Re: Hardening a Kernel post hardened-sources
Guillaume Ceccarelli <[email protected]> Fri, 30 Mar 2018 18:12:39 +0200
| Newsgroups | gmane.linux.gentoo.hardened |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_BF852EF7-862C-4D01-83EF-C2C499213B01 Content-Type: multipart/alternative; boundary="Apple-Mail=_99F4075B-173B-4A66-9B74-F556DA990DD3" --Apple-Mail=_99F4075B-173B-4A66-9B74-F556DA990DD3 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I see=E2=80=A6 I=E2=80=99m sorry to hear that. The grsecurity-sources overlay seems to be tracking minipli=E2=80=99s = unofficial port. So that=E2=80=99s what you already got as a = recommendation, with the convenience of ebuilds to match. It looks like the latest release from minipli=E2=80=99s is based off of = Linux 4.9.74 (early January ; the last one before Spectre / Meltdown = mitigations got merged into upstream kernels), with the latest upstream = version today being 4.9.91. So minipli=E2=80=99s kernel is starting to = be quite a bit behind upstream too. He did mention that it would take = him a significant amount of time to forward port with KAISER / KPTI. So = he might just be working on it, still. Minipli=E2=80=99s kernel might still be your best option after all, but = I haven=E2=80=99t reviewed the patches that made it to upstream between = 4.9.74 and 4.9.91 so I=E2=80=99m not sure what you=E2=80=99d be missing = out on at the moment by choosing to go with it. Best, =E2=80=93 Guillaume Ceccarelli > On Mar 30, 2018, at 17:37, Robert Sharp <selinux-/[email protected]> = wrote: >=20 > I requested a quote from GRsecurity and they told me that although = they are looking at providing a package for personal customers they = don't have one at the moment. They recommended minipli as the next best = thing... >=20 > What about the grsecurity-source overlay? >=20 > On 29/03/18 11:47, Guillaume Ceccarelli wrote: >> Hi all, >>=20 >> I=E2=80=99ve been a grsecurity customer for a little over two years = now, and my use of it is as a small business, on Gentoo server = installations. While I can=E2=80=99t disclose the amount of money I=E2=80=99= m paying publicly because every deal is customized, I would encourage = you to get in touch using the contact form on grsecurity.net = <http://grsecurity.net/> and ask for a quote if you haven=E2=80=99t = already. >>=20 >> You might just end up with an arrangement you can afford, and grsec = is still certainly worth having today. Not only for the feature set, but = also for the constant looking over the mainline Linux kernel code, = including fixing and backporting more fixes than the regular kernel = stable releases, and for knowledge / emails giving context to important = kernel vulnerabilities when they occur. >>=20 >>=20 >> Best, >>=20 >> =E2=80=93 Guillaume Ceccarelli=20 >>=20 >> On 28 Mar 2018, at 20:22, R0b0t1 <[email protected] = <mailto:[email protected]>> wrote: >>=20 >>> On Wed, Mar 28, 2018 at 12:40 PM, Alex Efros <[email protected] = <mailto:[email protected]>> wrote: >>>> Hi! >>>>=20 >>>> On Wed, Mar 28, 2018 at 06:06:00PM +0100, Robert Sharp wrote: >>>>> Does anyone know of a