(Kernel) hardening: Use PaX or Grsec

[rugk]

If you did not know already: You have been featured by Snowden. 🎉

So this issue is about a response by another user:

solation is one thing, memory corruption prevention is another. You might need PaX/Grsec-based OS, @subgraph ?

https://twitter.com/citypw/status/781497609298989056

So from quickly searching this issue tracker, it seems you do not use any kernel hardening features. What do you think about adding them?

The user also mentions another OS. I think you can certainly get inspiration from the competition. 😄

[ag4ve]

I'll preface my liking this idea by saying I've never run PaX on Xen. There
might also be kernel version issues since they only release long-term
support kernel patches (there's a blog post about why - you pay for the
other versions). If neither of those are blockers - I would love to see
this.

On Sep 29, 2016 2:02 PM, "rugk" notifications@github.com wrote:

If you did not know already: You have been featured by Snowden. 🎉

So this issue is about a response by another user:

solation is one thing, memory corruption prevention is another. You might
need PaX/Grsec-based OS, @subgraph https://github.com/subgraph ?

https://twitter.com/citypw/status/781497609298989056

So from quickly searching this issue tracker, it seems you do not use any
kernel hardening features. What do you think about adding them?

The user also mentions another OS https://subgraph.com/. I think you
can certainly get inspiration from the competition. 😄

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#2345, or mute the thread
https://github.com/notifications/unsubscribe-auth/ABNnP1BsJwAK3CvpBfgngxS9qpcEHEtbks5qu_1EgaJpZM4KKS7P
.

[ag4ve]

I'll preface my liking this idea by saying I've never run PaX on Xen. There
might also be kernel version issues since they only release long-term
support kernel patches (there's a blog post about why - you pay for the
other versions). If neither of those are blockers - I would love to see
this.

On Sep 29, 2016 2:02 PM, "rugk" notifications@github.com wrote:

If you did not know already: You have been featured by Snowden. 🎉

So this issue is about a response by another user:

solation is one thing, memory corruption prevention is another. You might
need PaX/Grsec-based OS, @subgraph https://github.com/subgraph ?

https://twitter.com/citypw/status/781497609298989056

So from quickly searching this issue tracker, it seems you do not use any
kernel hardening features. What do you think about adding them?

The user also mentions another OS https://subgraph.com/. I think you
can certainly get inspiration from the competition. 😄

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#2345, or mute the thread
https://github.com/notifications/unsubscribe-auth/ABNnP1BsJwAK3CvpBfgngxS9qpcEHEtbks5qu_1EgaJpZM4KKS7P
.

[mfc]

thanks for opening this issue. for the past year we have tried convincing the subgraph team to work on this (including getting funding for them to do it) by creating subgraph templates for Qubes but they aren't interested. so I think it's worthwhile to track this effort and look elsewhere for potential implementers.

[mfc]

thanks for opening this issue. for the past year we have tried convincing the subgraph team to work on this (including getting funding for them to do it) by creating subgraph templates for Qubes but they aren't interested. so I think it's worthwhile to track this effort and look elsewhere for potential implementers.

[mfc]

just to update, the coldkernel team is working on this, see their blogpost and progress:

https://coldhak.ca/blog/2016/12/12/coldkernel-qubes-1.html
https://github.com/coldhakca/coldkernel/issues/35

[mfc]

just to update, the coldkernel team is working on this, see their blogpost and progress:

https://coldhak.ca/blog/2016/12/12/coldkernel-qubes-1.html
https://github.com/coldhakca/coldkernel/issues/35

[marmarek]

Grsec is dead (at least as an open source project), so it doesn't apply anymore.

[marmarek]

Grsec is dead (at least as an open source project), so it doesn't apply anymore.

[fread2281]

https://github.com/copperhead/linux-hardened

[fread2281]

https://github.com/copperhead/linux-hardened