[gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Anthony G. Basile]

Hi everyone,

Since late April, grsecurity upstream has stop making their patches
available publicly.  Without going into details, the reason for their
decision revolves around disputes about how their patches were being
(ab)used.

Since the grsecurity patch formed the main core of our hardened-sources
kernel, their decision has serious repercussions for the Hardened Gentoo
project.  I will no longer be able to support hardened-sources and will
have to eventually mask and remove it from the tree.

Hardened Gentoo has two sides to it, kernel hardening (done via
hardened-sources) and toolchain/executable hardening.  The two are
interrelated but independent enough that toolchain hardening can
continue on its own.  The hardened kernel, however, provided PaX
protection for executables and this will be lost.  We did a lot of work
to properly maintain PaX markings in our package management system and
there was no part of Gentoo that wasn't touched by issues stemming from
PaX support.

I waited two months before saying anything because the reasons were more
of a political nature than some technical issue.  At this point, I think
its time to let the community know about the state of affairs with
hardened-sources.

I can no longer get into the #grsecurity/OFTC channel (nothing personal,
they kicked everyone), and so I have not spoken to spengler or pipacs.
I don't know if they will ever release grsecurity patches again.

My plan then is as follows.  I'll wait one more month and then send out
a news item and later mask hardened-sources for removal.  I don't
recommend we remove any of the machinery from Gentoo that deals with PaX
markings.

I welcome feedback.

-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Vadim A. Misbakh-Soloviov]

> I welcome feedback.

And how about KSPP and other similar projects, that tries to continue the idea 
of community-friendly development based on latest release available to wide 
public (or, maybe some other, that was grown in parallel with PaX)?




[OFFTOP]
I personally very dislike Brad's behaviour.
Not only closing the source from public.
Not only blackmail to ban from updates for customers that will public the 
patches.
But also his trolling against KSPP:
Firstly he cried they steal his work (yup, steal. OpenSource. Lol).
Then he stated that he wants that KSPP stated *both* that their work is based 
on Grsec *and* that they have no connection with grsecurity at the *same 
time*.

So, it looks like he does not really care about Linux Security. He only cares 
about his business.
Which is against my vision of opensource community principles.
So, since that time I have no non-offensive words to describe him anymore.

So, I previously decided to take latest available hardened-sources patchset 
and maintain it (mostly, fix for new kernel releases) locally for my needs, 
until Gentoo Hardened will migrate to KSPP, or KSPP will merge all of the work 
into "vanilla" Linux.

But since I read this notice, I'm very sad about the destiny of Gentoo 
Hardened. It was the best solution for production servers, imho. But news like 
that makes people think that it (Hardened Gentoo) starts pre-death agonia. And 
that's very and very sad :'(
[/OFFTOP]

[gentoo-dev] Re: [gentoo-project] The status of grsecurity upstream and hardened-sources downstream

[Alice Ferrazzi]

On Sat, Jun 24, 2017 at 1:28 AM, Anthony G. Basile <blueness@gentoo.org> wrote:
>
> Hi everyone,
>
> Since late April, grsecurity upstream has stop making their patches
> available publicly.  Without going into details, the reason for their
> decision revolves around disputes about how their patches were being
> (ab)used.
>
> Since the grsecurity patch formed the main core of our hardened-sources
> kernel, their decision has serious repercussions for the Hardened Gentoo
> project.  I will no longer be able to support hardened-sources and will
> have to eventually mask and remove it from the tree.
>
> Hardened Gentoo has two sides to it, kernel hardening (done via
> hardened-sources) and toolchain/executable hardening.  The two are
> interrelated but independent enough that toolchain hardening can
> continue on its own.  The hardened kernel, however, provided PaX
> protection for executables and this will be lost.  We did a lot of work
> to properly maintain PaX markings in our package management system and
> there was no part of Gentoo that wasn't touched by issues stemming from
> PaX support.
>
> I waited two months before saying anything because the reasons were more
> of a political nature than some technical issue.  At this point, I think
> its time to let the community know about the state of affairs with
> hardened-sources.
>
> I can no longer get into the #grsecurity/OFTC channel (nothing personal,
> they kicked everyone), and so I have not spoken to spengler or pipacs.
> I don't know if they will ever release grsecurity patches again.
>
> My plan then is as follows.  I'll wait one more month and then send out
> a news item and later mask hardened-sources for removal.  I don't
> recommend we remove any of the machinery from Gentoo that deals with PaX
> markings.
>
> I welcome feedback.
>

As we already contribute to grsec in the past,
would be sad to see hardened-sources go away.
What about the possibility of Gentoo forking PaX ?

