_________________
Today is the first day of the rest of your Gentoo installation.

[cloc3]

[mv]

[saboya]

[depontius]

From the way I understand it, AMD is not susceptible to Meltdown, so PTI isn't needed.

But practically anything with speculative execution is susceptible to Spectre, however as of yet there is not kernel fix. But both Firefox and Chrome are intentionally degrading their high resolution timer capability, to mitigate Spectre. For personal use, especially on Gentoo where we compile our own software, this will protect us from javascript - basically the biggest potential attack vector.
_________________
.sigs waste space and bandwidth

[Havin_it]

I decided to just bite the bullet and go along with the profile update as prescribed. Took a while to get started on the rebuilds, until I twigged that using distcc with a non-pie host was an (obvious, now I think of it) no-go. Thanks to the poster here who pointed this out

Was about 700/1060 thru the emerge -e world when it crapped out (due to me forgetting to download the oracle-jdk-bin into my distfiles - gah! - but this can also happen for reasons unrelated to one's own negligence).

On attempting to resume, I got the dreaded "Invalid resume list" message

For those who've not had the "pleasure", this wipes the resume list so you can't resume, so here is a tip in case anyone has it happen to them:

This failure will spit out a list of packages still to (not) be merged. If you're able in whatever terminal you're in (and the whole list fits in your scrollback buffer), copy the output into a text file: just all the lines that look like this:

[fedeliallalinea]

Or remeber to add --keep-going option to emerge.
Another solution is to use command emerge -1 $(eix-installed-after -btF /usr/bin/gcc) (mv solution) but require eix package installed
_________________
Questions are guaranteed in life; Answers aren't.

[Hu]

[Spargeltarzan]

Does somebody know exactly what became merged into profile 17.0 and/or what may be in future become included as well?

Extract from Hardened-Docu, what all is covered by Hardened:
1) Enabling specific options in the toolchain (compiler, linker ...) such as forcing position-independent executables (PIE), stack smashing protection and compile-time buffer checks.
2) Enabling PaX extensions in the Linux kernel, which offer additional protection measures like address space layout randomization and non-executable memory.
3) Enabling grSecurity extensions in the Linux kernel, including additional chroot restrictions, additional auditing, process restrictions, etc..
4) Enabling SELinux extensions in the Linux kernel, which offers a Mandatory Access Control system enhancing the standard Linux permission restrictions.
5) Enabling Integrity related technologies, such as Integrity Measurement Architecture, for making systems resilient against tampering

For 1) we have got PIE with profile 17.0, but what's about "stack smashing protection" and "compile-time buffer checks"?
2) 3) is dead in the moment unless using the old 4.9 kernel.
For 4) I believe it is recommended to change to a hardened-profile.
Finally, what's about 5) in profile 17.0?

Could I stay on profile 17.0 and activate more hardening features, probably by use flag "hardening"?
_________________
___________________
Regards

Spargeltarzan

Notebook: Lenovo YOGA 900-13ISK: Gentoo stable amd64, GNOME systemd, KVM/QEMU
Desktop-PC: Intel Core i7-4770K, 8GB Ram, AMD Radeon R9 280X, ZFS Storage, GNOME openrc, Dantrell, Xen

[mv]

[LIsLinuxIsSogood]

Thank you to mv for the instructions (in page 2 or 3 of the thread involving updates to static libraries)... The programming of Portage is truly remarkable that it can handle all that with such elegance.

Here's though where I think the announcement and the use of emerge -e @world (as was suggested in the announcement) that will not be happening, for me, is likely in general too much and not necessary, not to mention putting the processor and equipment under a lot of stress which I can't say is good or bad, but if it isn't necessary than why do it??

The reason that the empty tree build of world set doesn't seem to make sense to me is because there are other ways to do this....LIKE WITH THE eix program as mentioned several times. Also, I don't see the point of really jumping into an empty tree build of the world set without first preparing for the worst (or else as others have pointed out to use the --keep-going option)

Of course the main thing that has to be done first is installing the toolchain, so I was wondering why there isn't a set in portage for this then? It would make so much more sense I think to have that, so that the instructions could be done so much more easily with

emerge -1 @toolchain
emerge -e @system
emerge -1 ...with whatever command to install the remaining packages either in world or selected sets for example

And actually what I'm really wondering is if the emptytree for system is even a bit over kill since that I just looked at which is going to be 216 packages on my desktop PC, which could probably take a long time!!!

[mv]

[LIsLinuxIsSogood]

EDIT: Oh also, my use flags for gcc are the following is what's enabled: cxx nls fortran nptl openmp pch sanitize ssp vtv pie (of course)

[NeddySeagoon]

LIsLinuxIsSogood,

Sets are simple lists. You can write a meta ebuild that accepts USE flags to get the functionality you suggest though.
Look at mate-1.18.ebuild as an example. It has some unconditional dependencies, followed by USE flag controlled groups.

Your own meta ebuilds go in your local overlay.

meta means its an ebuild that calls other ebuilds, much like a set, but USE flags are allowed.
Its your ebuild, the naming is up to you.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[krinn]

[mv]

[krinn]

[mv]

[eddy89]

Hi all,
I'm sorry I did not read after page 5, so if someone already asked my question, well, sorry.

How do I check if my system(a single binary/library) is already compiled pie?
I ask this question mainly because: