Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixes #5507 marks grsec kernel as default on Focal #5521

Closed
wants to merge 1 commit into from
Closed

Fixes #5507 marks grsec kernel as default on Focal #5521

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions install_files/securedrop-grsec/DEBIAN/postinst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,14 +15,21 @@ set -x
# <conflicting-package> <version>
# for details, see http://www.debian.org/doc/debian-policy/ or
# the debian-policy package
GRSEC_VERSION='4.14.188-grsec'

# Sets default grub boot parameter to the kernel version specified
# by $GRSEC_VERSION. The debian buster default kernel is 4.19, thus
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment references "buster" & "4.19" kernel, neither of which are relevant to SecureDrop servers. The comment and the rest of the postinst patch are pulled from https://github.com/freedomofpress/securedrop-debian-packaging/blob/05eedc6e2a5d9a1c53ebb6dda0a2188365063e05/securedrop-workstation-grsec/debian/postinst#L26-L32 We should definitely rewrite for clarity if/when we adopt this approach.

# supersedes this 4.14.x series grsecurity kernel at boot-time
set_grub_default() {
GRUB_OPT="'Advanced options for Debian GNU/Linux>Debian GNU/Linux, with Linux $GRSEC_VERSION'"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the grub menu, does Ubuntu still set Debian GNU/Linux>Debian GNU/Linux? That is, I'd expect "Ubuntu", not "Debian". See in

securedrop/install_files/ansible-base/roles/grsecurity/tasks/from_fpf_repo_install_grsec.yml

Line 61 in f81e415

command: grub-reboot "Advanced options for Ubuntu>{{ grsec_str.stdout }}"

where we're explicitly referring to the menu entry as Advanced options for Ubuntu>. It's possible the appropriate settings have changed between Xenial & Focal, but at the very least we should be setting the same in both places.

perl -pi -e "s|^GRUB_DEFAULT=.*|GRUB_DEFAULT=$GRUB_OPT|" /etc/default/grub
}

case "$1" in
configure)

# Replace the default GRUB boot option with 0, which defaults to the
# highest kernel version. Any kernel provided by apt.freedom.press must
# suprecede the ones provided by Ubuntu.
sed -i '/^GRUB_DEFAULT=/s/=.*/=0/' /etc/default/grub
# Force latest hardened kernel for next boot
set_grub_default
# When using CONFIG_PAX_KERNEXEC, the grsecurity team recommends the kernel
# is booted with "noefi" on the kernel command line if "CONFIG_EFI" is
# enabled, as EFI runtime services are necessarily mapped as RWX.
Expand Down