good, post GRSecurity guide to reasonable = security >>>>> for the kernel? In the absence of anything else I will have to go = back >>>>> to the KSPP list and start removing stuff until I can get a stable = kernel. >>>>=20 >>>> I'm using https://github.com/minipli/linux-unofficial_grsec = <https://github.com/minipli/linux-unofficial_grsec>, but it lacks >>>> Spectre and Meltdown mitigation at the moment (see issues). Still, = I >>>> believe it's the best we can have now (better is probably paid = GrSec, but >>>> AFAIK it's impossible or too costly to buy it for home or small = business). >>>>=20 >>>=20 >>> Previous contributors have access to the code, but it doesn't seem >>> like there is any way to go that route anymore. >>>=20 >=20 --Apple-Mail=_99F4075B-173B-4A66-9B74-F556DA990DD3 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">I = see=E2=80=A6 I=E2=80=99m sorry to hear that.<div class=3D""><br = class=3D""></div><div class=3D"">The grsecurity-sources overlay seems to = be tracking minipli=E2=80=99s unofficial port. So that=E2=80=99s what = you already got as a recommendation, with the convenience of ebuilds to = match.</div><div class=3D""><br class=3D""></div><div class=3D"">It = looks like the latest release from minipli=E2=80=99s is based off of = Linux 4.9.74 (early January ; the last one before Spectre / Meltdown = mitigations got merged into upstream kernels), with the latest upstream = version today being 4.9.91. So minipli=E2=80=99s kernel is starting to = be quite a bit behind upstream too. He did mention that it would take = him a significant amount of time to forward port with KAISER / KPTI. So = he might just be working on it, still.</div><div class=3D""><br = class=3D""></div><div class=3D"">Minipli=E2=80=99s kernel might still be = your best option after all, but I haven=E2=80=99t reviewed the patches = that made it to upstream between 4.9.74 and 4.9.91 so I=E2=80=99m not = sure what you=E2=80=99d be missing out on at the moment by choosing to = go with it.</div><div class=3D""><br class=3D""></div><div class=3D""><br = class=3D""></div><div class=3D"">Best,</div><div class=3D""><br = class=3D""></div><div class=3D"">=E2=80=93 Guillaume = Ceccarelli</div><div class=3D""><div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D"">On Mar 30, 2018, at 17:37, = Robert Sharp <<a href=3D"mailto:selinux-/[email protected]" = class=3D"">selinux-/[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""> =20 <meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8" class=3D""> =20 <div text=3D"#000000" bgcolor=3D"#FFFFFF" class=3D""> <div class=3D"moz-cite-prefix">I requested a quote from GRsecurity = and they told me that although they are looking at providing a package for personal customers they don't have one at the moment. They recommended minipli as the next best thing...<br class=3D""> <br class=3D""> What about the grsecurity-source overlay?