Grsecurity Blog

It could be zero. I'm really not sure. Someone has to go through the vulns and check if they are protected or not. It probably doesn't harm security and may stop some future bug but if you have limited resources to apply to security it might be worth installing grsecurity instead of this. (https://grsecurity.net/) They are often boasting about how grsecurity would have stopped a vuln. So they seem to have a track record of useful mitigations.

Amazed that "Install grsecurity" isn't one of the key things listed here. Sure, you have to compile your own kernel, but the enhanced memory protections and many other hardening features make it an excellent addition to your security arsenal. http://grsecurity.net

Why does nobody ever mention grsecurity/pax? http://www.grsecurity.net It's worth your time.

If you really need security consider using the grsecurity patchset¹ and pax². It's possible to patch the Ubuntu default kernel without problems. However understanding and configuring this takes time and patience. There is a great guide on Wikibooks through³ 1: http://grsecurity.net/ 2: http://pax.grsecurity.net/ 3: http://en.wikibooks.org/wiki/Grsecurity

There is https://grsecurity.net/ but it's not free. It's developed by people with much more experience defending against attackers than all of the other projects combined.

Some DevOps guys I know are running on Macbook M2 a Gentoo musl+llvm+openrc userland on a Linux that has Asahi patches and https://grsecurity.net patches. The only "downside" is no Windows VMs, but they don't seem to care about that.

Linux as a service is most of Redhat and Canonical's business models. grsecurity does this from a security angle specifically - in fact they're boasting about it on their homepage right now (fair enough!) >Are Your Products Drowning in Linux Kernel CVE Noise? >We know your products can't be updated every week based off unverified CVE information. Address true risk by protecting against entire classes of vulnerabilites and exploitation techniques. Our Pro Support ensures you make the most of attack surface reduction and our proactive defense in your products. https://grsecurity.net/

Yes, https://grsecurity.net/ Why did you use archive.org to get to wikipedia??

I wonder what the author thinks about grsecurity [0], and about the Kernel Self Protection Project [1] 0: https://www.grsecurity.net/ 1: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project

> Similarly Linux has "Linus decentralisation": there's an elaborate decentralised version control system, but nonetheless Linus has effective final veto in practice. And Etherum has "Vitalik decentralisation": disasters such as the DAO can be reversed by code changes, because even if the blockchain is immutable the code required to interpret it isn't. There is nothing but "sheep mentality" preventing most people from (hard) forking. Don't like what Ethereum did with the DAO incident? Don't patch. See https://ethereumclassic.github.io/ Don't like what Linus did (not) merge? Fork the project, and patch it like you want. See https://grsecurity.net/features.php

There is no unequivocally answer in the domain of security, secure refers to a threat model. When your threat model includes Microsoft or US surveillance then no Microsoft OS can provide you the security you're aiming for. Then again Desktop Linux is no OpenBSD or GRsecurity[1], A hardened linux experience usually doesn't come out of the box with Desktop Linux, but still there are options to explore[2] if you're so inclined. [1]: https://grsecurity.net/ [2]: https://wiki.archlinux.org/index.php/Security

> You seems to be slandering grsec for no reason. It's not without reason, I don't like people abusing free software in the manner the grsecurity people do it (https://grsecurity.net/agree/agreement.php). They license code under the GPL (because they have to) but then they effectively tell their customers that exercising their right to redistribute code will result in a termination of contract (which is at best against the spirit of the GPL, and at worst illegal).

Or you can use grsecurity, which goes even further: https://grsecurity.net/ In fact, many of the KSP patches are inspired by Grsecurity.

grsecurity[1] for linux. You don't even have to use RBAC if you don't want to (you can still use AppArmor/SELinux/etc) but RBAC comes with a built-in learning mode which is good and will likely do a better job than you could and generating a profile. Sure you'll probably have to hand tune it a bit but for production servers I see no reason why RBAC couldn't be used with it's training/learning mode. [1] https://grsecurity.net/

> There are some great lesser alternatives like AppArmor, grsec, Lesser? grsecurity is actually a far superior alternative to SELinux: https://grsecurity.net/compare.php It's unfortunate that their stable patches are no longer available publicly: https://grsecurity.net/announce.php

> This is likely to be easy to exploit for privilege escalation, except on systems with SMAP or UDEREF Another reminder why everyone should be using https://grsecurity.net which provides these mitigations to the Linux kernel via patches. GRSecurity has had SMAP aka KERNEXEC for a long time as well as UDEREF https://grsecurity.net/~spender/uderef.txt If you keep any sensitive data on a Linux server you should seriously consider grsec. Even last week there was an ASLR bypass posted on OSS-security which of-course grsec already protected you against http://seclists.org/oss-sec/2014/q4/908 There is a lot of drama around the fact Linux core devs don't adopt these patches by default. But regardless Linux is pretty insecure by default and grsec makes privesc via various classes of exploits significantly harder.

