Re: [gentoo-dev] New item for sys-kernel/hardened-sources removal

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--x0wE67beKT2BRee0OwC82DfrM86nFwaHl
Content-Type: multipart/mixed; boundary="7cOEMPXTjtxuXFpcP0Exn2G9rRwXDaj7Q"
From: "Francisco Blas Izquierdo Riera (klondike)" <[email protected]>
To: [email protected]
Cc: [email protected], [email protected]
Message-ID: <89529177-d896-42a0-e57c-2d4bb07edbf1-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>
Subject: Re: [gentoo-dev] New item for sys-kernel/hardened-sources removal
References: <c5b21580-d44b-c683-8e33-fa83f8552a1f-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>
 <9e03d55e-7212-1bd9-370a-0a570bf18aa3-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>
 <22931.7313.608217.152058-Uh4h6YzJNddeZPGdu31ggMZhgZJuwmKT@public.gmane.org>
In-Reply-To: <22931.7313.608217.152058-Uh4h6YzJNddeZPGdu31ggMZhgZJuwmKT@public.gmane.org>

--7cOEMPXTjtxuXFpcP0Exn2G9rRwXDaj7Q
Content-Type: multipart/mixed;
 boundary="------------2FD2508DCA0D81AA5F106E6F"

This is a multi-part message in MIME format.
--------------2FD2508DCA0D81AA5F106E6F
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

El 15/08/17 a las 18:08, Ulrich Mueller escribi=F3:
>>>>>> On Tue, 15 Aug 2017, Francisco Blas Izquierdo Riera (klondike) wro=
te:
>> Updated the news item following comments from dilfridge, mrueg and
>> floppym. Also made it display to users of hardened profiles.
> Some very minor comments:
>
>> Author: Francisco Blas Izquierdo Riera (klondike) <[email protected]=
>
> Format of the line is "Real Name <email@address>", so I'd suggest to
> drop the nick in parentheses, especially since it is there in the
> e-mail address anyway.
>
>> Because of that we will be masking the hardened-sources on the 27th of=

>> August and will proceed to remove then from the tree by the end of
>> September. [...]
> s/then/them/
>
>> As an alternative, for users happy keeping themselves on the  stable
>> 4.9 branch of the kernel minipli, another Grsec user, is forward
>> porting the patches on [3].
> I had difficulties parsing this sentence. Insert a comma after
> "kernel"? Also there is spurious whitespace before "stable".
>
> Ulrich

Thanks for your input, I have addressed your comments on the attached
news item.

I have also added a note regarding the other PaX related packages as
these won't stil be removed.


Klondike


--------------2FD2508DCA0D81AA5F106E6F
Content-Type: text/plain; charset=UTF-8;
 name="2017-08-19-hardened-sources-removal.en.txt"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="2017-08-19-hardened-sources-removal.en.txt"

Title: sys-kernel/hardened-sources removal
Author: Francisco Blas Izquierdo Riera <[email protected]>
Posted: 2017-08-19
Revision: 3
News-Item-Format: 2.0
Display-If-Installed: sys-kernel/hardened-sources
Display-If-Profile: hardened/linux/*

As you may know the core of sys-kernel/hardened-sources have been the
patches published by Grsec.

Sadly, their developers have stopped making these patches freely
available [1]. This is a full stop of any public updates and not only
stable ones as was announced two years ago[2].

As a result, the Gentoo Hardened team is unable to keep providing
further updates of the patches, and although the hardened-sources have
proved (when using a hardened toolchain) being resistant against
certain attacks like the stack guard page jump techniques proposed by
Stack Clash, we can't ensure a regular patching schedule and therefore,
the security of the users of these kernel sources.

Because of that we will be masking the hardened-sources on the 27th of
August and will proceed to remove them from the tree by the end of
September. Obviously, we will reinstate the package again if the
developers decide to make their patches publicly available again.

Our recommendation is that users should consider using instead
sys-kernel/gentoo-sources.

As an alternative, for users happy keeping themselves on the stable
4.9 branch of the kernel; minipli, another Grsec user, is forward
porting the patches on [3].

Strcat from Copperhead OS is making his own version of the patches
forward ported to the latest version of the Linux tree at [4].

The Gentoo Hardened team can't make any statement regarding the
security, reliability or update availability of either those patches
as we aren't providing them and can't therefore make any
recommendation regarding their use.

We'd like to note that all the userspace hardening and MAC support
for SELinux provided by Gentoo Hardened will still remain there and
is unaffected by this removal. Also, all PaX related packages other
than the hardened-sources will remain for the time being.

[1] https://grsecurity.net/passing_the_baton.php
[2] https://www.gentoo.org/support/news-items/2015-10-21-future-support-o=
f-
hardened-sources-kernel.html
[3] https://github.com/minipli/linux-unofficial_grsec
[4] https://github.com/copperhead/linux-hardened
--------------2FD2508DCA0D81AA5F106E6F--

--7cOEMPXTjtxuXFpcP0Exn2G9rRwXDaj7Q--

--x0wE67beKT2BRee0OwC82DfrM86nFwaHl
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIxBAEBCgAbBQJZk1RqFBxrbG9uZGlrZUBnZW50b28ub3JnAAoJEPS90u/o/3j5
z6AP/RfmJVwpRGJ/T7XswPZLQsbbkpiwMrLJtlUciMH9Mr+bh2lEuKqg8cgvO5G1
l2XKecUznL42hsKUnFzJwGrBs0izfmK6andY4qwbkw1QMN9nfmXHg9r3wau3OdKq
uMtwqxxlTZywto6xsSW17F3BjVOZnwS+P42k7vcc945GLhDLmk4eit7L695HvqEH
E8hhjemuyAYBu+tT5gd5Quv+SWGASaa9ONQAxL8w1zNJAOvRXixyye/RY4bWwCIu
kCggSyV4T42A8AdkWIs9yae1JquzFSVGM4pF+UnfbmfP4eXsP3e4+1mMpe5mZIMk
nQfXJOJQonWN3r4Dq6pPAdah+uriQv61vnxSFOoQfI7mSZZNcbAz71znL8YO0ENK
oqWTWm3ZcEOlHEkUhjKPr8EPI39ydZ6+vSFLQgJLDOjsM0b6YaG00VUphbkYoNVB
cL/uOADNm2Hw1Qnus4c+x6zVjy4N8Z+eT9XIKeaENfh78iODptFv7wi7/jeA+Icw
0o8SthzrXLTOxmkaw5P2Nf8GmpW7YvwuAIKwRXVKjqNx9c/1UwnQHkT12753rRwt
Wwblpxti90+B+soRkwpX4EfXlDHYUxtde7EaGAZIZLmJ03XXDxtZmkU2chlReZ0i
5W69sUap6pGpT7eeKx1blQjogPyzlGN6mIk3tCn6Fbrzeel3
=nNyZ
-----END PGP SIGNATURE-----

--x0wE67beKT2BRee0OwC82DfrM86nFwaHl--