#grsecurity — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #grsecurity, aggregated by home.social.
-
Preparatory patches: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1068
Full Kbuild support: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1069
#grsecurity compatibility: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1070
-
Preparatory patches: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1068
Full Kbuild support: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1069
#grsecurity compatibility: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1070
-
Preparatory patches: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1068
Full Kbuild support: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1069
#grsecurity compatibility: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1070
-
Preparatory patches: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1068
Full Kbuild support: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1069
#grsecurity compatibility: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1070
-
Preparatory patches: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1068
Full Kbuild support: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1069
#grsecurity compatibility: https://github.com/NVIDIA/open-gpu-kernel-modules/pull/1070
-
Our 6.18 #grsecurity LTS release, to be supported through at least the end of 2028, is now available!
-
Our 6.18 #grsecurity LTS release, to be supported through at least the end of 2028, is now available!
-
Our 6.18 #grsecurity LTS release, to be supported through at least the end of 2028, is now available!
-
Lies, damned lies and #statistics: Literature shows it's statistically possible to infer a password from typing habits given access to a side channel which reveals access and/or modification time such as stat(2), fanotify(7) or inotify(7). #grsecurity prevents this with GRKERNSEC_DEVICE_SIDECHANNEL which #sydbox inherited with its Device Sidechannel Mitigations: https://man.exherbo.org/syd.7.html#Device_Sidechannel_Mitigations #exherbo #linux #security
-
Lies, damned lies and #statistics: Literature shows it's statistically possible to infer a password from typing habits given access to a side channel which reveals access and/or modification time such as stat(2), fanotify(7) or inotify(7). #grsecurity prevents this with GRKERNSEC_DEVICE_SIDECHANNEL which #sydbox inherited with its Device Sidechannel Mitigations: https://man.exherbo.org/syd.7.html#Device_Sidechannel_Mitigations #exherbo #linux #security
-
Lies, damned lies and #statistics: Literature shows it's statistically possible to infer a password from typing habits given access to a side channel which reveals access and/or modification time such as stat(2), fanotify(7) or inotify(7). #grsecurity prevents this with GRKERNSEC_DEVICE_SIDECHANNEL which #sydbox inherited with its Device Sidechannel Mitigations: https://man.exherbo.org/syd.7.html#Device_Sidechannel_Mitigations #exherbo #linux #security
-
Lies, damned lies and #statistics: Literature shows it's statistically possible to infer a password from typing habits given access to a side channel which reveals access and/or modification time such as stat(2), fanotify(7) or inotify(7). #grsecurity prevents this with GRKERNSEC_DEVICE_SIDECHANNEL which #sydbox inherited with its Device Sidechannel Mitigations: https://man.exherbo.org/syd.7.html#Device_Sidechannel_Mitigations #exherbo #linux #security
-
6.18 has been selected as the next #grsecurity stable kernel version, to be supported through the end of 2028, one year longer than the upstream LTS EOL date of Dec 2027.
-
6.18 has been selected as the next #grsecurity stable kernel version, to be supported through the end of 2028, one year longer than the upstream LTS EOL date of Dec 2027.
-
6.18 has been selected as the next #grsecurity stable kernel version, to be supported through the end of 2028, one year longer than the upstream LTS EOL date of Dec 2027.
-
#sydbox 3.37.3 is released with Trusted Symbolic Links a la CONFIG_GRKERNSEC_LINK of #grsecurity: https://man.exherbo.org/syd.7.html#Trusted_Symbolic_Links #exherbo #security #linux
-
#sydbox 3.37.3 is released with Trusted Symbolic Links a la CONFIG_GRKERNSEC_LINK of #grsecurity: https://man.exherbo.org/syd.7.html#Trusted_Symbolic_Links #exherbo #security #linux
-
#sydbox 3.37.3 is released with Trusted Symbolic Links a la CONFIG_GRKERNSEC_LINK of #grsecurity: https://man.exherbo.org/syd.7.html#Trusted_Symbolic_Links #exherbo #security #linux
-
#sydbox 3.37.3 is released with Trusted Symbolic Links a la CONFIG_GRKERNSEC_LINK of #grsecurity: https://man.exherbo.org/syd.7.html#Trusted_Symbolic_Links #exherbo #security #linux
-
Nice demo: tested a vulnerable Ubuntu 22.04 system for glibc CVE-2025-4802 using Solar Designer's PoC adapted to Ubuntu (replace any occurrence of "myhostname" with "mdns4_minimal"). Even an old #grsecurity 5.4.96 kernel from February 8 2021 prevented exploitation
-
Nice demo: tested a vulnerable Ubuntu 22.04 system for glibc CVE-2025-4802 using Solar Designer's PoC adapted to Ubuntu (replace any occurrence of "myhostname" with "mdns4_minimal"). Even an old #grsecurity 5.4.96 kernel from February 8 2021 prevented exploitation
-
Nice demo: tested a vulnerable Ubuntu 22.04 system for glibc CVE-2025-4802 using Solar Designer's PoC adapted to Ubuntu (replace any occurrence of "myhostname" with "mdns4_minimal"). Even an old #grsecurity 5.4.96 kernel from February 8 2021 prevented exploitation
-
Nice demo: tested a vulnerable Ubuntu 22.04 system for glibc CVE-2025-4802 using Solar Designer's PoC adapted to Ubuntu (replace any occurrence of "myhostname" with "mdns4_minimal"). Even an old #grsecurity 5.4.96 kernel from February 8 2021 prevented exploitation
-
We expect our 6.13 #grsecurity beta to be available within the next two weeks.
