Uninstallation and Optimization

Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev | Chapter 7. Configuring and Building a Secure, Optimized Kernel | Next

# 7.2. Uninstallation and Optimization

1. We must copy the archive file of the Kernel to the `/usr/src` directory and move to this directory.

                      [root@deep] /#cp linux-version_tar.gz /usr/src/
                      [root@deep] /#cd /usr/src/

   These steps are required only if you already have installed a Linux kernel with a tar archive before. If it is a first, fresh install of Linux kernel, then instead uninstall the kernel-headers-version.i386.rpm, kernel-version.i386.rpm package that are on your system. Remove the Linux symbolic link with the following command:

                      [root@deep ] /src#rm -rf linux

   Remove the Linux kernel headers directory with the following command:

                      [root@deep ] /src#rm -rf linux-2.2.xx

   Remove the Linux kernel modules directory with the following command:

                      [root@deep ] /src#rm -rf /lib/modules/2.2.xx

   > : Removing the old kernel modules is required only if you have installed a modularized kernel version before. If the modules directory doesn't exist under the `/lib` directory it's because your old kernel version is not a modularized kernel.

   If the original kernels RPM package are installed on your system instead of the Linux kernel tar archive, because you have just finished installing your new Linux system, or have used an RPM package before to upgrade your Linux system, then use the following command to uninstall the Linux kernel: You can verify that a kernel RPM package is installed on your system with the following command:

                      [root@deep ] /src#rpm -qa |grep kernel

   `kernel-headers-2.2.xx.i386.rpm kernel-2.2.xx.i386.rpm`

   To uninstall the linux kernel RPM, use the following command:

                      [root@deep ] /src#rpm -e --nodeps kernel-headers kernel

   `cannot remove /usr/src/linux-2.2.xx - directory not empty cannot remove /lib/modules/2.2.xx - directory not empty`

                      [root@deep ] /src#rm -rf /usr/src/linux-2.2.xx/
                      [root@deep ] /src#rm -rf /lib/modules/2.2.xx/

   In the steps below, we remove manually the empty `/usr/src/linux-2.2.xx` and `/lib/modules/2.2.xx` directories after the uninstallation of the kernels RPM, the RPM uninstall program will not completely remove those directories.

2. Now, we must decompress the tar archive of the kernel and remove the Linux tar archive from the system.

                      [root@deep ] /src#tar xzpf linux-version_tar.gz
                      [root@deep ] /src#rm -f  linux-version_tar.gz

3. To increase the number of tasks allowed the maximum number of processes per user, you may need to edit the `/usr/src/linux/include/linux/tasks.h` file and change the following parameters. Edit the tasks.h file, vi +14 `/usr/src/linux/include/linux/tasks.h` and change the following parameters: `NR_TASKS` from `512` to `3072` and `MIN_TASKS_LEFT_FOR_ROOT` from `4` to `24`

   > : The value in the `NR_TASKS` line denotes the maximum number of tasks (processes) handles that the Linux kernel will allocate per users. Increasing this number will allow you to handle more connections from clients on your server, example: an HTTP web server will be able to serve more client connections. Please don't forget, Linux is protected from allocation of all process slots for normal users. There is a special parameter line `MIN_TASKS_LEFT_FOR_ROOT` reserved especially for the super-user root that you may set for the number of process reserved to root `-24` is a good value.

4. To optimize the Linux kernel to fit your specific CPU architecture and optimization flags you may need to edit the `/usr/src/linux/Makefile` file and change the following parameters.

   1. Edit the Makefile file (vi +18 /usr/src/linux/Makefile) and change the line: `HOSTCC =gcc` to read:

                         HOSTCC =egcs.

   2. Edit the Makefile file, vi +25 `/usr/src/linux/Makefile` and change the line: `CC =$(CROSS_COMPILE)gcc D__KERNEL__ -I$(HPATH)` to read:

                         CC =$(CROSS_COMPILE)egcs D__KERNEL__ -I$(HPATH).

   3. Edit the Makefile file vi +90 `/usr/src/linux/Makefile` and change the line: `CFLAGS = -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer` to read:

                         CFLAGS = -Wall -Wstrict-prototypes -O9 -funroll-loops -ffast-math -malign-double -mcpu=pentiumpro -march=pentiumpro -fomit-frame-pointer -fno-exceptions

   4. Edit the Makefile file vi +19 `/usr/src/linux/Makefile` and change the line: `HOSTCFLAGS =-Wall -Wstrict-prototypes -O2 -fomit-frame-pointer` to read:

                         HOSTCFLAGS =-Wall -Wstrict-prototypes -O9 -funroll-loops -ffast-math -malign-double -mcpu=pentiumpro -march=pentiumpro -fomit-frame-pointer -fno-exceptions

> : These changes turn on aggressive optimization tricks that may or may not work with all kernels. Please, if the optimization flags above, or the ones you have chosen for your CPU architecture do not work for you, don't try to absolutely force it to work. I wouldn't want to make your system unstable like Microsoft Windows.

Prev | Home | Next
Pre-Install | Up | Securing the kernel