From Gentoo Wiki
Jump to:navigation Jump to:search
This is a Talk page - please see the documentation about using talk pages. Add newer comments below older ones, sign comments using four tildes (~~~~), and indent successive comments with colons (:). Add new sections at the bottom of the page, under a heading (== ==). Please remember to mark sections as "open for discussion" using {{talk|open}}, so they will show up in the list of open discussions.


Talk status
This discussion is done.

You have just added some examples for hardening the kernel. Maybe you want read more here User:Pietinger/Tutorials/Kernel_Hardening_with_KSPP

-- Pietinger 09:03, 07 March 2023 (UTC)

Added -- Gso321 (talk) 17:25, 10 March 2023 (UTC)

Wording Queries

Talk status
This discussion is done.

This is a really good new submission and one I think many people will find helpful so thanks for creating it.

I do have two queries though:

1. Kernel/Optimization#Kbuild

Here you have suggested using -O3, I know from testing using it systemwide this is generally slower so I think if you know in the case of kernel this is better it would be wise to add some results to show what to accept.

2. Kernel/Optimization#Clang.2FLLVM

Could you clarify what the warning is for on this one as you can use a LLVM compiled system with a GCC compiled kernel with very few issues nowadays as I'm running gentoo-kernel-bin on my system which is setup in this way.

-- Immolo (talk) 16:19, 10 March 2023 (UTC)

1. You can see some results in Phoronix article. I might add my own benchmarks 2. What i meant is to not mix the binutils, for example make CC=gcc LD=ld.lld AR=llvm-ar will not work because LLVM's ar and ld is not compatible with GCC. -- Gso321 (talk) 17:25, 10 March 2023 (UTC)
Now it makes sense to me and I agree with it, please think about adding these to your guide as in my opinion it completes it.
Immolo (talk) 17:49, 10 March 2023 (UTC)
Done -- Gso321 (talk) 18:01, 10 March 2023 (UTC)

Links to hardened sources

Talk status
This discussion is done.

Maybe you are interested also in this one: (Clip OS is based on Gentoo and made from the french secret service.) -- Pietinger 07:55, 18 April 2023 (UTC)

Added. -- Gso321 (talk) 23:17, 24 April 2023 (UTC)

Compiling Kernel GCC GPO not work

Talk status
This discussion is still ongoing.

see post

Added. -- Antonellocaroli (talk) 09:04, 19 August 2023 (UTC)

LLVM toolchain install step is overzelous

Talk status
This discussion is still ongoing.

Installing sys-libs/llvm-libunwind or sys-libs/compiler-rt is not necessary for building the kernel with clang. The kernel has not special requirement on them, and to use them would require extra setup (the kernel wouldn't use them even after that). Including sys-libs/llvm-libunwind especially in the instructions just causes confusion as sys-libs/libunwind is going to block it most of the time for non-llvm profile users.

Really the bare minimum it could be is clang+lld as clang and lld are going to pull in llvm by themselves.

Mentioning sys-libs/compiler-rt-santitizers could been useful if the use of the sanitizers was expanded on though (shadow-call-stack and kcfi).

On a similar note its odd that isn't linked in this page, especially in the references.

Parona (talk) 16:31, 18 November 2023 (UTC)