On 06/29/2011 05:39 PM, Tom Hendrikx wrote: > On 29/06/11 16:47, 7v5w7go9ub0o wrote: >> On 06/29/11 07:19, Anthony G. Basile wrote: >> >> [snip] >> >>> >>> The safest approach in either switching or recompiling everything >>> is: >>> >>> 1. Make the profile is set "eselect profile list" and pick your >>> hardened box. Careful on amd64 about changing multilib/nomultilib. >>> Stick with your mutilib-edness (if such a word exists :) >>> >>> 2. Rebuild the tool chain: emerge binutils glibc gcc >>> >>> 3. Rebuild system: emerge --keep-going -eq system (note anything >>> that fails you might want to file a bug) >>> >>> 4. Rebuild world: emerge --keep-going -eq world (again not any >>> failures, shouldn't happen else we're not doing our job) >>> >>> system vs world = system is just the bare minimum packages that any >>> box running that profile needs. world = system + what you've added. >>> You can skip step 3, but there might be a chance of mixing >>> unhardened/hardened stuff if you do, but I'm not 100% sure. >>> >> >> Thank You! >> >> 1. Is there some way this clear, succinct list could get into the >> hardened documentation? >> >> 2. At this point, the 'clearest' way to build a hardened box from scratch >> seems to go a few steps into the Gentoo handbook, then migrate using the >> steps above. Not ideal, but until the documentation can be refined, how >> about either putting these steps into the handbook, or alternatively a >> reference *in the handbook* to wherever you find a home for these steps >> (e.g. QandA). > > I built a hardened box last week by grabbing a hardened autobuild, then > following the regular handbook for my arch. Above steps are only needed > when you start from a regular stage, or when you are converting a > regular install. > > Usage of autobuilds is missing in the handbook now, but iirc there are > some open bugs on getting this changed. > > -- > Regards, > Tom
That's correct, these are instructions for switching from vanilla or if you want to *very* safely recompile everything making sure you get hardened. It is the most conservative path but also very time consuming. If you're starting from scratch, just grab the latest stage3 *hardened* tarball, start building your system from there and save yourself the time. You will gain nothing but recompiling the tool chain and system/world. -- Anthony G. Basile, Ph.D. Gentoo Linux Developer [Hardened] E-Mail : bluen...@gentoo.org GnuPG FP : 8040 5A4D 8709 21B1 1A88 33CE 979C AF40 D045 5535 GnuPG ID : D0455535
