> Date: Wed, 30 Apr 2008 12:20:03 -0400
From: "max bianco" <maximilianbianco(a)gmail.com>
Subject: Re: Anybody deploy grsecurity on Fedora?
> Have been watching the PaX and grsecurity efforts for a while, but
> had a need to add them to a Linux box yet...either for a customer,
or in a
> lab for playing.
> I noticed that the PaX stuff seems to now be merged into grsecurity.
> most recent release of grsecurity has some interesting security
> I'm interested in testing.
> Anyone deploy grsecurity on a recent Fedora release (7 or 8) or RHEL
> or 5? If so, any problems, lessons learned, or tips?
I haven't used and don't know much about it or its relationship, if
any , with fedora , I don't think it goes as far as SELinux but that
is just speculation based on a quick overview of the following which i
will now review in depth to correct any mistaken notions i might have.
If you come across better resources that explain this better please
Although there is some overlap, I believe the two (selinux and
grsecurity) have many features that are complimentary. Selinux provides
containment based on security contexts (labels). If one were to crash a
program covered by selinux, the damage would be contained. The goals of
grsecrutiy (especially the PaX elements) however, are to make it harder
to crash that program in the first place.
Is the Linux kernel community thinking of pulling in some of the
capabilities that grsecrutiy (especially PaX) offers into the
kernel...making things like randomization of stack, data, and code space
a default behavior of the kernel?
Principal Information System Security Engineer // NSA-IEM, NSA-IAM
SAIC, IISBU, Columbia, MD