Re: The status of grsecurity upstream and hardened-sources downstream

--=-bzvZ24EVyEsHo5rhRw5Y
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, 2017-06-23 at 19:09 +0200, Javier Juan Martinez Cabezon wrote:
> Have you thought in use other alternative apart grsec as kernel side
> solution?, PaX is PaX, its a great loss, but rsbac and selinux has
> their
> w or x, almost all cpu today has NX bit and reduce the needings of
> PageExec/SegmExec, and I think that exists some gcc plugins with PaX
> alike functions.
>=20
> rsbac has their git public and selinux is in vanilla. Maybe you could
> consider to use rsbac git kernel as hardened-sources new kerneland
> solution but I have not tested selinux under this kernel
>=20
> Under rsbac pax userland is not needed, MPROTECT controls it and can
> be
> switched individually in kernel land because it is something like a
> request under rsbac. Not all functions of PaX, but good enough in my
> opinion
>=20
> On 23/06/17 18:28, Anthony G. Basile wrote:
> >=20
> > Hi everyone,
> >=20
> > Since late April, grsecurity upstream has stop making their patches
> > available publicly.=C2=A0=C2=A0Without going into details, the reason f=
or
> > their
> > decision revolves around disputes about how their patches were
> > being
> > (ab)used.
> >=20
> > Since the grsecurity patch formed the main core of our hardened-
> > sources
> > kernel, their decision has serious repercussions for the Hardened
> > Gentoo
> > project.=C2=A0=C2=A0I will no longer be able to support hardened-source=
s and
> > will
> > have to eventually mask and remove it from the tree.
> >=20
> > Hardened Gentoo has two sides to it, kernel hardening (done via
> > hardened-sources) and toolchain/executable hardening.=C2=A0=C2=A0The tw=
o are
> > interrelated but independent enough that toolchain hardening can
> > continue on its own.=C2=A0=C2=A0The hardened kernel, however, provided =
PaX
> > protection for executables and this will be lost.=C2=A0=C2=A0We did a l=
ot of
> > work
> > to properly maintain PaX markings in our package management system
> > and
> > there was no part of Gentoo that wasn't touched by issues stemming
> > from
> > PaX support.
> >=20
> > I waited two months before saying anything because the reasons were
> > more
> > of a political nature than some technical issue.=C2=A0=C2=A0At this poi=
nt, I
> > think
> > its time to let the community know about the state of affairs with
> > hardened-sources.
> >=20
> > I can no longer get into the #grsecurity/OFTC channel (nothing
> > personal,
> > they kicked everyone), and so I have not spoken to spengler or
> > pipacs.
> > I don't know if they will ever release grsecurity patches again.
> >=20
> > My plan then is as follows.=C2=A0=C2=A0I'll wait one more month and the=
n send
> > out
> > a news item and later mask hardened-sources for removal.=C2=A0=C2=A0I d=
on't
> > recommend we remove any of the machinery from Gentoo that deals
> > with PaX
> > markings.
> >=20
> > I welcome feedback.
> >=20
>=20
>=20

How do I play with RSBAC, there is nice wiki pages etc but al the
ebuilds are removed from portage?

Regards:
Cor

--=-bzvZ24EVyEsHo5rhRw5Y
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE2RBO4OC4R8GCzwhDB+nmjKKe8yEFAll2JHIACgkQB+nmjKKe
8yHJZQ/+Oo4yvUPkwRI00w2Afmmb8zq7U1KSrUFhPVMIdqIetVEY/vOggaqLc68D
F92kLQZop1vFaRClqSKuaFCPOT38AAqyeiN6s6m6UTB4EldjETuX5mC/rRIGAWkf
XfMX8Kwpd9xXCYEa9E4BOg7SOZkL3lfepJKaIGUJ0mj2prwqnCQH8vlyVMIuNsww
0drAIxEEeTY0dYcReoLRak5M0jJANmShYSu4l+aN7W2dWY0LXyPtCCyvwmPHIp2H
0Ok8JR4OKB1pnhuMGo+jAdOfwKAU2UHvGkB8TbHR8IlJ/eVpQq23JvOJ6BnGwHIj
+KEjzv9HGfQPxNZLjYYqB33pLh39jZBttF5n/PQAB2WjiN9A69M/MpaWNB5fjR5a
u4Q2bR/bJWjphEVD7Tvr9oJnzqEdwhr2EVSsYTrgD/IdBnkThkmUF/SghuInnVcy
jXiUz2ghj1dzpUxY2Hj5BE6VZ/qJ0Cjs7ooxOLv3wGYju5aq91acf6HlW3N3YJjL
EM1Wz1fm2koxXUuPPspSLfBXuVVEbdmcKLyYbSqwILrotNwFGcZgeWiI8iNnJx5G
3B9z8CBSZIP2tuMjXzkYrqf3X5lvvafznu+F/ltrkOh+SGcQcTbi6NOPVKCvc94l
whq6DK6Ve3s9vxpJ6yBXNB58cE8bCUD1bCEBrPaBp3I1CoC2CNs=
=WnQf
-----END PGP SIGNATURE-----

--=-bzvZ24EVyEsHo5rhRw5Y--