Dear All,

I am new to the Linux Questions forum.

I run gentoo and debian linux OSes.

I am curious about Bedrock Linux.

From what I can see it allows you to run two or more linux distributions in tandem.

Thus you can get a "best of both worlds" experience.

Gentoo is a distribution which is useful if you want to compile and configure the latest kernel containing patches for spectre and meltdown vulnerabilities and newer exotic vulnerabilities that seem to be appearing at present.

Debian is a distribution which traditionally has released kernels and versions of web browsers and other packages at a more leisurely pace but which has a reputation for reliability and stability etc.


Out of interest, if you would combine these two distributions with Bedrock Linux, would it be possible to compile a very recent kernel using portage and install it for use by debian in the hybrid bedrock environment?

Both rpm and deb formats are included in the kernel configuration and installation system in Linux but if you try to compile a kernel under gentoo as a linux-image file that you could copy or port to a debian system and then install on it using dpkg -i etc that doesn't work easily at all in practice.

I tried using fakeroot in gentoo plus some fancy out of tree kernel compilation scripts but I kept getting errors and grief of different kinds in gentoo.

You have to compile and install new kernels in debian for use in debian it would seem.

But maybe Bedrock can do the Clark Kent entering to phone box transition and a compile once run anywhere solution can be found even for bang up to date linux kernels...

Comments appreciated.

Regards

Michael Fothergill

Instead of thinking of them as running in tandem, I'd prefer to model it as letting you get pick get parts from one distro and parts from another. Part of the importance of the distinction is that there are some things you can only have one of in use as once, such as only having one kernel or one PID1. Bedrock does not abstract these away.

Yes, that's possible. You could, for example, hijack a Gentoo install then `brl fetch debian` and start using things from Debian.

However, if you only want the kernel from Gentoo, and you only want it because of recency with respect to things like spectre fixes, note:

• Debian backports important security fixes to its older kernels. They are on top of things like Spectre and Meltdown. So long as you update your properly configured Debian system, you should be fine with respect to such kernel exploits.
• Debian offers newer kernels for their stable system via "backports."
• You can compile newer kernel releases yourself on Debian. Just `git clone` from kernel.org instead of using Debian's source. Apply whatever Gentoo patches you want.

If you're using the upstream kernel's build system - not emerge - and its .deb output, there's little value in building it on gentoo. Just build it on Debian.

Have too, no. It's quite possible on Gentoo, it's just a bit more work. Given your background, that extra work may be problematic. Given your goal, I don't see why suffering through that offers you anything.

Bedrock can let you use Gentoo's make with Debian's dpkg-buildpackage, but I don't really see how that helps over just building it entirely with Debian's tooling. Bedrock can also let you use Gentoo's kernel with Debian's userland, but from your description I think just using a Debian security team maintained kernel, or a backported kernel, or building a custom kernel on Debian, will provide the same benefits with a lot less complexity.

2 members found this post helpful.

Many thanks for your comments.

In my experience when the spectre and meltdown problems occurred I found it much easier to keep on top of them with gentoo than debian.

I found compiling kernels in debian to be difficult.

You needed gcc 8 to add the spectre patches into the kernel. Gcc 8 was not even available in debian sid then.

However as you say debian did respond to this.

But new vulnerabilities seem to be appearing now.
More could be coming in the future:


https://www.fudzilla.com/news/48965-...-to-get-tricky

People have been enquiring about this:

https://lists.debian.org/debian-user.../msg00674.html


The main problem I had doing the out of tree kernel compilations for debian was the dpkg-buildpackage issue. But if that can be fixed with Bedrock linux then that is
impressive.

As I recall it the recommendation for not using emerge for this came from the gentoo community.

I need to get a cooler for another machine I have. Once it is installed I will try out Bedrock Linux on it.

I have gentoo and debian installed on it. I will try making a kernel for debian with both the gentoo approach and the native debian one and see experimentally which is the
easiest and fastest. The custom kernel build does look to have been simplified in debian.


Thanks for the input on this.

Regards

MF