Lisp (SBCL) on Hardened Gentoo

Dan Ballard — Sat, 21 Jun 2008 07:07:16 +0000

My server, mindstab.net, runs Hardened Gentoo. I like it. It provides nice features from grsecurity and PaX like memory randomization, non executable writable memory, etc. However, it really doesn't get along so well with Lisp. Lisp in general seems to like executable and writable memory, and SBCL at least also doesn't like randomized memory. So it took a bit of work to get Lisp onto my server.

Approach 1: Failure
I spent a bunch of time trying to patch the build process in portage to coax SBCL into building. First, of course, I used gcc-config to disable the hardened gcc profile, and just use the vanilla one. Then I created a suid root shell script to call "paxctl -m -p -r -e $1" so that the sandboxed build process could disable PaX features on the SBCL binaries. I added the command to the ebuild, and created a patch to insert the command into SBCL's build process. The process goes like this, portage download's the SBCL source and a pre-compiled SBCL binary. The patched ebuild then calls my suid root script which disables PaX on the pre-compiled binary so it actually runs (as opposed to crashing under PaX) and then a new SBCL binary is built from the source and the pre-compiled binary builds a core file from the SBCL lisp source. The patched SBCL make.sh then again calls the suid root script on the new binary, so it will run. Then it should load the new core and recompile the system for itself. Sadly, while it runs at least, it chokes on the core file and hangs while using 100% cpu. I couldn't get past this so I eventually gave up. If anyone has any suggestions that'd be great.

Approach 2: Success
So the actually solution was as follows: Download the most recent precompiled SBCL binary from the website (1.0.15 for x86), run "paxctl -p -e -m -r -x -s " on src/runtime/sbcl (to cover all the bases). Then run "sh install.sh" to install SBCL to /usr/local. That's it.

The problem with this is you can't emerge lisp packages in portage, you have to install them by hand (unless maybe you want to fake inject the package into the portage database).

I downloaded a copy of slime, untarred it and popped it in my .emacs and I had a full lisp environment ready to go, and on my hardened machine no less. Not so bad.

Emacs and Slime highlight changes and how to control it

Dan Ballard — Thu, 15 May 2008 02:23:26 +0000

Massive thanks to durka on #lisp on irc.freenode.net.
New versions of slime for emacs have had enabled by default a new feature, essentially a light highlighting of uncompiled changes to a file. At first I found it annoying but then I got used to it. It is kind of handy. However I wouldn't find out how to turn it on or off. Oh well.

Then I went to use emacs on the console and the subtle light grey background highlight was suddenly grey text on a white background and completely unreadable. Very annoying, suddenly this little feature rendered -nox emacs useless.

Hours of google searching turned up nothing so finally I resorted to the irc channel. In only 10 minutes we got the answer.

 aha
 customize emacs - applications - slime - slime mode - slime mode faces
 change highlight edits face

Thank you.

Mindstab.net » Emacs

Lisp (SBCL) on Hardened Gentoo

Emacs and Slime highlight changes and how to control it