|This article relies too much on references to primary sources. (October 2014) (Learn how and when to remove this template message)|
|Developer(s)||Brad Spengler (Spender)|
|Stable release||3.1 for Linux Kernels 3.14.79 and 4.4.45
(26 January 2017 ) [±]
|Preview release||3.1 for Linux Kernel 4.8.17
(15 January 2017 ) [±]
grsecurity is a set of patches for the Linux kernel which emphasize security enhancements. The patches are typically used by computer systems which accept remote connections from untrusted locations, such as web servers and systems offering shell access to its users. Grsecurity provides a collection of security features to the Linux kernel, including address space protection, enhanced auditing and process control. Grsecurity is produced by Open Source Security, Inc., headquartered in Pennsylvania. Work on grsecurity began in February 2001 as a port of Openwall Project's security-enhancing patches for version 2.4 of the Linux kernel mainline. The first release of grsecurity was for the Linux kernel 2.4.1.
From 2001 to September 2015, grsecurity developers offered all stable and test patches as free downloads on the grsecurity website. In late-August 2015, Open Source Security announced that it would only make the stable releases available to paid subscribers, citing that a "multi-billion dollar corporation" involved in embedded Linux had diluted its trademarks by "using the grsecurity name all over its marketing material and blog posts to describe their backported, unsupported, unmaintained version in a version of Linux with other code modifications that haven't been evaluated by us for security impact".  On April 26, 2017, grsecurity developers "hand[ed] over future maintenance of grsecurity test patches to the community" and stopped offering free downloads of patches on the grsecurity website.
As a derivative work of the Linux kernel, grsecurity's code is licensed under the GNU General Public License version 2. However, grsecurity is only distributed to paid subscribers, and its use requires agreement to a grsecurity Access Agreement which voids access to future versions if the code is redistributed.
Bruce Perens, co-founder of the Open Source Initiative, argued in 2017 that these terms violate the GPL as it adds additional conditions to redistribution. In August 2017, Perens was sued by Open Source Security Inc. for defamation, claiming that "Under the Subscription Agreement, clients are informed that they have all rights and obligations granted by the GPLv2 for the Patches in their possession", and that it "does not apply further restrictions on a client’s ability to redistribute the Patches in their possession, or restrict their ability to exercise their rights for Patches in their possession, in accordance with the terms and conditions of the GPLv2."
Grsecurity developers do not actively participate in submitting features from grsecurity to the mainline Linux kernel. In June 2017, Linus Torvalds, the original developer of Linux, responded on the Linux kernel mailing list to a question about grsecurity: "The thing is a joke, and they are clowns. When they started talking about people taking advantage of them, I stopped trying to be polite about their bullshit. Their patches are pure garbage." When this statement was subsequently addressed on another security list, Linus urged grsecurity developers to work on submitting to the mainline Linux kernel instead.
A major component bundled with grsecurity is PaX. Among other features, the patch flags data memory, the stack, for example, as non-executable and program memory as non-writable. The aim is to prevent memory from being overwritten, which can help to prevent many types of security vulnerabilities, such as buffer overflows. PaX also provides address space layout randomization (ASLR), which randomizes important memory addresses to reduce the probability of attacks that rely on easily predicted memory addresses.
Role-based access control
Another notable component of grsecurity is that it provides a full role-based access control (RBAC) system. RBAC is intended to restrict access to the system further than what is normally provided by Unix access control lists, with the aim of creating a fully least-privilege system, where users and processes have the absolute minimum privileges to work correctly and nothing more. This way, if the system is compromised, the ability of the attacker to damage or gain sensitive information on the system can be drastically reduced. RBAC works through a collection of roles. Each role can have individual restrictions on what it can or cannot do, and these roles and restrictions form an access policy which can be amended as needed.