-- 
Thanks,
Alice Ferrazzi

Gentoo Kernel Project Leader
Mail: Alice Ferrazzi <alicef@gentoo.org>
PGP: 2E4E 0856 461C 0585 1336 F496 5621 A6B2 8638 781A

Re: [gentoo-dev] Re: [gentoo-project] The status of grsecurity upstream and hardened-sources downstream

[Roy Bamford]

[-- Attachment #1: Type: text/plain, Size: 638 bytes --]

On 2017.06.23 19:54, Alice Ferrazzi wrote:
[snip]
> 
> As we already contribute to grsec in the past,
> would be sad to see hardened-sources go away.
> What about the possibility of Gentoo forking PaX ?
> 
> -- 
> Thanks,
> Alice Ferrazzi
> 
> Gentoo Kernel Project Leader
> Mail: Alice Ferrazzi <alicef@gentoo.org>
> PGP: 2E4E 0856 461C 0585 1336 F496 5621 A6B2 8638 781A
> 
> 

Alice,

Forking with what aim?
Keeping the existing functionality alive in line with kernel 
developments or that and adding new features.  

-- 
Regards,

Roy Bamford
(Neddyseagoon) a member of
elections
gentoo-ops
forum-mods

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] Re: [gentoo-project] The status of grsecurity upstream and hardened-sources downstream

[Alice Ferrazzi]

On Sat, Jun 24, 2017 at 5:48 AM, Roy Bamford <neddyseagoon@gentoo.org> wrote:
> On 2017.06.23 19:54, Alice Ferrazzi wrote:
> [snip]
>>
>> As we already contribute to grsec in the past,
>> would be sad to see hardened-sources go away.
>> What about the possibility of Gentoo forking PaX ?
>>
>> --
>> Thanks,
>> Alice Ferrazzi
>>
>> Gentoo Kernel Project Leader
>> Mail: Alice Ferrazzi <alicef@gentoo.org>
>> PGP: 2E4E 0856 461C 0585 1336 F496 5621 A6B2 8638 781A
>>
>>
>
> Alice,
>
> Forking with what aim?
> Keeping the existing functionality alive in line with kernel
> developments or that and adding new features.
>

As now we have not enough resource for add new feature,
we can maybe consider to keep alive PaX.

I heard that also Alpine linux is thinking what to do.
Maybe we could ask to merge the efforts.

https://forum.alpinelinux.org/forum/pax-grsecurity/future-grsecurity-alpine


-- 
Thanks,
Alice Ferrazzi

Gentoo Kernel Project Leader
Mail: Alice Ferrazzi <alicef@gentoo.org>
PGP: 2E4E 0856 461C 0585 1336 F496 5621 A6B2 8638 781A

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Daniel Campbell]

[-- Attachment #1.1: Type: text/plain, Size: 2311 bytes --]

