| 1 |
On Mon, 1 May 2017 13:58:08 +0000 Sven Vermeulen wrote: |
| 2 |
> On Mon, May 01, 2017 at 01:28:54PM +0300, Andrew Savchenko wrote: |
| 3 |
> > > The obvious step is indeed to stop further *current* development on |
| 4 |
> > > hardened-sources. |
| 5 |
> > |
| 6 |
> > Why not support hardened-sources while corresponding vanilla |
| 7 |
> > kernels are still supported? E.g. 4.9 is a longterm branch, so we |
| 8 |
> > should be able to keep hardened-sources-4.9* up-to-date with |
| 9 |
> > vanilla bugfixes. This will give a nice transition period for |
| 10 |
> > hardened users. |
| 11 |
> |
| 12 |
> Transition to what exactly? |
| 13 |
|
| 14 |
It doesn't really matter. Something will come up, but we need to |
| 15 |
provide users smooth experience before then. Supporting 4.9 looks |
| 16 |
like a good solution here. |
| 17 |
|
| 18 |
Most likely KSPP project will come up, they are doing a good job: |
| 19 |
bringing security features upstream fixing bugs in PaX code during |
| 20 |
the process [1]. This is what PaX should have done long time ago, |
| 21 |
they were even offered CII grant for this job, but refused [2]. |
| 22 |
|
| 23 |
[1] http://openwall.com/lists/kernel-hardening/2017/05/02/4 |
| 24 |
[2] https://lists.coreinfrastructure.org/pipermail/cii-discuss/2015-August/000003.html |
| 25 |
|
| 26 |
Best regards, |
| 27 |
Andrew Savchenko |
Archives