4 ms·

This is terribly unfortunate. By the way, could someone comment on why major distributions didn't use grsecurity code in their main kernel packages (or at least

by d33 9y ago

This is terribly unfortunate. By the way, could someone comment on why major distributions didn't use grsecurity code in their main kernel packages (or at least provide hardened-) ones? Maintenance cost or something else?

Foxboron 9y ago
Arch Linux has provided the kernel with grsecurity patches inn the main repos for a long time.
- dfc 9y ago
  The question was about the main kernel package in a distribution. Lots of distributions had optional packages with grsec support.
- qznc 9y ago
  "The PaX and grsecurity patches are no longer going to be public, so official support in Arch Linux has ended" https://lists.archlinux.org/pipermail/arch-general/2017-April/043604.html https://lists.archlinux.org/pipermail/arch-general/2017-Apri...
  - Foxboron 9y ago
    Yes. I wrote "has".
    - joh6nn 9y ago
      "has" is present tense. I think you meant "had"?
  - gribbly 9y ago
    The 'hardened' kernel he mentioned has recently (~40 hours) appeared in the Arch repos: https://www.archlinux.org/packages/community/x86_64/linux-hardened/ https://www.archlinux.org/packages/community/x86_64/linux-ha... Not a replacement but at least an alternative.
justincormack 9y ago
The major distros gave up using significant amounts of non upstream code a decade or so ago, as it was extremely difficult to support. The only people who ship the grsec kernels ship them pretty much unmodified.
viraptor 9y ago
You can't really ship all of the grsec, because some compile time settings break userspace apps. Other options disable things you want on laptops, like power management registers. Basically your need to opt-in to grsec and you need to know what to configure afterwards. Or enable only selected few features and not get the whole protection. On top of that, you can't use the latest kernel version until grsec is ported to it. And probably more reasons I don't know about yet. Basically, it's not one-size-fits-all solution - Ubuntu would create more problems than solutions if they just dumped it on users by default (or at least without a proper migration path with lots of deprecation time).
- staticassertion 9y ago
  > You can't really ship all of the grsec, because some compile time settings break userspace apps. Other options disable things you want on laptops, like power management registers. Basically your need to opt-in to grsec and you need to know what to configure afterwards. Or enable only selected few features and not get the whole protection. The vast majority of features are 'set and forget'. Most will not break userland, or have extremely low FP rates. I can think of only one or two that have a high FP rate (integer overflow plugin) that would not be enabled by default. After all, these patches tend to make it into upstream under another name in ~10 years or so. > On top of that, you can't use the latest kernel version until grsec is ported to it. Not really a problem unless your distro updates to the latest version the night it's released, which most will not. Grsecurity's dev patch tends to be far, far ahead of whatever Ubuntu is using. I ran it on an Ubuntu system with virtually all features enabled with little problem.
  - viraptor 9y ago
    > Most will not break userland That's exactly what I meant. It usually works the same. Apart from when it doesn't. For example arch's linux-grsec kernel requires pax changes for common KDE apps, and every separate python virtualenv. Restricted runtime CPU registers stop powertop. Something (can't remember details now) affected sysdig. It's not critical. I used to run grsec kernel all the time on a laptop. But I can't imagine someone dropping, for example paxd support into a popular distro and expect people to deal with apps suddenly not starting.
snaky 9y ago
> The Gentoo Hardened project maintains security-enhancement features for Gentoo, including but not limited to grsecurity https://wiki.gentoo.org/wiki/Hardened/Grsecurity2_Quickstart#Gentoo_Hardened_integration https://wiki.gentoo.org/wiki/Hardened/Grsecurity2_Quickstart...

by d33 9y ago

Foxboron 9y ago

Arch Linux has provided the kernel with grsecurity patches inn the main repos for a long time.

dfc 9y ago
The question was about the main kernel package in a distribution. Lots of distributions had optional packages with grsec support.
qznc 9y ago
"The PaX and grsecurity patches are no longer going to be public, so official support in Arch Linux has ended" https://lists.archlinux.org/pipermail/arch-general/2017-April/043604.html https://lists.archlinux.org/pipermail/arch-general/2017-Apri...
- Foxboron 9y ago
  Yes. I wrote "has".
  - joh6nn 9y ago
    "has" is present tense. I think you meant "had"?
- gribbly 9y ago
  The 'hardened' kernel he mentioned has recently (~40 hours) appeared in the Arch repos: https://www.archlinux.org/packages/community/x86_64/linux-hardened/ https://www.archlinux.org/packages/community/x86_64/linux-ha... Not a replacement but at least an alternative.

justincormack 9y ago

The major distros gave up using significant amounts of non upstream code a decade or so ago, as it was extremely difficult to support. The only people who ship the grsec kernels ship them pretty much unmodified.

viraptor 9y ago

You can't really ship all of the grsec, because some compile time settings break userspace apps. Other options disable things you want on laptops, like power management registers. Basically your need to opt-in to grsec and you need to know what to configure afterwards. Or enable only selected few features and not get the whole protection. On top of that, you can't use the latest kernel version until grsec is ported to it. And probably more reasons I don't know about yet. Basically, it's not one-size-fits-all solution - Ubuntu would create more problems than solutions if they just dumped it on users by default (or at least without a proper migration path with lots of deprecation time).

staticassertion 9y ago
> You can't really ship all of the grsec, because some compile time settings break userspace apps. Other options disable things you want on laptops, like power management registers. Basically your need to opt-in to grsec and you need to know what to configure afterwards. Or enable only selected few features and not get the whole protection. The vast majority of features are 'set and forget'. Most will not break userland, or have extremely low FP rates. I can think of only one or two that have a high FP rate (integer overflow plugin) that would not be enabled by default. After all, these patches tend to make it into upstream under another name in ~10 years or so. > On top of that, you can't use the latest kernel version until grsec is ported to it. Not really a problem unless your distro updates to the latest version the night it's released, which most will not. Grsecurity's dev patch tends to be far, far ahead of whatever Ubuntu is using. I ran it on an Ubuntu system with virtually all features enabled with little problem.
- viraptor 9y ago
  > Most will not break userland That's exactly what I meant. It usually works the same. Apart from when it doesn't. For example arch's linux-grsec kernel requires pax changes for common KDE apps, and every separate python virtualenv. Restricted runtime CPU registers stop powertop. Something (can't remember details now) affected sysdig. It's not critical. I used to run grsec kernel all the time on a laptop. But I can't imagine someone dropping, for example paxd support into a popular distro and expect people to deal with apps suddenly not starting.

snaky 9y ago

> The Gentoo Hardened project maintains security-enhancement features for Gentoo, including but not limited to grsecurity https://wiki.gentoo.org/wiki/Hardened/Grsecurity2_Quickstart#Gentoo_Hardened_integration https://wiki.gentoo.org/wiki/Hardened/Grsecurity2_Quickstart...