8 ms·

I love how grsecurity is always quick to point out how generous they have been by providing the patches for free. > We have been providing grsecurity freely fo

I love how grsecurity is always quick to point out how generous they have been by providing the patches for free. > We have been providing grsecurity freely for 16 years. Meanwhile the kernel upon which their work is built has been provided for free for much longer, and continues to be.

SEJeff 10y ago
I thought the same thing. The Linux kernel has been "freely available" for a measly 26 years, and will continue to be so.
- qznc 10y ago
  Why are the grsecurity patches not included in the Vanilla Kernel? https://unix.stackexchange.com/questions/59020/why-are-the-grsecurity-patches-not-included-in-the-vanilla-kernel https://unix.stackexchange.com/questions/59020/why-are-the-g...
  - pinpeliponni 10y ago
    Original discussion from over a decade ago was more about clashing opinions, strong personalities, and anti-NSA sentiment (how SELinux ws handled). Grsecurity has always been very opinionated, and technically well implemented. That has never been the issue. In theory they also could have chosen to maintain only one version - in the official kernel. To clarify some technical aspects, SELinux and grsecurity are not answers to the same problems, and they never meant to be. SELinux was always meant to implement things like multi-level security, bell-lapadula model, and extending 3rd party application with SeLinux roles, and the security daemon. Grsecurity has file oriented rbac system that was more approachable, and a variety of other patches (which are what grsecurity has been more known for - they have been always very excellent). Knowing Spender, he was probably actually paid to stop. That's my guess. Not going to iterate on that.
  - peterwwillis 10y ago
    In other words: nobody ever tried to get it into mainline. Anyone reading this right now could go and get it submitted into mainline in the chunks that Linus would accept. It would take about 6 months, though, assuming you knew what you were doing.
    - SEJeff 10y ago
      Incorrect, Kees Cook, who more or less founded the KSP project (kernel self protection) has been working on this for several years to enhance the security of ChromeOS while working for google. He started some of it when he was working for Canonical and has been doing this non-stop. The problem is that getting things into small individually testable components is literally anathema to the Pax/grsecurity model. They have very specific "chunks" of functionality which are quite invasive, by design. This goes against the model the Linux kernel is developed, so the two development communities are simply mutually exclusive. https://www.linux.com/news/google-developer-kees-cook-details-linux-kernel-self-protection-project https://www.linux.com/news/google-developer-kees-cook-detail... He's been working on this for a very long time.
      - PaXTeam 10y ago
        > The problem is that getting things into small individually testable components > is literally anathema to the Pax/grsecurity model. no, you're wrong. how do you think we developed our code? did all the 8+ MB worth of it pop out of our head all at once? or more realistically, did we develop the features piece by piece, not unlike how upstream linux is developed? > They have very specific "chunks" of functionality which are quite invasive, by design. define invasive. linux itself has 'quite invasive' features too yet that didn't prevent them from being developed and upstreamed, so not sure what you were trying to imply here. > This goes against the model the Linux kernel is developed, so the two development > communities are simply mutually exclusive. this narrative only exists in your head, not in reality. our work is as much upstreamable as any other kernel code that went in over the years (how else do you think some of it could get in already?), it's just that it can't be done in one's free time.
        10y ago
tptacek 10y ago
They have, in fact, been generous in providing patches for free. Other people have been generous too. Generosity doesn't cancel itself out. It must be particularly irritating in Spengler's case, because he works in a field where most of the best people make millions turning poorer versions of the same ideas into commercial products that only huge companies ever get to play with, while he spends his career arguing with upstream and taking shit from people on message boards.
- qznc 10y ago
  Torvalds claims [0] that he did not do enough arguing with upstream: > The apparent inability (and perhaps more importantly - total unwilling[n]ess) from the PaX team to be able to see what makes sense in a long-term general kernel and what does not, and split things up and try to push the sensible things up (and know which things are too ugly or too specialized to make sense), caused many PaX features to never be merged. In a comment [0] the PAX team says > we never ever considered submitting grsecurity or PaX for mainline inclusion [...] anything similar in the past was user action, not on our behalf I don't know how Spengler and PAX relate. [0] https://lwn.net/Articles/313621/ https://lwn.net/Articles/313621/
