Differences

This shows you the differences between two versions of the page.

--- linux:grsec [2006/07/26 14:23]
a
+++ linux:grsec [2006/12/16 00:48]
a
@@ Line 41: / Line 41: @@
 ==== kernel 2.4.x tips ====
 ==== kernel 2.6.x tips ====
+=== What to include in 2.6 with GRSecurity (Safeway) ===
+**taken from: [[http://lists.grok.org.uk/pipermail/full-disclosure/2003-August/008236.htm|here]]
+**
+There are some problems with some applications with parts of the patch. For
+example, turning on the non-executeable stack will break anything that uses
+an executeable stack. ie: X, java, or wine, now you can use chpax and give
+each of these a non executable stack. There are also some problems with the
+way grsecurity gets a little to restrictive with things like restericting
+filesystems ect. All of these can be overcome, however, you need to do some
+magic to get some of these things to work, and frankly, some of it really
+isnt worth it.
+There are several options inside the grsecurity patch that you can choose.
+What you can safely turn on in GRsecurity without breaking anything is:
+   * **''Address Space Protection''**
+   * **''Address Space Layout Randomization''**
+      * **''Randomize kernel stack base''**
+      * **''Randomize user stack base''**
+      * **''Randomize mmap() base''**
+   * **Filesystem Protections**
+      * //Everything under this option is safe to include//
+   * **''Kernel Auditing''**
+      * //Everything under this option is safe to include//
+   * **''Executable Protections''**
+      * //Everything under this option is safe to __incude except__:// ''Partially restrict non-root users''
+  * **''Network Protections''**
+     * //Everything under this option is safe to include//
+  * **''Sysctl support''** //This is usefull to enable, but not necesary
+//
+Compile everything staticly and you shold be fine.
+I have tested this on production servers, and desktop boxes in mass and its
+come out fine for x86 and sparc. I havent tried it on ppc but for the most
+part it is safe, and it is also safe for production envoirnments.
 ===== Configuration =====
@@ Line 162: / Line 207: @@
 ==== grsec iptables patch ====
 FIXME TODO