Future of GRSecurity in Alpine?
#1
Thu, 2017-05-18 06:46
dnx
-
- Offline
- 10 months 2 weeks ago
- 2017-05-18
With the end of public grsecurity patches (https://grsecurity.net/passing_the_baton_faq.php) what is the future looking like for grsec/pax in Alpine? I had a search but couldn't find anything definite - some mention of a fork maybe? Is Alpine's grsec implementation already a fork?
I'd love to know more about this, any helpful link or info greatly appreciated.
Thanks.
An unofficial grsecurity fork is being used, and the kernel has a label called 'hardened' instead of 'grsecurity'.
See the 'Secure' paragraph in Alpine's about page or this video passage.
This was on the mailing list Wed, 10 Jan 2018:
"We are still working out the specifics of how to handle
linux-hardened, but current research indicates that changes to PaX
will be required to do the same style of mitigation. As we are
incapable of doing these changes ourselves at this time, we are
planning to migrate linux-hardened users to linux-vanilla in a future
update. We are presently working out the exact plans to do this, as
well as to introduce missing modules and kernel variants (-virt kernel
profile) that are missing in linux-vanilla.
Once linux-vanilla is at feature parity (in terms of modules and
kernel variants offered) we will do this transition in edge. After
the transition plan is proven stable in edge, we will push it to the
supported releases.
A common question is whether or not we will be keeping the
linux-hardened and linux-grsec packages themselves around in the
release branches. At present we have not made this conclusion. The
reality, however, is that backporting security fixes to the hardened
kernel is now a lot more difficult due to the introduction of KAISER
as a mitigation in the LTS branches, so most likely we will drop it
since we feel it would be irresponsible to carry a package that has
known vulnerabilities while also claiming it has enhanced security
features.
William"