0

I want to secure my kernel with Grsecurity, however; I have researched about it and found some tutorials, but ain't really sure about it. I have read that you need to replace your current kernel with a Vanilla kernel. Which is an unaltered default Linux kernel, but is it good to replace the current kernel included by Debian with a Vanilla one? Won't this cause problems with updates, not getting all the updates, not having the best optimization for Debian,...?

And if I'd replace it with a Vanilla one, is it easy to update, or do I need to check the Vanilla website each time for an update and then compile it manually?

So, in short, is it a good idea to protect my kernel with Grsecurity and to do the Vanilla-hassle? This Debian page says that the performance ain't lost that hard, and there is a repository to update it easily; is this still true this day?

Someone experience with it or has it done himself?

Thanks!

1

2 Answers 2

2

Stephen was faster than I. His answer method is the way to go if you want to install linux-image-grsec-amd6 without the work involved on kernel compilation and kernel package creation with make-kpkg.

However, some things that could break while using grsecurity:

  • Hibernation could break (conflicts with CONFIG_GRKERNSEC_KMEM, CONFIG_PAX_MEMORY_SANITIZE and CONFIG_RANDOMIZE_BASE);
  • Xen and virtualbox could break (conflicts with CONFIG_PAX_KERNEXEC and CONFIG_PAX_MEMORY_UDEREF);
  • The code reuse attacks protection (RAP), enabled with CONFIG_PAX_RAP, could break binary blobs like the nvidia driver;
  • broadcom-sta-dkms could fail to compile due to illegal memory access;

All those things are listed at the Arch Linux Grsecurity wiki page. At home, i decided to use grsecurity and i'm not using nvidia proprietary drivers(but having one card of this brand installed). You have to make sure what are the parameters enabled on grsec by your distribution, and see if it fits your needs(of if you can make the tradeoff of some features).

If you take the path of packaging/patching your own vanilla Kernel, it will be up to you keep your kernel updated, and use Debian own tools to create packages for linux-image, kernel-source and kernel-headers.

Related stuff:

1
  • I tried the GRsec kernel solution provided here, and it didn't work. It broke my system. I think it is because Grsec-kernel is based on 4.x; other 4.x kernels also break my system. Is there a Grsec-kernel (uptodate) but based on 3.16?
    – O'Niel
    Commented Jan 17, 2017 at 20:29
1

The wiki page mentions packaged grsec kernels in unstable; these are now available for Debian 8 (Jessie) via Backports. To install them, add the appropriate repository:

echo deb http://http.debian.net/debian jessie-backports main > /etc/apt/sources.list.d/jessie-backports.list

(as root), then

apt-get update

and finally install the kernel and appropriate tools:

apt-get -t jessie-backports linux-image-grsec-amd64 gradm2

(assuming you're running amd64). This will install a recent grsec kernel, and keep it updated.

Note that you'll probably need to tweak a number of settings before you can get your grsec system running properly, so keep a non-grsec kernel around...

9
  • Thanks I'm about to do this. But because it's unstable, won't this introduce more vulnerabilities and bugs or is it well tested by the developers (not Debian developers) themselves before released 'unstable'?
    – O'Niel
    Commented Jan 17, 2017 at 18:28
  • Debian unstable is called that because its contents change a lot, not because the software is unstable — software uploaded to Debian unstable is supposed to end up (eventually) in the next stable release. I imagine the grsec developers test things, and the grsec maintainer in Debian does too. Commented Jan 17, 2017 at 18:37
  • I tried the GRsec kernel solution provided here, and it didn't work. It broke my system. I think it is because Grsec-kernel is based on 4.x; other 4.x kernels also break my system. Is there a Grsec-kernel (uptodate) but based on 3.16?
    – O'Niel
    Commented Jan 17, 2017 at 20:29
  • The oldest pre-built grsec kernel in Debian is 4.3.3. The 3.14.79 grsec patch is only available to paying customers of grsec; I don't think there's anything for 3.16... Commented Jan 17, 2017 at 21:51
  • Is there also such an easy backport repository for that version? Or do I also need to compile it etc. snapshot.debian.org/package/linux-grsec
    – O'Niel
    Commented Jan 18, 2017 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .