Config for a hardened Gentoo system built on top of the Clang profile.

This is a work in progress

To test this out, start from scratch following the Gentoo handbook, and at install time:

• Choose the stage3-amd64-clang-openrc tarball.
• Before the mirror select step, copy the contents of /etc/portage/ to the system's portage dir.
  • Make sure to inspect them all before proceeding. This does more than hardening the Clang toolchain.
  • You may wish to remove package.use/mandoc and package.accept_keywords/mandoc and remove the PORTAGE_COMPRESS lines in make.conf if you do not want to use mandoc as the system man.
  • In make.conf, you may wish to adjust MAKEOPTS="-j$(nproc)" if you want to keep a cpu core free during compile time.
• If you want the full base system that this repository provides, add the contents of /var/lib/portage/world to the system's @world file.
• When you're at the stage of emerging/updating @world for the first time, brace yourself.

Unfortunately, Gentoo currently forces all LLVM targets to be enabled at build time, which triples LLVM and Clang's compile time. This is a necessay evil due to a bug which causes an issue with reverse dependencies (e.g. Rust) when some targets are disabled. It is possible to disable the unnecessary targets by uncommenting them in /etc/portage/profile/package.use.force, as long as you understand that you'll probably have to build all targets anyway at some point (provided the issue hasn't been fixed by then).

I can only confirm that the packages in the base system and the @world file build perfectly fine with targets disabled by force.

• Provide a hardened kernel config
• Remove multilib support
• Switch to Musl