# [solved] switching from hardened to regular

## schmeggahead

To switch from the hardened profile on my machine, can I do that without reinstalling the base?

I'm inclined to think that if I point to a non hardened profile and emerge gentoo-sources to use instead of hardened-sources, then I would need to go through the tool chain build (emwrap) and then emerge world.

Is there anything wrong with switching profiles like this (or is it better for me to punt and reinstall the full system?)

UPDATE: Nessumsar solved (see below, copied here for convenience)

 *Quote:*   

> 1. Switched profile and gcc to non-hardened versions
> 
> 2. Recompiled gcc 3.4.6
> 
> 3. Compiled the latest glibc
> ...

 Last edited by schmeggahead on Wed Dec 12, 2007 11:34 am; edited 4 times in total

----------

## guinness.stout

I'd say follow the how to's for the hardened kernel, make sure you have anything that is nessesary for it to work emerged and then just add that new hardened kernel to your boot loader.  I have never made that switch before but I don't see why you would have to rebuild your system.  I'm sure you are not the first to do this either.

----------

## schmeggahead

I started out with the hardened profile and want to go to a regular profile (wine behaves on the regular profile)

There's plenty about "to hardened" but not "from hardened" that I could find.

----------

## Hu

If Wine is your only problem, perhaps you would be better served by fixing Wine rather than converting all your packages to non-hardened.  What happens when you try to run Wine?  What have you tried to fix it?

----------

## schmeggahead

My trouble with wine is the 3G/1G split - a known problem with hardened -> https://forums.gentoo.org/viewtopic.php?t=540135

Not something I am likely to fix in my lifetime (I'm just not that skilled).

Installing a non-hardened version I already almost hosed the hardened version where I finally got all of the hardware working.

I did make several attempts to fix the kernel but was not successful.

Maybe I could just turn off all the grsecurity and pax stuff in the kernel and try that.

----------

## Hu

According to that post, the problem is that Wine is not compatible with how PaX implements SEGMEXEC.  I have not tried this, but I think you could work around it by disabling SEGMEXEC for Wine.  Use sys-apps/paxctl to control what PaX features affect a particular binary.

----------

## neiljw

 *schmeggahead wrote:*   

> To switch from the hardened profile on my machine, can I do that without reinstalling the base?

 

I've done it a couple of times on servers (can't think of a reason to run hardened on anything but a server  :Wink:  ). Of course, there was nothing too complicated to mess up on servers - no X, etc. Just changed profile, switched to gentoo-sources and "emerge -uavDN world". No issues at all. YMMV.  :Wink: 

----------

## Stever

 *neiljw wrote:*   

> I've done it a couple of times on servers (can't think of a reason to run hardened on anything but a server  ). Of course, there was nothing too complicated to mess up on servers - no X, etc. Just changed profile, switched to gentoo-sources and "emerge -uavDN world". No issues at all. YMMV. 

 

Same experience here when I switched my internal web/samba server from hardened back to normal.  No problems at all.

----------

## schmeggahead

More on converting:

Hardened uses 3.4.6 and the current gcc is 4.1.2

(this breaks emwrapper by the way)

that gives you this problem https://forums.gentoo.org/viewtopic-t-607865-highlight-nodelete+glibc.html?sid=cdd70d969a16a74ba6e56db40d514c07

So first:

```
emerge binutils
```

then:

```
emerge -uv gcc
```

then set the new gcc:

```
gcc-config -l
```

then re-emerge the tool chain then system -e (emwrap -Sb)

then re-emerge the world (emwrap -W)

I am only on step 2 above.

----------

## schmeggahead

failure on gcc:

```
In file included from /var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3/include/memory:61,

                 from /var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3/include/string:48,

                 from /var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3/include/bits/locale_classes.h:47,

                 from /var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3/include/locale:46,

                 from /var/tmp/portage/sys-devel/gcc-4.1.2/work/gcc-4.1.2/libstdc++-v3/src/codecvt.cc:30:

/var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3/include/limits:990: error: stray '\226' in program

/var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3/include/limits:1047: error: stray '\374' in program

/var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3/include/limits:1104: error: stray '\226' in program

make[5]: *** [codecvt.lo] Error 1

make[5]: Leaving directory `/var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3/src'

make[4]: *** [all-recursive] Error 1

make[4]: Leaving directory `/var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3'

make[3]: *** [all] Error 2

make[3]: Leaving directory `/var/tmp/portage/sys-devel/gcc-4.1.2/work/build/i686-pc-linux-gnu/libstdc++-v3'

make[2]: *** [all-target-libstdc++-v3] Error 2

make[2]: Leaving directory `/var/tmp/portage/sys-devel/gcc-4.1.2/work/build'

make[1]: *** [all] Error 2

make[1]: Leaving directory `/var/tmp/portage/sys-devel/gcc-4.1.2/work/build'

make: *** [profiledbootstrap] Error 2

 *

 * ERROR: sys-devel/gcc-4.1.2 failed.

 * Call stack:

 *          ebuild.sh, line 1701:  Called dyn_compile

 *          ebuild.sh, line 1039:  Called qa_call 'src_compile'

 *          ebuild.sh, line   44:  Called src_compile

 *          ebuild.sh, line 1383:  Called toolchain_src_compile

 *   toolchain.eclass, line   26:  Called gcc_src_compile

 *   toolchain.eclass, line 1546:  Called gcc_do_make

 *   toolchain.eclass, line 1420:  Called die

 * The specific snippet of code:

 *      emake \

 *              LDFLAGS="${LDFLAGS}" \

 *              STAGE1_CFLAGS="${STAGE1_CFLAGS}" \

 *              LIBPATH="${LIBPATH}" \

 *              BOOT_CFLAGS="${BOOT_CFLAGS}" \

 *              ${GCC_MAKE_TARGET} \

 *              || die "emake failed with ${GCC_MAKE_TARGET}"

 *  The die message:

 *   emake failed with profiledbootstrap

 *

 * If you need support, post the topmost build error, and the call stack if relevant.

 * A complete build log is located at '/var/tmp/portage/sys-devel/gcc-4.1.2/temp/build.log'.

