Which distributions maintain a kernel package with grsecurity support

Question

I know that I can apply the grsecurity patches by compiling my own kernel. This is not a big deal to do it once, but too complex to have regular and easy kernel image updates. So I am looking for linux distributions which supports gsecurity as a kernel-package which I can easily update via a package manager. For Ubuntu there was a repository http://kernelsec.cr0.org/ which was probably trustable because it was linked by the gsecurity page. But it seems to end with kernel version 2.6.32.15.

Since I am currently using ubuntu, it would be great to find something based on ubuntu or just on debian.

Answer 1

ArchLinux have newest kernel with grsec in their repo. More info about this package can be found on it's dedicated wiki page.

Answer 2

NetSecL is a OpenSUSE based distribution which supports grsecurity by default.

From the homepage:

NetSecL is a hardened,live and installable OS based on OpenSuse suitable for Desktop/Server and Penetration testing. Once installed you can fully enjoy the features of GrSecurity hardened kernel and penetration tools OR use the penetration tools directly from your live DVD. GrSecurity is a great security enhancement that you can enjoy with NetSecL and have a normally functional OS together with the NetSecL Firewall and Penetration tools you are always ready and know at what level your security is.

Pentoo is a gentoo based distribution which includes grsecurity by default, from the wikipedia page:

The Pentoo kernel includes grsecurity and PAX hardening and extra patches - with binaries compiled from a hardened toolchain with the latest nightly versions of some tools available.

Answer 3

Alpine Linux uses a kernel with grsec by default so once installed updates require no added effort. Though my understanding is they use an unsupported grsec kernel.

Answer 4

Subgraph OS is another example of a Debian distribution that adds Grsecurity/Pax patches by default,

Subgraph OS includes a kernel hardened with the well-respected grsecurity/PaX patchset for system-wide exploit and privilege escalation mitigation. In addition to making the kernel more resistant to attacks, grsecurity and PaX security features offer strong security protection to all processes running without modification (i.e. recompiling / relinking).

The Subgraph OS kernel is also built with the recently released RAP (demo from the test patch) security enhancements designed to prevent code-reuse (i.e. ROP) attacks in the kernel. This is an important mitigation against contemporary exploitaion techniques and greatly increases the resistance of the kernel to modern exploits that can be used to escalate privileges once an application on the endpoint is breached. grsecurity, PaX, and RAP are essential defenses implemented in Subgraph OS.