<br class=3D""> <br class=3D""> On 29/03/18 11:47, Guillaume Ceccarelli wrote:<br class=3D""> </div> <blockquote type=3D"cite" = cite=3D"mid:467F3E15-D7B4-411F-994B-780871AA83A4-IyFa6exPGtwsy6BxJt0lzQ@public.gmane.org" = class=3D""> <meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dutf-8" class=3D""> <div class=3D""><span class=3D""></span></div> <div class=3D""> <div class=3D""><span style=3D"background-color: rgba(255, 255, = 255, 0);" class=3D"">Hi all,<br class=3D""> <br class=3D""> I=E2=80=99ve been a grsecurity customer for a little over = two years now, and my use of it is as a small business, on Gentoo server installations. While I can=E2=80=99t disclose the = amount of money I=E2=80=99m paying publicly because every deal is = customized, I would encourage you to get in touch using the contact form on <a href=3D"http://grsecurity.net/" dir=3D"ltr" = x-apple-data-detectors=3D"true" x-apple-data-detectors-type=3D"link" = x-apple-data-detectors-result=3D"0" moz-do-not-send=3D"true" = class=3D"">grsecurity.net</a> and ask for a quote if you haven=E2=80=99t already.<br class=3D"">= <br class=3D""> You might just end up with an arrangement you can afford, and grsec is still certainly worth having today. Not only for the feature set, but also for the constant looking over the mainline Linux kernel code, including fixing and backporting more fixes than the regular kernel stable releases, and for knowledge / emails giving context to important kernel vulnerabilities when they occur.<br = class=3D""> <br class=3D""> <br class=3D""> Best,<br class=3D""> <br class=3D""> =E2=80=93 Guillaume Ceccarelli </span></div> <div class=3D""><br class=3D""> On 28 Mar 2018, at 20:22, R0b0t1 <<a = href=3D"mailto:[email protected]" moz-do-not-send=3D"true" = class=3D"">[email protected]</a>> wrote:<br class=3D""> <br class=3D""> </div> <blockquote type=3D"cite" class=3D""> <div class=3D""><span class=3D"">On Wed, Mar 28, 2018 at 12:40 = PM, Alex Efros <<a href=3D"mailto:[email protected]" = moz-do-not-send=3D"true" class=3D"">[email protected]</a>> wrote:</span><br class=3D""> <blockquote type=3D"cite" class=3D""><span = class=3D"">Hi!</span><br class=3D""> </blockquote> <blockquote type=3D"cite" class=3D""><span = class=3D""></span><br class=3D""> </blockquote> <blockquote type=3D"cite" class=3D""><span class=3D"">On = Wed, Mar 28, 2018 at 06:06:00PM +0100, Robert Sharp wrote:</span><br = class=3D""> </blockquote> <blockquote type=3D"cite" class=3D""> <blockquote type=3D"cite" class=3D""><span class=3D"">Does = anyone know of a good, post GRSecurity guide to reasonable security</span><br = class=3D""> </blockquote> </blockquote> <blockquote type=3D"cite" class=3D""> <blockquote type=3D"cite" class=3D""><span class=3D"">for = the kernel? In the absence of anything else I will have to go = back</span><br class=3D""> </blockquote> </blockquote> <blockquote type=3D"cite" class=3D""> <blockquote type=3D"cite" class=3D""><span class=3D"">to = the KSPP list and start removing stuff until I can get a stable = kernel.