Hacker News Reader

Comment by d33 | Hacker News Reader

This is terribly unfortunate. By the way, could someone comment on why major distributions didn't use grsecurity code in their main kernel packages (or at least provide hardened-) ones? Maintenance cost or something else?

View on HN

You can't really ship all of the grsec, because some compile time settings break userspace apps. Other options disable things you want on laptops, like power management registers. Basically your need to opt-in to grsec and you need to know what to configure afterwards. Or enable only selected few features and not get the whole protection.

On top of that, you can't use the latest kernel version until grsec is ported to it. And probably more reasons I don't know about yet. Basically, it's not one-size-fits-all solution - Ubuntu would create more problems than solutions if they just dumped it on users by default (or at least without a proper migration path with lots of deprecation time).

> You can't really ship all of the grsec, because some compile time settings break userspace apps. Other options disable things you want on laptops, like power management registers. Basically your need to opt-in to grsec and you need to know what to configure afterwards. Or enable only selected few features and not get the whole protection.

The vast majority of features are 'set and forget'. Most will not break userland, or have extremely low FP rates. I can think of only one or two that have a high FP rate (integer overflow plugin) that would not be enabled by default. After all, these patches tend to make it into upstream under another name in ~10 years or so.

> On top of that, you can't use the latest kernel version until grsec is ported to it.

Not really a problem unless your distro updates to the latest version the night it's released, which most will not. Grsecurity's dev patch tends to be far, far ahead of whatever Ubuntu is using.

I ran it on an Ubuntu system with virtually all features enabled with little problem.

> Most will not break userland

That's exactly what I meant. It usually works the same. Apart from when it doesn't. For example arch's linux-grsec kernel requires pax changes for common KDE apps, and every separate python virtualenv. Restricted runtime CPU registers stop powertop. Something (can't remember details now) affected sysdig.

It's not critical. I used to run grsec kernel all the time on a laptop. But I can't imagine someone dropping, for example paxd support into a popular distro and expect people to deal with apps suddenly not starting.

We've been using PaX/Grsecurity on Debian( as server) and Linux Mint( as Desktop) for a while. It's working perfect fine until now. You can also tweak the reproducible builds as well:

https://github.com/hardenedlinux/grsecurity-reproducible-bui...

As exmaple of Linux Mint: https://hardenedlinux.github.io/system-security/2016/01/10/h...

The major distros gave up using significant amounts of non upstream code a decade or so ago, as it was extremely difficult to support. The only people who ship the grsec kernels ship them pretty much unmodified.

Arch Linux has provided the kernel with grsecurity patches inn the main repos for a long time.

The question was about the main kernel package in a distribution. Lots of distributions had optional packages with grsec support.

"The PaX and grsecurity patches are no longer going to be public, so official support in Arch Linux has ended"

https://lists.archlinux.org/pipermail/arch-general/2017-Apri...

Yes. I wrote "has".

"has" is present tense. I think you meant "had"?

The 'hardened' kernel he mentioned has recently (~40 hours) appeared in the Arch repos:

https://www.archlinux.org/packages/community/x86_64/linux-ha...

Not a replacement but at least an alternative.

> The Gentoo Hardened project maintains security-enhancement features for Gentoo, including but not limited to grsecurity

https://wiki.gentoo.org/wiki/Hardened/Grsecurity2_Quickstart...

Reply on news.ycombinator.com