All about hardening Linux systems with Grsecurity

learn more… | top users | synonyms

0
votes
0answers
18 views

DEBUG_RODATA option in the linux kernel

I am wondering what exactely the use of DEBUG_RODATA is in the linux kernel. The help says: CONFIG_DEBUG_RODATA: Mark the kernel read-only data as write-protected in the pagetables, in order to ...
0
votes
0answers
21 views

Grsecurity: best strategy sought

If a server is run with Linux hardened with Grsecurity (say, Gentoo Hardened), what is the best time to enable Grsecurity RBAC? Automatically by some boot script, or manually after booting?
2
votes
1answer
54 views

Automatized kernel upgrade

I am writing a BASH script that automatically configures, builds and installs the most recent kernel image. The generated kernel should include the grsecurity patchset. It would use the previous ...
1
vote
1answer
262 views

Which distributions maintain a kernel package with grsecurity support

I know that I can apply the grsecurity patches by compiling my own kernel. This is not a big deal to do it once, but too complex to have regular and easy kernel image updates. So I am looking for ...
1
vote
0answers
21 views

Grsecurity Policy Generation - role_allow_ip 127.0.0.6

the Grsecurity policy generation from a learning log file frequently yields role definitions with role attributes like role_allow_ip 127.0.0.6 when in fact I have logged in via IPv6. Since ...
3
votes
1answer
41 views

Grsecurity subject mode x

I am conducting some research on Grsecurity on Hardened Gentoo, see http://en.wikibooks.org/wiki/Grsecurity. To be more specific, I am trying to find an example where subject mode x makes a ...
12
votes
2answers
3k views

Why are the grsecurity patches not included in the Vanilla Kernel?

What are the reasons that grsecurity patches (or the security features it brings) are not included in the kernel by default. When looking at the benefits for security it seems the vanilla kernel is ...
4
votes
1answer
2k views

I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?

I installed 'linux-patch-grsecurity2' and it has some sort of interface. ~$ sudo gradm2 gradm 2.1.14 grsecurity administration program Usage: gradm [option] ... Examples: gradm -P ...
17
votes
2answers
4k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
5
votes
2answers
2k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...