[gentoo-user] Switching to hardened

[gentoo-user] Switching to hardened

[Alex Schuster]

Hi there!

I want to harden the gentoo running on my little server, but I'm a little 
worried about possible problems. Like, services not coming up when 
rebooting after an emerge -e world. Do you see any possibility for that?

I followed the guide at <http://rockfloat.com/howto/gentoo-hardened.html> 
(activate hardened profile, enable some kernel options and build new 
hardened kernel, emerge binutils gcc virtual/libc), and 
added -fforce-addr to my CFLAGS. I then switched back to gcc 3.4 from gcc 
4 with gcc-config, and now I should do the emerge -e world. I guess this 
is quite safe?

	Wonko

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] Switching to hardened

[Dan Farrell]

On Wed, 30 Jan 2008 04:19:08 +0100
Alex Schuster <wonko@wonkology.org> wrote:

> I want to harden the gentoo running on my little server, but I'm a
> little worried about possible problems. Like, services not coming up
> when rebooting after an emerge -e world. Do you see any possibility
> for that?

Absolutely.  These problems can be overcome with a little attention,
but outdated config files that were not updated with dispatch-conf or
etc-update might not work with newer versions of software. 
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] Switching to hardened

[Alex Schuster]

Dan Farrell writes:

> Alex Schuster <wonko@wonkology.org> wrote:
> > I want to harden the gentoo running on my little server, but I'm a
> > little worried about possible problems. Like, services not coming up
> > when rebooting after an emerge -e world. Do you see any possibility
> > for that?
>
> Absolutely.  These problems can be overcome with a little attention,
> but outdated config files that were not updated with dispatch-conf or
> etc-update might not work with newer versions of software.

Sure. But the system is up to date, emerge -uN world gives nothing. It's 
only the re-compiling of everything with a hardened gcc that worries me a 
little. If something might go wrong there, I would wait with re-compiling 
until I know I have physical access to the machine for a while, while 
most of the time I am away some 100 km from it.

I must admit that I should know more about the hardened stuff, but I 
thought I'd start with the preparations. Configuring things like Pax 
would come later, when emerge -e world has finished on this slow machine 
(and when I have read all the howtos).

	Wonko
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] Switching to hardened

[Dan Farrell]

On Wed, 30 Jan 2008 11:49:48 +0100
Alex Schuster <wonko@wonkology.org> wrote:

> Dan Farrell writes:
> 
> > Alex Schuster <wonko@wonkology.org> wrote:
> > > I want to harden the gentoo running on my little server, but I'm a
> > > little worried about possible problems. Like, services not coming
> > > up when rebooting after an emerge -e world. Do you see any
> > > possibility for that?
> >
> > Absolutely.  These problems can be overcome with a little attention,
> > but outdated config files that were not updated with dispatch-conf
> > or etc-update might not work with newer versions of software.
> 
> Sure. But the system is up to date, emerge -uN world gives nothing.
> It's only the re-compiling of everything with a hardened gcc that
> worries me a little. If something might go wrong there, I would wait
> with re-compiling until I know I have physical access to the machine
> for a while, while most of the time I am away some 100 km from it.
> 
> I must admit that I should know more about the hardened stuff, but I 
> thought I'd start with the preparations. Configuring things like Pax 
> would come later, when emerge -e world has finished on this slow
> machine (and when I have read all the howtos).
> 
> 	Wonko

You might consider building packages but not installing them -- I think
could use --buildpkgonly (aka -B) to achieve this end.  If the world
emerge with a -B flag finishes successfully, I think that means all
packages were built and you are ready to emerge world with --usepkgonly
(-K) without having to worry about build-time issues that could cause
conflicting packages on the system.  


But what does everyone else think?
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] Switching to hardened

[Eric Martin]

Dan Farrell wrote:
> You might consider building packages but not installing them -- I think
> could use --buildpkgonly (aka -B) to achieve this end.  If the world
> emerge with a -B flag finishes successfully, I think that means all
> packages were built and you are ready to emerge world with --usepkgonly
> (-K) without having to worry about build-time issues that could cause
> conflicting packages on the system.  
>
>
> But what does everyone else think?
>   

I like it.  The only problem is it might not work in some situations 
where you need program A to compile program B (kde4 requires qt4).  I've 
never gone from a non-hardened system -> hardened though so take my 
comments with a grain of salt.  This could also work on other tricky 
upgrades.
-- 
gentoo-user@lists.gentoo.org mailing list

[gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Mateusz Mierzwinski]

Total: 246 packages (201 upgrades, 1 downgrade, 38 new, 6 in new slots), 
Size of downloads: 1,047,420 kB
Fetch Restriction: 1 package (1 unsatisfied)

Would you like to merge these packages? [Yes/No]


PS: Gentoo is only known by me distro that survives this operation ;) 
(emerge -uvaD World) without issues. Congratulation great job! Keep it 
up! Keep Your fingers for me ;)

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Rumen Yotov]

[-- Attachment #1: Type: text/plain, Size: 691 bytes --]

On (01/02/08 23:44) Mateusz Mierzwinski wrote:
> Total: 246 packages (201 upgrades, 1 downgrade, 38 new, 6 in new slots), 
> Size of downloads: 1,047,420 kB
> Fetch Restriction: 1 package (1 unsatisfied)
>
> Would you like to merge these packages? [Yes/No]
>
>
> PS: Gentoo is only known by me distro that survives this operation ;) 
> (emerge -uvaD World) without issues. Congratulation great job! Keep it up! 
> Keep Your fingers for me ;)
>
> -- 
> gentoo-user@lists.gentoo.org mailing list
>
Hi,
Good luck, try to get the fetch-restricted package first.
Put it in /usr/portage/distfiles and run for 'world'.
Don't forget: etc-update, revdep-rebuild tools.
HTH. Rumen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[maxim wexler]

--- Mateusz Mierzwinski <mateuszmierzwinski@o2.pl>
wrote:

> Total: 246 packages (201 upgrades, 1 downgrade, 38
> new, 6 in new slots), 
> Size of downloads: 1,047,420 kB

Man, those must be tiny packages. I just completed -uD
world which took 351 packages totalling ~800M

Maxim


      ____________________________________________________________________________________
Looking for last minute shopping deals?  
Find them fast with Yahoo! Search.  http://tools.search.yahoo.com/newsearch/category.php?category=shopping
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Iain Buchanan]

On Sat, 2008-02-02 at 07:53 -0800, maxim wexler wrote:
> --- Mateusz Mierzwinski <mateuszmierzwinski@o2.pl>
> wrote:
> 
> > Total: 246 packages (201 upgrades, 1 downgrade, 38
> > new, 6 in new slots), 
> > Size of downloads: 1,047,420 kB
> 
> Man, those must be tiny packages. I just completed -uD
> world which took 351 packages totalling ~800M

read again :)  He has approximately 1Gb of downloads...
-- 
Iain Buchanan <iaindb at netspace dot net dot au>

The Golden Rule of Arts and Sciences:
	He who has the gold makes the rules.

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[maxim wexler]

> Don't forget: etc-update, revdep-rebuild tools.
> HTH. Rumen

At the end of an emerge process I saw two
recommendations: etc-update and ?-update. The exact
name escapes me and I can't find it in the logs. It
seems pretty significant with 100+ updates pending. Do
you recall the full name?

Maxim





      ____________________________________________________________________________________
Be a better friend, newshound, and 
know-it-all with Yahoo! Mobile.  Try it now.  http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ 

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Hal Martin]

Emerge recommends that you run 'etc-update' and 'revdep-rebuild' after
updating.


-Hal


maxim wexler wrote:
>> Don't forget: etc-update, revdep-rebuild tools.
>> HTH. Rumen
>>     
>
> At the end of an emerge process I saw two
> recommendations: etc-update and ?-update. The exact
> name escapes me and I can't find it in the logs. It
> seems pretty significant with 100+ updates pending. Do
> you recall the full name?
>
> Maxim
>
>
>
>
>
>       ____________________________________________________________________________________
> Be a better friend, newshound, and 
> know-it-all with Yahoo! Mobile.  Try it now.  http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ 
>
>   

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Alan McKinnon]

On Saturday 02 February 2008, maxim wexler wrote:
> > Don't forget: etc-update, revdep-rebuild tools.
> > HTH. Rumen
>
> At the end of an emerge process I saw two
> recommendations: etc-update and ?-update. The exact
> name escapes me and I can't find it in the logs. It
> seems pretty significant with 100+ updates pending. Do
> you recall the full name?
>
> Maxim

modules-update if you have out-of-tree kernel modules 

env-update follwed by '. /etc/profile/ to avoid the hassle of logging 
out and back in just to update the environment

possibly conf-update which does the same thing as etc-update, just with 
a much nicer ui that is easier to see what is going on

