3 ms·

GRSecurity has some interesting ideas and if systemd is any indication some Linux vendors will happily work with iconoclasts. However it seems like much Theo D

GRSecurity has some interesting ideas and if systemd is any indication some Linux vendors will happily work with iconoclasts. However it seems like much Theo De Raadt can rub people the wrong way resulting in OpenBSD, GR Security's alleged refusal to submit patches in a manner Linus will accept has resulted in their rejection from the kernel mainline. Considering for some applications Linux needs all the hardening it can get, this is truly unfortunate.

geofft 10y ago
There's good news here: the Kernel Self Protection Project is a team of Linux devs who have been successfully upstreaming good, compatible ideas from grsecurity. https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr... https://lwn.net/Articles/698827/ https://lwn.net/Articles/698827/ (note the admission in the comments by all sides that KSPP is essentially about upstreaming all the upstreamable ideas in grsecurity, to bypass the sort of yelling that you see in those comments) The trouble is that the incompatible ideas run contrary to Linux's philosophy of compatibility / "don't break userspace" being the highest virtue, but that at least isn't about personalities, just differing design goals.
SEJeff 10y ago
You've got it a bit wrong. Brad Spengler (aka spender) and much of the grsecurity team's goal is making Linux more secure by working on grsecurity. They're not interested in totally rewriting large portions of Linux technical debt to make Linux more secure, but upstream demands they do it. Is spender often a bit of a prick, yes, but is he virtually 100% right on security things, also yes. It wasn't really a rejection from kernel mainline so much as they don't have any interest in submitting it. You can't have rejected what you never submitted in the first place. Fast forward to now and you have kernel heavyweights like Kees Cook (former Canonical kernel/security lead now chromeos security badass extraordinaire) working on bringing these features into mainline via the aforementioned KSP projects. In the end, Linux is getting more secure, and it is largely in part to the hard work of the entire GRSec team, even if they're a bit abrasive to work with.
- technofiend 10y ago
  I was specifically referring to this post by Linus himself http://article.gmane.org/gmane.linux.kernel/774824 http://article.gmane.org/gmane.linux.kernel/774824 in which he states >The apparent inability (and perhaps more importantly - total unwillingless) from the PaX team to be able to see what makes sense in a long-term general kernel and what does not, and split things up and try to push the sensible things up (and know which things are too ugly or too specialized to make sense), caused many PaX features to never be merged. Although there are other posts since debating the same point such as this one https://lkml.org/lkml/2005/1/25/141 https://lkml.org/lkml/2005/1/25/141

geofft 10y ago

There's good news here: the Kernel Self Protection Project is a team of Linux devs who have been successfully upstreaming good, compatible ideas from grsecurity. https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr... https://lwn.net/Articles/698827/ https://lwn.net/Articles/698827/ (note the admission in the comments by all sides that KSPP is essentially about upstreaming all the upstreamable ideas in grsecurity, to bypass the sort of yelling that you see in those comments) The trouble is that the incompatible ideas run contrary to Linux's philosophy of compatibility / "don't break userspace" being the highest virtue, but that at least isn't about personalities, just differing design goals.

SEJeff 10y ago

You've got it a bit wrong. Brad Spengler (aka spender) and much of the grsecurity team's goal is making Linux more secure by working on grsecurity. They're not interested in totally rewriting large portions of Linux technical debt to make Linux more secure, but upstream demands they do it. Is spender often a bit of a prick, yes, but is he virtually 100% right on security things, also yes. It wasn't really a rejection from kernel mainline so much as they don't have any interest in submitting it. You can't have rejected what you never submitted in the first place. Fast forward to now and you have kernel heavyweights like Kees Cook (former Canonical kernel/security lead now chromeos security badass extraordinaire) working on bringing these features into mainline via the aforementioned KSP projects. In the end, Linux is getting more secure, and it is largely in part to the hard work of the entire GRSec team, even if they're a bit abrasive to work with.

technofiend 10y ago
I was specifically referring to this post by Linus himself http://article.gmane.org/gmane.linux.kernel/774824 http://article.gmane.org/gmane.linux.kernel/774824 in which he states >The apparent inability (and perhaps more importantly - total unwillingless) from the PaX team to be able to see what makes sense in a long-term general kernel and what does not, and split things up and try to push the sensible things up (and know which things are too ugly or too specialized to make sense), caused many PaX features to never be merged. Although there are other posts since debating the same point such as this one https://lkml.org/lkml/2005/1/25/141 https://lkml.org/lkml/2005/1/25/141