There's another thread on a similar topic. Going from 2006.1 normal to the hardened profile causes a lot of problems because GCC 4+ is not ready for the hardened toolchain. Please refer to the previous thread (only few days ago) for more info than I can give.
SM -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: 22 January 2007 01:17 To: [email protected] Subject: [gentoo-hardened] I have trouble installing Hi list! I would like to switch to hardened gentoo from Adamantix. I need a linux that has PaX, SSP and RSBAC at least. And support, QA. That's what is missing from Adamantix. So this is the first time I try to install gentoo, by the book, and it fails. Since I have no experience with gentoo I write here what I did, so you can tell me if I have missed a step, or made some other mistake. I am sorry, but it is a little bit long. Booted from CD, have net, partitioned, formatted, mounted, downloaded stage3-i686-2006.1.tar.bz2 # cd /mnt/gentoo # tar xjSpf stage3-i686-2006.1.tar.bz2 # tar xjf portage-latest.tar.bz2 -C usr/ # cd /mnt/gentoo/etc # mirrorselect -i -o >> /mnt/gentoo/etc/make.conf # mirrorselect -i -r -o >> /mnt/gentoo/etc/make.conf # cat make.conf # These settings were set by the catalyst build script that # automatically built this stage # Please consult /etc/make.conf.example for a more detailed example CFLAGS="-O2 -march=i686 -pipe" CHOST="i686-pc-linux-gnu" CXXFLAGS="${CFLAGS}" GENTOO_MIRRORS="http://gentoo.inf.elte.hu/ " SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage" # cp -L /etc/resolv.conf resolv.conf # mount -t proc none /mnt/gentoo/proc # mount -o bind /dev /mnt/gentoo/dev # cd ../.. # chroot /mnt/gentoo bin/bash # env-update # source /etc/profile # emerge --sync # emerge portage * Applying portage-2.1.1-r2.patch ... * Setting portage.VERSION to 2.1.1-r2 ... # find /etc -iname '._cfg????_*' # cd /etc # mv ._cfg0000_make.conf.example make.conf.example # mv ._cfg0000_etc-update.conf etc-update.conf # rm /etc/make.profile # ln -s /usr/portage/profiles/hardened/x86/2.6/ make.profile # env-update # source /etc/profile # emerge gcc binutils virtual/libc Downloads gcc 3.4.6 patches, etc. compiles for hours * The current gcc config appears valid, so it will not be * automatically switched for you. If you would like to * switch to the newly installed gcc version, do the * following: * gcc-config i686-pc-linux-gnu-3.4.6 * source /etc/profile * Switching native-compiler to i686-pc-linux-gnu-4.1.1 ... ... >>> sys-devel/gcc-3.4.6-r2 merged. Does this mean that the new, SSP patched gcc is installed, but not in use at this point? If it is so, isn't it a problem, that binutils and libc is compiled with the old gcc? And why is this version 3.4.6? I have expected to see the same version of gcc that I already had (from stage3 I suppose), which is 4.1.1, recompiled with SSP, and possibly other patches, and the new hardened version to replace the current one. Why does emerge give me an older version? Is this normal? And it seems that the method written in http://www.gentoo.org/proj/en/hardened/hardenedfaq.xml#hardenedprofile does not work. emerge downloads binutils, compiles for about half an hour, unmerges original, merges binutils-2.16.1-r3 emerging sys-libs/glibc-2.3.6-r5 to / downloads, then: * checking ebuild checksums ;-) ... [ ok ] * checking auxfile checksums ;-) ... [ ok ] * checking miscfile checksums ;-) ... [ ok ] * checking glibc-2.3.6.tar.bz2 ;-) ... [ ok ] * checking glibc-linuxthreads-2.3.6.tar.bz2 ;-) ... [ ok ] * checking glibc-libidn-2.3.6.tar.bz2 ;-) ... [ ok ] * checking glibc-2.3.6-patches-1.19.tar.bz2 ;-) ... [ ok ] * checking glibc-manpages-2.3.6-1.tar.bz2 ;-) ... [ ok ] * checking glibc-infopages-2.3.6.tar.bz2 ;-) ... [ ok ] * Sanity check to keep you from breaking your system: * Downgrading glibc is not supported and a sure way to destruction !!! ERROR: sys-libs/glibc-2.3.6-r5 failed. Call stack: ebuild.sh, line 1562: Called dyn_setup ebuild.sh, line 665: Called pkg_setup glibc-2.3.6-r5.ebuild, line 1037: Called die !!! aborting to save your system !!! If you need support, post the topmost build error, and the call stack if relevant. So, emerging libc has failed. I thought that when I switch to the hardened profile, it only has to recompile the same version that I already have. But it seems that it tries an older version? Just as it did with gcc. Why? So what do I do now? Do I have to manually switch to the hardened gcc? Then I have to recompile binutils, as it was compiled with the unhardened gcc. How do I emerge the libc? Cheers, Gabor -- [email protected] mailing list -- [email protected] mailing list
