OpenPaX Announced As "Open-Source Alternative To GrSecurity" With Free Kernel Patch
OpenPaX Announced As "Open-Source Alternative To GrSecurity" With Free Kernel Patch
Why would anyone want to run unmainlined security patches from a company?
This is how CrowdStrike happened.
This feels like security via business decision which is always the opposite of security. At least this would be open source now? 🤷‍♂️
GrSecurity adds so many layers of protections to the kernel. They are literally decades ahead of the vanilla Linux kernel in terms of security. With all of the hardened GrSec settings checked/configured correctly, it stops the majority of 0 ring exploits (at least when I was running it before they went full GPLv2).
PaX is an awesome part of GrSec. Mprotect stops any read and write and execute access to memory in both user and kernel lands (only rx or wx). Stuff like web browsers won't work unless you have a program to mark it in elf to not use pax. However, this kills a lot of exploits with that turned on by itself (though there are probably work arounds if you are developing exploits which the other features would hopefully catch). That's why people installed 3rd party unmainlined security patches, but that's just me maybe idk.
I hope this venture will be more fruitful than the copy paste code that people kept trying to push to the hardened Linux kernel project (despite the maintainers best intentions and countless efforts to stop that)
Mprotect stops any read and write and execute access to memory in both user and kernel lands (only rx or wx). Stuff like web browsers won't work unless you have a program to mark it in elf to not use pax. However, this kills a lot of exploits with that turned on by itself (though there are probably work arounds if you are developing exploits which the other features would hopefully catch). That's why people installed 3rd party unmainlined security patches, but that's just me maybe idk.
I am having a hard time following what this does or why this is desirable. You're saying there's a patch this thing provides that .. disables memory access ... unless a flag is set in an executable ... which will then bypass the security?
This is very good news, the closing of grsec has been a huge loss for Linux hardening.
Wow. Hope that they will do better than kspp