# first hardened installation

## D-LINC

I'm doing a fresh Gentoo installation on a server and am taking the hardened route: hardened profile, hardened kernel, pax + grsec. I've just chrooted into my new root filesystem, and set the profile and use flags. Is this the point where I should rebuild the tool chain? (Before installing the kernel, correct?) Do I just run an emerge world, or is there something more specific I should emerge first? (To be honest, I'm not sure how many packages are are part of the "tool chain".)

----------

## Veldrin

definitely a good idea to rebuild the toolchain: emerge -a1 linux-headers glibc gcc binutils

alternatively you could have used a hardened stage3 (but I am not sure if they are still around)

then select the appropriate gcc profile (usually just the first one) and rebuild the world. (simple variant: emerge -aDuN world, thorough variant: emerge -e world)

V.

----------

## D-LINC

Thank you for a quick and detailed reply.

----------

## myceliv

 *Veldrin wrote:*   

>  alternatively you could have used a hardened stage3 (but I am not sure if they are still around) 

 

On the mirrors in e.g. autobuilds/current-stage3-amd64-hardened/ there are usually pretty new official ones. Currently it's about six months old, which may save you some build time, especially if you aren't using ~arch.

If you trust jmbvicetto (linked from the #gentoo-hardened freenode irc channel) then you can get very recent hardened stage3's from releases/amd64/hardened/ at http://www.jmbsvicetto.name

Although I don't think the stage3 question is answered there, for future searchers looking for more hardened documentation, the Hardened Project Page has lots of great doc links.

----------

## D-LINC

Related question:

```
# gcc-config -l

 [1] i686-pc-linux-gnu-4.5.3 *

 [2] i686-pc-linux-gnu-4.5.3-hardenednopie

 [3] i686-pc-linux-gnu-4.5.3-hardenednopiessp

 [4] i686-pc-linux-gnu-4.5.3-hardenednossp

 [5] i686-pc-linux-gnu-4.5.3-vanilla

```

Which one to choose? I was under the impression from the hardened quick-start doc that I was supposed to have PIE and SSP.

----------

## myceliv

Yeah, a bit confusing. You want the unannotated one ([1] here) except for unusual cases that require disabling some or all features. If you have multiple gcc versions you might have [1] or [6] or [11]... to choose from.

```
# gcc-config -l

 [1] i686-pc-linux-gnu-4.5.3 * <-- full on hardened, PIE+SSP

 [2] i686-pc-linux-gnu-4.5.3-hardenednopie

 [3] i686-pc-linux-gnu-4.5.3-hardenednopiessp

 [4] i686-pc-linux-gnu-4.5.3-hardenednossp

 [5] i686-pc-linux-gnu-4.5.3-vanilla <-- plain gcc, unhardened

```

----------

