Re: [gentoo-dev] Regarding the State of PaX in the tree

["Hanno Böck" <hanno@gentoo.org>]

Hi,

I honestly don't see how it would be feasible to maintain a feature
that the developers maintaining it have access to.

I get that this whole pax-thing embodies a huge part of Gentoo history
and it may feel hard for some to let it go. But things are how they are.

Regarding the fork states: I followed up on minipli's fork, which
tried to maintain newer patches of grsec for LTS kernels, but that
essentially stopped after KPTI/meltdown/retpoline. From what I know
there's no public grsec patch with kpti or any spectre fixes, thus I
would very much say you're safer these days with an upstream kernel.

I think the only realistic way this support can be upheld would be if
some people who have access to the grsec sources commit to making sure
that it is maintained.


There's also another question related to this: What's the future for
Gentoo hardened?
From what I can tell hardened consists of:
* the things that try to make it compatible with grsec/pax
  (more or less obsolete).
* things that are now in default profiles anyway (aslr, stack
  protector).
* things that probably should be in default profiles (relro, now linker
  flags)
* -fstack-check, which should eventually be replaced with
  -fstack-clash-protection (only available in future gcc's) and that
  should probably also go into default profiles.
* Furthermore hardened disables some useful features due to their
  incompatibility with pax (e.g. sanitizers).

So it's stuff that either is obsolete or probably should be a candidate
for main profiles. Maybe we should strive for "hardened-by-default".

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@hboeck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42