Subject: How does Alpine Linux harden its kernel?

From: Marco Sulla <[email-masked]>
Date: Tue, 31 Mar 2020 11:43:01 +0200

Hello all. I discovered Alpine Linux, and it seems the unique active
Linux distro that applies hardening patches to the Linux kernel.

The problem is I do not understand where Alpine applies its patches to
the kernel. Where is the code?

PS: I know that Alpine Linux does not use anymore grsecurity. Does it
continue to apply PaX patches?

---

From: Natanael Copa <[email-masked]>
Date: Tue, 31 Mar 2020 12:02:29 +0200

On Tue, 31 Mar 2020 11:43:01 +0200

> continue to apply PaX patches?

Hi!

We no longer harden the kernel, due to grsecurity nor pax not being
available for public.

It sounds like we need to update the documentation somewhere.

-nc

---

From: PICCORO McKAY Lenz <[email-masked]>
Date: Tue, 31 Mar 2020 10:17:25 -0400

wicht part of the wiki said that? i'll investigate it and later applied
updates

---

From: Marco Sulla <[email-masked]>
Date: Tue, 31 Mar 2020 12:10:47 +0200

But did you not apply custom patches made by yourselves? I see that in
the source code that pax utilities are used. And it seems Apline use
linux-hardened.

---

From: Natanael Copa <[email-masked]>
Date: Tue, 31 Mar 2020 12:30:06 +0200

On Tue, 31 Mar 2020 12:10:47 +0200

> the source code that pax utilities are used. And it seems Apline use

We used the testing patches from grsecurity and maintained our own fork
of it for a while. But it was not possible to continue at some point
(which was expected). Now we have dropped the linux-hardened kernel in
favor of the vanilla linux-lts.

I recommend that you ask (and pay for) grsecurity for a proper hardened
kernel.

-nc

---

From: Marco Sulla <[email-masked]>
Date: Tue, 31 Mar 2020 15:47:01 +0200

Thank you for the information. I have no intention to apply a patch to
the linux kernel which code is not publicly available.