</span><br class=3D""> </blockquote> </blockquote> <blockquote type=3D"cite" class=3D""><span = class=3D""></span><br class=3D""> </blockquote> <blockquote type=3D"cite" class=3D""><span class=3D"">I'm = using <a href=3D"https://github.com/minipli/linux-unofficial_grsec" = moz-do-not-send=3D"true" = class=3D"">https://github.com/minipli/linux-unofficial_grsec</a>, but it lacks</span><br class=3D""> </blockquote> <blockquote type=3D"cite" class=3D""><span class=3D"">Spectre = and Meltdown mitigation at the moment (see issues). Still, = I</span><br class=3D""> </blockquote> <blockquote type=3D"cite" class=3D""><span class=3D"">believe = it's the best we can have now (better is probably paid GrSec, but</span><br = class=3D""> </blockquote> <blockquote type=3D"cite" class=3D""><span class=3D"">AFAIK = it's impossible or too costly to buy it for home or small business).</span><br = class=3D""> </blockquote> <blockquote type=3D"cite" class=3D""><span = class=3D""></span><br class=3D""> </blockquote> <span class=3D""></span><br class=3D""> <span class=3D"">Previous contributors have access to the = code, but it doesn't seem</span><br class=3D""> <span class=3D"">like there is any way to go that route = anymore.</span><br class=3D""> <span class=3D""></span><br class=3D""> </div> </blockquote> </div> </blockquote><p class=3D""><br class=3D""> </p> </div> </div></blockquote></div><br class=3D""></div></body></html>= --Apple-Mail=_99F4075B-173B-4A66-9B74-F556DA990DD3-- --Apple-Mail=_BF852EF7-862C-4D01-83EF-C2C499213B01 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJ9zCCBBcw ggL/oAMCAQICCwQAAAAAATGJxjDEMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNp Z24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu MB4XDTExMDgwMjEwMDAwMFoXDTE5MDgwMjEwMDAwMFowXTELMAkGA1UEBhMCQkUxGTAXBgNVBAoT EEdsb2JhbFNpZ24gbnYtc2ExMzAxBgNVBAMTKkdsb2JhbFNpZ24gUGVyc29uYWxTaWduIDIgQ0Eg LSBTSEEyNTYgLSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKYBOgY+TD0lJ71l 7FcN0/Nzj61Z4eB/NxJMsSxhevgtUUcwxyWYkoHDl+FoQMXe8JSYraOIN7UpZvvDa9fVVpouxlnk 1upfRTHJRpU636SlHTEE5ZnXTYWQ3pTL51oEoPL4fL4OIHHO8Xe0H7X/9nw+N8tNxCCiGKRBMCcH HXuJLeW3pFUISGaVwfc2mye8mjIw+bjIJ6gtjK66WaUW6fWY323qkkS8W9uzdCXKVpGPkZUhsmqW fGlg2msfbx3O8to8LaCk0RqlVvV+g7ZrY7xBwdWGfZKCRd5R1kt2QBYOBtZfRBV7dfPMsjI4XcQU uKyTYpccj7VTvLdaf+B+TZkCAwEAAaOB6DCB5TAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgw BgEB/wIBADAdBgNVHQ4EFgQUP2xXRJ5Xn339aDnLufEa5Ll2UDgwRwYDVR0gBEAwPjA8BgRVHSAA MDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDYG A1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5uZXQvcm9vdC1yMy5jcmwwHwYD VR0jBBgwFoAUj/BLf6guRSSuTVD6Y5qL3uLdG7wwDQYJKoZIhvcNAQELBQADggEBAEWk43dt8+mP vv8ou8ZzoNxtjS0WuP0v/qiu9VX/JBjb+7X1tiWtGc2UqaUO+Y4irbiawHdgYnAXDNW1h8pCog+u z7kVIYegYhBWyQhlrn3c2sjXK+aRVFe44Ygfdmgcrj1Y7E6g9YvaGOhwZsr1IyQYkgejewpRDb+O B+3Cr5JtwJYuar3TNXrzOZnDnZSqOkvSASOlk1m5fPCYam4MdSTCJQRtz9Apcz3zcaJmlBkQsSix LzUqfPpTjheBjLoMJzhnRpZnOZiwe6J4LDrXyZqNSB5MCUIdCxWQlrt6ed8y07KPueYXPlZh0iUt vUEdL6Et8YULkFMQqQ7aAZtxBYMwggXYMIIEwKADAgECAhEA2O44+rO7W3RMNf8plxUGHTANBgkq hkiG9w0BAQsFADBdMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEzMDEG A1UEAxMqR2xvYmFsU2lnbiBQZXJzb25hbFNpZ24gMiBDQSAtIFNIQTI1NiAtIEcyMB4XDTE1MDcy MDEzMzEyN1oXDTE4MDcyMDEzMzEyN1owVzELMAkGA1UEBhMCU0UxHTAbBgNVBAMTFEd1aWxsYXVt ZSBDZWNjYXJlbGxpMSkwJwYJKoZIhvcNAQkBFhpndWlsbGF1bWVAZ2NzLXZlbnR1cmVzLmNvbTCC AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvhtYubxIJHmiJsh8UNaQP6zdQJPSy2e6bN