Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev Chapter 7. Configuring and Building a Secure, Optimized Kernel Next

7.2. Uninstallation and Optimization

  1. We must copy the archive file of the Kernel to the /usr/src directory and move to this directory.

    
               [root@deep] /#cp linux-version_tar.gz /usr/src/
               [root@deep] /#cd /usr/src/
    These steps are required only if you already have installed a Linux kernel with a tar archive before. If it is a first, fresh install of Linux kernel, then instead uninstall the kernel-headers-version.i386.rpm, kernel-version.i386.rpm package that are on your system. Remove the Linux symbolic link with the following command: 
    
               [root@deep ] /src#rm -rf linux
    Remove the Linux kernel headers directory with the following command: 
    
               [root@deep ] /src#rm -rf linux-2.2.xx
    Remove the Linux kernel modules directory with the following command: 
    
               [root@deep ] /src#rm -rf /lib/modules/2.2.xx

    Important: Removing the old kernel modules is required only if you have installed a modularized kernel version before. If the modules directory doesn't exist under the /lib directory it's because your old kernel version is not a modularized kernel.

    If the original kernels RPM package are installed on your system instead of the Linux kernel tar archive, because you have just finished installing your new Linux system, or have used an RPM package before to upgrade your Linux system, then use the following command to uninstall the Linux kernel: You can verify that a kernel RPM package is installed on your system with the following command: 
    
               [root@deep ] /src#rpm -qa |grep kernel

    kernel-headers-2.2.xx.i386.rpm kernel-2.2.xx.i386.rpm
                   

    To uninstall the linux kernel RPM, use the following command: 
    
               [root@deep ] /src#rpm -e --nodeps kernel-headers kernel


                    cannot remove /usr/src/linux-2.2.xx - directory not empty cannot remove /lib/modules/2.2.xx - directory not empty
                   

    
               [root@deep ] /src#rm -rf /usr/src/linux-2.2.xx/
               [root@deep ] /src#rm -rf /lib/modules/2.2.xx/
    In the steps below, we remove manually the empty /usr/src/linux-2.2.xx and /lib/modules/2.2.xx directories after the uninstallation of the kernels RPM, the RPM uninstall program will not completely remove those directories.

  2. Now, we must decompress the tar archive of the kernel and remove the Linux tar archive from the system.

    
               [root@deep ] /src#tar xzpf linux-version_tar.gz
               [root@deep ] /src#rm -f  linux-version_tar.gz

  3. To increase the number of tasks allowed the maximum number of processes per user, you may need to edit the /usr/src/linux/include/linux/tasks.h file and change the following parameters. Edit the tasks.h file, vi +14 /usr/src/linux/include/linux/tasks.h and change the following parameters: NR_TASKS from 512 to 3072 and MIN_TASKS_LEFT_FOR_ROOT from 4 to 24

    Important: The value in the NR_TASKS line denotes the maximum number of tasks (processes) handles that the Linux kernel will allocate per users. Increasing this number will allow you to handle more connections from clients on your server, example: an HTTP web server will be able to serve more client connections. Please don't forget, Linux is protected from allocation of all process slots for normal users. There is a special parameter line MIN_TASKS_LEFT_FOR_ROOT reserved especially for the super-user root that you may set for the number of process reserved to root -24 is a good value.

  4. To optimize the Linux kernel to fit your specific CPU architecture and optimization flags you may need to edit the /usr/src/linux/Makefile file and change the following parameters.

    1. Edit the Makefile file (vi +18 /usr/src/linux/Makefile) and change the line: HOSTCC =gcc to read:

      
               HOSTCC =egcs.

    2. Edit the Makefile file, vi +25 /usr/src/linux/Makefile and change the line: CC =$(CROSS_COMPILE)gcc D__KERNEL__ -I$(HPATH) to read:

      
               CC =$(CROSS_COMPILE)egcs D__KERNEL__ -I$(HPATH).

    3. Edit the Makefile file vi +90 /usr/src/linux/Makefile and change the line: CFLAGS = -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer to read:

      
               CFLAGS = -Wall -Wstrict-prototypes -O9 -funroll-loops -ffast-math -malign-double -mcpu=pentiumpro -march=pentiumpro -fomit-frame-pointer -fno-exceptions

    4. Edit the Makefile file vi +19 /usr/src/linux/Makefile and change the line: HOSTCFLAGS =-Wall -Wstrict-prototypes -O2 -fomit-frame-pointer to read:

      
               HOSTCFLAGS =-Wall -Wstrict-prototypes -O9 -funroll-loops -ffast-math -malign-double -mcpu=pentiumpro -march=pentiumpro -fomit-frame-pointer -fno-exceptions

Important: These changes turn on aggressive optimization tricks that may or may not work with all kernels. Please, if the optimization flags above, or the ones you have chosen for your CPU architecture do not work for you, don't try to absolutely force it to work. I wouldn't want to make your system unstable like Microsoft Windows.

Prev Home Next
Pre-Install Up Securing the kernel