Dev1 Galaxy Forum / Grsecurity/Pax installation on Devuan GNU/Linux

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (groog.17) — Sun, 13 Jan 2019 10:38:11 +0000

miroR wrote:

and grsec/dappersec can't protect you from those...

In fact they can. https://grsecurity.net/respectre_announce.php

Respectre™ is a nod to the Spectre speculation attack and signifies that it (re)veals potential Spectre vulnerabilities, (re)spects the original intent of the code, and automatically (re)factors it via a compiler plugin to eliminate speculation-based side channels.

The point is how to get it, when they even do not answer emails.

Best regards.

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Sun, 07 Oct 2018 13:40:46 +0000

Regarding a tiny comparison on Debian Forums at:
http://forums.debian.net/viewtopic.php? … 59#p679387

I wrote:

So... It's still probably safer with the free grsec kernel (dappersec)... Sorely missing the protections from Meltdown and Spectre, but most other protectiions are in place. And pls. note that it's a dev from the KSPP team. Hardly biased towards grsec.

No, it's probably not... While I haven't sudied those in depth, it's probably the Meltdown and Spectre that are the most important to have countermeasures in your kernel against, and grsec/dappersec can't at this time, and there seem no interest from spender and PaX Team, the authors... and grsec/dappersec can't protect you from those...
I think I'm closing my engagement with what is left in the open FOSS world of grsecurity.

Regards!

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Mon, 24 Sep 2018 10:40:11 +0000

https://www.croatiafidelis.hr/gnu/deb/l … 180924-07/
see previous posts for how to install it and other.

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Fri, 14 Sep 2018 18:23:13 +0000

https://www.croatiafidelis.hr/gnu/deb/l … 180914-10/
see previous posts for how to install it and other.

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Tue, 21 Aug 2018 03:51:09 +0000

https://www.croatiafidelis.hr/gnu/deb/l … 180820-16/
see previous posts for how to install it and other.

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Fri, 17 Aug 2018 19:42:22 +0000

https://www.croatiafidelis.hr/gnu/deb/l … 180816-16/
see previous posts for how to install it and other.

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Fri, 10 Aug 2018 13:26:16 +0000

https://www.croatiafidelis.hr/gnu/deb/l … 180810-06/
see previous posts for how to install it and other.

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Fri, 27 Jul 2018 18:01:14 +0000

https://www.croatiafidelis.hr/gnu/deb/l … 180727-10/ (under https://www.croatiafidelis.hr/gnu/deb/l … -current/)
Tested on three machines (but MBO are of only two kinds). No issues.
Refer to previous post for tips if needed.

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Wed, 11 Jul 2018 12:28:24 +0000

New stable packages:
https://www.croatiafidelis.hr/gnu/deb/l … 180710-21/
( https://www.croatiafidelis.hr/gnu/deb/l … c-current/ )
Any difficulty installing, pls. review previous long posts... (I'm probably too short on time currently)

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Fri, 01 Jun 2018 13:29:13 +0000

The offered packages in the previous post (no issues have I had so far) are for any system hardware (well: x86_64 arch only).

The best way is surely, to compile. Nothing wrong with the other option. It's only that tailoring the compiled kernel for only your hardware reduces the huge attack surface.

While Dapper Secure Kernel Patchset (
https://github.com/dapperlinux/dapper-s … e/releases
) is still grsecurity, my script for newbies has changed to help new GNU-Debianers/Devuaners who want to look into kernel compiling.

So pls. look up:

https://github.com/miroR/grsec-dapper-compile/

I'm not sure, you might need to get dapper-linux PGP key from:

https://dapperlinux.com/contact.html
https://dapperlinux.com/matthew_gpg_public_key.asc

Regards!

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Fri, 01 Jun 2018 11:50:35 +0000

The:
https://www.croatiafidelis.hr/gnu/deb/l … c-current/
now points to:
https://www.croatiafidelis.hr/gnu/deb/l … 180601-06/
That is the kernel package for Debian/Devuan that _may_ be worth trying out, bearing in mind the caveats of Dapper Linux patchset:
https://dapperlinux.com/
I.e. no meltdown protection, no spectre protection, currently no retpoline.

However, all the othe usual protection that grsec offered are there. And the kernel is up to date.

I am testing that kernel right now, it appears to be fine.

If you want to use it, pls. see previous posts, there are a lot of info how to dowload it, how to verify it, etc.

Regards!

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Tue, 06 Feb 2018 05:30:43 +0000

It might be worth trying (and reporting if you can install and load amd64-microcode with):
https://www.croatiafidelis.hr/gnu/deb/l … 180204-21/
Pls. read there, and the links, for the details.

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Sun, 04 Feb 2018 07:41:43 +0000

Retpoline-patched grsecunoff (AMD, butno meltdown protection yet for Intel) available under the "current" link, or:
https://www.croatiafidelis.hr/gnu/deb/l … 180203-22/

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (miroR) — Fri, 29 Dec 2017 17:31:05 +0000

golinux wrote:

Wishing you a happy new year MiroR. And everyone else too of course . . .

Thanks! To everyone Happy New Year (and Merry Xmas for those who wish)!

Re: Grsecurity/Pax installation on Devuan GNU/Linux

dummy@example.com (golinux) — Fri, 29 Dec 2017 17:04:46 +0000

Wishing you a happy new year MiroR. And everyone else too of course . . .