1 |
On 170502-10:28+0200, Daniel Cegiełka wrote: |
2 |
> https://wiki.gentoo.org/wiki/Hardened/Hardened_Kernel_Project |
3 |
> |
4 |
> It closes the topic of our discussion. |
5 |
> |
6 |
And I read all the discussion in gentoo-hardened in regard. |
7 |
|
8 |
First, I'm a user[1], and I'm trying to continue to keep safe and secure |
9 |
as I used to be with grsec/PaX. |
10 |
|
11 |
I figured out only yesterday about this almost two weeks old news, and I |
12 |
guess the then 10+ days old (slightly) unmaintained kernel |
13 |
4.9.24-hardened (and there won't be any updates, correct?), may have |
14 |
contributed to my woes[2]: |
15 |
|
16 |
# ls -ABRgo /usr/portage/sys-kernel/hardened-sources/ |
17 |
... |
18 |
-rw-r--r-- 1 47449 2016-12-17 02:21 ChangeLog |
19 |
... |
20 |
-rw-r--r-- 1 1316 2017-04-22 18:18 hardened-sources-4.9.24.ebuild |
21 |
... |
22 |
# |
23 |
|
24 |
And really since late in 2016 no more entries in the Changelog. Pls. |
25 |
note that I'm only stating the facts, not complaining. |
26 |
|
27 |
I really wish I learn myself and be able to contribute; acually I have |
28 |
occasinally contributed, marginally, to the hardened project, with |
29 |
testing. |
30 |
|
31 |
> worth reading: |
32 |
> |
33 |
> http://openwall.com/lists/kernel-hardening/2017/05/01/5 |
34 |
> |
35 |
> http://openwall.com/lists/kernel-hardening/2017/05/02/4 |
36 |
|
37 |
And these should not be missed: |
38 |
|
39 |
It looks like there will be no more public versions of PaX and Grsec |
40 |
http://openwall.com/lists/kernel-hardening/2017/05/04/20 |
41 |
( Shawn's collection of links there are an eye-opener, esp. this one |
42 |
link which, to me, feels like sacrilege: |
43 |
https://mjg59.dreamwidth.org/39546.html |
44 |
about Karen Sandler, the executive director of the Software Freedom |
45 |
Conservancy, by sly means prevented to stand for LF board ) |
46 |
|
47 |
and: |
48 |
< same subject > |
49 |
http://openwall.com/lists/kernel-hardening/2017/05/02/14 |
50 |
( where find what "is... unappealing." ) |
51 |
|
52 |
> this means: |
53 |
> |
54 |
> * KSPP means that keeping PaX for >4.9 will be difficult and painful, |
55 |
> as I pointed out previously |
56 |
|
57 |
> * NSA SELinux instead PAX MPROTECT? |
58 |
I hope this is a joke. It looks like one, at first sight, but there are |
59 |
half a dozen "NSA SELinux" instances to be found in the latest |
60 |
hardened-sources. |
61 |
|
62 |
# grep 'NSA SE' /usr/src/linux/security/selinux/Kconfig |
63 |
bool "NSA SELinux Support" |
64 |
... |
65 |
# |
66 |
(where linux is a hardened-sources installation) |
67 |
|
68 |
If hardened would be down to SELinux, I wouldn't be hardening any more. |
69 |
|
70 |
> alternatives: RSBAC |
71 |
> |
72 |
... |
73 |
|
74 |
But I saw the other link that gives me some hope: |
75 |
|
76 |
Unofficial forward ports of the last publicly available grsecurity patch |
77 |
https://github.com/minipli/linux-unofficial_grsec/tree/linux-4.9.x-unofficial_grsec |
78 |
|
79 |
which I cloned into my machine. (And I have just spent hours trying to |
80 |
fix an ebuild in my custom overlay and install it in my machine, to no |
81 |
avail so far, and I'm at the end of my forbearance... A little more below.) |
82 |
|
83 |
And I wonder: |
84 |
|
85 |
1) Are there any guides for non-programmers how to install the: |
86 |
|
87 |
Merge tag 'v4.9.26' into linux-4.9.x-unofficial_grsec |
88 |
https://github.com/minipli/linux-unofficial_grsec/commit/bb9fb983874810ca4167430508e06975af700824?diff=unified |
89 |
|
90 |
UPDATE (at proofreading time: Matheus, thanks! You just PGP-signed the |
91 |
new tag [3], reader, skip 16 lines ) |
92 |
|
93 |
2) How can I check the integrity? I can: |
94 |
|
95 |
$ git tag --verify v4.9.26 |
96 |
object d071951e08ee23cd725c2336d7ab4582bb93b0af |
97 |
type commit |
98 |
tag v4.9.26 |
99 |
tagger Greg Kroah-Hartman <gregkh@×××××××××××××××.org> 1493825816 -0700 |
100 |
... |
101 |
$ |
102 |
|
103 |
but I can not verify Mathias Krause's commit. Pls. minipli, can you |
104 |
start PGP-signing... [cut more text, because you have :) ] |
105 |
|
106 |
(Continue reading, isues left here, this is the "little more below" |
107 |
I mentioned above.) |
108 |
|
109 |
The README.md is plain readme from the kernel, no mention of grsec at |
110 |
all... |
111 |
|
112 |
Where do I get some tips how to install? I do have the git sources, they |
113 |
verify fine... I will, hopefully, keep strong and keep trying, but I'm |
114 |
not so very sure I am able to craft an ebuild that would work and that |
115 |
would install with the local git linux-unofficial_grsec repo... |
116 |
|
117 |
I suspect the [2] below was because my kernel wasn't updated... and I do |
118 |
feel a little insecure at this time... |
119 |
|
120 |
--- |
121 |
[1] but I can understand the issues the developers have. I have some |
122 |
understanding of programming, and the politics with and around FOSS |
123 |
is easy to understand, given time and info. |
124 |
|
125 |
[2] Strange script planted with Bash |
126 |
https://www.croatiafidelis.hr/foss/cap/cap-170504-strange-bash/ |
127 |
and: |
128 |
Inconsistent behavior in my Gentoo OS instance |
129 |
https://lists.gt.net/gentoo/user/325985#325985 |
130 |
|
131 |
[3] $ git tag --verify v4.9.26-unofficial_grsec |
132 |
object bb9fb983874810ca4167430508e06975af700824 |
133 |
type commit |
134 |
tag v4.9.26-unofficial_grsec |
135 |
tagger Mathias Krause <minipli@××××××××××.com> 1494181910 +0200 |
136 |
|
137 |
This is the unofficial forward port of grsecurity-3.1-4.9.24-201704252333.patch to v4.9.26 |
138 |
gpg: Signature made Sun 07 May 2017 20:32:02 CEST |
139 |
gpg: using RSA key 7585399992435BA4 |
140 |
gpg: Good signature from "Mathias Krause <minipli@××××××××××.com>" [unknown] |
141 |
... |
142 |
Primary key fingerprint: 7629 8B5B B60E DAD2 1B36 2E66 7585 3999 9243 5BA4 |
143 |
|
144 |
Regards! |
145 |
-- |
146 |
Miroslav Rovis |
147 |
Zagreb, Croatia |
148 |
https://www.CroatiaFidelis.hr |