-- 
Alan McKinnon
alan dot mckinnon at gmail dot com
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[maxim wexler]

> 
> modules-update if you have out-of-tree kernel
> modules 
> 
> env-update follwed by '. /etc/profile/ to avoid the
> hassle of logging 
> out and back in just to update the environment
> 
> possibly conf-update which does the same thing as
> etc-update, just with 
> a much nicer ui that is easier to see what is going
> on
> 

No it was none of those. It was the same format as
that for etc-upate, Bold yellow text followed by
recommended action. And in the line right next to it.
IIRC it would appear at the end of some of the
successful emerges, just not the last one, and there
wasn't enough in the buffer to scroll back for it. 

I 'tail'ed  some likely suspects in /var/log/portage
but it didn't show. 'grep'ing emerg.log for "update"
only finds the --update switch. 

I'm all askeerd to reboot before finding out what it
was ;(

> -- 
> Alan McKinnon
> alan dot mckinnon at gmail dot com
> -- 
> gentoo-user@lists.gentoo.org mailing list
> 
> 



      ____________________________________________________________________________________
Never miss a thing.  Make Yahoo your home page. 
http://www.yahoo.com/r/hs
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Alan McKinnon]

On Saturday 02 February 2008, maxim wexler wrote:
> I 'tail'ed  some likely suspects in /var/log/portage
> but it didn't show. 'grep'ing emerg.log for "update"
> only finds the --update switch.
>
> I'm all askeerd to reboot before finding out what it
> was ;(

did you grep all the files in /var/log/portage/elog/ as well? That's 
where such notifications are normally stored.


Some more likely candidates are gcc-config, java-config, perhaps 
python-updater or maybe one of these:

nazgul ~ # ls -al /sbin/*update /usr/sbin/*update
lrwxrwxrwx 1 root root    14 Nov  2 09:55 /sbin/modules-update -> 
update-modules
-rwxr-xr-x 1 root root  5546 Jan 17 22:33 /sbin/rc-update
-rwxr-xr-x 1 root root 30356 Nov  2 10:00 /usr/sbin/conf-update
lrwxrwxrwx 1 root root    29 Feb  1 
20:14 /usr/sbin/env-update -> ../lib/portage/bin/env-update
lrwxrwxrwx 1 root root    29 Feb  1 
20:14 /usr/sbin/etc-update -> ../lib/portage/bin/etc-update
-rwxr-xr-x 1 root root  1873 Jan 10 15:14 /usr/sbin/texmf-update
nazgul ~ # ls -al /sbin/*config /usr/sbin/*config
-rwxr-xr-x 1 root root  53788 Nov  1 22:24 /sbin/ifconfig
-rwxr-xr-x 1 root root  71460 Nov  5 14:42 /sbin/iwconfig
-rwxr-xr-x 1 root root 564648 Nov  2 08:00 /sbin/ldconfig
-rwxr-xr-x 1 root root   4412 Nov  1 22:24 /sbin/plipconfig
-rwxr-xr-x 1 root root  26020 Nov  2 08:00 /usr/sbin/iconvconfig
-rwxr-xr-x 1 root root   4171 Jan  2 13:48 /usr/sbin/paperconfig
-rwxr-xr-x 1 root root  10284 Nov  1 22:24 /usr/sbin/pci-config
-rwxr-xr-x 1 root root  18563 Nov  7 23:25 /usr/sbin/pwmconfig
-rwxr-xr-x 1 root root   3084 Nov  5 13:27 /usr/sbin/ruby-config

-- 
Alan McKinnon
alan dot mckinnon at gmail dot com
--
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Dale]

maxim wexler wrote:
>> Don't forget: etc-update, revdep-rebuild tools.
>> HTH. Rumen
>>     
>
> At the end of an emerge process I saw two
> recommendations: etc-update and ?-update. The exact
> name escapes me and I can't find it in the logs. It
> seems pretty significant with 100+ updates pending. Do
> you recall the full name?
>
> Maxim
>
>
>
>   

Was it dispatch-conf by any chance?  It does the same thing as
etc-update.  100+, WOW.  he he he

I'm not going to tell how many times I hit the tab key when trying to
type in those commands.   ;-) 

Dale

:-)  :-)  :-) 
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Dirk Heinrichs]

[-- Attachment #1: Type: text/plain, Size: 377 bytes --]

Am Samstag, 2. Februar 2008 schrieb maxim wexler:

> At the end of an emerge process I saw two
> recommendations: etc-update and ?-update. The exact
> name escapes me and I can't find it in the logs. It
> seems pretty significant with 100+ updates pending. Do
> you recall the full name?

cfg-update, maybe? So far the best Gentoo config file updater I've used.

