Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [grsecurity]

Grsecurity is a set of patches for the Linux kernel to harden Linux systems.

4
votes
1answer
41 views

How do I simulate /proc/sys/kernel/grsecurity/deny_new_usb without grsecurity?

How do I flexibly enable and disable plugging in new USB devices (running driver code responsible for those devices) at runtime without Grsecurity patch? Are there other approaches or alternative ...
0
votes
0answers
15 views

How would I make test case for grsecurity's PXN feature

I'm a newcomer for Hardened Linux and I'm quite confused about the PXN feature as it's mentioned in the READ.me of hardenedlinux/armv7-nexus7-grsec. I get some material from well known site: ...
1
vote
1answer
51 views

How do I detect a grsecurity kernel?

How can I detect whether my kernel is/has/enables grsecurity? I'm using an official Ubuntu Bionic image, and I'm trying to establish whether another Q&A is relevant for me.
-1
votes
1answer
50 views

grsec causes coredump of application and kernel panic

I have a custom application running on an embedded linux (generated with Buildroot). The kernel is patched with grsec and then, in the linux-menuconfig I enable GRsecurity. I haven't enable any more ...
3
votes
1answer
308 views

How does an “embargo” work in the context of Kernel development? [closed]

There has been a lot of noise about the newest Intel x86 vulnerability. I've seen posts on PostgreSQL, the Linux list, Intel, AMD -- all with vague mention of what's going on. I've seen a few pretty ...
-2
votes
1answer
96 views

Is there a MAC for Linux that can stop a process on policy violations?

Is there a MAC that can SIGSTOP a process on policy violations so I can resume it with an updated policy to retry the syscall? This would be very handy in case of running interactive untrusted ...
1
vote
1answer
352 views

How can I run Java on a grsec-hardend Arch Linux kernel with paxd?

I have Arch Linux with the latest grsec-hardened 4.9.x Linux kernel with paxd installed. But because of this when I try to run Java I get the following error: Java HotSpot(TM) 64-Bit Server VM ...
2
votes
1answer
111 views

GRSecurity/PaX Preventing me from using TOR

So, while trying to open the Tor Browser Bundle while using the Grsecurity with Pax enabled it returns this error: ./start-tor-browser: line 368: 1848 Segmentation fault (core dumped) ...
2
votes
0answers
126 views

How to I can compile the Linux Kernel with GRSecurity and SELinux using the git repositories?

I want compile the Linux kernel with two patches (Grsecurity and SELinux) using the git repositories if theses sources, my problem is in the patch file generation because I unknow how make the patches ...
1
vote
1answer
368 views

Explicit kernel module load at startup

I'm using grsecurity kernel which disallows automatic kernel load thus several systemd services don't work. After manually loading modules with modprobe and restarting module everything works ...
0
votes
2answers
1k views

Securing Debian kernel with Grsecurity

I want to secure my kernel with Grsecurity, however; I have researched about it and found some tutorials, but ain't really sure about it. I have read that you need to replace your current kernel with ...
1
vote
0answers
38 views

Can Grsec whitelist code which breaches some of its rules?

I'm looking into playing around with the Grsecurity kernel on my laptop, a 2012 Retina MacBook Pro, which is running Arch. So far, I've got bits and pieces of experience using SELinux, but that's on ...
2
votes
1answer
113 views

How can I persistently boot into linux-grsec?

I've installed the linux-grsec kernel on my machine via pacman. While I can edit grub's settings at boot time by hitting 'e' at the bootloader menu, the updates I make specifying which kernel and ...
0
votes
1answer
30 views

PaX - for libs?

