Date: Tue, 2 May 2017 22:46:57 +0800 From: Shawn <citypw@...il.com> To: Rik van Riel <riel@...hat.com> Cc: Mathias Krause <minipli@...glemail.com>, Kees Cook <keescook@...omium.org>, Daniel Cegiełka <daniel.cegielka@...il.com>, "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com> Subject: Re: It looks like there will be no more public versions of PaX and Grsec. On Tue, May 2, 2017 at 8:09 AM, Rik van Riel <riel@...hat.com> wrote: > On Tue, 2017-05-02 at 00:01 +0200, Mathias Krause wrote: > >> I think the intention of the KSPP is good -- making vanilla Linux >> more >> secure. But the way it does its work harms overall Linux security. It >> does hurt mine, that's for sure! > > Yeah, no. The grsecurity people produced patches > that were used on maybe a few tens of thousands > of systems, while the KSPP code will end up > enhancing the security of over a billion Android > devices. > Are you serious think KSPP can solve Android security issue without changing the current Android eco-system? It's about one billion Android device( most are old armv7 based) can be exploited and being used by criminal and BIGBROs( NSA/CIA/PLA/whatever-A*/etc) with low cost. I made hardened PoC( based on PaX + PXN + some code hardening) for Nexus 7 2013 back in 2015. It proved that it can defeat "massive" exp without much perf impact. But I don't see any sign those cellphone vendors would port any KSPP features into the old devices. How about new phone? I ported a couple of KSPP features( all originally done or inspired by PaX/Grsecurity) to Pixel XL: https://github.com/hardenedlinux/armv7-nexus7-grsec Google's Pixel/Pixel2 may be the one of few cellphones can getting benefit from KSPP. Otherwise, my own phone is running with much more hardening features than Android O( released in Oct?) but it's still not secure enough to defeat customized exploit. > Those Android devices are more likely to require > hardening, too, since they do not receive security > updates as quickly as the systems maintained by > grsecurity users. > Don't worry about it. PaX/Grsecurity can defeat multiple public exploits without any fix. Maybe some ppl will go to maintain 4.9 LTS. > Integrating hardening into the upstream kernel is > a good thing for security, not a bad thing. > It depends how much security you need. -- GNU powered it... GPL protect it... God blessing it... regards Shawn
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.