Qubes 4 with Grsec could make a big splash
kev27
I think if Grsec would be enabled by default in Qubes, it would be no question that Qubes is the most secure operating system out there.
kev27
> I saw this being retweeted by the Qubes account on Twitter. Can Grsec support still land in Qubes 4.0, or should we expect it for 4.1 or 4.2, etc?
>
> I think if Grsec would be enabled by default in Qubes, it would be no question that Qubes is the most secure operating system out there.
Forgot to add the link:
Ronald Duncan
jkitt
That's great news! Except PAX protections require more than just the kernel - they require PIE/PIC compiled binaries/SO's. There's also a number of security options that should be enabled in the GCC compiler (see the Gentoo hardened GCC profile). This means that the entire userspace would need to be recompiled and distributed as a hardened image - someone will need to do the legwork; and it will need to be signed by a trusted party.
jkitt
> Will this be using the latest linux kernel since grsecurity only provide the latest version free.
Yes, it will be an "unstable" kernel. A bare metal grsec kernel is actually available in Debian's testing repo. However, it is not compiled with optimal hypervisor guest options, and will be slow (if working at all) in a Xen guest environment. And because it's in the testing repo it probably doesn't receive as much attention to security as stable.
raah...@gmail.com
can you just tell us the options so we can compile it ourselves? paste the cfg or something.
raah...@gmail.com
does it need any other special patches? something like this to stay up to date you gonna need compile the multiple times a month.
Salmiakki
> I saw this being retweeted by the Qubes account on Twitter. Can Grsec support still land in Qubes 4.0, or should we expect it for 4.1 or 4.2, etc?
>
> I think if Grsec would be enabled by default in Qubes, it would be no question that Qubes is the most secure operating system out there.
Technically you could consider having grsec in dom0 or in AppVMs. It seems unklikely to me that it will appear as a default in either place.
In dom0 it isn't really necessary because it is extremely hardened and trustworthy already. In AppVMs it can be used already which is what this tweet is about but I doubt that the default Fedora template will change.
jkitt
> can you just tell us the options so we can compile it ourselves? paste the cfg or something.
Also:
> Can I add -fstack-protector-all or -fstack-protector in the make.conf CFLAGS?
> No, they will likely break the building of many packages, amongst others glibc.
in other words these options will break some packages - particularly glibc; ulibc is more flexible in that regards.
There's also: https://wiki.gentoo.org/wiki/Hardened/Toolchain
It's not as straightforward as you think. Perhaps you can build selected applications as statically linked with PIE, and place it in a grsec chroot instead - it would be a lot simpler.
I'd really like to see Gentoo (hardened) support, that and OpenBSD.
raah...@gmail.com
I meant if you were able to fpaste the .config file of your grsec kernel. I don't know anything about hardened building of the kernel. Is that nescessary? lol
raah...@gmail.com
I've always used a grsec kernel with baremetal debian. I just slete the default security over performance option. But I'm assuming some pax settings conflict with xen? So wanted to see your working .config file. Or maybe i'm wrong and should just try it myself...
I just kind of figure that since I'm using qubes whats the point is it really worth all the effort...
Patrick Schleizer
jkitt
A grsecurity kernel on it's own is not adequate enough. Someone will need to distribute a hardened userspace.
The coldhaka kernel is in alpha. It's a start but not a solution.
raah...@gmail.com
its not nescessary to use grsec, but I guess makes it more secure.
The problem i'm having now trying not even a custom grsec kernel, but the debian 3.16 kernel from their repos. is that the vm I created when booting is asking me for a login? so if I type root it gives it to me. but it doesn't seem to be functioning right. The vm starts shows green light, then goes yellow light. And I can't load any programs from it like terminal.
I folloowed directions to install pvgrub2-xen in dom0.
Then in template vm installed qubes-kernel-vm-support grub2-common and installed kernel. then update-grub and shutdown. What did I do wrong?
raah...@gmail.com
forgot to add I get root with sudo xl console, and selected pvgrub2 in vm kernel settings.
Grzesiek Chodzicki
> I saw this being retweeted by the Qubes account on Twitter. Can Grsec support still land in Qubes 4.0, or should we expect it for 4.1 or 4.2, etc?
>
> I think if Grsec would be enabled by default in Qubes, it would be no question that Qubes is the most secure operating system out there.
Marek Marczykowski-Górecki
Hash: SHA256
On Fri, Nov 25, 2016 at 09:08:03PM -0800, jkitt wrote:
> The point is that the security of a grsecurity protected system depends on the userspace being compiled in a special way. The binaries need to be compiled with pie, and shared objects need to be compiled with pic. There are also some other mitigations like SSP.
executables - I think most distributions do this only for selected
binaries only.
> A grsecurity kernel on it's own is not adequate enough. Someone will need to distribute a hardened userspace.
>
> The coldhaka kernel is in alpha. It's a start but not a solution.
>
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJYOWr8AAoJENuP0xzK19csNYoH/iaSyiPdIK0quLx1nu3WaB1A
kgqEkY2W9/JIjprX7di8POL9xOSs6m0S7GAlefuhj4XOtY2vJSbfnaBt3AkKUK/9
G0x9o6UdmbjeiXPqGDEvHi0PfKdVer138IkdcgvFmBp9WAj0mgJdq1cKrZ9VfV8s
dBwX6R2uJkQ/F/EXaSuDNqy9xmI3x5Ea96pCQ8bcocj+7gSUzsVxl9F7Zkni3nUU
9ffnoxlzNMoxvqzi+liRCnwSYplNdcKkhIIJ/d/8Lz0ibyTjxkBPZFmUXYw6AKlr
+FK7wrD1ODYBeYEAcHEYpU3rmUkpmvErwR2PH5ZL9BpNZ8rp5z+NhJLSldQ72kM=
=lyTt
-----END PGP SIGNATURE-----