HTH...

	Dirk

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Mateusz Mierzwinski]

Rumen Yotov pisze:
> On (01/02/08 23:44) Mateusz Mierzwinski wrote:
>   
>> Total: 246 packages (201 upgrades, 1 downgrade, 38 new, 6 in new slots), 
>> Size of downloads: 1,047,420 kB
>> Fetch Restriction: 1 package (1 unsatisfied)
>>
>> Would you like to merge these packages? [Yes/No]
>>
>>
>> PS: Gentoo is only known by me distro that survives this operation ;) 
>> (emerge -uvaD World) without issues. Congratulation great job! Keep it up! 
>> Keep Your fingers for me ;)
>>
>> -- 
>> gentoo-user@lists.gentoo.org mailing list
>>
>>     
> Hi,
> Good luck, try to get the fetch-restricted package first.
> Put it in /usr/portage/distfiles and run for 'world'.
> Don't forget: etc-update, revdep-rebuild tools.
> HTH. Rumen
>   
Nothing like Gentoo ;). Good update, goooood! ;). Everything is OK ;) as 
usual ;). Great work 4 all'ya! THX for best distro ;). PS: portage wrote 
message to fetch java from SUN page - only java SDK (because of NetBeans 
installed). If anyone can read then anyone can do update ;). Three 
nights and system up and running ;).
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Ricardo Saffi Marques]

[-- Attachment #1: Type: text/plain, Size: 2081 bytes --]

I here use dispatch-conf instead of etc-update. I just change /etc/dispatch-
conf.conf to the following:

use-rcs=yes
>
and

> diff="colordiff -Nu %s %s | less --no-init --QUIT-AT-EOF"
>

which requires rcs and colordiff to be merged. It's fantastic for updating
the conf files.

Regards,

Saffi

On 2/2/08, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
>
> did you grep all the files in /var/log/portage/elog/ as well? That's
> where such notifications are normally stored.
>
>
> Some more likely candidates are gcc-config, java-config, perhaps
> python-updater or maybe one of these:
>
> nazgul ~ # ls -al /sbin/*update /usr/sbin/*update
> lrwxrwxrwx 1 root root    14 Nov  2 09:55 /sbin/modules-update ->
> update-modules
> -rwxr-xr-x 1 root root  5546 Jan 17 22:33 /sbin/rc-update
> -rwxr-xr-x 1 root root 30356 Nov  2 10:00 /usr/sbin/conf-update
> lrwxrwxrwx 1 root root    29 Feb  1
> 20:14 /usr/sbin/env-update -> ../lib/portage/bin/env-update
> lrwxrwxrwx 1 root root    29 Feb  1
> 20:14 /usr/sbin/etc-update -> ../lib/portage/bin/etc-update
> -rwxr-xr-x 1 root root  1873 Jan 10 15:14 /usr/sbin/texmf-update
> nazgul ~ # ls -al /sbin/*config /usr/sbin/*config
> -rwxr-xr-x 1 root root  53788 Nov  1 22:24 /sbin/ifconfig
> -rwxr-xr-x 1 root root  71460 Nov  5 14:42 /sbin/iwconfig
> -rwxr-xr-x 1 root root 564648 Nov  2 08:00 /sbin/ldconfig
> -rwxr-xr-x 1 root root   4412 Nov  1 22:24 /sbin/plipconfig
> -rwxr-xr-x 1 root root  26020 Nov  2 08:00 /usr/sbin/iconvconfig
> -rwxr-xr-x 1 root root   4171 Jan  2 13:48 /usr/sbin/paperconfig
> -rwxr-xr-x 1 root root  10284 Nov  1 22:24 /usr/sbin/pci-config
> -rwxr-xr-x 1 root root  18563 Nov  7 23:25 /usr/sbin/pwmconfig
> -rwxr-xr-x 1 root root   3084 Nov  5 13:27 /usr/sbin/ruby-config
>
> --
> Alan McKinnon
> alan dot mckinnon at gmail dot com
> --
> gentoo-user@lists.gentoo.org mailing list
>
>