  - lvh 10y ago
    PaX is developed independently from and usually shipped with grsec patches. AFAICT Spengler's not directly involved, and Torvald's comments don't reflect on them.
    - hackermailman 10y ago
      Every post on lwn or mailing lists by "PaXTeam" is quite obviously spender with another handle.
      - PaXTeam 10y ago
        i think you're 'quite obviously' wrong ;).
      - 10y ago
twiss 10y ago
I think they're just tired of doing work and the kernel community going shrug (or worse, dismissing it). Of course, the kernel developers are also doing work for free, but at least their work is actually being accepted into the kernel. Maybe they're just thinking "our customers value our work, so let's focus on providing value to them instead of to people who don't value our work". Whether or not that's true, I don't blame them.
- monocasa 10y ago
  > The important context here is that neither grsecurity nor PaX developers were involved in that mailing list discussion. The PaX Team's comment to the LWN article clears this up. We've never submitted the patches for mainline inclusion. https://unix.stackexchange.com/questions/59020/why-are-the-grsecurity-patches-not-included-in-the-vanilla-kernel https://unix.stackexchange.com/questions/59020/why-are-the-g...
- tptacek 10y ago
  That is pretty much what Spengler says in the Stack Overflow question where this was asked directly.
  - cryptarch 10y ago
    Link for the lazy: https://unix.stackexchange.com/questions/59020/why-are-the-grsecurity-patches-not-included-in-the-vanilla-kernel https://unix.stackexchange.com/questions/59020/why-are-the-g...
eugeneionesco 10y ago
It's not just the patches they provided for, it's also innovation. The technologies these dudes developed are used in the vast majority of OSs outthere. Instead of posting a cynical comment here you should thank them.
- monocasa 10y ago
  I mean, the grsecurity guys aren't the PAX guys.
  - eugeneionesco 10y ago
    They work together.
    - monocasa 10y ago
      We have no real evidence of that other than it's what Brad Spengler says.
      - eugeneionesco 10y ago
        Are you serious? If yes, ask PAX Team, irc email, whatever.
        monocasa 10y ago
        You mean the freemail.hu email on a page that only appeared about a year after their last release?
        eugeneionesco 10y ago
        Please don't do that, this is not Reddit, I'm sure you'll figure a way out to contact PAX Team.
        monocasa 10y ago
PaXTeam 10y ago
you conveniently forgot to mention the fundamental difference: the upstream kernel isn't developed for free whereas our code has always been. changes the equation quite a bit, doesn't it?
- cryptarch 10y ago
  What do you mean, the Linux kernel isn't developed for free? Many contributors aren't paid. And do you have proof that PaXTeam is not paid, if you are indeed PaXTeam?
  - PaXTeam 10y ago
    > What do you mean, the Linux kernel isn't developed for free? Many contributors aren't paid. you're wrong, see item 6 in https://opensource.com/article/16/12/yearbook-9-lessons-25-years-linux-kernel-development https://opensource.com/article/16/12/yearbook-9-lessons-25-y... though you might want to demand that Greg prove his identity first ;). > And do you have proof that PaXTeam is not paid, if you are indeed PaXTeam? sure, come visit me in hungary and i'll take you to the local tax authorities and grant you access to my files. of course you'll have to prove your own identity first ;).
    - cryptarch 10y ago
      You mean that some developers are paid to implement things by companies? Fair enough, though I'd still argue it's not developed commercially because no one pays to get access to the result (they only pay to influence the result). >> sure, come visit me in hungary That'd be amusing, maybe sometime this summer? I'm kinda busy right now setting up my business :') Let me know when you're around the Benelux, we could do the key-siging song-and-dance over a coffee or beer.
- cyphar 10y ago
  At most 80% of Linux contributors have jobs at software companies. That doesn't mean that all of them are paid for their kernel development, but at least 20% of contributors are definitely not paid for it. As for grsecurity, 100% of the core grsecurity team (that work at "Open Source Security") are paid for their work. I will admit that I'm not fully aware of the interactions between PaXTeam and grsecurity, but I'd be shocked to hear that nobody at PaXTeam works at a software company related to security or kernel hardening.

