hardened->vanilla

[sotn3m]

I would like to change my system from being "hardened" to vanilla. One of the reasons is that I could use prelink.

My question is: is there anyone who maybe tried to write a script which will remerge packages which have binaries still hardened? Remerging all will take me a week and it would be nice to have such a tool. For example, during remerge, if anything fails then there is a need to track all things that were already done and remerge only the others.. Lots of packages->lots of work ;) or I would like to remerge "system" first and then the rest of the world...

Any ideas, anyone?;)

[sotn3m]

bump ..
how would you change suddenly everything from hardened to normal gcc? or maybe I don't need to change everything?

It's weird. Hardened problems are the ones, noone knows answers

[erikm]

I would like to change my system from being "hardened" to vanilla. One of the reasons is that I could use prelink.

My question is: is there anyone who maybe tried to write a script which will remerge packages which have binaries still hardened? Remerging all will take me a week and it would be nice to have such a tool. For example, during remerge, if anything fails then there is a need to track all things that were already done and remerge only the others.. Lots of packages->lots of work or I would like to remerge "system" first and then the rest of the world...

Any ideas, anyone?;)

Prelink works perfectly with the hardened toolchain. Some people seem to have had problems with prelink and the hardened kernel sources, but that is something else entirely.
Otherwise, the hardened profile only affects most packages at build time (using the hardened gcc profile). A small number of packages (ex. pkgconfig, glib) are influenced by the hardened use flag and those use flags implied (ex. selinux) by the hardened profile.
These shouldn't be too hard to reemerge with the vanilla profile via a standard 'emerge -uDN world'.

I myself have been using the hardened profile with moderate CFLAGS and LDFLAGS, prelink, and a ck kernel for the better part of a year now. Save for the extremely rare failed build, I cannot think of a reason not to use the hardened profile.

[sotn3m]

Prelink works perfectly with the hardened toolchain. Some people seem to have had problems with prelink and the hardened kernel sources, but that is something else entirely.
Otherwise, the hardened profile only affects most packages at build time (using the hardened gcc profile). A small number of packages (ex. pkgconfig, glib) are influenced by the hardened use flag and those use flags implied (ex. selinux) by the hardened profile.
These shouldn't be too hard to reemerge with the vanilla profile via a standard 'emerge -uDN world'.

I myself have been using the hardened profile with moderate CFLAGS and LDFLAGS, prelink, and a ck kernel for the better part of a year now. Save for the extremely rare failed build, I cannot think of a reason not to use the hardened profile.

What kind of packages do You have? Cause my doubts came from official prelink guide:

Warning: Prelink will not work with Hardened Gentoo. This is because both projects try to change the address space mapping of shared libraries. But prelink with the -R option randomises library base addresses, providing some degree of hardened protection.

..

[GNUtoo]

prelinking has securities issues
see http://kerneltrap.org/node/6662

[sotn3m]

prelinking has securities issues
see http://kerneltrap.org/node/6662

I can believe that..
But I am beginning to be fed up with for exemple opera loading almost 10sec...

I have:

Code: Select all

model name      : AMD Sempron(tm) 2200+
cpu MHz         : 1512.272
cache size      : 256 KB

-> most apps should load a lot faster I suppose...

[Beefrum]

Factory pre-linking?

But I am beginning to be fed up with for exemple opera loading almost 10sec...

[sotn3m]

:? Factory pre-linking?

I didn't quite get it.. Is it about the fact that this is a binary and it can't be prelinked?

[Beefrum]

Keeping people waiting is, of course a corporate policy, YES that's what I meant.