Re: Don't kill hardened yet - Porting the patch forward is complete

--94eb2c0b92bad54ee305576ed40a
Content-Type: text/plain; charset="UTF-8"

Have we thought about paying spender to give us patches? We could agree to
a license that requires it to be on Gentoo....just a thought

On Aug 23, 2017 11:20 AM, <bob-Eg+PUiHjXiRWk0Htik3J/[email protected]> wrote:

> After re-reading the official announcement, rather than the one I saw on a
> tech news website, it appears only hardened-sources are being pulled rather
> than the whole project. That is good news. For a moment I thought all the
> PaX files were being removed, which would be a major blow to security for
> those who need it.
>
> Per announcement:
>
>> Also, all PaX related packages, except
>>
> sys-kernel/hardened-sources, will remain available for the time being.
> https://www.gentoo.org/support/news-items/2017-08-19-hardene
> d-sources-removal.html
>
> I guess I can live with an overlay for now, although
> unofficial-hardened-sources would make a nice addition to the entire
> project, they are very stable for me. Thank you again and keep up the good
> work.
>
> On 2017-08-23 10:10, bob-Eg+PUiHjXiRWk0Htik3J/[email protected] wrote:
>
>> Hello Everyone,
>> I just heard that gentoo-hardened will be scrapped by end-of-month.
>> Well, I have some good news - it doesn't have to be. A project has
>> risen up to continue supporting the patch on future kernels and I have
>> been running it successfully for over a month with the stock hardened
>> profile.
>>
>> You can download the patches here, they are also GPG signed:
>> https://github.com/minipli/linux-unofficial_grsec/releases
>>
>> So-called "linux-hardened project (KSPP)" and "SELinux" do not even
>> slightly compare at their current stage of development in terms of
>> kernel hardening and PaX protection. In the mid-term, I would
>> recommend using these forward patches for hardened-LTS 4.9.x and hope
>> Gentoo-hardened will continue for awhile longer while we wait for
>> further improvements.
>>
>> Thank you for your time and concern.
>>
>
>

--94eb2c0b92bad54ee305576ed40a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Have we thought about paying spender to give us patches? =
We could agree to a license that requires it to be on Gentoo....just a thou=
ght</div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Aug 2=
3, 2017 11:20 AM,  &lt;<a href=3D"mailto:bob-Eg+PUiHjXiRWk0Htik3J/[email protected]">bob-Eg+PUiHjXiRWk0Htik3J/[email protected]=
</a>&gt; wrote:<br type=3D"attribution"><blockquote class=3D"gmail_quote" s=
tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Afte=
r re-reading the official announcement, rather than the one I saw on a tech=
 news website, it appears only hardened-sources are being pulled rather tha=
n the whole project. That is good news. For a moment I thought all the PaX =
files were being removed, which would be a major blow to security for those=
 who need it.<br>
<br>
Per announcement:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
Also, all PaX related packages, except<br>
</blockquote>
sys-kernel/hardened-sources, will remain available for the time being.<br>
<a href=3D"https://www.gentoo.org/support/news-items/2017-08-19-hardened-so=
urces-removal.html" rel=3D"noreferrer" target=3D"_blank">https://www.gentoo=
.org/support<wbr>/news-items/2017-08-19-hardene<wbr>d-sources-removal.html<=
/a><br>
<br>
I guess I can live with an overlay for now, although unofficial-hardened-so=
urces would make a nice addition to the entire project, they are very stabl=
e for me. Thank you again and keep up the good work.<br>
<br>
On 2017-08-23 10:10, <a href=3D"mailto:bob-Eg+PUiHjXiRWk0Htik3J/[email protected]" target=3D"_blank">=
bob-Eg+PUiHjXiRWk0Htik3J/[email protected]</a> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
Hello Everyone,<br>
I just heard that gentoo-hardened will be scrapped by end-of-month.<br>
Well, I have some good news - it doesn&#39;t have to be. A project has<br>
risen up to continue supporting the patch on future kernels and I have<br>
been running it successfully for over a month with the stock hardened<br>
profile.<br>
<br>
You can download the patches here, they are also GPG signed:<br>
<a href=3D"https://github.com/minipli/linux-unofficial_grsec/releases" rel=
=3D"noreferrer" target=3D"_blank">https://github.com/minipli/lin<wbr>ux-uno=
fficial_grsec/releases</a><br>
<br>
So-called &quot;linux-hardened project (KSPP)&quot; and &quot;SELinux&quot;=
 do not even<br>
slightly compare at their current stage of development in terms of<br>
kernel hardening and PaX protection. In the mid-term, I would<br>
recommend using these forward patches for hardened-LTS 4.9.x and hope<br>
Gentoo-hardened will continue for awhile longer while we wait for<br>
further improvements.<br>
<br>
Thank you for your time and concern.<br>
</blockquote>
<br>
</blockquote></div></div>

--94eb2c0b92bad54ee305576ed40a--