-- 
Ricardo Saffi Marques
Laboratório de Administração e Segurança de Sistemas (LAS/IC)
Universidade Estadual de Campinas (UNICAMP)
Cell: +55 (19) 8128-0435
Skype: ricardo_saffi_marques
Website: http://www.rsaffi.com

[-- Attachment #2: Type: text/html, Size: 3149 bytes --]

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[443-653-1569]

[-- Attachment #1: Type: text/plain, Size: 545 bytes --]

On 09:28 Sun 03 Feb     , Dirk Heinrichs wrote:
> Am Samstag, 2. Februar 2008 schrieb maxim wexler:
> 
> > At the end of an emerge process I saw two
> > recommendations: etc-update and ?-update. The exact
> > name escapes me and I can't find it in the logs. It
> > seems pretty significant with 100+ updates pending. Do
> > you recall the full name?
> 
> cfg-update, maybe? So far the best Gentoo config file updater I've used.
> 
> HTH...
> 
> 	Dirk

I've tried all the updaters and I also recommend cfg-update.

Bill Roberts

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-user] ALT/GR (Right ALT) as an RETURN?

[Mateusz Mierzwinski]

Ok, I don't know what's going on, but My laptop have issue - when I 
press ALT/GR (Right ALT) it works like RETURN, executes applications, 
sends messages by Kadu. What's wrong? I've try control panel in KDE, but 
this wont work in regionals settings. Periphernals > Keyboard also don't 
work. My keyboard is OK because in commandline everything is OK.

Any suggestions?


-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] ALT/GR (Right ALT) as an RETURN?

[Mateusz Mierzwinski]

Mateusz Mierzwinski pisze:
> Ok, I don't know what's going on, but My laptop have issue - when I 
> press ALT/GR (Right ALT) it works like RETURN, executes applications, 
> sends messages by Kadu. What's wrong? I've try control panel in KDE, 
> but this wont work in regionals settings. Periphernals > Keyboard also 
> don't work. My keyboard is OK because in commandline everything is OK.
>
> Any suggestions?
>
>
And when I turn of Keyboard Layouts and press magic combo 
CTRL+ALT+BCKSPC, run again KDE by startx then everything is OK, but 
until I choice PL Keyboard Layout and press Apply. After that My 
keyboard is going insane. :/ Any bug?
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[maxim wexler]

> Was it dispatch-conf by any chance?  It does the
> same thing as
> etc-update.  100+, WOW.  he he he


Now that I've thought about it more I recall it didn't
specify a command, what it said was something like
there are n files in /etc that have changed then
something like see man emerge for further details
Then on the next line was a similar warning, but for a
different /dir which I mismember.

Why would they use dispatch-conf if it's the same
thing as etc-update

I looked in /usr/lib/portage/bin; if it's anywhere,
it'll be in there, but I didn't recognize it. Oh well,
I'll know how bad things are the next time I reboot

> 
> I'm not going to tell how many times I hit the tab
> key when trying to
> type in those commands.   ;-) 

What do you mean? I just overwrite most of them
automatically except for those few I need to keep the
same

Maxim


      ____________________________________________________________________________________
Looking for last minute shopping deals?  
Find them fast with Yahoo! Search.  http://tools.search.yahoo.com/newsearch/category.php?category=shopping
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] BIG-UPDATE! ;) If I survive, then gentoo rulezz... :)

[Dale]

maxim wexler wrote:
>> Was it dispatch-conf by any chance?  It does the
>> same thing as
>> etc-update.  100+, WOW.  he he he
>>     
>
>
> Now that I've thought about it more I recall it didn't
> specify a command, what it said was something like
> there are n files in /etc that have changed then
> something like see man emerge for further details
> Then on the next line was a similar warning, but for a
> different /dir which I mismember.
>
> Why would they use dispatch-conf if it's the same
> thing as etc-update
>
> I looked in /usr/lib/portage/bin; if it's anywhere,
> it'll be in there, but I didn't recognize it. Oh well,
> I'll know how bad things are the next time I reboot
>   


They have two because a lot of people like dispatch-conf.  It archives
old configs just in case something . . . well. . . screws up badly.