On 06/23/2017 09:28 AM, Anthony G. Basile wrote:
> Hi everyone,
> 
> Since late April, grsecurity upstream has stop making their patches
> available publicly.  Without going into details, the reason for their
> decision revolves around disputes about how their patches were being
> (ab)used.
> 
> Since the grsecurity patch formed the main core of our hardened-sources
> kernel, their decision has serious repercussions for the Hardened Gentoo
> project.  I will no longer be able to support hardened-sources and will
> have to eventually mask and remove it from the tree.
> 
> Hardened Gentoo has two sides to it, kernel hardening (done via
> hardened-sources) and toolchain/executable hardening.  The two are
> interrelated but independent enough that toolchain hardening can
> continue on its own.  The hardened kernel, however, provided PaX
> protection for executables and this will be lost.  We did a lot of work
> to properly maintain PaX markings in our package management system and
> there was no part of Gentoo that wasn't touched by issues stemming from
> PaX support.
> 
> I waited two months before saying anything because the reasons were more
> of a political nature than some technical issue.  At this point, I think
> its time to let the community know about the state of affairs with
> hardened-sources.
> 
> I can no longer get into the #grsecurity/OFTC channel (nothing personal,
> they kicked everyone), and so I have not spoken to spengler or pipacs.
> I don't know if they will ever release grsecurity patches again.
> 
> My plan then is as follows.  I'll wait one more month and then send out
> a news item and later mask hardened-sources for removal.  I don't
> recommend we remove any of the machinery from Gentoo that deals with PaX
> markings.
> 
> I welcome feedback.
> 
Thanks for taking the time to let the greater Gentoo community know.
It's a shame things took this turn... Is there any hope of a fork
emerging from the drama? Why would a security-conscious group take their
toys and go home? Regardless, this is a loss for Linux as a whole. I
hope something springs up in its place.

-- 
Daniel Campbell - Gentoo Developer
OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[gentoo-dev] Re: [gentoo-project] The status of grsecurity upstream and hardened-sources downstream

[Sergei Trofimovich]

[-- Attachment #1: Type: text/plain, Size: 373 bytes --]

On Fri, 23 Jun 2017 12:28:27 -0400
"Anthony G. Basile" <blueness@gentoo.org> wrote:

> My plan then is as follows.  I'll wait one more month and then send out
> a news item and later mask hardened-sources for removal.  I don't
> recommend we remove any of the machinery from Gentoo that deals with PaX
> markings.

Thanks for the status update!

-- 

  Sergei

[-- Attachment #2: Цифровая подпись OpenPGP --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Alexis Ballier]

On Fri, 23 Jun 2017 12:28:27 -0400
"Anthony G. Basile" <blueness@gentoo.org> wrote:

> Hardened Gentoo has two sides to it, kernel hardening (done via
> hardened-sources) and toolchain/executable hardening.  The two are
> interrelated but independent enough that toolchain hardening can
> continue on its own.  The hardened kernel, however, provided PaX
> protection for executables and this will be lost.  We did a lot of
> work to properly maintain PaX markings in our package management
> system and there was no part of Gentoo that wasn't touched by issues
> stemming from PaX support.


Good luck to them at providing a complete userland ecosystem for using
pax protection. Good luck at getting people accept and review their
often crashing asm patches at upstream projects that won't even be able
to test their benefits.

Maybe we should start a business for this ? :)
http://static.sstic.org/videos2015/SSTIC_2015-06-03_P08_CLIP.mp4
(This is for Patrice)



We'll need to decide what to do with things like USE=pic. For media
packages this is not something you usually want to enable as you can
bear the 10Mb relocations at startup to have 10% or more performance
improvement when reading your 2hours long movie.


Alexis.

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Anthony G. Basile]

On 6/24/17 6:04 AM, Alexis Ballier wrote:
> On Fri, 23 Jun 2017 12:28:27 -0400
> "Anthony G. Basile" <blueness@gentoo.org> wrote:
> 
>> Hardened Gentoo has two sides to it, kernel hardening (done via
>> hardened-sources) and toolchain/executable hardening.  The two are
>> interrelated but independent enough that toolchain hardening can
>> continue on its own.  The hardened kernel, however, provided PaX
>> protection for executables and this will be lost.  We did a lot of
>> work to properly maintain PaX markings in our package management
>> system and there was no part of Gentoo that wasn't touched by issues
>> stemming from PaX support.
> 
> 
> Good luck to them at providing a complete userland ecosystem for using
> pax protection. Good luck at getting people accept and review their
> often crashing asm patches at upstream projects that won't even be able
> to test their benefits.
> 
> Maybe we should start a business for this ? :)
> http://static.sstic.org/videos2015/SSTIC_2015-06-03_P08_CLIP.mp4
> (This is for Patrice)

Correct.  Zorry, myself and others on the hardened team did a lot to
make userland play nice with the hardened-kernel.  It represents most of
my effort in Gentoo.

