3 ms·

The Gentoo Hardened Project makes using grsec/PaX relatively easy. https://wiki.gentoo.org/wiki/Project:Hardened https://wiki.gentoo.org/wiki/Project:Hardened

by jakeogh 11y ago

dfc 11y ago
Anyone that is curious about grsec and comfortable installing a gentoo overlay would have no problem installing grsec on their own; especially if gentoo was not their normal distro. You are not doing anyone any favors by making grsec look like a Sisyphean task without gentoo.
- riffraff 11y ago
  I used to run mandrake many years ago, and there was a -grsec kernel available in their package repository, and it just worked.
_yy 11y ago
Arch Linux has a working out-of-the-box config too. The guy who contributed it to Arch Linux is Daniel Micay, who was also quoted in the WaPo article.
meirelles 11y ago
I used to be a security freak guy. Using the Gentoo Hardened, GRSecurity PaX/RBAC, customized ACLs, etc. IMHO is a high-quality piece of software, very polished and well-designed... I'm a Ubuntu guy today. For my small business, such level of security is too much time consuming, drawing me back. It's kinda sad.
- antocv 11y ago
  Same here. I used to make my own Linux distribution, from scratch, with Grsecurity, PaX/RBAC for everything. Then it wasnt so usable, when I needed new packages/software, or upgrades, compiling was tiresome, and I didnt know how to make a package manager, or how to automate everything. I assumed somebody else would do it, a big multi billion dollar company perhaps, since I was just 16 year-old doing that over a summer, they would do better, right? Oh how sad. Nobody really cares about security. Since, enterprises just use lawyers instead of security.
- hannob 11y ago
  You know, that's the problem. There is basically no reason why this is so hard. Many security features could just be enabled by default by major distributions with hardly any downside. You don't even have to look at grsecurity. Just using pie binaries to enable proper ASLR would be a start.
  - rlpb 11y ago
    Ubuntu already does quite a bit: https://wiki.ubuntu.com/Security/Features https://wiki.ubuntu.com/Security/Features I'm not well versed enough to understand whether "Just using pie binaries to enable proper ASLR" is included, but the chart does show green against various things mentioning ASLR. It looks like specific packages are built with PIE, too.

The Gentoo Hardened Project makes using grsec/PaX relatively easy. https://wiki.gentoo.org/wiki/Project:Hardened https://wiki.gentoo.org/wiki/Project:Hardened

by jakeogh 11y ago

The Gentoo Hardened Project makes using grsec/PaX relatively easy. https://wiki.gentoo.org/wiki/Project:Hardened https://wiki.gentoo.org/wiki/Project:Hardened

dfc 11y ago

Anyone that is curious about grsec and comfortable installing a gentoo overlay would have no problem installing grsec on their own; especially if gentoo was not their normal distro. You are not doing anyone any favors by making grsec look like a Sisyphean task without gentoo.

riffraff 11y ago
I used to run mandrake many years ago, and there was a -grsec kernel available in their package repository, and it just worked.

_yy 11y ago

Arch Linux has a working out-of-the-box config too. The guy who contributed it to Arch Linux is Daniel Micay, who was also quoted in the WaPo article.

meirelles 11y ago

I used to be a security freak guy. Using the Gentoo Hardened, GRSecurity PaX/RBAC, customized ACLs, etc. IMHO is a high-quality piece of software, very polished and well-designed... I'm a Ubuntu guy today. For my small business, such level of security is too much time consuming, drawing me back. It's kinda sad.

antocv 11y ago
Same here. I used to make my own Linux distribution, from scratch, with Grsecurity, PaX/RBAC for everything. Then it wasnt so usable, when I needed new packages/software, or upgrades, compiling was tiresome, and I didnt know how to make a package manager, or how to automate everything. I assumed somebody else would do it, a big multi billion dollar company perhaps, since I was just 16 year-old doing that over a summer, they would do better, right? Oh how sad. Nobody really cares about security. Since, enterprises just use lawyers instead of security.
hannob 11y ago
You know, that's the problem. There is basically no reason why this is so hard. Many security features could just be enabled by default by major distributions with hardly any downside. You don't even have to look at grsecurity. Just using pie binaries to enable proper ASLR would be a start.
- rlpb 11y ago
  Ubuntu already does quite a bit: https://wiki.ubuntu.com/Security/Features https://wiki.ubuntu.com/Security/Features I'm not well versed enough to understand whether "Just using pie binaries to enable proper ASLR" is included, but the chart does show green against various things mentioning ASLR. It looks like specific packages are built with PIE, too.