All about hardening Linux systems with Grsecurity

learn more… | top users | synonyms

0
votes
2answers
27 views
+150

How to get a grsecurity kernel on Debian Wheezy using the linux-patch-grsecurity2 package?

There is a package linux-patch-grsecurity2. But it seems to be lacking documentation. How to make use of linux-patch-grsecurity2 to get a grsecurity enabled kernel?
3
votes
1answer
159 views

cannot start chrome browser - bind failed: Permission denied

I am using grsecurity kernel with CONFIG_GRKERNSEC_SOCKET_SERVER enabled: [*] Socket restrictions [ ] Deny any sockets to group (NEW) [ ] Deny client sockets to group (NEW) [*] Deny ...
2
votes
0answers
22 views

USB keyboard is disconecting automatically (without being unplugged)

In my log, I see following message: kernel: usb 1-1.6: USB disconnect, device number 5 acpid: input device has been disconnected, fd 7 acpid: input device has been disconnected, fd 8 I have not ...
0
votes
1answer
9 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
0
votes
0answers
21 views

DEBUG_RODATA option in the linux kernel

I am wondering what exactely the use of DEBUG_RODATA is in the linux kernel. The help says: CONFIG_DEBUG_RODATA: Mark the kernel read-only data as write-protected in the pagetables, in order to ...
0
votes
0answers
22 views

Grsecurity: best strategy sought

If a server is run with Linux hardened with Grsecurity (say, Gentoo Hardened), what is the best time to enable Grsecurity RBAC? Automatically by some boot script, or manually after booting?
2
votes
1answer
58 views

Automatized kernel upgrade

I am writing a BASH script that automatically configures, builds and installs the most recent kernel image. The generated kernel should include the grsecurity patchset. It would use the previous ...
1
vote
1answer
417 views

Which distributions maintain a kernel package with grsecurity support

I know that I can apply the grsecurity patches by compiling my own kernel. This is not a big deal to do it once, but too complex to have regular and easy kernel image updates. So I am looking for ...
1
vote
0answers
25 views

Grsecurity Policy Generation - role_allow_ip 127.0.0.6

the Grsecurity policy generation from a learning log file frequently yields role definitions with role attributes like role_allow_ip 127.0.0.6 when in fact I have logged in via IPv6. Since ...
3
votes
1answer
44 views

Grsecurity subject mode x

I am conducting some research on Grsecurity on Hardened Gentoo, see http://en.wikibooks.org/wiki/Grsecurity. To be more specific, I am trying to find an example where subject mode x makes a ...
12
votes
2answers
3k views

Why are the grsecurity patches not included in the Vanilla Kernel?

What are the reasons that grsecurity patches (or the security features it brings) are not included in the kernel by default. When looking at the benefits for security it seems the vanilla kernel is ...
4
votes
1answer
2k views

I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?

I installed 'linux-patch-grsecurity2' and it has some sort of interface. ~$ sudo gradm2 gradm 2.1.14 grsecurity administration program Usage: gradm [option] ... Examples: gradm -P ...
17
votes
2answers
5k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
5
votes
2answers
2k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...