Hardened Gentoo

'''Gentoo Hardened is a Gentoo project that offers multiple additional security services on top of the all-known Gentoo Linux installation. Although each of them can be selected separately, Gentoo Hardened enables several risk-mitigating options in the toolchain, supports PaX, grSecurity, SELinux, TPE and more'''

Whether you are running an Internet-facing server or a flexible workstation, when you are dealing with multiple threats you will want to harden your system further than just automatically applying the latest security patches. Hardening a system means that you take additional countermeasures against attacks and other risks and is usually a combined set of activities you perform against the system.

Within Gentoo Hardened, several projects are active that help you further harden your Gentoo system through
 * enabling specific options in the toolchain (compiler, linker ...) such as forcing position-independent executables (PIE), stack smashing protection and compile-time buffer checks
 * enabling PaX extensions in the Linux kernel, which offer additional protection measures like address space layout randomization and non-executable memory
 * enabling grSecurity extensions in the Linux kernel, including additional chroot restrictions, additional auditing, process restrictions, etc.
 * enabling SELinux extensions in the Linux kernel, which offers a Mandatory Access Control system enhancing the standard Linux permission restrictions

Of course, this includes the necessary userspace utilities to manage these extensions.

Toolchain
The hardened GCC profile is the one without a suffix. If you want to disable PIE or SSP, choose the relavent hardenedno(pie|ssp) or both, hardenednopiessp. The vanilla profile is of course the one with hardening disabled.

Per Package
Changing the GCC profile to deal with specific packages can be a pain. A way to avoid this is to set per-package C(XX)FLAGS using package.env. Create the file /etc/portage/env/nossp and add to that:

To allow for disabling PIE, create and add to /etc/portage/env/nopie:

Finally add the package you want to disable either PIE or SSP for to /etc/portage/package.env and the relevant /etc/portage/env/, for this example is used here:

Grsecurity chroot
If you want to chroot to a copied environment where the CONFIG_GRKERNSEC_CHROOT is enabled you must use the cd grub and change the root(cd) kernel(cd) initrd(cd) setting to from (cd) to (hdx,y).

Now you can install the grub environment.

Links

 * Gentoo Hardened Project
 * Gentoo Hardened SELinux Project