>   
>> I'm not going to tell how many times I hit the tab
>> key when trying to
>> type in those commands.   ;-) 
>>     
>
> What do you mean? I just overwrite most of them
> automatically except for those few I need to keep the
> same
>
> Maxim
>
>   

If you are in a console and type in "eme" then hit the tab key, it will
fill in the rest of the command emerge for you.  Saves you from typing
the whole thing.  You can do the same when changing directories and such
too.  Saves you a lot of typing but when you are typing in a email, it
doesn't fill it in for ya.  Then you have to backspace and fill in the
whole thing yourself.

Try it sometime.  It'll grow on you.

Dale

:-)  :-) 
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] ALT/GR (Right ALT) as an RETURN?

[Dan Farrell]

On Sun, 03 Feb 2008 21:32:47 +0100
Mateusz Mierzwinski <mateuszmierzwinski@o2.pl> wrote:

> Mateusz Mierzwinski pisze:
> > Ok, I don't know what's going on, but My laptop have issue - when I 
> > press ALT/GR (Right ALT) it works like RETURN, executes
> > applications, sends messages by Kadu. What's wrong? I've try
> > control panel in KDE, but this wont work in regionals settings.
> > Periphernals > Keyboard also don't work. My keyboard is OK because
> > in commandline everything is OK.
> >
> > Any suggestions?

No, just questions: 

 1) what kind of keyboard do you use 
 2) what kind of keyboard setting do you use at the console
 3) What is your keyboard setting in X

Can you answer these?
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] ALT/GR (Right ALT) as an RETURN?

[Mateusz Mierzwinski]

Dan Farrell pisze:
> On Sun, 03 Feb 2008 21:32:47 +0100
> Mateusz Mierzwinski <mateuszmierzwinski@o2.pl> wrote:
>
>   
>> Mateusz Mierzwinski pisze:
>>     
>>> Ok, I don't know what's going on, but My laptop have issue - when I 
>>> press ALT/GR (Right ALT) it works like RETURN, executes
>>> applications, sends messages by Kadu. What's wrong? I've try
>>> control panel in KDE, but this wont work in regionals settings.
>>> Periphernals > Keyboard also don't work. My keyboard is OK because
>>> in commandline everything is OK.
>>>
>>> Any suggestions?
>>>       
>
> No, just questions: 
>
>  1) what kind of keyboard do you use 
>  2) what kind of keyboard setting do you use at the console
>  3) What is your keyboard setting in X
>
> Can you answer these?
>   

I'm using standard laptop keyboard with windows key (some kind like 
generic-101/102 keys). In console i use standard settings (don't change 
anything because I don't need Polish keyboard in konsole).
My Xorg setting of keyboard:

Section "InputDevice"

    Identifier    "Keyboard1"
    Driver    "kbd"

    Option "AutoRepeat" "500 30"
    Option "XkbRules"    "xorg"
    Option "XkbModel"    "pc105"
    Option "XkbLayout"    "pl"

EndSection

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] Switching to hardened

[Alex Schuster]

Eric Martin writes:

> Dan Farrell wrote:
> > You might consider building packages but not installing them -- I think
> > could use --buildpkgonly (aka -B) to achieve this end.  If the world
> > emerge with a -B flag finishes successfully, I think that means all
> > packages were built and you are ready to emerge world with --usepkgonly
> > (-K) without having to worry about build-time issues that could cause
> > conflicting packages on the system.
> >
> > But what does everyone else think?
>
> I like it.  The only problem is it might not work in some situations
> where you need program A to compile program B (kde4 requires qt4).  I've
> never gone from a non-hardened system -> hardened though so take my
> comments with a grain of salt.  This could also work on other tricky
> upgrades.

Nice idea. Maybe next time... I already had started the migration.

And screwed up. I forgot about distcc being active, so some other boxes 
helped in compiling, but they do not have the hardened profile, and thus no 
hardened gcc. So, in fact nothing was compiled on the local machine.

I emerged -e again, this time without distcc and ccache. All compiled fine, 
except for media-video/mplayer-1.0_rc2_p24929-r1 (vf_decimate.c:26: error: 
can't find a register in class `BREG' while reloading `asm') and 
net-nntp/pan-0.132-r1, which claims to need about 300 more megabytes of 
memory to compile.

