Rik Bobbaers wrote: > heya, > > i don't know how the hardened gentoo stuff works (since i don't use > gentoo). but i do know that i created a patch for 2.6.31.5, with the > latest grsecurity/pax patch, but there are issues with e.g. kernexec, > which make the kernel unbootable. I contacted the pax team on this issue, > and "we" are working on it. > Another 2p is: - Use Rik's last working patch (2.6.29.6 ish?) and you should have a nice working kernel. The kernel is a separate problem to the rest of your userland tools. If you want additional patches then I suggest you start with the vserver+grsec+pax patch first since this is a meaty one. I doubt you want to merge vserver onto some already patched kernel so disregard using gentoo-sources. After that you can pull out any extra patches that you feel are relevant, eg from gentoo-sources or whatever is your favourite and deal with any merge conflicts. - Use gentoo hardened normally... Just a quick tip, but you will need latest util-vserver package and also you will need to unmask the latest dietlibc version before you build util-vserver (if you don't do the later then everything will segfault because it gets built against a duff dietlibc package) Note that standard hardened recently upgraded to gcc-4.3 and this seems to work really nicely, but SSP is not enabled. Also there is an overlay with gcc-4.4 which DOES have SSP enabled. I'm not using this with vserver, but I do have some builds using it with a uclibc setup (which should really give it a workout...) and I haven't yet seen a package it's caused bother with... (well apart from python and sandbox - both critical system packages, but hey you can work around this fairly easily...) Thumbs up for vserver + gentoo hardened Good luck Ed W