Re: [gentoo-dev] Hardening a default profile

["Tiziano Müller" <dev-zero@gentoo.org>]

Hi Michael

Am 11.06.2017 um 23:39 schrieb Michael Brinkman:
>  Hello, so I've been running Gentoo Hardened for a few years on my
> laptop, my desktop, and a server made from an older desktop.
> 
> Because of Grsecurity closing access to its source to non-subscribers,
> I decided that I would just try to stick with Gentoo-sources and
> harden the default profile and follow the KSSP guidelines to get as
> close as possible without losing the testing kernel.  Because of this,
> I no longer used the PaX features and decided switch to the default
> profile and enabling my own flags.

The security people probably have more insight, but I personally run by
default the hardened profile, also in combination with gentoo-sources if
there were too many compatibility issues with the software I had to run
on that specific machine.
So, from my point of view there is no reason to switch to the default
profile just because the grsec-kernel-patchset isn't open source anymore.

Best regards,
Tiziano