SEJeff 10y ago

I thought the same thing. The Linux kernel has been "freely available" for a measly 26 years, and will continue to be so.

qznc 10y ago
Why are the grsecurity patches not included in the Vanilla Kernel? https://unix.stackexchange.com/questions/59020/why-are-the-grsecurity-patches-not-included-in-the-vanilla-kernel https://unix.stackexchange.com/questions/59020/why-are-the-g...
- pinpeliponni 10y ago
  Original discussion from over a decade ago was more about clashing opinions, strong personalities, and anti-NSA sentiment (how SELinux ws handled). Grsecurity has always been very opinionated, and technically well implemented. That has never been the issue. In theory they also could have chosen to maintain only one version - in the official kernel. To clarify some technical aspects, SELinux and grsecurity are not answers to the same problems, and they never meant to be. SELinux was always meant to implement things like multi-level security, bell-lapadula model, and extending 3rd party application with SeLinux roles, and the security daemon. Grsecurity has file oriented rbac system that was more approachable, and a variety of other patches (which are what grsecurity has been more known for - they have been always very excellent). Knowing Spender, he was probably actually paid to stop. That's my guess. Not going to iterate on that.
- peterwwillis 10y ago
  In other words: nobody ever tried to get it into mainline. Anyone reading this right now could go and get it submitted into mainline in the chunks that Linus would accept. It would take about 6 months, though, assuming you knew what you were doing.
  - SEJeff 10y ago
    Incorrect, Kees Cook, who more or less founded the KSP project (kernel self protection) has been working on this for several years to enhance the security of ChromeOS while working for google. He started some of it when he was working for Canonical and has been doing this non-stop. The problem is that getting things into small individually testable components is literally anathema to the Pax/grsecurity model. They have very specific "chunks" of functionality which are quite invasive, by design. This goes against the model the Linux kernel is developed, so the two development communities are simply mutually exclusive. https://www.linux.com/news/google-developer-kees-cook-details-linux-kernel-self-protection-project https://www.linux.com/news/google-developer-kees-cook-detail... He's been working on this for a very long time.
    - PaXTeam 10y ago
      > The problem is that getting things into small individually testable components > is literally anathema to the Pax/grsecurity model. no, you're wrong. how do you think we developed our code? did all the 8+ MB worth of it pop out of our head all at once? or more realistically, did we develop the features piece by piece, not unlike how upstream linux is developed? > They have very specific "chunks" of functionality which are quite invasive, by design. define invasive. linux itself has 'quite invasive' features too yet that didn't prevent them from being developed and upstreamed, so not sure what you were trying to imply here. > This goes against the model the Linux kernel is developed, so the two development > communities are simply mutually exclusive. this narrative only exists in your head, not in reality. our work is as much upstreamable as any other kernel code that went in over the years (how else do you think some of it could get in already?), it's just that it can't be done in one's free time.
      - 10y ago

tptacek 10y ago

They have, in fact, been generous in providing patches for free. Other people have been generous too. Generosity doesn't cancel itself out. It must be particularly irritating in Spengler's case, because he works in a field where most of the best people make millions turning poorer versions of the same ideas into commercial products that only huge companies ever get to play with, while he spends his career arguing with upstream and taking shit from people on message boards.

qznc 10y ago
Torvalds claims [0] that he did not do enough arguing with upstream: > The apparent inability (and perhaps more importantly - total unwilling[n]ess) from the PaX team to be able to see what makes sense in a long-term general kernel and what does not, and split things up and try to push the sensible things up (and know which things are too ugly or too specialized to make sense), caused many PaX features to never be merged. In a comment [0] the PAX team says > we never ever considered submitting grsecurity or PaX for mainline inclusion [...] anything similar in the past was user action, not on our behalf I don't know how Spengler and PAX relate. [0] https://lwn.net/Articles/313621/ https://lwn.net/Articles/313621/
- lvh 10y ago
  PaX is developed independently from and usually shipped with grsec patches. AFAICT Spengler's not directly involved, and Torvald's comments don't reflect on them.
  - hackermailman 10y ago
    Every post on lwn or mailing lists by "PaXTeam" is quite obviously spender with another handle.
    - PaXTeam 10y ago
      i think you're 'quite obviously' wrong ;).
    - 10y ago