bBGgbw/orbstZ97Dg6BoqDyU/UWaOX1FY+LP7Rz8j9WnOl+iNN/CI59PVaqpnnL5wiarYeo5aWEB lgwYUgd4IcRtZBFt2HXktfwqlmOz8L5DdotPy6QH9B494xB7VYHm2uQB3gL2a/9PUHk0Fgmf+VWz 6vj1VdXstnc4syXrN2gfRQbL2h3Wzje1SHD00yD/7xCI60tlauy2+F6wFi14FC8iHmVvldM0ykId mQc7AOLhS2aGeY44yohhM7hBxGrUWvhGAOH+BogkIYOUyDdwZRF/Wi8x4LKglbxXllaoBHrDoSfc SAywjSwe1zedsghNDd6A/p8pVfP15Kiw1KjA4VTOSeqRwDgIn4xmfqjsX+yC8fOlvyXfdusobyvG DDecXGPTXvhMMyyoALZLPknSS30OIlK1HSXu/xswd4923A6H7yQsfM+J3ONDQYaGkUqiPv9XtbGV ZE6GAEtxj4VKjq43DMYBjLa0lf2/0hxFhkaK0TkLBiMOO5R+Ii1hIbHu44FhV5vqzX0326mpEYjA HKIBYCYeYk1WWvX37mw5NDuklwZ5A+VxB+V450UMhSh+lfexLneimksnYFAozjpjBIp4Wr0MaWDf 4UUk6j7dzOlkrLS78+zd8EIytBtqNQ7uQGYRq2VzAgMBAAGjggGXMIIBkzAOBgNVHQ8BAf8EBAMC BaAwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xv YmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wJQYDVR0RBB4wHIEaZ3VpbGxhdW1lQGdjcy12ZW50dXJl cy5jb20wCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwRwYDVR0fBEAw PjA8oDqgOIY2aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9nc3BlcnNvbmFsc2lnbjJzaGEy ZzIuY3JsMFkGCCsGAQUFBwEBBE0wSzBJBggrBgEFBQcwAoY9aHR0cDovL3NlY3VyZS5nbG9iYWxz aWduLmNvbS9jYWNlcnQvZ3NwZXJzb25hbHNpZ24yc2hhMmcyLmNydDAdBgNVHQ4EFgQUzrypLO8j 4uk2DyhKJM6IldW/Mc4wHwYDVR0jBBgwFoAUP2xXRJ5Xn339aDnLufEa5Ll2UDgwDQYJKoZIhvcN AQELBQADggEBAHdqYOeiDXxLG8uJf5t3btHHqzUd+fyUnJcpOrKTfpXonY1w0Ao6wdMg7L6roeAJ YO8Rgc75YjmNIlHT51kSm3Q7cCNk4q8kLIR2TvZcBn2hei/Md7Zae3PmQW7TEyPNbDc6JowtE5za +/YcGjRZZn16qxWKGXMml3BmxfP6E8RPJST4oVwqYkxenk4w2OuOt8yC/ohSImkNiXI1Ylm0LdB6 gToMlpS/DKbLRnp2//dimkt1Yjii6nHKMWB2KbG7AyrPsBm3v8GZfoVHq94mCy6Z7n/M0qtQEd+7 ThbuY3AOc0Ml7SnGHJjDx5lMpgTIeReRI3PDaa5styjEWk+QVlUxggQEMIIEAAIBATByMF0xCzAJ BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTMwMQYDVQQDEypHbG9iYWxTaWdu IFBlcnNvbmFsU2lnbiAyIENBIC0gU0hBMjU2IC0gRzICEQDY7jj6s7tbdEw1/ymXFQYdMAkGBSsO AwIaBQCgggFnMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE4MDMz MDE2MTIzOVowIwYJKoZIhvcNAQkEMRYEFELRKWQ8mopKf+6sxMAoDkyiuA+XMIGBBgkrBgEEAYI3 EAQxdDByMF0xCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTMwMQYDVQQD EypHbG9iYWxTaWduIFBlcnNvbmFsU2lnbiAyIENBIC0gU0hBMjU2IC0gRzICEQDY7jj6s7tbdEw1 /ymXFQYdMIGDBgsqhkiG9w0BCRACCzF0oHIwXTELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2Jh bFNpZ24gbnYtc2ExMzAxBgNVBAMTKkdsb2JhbFNpZ24gUGVyc29uYWxTaWduIDIgQ0EgLSBTSEEy NTYgLSBHMgIRANjuOPqzu1t0TDX/KZcVBh0wDQYJKoZIhvcNAQEBBQAEggIAUaLtycXWwVnWCMVw tzPS7mxoq1kdQiQ0HH+Ld0jKWqk4GLH7T2KDrowPssjnFRmERqKxgvoWl62PvXXVsAkvrLF8CKZK dhk7AR9xzZ+OmUcECvCteQIfiZubODnO/NFOhBVLnYwE9WAxklc6LC6RuPJW+EvY+owSoIr1qw8N 1RurTcuGx7M1T9q19MYyigMc7/KNwc6zbHaZPKSZvFq5+CYHVJmrqMIuaDVK8kODE5aHpaGkqWkl J8yVWSQEgCbeDqyLdVxF+ysG0k3lkG2CyktaMHpNUkYNOt6rugmkfWsQTojILIlEW7jZP8+M6Q4R ooMkj7bTDWfe/Dc4aZR+3VG/RUJ9Z/0Fcluvu2JEJhM5qNHtkrNUdVrbbpFT6hFb29f6q2r/DKYK n9Cbq+PRTuRFkpMAUU52jyfR4Q7tfzejDegozvMWWUbMY9F1I+jzI1KhIJGmw5dEEMt47Gou+hny OHNsDbjjex+hbgrUNAWwpgLUGfjfvv6urvFlvNc31dTEUJ9ykN+LtC6NLhhm5wdemqJH2b+/xzza 2fEA+9gAZ1TGAEZwDNBKLolnrNFocCO1Tcaj3kZq4Ep27QxUDJ48GTDac8HnZueq1uaUxInKsW07 mpsJarehUSw259oe5OIa6Dgmf2e3wX/m0XCZ+N7asnjnPyvHIhw/JywPi9AAAAAAAAA= --Apple-Mail=_BF852EF7-862C-4D01-83EF-C2C499213B01--