https://review.clip-os.org/c/clipos/src_platform_config-linux-hardware/+/35685/
This isn’t in our kernel version though so we don’t need to worry (benefits of LTS).
I think it’s too early for that and I don’t think many listed there would be interested in it. MirageOS doesn’t even use Linux. It’s a framework for building unikernels.
Unrelated to outreach but can be useful for improving build speed:
The idea isn’t that distributions build and upload the kernel to their
distribution very soon. That may or may not be realistic indeed.
The idea is to get attention on the project. Have other competent people
review and contribute.
Because at the moment it’s stalled. This got much more complicated than
I anticipated and I really can’t review the kernel config.
I highly doubt any standard distro would be interested in this. The only reason Arch has a package is because anthraxx/Daniel Micay are Arch maintainers/Trusted Users. Tails and Qubes are the only ones I see that might be interested. Gentoo (Hardened) might be interested in linux-hardened but not hardened-kernel since they always create their own config.
Interested distributions would be jackpot but my hope is lower and hopefully more realistic: anyone capable of contributing. And I guess that chance is realistic. There used to be a lot enthusiasm and auxiliary protects for grsecurity (download, compile scripts such as coldkernel, packages and whatnot). I would be really surprised if zero people could get excited about this project now that there is no longer any grsecurity free or other somehow popular (people having heard about it) alternative.
grsecurity isn’t really the same. It was well known for providing a large set of security features. linux-hardened doesn’t come close.
Somewhat interesting (although mostly redundant code that does more harm than good):
https://www.openwall.com/lists/kernel-hardening/2020/05/10/3
Messy C
Could have done:
char tmp[33];
char *ptrTmp=tmp;
This way, array can account for the 32 bytes and the required /0, and also render an over flow impossible because *ptrTmp could only ever hold 32 bytes since it holds the address of tmp (char *ptrTmp=&tmp[0])
Also like grsec said, the n is left undefined. Could have said:
size_t=strlen(whatever string)=n; or better yet, just leave it out completely. Interesting because I know (from errors I made) that an undefined variable will trigger a lot of complaining from gcc. I imagine any other compiler would do the same?
Anyway just a couple things I saw related to C “grammar.”
Full disclosure: student of C, definitely not an expert by any means, but I learn more every day.
I want to try pimping this project to other upstreams - with the goal of having them absorb your changes completely. @madaidan can you summarize in a few bullet points the main accomplishments so far that aren’t covered by ClipOS + anthraxx hardened-kernel?
The none bullet point, non-summary, full description is here:
Perhaps (also) have a look there and see what the highlights are?
I try to provide a short overview here…
There are two main parts.
(And maybe a third small part but not important at this stage.)
A) There is linux-hardened [archive] (a patch for the Linux kernel that adds many hardening features). Very few people know about this project.
Outreach can be done without mentioning Whonix specifically. (Not good to think of Whonix specific anyway.)
Previous outreach:
- Debian Linux package feature request: consider review and merge of linux-hardened patches (free, Libre alternative to grsecurity) [archive]
- Debian Request For Packaging: RFP: linux-hardened – hardened Linux kernel [archive]
But otherwise there is almost zero (let alone recent) mention of linux-hardened.
Example search term:
site:ubuntu.com https://github.com/anthraxx/linux-hardened
Same hold true for other major distributions.
I don’t think that’s a for not trying to organize the linux-hardened project.
grsecurity may have been better than linux-hardened was in past. That might result in less interest (not possible to quantify xx %) interest in linux-hardened than grsecurity. But certainly the interest in linux-hardened will not be zero.
B) Hardened kernel config.
There are two kernel configs, hardened-vm-kernel [archive] and hardened-host-kernel [archive]. hardened-vm-kernel is designed specifically for virtual machines (VMs) and hardened-host-kernel is designed for hosts.
These were created by @madaidan.
C) Supporting scripts.
There’s a download script and a build script but it does not verify software signatures yet. Neither it should instead TODO: do not use networking as per
- kernel recompilation for better hardening - #214 by Patrick and
- kernel recompilation for better hardening - #267 by Patrick
Other stuff ci_test / travis CI (but only building, no other automated tests). other tasks
Therefore not sure mentioning this part yet.
Not sure which parts are worth doing outreach / outreach strategy but anything is certainly better than no progress on outreach.
CLIP OS expects you to create your own config.
You mean anthraxx’s linux-hardened, not hardened-kernel and that’s not a kernel config. It’s a hardening patchset.
There isn’t really much I can say except what’s on hardened-kernel
If they can provide a Debian package repository with a hardened kernel, tested to not totally break Debian and up to date that would probably get many people exited.
Might be unlikely because CLIP OS is based on hardened gentoo.
Good to know. Generating a deb is as easy as specifying this during build. I will see what they think.