4.9.70 under:
https://www.croatiafidelis.hr/gnu/deb/l … c-current/
(i.e. https://www.croatiafidelis.hr/gnu/deb/l … 171220-11/ )
For those who verify, ls-1.sum.asc is missing. Busy, but it's coming later.
EDIT 2017-12-21 09:30:44+00:00, there now:
https://www.croatiafidelis.hr/gnu/deb/l … -1.sum.asc

Also great to read from golinux!

There's
kernel tried to execute NX-protected page - exploit attempt?
https://github.com/minipli/linux-unoffi … -348678535
Aahh..., I gave a particular subpage... But, never mind, read how good grsec-unoff is, all visitors! And it's all linked from there.

No, that's not what I asked, you can, if you don't take me wrong, pls. don't do, reread what I asked.
See also...

But I have to post this temporarily, incomplete, else I might lose it... attacked too often lately...

Continuing. Pls read those traces linked from above that alomost undeniably indicate attemped intrusions and forgive my stuttered posting

That note was for other future users of eudev

The problem is Qubes, IIRC, can't be used without dbus, and I don't have dbus, and don't want to use it, don't trust it.... My Devuan is  sans-dbus.
Else, I read about Qubes, I have their paxrat installed in my box.

On my AMD64 it's PSP, not ME.
Regards!

I apologize to have to prolong the story I announced in this topic.

Other attacks (unconfirmed by experts following there, so pls. wait for replies in the below):

https://github.com/minipli/linux-unoffi … /issues/19
https://github.com/minipli/linux-unoffi … /issues/18
https://github.com/minipli/linux-unoffi … /issues/17
https://github.com/minipli/linux-unoffi … /issues/13

have happened in the meantime, and those, and other in links from below, took huge time for me to analyze:

https://www.croatiafidelis.hr/foss/cap/ … -RAP-Oops/

Regards!

My views on it are in my signature. (important: the ripoff by Google, but read there spender's statement or roll back for more verbose view of mine

Not in the future, you already have to pay for it. But not the unofficial-grsecurity which is completely open, and which I talk about and post packages of, since the closure of free official grsecurity.

You do point to another... erhm...historical remark by Linus... Appreciated!

But no time for discussion here on my part, too many things to solve are on my hands instead.

The patches, I believe, are still good, the unofficial ones, but surely more testing would be needed by more people!

This post copy-paste removed over from the below post of this topic:
OpenRC installation in Devuan Ascii
https://dev1galaxy.org/viewtopic.php?id=1128#p6015
---

In case you are referring to my post some one hour ago, not yet. You're not missing. But figure out that the SHA256 sums might be for some crypto identifying a future analysis, by starting here:

BAD sig with Devuan Jessie 1.0.0-RC
https://dev1galaxy.org/viewtopic.php?id=568
and also look up:
[ same title as above ]
https://lists.dyne.org/lurker/message/2 … 59.en.html
and try not to miss:
[ same title as above, since in the same thread ]
https://lists.dyne.org/lurker/message/2 … f4.en.html

I've worked hard, and... I can't repeat myself. See again the previous post if you are, but don't be, impatient to know, because I can't satisfy impatience here. I'm not so very advanced... Thank you.

I'll be busy in the next days, and I may even find it too hard to tell much soon at all... I've needed to even update some of my (somewhat primitive) programs on github to be able to deal with understanding the intrusion... And I'm not a wizzard...

More patience, and I'll make a separate topic, once I, God willing, make it...
---
But notice that I don't want to touch the stamps on the previous post with the hashes:
https://dev1galaxy.org/viewtopic.php?id=1128#p6007
And I don't want to repost those here either, not duplicating things.

Now I got to analyze also the trace that went captured as I wrote this... I often get surprises, and very unseemly and unsavory... It's often is a very demanding struggle...

Regards!

Yep!... But please have patience. These are hard stuff... some expertize to fight to gain... Tired...

e2a781c8a91233bab06c1808b5fdc94aea719b753eeab5d51bc2c7363cff4a82
50ba5468cca0fb2b680aa3defee9d954ec80b1b3d684d86d3678590ac7c5d723
b756f4016d5f4ca15995eaf03e633f83897208ccbcdcd2505fad3d953450c4d0
74775e06b33558cdf9f5432de953fa46f40280a35dd9f941ec29e04022059e01
980f7d350232df4bc9fa58c574888ead4e4d2f6dc62cc032b1aa4e0ec7791eb9
5d02f76d469a1660ae13784c4e6baa1876c7d01a18fe7bf0433e374c211bd892
39e3768157f666cb2f227f7712e5002bd84bb97ff797c784f1c1a2657eaf8c31
3f105964bb6f15190a184a78967392b82e4db7da448e4c22124cdf122d8bafee
b5de4481920edee8cb4ef7b5dacc575009e8069e432b26813522487041e80199
f2d6441c9311fc802be9f994eae28e99c28f23519929f386a03fa545b9fe5067
e644ec793e4dea6dc4ada4ea14ee93a6ea7a298eb69a7ca0c0cce12d397f2cdd

Allow time...
( BTW, pls also allow this post... Some of the admins know that I do have some understanding about network and such... The above is recent. But too much work to explain quickly, and like now with this posting, it will be way more credible. But I'll open a separate topic for it... Thank you...)