> 
> 
> 
> We'll need to decide what to do with things like USE=pic. For media
> packages this is not something you usually want to enable as you can
> bear the 10Mb relocations at startup to have 10% or more performance
> improvement when reading your 2hours long movie.

It will be a mess going forward.  We will necessarily have to start
dropping pax related stuff, if for no other reason than we can't support
making a package work under pax if we have no pax enabled kernel to test
on.  Once this is gone, such bugs will float upstream to pipacs and
spender.  "Good luck" is right.

> 
> 
> Alexis.
> 


-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Joshua Kinard]

On 06/23/2017 12:28, Anthony G. Basile wrote:
> Hi everyone,
> 
> Since late April, grsecurity upstream has stop making their patches
> available publicly.  Without going into details, the reason for their
> decision revolves around disputes about how their patches were being
> (ab)used.
> 
> Since the grsecurity patch formed the main core of our hardened-sources
> kernel, their decision has serious repercussions for the Hardened Gentoo
> project.  I will no longer be able to support hardened-sources and will
> have to eventually mask and remove it from the tree.
> 
> Hardened Gentoo has two sides to it, kernel hardening (done via
> hardened-sources) and toolchain/executable hardening.  The two are
> interrelated but independent enough that toolchain hardening can
> continue on its own.  The hardened kernel, however, provided PaX
> protection for executables and this will be lost.  We did a lot of work
> to properly maintain PaX markings in our package management system and
> there was no part of Gentoo that wasn't touched by issues stemming from
> PaX support.
> 
> I waited two months before saying anything because the reasons were more
> of a political nature than some technical issue.  At this point, I think
> its time to let the community know about the state of affairs with
> hardened-sources.
> 
> I can no longer get into the #grsecurity/OFTC channel (nothing personal,
> they kicked everyone), and so I have not spoken to spengler or pipacs.
> I don't know if they will ever release grsecurity patches again.
> 
> My plan then is as follows.  I'll wait one more month and then send out
> a news item and later mask hardened-sources for removal.  I don't
> recommend we remove any of the machinery from Gentoo that deals with PaX
> markings.
> 
> I welcome feedback.
> 

So short-term, what's the next step one can do to hop off the hardened-sources
train before it runs out of track without a full rebuild?  I'm planning on a
full rebuild/re-install eventually for my dev box, but it has been stuck on
kernel 4.9.x since this shindig went down and I'd like to get ahead to 4.11 or
4.12 instead of using my SGI machines to discover new surprises.

Safe for now to just switch to gentoo-sources while retaining hardened
toolchain?  Or would there be a few additional steps needed?  I only use PaX
for mprotect() and the ALSR capabilities, though I suspect those might be in
the standard sauce by now.  As such, I haven't had to deal with userland issues
and PaX too much over the years.

-- 
Joshua Kinard
Gentoo/MIPS
kumba@gentoo.org
6144R/F5C6C943 2015-04-27
177C 1972 1FB8 F254 BAD0 3E72 5C63 F4E3 F5C6 C943

"The past tempts us, the present confuses us, the future frightens us.  And our
lives slip away, moment by moment, lost in that vast, terrible in-between."

--Emperor Turhan, Centauri Republic

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Alice Ferrazzi]

[-- Attachment #1: Type: text/plain, Size: 237 bytes --]

Linus Torvald on grsecurity:
https://www.spinics.net/lists/kernel/msg2540934.html


-- 
Thanks,
Alice Ferrazzi

Gentoo Kernel Project Leader
Mail: Alice Ferrazzi <alicef@gentoo.org>
PGP: 2E4E 0856 461C 0585 1336 F496 5621 A6B2 8638 781A

[-- Attachment #2: Type: text/html, Size: 405 bytes --]

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Jason A. Donenfeld]

On Mon, Jun 26, 2017 at 9:30 AM, Alice Ferrazzi <alicef@gentoo.org> wrote:
>
> Linus Torvald on grsecurity:
> https://www.spinics.net/lists/kernel/msg2540934.html

Spender responds:
http://www.openwall.com/lists/oss-security/2017/06/24/1

Popcorn worthy thread.