A list of RBAC features:
- Domain support for users and groups
- Role transition tables
- IP-based roles
- Non-root access to special roles
- Special roles that require no authentication
- Nested subjects
- Support for variables in the configuration
- And, or, and difference set operations on variables in configuration
- Object mode that controls the creation of setuid and setgid files
- Create and delete object modes
- Kernel interpretation of inheritance
- Real-time regular expression resolution
- Ability to deny ptraces to specific processes
- User and group transition checking and enforcement on an inclusive or exclusive basis
- /dev/grsec entry for kernel authentication and learning logs
- Next-generation code that produces least-privilege policies for the entire system with no configuration
- Policy statistics for gradm
- Inheritance-based learning
- Learning configuration file that allows the administrator to enable inheritance-based learning or disable learning on specific paths
- Full path names for offending process and parent process
- RBAC status function for gradm
- /proc/<pid>/ipaddr gives the remote address of the person who started a given process
- Secure policy enforcement
- Supports read, write, append, execute, view, and read-only ptrace object permissions
- Supports hide, protect, and override subject flags
- Supports the PaX flags
- Shared memory protection feature
- Integrated local attack response on all alerts
- Subject flag that ensures a process can never execute trojaned code
- Full-featured, fine-grained auditing
- Resource, socket, and capability support
- Protection against exploit bruteforcing
- /proc/pid filedescriptor/memory protection
- Rules can be placed on non-existent files/processes
- Policy regeneration on subjects and objects
- Configurable log suppression
- Configurable process accounting
- Human-readable configuration
- Not filesystem or architecture dependent
- Scales well: supports as many policies as memory can handle with the same performance hit
- No run-time memory allocation
- SMP safe
- O(1) time efficiency for most operations
- Include directive for specifying additional policies
- Enable, disable, reload capabilities
- Option to hide kernel processes
- No attaching shared memory outside chroot
- No sending of signals by
- No viewing of any process outside chroot, even if /proc is mounted
- No mounting or remounting
- No double chroot
fchdirout of chroot
- No raising of scheduler priority
- No connecting to abstract unix domain sockets outside chroot
- Removal of harmful privileges via cap
Among other things, it can be configured to audit a specific group of users, mounting/unmounting of devices, changes to the system time and date, and
chdir logging. Some of the other audit types allow the administrator to also log denied resource attempts, failed
fork attempts, IPC creation and removal, and
exec logging together with its arguments.
Trusted path execution is another optional feature that can be used to prevent users from executing binaries not owned by the root user, or world-writable binaries. This is useful to prevent users from executing their own malicious binaries or accidentally executing world-writable system binaries that could have been modified by a malicious user.
grsecurity also hardens the way chroot "jails" work. A chroot jail can be used to isolate a particular process from the rest of the system, which can be used to minimise the potential for damage should the service be compromised. There are ways to "break out" of a chroot jail, which grsecurity attempts to prevent.
List of additional features and security improvements:
/procrestrictions that do not leak information about process owners
- Symlink/hardlink restrictions to prevent
- FIFO restrictions
- Enhanced implementation of trusted path execution
- GID-based socket restrictions
- Nearly all options are
sysctl-tunable, with a locking mechanism
- All alerts and audits support a feature that logs the IP address of the attacker with the log
- Stream connections across Unix domain sockets carry the attacker's IP address with them (on 2.4 only)
- Detection of local connections: copies attacker's IP address to the other task
- Automatic deterrence of exploit brute-forcing
- Low, medium, high, and custom security levels
- Tunable flood-time and burst for logging
- Application firewall
- Exec Shield
- Intel MPX
- Linux Security Modules
- Security-Enhanced Linux
- "Grsecurity Features".
- "Open Source Security Inc. Announces World-First Fully CFI-Hardened OS Kernel". PRWeb. Retrieved 2017-07-05.
- "Grsecurity will stop issuing patches citing trademark abuse". NetworkWorld. Retrieved 2017-07-09.
- Brad Spengler; The PaX Team (2015-08-26). "Important Notice Regarding Public Availability of Stable Patches". grsecurity.net. Retrieved 2016-06-21.
- Brad Spengler & The PaX Team (2017-04-26). "Grsecurity Passing the Baton". grsecurity.com. Retrieved 2017-04-28.
- "Stable Patch Access Agreement". grsecurity.net. 2 October 2016.
- "Access Agreement FAQ". grsecurity.net. 10 July 2017.
- "OSS v. Perens Complaint" (PDF). 17 July 2017.
- "Open-source advocate sued over comments on kernel hardening group". ITWire. Retrieved August 5, 2017.
- Torvalds, Linus. "oss-sec: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method". seclists.org. Retrieved 2017-08-15.
- Spengler, Brad. "oss-sec: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method". seclists.org. Retrieved 2017-08-15.
- "grsecurity". grsecurity.net. Retrieved 2010-08-12.
|Wikibooks has a book on the topic of: Grsecurity|