Hardening

[AgentD]

• Turn on all the fancy binutils and gcc configure options for stack protection and code fortification
• Pass additional flags to build systems to use available gcc and ld flags
• Finish cleaning up filesystem permissions
• Configure services (the ones that don't already do this) to run as unprivileged users in chroot chails

[AgentD]

Most of this is done as of now. As commented on the init project, adding SELinux policies may prove interesting for some services.

What I would still like to do in addition: Reduce number of setuid binaries (e.g. replace passwd and frieds with openwall alternatives, musl supports shadow.d)

[AgentD]

mksquashfs has been replaced with our own tool by now which supports SELinux labeling through a file contexts files.