-
We expect our 6.13 #grsecurity beta to be available within the next two weeks.
-
We expect our 6.13 #grsecurity beta to be available within the next two weeks.
-
Our 6.12 #grsecurity beta is now available to beta testers for testing
-
Our 6.12 #grsecurity beta is now available to beta testers for testing
-
Our 6.12 #grsecurity beta is now available to beta testers for testing
-
Linux kernel hardening does not necessarily have to ruin performance. Quite the opposite is possible! One just has to address performance issues first and gets better security “for free” — sometimes vast performance improvements even!
Current example: BPF JIT handling. test_bpf.ko is a kernel module exercising various extreme and corner cases of BPF programs the kernel is supposed to handle just fine. However, under certain configurations it makes the kernel busy burn cycles without making real progress. Fixing that allowed us to implement security features in #grsecurity at all stages of the JIT process and basically get them for free. See for yourself…
…and yes, while waiting for insmod to finish on vanilla Linux, I fixed the tests and did a quick re-run on #grsecurity.
-
Linux kernel hardening does not necessarily have to ruin performance. Quite the opposite is possible! One just has to address performance issues first and gets better security “for free” — sometimes vast performance improvements even!
Current example: BPF JIT handling. test_bpf.ko is a kernel module exercising various extreme and corner cases of BPF programs the kernel is supposed to handle just fine. However, under certain configurations it makes the kernel busy burn cycles without making real progress. Fixing that allowed us to implement security features in #grsecurity at all stages of the JIT process and basically get them for free. See for yourself…
…and yes, while waiting for insmod to finish on vanilla Linux, I fixed the tests and did a quick re-run on #grsecurity.
-
Linux kernel hardening does not necessarily have to ruin performance. Quite the opposite is possible! One just has to address performance issues first and gets better security “for free” — sometimes vast performance improvements even!
Current example: BPF JIT handling. test_bpf.ko is a kernel module exercising various extreme and corner cases of BPF programs the kernel is supposed to handle just fine. However, under certain configurations it makes the kernel busy burn cycles without making real progress. Fixing that allowed us to implement security features in #grsecurity at all stages of the JIT process and basically get them for free. See for yourself…
…and yes, while waiting for insmod to finish on vanilla Linux, I fixed the tests and did a quick re-run on #grsecurity.
-
Linux kernel hardening does not necessarily have to ruin performance. Quite the opposite is possible! One just has to address performance issues first and gets better security “for free” — sometimes vast performance improvements even!
Current example: BPF JIT handling. test_bpf.ko is a kernel module exercising various extreme and corner cases of BPF programs the kernel is supposed to handle just fine. However, under certain configurations it makes the kernel busy burn cycles without making real progress. Fixing that allowed us to implement security features in #grsecurity at all stages of the JIT process and basically get them for free. See for yourself…
…and yes, while waiting for insmod to finish on vanilla Linux, I fixed the tests and did a quick re-run on #grsecurity.
-
Linux kernel hardening does not necessarily have to ruin performance. Quite the opposite is possible! One just has to address performance issues first and gets better security “for free” — sometimes vast performance improvements even!
Current example: BPF JIT handling. test_bpf.ko is a kernel module exercising various extreme and corner cases of BPF programs the kernel is supposed to handle just fine. However, under certain configurations it makes the kernel busy burn cycles without making real progress. Fixing that allowed us to implement security features in #grsecurity at all stages of the JIT process and basically get them for free. See for yourself…
…and yes, while waiting for insmod to finish on vanilla Linux, I fixed the tests and did a quick re-run on #grsecurity.
-
Performance isn't the enemy of security: we care about both. Today's patches finish off a set of security/performance improvements to eBPF. Below we show a ~30x speedup vs vanilla in running the eBPF selftests with every single #grsecurity option enabled!
-
Performance isn't the enemy of security: we care about both. Today's patches finish off a set of security/performance improvements to eBPF. Below we show a ~30x speedup vs vanilla in running the eBPF selftests with every single #grsecurity option enabled!
-
Performance isn't the enemy of security: we care about both. Today's patches finish off a set of security/performance improvements to eBPF. Below we show a ~30x speedup vs vanilla in running the eBPF selftests with every single #grsecurity option enabled!