I did not reboot yet as I am not near the machine, but so far things work 
well. Mplayer is not needed on that machine anyway.


I then decided to harden my desktop PC, too. I want to get some experience 
with the hardened setup, and I want that machine to be able to act as a 
distcc server for another hardened machine which will be set up soon.

Here, also mplayer and some more packages failed.

x11-misc/xaos-3.2:
i386.c: In function `_control87':
i386.c:31: error: PIC register `bx' clobbered in `asm'
Solved by using the vanilla gcc.

x11-misc/xscreensaver-5.04:
lockward.c:59: error: syntax error before "uint8_t"

app-emulation/dosemu-1.3.3:
vga.c: In function `pcivga_init':
vga.c:493: error: `PCI_CLASS_DISPLAY_VGA' undeclared (first use in this 
function)

mplayer: compiles with vanilla gcc.

But most annoying is that the nvidia drivers do not seem to work. First, 
they refused to compile telling me that this would do more harm than good 
with a hardened setup. I put them into packages.unmask, now they compile 
and the nvidia module loads, but still X has no GLX, xorg.0.log 
says "Failed to initialize GLX extension (NVIDIA X driver not found)", 
glxinfo segfaults. I guess I will try to re-compile all X stuff with the 
vanilla gcc.

Would it be possible to make these changes permanent, that is, can I tell 
portage to compile specific packages with a specific 
compiler? /etc/portage/package.compilerflavor or something?

If this makes things complicated, I think I will go back to a normal setup 
at least for my desktop machine. Thre hardened gcc will stay for distcc 
purposes (I will run two distccs on different ports, one for the hardened, 
one for the vanilla gcc), but I prefer to have a system which will run 
OpenGL.

	Wonko
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] Switching to hardened

[Willie Wong]

On Mon, Feb 11, 2008 at 11:24:49PM +0100, Penguin Lover Alex Schuster squawked:
> I emerged -e again, this time without distcc and ccache. All compiled fine, 
> except for media-video/mplayer-1.0_rc2_p24929-r1 (vf_decimate.c:26: error: 
> can't find a register in class `BREG' while reloading `asm') and 

http://bugs.gentoo.org/show_bug.cgi?id=175627

Like you found below, it can be avoided using vanilla GCC. 
That is why I still only have mplayer-1.0_rc1-r2, that one compiled
okay. 

> I then decided to harden my desktop PC, too. I want to get some experience 
> with the hardened setup, and I want that machine to be able to act as a 
> distcc server for another hardened machine which will be set up soon.

> x11-misc/xscreensaver-5.04:
> lockward.c:59: error: syntax error before "uint8_t"

Not a problem with hardened. 
http://bugs.gentoo.org/show_bug.cgi?id=208731
Meanwhile, downgrade to 5.03, that one works. 

> But most annoying is that the nvidia drivers do not seem to work. First, 

what card and which drivers?
I have an old card that is not supported by drivers >= 1.0.9700, so 
... scratch that, I didn't notice that the versioning scheme changed. 

http://www.gentoo.org/doc/en/nvidia-guide.xml

> they refused to compile telling me that this would do more harm than good 
> with a hardened setup. I put them into packages.unmask, now they compile 
> and the nvidia module loads, but still X has no GLX, xorg.0.log 
> says "Failed to initialize GLX extension (NVIDIA X driver not found)", 

This really does not sound like a hardened issue... I need to upgrade
my drivers to the 96.* to see if I can reproduce your problem, but
with 1.0.8776 (from two years ago) I definitely do not have your
problem. 

> glxinfo segfaults. I guess I will try to re-compile all X stuff with the 
> vanilla gcc.

glxinfo segfaulting is expected. Do you have chpax/paxctl installed? There
are a metric shitload of stuff that will run afoul of pax on hardened.
A quick list from my /etc/conf.d/chpax has (admittedly, this is info
that is two years old, since chpax is obsolete and hasn't been
updated)

java, wine, xorg, xine, openoffice, mplayer, mozilla, firefox,
glxinfo, glxgears, ut2004, skype

glxinfo has problem with mprotect. Check your system log, there should
be something to that effect when your hardened system shuts glxinfo
down. 