It's funny. I was just learning about RuneWatch, which is how the Runescape community attempts to democratize and distribute the problem of dealing with scammers. The evolution was basically that it started the way CVEs work. You could submit a report and there wasn't really any verification. Of course, this was abused - far worse than the CVE system, naturally, but the same sort of problem. Now they require a lot of evidence and things are much much better and abuse is far more difficult. It seems sort of obvious. If this is a vulnerability, prove it. It almost feels like a CVE should have a "practical" tag. Like: 1. Is this theoretically exploitable? 2. Is this practically exploitable? 3. Is this proven exploitable? This should be a massive contributor to the score. It also means that a score can be raised by having the sec researcher demonstrate an exploit - so disagreements can be resolved very easily. Related, here's a post from Spender on the topic (since the "CVE bad" situation is nothing new) https://grsecurity.net/reports_of_cves_death_greatly_exaggerated

grsec does this: https://grsecurity.net/

IMHO it can be done, using UNIX-based operating systems and standard open source software, if the infrastructure designer takes security seriously and is committed and knowledgeable. It's NOT the system administrator's work to secure the network. The ISP/minor IT company should have a security engineer to overview the network, although some sys-admins are extremely skilled when it comes to security. There are so many security layers that can be implemented on a Linux/BSD server that makes the machine virtually un-hackable and IF anyone enters, all bells and whistles could start cheering. Examples: GRsecurity[1], IPTables[2], Snort[3], chroots (or jails), VPNs, malware scanners (clamav, spamassassin), encryption and what-not. To me securing linux desktops, especially simple ones (e.g. window manager + basic programs... almost like thin clients) is easy. Securing Windows XP/7/8/etc is extremely tricky BUT can be done. Once you do all that, I'm 100% that you're going to be one hell of a target for anyone. And you really don't trust your team you can always hire people to test your network's security and improve it. The most important thing though is having a strict general user policy: What users can and can not do must be crystal clear with no exception. When a 'tiger team' finds a secure network, they usually target the people not the infrastructure. [1] GRsecurity: https://grsecurity.net/ [2] http://www.netfilter.org/projects/iptables/ [3] https://www.snort.org/

It does not have KASLR and it does not even have userland binaries ASLR enabled by default(not that it matters for this vulnerability). https://twitter.com/wdormann/status/1528742791383334917 >It would make thus attack much harder It won't make it much harder, just a teensy bit harder. https://grsecurity.net/kaslr_an_exercise_in_cargo_cult_security

Don't know why your other comment got downvoted. Silently patching bugs has left many LTS kernels vulnerable to old bugs, because they weren't tagged as security fixes. Also leads to other issues..: https://grsecurity.net/the_life_of_a_bad_security_fix See also: https://twitter.com/spendergrsec

Its the work of Positive Technologies according to this article from grsecurity: https://grsecurity.net/watch_your_stepping_atoms_breaking_apart https://www.ptsecurity.com/ Positive Technologies got sanctioned by the US government. Seems Google deleted their blog as a result. https://web.archive.org/web/20210419105554/http://blog.ptsecurity.com/…

Remember when they tried to push a backdoor into the kernel last year? I am surprised with how they kept allowing them to submit patches. They acted much more boldly with the issue with the university of Minnesota. I am not a grsec fan but here https://grsecurity.net/huawei_hksp_introduces_trivially_exploitable_vu…

In case anyone forgot about this: https://grsecurity.net/huawei_hksp_introduces_trivially_exploitable_vu…

Video: https://www.youtube.com/watch?v=F_Kza6fdkSU PDF: https://grsecurity.net/10_years_of_linux_security.pdf PPTX: https://grsecurity.net/10_years_of_linux_security.pptx

I wonder whether it's better just to link to grsecurity here https://grsecurity.net/huawei_hksp_introduces_trivially_exploitable_vu…

The article describes grsecurity's 'respectre' compiler plugin [1]. [1] https://grsecurity.net/respectre_announce.php

https://grsecurity.net/announce.php Reading between the lines, it seems to be a money thing.

Edit: I replied too soon and misunderstood the core of Peren's argument. His claim is that by withdrawing support if a customer redistributes the grsecurity patch (which absolutely is licensed under the GPLv2), that amounts to adding a clause to the GPL due to the penalty this imposes. At issue is this agreement: https://grsecurity.net/agree/agreement.php This clearly represents additional conditions imposed on the software. Seems like a grey area as to whether those conditions at enough to violate the GPL under which the Linux kernel is licensed. Original comment: I don't buy it. Grsecurity isn't distributed as a derivative work of the Linux kernel. Just because it's useless without the kernel doesn't make it a derivative work. By that logic, Nvidia's closed source driver would qualify as a derivative work and fall under the GPL.

Also read the corresponding FAQ: https://grsecurity.net/passing_the_baton_faq.php