Re: [gentoo-hardened] Technical repercussions of grsecurity removal

[Mathias Krause]

On 8 May 2017 at 20:08, Miroslav Rovis <miro.rovis@××××××××××××××.hr> wrote:
> [...]
> But I saw the other link that gives me some hope:
>
> Unofficial forward ports of the last publicly available grsecurity patch
> https://github.com/minipli/linux-unofficial_grsec/tree/linux-4.9.x-unofficial_grsec
>
> which I cloned into my machine. (And I have just spent hours trying to
> fix an ebuild in my custom overlay and install it in my machine, to no
> avail so far, and I'm at the end of my forbearance... A little more below.)
>
> And I wonder:
>
> 1) Are there any guides for non-programmers how to install the:
>
> Merge tag 'v4.9.26' into linux-4.9.x-unofficial_grsec
> https://github.com/minipli/linux-unofficial_grsec/commit/bb9fb983874810ca4167430508e06975af700824?diff=unified

See below.

> [...]
>
> 2) How can I check the integrity? I can:

You figured that one already ;)

> [...]
> The README.md is plain readme from the kernel, no mention of grsec at
> all...

...as it used to be the case for the official grsec patch. So nothing
has changed here. ;) But I can understand your concerns. If you're
used to getting a patch and have to use a git repo now, it's not
intuitive on *how* to make use of it. But, again, see below...

>
> Where do I get some tips how to install? I do have the git sources, they
> verify fine... I will, hopefully, keep strong and keep trying, but I'm
> not so very sure I am able to craft an ebuild that would work and that
> would install with the local git linux-unofficial_grsec repo...

I'm not familiar with the gentoo ebuild based package system but I
guess patches integrate more smoothly than git repositories do. So
here's how you generate a patch for the unofficial port for v4.9.27
(just pushed ;):

  $ git remote update
  [update log foo]
  $ git diff v4.9.27..v4.9.27-unofficial_grsec > ~/unofficial_grsec-v4.9.27.diff

If you don't want to clone the git repo you can fetch the patch
directly via the github web interface:

  $ curl https://github.com/minipli/linux-unofficial_grsec/compare/v4.9.27...v4.9.27-unofficial_grsec.diff
> ~/unofficial_grsec-v4.9.27.diff

The pattern should be intuitive: just change "v4.9.27" for the kernel
version you want to get a patch for (v4.9.25 to v4.9.27 so far).

The generated patch can be applied on a vanilla Linux v4.9.27 as usual
to generate the unofficial grsec kernel.

I hope this helps!

Cheers,
Mathias