Is it worth it to switch to a hardened Gentoo profile?

[hjkl]

Hi,

I'm very paranoid about security and practically harden my system to the extent I can without loosing most of the convenience I want (which is luckily not much).

I recently learned about Gentoo "Hardened" and I was wondering if it's worth it for me to switch to it.


https://wiki.gentoo.org/wiki/Hardened_Gentoo Also it seems that this is kind of outdated (switching to the hardened profile) as hardened-sources no longer exist.


WIll it cause any headaches and will SELinux be mandatory to use or just optional as I don't want to bother setting it up.

Cheers!
_________________
Having problems compiling since 2021

[alamahant]

Hi if you select

[eccerr0r]

It indeed is a security vs convenience issue. Sometimes you will run into things that don't "work" because it's trying to protect you. Whether or not you want to deal with it is the question.

For a computer that "does just one thing" (like a backend database or file server) it might make sense.

For a computer that "does everything" (including workstations) likely you'll run into things that will annoy you from time to time and possibly more often than not.

Totally up to you. The idea, however, is that the software you run should be kept secure and free from bugs that hardened kernels should not be necessary and is simply overhead - until a hacker finds an undiscovered or zero day and exploits it...
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

[Goverp]

I run ~amd64 gentoo-sources, and noticed that the last update brought a new Gentoo meta-configuration item CONFIG_GENTOO_KERNEL_SELF_PROTECTION which looks to turn on several security enhancements (which I currently run without).
The relevant non-Gentoo documentation appears to be here, and a Gentoo-related note here.
_________________
Greybeard

[pietinger]

[pietinger]

[alamahant]

Thanks pietinger
for the detailed list of what these options entail.
I went through your to-the-point post.
I am uncertain about this though.
If one uses a FULL .config like i dont know arch or fedora all these gentoo-specific expansions will have already been included no?
I am not sure about the hardened feature but the rest i suppose so...
Do you have any clarity maybe on this?
Also is it possible to compile a hardened kernel source with a normal gcc?[/url]

Thanks....
_________________

[hjkl]

[pjp]

[pietinger]

Hi, alamahant

[pietinger]