Subject: Re: [alpine-devel] grsec go or no-go call for 3.6

From: Jens Staal <[email-masked]>
Date: Thu, 6 Apr 2017 06:02:06 +0200

Arch linux is using grsec on kernel 4.9.

https://www.archlinux.org/packages/community/i686/linux-grsec/

Perhaps it would be good to ask that maintainer what their plans are.
I did not find any new announcements on the grsec web page except the
announcement from 2015 where they explicitly say that they still want that
the patches are available for the hardened Arch and Gentoo projects.

Den 6 apr. 2017 00:07 skrev "Stuart Cardall" <[email-masked]>:

If possible it would be good to keep grsecurity. It mitigates attacks on
php-fpm:

"bruteforce prevention initiated for the next 30 minutes or until service
restarted, stalling each fork 30 seconds."

Stuart.

On 04/05/2017 09:07 PM, Natanael Copa wrote:

On Sun, 2 Apr 2017 21:18:16 -0500
William Pitcock <[email-masked]> <[email-masked]> wrote:

Hello,

On Sun, Apr 2, 2017 at 2:54 PM, Francesco
Colista<[email-masked]> <[email-masked]> wrote:

Il 2017-04-02 00:39 William Pitcock ha scritto:

Hello,

It is getting to the point to decide whether we wish to continue
including grsec kernel for 3.6.
There are three options that I can see:

1. Ship grsec in Alpine 3.6 and see what happens.  Revisit this issue
in Alpine 3.7.

One of the paradigm of Alpine is "secure".
grsec contributed so far in making Alpine "secure".

How has grsec improved the security of aarch64, ppc64le or s390x?
It has been previously proposed to remove grsec at the same time that
we remove support for 32-bit x86, should that ever happen.

I would not make any important decision based on a "possibility", rahter on
official announcements.

Unfortunately, we do need to make a decision.

I think we try keep grsecurity for v3.6.

While it is true that upstream may ultimately decide to not withdraw
the testing patches, it can very easily go the other way.
Upstream's rationale for withdrawing the testing patches have to do
with the KSPP project (which is basically incrementally reimplementing
grsec in mainline), which has the possibility of negatively impacting
revenue.

And KSPP is like a decade behind, they will have to negotiate the
features (vs speed for example) with the other developers, so they will
never reach the level of protection that Grsecurity provides.

Of course, upstream is still invited to comment on whether or not he
ultimately plans to withdraw the patches or not.

It may be that they will provide the testing patches every 2 years, (or
maybe even for every new LTS kernel). I hope they will realize that
killing the "community" and ecosystem around grsecurity will hurt their
customers and will give at least partial support for a non-official
port of grsecurity.

William

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: William Pitcock <[email-masked]>
Date: Wed, 26 Apr 2017 12:42:04 -0500

Hello,

> the patches are available for the hardened Arch and Gentoo projects.

https://grsecurity.net/passing_the_baton.php

Its official now.  Which means we need to revisit this.  Do we want
the exposure for 3.6?

William

---

---

From: Natanael Copa <[email-masked]>
Date: Wed, 26 Apr 2017 21:02:42 +0200

On Wed, 26 Apr 2017 12:42:04 -0500

> Its official now.  Which means we need to revisit this.  Do we want

I'd like to keep the grsec patch for 3.6. However, we need rename it. I
think we should call it 'linux-hardened'. That way we can remove the
patch later or switch to something else in future.

-nc

---

---

From: Jean-Louis Fuchs <[email-masked]>
Date: Thu, 27 Apr 2017 17:49:56 +0200

Hi

> patch later or switch to something else in future.

Could we actually find a sponsor and get a subscription? I mean the
source is GPL after all.

Best,
    Jean-Louis

---

From: Shiz <[email-masked]>
Date: Fri, 28 Apr 2017 10:25:00 +0200

Not viable as machine count is part of the subscription count, which we can’t predict.
We also can’t redistribute the patch or the subscription will be terminated.

Personally I vote for maintaining grsec for 3.6 and renaming it.
For the 3.6 releases cycle, we should be reasonably able to maintain the patch against 4.9 LTS.
We have to revisit this for 3.7+, preferably soon after as 3.6 is released, though.

- Shiz

> On 27 Apr 2017, at 17:49, Jean-Louis Fuchs <[email-masked]> wrote:
> 
> Hi
>

---

From: "V.Krishn" <[email-masked]>
Date: Mon, 1 May 2017 15:32:48 +0530

> Not viable as machine count is part of the subscription count, which we
> can’t predict. We also can’t redistribute the patch or the subscription
> will be terminated.
> 
> For the 3.6 releases cycle, we should be reasonably able to maintain the
> patch against 4.9 LTS. We have to revisit this for 3.7+, preferably soon
> after as 3.6 is released, though.

If dormant project like this can raise such a sum, I am sure a security 
project (close to kernel) can even larger.
eg. http://www.phoronix.com/scan.php?page=news_item&px=RoundCube-Next-
Silent-2017

Not sure what game is at play, but after small overview of other LSM/Non-LSM 
stackable/non-stackable projects, I think grsec should be kept alive atleast 
for 3 yrs or so (irrespective of alpinelinux uses it)
If original author does not like the idea of such crowdfunding, maybe it 
should be given a try by community/devs that forks it.

-- 
Regards.
V.Krishn

---

---

From: William Pitcock <[email-masked]>
Date: Thu, 27 Apr 2017 01:34:23 -0500

Hello,

> patch later or switch to something else in future.

I took care of this in edge/3.6 already.  Whenever the current blocks
on the builders are resolved, this should go in fine.
It passed a local rebuild anyway.

When people upgrade their system, it will transition them to
linux-hardened if they have linux-grsec as soon as it lands.

William

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 28 Apr 2017 14:00:30 +0200

On Thu, 27 Apr 2017 01:34:23 -0500

> linux-hardened if they have linux-grsec as soon as it lands.

I tried upgrade here.

apk upgrade replaced the grsec kernel with hardened. I just had to edit
my gummiboot config and everything was back to normal.

Thank you very much!

-nc

---