I’d like to announce a new (fun?) initiative of the hardened uClibc subproject: a security enhanced, fully featured XFCE4 desktop for amd64, built on uClibc, codenamed “Lilblue”, after the little blue penguin of New Zealand , a smaller cousin of the Gentoo.
The hardened uClibc subproject aims at producing hardened stage3s for amd64, mips (isa=mips32r2/mipsel3, abi=o32), armv7a (softfloat) and i686 . Recent improvements in uClibc and bugfixes in various Gentoo packages, both downstream and upstream, now make it possible to build an entire desktop system replacing glibc with uClibc. So, in addition to the stage3s, we are now releasing a fully featured XFCE4 desktop for arch=amd64. It does *not* depend on busybox to provide its core utilities like most uClibc systems, but coreutils, util-linux and all the usual system packages you find on a generic Gentoo system. The tarball bundles about 800 packages including ephiphany, claws, hexchat, abiword, gqview, transmission, vinagre, etc. We have plans to provide binpkgs for up to 7000 packages in all. The hardening includes all of the usual toolchain and kernel hardening you get in regular hardened glibc-based Gentoo.
The project has been in development for a year but should be considered experimental. A user base of … uhm … one … does not really qualify it to be labeled as “safe for production” . However, I have had no issues with it (minor bugs of course) and I use it on a daily basis. For the average user, the main advantage is speed and the system does feel “snappy”. For developers, its fun to dig into bugs which revolve around what functions are provided by your standard C lib: is this POSIX or a GNU-ism? should I fix the package or add a new function to uClibc? what is the best way to implement this fix so it ports across different *libcs? what do I do about this package whose build system is braindead and doesn’t understand libdir? If you have too much time on your hands and you’re into that kind of “fun” we have a project for you! On a serious note, the main reason for this initiative is to explore and expand the usefulness of an alternative standard C library.
The home page is at  and a freecode.com announcement at . It can be downloaded from any gentoo mirror  at [mirror]/gentoo/experimental/amd64/uclibc/desktop-amd64-uclibc-hardened-[date].tar.bz2. The date of the first release is 20130531.
 This is not entirely true. I would like to thank my students for testing, especially Devan Franchini <firstname.lastname@example.org>.
Back in September of last year, I pushed out two images for xfce4-based desktop systems for the Yeeloong netbook. These mips64el machines are manufactured by Lemote in China, and distributed in the US by “Freedom Included“. Over the summer, I spent time fixing the bugs I hit as I ported over goodies for the desktop: Abiword for word prcessing, GQview for images, Audacity for audio, Claws for email and Dillo for browsing. Most of these bugs were in build systems that were not multilib aware. I was building for three ABI’s, o32, n32 and n64 with libraries living in /lib, /lib32 and /lib64, respectively, and similarly under /usr. Since some build systems would blindly install into /lib and since the default ABI is n32, this caused some issues!
As mentioned, there are two images, one for binaries built with a hardened toolchain (SSP, PIE, FORTIFY_SOURCES=2, bind_now and relro) and the other for binaries built with a vanilla toolchain. Remarkably, hardening led to no appreciable bugs over the vanilla, but there is about a 5% performance hit when running. This is most noticeable when compiling which is already slow on these 800-900 MHz machines. In fact, this is why I decided to distribute entire desktops and not just stage3′s. It would take a user about two days of no stop building to get to the desktop from a stage3. Given the occasional failure along the way, this is a recipe for frustration for anyone who wants Gentoo on their Yeeloong. Hopefully the end user won’t be too unhappy with my choice of software. In the future, I hope to have a better brower than Dillo and try go get video working. I’ve had some success with the latter but not enough to push something out.
Anyhow, four months after my initial images and I thought its time to update. Except for updating the packages, I didn’t change the selection. My update to the kernel, however, was important: we can now do the usual partitioning suggested in the Gentoo Handbook: boot on sda1 with ext2, swap on sda2 and root on sda3 with ext4. My first images had to combine boot and root into one ext3 partition because of certain limitations.
I hope if you have the hardware you’ll give the images a test drive and let me know! They’re available on any Gentoo mirror under <mirror>/experimental/mips/desktop-loongson2f. The latest version is 20130124 and the instructions for installation are found here.
I’d like to announce a new initiative within the mips arch team. We are now supporting an xfce4-based desktop system for the Lemote Yeeloong netbook. The images can be found on any gentoo mirrors, under gentoo/experimental/mips/desktop-loongson2f. The installation instructions can be found here. The yeeloong netbook is particularly interesting because it only uses “free” hardware, ie. hardware which doesn’t require any proprietary code. It is manufactured by Lemote in China, and distributed and promoted in the US by “Freedom Included“. It is how Richard Stallman does his computing.
I’m blogging because I thought it was important for Planet Gentoo to know that mips devices are currently being manufactured and used in netbooks as well as embedded systems. The gentoo mips team has risen to the challenge of targetting these systems and maintaining natively compiled stage4′s for them. Why stage4′s? And why a full desktop for the yeeloong? These processors are slow, so the time from a stage3 to a desktop is about three days for the yeeloong. Also, the yeeloong sports a little endian mips64 processor, the loongson2f, and we support three ABIs: o32, n32 and n64, with n32 being the preferred. This significantly increases the time to build glibc and other core packages. I provide two images, a vanilla one and a hardened one. The latter adds full hardening (pie, ssp, _FORTIFY_SOURCES=2, bind now, relro) to the toolchain and userland binaries as we do for amd64 and i686 in hardened gentoo. I have not ported over the hardened kernel, however.
I allude above to “other” targetted devices. I am also maintaining some mips uclibc systems (both hardened and vanilla) which are on the gentoo mirrors under experimental/mips/uclibc. But I will speak more of these later as part of an initiative to maintain hardened uclibc systems on “alternative” architectures such as arm, mips, ppc as well as amd64 and i686.
You can read the full installation instructions, but here’s a quick summary, since it doesn’t follow the usual Gentoo method of starting from a stage3:
- Prepare either a pen drive or a tftp server with a rescue image: netboot-yeeloong.img
- Turn on the yeeloong and hit the Del key multiple times until you get the firmware promt: PMON>
- If netbooting, add an IP address and point to the netboot-yeeloong.img. If using a pen drive then point to thei image on the drive and boot into the rescue environment.
- Partition and format the drive.
- Download the desktop image from a mirror via http or ftp. Its about 350 MB in size.
- Unpack the image. It contains not only the userland, but also a kernel.
- Reboot to the PMON> prompt. Aim to the kernel on the drive. PMON will remember your choice and you will not have to repeat this step.
Once installed, you will log in as an ordinary user with sudo with username and password = “gentoo”. The root password is also set to “root”. It is an ordinary Gentoo system, so edit your make.conf, emerge –sync and add whatever packages you like! File bugs to: email@example.com with a CC to firstname.lastname@example.org.
If you have a Yeeloong or go out and buy one, consider trying out this image.
Hi Universe! Wow you’re so big. And I’m so small. What can I say in such a vast void of any significance?
This is my “hello world” post to Planet Gentoo. I’ll be posting about my dev activities here.