-
Performance isn't the enemy of security: we care about both. Today's patches finish off a set of security/performance improvements to eBPF. Below we show a ~30x speedup vs vanilla in running the eBPF selftests with every single #grsecurity option enabled!
-
Performance isn't the enemy of security: we care about both. Today's patches finish off a set of security/performance improvements to eBPF. Below we show a ~30x speedup vs vanilla in running the eBPF selftests with every single #grsecurity option enabled!
-
I've submitted one #kernel #bug for #Linux and one for #HardenedBSD today, see: https://bugzilla.kernel.org/show_bug.cgi?id=219227 and https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/issues/107 The issue is (almost) the same and breaks W^X. It has already been mitigated by #sydbox since version 3.15.1: #sydbox denies executable shared memory like #grsecurity does! See: http://man.exherbolinux.org/syd.7.html#Advanced_Memory_Protection_Mechanisms #exherbo
-
I've submitted one #kernel #bug for #Linux and one for #HardenedBSD today, see: https://bugzilla.kernel.org/show_bug.cgi?id=219227 and https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/issues/107 The issue is (almost) the same and breaks W^X. It has already been mitigated by #sydbox since version 3.15.1: #sydbox denies executable shared memory like #grsecurity does! See: http://man.exherbolinux.org/syd.7.html#Advanced_Memory_Protection_Mechanisms #exherbo
-
I've submitted one #kernel #bug for #Linux and one for #HardenedBSD today, see: https://bugzilla.kernel.org/show_bug.cgi?id=219227 and https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/issues/107 The issue is (almost) the same and breaks W^X. It has already been mitigated by #sydbox since version 3.15.1: #sydbox denies executable shared memory like #grsecurity does! See: http://man.exherbolinux.org/syd.7.html#Advanced_Memory_Protection_Mechanisms #exherbo
-
I've submitted one #kernel #bug for #Linux and one for #HardenedBSD today, see: https://bugzilla.kernel.org/show_bug.cgi?id=219227 and https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/issues/107 The issue is (almost) the same and breaks W^X. It has already been mitigated by #sydbox since version 3.15.1: #sydbox denies executable shared memory like #grsecurity does! See: http://man.exherbolinux.org/syd.7.html#Advanced_Memory_Protection_Mechanisms #exherbo
-
I've submitted one #kernel #bug for #Linux and one for #HardenedBSD today, see: https://bugzilla.kernel.org/show_bug.cgi?id=219227 and https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/issues/107 The issue is (almost) the same and breaks W^X. It has already been mitigated by #sydbox since version 3.15.1: #sydbox denies executable shared memory like #grsecurity does! See: http://man.exherbolinux.org/syd.7.html#Advanced_Memory_Protection_Mechanisms #exherbo
-
I wrote about how C‘s more recent language features make grsecurity maintenance easier and how we pushed the idea even further by adding a new compiler builtin.
https://grsecurity.net/reducing_maintenance_burden_by_bending_c
The article has quite some code snippets, showing how easy the latter actually is, thanks to a rather stable GCC plugin API.
-
I wrote about how C‘s more recent language features make grsecurity maintenance easier and how we pushed the idea even further by adding a new compiler builtin.
https://grsecurity.net/reducing_maintenance_burden_by_bending_c
The article has quite some code snippets, showing how easy the latter actually is, thanks to a rather stable GCC plugin API.
-
I wrote about how C‘s more recent language features make grsecurity maintenance easier and how we pushed the idea even further by adding a new compiler builtin.
https://grsecurity.net/reducing_maintenance_burden_by_bending_c
The article has quite some code snippets, showing how easy the latter actually is, thanks to a rather stable GCC plugin API.
-
I wrote about how C‘s more recent language features make grsecurity maintenance easier and how we pushed the idea even further by adding a new compiler builtin.
https://grsecurity.net/reducing_maintenance_burden_by_bending_c
The article has quite some code snippets, showing how easy the latter actually is, thanks to a rather stable GCC plugin API.
-
I wrote about how C‘s more recent language features make grsecurity maintenance easier and how we pushed the idea even further by adding a new compiler builtin.
https://grsecurity.net/reducing_maintenance_burden_by_bending_c
The article has quite some code snippets, showing how easy the latter actually is, thanks to a rather stable GCC plugin API.
-
@paulmckrcu, regarding https://lore.kernel.org/kvm/08ee7eb2-8d08-4f1f-9c46-495a544b8c0e@paulmck-laptop/, we went with option 3 and implemented rcu_kvfree_barrier() in #grsecurity, mainly in need for AUTOSLAB which converts every kmalloc() into a dedicated slab cache, making the issue much more likely to trigger. Placing a call to rcu_kvfree_barrier() at a fitting place in free_module() fixes the leak/uaf issue.