Re: [gentoo-hardened] gcc-config

[Albert Lash <alby@thirteen.net>]

Hello again,

I jumped the gun and attempted to reload the toolchain after changing the
gcc profile to gcc-3.4.4-r1-hardened. I got through
binutils and gcc, then glibc fails, saying it explicity requires SELInux.

Strange thing happened to my gcc profiles too. Running gcc-config shows 5
choices, only gcc-3.4.4-hardened is gone, replaced by gcc-3.4.4-vanilla at
the end. This sort of makes sense.

Currently I am again compiling gcc, hoping that it will do something that
will make glibc compile OK. I selected gcc-3.4.4-hardened-nopie to see if
that helps.

Does

gcc-3.4.4-hardened-nopiessp mean that neither pie or ssp will be
installed, or only ssp? I searched around for an explanation of these
profiles but found none. Might be a good idea for the docs.

Alby

On Sat, 24 Sep 2005, Albert Lash wrote:

> Hello,
>
> I am running gentoo-hardened kernel 2.6.11-r15 on an amd64 system. I have
> followed the convert howto and found it very straightforward and clear.
>
> However, I noticed my list of deps was rather large during a recent emerge
> pretend and so I checked my setup and found SELinux to be not enabled -
>
> !!!SELinux not enabled:...
>
> So I checked my profile, and it was not the hardened profile! I updated
> the profile, and reloaded the profile, and so now when I run sestatus it
> gives me the desired response:
>
> sestatus
> SELinux status:         enabled
> SELinuxfs mount:        /selinux
> Current mode:           permissive
> Policy version:         18
>
> Policy booleans:
> secure_mode             inactive
> ssh_sysadm_login        inactive
> user_ping               inactive
>
> However, when I run gcc-config -l, I am running the vanilla gcc-3.4.4. I
> searched for information on whether I need to be using the hardened and
> can't find much. Do I need to enabled the hardened compiler, and
> re-compile everything under the new selinux profile and policy?
>
> Thank you,
>
> Alby Lash
>
> --
> gentoo-hardened@gentoo.org mailing list
>
-- 
gentoo-hardened@gentoo.org mailing list