Re: The status of grsecurity upstream and hardened-sources downstream

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--TwEPUR1XkvVIlAI4Bhf6SKj1IwPBUI9B7
Content-Type: multipart/mixed; boundary="oR3glkCS9ovNNHw3dU2cLmesJIAXVoqP5"
From: "Francisco Blas Izquierdo Riera (klondike)" <[email protected]>
To: [email protected]
Cc: Mathias Krause <minipli-gM/[email protected]>
Message-ID: <2324b4ef-5823-2a41-aec3-d721bd530b3a-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>
Subject: Re: [gentoo-hardened] The status of grsecurity upstream and
 hardened-sources downstream
References: <ea98b420-db01-4b70-68a3-f8f9a3f8b9cf-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>
In-Reply-To: <ea98b420-db01-4b70-68a3-f8f9a3f8b9cf-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>

--oR3glkCS9ovNNHw3dU2cLmesJIAXVoqP5
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

El 23/06/17 a las 18:28, Anthony G. Basile escribi=C3=B3:
> Hi everyone,
>
> Since late April, grsecurity upstream has stop making their patches
> available publicly.  Without going into details, the reason for their
> decision revolves around disputes about how their patches were being
> (ab)used.
>
> Since the grsecurity patch formed the main core of our hardened-sources=

> kernel, their decision has serious repercussions for the Hardened Gento=
o
> project.  I will no longer be able to support hardened-sources and will=

> have to eventually mask and remove it from the tree.
>
> Hardened Gentoo has two sides to it, kernel hardening (done via
> hardened-sources) and toolchain/executable hardening.  The two are
> interrelated but independent enough that toolchain hardening can
> continue on its own.  The hardened kernel, however, provided PaX
> protection for executables and this will be lost.  We did a lot of work=

> to properly maintain PaX markings in our package management system and
> there was no part of Gentoo that wasn't touched by issues stemming from=

> PaX support.
>
> I waited two months before saying anything because the reasons were mor=
e
> of a political nature than some technical issue.  At this point, I thin=
k
> its time to let the community know about the state of affairs with
> hardened-sources.
>
> I can no longer get into the #grsecurity/OFTC channel (nothing personal=
,
> they kicked everyone), and so I have not spoken to spengler or pipacs.
> I don't know if they will ever release grsecurity patches again.
>
> My plan then is as follows.  I'll wait one more month and then send out=

> a news item and later mask hardened-sources for removal.  I don't
> recommend we remove any of the machinery from Gentoo that deals with Pa=
X
> markings.
>
> I welcome feedback.
>
Hi!

I know that minipli has been working on keeping the last released grsec
patches up to date on the 4.9 LTS branch and was sharing his work on a
github repository.

I believe his work could be a good alternative for a few more years and
give us enough time to see how everything evolves.

Maybe the upstream people start taking things seriosuly and we can drop
the hardened-sources by then (not very optimistic about that though). Or
maybe spender and the PaX Team start releasing patches again (as the
situation looks now I also doubt it). Eitherway it will buy us time at
the expense of lack of new hardware compatibility.

Klondike



--oR3glkCS9ovNNHw3dU2cLmesJIAXVoqP5--

--TwEPUR1XkvVIlAI4Bhf6SKj1IwPBUI9B7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIxBAEBCgAbBQJZTkYhFBxrbG9uZGlrZUBnZW50b28ub3JnAAoJEPS90u/o/3j5
qQ8P/20O6cWUnk6ZyZe/+xPXjUo5qVFZYMj7jD0+Qm0GMjOmJui95SEdHSUPEOrQ
73Hql7YMo0N5dM5C2sDGHUVQmEaVBR57s86UoX1UHpcLmNjM2gdkv213rVqLxegx
cu9mjjhfMC9M3UZ5PrL6DBQU5jFE2BC3aVP9UHNdbnEzHfoQN0R+JFh5U2+eTIH2
BwrKCRmnEn1Q5lK+cMOSyXJ2OywwpcEvlDdvoattxI5yh8lc/zCYrNYPJ/KR/iHg
4Ik+TxuMomzYqFKk3OFYL97E45Q7Qc0zznzPpfchbKvgsL85zUQXQCpBaUA4Pghd
nIErqKM6LTFNhJZYkEtwLdPrPXaQe0WWYoSWCiZrsIuPjxESQbR5Hhp7BakL3yD4
IibYuPaJFI8HeEQDD3IWxETUkBhU/oqG/jcbJa6ULH3BFODKrIq/w6/MvVrqmDyQ
VPVDALRs7ebKycy49wHucvrBkFuVUHK5gxsWLMOsrBz4lcmJ276uOqIwWTKEiEIZ
0CuOqqcrMOymTnKzYwtjCIV4A+Qj3LF73DCz6ryJmo+x/g/1NXlxQxpCYrwtqyd5
U+pJWwVV/Vz9q4aEManR1tUbd0Y8T7BfVx8sQl7Xb0SZFUnjkKjUdBermgvM+/fx
EZ7d4IvOSQZz72AuK/CG2akONvuBHcrVfAr0kVgKC+r3n0Fe
=CCxE
-----END PGP SIGNATURE-----

--TwEPUR1XkvVIlAI4Bhf6SKj1IwPBUI9B7--