twiss 10y ago

I think they're just tired of doing work and the kernel community going shrug (or worse, dismissing it). Of course, the kernel developers are also doing work for free, but at least their work is actually being accepted into the kernel. Maybe they're just thinking "our customers value our work, so let's focus on providing value to them instead of to people who don't value our work". Whether or not that's true, I don't blame them.

monocasa 10y ago
> The important context here is that neither grsecurity nor PaX developers were involved in that mailing list discussion. The PaX Team's comment to the LWN article clears this up. We've never submitted the patches for mainline inclusion. https://unix.stackexchange.com/questions/59020/why-are-the-grsecurity-patches-not-included-in-the-vanilla-kernel https://unix.stackexchange.com/questions/59020/why-are-the-g...
tptacek 10y ago
That is pretty much what Spengler says in the Stack Overflow question where this was asked directly.
- cryptarch 10y ago
  Link for the lazy: https://unix.stackexchange.com/questions/59020/why-are-the-grsecurity-patches-not-included-in-the-vanilla-kernel https://unix.stackexchange.com/questions/59020/why-are-the-g...

eugeneionesco 10y ago

It's not just the patches they provided for, it's also innovation. The technologies these dudes developed are used in the vast majority of OSs outthere. Instead of posting a cynical comment here you should thank them.

monocasa 10y ago
I mean, the grsecurity guys aren't the PAX guys.
- eugeneionesco 10y ago
  They work together.
  - monocasa 10y ago
    We have no real evidence of that other than it's what Brad Spengler says.
    - eugeneionesco 10y ago
      Are you serious? If yes, ask PAX Team, irc email, whatever.
      - monocasa 10y ago
        You mean the freemail.hu email on a page that only appeared about a year after their last release?
        eugeneionesco 10y ago
        Please don't do that, this is not Reddit, I'm sure you'll figure a way out to contact PAX Team.
        monocasa 10y ago

PaXTeam 10y ago

you conveniently forgot to mention the fundamental difference: the upstream kernel isn't developed for free whereas our code has always been. changes the equation quite a bit, doesn't it?

cryptarch 10y ago
What do you mean, the Linux kernel isn't developed for free? Many contributors aren't paid. And do you have proof that PaXTeam is not paid, if you are indeed PaXTeam?
- PaXTeam 10y ago
  > What do you mean, the Linux kernel isn't developed for free? Many contributors aren't paid. you're wrong, see item 6 in https://opensource.com/article/16/12/yearbook-9-lessons-25-years-linux-kernel-development https://opensource.com/article/16/12/yearbook-9-lessons-25-y... though you might want to demand that Greg prove his identity first ;). > And do you have proof that PaXTeam is not paid, if you are indeed PaXTeam? sure, come visit me in hungary and i'll take you to the local tax authorities and grant you access to my files. of course you'll have to prove your own identity first ;).
  - cryptarch 10y ago
    You mean that some developers are paid to implement things by companies? Fair enough, though I'd still argue it's not developed commercially because no one pays to get access to the result (they only pay to influence the result). >> sure, come visit me in hungary That'd be amusing, maybe sometime this summer? I'm kinda busy right now setting up my business :') Let me know when you're around the Benelux, we could do the key-siging song-and-dance over a coffee or beer.
cyphar 10y ago
At most 80% of Linux contributors have jobs at software companies. That doesn't mean that all of them are paid for their kernel development, but at least 20% of contributors are definitely not paid for it. As for grsecurity, 100% of the core grsecurity team (that work at "Open Source Security") are paid for their work. I will admit that I'm not fully aware of the interactions between PaXTeam and grsecurity, but I'd be shocked to hear that nobody at PaXTeam works at a software company related to security or kernel hardening.