22

What are the reasons that grsecurity patches (or the security features it brings) are not included in the kernel by default. When looking at the benefits for security it seems the vanilla kernel is quite insecure as it is.

If this is a trade-off (some applications where you want to avoid the security measures), it seems that grsecurity could be an option to enable in the vanilla kernel.

With so many things in the mainstream vanilla kernel, I have a hard time understanding the reasons why the community does not want to include grsecurity.

Improve this question
2

2 Answers 2

Reset to default
23

(I'm a grsecurity developer.)

jsbillings's answer is based on an email post discussed in an LWN article.

The important context here is that neither grsecurity nor PaX developers were involved in that mailing list discussion. The PaX Team's comment to the LWN article clears this up. We've never submitted the patches for mainline inclusion. One simple reason is that we're the ones with the ideas and implementations, which upstreaming would not solve. Furthermore, we'd have to engage in tiresome mailing list arguments with a group of developers who are very much anti-security (see my 2012 H2HC presentation for more discussion of this). We have limited time and resources, so we choose to spend it in the most effective way possible: creating the security technology of tomorrow and making it available to everyone for free. As the PaX Team mentions in their comment, we have a particular encompassing view of security and also thus don't believe there's much merit in the splitting-off and upstreaming of individual features.

Improve this answer
1
  • I liked the link to the interesting LWN article. Thank you. I am still in a state of confusion to read the opinion that a group of Kernel developers would be "very much anti-security". I have of course not any sort of insight, but this seems worrying though :(. The confusion is that I assume security one of the "strongest arguments" for OpenSource and Linux. At the moment I feel quite threatened on my ubuntu based system. Remain a little left behind with, what would be "more eyes can look"-security of OS werth if we were ignorant? I like grsecurity anyhow, thank you for it.
    – humanityANDpeace
    Commented Dec 21, 2012 at 9:32
10

It seems that the grsecurity developers have had issues in the past convincing Linus to accept changes into the kernel. The problems seem to be:

  1. Submitting a giant blob of code and not breaking it up into pieces
  2. Linus considers a lot of the changes "insane", which is probably Linus's way of saying that it doesn't work with his plans for future development.
Improve this answer
2
  • These are quite some interessting points. Still learning - I was not even aware of the BLOB (that is a binary data thing, right, something not opensource I guess). Well The info is good. If the reasons stated are true it is still a shame. I like the idea of the security improvement related to the grsecurity patchset.
    – humanityANDpeace
    Commented Dec 20, 2012 at 16:47
  • 1
    @humanityANDpeace "blob" can mean "binary large object" (usually in the database sense, but sometimes elsewhere as well), or it can be slang for "large chunk of whatever". In this case, I take it jsbillings meant it as the latter: a large chunk of source code which isn't further subdivided. Being a programmer myself, I know exactly how frustrating those can be to work with, let alone review.
    – user
    Commented Dec 20, 2012 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .