4 ms·

I'm an Arch user and I have no idea what's going on with security-focused kernels these days. I was running the grsecurity kernel package but that was recently

I'm an Arch user and I have no idea what's going on with security-focused kernels these days. I was running the grsecurity kernel package but that was recently replaced by a "linux-hardened" package that I had never heard of. Then, a pacman update tonight installed a plain Linux kernel. It's very confusing. Not unexpected for Arch but there is so little on the wiki about this.

cyphar 9y ago
The grsecurity patches have been made private. Although they are under the GPL (because they are a derivative work of the Linux kernel), the company that produces grsecurity engages in the unethical (and potentially illegal) business practice of threatening to terminate customer subscriptions if they exercise their right to distribute the patches. In other words, no customer is going to distribute the patches because they will have wasted money and lost access to updates. This is very reminiscent of free speech chilling effects, and I'm surprised none of the copyright holders in Linux (myself included) have teamed up to sue them. Long story short, the general community (including distributions) no longer has access to new patches making grsecurity useless for the community.
- snuxoll 9y ago
  > the company that produces grsecurity engages in the unethical (and potentially illegal) Unethical, probably - illegal, probably not. The GPL dictates what you can do once code hits your hands (or binaries compiled with), it doesn't prevent companies from selling it to you or what contract they do it under.
  - skymt 9y ago
    That depends on how you read section 6 of the GPL2. It states in part: > You may not impose any further restrictions on the recipients' exercise of the rights granted herein. The central right granted under the GPL is, of course, the right to modify and redistribute the source. I'm not a lawyer, and I'm certain that Grsecurity could find a number of legal arguments that what they're doing is allowed (likely starting with the claim that terminating a relationship with a customer isn't legally imposing a restriction on that customer's actions), but the idea that they're in violation of the GPL isn't pulled from thin air.
    - AstralStorm 9y ago
      It is enough for them to send the source on a written request. May be a link (working!), may be source code on a disk. Someone will have to set up an automatic snail mailer. If they do not respect that, they are explicitly violating GPL.
      - jopsen 9y ago
        The point is if they punish you (such as discontinue business relationship) because you send a request to obtain the source, and exercise the rights you've been granted in the GPL, well, that's an additional restriction. I'm no lawyer, but the spirit of the law or a contract matters. You can't avoid a speeding ticket because the wheels of your car wasn't touching the road in the photo :)
  - jopsen 9y ago
    Sure you can sell it, and under whatever terms you like. But you have to _also_ provide the full source under the GPL, not under "the GPL with additional constraints". I'm no lawyer, but I highly doubt it'll hold. And buying Linux from them could be very toxic as "GPL violation" => "termination of license" -- and I'm not sure how you go about getting a new license :)
    - infogulch 9y ago
      No, under the GPL you have the right to redistribute the source. You don't have a right to receive new patches or maintain any particular subscription, that is a different consideration that you can maintain in a separate contract.
      - jopsen 9y ago
        True, But punishing people for exercising their rights, is quite similar to placing restrictions on said rights. I'm no lawyer, but you generally can't out-smart the law :)
        infogulch 9y ago
        Of course you can be punished for exercising your rights. There is no better example than free speech: you're free to say whatever you want, and your customers are free to leave in response. The considerations of many contracts include some form of restricting your rights in return for something. IANAL either, in case that wasn't obvious.
  - deleted 9y ago
    [deleted]
shakna 9y ago
Because grsecurity make no effort to separate out their patches, it's really hard to upstream them. Sometimes the Arch team get the effort in time, sometimes its overly difficult so you don't get the kernel rolled out by the time an update is available for plain.

cyphar 9y ago

The grsecurity patches have been made private. Although they are under the GPL (because they are a derivative work of the Linux kernel), the company that produces grsecurity engages in the unethical (and potentially illegal) business practice of threatening to terminate customer subscriptions if they exercise their right to distribute the patches. In other words, no customer is going to distribute the patches because they will have wasted money and lost access to updates. This is very reminiscent of free speech chilling effects, and I'm surprised none of the copyright holders in Linux (myself included) have teamed up to sue them. Long story short, the general community (including distributions) no longer has access to new patches making grsecurity useless for the community.

snuxoll 9y ago
> the company that produces grsecurity engages in the unethical (and potentially illegal) Unethical, probably - illegal, probably not. The GPL dictates what you can do once code hits your hands (or binaries compiled with), it doesn't prevent companies from selling it to you or what contract they do it under.
- skymt 9y ago
  That depends on how you read section 6 of the GPL2. It states in part: > You may not impose any further restrictions on the recipients' exercise of the rights granted herein. The central right granted under the GPL is, of course, the right to modify and redistribute the source. I'm not a lawyer, and I'm certain that Grsecurity could find a number of legal arguments that what they're doing is allowed (likely starting with the claim that terminating a relationship with a customer isn't legally imposing a restriction on that customer's actions), but the idea that they're in violation of the GPL isn't pulled from thin air.
  - AstralStorm 9y ago
    It is enough for them to send the source on a written request. May be a link (working!), may be source code on a disk. Someone will have to set up an automatic snail mailer. If they do not respect that, they are explicitly violating GPL.
    - jopsen 9y ago
      The point is if they punish you (such as discontinue business relationship) because you send a request to obtain the source, and exercise the rights you've been granted in the GPL, well, that's an additional restriction. I'm no lawyer, but the spirit of the law or a contract matters. You can't avoid a speeding ticket because the wheels of your car wasn't touching the road in the photo :)
- jopsen 9y ago
  Sure you can sell it, and under whatever terms you like. But you have to _also_ provide the full source under the GPL, not under "the GPL with additional constraints". I'm no lawyer, but I highly doubt it'll hold. And buying Linux from them could be very toxic as "GPL violation" => "termination of license" -- and I'm not sure how you go about getting a new license :)
  - infogulch 9y ago
    No, under the GPL you have the right to redistribute the source. You don't have a right to receive new patches or maintain any particular subscription, that is a different consideration that you can maintain in a separate contract.
    - jopsen 9y ago
      True, But punishing people for exercising their rights, is quite similar to placing restrictions on said rights. I'm no lawyer, but you generally can't out-smart the law :)
      - infogulch 9y ago
        Of course you can be punished for exercising your rights. There is no better example than free speech: you're free to say whatever you want, and your customers are free to leave in response. The considerations of many contracts include some form of restricting your rights in return for something. IANAL either, in case that wasn't obvious.
- deleted 9y ago
  [deleted]

shakna 9y ago

Because grsecurity make no effort to separate out their patches, it's really hard to upstream them. Sometimes the Arch team get the effort in time, sometimes its overly difficult so you don't get the kernel rolled out by the time an update is available for plain.