 *

```

emerge --info:

```
Portage 2.1.3.19 (default-linux/x86/2007.0/desktop, gcc-3.4.6, glibc-2.6.1-r0, 2.6.22-gentoo-r9 i686)

=================================================================

System uname: 2.6.22-gentoo-r9 i686 Intel(R) Core(TM)2 Quad CPU @ 2.40GHz

Timestamp of tree: Sat, 10 Nov 2007 15:16:01 +0000

app-shells/bash:     3.2_p17

dev-java/java-config: 1.3.7, 2.0.33-r1

dev-lang/python:     2.4.4-r6

dev-python/pycrypto: 2.0.1-r6

sys-apps/baselayout: 1.12.9-r2

sys-apps/sandbox:    1.2.18.1-r2

sys-devel/autoconf:  2.13, 2.61-r1

sys-devel/automake:  1.7.9-r1, 1.9.6-r2, 1.10

sys-devel/binutils:  2.17, 2.18-r1

sys-devel/gcc-config: 1.3.16

sys-devel/libtool:   1.5.24

virtual/os-headers:  2.6.22-r2

ACCEPT_KEYWORDS="x86"

CBUILD="i686-pc-linux-gnu"

CFLAGS="-march=prescott -O2 -pipe -fomit-frame-pointer -fforce-addr"

CHOST="i686-pc-linux-gnu"

CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"

CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/terminfo /etc/udev/rules.d"

CXXFLAGS="-march=prescott -O2 -pipe -fomit-frame-pointer -fforce-addr"

DISTDIR="/usr/portage/distfiles"

FEATURES="distlocks metadata-transfer sandbox sfperms strict unmerge-orphans userfetch"

GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"

MAKEOPTS="-j5"

PKGDIR="/usr/portage/packages"

PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"

PORTAGE_TMPDIR="/var/tmp"

PORTDIR="/usr/portage"

SYNC="rsync://192.168.5.96/gentoo-portage"

USE="X a52 aac aalib acl acpi ads alsa arts berkdb bitmap-fonts cairo cdaudio cdda cddb cdio cdr cdrom cli cracklib crypt cups dbus dri dts dvd dvdr dvdread dvi eds emboss encode esd evo fam fbcon firefox fortran gdbm gif gimpprint gnome gpm gstreamer gtk gtkhtml hal iconv ipv6 isdnlog java jpeg kde kerberos ldap mad midi mikmod mmx mozilla mp2 mp3 mpeg mplayer mudflap ncurses nls nptl nptlonly ogg opengl openmp oss pam pcre pdf perl png pppd python qt3 qt3support qt4 quicktime readline real realmedia reflection samba sdl sdl-image sdl-sound session spell spl sse ssl subtitles svg svga tcpd tiff transcode truetype truetype-fonts type1-fonts unicode vorbis win32codecs wmf x86 xml xorg xv xvid xvmc zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="nvidia vesa"

Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

```

----------

## schmeggahead

Looks like I'm headed for a full re-install.

The glibc error and gcc together are unresolvable.

I've see resolutions with remerging binutils, coreutils, perl, - you name it and their problems are fixed.

Mine persist.   :Sad: 

Trying libstdc++-v3 now.

But emwrap did everything in system and glibc and gcc consistently failed.

Can't get a different gcc to fix the glibc and can't get gcc without glibc working I guess.

I did recompile the kernel with the new settings but the toolchain has never successfully been rebuilt.

----------

## minor_prophets

 *schmeggahead wrote:*   

> Looks like I'm headed for a full re-install.
> 
> The glibc error and gcc together are unresolvable.
> 
> I've see resolutions with remerging binutils, coreutils, perl, - you name it and their problems are fixed.
> ...

 

Just a thought.  Had you tried emerging these with the --oneshot --nodeps <package name>?

----------

## schmeggahead

I tried that and I'm pretty sure emwrap does that anyway.

No success. 

Marking this thread abandoned and doing full reinstall. (had to move an instance over to dmraid anyway).

----------

## Nessumsar

I had the same problem, here's a solution that worked for me:

1. Switched profile and gcc to non-hardened versions

2. Recompiled gcc 3.4.6

3. Compiled the latest glibc

4. gcc 4.1.2 now compiled without error.

A bit too late for the thread starter, but maybe someone else will find it useful.

----------

## schmeggahead

Well, the thread starter is a bit behind schedule.   :Embarassed: 

So I really appreciate the tips (I'll remember that next time I get through a tough step to search & post like you did - thank you).

I found gcc-3.4.6 masked.

So I'm trying it with 3.3.6

With any luck ...

I'll keep you posted.

& thanks for the holiday gift in advance, I really didn't want to do a full rebuild on yet another machine.   :Wink: 

that failed, so I went to portage browse to get the current atom after unsuccessfully trying to unmask the 3.4.6 package (how do you do that anyway, I just don't get the instructions, they have never worked for me, I must be dense (duh)).

So 3.4.6 is off and running.

----------

## schmeggahead

Well, the formula was a success. Thank you.

I'm ignoring all of the file collisions in the gcc-4.1.2 emerge because it appears to be successful.

Thanks loads. - Marking the thread solved.   :Very Happy: 

----------