I have managed out how PaX works. But I can't let 'scrot' save screenshots due to giblib error: Saving to file * failed How to change flags for libs? Exciting.
0
votes
0answers
31 views

Attempting to compile any kernels, even vanilla ones, yields a certification error (continued from last thread) [duplicate]

(Accidentally lost previous account after crashing my computer without saving keepass information. Continuing thread here). I'm currently attempting to follow this guide in order to install the 4.5....
11
votes
1answer
10k views

Attempting to compile any kernel yields a certification error [duplicate]

I'm currently attempting to follow this guide in order to install the 4.5.7 kernel with Grsecurity on my Kali Linux desktop. I am following that list of instructions verbatim, except for the fact ...
1
vote
0answers
31 views

Grsecurity policy file for an application

I have made an AppArmor policy file for an app. Could someone show me an example policy file in grsecurity for an application? (doesn't matter which one)
2
votes
0answers
485 views

Unable to emerge SystemD on Hardened/SELinux

I'm on the hardened/linux/amd64/selinux profile on a recent Stage 3 of Gentoo amd64. I'm trying to install SystemD, and I see the following: > emerge -aq sys-apps/ The following mask changes are ...
3
votes
1answer
119 views

Automated kernel recompilation on security patches?

I'm on Ubuntu 14.04 and really enjoy the fact that I get automatic kernel security updates. When a kernel security problem is patched, a new package will be shipped with the new version. My machine is ...
2
votes
1answer
2k views

Grsecurity resource oversteps

Can anybody explain what this kind of messages in dmesg really mean, or point me to some documentation? I have failed to find non-prehistoric info about dealing with such events. Sometimes programs ...
1
vote
0answers
43 views

Is it secure to mount with defaults my /chroot partition?

I run debian with GRSECURITY patched kernel. Apache is chrooted with mod_chroot under /chroot For now I have mounted /chroot partition with defaults,nodev. However, Apache need to access /dev/...
1
vote
1answer
46 views

Using apprarmor/grsec to gain capabilities for file

I know that using apparmor, one can reduce process capabilities(7). But is it possible to gain them? For example: ping requires CAP_NET_RAW. It's binary has no suid set and doesn't have any file ...
0
votes
2answers
1k views

How to get a grsecurity kernel on Debian Wheezy using the linux-patch-grsecurity2 package?

There is a package linux-patch-grsecurity2. But it seems to be lacking documentation. How to make use of linux-patch-grsecurity2 to get a grsecurity enabled kernel?
3
votes
1answer
2k views

cannot start chrome browser - bind failed: Permission denied

I am using grsecurity kernel with CONFIG_GRKERNSEC_SOCKET_SERVER enabled: [*] Socket restrictions [ ] Deny any sockets to group (NEW) [ ] Deny client sockets to group (NEW) [*] Deny ...
3
votes
1answer
502 views

USB keyboard is disconecting automatically (without being unplugged)

In my log, I see following message: kernel: usb 1-1.6: USB disconnect, device number 5 acpid: input device has been disconnected, fd 7 acpid: input device has been disconnected, fd 8 I have not ...
0
votes
1answer
94 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
2
votes
1answer
94 views

Automatized kernel upgrade

I am writing a BASH script that automatically configures, builds and installs the most recent kernel image. The generated kernel should include the grsecurity patchset. It would use the previous ...
6
votes
4answers
3k views

Which distributions maintain a kernel package with grsecurity support

I know that I can apply the grsecurity patches by compiling my own kernel. This is not a big deal to do it once, but too complex to have regular and easy kernel image updates. So I am looking for ...
1
vote
0answers
57 views

Grsecurity Policy Generation - role_allow_ip 127.0.0.6

the Grsecurity policy generation from a learning log file frequently yields role definitions with role attributes like role_allow_ip 127.0.0.6 when in fact I have logged in via IPv6. Since ...
3
votes
1answer
99 views

Grsecurity subject mode x

I am conducting some research on Grsecurity on Hardened Gentoo, see http://en.wikibooks.org/wiki/Grsecurity. To be more specific, I am trying to find an example where subject mode x makes a difference....
22
votes
2answers
7k views

Why are the grsecurity patches not included in the Vanilla Kernel?

What are the reasons that grsecurity patches (or the security features it brings) are not included in the kernel by default. When looking at the benefits for security it seems the vanilla kernel is ...
5
votes
1answer
3k views

I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?

I installed 'linux-patch-grsecurity2' and it has some sort of interface. ~$ sudo gradm2 gradm 2.1.14 grsecurity administration program Usage: gradm [option] ... Examples: gradm -P ...
20
votes
2answers
8k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
8
votes
2answers
3k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...