If I don't fix the warnings by user downloading of the new packages, the warnings are here;
https://www.croatiafidelis.hr/gnu/deb/l … 170923-22/
( but don't use those old packages )
And the packages are here:

linux-deb-4.9.52-unofficial+grsec170929-07
https://www.croatiafidelis.hr/gnu/deb/l … 170929-07/

I think it's a good kernel... Barring some tests and some research/advice that I've been seeking as per the warnings page...

In case there's anybody looking more seriously into these quirks/(exploits?), the system is Asrock Extreme 4
https://www.asrock.com/mb/AMD/970%20Extreme4/
You can also find out more datails at:
Use old amd64 gentoo image on new amd64 hardware, possible?
https://forums.gentoo.org/viewtopic-t-940916.html
That's when I bought those MBO's and most of the other components.

The one and the other change not be of the kind to put together as similar (not saying that you are doing so).
The change with Xorg is praisewothy (but probably came to be because the exploits went mad on Xorg...), the other change is sad as can be...
fsmithred, I just sent an email to dng mailing list (and to a few Devauners of the thread on Xorg, one of them being you).
And then I see this documentation post...
Good! Let's wait and see if my email to DNG ML appears at:
...
Gosh! It appeared! Phew! Feeling muuuch better now !
Here:

Subject: Re: [DNG] upgrade from Debian stretch to Devuan ascii?
https://lists.dyne.org/lurker/message/2 … f1.en.html

Readers here, take note that it is absolutely best for security of your Devuan boxen if you manage to use Xorg the new way, not as root!

Happy !

I've posted what I promised at:
Strange script planted with Bash 2
https://www.croatiafidelis.hr/foss/cap/ … bash-2.php

I don't believe the possible issue here, and it does seem to me to be something very fishy in there... is related in particular way to Devuan, other than Devuan being a Linux, the vulnerable distro, because the good ways have been rejected because the geniuses that kept patching Mr Linux's kernel were attempted to be ripped off of their code, by Google, and likely in (but that I don't claim) with at least the approval of, if not in cahoots with, the aforesaid mister in charge...

Ah, but grsecurity has been taken the baton of by, I hope to God, competent people, one of them being our own, Devuan's own developer parazyd! I hope miniply, parazyd and friends make it... (Read about it in the link to grsec installation on Devuan below, in post(s) three days ago or so, of mine there.)

Aah...

Use grsecurity:

Grsecurity/Pax installation on Devuan GNU/Linux
https://dev1galaxy.org/viewtopic.php?id=596

It's the only hope left for Linux kernel's security...

This explanation is missing (due to political, and even criminal --morally so-- reasons grsec is not in widespread use [1]):

mr@gdOv:~$ sudo -s
[sudo] password for root: 
root@gdOv:/home/mr# ls -l /proc/sys/kernel/grsecurity/^C
root@gdOv:/home/mr# echo 0 > /proc/sys/kernel/grsecurity/exec_logging ; echo 0 > /proc/sys/kernel/grsecurity/audit_chdir ; 
root@gdOv:/home/mr# echo 1 > /proc/sys/kernel/grsecurity/exec_logging ; echo 1 > /proc/sys/kernel/grsecurity/audit_chdir ; 
root@gdOv:/home/mr# echo 0 > /proc/sys/kernel/grsecurity/tpe ; 
tpe               tpe_gid           tpe_restrict_all  
root@gdOv:/home/mr# cat /proc/sys/kernel/grsecurity/tpe ; 
1
root@gdOv:/home/mr# cat /proc/sys/kernel/grsecurity/tpe_restrict_all ; 
1
root@gdOv:/home/mr# echo 0 > /proc/sys/kernel/grsecurity/tpe ; echo 0 >  /proc/sys/kernel/grsecurity/tpe_restrict_all ; 
root@gdOv:/home/mr# 

The setting to disable exec_logging with "echo 0", and likewise the setting to disable of audit_chdir is if you compile with exec_logging and audit_chdir. Enable it again with the "echo 1 ..." line.

Currently, and I don't know why, the tpe  ([T]rusted [P]ath [E]xecution, pls. read in the kernel help when you issue "menu makeconfig" about it), just does not work right in Devuan/Debian/Ubuntu. E.g. I couldn't run any scripts from /usr/local/bin because of it. So, disabling it with issuing the two "echo 0 ..." lines.

---
[1] Pls. see my sig for that... BTW, my current sig links to:
https://forums.grsecurity.net/viewtopic … 699#p17127
https://lists.dyne.org/lurker/message/2 … 4b.en.html
in case that should change in the future.