Grsecurity is a set of patches for the Linux kernel which emphasize security enhancements. The patches are typically used by computer systems which accept remote connections from untrusted locations, such as web servers and systems offering shell access to its users. Grsecurity provides a collection of security features to the Linux kernel, including address space protection, enhanced auditing and process control. Grsecurity is produced by Open Source Security, Inc., headquartered in Pennsylvania, and since April 2017 (Linux 4.9) the patches (including test ones) are only available to their paying customers.
Grsecurity started in 2001, with PaX being a major component. As of 2009 its developers have complained about funding problems.[1] Since April 2017 Grsecurity switched to a subscription-only model. Customers are discouraged from redistributing the patch by a threat of terminating future grsecurity access.[2] It is legal to forward-port the later available GPLv2 versions to newer Linux kernels, although in practice this has not been done due to the complexity involved, since the "set of patches" in practice has always been released as one large patch.
A major component bundled with grsecurity is PaX. Among other features, the patch flags data memory, the stack, for example, as non-executable and program memory as non-writable. The aim is to prevent memory from being overwritten, which can help to prevent many types of security vulnerabilities, such as buffer overflows. PaX also provides address space layout randomization (ASLR), which randomizes important memory addresses to reduce the probability of attacks that rely on easily predicted memory addresses.
Another notable component of grsecurity is that it provides a full role-based access control (RBAC) system. RBAC is intended to restrict access to the system further than what is normally provided by Unix access control lists, with the aim of creating a fully least-privilege system, where users and processes have the absolute minimum privileges to work correctly and nothing more. This way, if the system is compromised, the ability of the attacker to damage or gain sensitive information on the system can be drastically reduced. RBAC works through a collection of roles. Each role can have individual restrictions on what it can or cannot do, and these roles and restrictions form an access policy which can be amended as needed.
A list of RBAC features:
grsecurity restricts chroot in a variety of ways to prevent various vulnerabilities and privilege escalation attacks, as well as to add additional checks:
kill
, ptrace
(architecture-independent), capget
, setpgid
, getpgid
and getsid
outside chrootfcntl
outside chrootpivot_root
fchdir
out of chrootchdir("/")
upon chroot(f)chmod +s
mknod
sysctl
writesAmong other things, it can be configured to audit a specific group of users, mounting/unmounting of devices, changes to the system time and date, and chdir
logging. Some of the other audit types allow the administrator to also log denied resource attempts, failed fork
attempts, IPC creation and removal, and exec
logging together with its arguments.
Trusted path execution is another optional feature that can be used to prevent users from executing binaries not owned by the root user, or world-writable binaries. This is useful to prevent users from executing their own malicious binaries or accidentally executing world-writable system binaries that could have been modified by a malicious user.
grsecurity also hardens the way chroot "jails" work. A chroot jail can be used to isolate a particular process from the rest of the system, which can be used to minimise the potential for damage should the service be compromised. There are ways to "break out" of a chroot jail, which grsecurity attempts to prevent.
There are also other features that increase security and prevent users from gaining unnecessary knowledge about the system, such as restricting the dmesg
and netstat
commands to the root user.[3]
List of additional features and security improvements:
/proc
restrictions that do not leak information about process owners/tmp
racesdmesg
restrictionsysctl
-tunable, with a locking mechanismThe grsecurity patches have never been submitted for inclusion in the mainline Linux kernel, for the following reasons:[1][4][5]
In addition, grsecurity is since 2017 a subscription-only service, and it would not make sense to give up on a core product.[4]
After access to the grsecurity stable patches was restricted, Bruce Perens speculated in a blog post that using the patches obtained under OSS, Inc.'s Stable Patch Access Agreement,[2] which, according to Perens, "adds a term to the GPL prohibiting distribution or creating a penalty for distribution", may expose clients to legal risk, such as copyright infringement. Brad Spengler of Open Source Security, Inc. sued for defamation in December 2017.[7][8] The case, Open Source Sec., Inc. v. Perens, was initially dismissed by the district court, so he took it up to the United States Court of Appeals for the Ninth Circuit.[9] Spengler lost the appeal, and was directed to pay Bruce Perens and his legal team almost $260,000.[10]
The content is sourced from: https://handwiki.org/wiki/Software:Grsecurity