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 482 bytes --]

On Mon, 26 Jun 2017 16:30:41 +0900
Alice Ferrazzi <alicef@gentoo.org> wrote:

> Linus Torvald on grsecurity:
> https://www.spinics.net/lists/kernel/msg2540934.html

Linus maybe responsible for Linux, but also things like Dirty Cow. Not
sure how I feel about him and security, given that neglect.

https://dirtycow.ninja/
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619

-- 
William L. Thomson Jr.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Luis Ressel]

[-- Attachment #1: Type: text/plain, Size: 924 bytes --]

On Sun, 25 Jun 2017 23:47:48 -0400
Joshua Kinard <kumba@gentoo.org> wrote:

> Safe for now to just switch to gentoo-sources while retaining hardened
> toolchain?  Or would there be a few additional steps needed?  I only
> use PaX for mprotect() and the ALSR capabilities, though I suspect
> those might be in the standard sauce by now.  As such, I haven't had
> to deal with userland issues and PaX too much over the years.

A full rebuild shouldn't be neccessary after a switch to gentoo-sources
or vanilla-sources. At least, I can't think of any reason why it would,
and I haven't encountered any problems after switching on my own hosts.

Just keep in mind that vanilla-sources doesn't support the PaX xattrs
properly (AFAIR), so if you ever want to switch *back* from vanilla to
hardened, some pax markings will be missing. This shouldn't be an issue
for gentoo-sources, though.

Cheers,
Luis Ressel

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] The status of grsecurity upstream and hardened-sources downstream

[Joshua Kinard]

On 06/26/2017 09:15, Luis Ressel wrote:
> On Sun, 25 Jun 2017 23:47:48 -0400
> Joshua Kinard <kumba@gentoo.org> wrote:
> 
>> Safe for now to just switch to gentoo-sources while retaining hardened
>> toolchain?  Or would there be a few additional steps needed?  I only
>> use PaX for mprotect() and the ALSR capabilities, though I suspect
>> those might be in the standard sauce by now.  As such, I haven't had
>> to deal with userland issues and PaX too much over the years.
> 
> A full rebuild shouldn't be neccessary after a switch to gentoo-sources
> or vanilla-sources. At least, I can't think of any reason why it would,
> and I haven't encountered any problems after switching on my own hosts.
> 
> Just keep in mind that vanilla-sources doesn't support the PaX xattrs
> properly (AFAIR), so if you ever want to switch *back* from vanilla to
> hardened, some pax markings will be missing. This shouldn't be an issue
> for gentoo-sources, though.
> 
> Cheers,
> Luis Ressel
> 

The machine needs a full rebuild just to "freshen" it up.  Current install is
going on 6-7+ years, at least three different motherboard/CPU cycles, and the
SATA drives are pushing 8+ years old at this point in that machine.  The same
drives were previously in my desktop machine between ~2006-2008, so they've had
a *great* run for spinning rust.  I've got new'ish replacement drives and a new
drive bay recently arrived, so the grsecurity mess was the straw that broke the
proverbial camel's back.

Just a matter of getting the needed downtime to move data off,
rebuild/reinstall everything, move stuff back, and check for broken bits.
Until then, I wasn't sure if switching to gentoo-sources would have any
side-effects with the hardened userland to get to a newer kernel.

-- 
Joshua Kinard
Gentoo/MIPS
kumba@gentoo.org
6144R/F5C6C943 2015-04-27
177C 1972 1FB8 F254 BAD0 3E72 5C63 F4E3 F5C6 C943

"The past tempts us, the present confuses us, the future frightens us.  And our
lives slip away, moment by moment, lost in that vast, terrible in-between."

--Emperor Turhan, Centauri Republic