make grsecurity kernel, grsecurity-installer work inside Whonix

[phabricator-migrator]

Information

ID: 301
PHID: PHID-TASK-fuksbwxdtn7pdxaaad4w
Author: Patrick
Status at Migration Time: invalid
Priority at Migration Time: Normal

Description

Introduction:

• grsecurity-installer
• (a fork of GitHub - rickard2/grsecurity-Debian-Installer: Install script for grsecurity for Debian environments)
• Used by and useful for the Linux distribution Whonix, which is primarily run inside virtual machines

TODO:

• use grsecurity sources from Debian repository (not from grsecurity.net because then we can avoid custom gpg verification)
• package needs more testing and eventually various fixes
• the ‘make menuconfig’ which currently needs manual interaction needs to be automated (preseeded by a configuration file most likely?)
• sane, secure, useful kernel compilation configuration file required
• never mind MPROTECT for now (can be disabled)
• test if it works inside Qubes and fix if required
• test if it works inside Qubes-Whonix and fix if required

possibly helpful:

• GitHub - coldhakca/coldkernel: Hardened kernel generation - Deprecated - grsecurity for xen
• http://www.webcitation.org/6hG9TVlld - previous work and previous ticket discussion

Bounty too low?:

1. Go to https://www.bountysource.com/issues/14471558-make-grsecurity-kernel-grsecurity-installer-work-inside-whonix
2. Click on “Developers”
3. Click on “Get Started”
4. Select Status “Bounty too low”
5. Enter your offer and press “Save”.

---

Mirrored from:
https://phabricator.whonix.org/T301

---

Mirrored to:
https://github.com/Whonix/grsecurity-installer/issues/1

---

On bountysource:
https://www.bountysource.com/issues/14471558-make-grsecurity-kernel-grsecurity-installer-work-inside-whonix

(If you are reading on bountysouce, you can skip all comments until Snapshot of this before I am going to rewrite the ticket. and read from there.)

Comments

---

HulaHoop

2015-05-13 01:47:50 UTC

A compact list of sane grsec defaults as deployed on gentoo:

Hardened/Grsecurity2 Quickstart - Gentoo wiki

Comprehensive coverage of grsec features and default settings:

Security - ArchWiki

---

HulaHoop

2015-05-20 12:53:41 UTC

What are cons of using the Mempo kernel that’s already patched with grsecurity?

---

Patrick

2015-05-20 13:38:01 UTC

Mempo kernel:

• project cannot be taken serious, see discussion: Whonix Forum

• high lag with reply: avoid code duplication - upstream to Debian? · Issue #31 · mempo/mempo-kernel · GitHub

• no reply: invite linux-patch-grsecurity2 maintainers to Teams/Grsecurity? · Issue #30 · mempo/mempo-kernel · GitHub

• not in Debian

• → not very well maintained

• does it even compile?

• the size of that repository, number of files, number of code lines vs grsecurity-installer is deterring

• repository contains a history of grsecurity patches → bad practice → nowhere near ready for inclusion into Debian

• seems more like a repository that is run by maintainers to compile a kernel that will be uploaded to a deb repository used for Mempo rather than a grsecurity-installer that would be similar to torbrowser-launcher / tb-updater, that is supposed to be run by a Debian user

• maybe parts of it would be useful for grsecurity-installer, perhaps they have sorted auto automating kernel config

---

HulaHoop

2015-05-20 16:25:35 UTC

What about the corsac repository listed in:
grsecurity - Debian Wiki

---

Patrick

2015-05-21 14:18:29 UTC

It’s also just a compiled kernel. I am that far. Has almost the same TODO as this ticket. Non-minor stuff such as “desktop environment (kdm) currently does not start, needs fixing”.

---

Patrick

2015-06-06 03:00:01 UTC

Corsac.net - Echoes: Followup on Debian grsec kernels for Jessie

---

HulaHoop

2015-08-18 19:50:58 UTC

Long term I think its better to have a script to compile and update a grsec kernel than a package in upstream repos because some protections can only be effective if they are unique to the user. A precompiled kernel loses these benefits because the protection values are public and known to everyone including the attacker. Arch has a packaged kernel and they explain the limits:

Security - ArchWiki

I see the potential problems with update logistics same as you had to handle with TBB updater bit it’s a trade off between full protection and ease of compilation.

This is a big project in itself. The ideas I’ll post belong on Rickard’s github tracker:

The script should have different default option configuration files so users can choose depending on the intended use of the computer server vs desktop.

Tor support so all this can happen anonymously preventing metadata and package info from leaking.

---

HulaHoop

2015-08-21 21:15:32 UTC

Actually the best option is the availability of a Debian grsecurity kernel source package that can be deterministically built. That way the maintenance and update burden is handled upstream and it can be securely installed thru apt with the full protections of grsecurity.

---

HulaHoop

2017-04-29 16:20:19 UTC

upstream ceased open development: grsecurity