# Hardened GCC

## sciwhiz007

I'm in the process of setting up a highly secure server resistant to as many attacks as I can think of. Naturally, in the course of my research, I came across hardened GCC. Now, I am aware that all the hardened-gcc package does is essentially update the gcc specs file and builds two system specific object files.

My question, however, is this. In order to have a complete system built with the protection implemented by hardened-gcc, should I emerge hardened-gcc before I bootstrap or after? The only reason I'm suspicious, is because I'm not sure whether emerging gcc as a part of the bootstrap process will overwrite the specs file or not.

Thanks in advance!

----------

## sciwhiz007

Just an update.

After searching through the forums, I found that the hardened team has released 3 x86 stages that come with the enhancements provided by hardened-gcc. So far, everything seems to be going fine. However, I noticed that not everything is being compiled as an ET_DYN executable. Sometimes, when I run file on them, I see that some of them are being compiled as ET_EXEC, and out of those that are being compiled as ET_DYN, not all are being stripped. I realize that this information is a bit vague, and I am certainly ready to provide any information you may need.

For anybody interested, check out the Gentoo Hardened page. I'll definitely post anything that I try just in case somebody else is going through a similar experience.

----------

## sciwhiz007

Terribly sorry for the extra post. I realized that I didn't post the links for the stages put out by the Hardened team. Anyway, here they are: http://gentoo.oregonstate.edu/experimental/x86/stages/ The right ones have been marked by the pie-ssp designator.

----------

## sciwhiz007

A bit of an update as well as a bump  :Wink: 

I used the hardened team's stages and the install went well, except that I can't boot the system. To avoid repeating myself and cluttering the forums, here's the link to hulk2nd's excellent root filesystem encryption thread: https://forums.gentoo.org/viewtopic.php?t=108162&postdays=0&postorder=asc&highlight=hulk2nd&start=75 My post is the 3rd one on that page.

----------