I have my entire system on the
hardened profile (including X and nvidia [yes, despite the warnings of
the hardened team about nvidia]) and no problems. My guess is that
your problem with GLX lies somewhere else. 

> Would it be possible to make these changes permanent, that is, can I tell 
> portage to compile specific packages with a specific 
> compiler? /etc/portage/package.compilerflavor or something?

Don't know. On the wiki there is a way to switch CFLAGS, don't know if
something like that can be used to strip SSP and/or PIC flags from the
hardened. 

W
-- 
"Somebody has suggested that as a solution to global warming we just change the
earth's orbit a little bit. Personally, I'm not too keen to carry out this 
experiment quite yet."
~DeathMech, S. Sondhi. P-town PHY 205
Sortir en Pantoufles: up 431 days, 12:37
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] Switching to hardened

[Alex Schuster]

Willie Wong wrote Wonko:

> On Mon, Feb 11, 2008 at 11:24:49PM +0100, Penguin Lover Alex Schuster
> squawked: 
> > I emerged -e again, this time without distcc and ccache. All compiled
> > fine, except for media-video/mplayer-1.0_rc2_p24929-r1
> > (vf_decimate.c:26: error: can't find a register in class `BREG' while
> > reloading `asm') and
>
> http://bugs.gentoo.org/show_bug.cgi?id=175627
>
> Like you found below, it can be avoided using vanilla GCC.
> That is why I still only have mplayer-1.0_rc1-r2, that one compiled
> okay.

Isn't that the version with those many security holes? But then, looking at 
<http://www.mplayerhq.hu/design7/news.html>, it seems that all versions pre 
r25824 have some.


> > x11-misc/xscreensaver-5.04:
> > lockward.c:59: error: syntax error before "uint8_t"
>
> Not a problem with hardened.
> http://bugs.gentoo.org/show_bug.cgi?id=208731
> Meanwhile, downgrade to 5.03, that one works.

Thanks!

> > But most annoying is that the nvidia drivers do not seem to work.
> > First,
>
> what card and which drivers?

01:00.0 VGA compatible controller: nVidia Corporation NV15 [GeForce2 
GTS/Pro] (rev a4)

I have nvidia drivers version 71.86.01 running now. I also re-compiled 
xorg-server, with vanilla gcc, GLX is running fine again, and I am happy.

> I have an old card that is not supported by drivers >= 1.0.9700, so
> ... scratch that, I didn't notice that the versioning scheme changed.
>
> http://www.gentoo.org/doc/en/nvidia-guide.xml
>
> > they refused to compile telling me that this would do more harm than
> > good with a hardened setup. I put them into packages.unmask, now they
> > compile and the nvidia module loads, but still X has no GLX, xorg.0.log
> > says "Failed to initialize GLX extension (NVIDIA X driver not found)",
>
> This really does not sound like a hardened issue... I need to upgrade
> my drivers to the 96.* to see if I can reproduce your problem, but
> with 1.0.8776 (from two years ago) I definitely do not have your
> problem.

Maybe I'll try again with hardened then. My experience with nvidia is that 
that it makes LOTS of trouble. This, and VMware, often made kerned updates 
a real pain for me. I often got those errors before, with the desktop 
profile, on different machines.


> > glxinfo segfaults. I guess I will try to re-compile all X stuff with
> > the vanilla gcc.
>
> glxinfo segfaulting is expected. Do you have chpax/paxctl installed?

No, not yet. I must admit I do not know much about hardened yet, but I want 
to play around with it and get some experience, so I started with preparing 
the setup by setting the hardened profile and switching to a hardened 
kernel.


> I have my entire system on the
> hardened profile (including X and nvidia [yes, despite the warnings of
> the hardened team about nvidia]) and no problems. My guess is that
> your problem with GLX lies somewhere else.

That's good to hear! So I will stick with hardened.

> > Would it be possible to make these changes permanent, that is, can I
> > tell portage to compile specific packages with a specific
> > compiler? /etc/portage/package.compilerflavor or something?
>
> Don't know. On the wiki there is a way to switch CFLAGS, don't know if
> something like that can be used to strip SSP and/or PIC flags from the
> hardened.

I don't find this information there, I guess I did not look hard enough. But 
there is /etc/portage/bashrc, I can put a little script in there, stripping 
those flags for the given packages. No problem.

Thanks again,

	Wonko
-- 
gentoo-user@lists.gentoo.org mailing list