From: "Francisco Blas Izquierdo Riera (klondike)" <klondike@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Cc: pr@gentoo.org, gentoo-hardened@lists.gentoo.org
Subject: [gentoo-hardened] Re: [gentoo-dev] New item for sys-kernel/hardened-sources removal
Date: Tue, 15 Aug 2017 22:07:05 +0200 [thread overview]
Message-ID: <89529177-d896-42a0-e57c-2d4bb07edbf1@gentoo.org> (raw)
In-Reply-To: <22931.7313.608217.152058@a1i15.kph.uni-mainz.de>
[-- Attachment #1.1.1: Type: text/plain, Size: 1249 bytes --]
El 15/08/17 a las 18:08, Ulrich Mueller escribió:
>>>>>> On Tue, 15 Aug 2017, Francisco Blas Izquierdo Riera (klondike) wrote:
>> Updated the news item following comments from dilfridge, mrueg and
>> floppym. Also made it display to users of hardened profiles.
> Some very minor comments:
>
>> Author: Francisco Blas Izquierdo Riera (klondike) <klondike@gentoo.org>
> Format of the line is "Real Name <email@address>", so I'd suggest to
> drop the nick in parentheses, especially since it is there in the
> e-mail address anyway.
>
>> Because of that we will be masking the hardened-sources on the 27th of
>> August and will proceed to remove then from the tree by the end of
>> September. [...]
> s/then/them/
>
>> As an alternative, for users happy keeping themselves on the stable
>> 4.9 branch of the kernel minipli, another Grsec user, is forward
>> porting the patches on [3].
> I had difficulties parsing this sentence. Insert a comma after
> "kernel"? Also there is spurious whitespace before "stable".
>
> Ulrich
Thanks for your input, I have addressed your comments on the attached
news item.
I have also added a note regarding the other PaX related packages as
these won't stil be removed.
Klondike
[-- Attachment #1.1.2: 2017-08-19-hardened-sources-removal.en.txt --]
[-- Type: text/plain, Size: 2374 bytes --]
Title: sys-kernel/hardened-sources removal
Author: Francisco Blas Izquierdo Riera <klondike@gentoo.org>
Posted: 2017-08-19
Revision: 3
News-Item-Format: 2.0
Display-If-Installed: sys-kernel/hardened-sources
Display-If-Profile: hardened/linux/*
As you may know the core of sys-kernel/hardened-sources have been the
patches published by Grsec.
Sadly, their developers have stopped making these patches freely
available [1]. This is a full stop of any public updates and not only
stable ones as was announced two years ago[2].
As a result, the Gentoo Hardened team is unable to keep providing
further updates of the patches, and although the hardened-sources have
proved (when using a hardened toolchain) being resistant against
certain attacks like the stack guard page jump techniques proposed by
Stack Clash, we can't ensure a regular patching schedule and therefore,
the security of the users of these kernel sources.
Because of that we will be masking the hardened-sources on the 27th of
August and will proceed to remove them from the tree by the end of
September. Obviously, we will reinstate the package again if the
developers decide to make their patches publicly available again.
Our recommendation is that users should consider using instead
sys-kernel/gentoo-sources.
As an alternative, for users happy keeping themselves on the stable
4.9 branch of the kernel; minipli, another Grsec user, is forward
porting the patches on [3].
Strcat from Copperhead OS is making his own version of the patches
forward ported to the latest version of the Linux tree at [4].
The Gentoo Hardened team can't make any statement regarding the
security, reliability or update availability of either those patches
as we aren't providing them and can't therefore make any
recommendation regarding their use.
We'd like to note that all the userspace hardening and MAC support
for SELinux provided by Gentoo Hardened will still remain there and
is unaffected by this removal. Also, all PaX related packages other
than the hardened-sources will remain for the time being.
[1] https://grsecurity.net/passing_the_baton.php
[2] https://www.gentoo.org/support/news-items/2015-10-21-future-support-of-
hardened-sources-kernel.html
[3] https://github.com/minipli/linux-unofficial_grsec
[4] https://github.com/copperhead/linux-hardened
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 829 bytes --]
next prev parent reply other threads:[~2017-08-15 20:07 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <c5b21580-d44b-c683-8e33-fa83f8552a1f@gentoo.org>
2017-08-15 15:10 ` [gentoo-hardened] Fwd: [gentoo-dev] News item for sys-kernel/hardened-sources removal Francisco Blas Izquierdo Riera (klondike)
2017-08-15 15:46 ` [gentoo-hardened] Re: [gentoo-dev] New " Francisco Blas Izquierdo Riera (klondike)
[not found] ` <22931.7313.608217.152058@a1i15.kph.uni-mainz.de>
2017-08-15 20:07 ` Francisco Blas Izquierdo Riera (klondike) [this message]
[not found] ` <9dfffef9-e2fc-dc97-6258-219de98e8b13@gentoo.org>
2017-08-16 10:09 ` Francisco Blas Izquierdo Riera (klondike)
2017-08-16 13:36 ` Robert Sharp
2017-08-16 14:37 ` Francisco Blas Izquierdo Riera (klondike)
2017-08-16 14:46 ` Michael Orlitzky
2017-08-16 15:01 ` philipp.ammann
[not found] ` <CAAD4mYjxdnctm4j=OcYa36sa7DbZyQ+_y=88YGs9_D10fWQxpg@mail.gmail.com>
[not found] ` <e5a84eed-ab8a-4877-326a-bf579155b64c@gentoo.org>
[not found] ` <CAAD4mYj4FMN=dVTQB_4HLBstW9yGgSoYqRXnf20i3umTZJKAJw@mail.gmail.com>
2017-08-19 10:54 ` [gentoo-hardened] About " Francisco Blas Izquierdo Riera (klondike)
2017-09-03 6:34 ` [gentoo-hardened] " R0b0t1
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=89529177-d896-42a0-e57c-2d4bb07edbf1@gentoo.org \
--to=klondike@gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
--cc=gentoo-hardened@lists.gentoo.org \
--cc=pr@gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox