4 ms·
Security things in Linux v4.8
- 0xmohit 10y agoNow there is no (expected) way to bypass seccomp filters, and containers with seccomp filters can allow ptrace again.
- AstralStorm 10y ago*until proven otherwise
- micaksica 10y agoI'm curious what "PaX Team" thinks of this.
- nullc 10y agoWith the accessibility of these patches in the few distros that support them falling further and further behind-- they're becoming increasingly theoretical, and less interesting to hear commentary from. E.g. https://packages.gentoo.org/packages/sys-kernel/hardened-sources https://packages.gentoo.org/packages/sys-kernel/hardened-sou...
- creshal 10y agoWhat does their inability to fund continued development have to do with their security competence?
- mynameislegion 10y agoThere is no relationship between the two.
- nullc 10y agoSadly, it isn't so-- the further from the vulgarities of production the patches are the less realistic the experience gained from working with them. I can tell you how to make a perfectly secure computer, grind it down and launch it into the sun. Part of the rest of the kernel communities complaints about many of these changes is that they aren't sufficiently pragmatic for widescale use or long term maintenance.
- contingencies 10y agoPaX is a patch-set, that's fine. People who care enough about low level security can apply it. The market for 'we care about security' is very large. Unfortunately, it still doesn't intersect with 'popular', and at that level one kernel team may be deploying to millions of machines. The mainline kernel (as well as other OS kernels) have drawn features explored through PaX and its predecessors slowly over time, and will likely continue to do so. Writing off PaX as increasingly irrelevant because you personally can't configure it with a button-click on your distro-of-choice simply reflects a profound ignorance of the longer term technical and social environment in which it is developed.
- grubles 10y agoIt's becoming irrelevant possibly because you have to pay for stable patches now: "Grsecurity stable patch downloads are available to customers only." edit: that's for grsec only, not PaX + grsec.
- Hello71 10y agowhat does that link show exactly
- contingencies 10y agoIt shows that Gentoo provides an easy-install method (emerge =sys-kernel/hardened-sources-VERSION) for pre-PaX-patched kernel sources up to version 4.7.6. This was done 4 days ago. That version of the kernel apparently only came out 5 days ago. That's a 24 hour latency on a release: pretty current in my view. It's not marked 'stable' on any platform (that's what the green squares mean), but that just means it has had limited testing and in Gentoo is not a weird thing at all.
- Hello71 10y agohow does that support the point made? (it doesn't help that I don't actually understand the point made)
- grubles 10y ago"Beware though; using the testing branch might incur stability issues, imperfect package handling (for instance wrong/missing dependencies), too frequent updates (resulting in lots of building) or broken packages. Users that do not know how Gentoo works and how to solve problems, we recommend to stick with the stable and tested branch." https://wiki.gentoo.org/wiki/Handbook:X86/Portage/Branches#Testing https://wiki.gentoo.org/wiki/Handbook:X86/Portage/Branches#T... The most recent stable hardened-sources is 4.4.8-r1 which is ~6 months old.
- Hello71 10y agovanilla-sources isn't stabled at all. what's your point?
- grubles 10y agovanilla-sources is not supported by the Gentoo kernel team, so I would expect it to not be. hardened-sources, however, is supported. https://wiki.gentoo.org/wiki/Kernel/Overview#vanilla-sources https://wiki.gentoo.org/wiki/Kernel/Overview#vanilla-sources
- AstralStorm 10y agoNow only if more of the RT patch landed in mainline I couldn't be happier.
- Aissen 10y agoI'm curious. What do you need/are you using in the RT patch that isn't mainline ?