| 1 |
On 09/03/2015 02:28 PM, Marc Schiffbauer wrote: |
| 2 |
> * Anthony G. Basile schrieb am 02.09.15 um 18:13 Uhr: |
| 3 |
>> Hi everyone, |
| 4 |
>> |
| 5 |
>> So by now most people have heard the news that the Grsecurity/PaX team |
| 6 |
>> are no longer going to be making their stable patches available. The |
| 7 |
>> reason is that they are in dispute with a certain embedded systems |
| 8 |
>> vendor and those negotiations broke down. So they decided to make their |
| 9 |
>> stable patches only available to the sponsors. [1] |
| 10 |
>> |
| 11 |
>> What does this mean for Gentoo? Up until now I have been maintaining |
| 12 |
>> both the grsec upstream stable and testing patchsets in our |
| 13 |
>> hardened-sources. Currently the upstream stable kernels are 3.2.71 and |
| 14 |
>> 3.14.51 and the testing are 4.1.6. In about one week, the 3.2.71 and |
| 15 |
>> 3.14.51 patchsets will no longer be available and I'll continue pushing |
| 16 |
>> out the 4.1.6. Unfortunately the testing patchset is precisely as the |
| 17 |
>> name suggests --- for testing and not production. For the embedded |
| 18 |
>> systems company this will be the kiss of death because those patches are |
| 19 |
>> not suitable for long term. For Gentoo it will mean that I will have to |
| 20 |
>> be more vigilant about bugs and trying to stick with a well known kernel |
| 21 |
>> before moving on. You can still use these kernels in production, but |
| 22 |
>> you must be carefull about instabilities as upstream pushes out |
| 23 |
>> experimental feature that may oops or panic. Keep older kernel images |
| 24 |
>> around and revert if it doesn't work. Look to this list for |
| 25 |
>> announcements about more serious issues like things that can cause data |
| 26 |
>> loss. |
| 27 |
>> |
| 28 |
>> I'm hoping that once this company feels the sting of what has just |
| 29 |
>> happened, they'll come back to the table and talk with Grsec/PaX people. |
| 30 |
>> They won't be able to ship boards with grsec anymore because its not so |
| 31 |
>> easy to switch out a kernel on a board! If they ship a board with a |
| 32 |
>> bug, they loose. We just reboot :) |
| 33 |
>> |
| 34 |
>> [1] https://grsecurity.net/ |
| 35 |
> |
| 36 |
> Can't Gentoo be a sponsor? I think we could easly croudfund a |
| 37 |
> sponsorship. |
| 38 |
> |
| 39 |
> This would help Gentoo and Grsecurty/PaX but OTOH that vendor might just |
| 40 |
> use the gentoo kernel if they not already did so. |
| 41 |
> |
| 42 |
> Thoughts? |
| 43 |
> |
| 44 |
We can't do that because it would make the LTS patches public, which |
| 45 |
spender is trying to avoid. |
| 46 |
|
| 47 |
-- |
| 48 |
-- Matthew Thode (prometheanfire) |
Archives