Subject: Re: [vserver] gentoo hardened/vserver
From: Ed W <lists@wildgooses.com>
Date: Tue, 10 Nov 2009 19:11:06 +0000

Rik Bobbaers wrote:
> heya,
>
> i don't know how the hardened gentoo stuff works (since i don't use
> gentoo). but i do know that i created a patch for 2.6.31.5, with the
> latest grsecurity/pax patch, but there are issues with e.g. kernexec,
> which make the kernel unbootable. I contacted the pax team on this issue,
> and "we" are working on it.
>   

Another 2p is:

- Use Rik's last working patch (2.6.29.6 ish?) and you should have a 
nice working kernel.  The kernel is a separate problem to the rest of 
your userland tools.  If you want additional patches then I suggest you 
start with the vserver+grsec+pax patch first since this is a meaty one.  
I doubt you want to merge vserver onto some already patched kernel so 
disregard using gentoo-sources. After that you can pull out any extra 
patches that you feel are relevant, eg from gentoo-sources or whatever 
is your favourite and deal with any merge conflicts.

- Use gentoo hardened normally...

Just a quick tip, but you will need latest util-vserver package and also 
you will need to unmask the latest dietlibc version before you build 
util-vserver (if you don't do the later then everything will segfault 
because it gets built against a duff dietlibc package)

Note that standard hardened recently upgraded to gcc-4.3 and this seems 
to work really nicely, but SSP is not enabled.  Also there is an overlay 
with gcc-4.4 which DOES have SSP enabled.  I'm not using this with 
vserver, but I do have some builds using it with a uclibc setup (which 
should really give it a workout...) and I haven't yet seen a package 
it's caused bother with... (well apart from python and sandbox - both 
critical system packages, but hey you can work around this fairly easily...)


Thumbs up for vserver + gentoo hardened

Good luck

Ed W