grsecurity: add gradm, paxctl, and pax-utils (take #2)#1771
grsecurity: add gradm, paxctl, and pax-utils (take #2)#1771wizeman merged 3 commits intoNixOS:masterfrom
Conversation
|
Looks good to me! |
This also ensures the appropriate udev rules are installed. Signed-off-by: Austin Seipp <[email protected]>
Signed-off-by: Austin Seipp <[email protected]>
Signed-off-by: Austin Seipp <[email protected]>
|
@wizeman Can these get merged? I updated the packages to also properly include ( |
|
@thoughtpolice I will add myself as a maintainer later to all the packages I'm keeping track of. Your patches look good to me and I am OK with getting them merged. However, I am not quite clear whether I should be merging them myself, taking into account that this is not a simple version update and only very recently I was given commit access... |
|
I guess what I'm saying is that I'm not clear what are the rules for getting something merged into the repository. For example, I wonder how many reviews/reviewers are needed when adding a new package, or how many are needed for changing an existing package, ...? |
|
@wizeman: no rules exist (except that stable branch is only meant for maintenance+security updates), we rely purely on judgement of each individual. |
|
In that case, I think I'm going to go ahead and merge it... Even though I assume we're close to the 14.02 release, this is just adding new packages, so I think there's very little risk of regressions. |
grsecurity: add gradm, paxctl, and pax-utils (take #2)
|
Thanks, @thoughtpolice ! |
|
Excellent, thanks! I do hope these packages are useful for the 14.02 release, and I think that they will be useful to anyone who wants to deploy grsecurity. (Relatedly, I also hope in the future that grsecurity stable-kernel updates can be shipped to the stable branch as well, if they are not already.) |
3 participants
Per the #1765 (hopefully without GitHub eating my pull requests again).
buildInputsseem to be required. Especially for GCC, because the Makefile forgradmis hard-coded to otherwise use/usr/bin/gccit seems, which results inldfailing due to an impure link at the end. The makefile is a bit hacky unfortunately so IMO it's safer to properly specify all the tools it needs explicitly.Otherwise I think this is good to go.
This adds 3 packages you might typically want with a grsec deployment.
The pieces here basically overlap some of with #1187 (which I found after I wrote my own
gradmpackage). This also installs the udev rules forgradm.Unlike the work by @wizeman it doesn't attempt to properly mark JIT binaries via
paxctl- it only adds the packages. But I think there's no reason to hold back the packages even without this.And
pax-utilsis from the Hardened Gentoo project, and includes some useful utilities (likepspax).