#grsec

Today i am releasing last ESK kernel due to the changes that recently was done by grsecurity and PAX team. It is build upon latest publicly available patch for kernel 3.14.51 (no longer available for download). You can grab binary builds here:

- ESK 3.14.51-pv(GPGsignature) sha256: b62d82b3056fa49c0219c2dd345d24966ce21957c5744722522ec0c0f4944efa

- ESK 3.14.51-hvm(GPGsignature) sha256: 388c43175bdb6c6d3a9edfac480c68a6e48dcbfd944d9280f5ccb9e57ca1a60a

mempo (deb) : https://wiki.debian.org/Mempo/ https://github.com/mempo/mempo-kernel tails: https://tails.boum.org/

parrot sec os: http://www.parrotsec.org/

kali https://www.kali.org/

Update: I have prepared new builds (#2) with GCC 4.9 which implies use of -fstack-protector-strong for better buffer overflow protection.

New release of ESK is available for both PV and HVM virtualisation:

- ESK 3.14.39-pv2(GPG signature) sha256:bfe1da235931506a5a9f35d00d382d77eb61a39a6762822bf5cd5f0845a01b64

- ESK 3.14.39-hvm2(GPG signature) sha256:b8aa3b48e55156a3ed85f53f332e74b782d51ed4c0ac1609b442491584c93448

New build for kernel line 3.2.60 has been released. Also new stable ESK kernel for 3.14.11 is available. Download new builds here:

- ESK 3.2.60

- ESK 3.14.11

I have just released new builds of ESK kernels with latest grsecurity patch. New release includes fix for recently announced critical vulnerability in futex, see CVE-2014-3153. Download ESK 3.2.59-1 here. 

In addition i have also prepared test build of kernel 3.14.5. From my personal tests it seems 3.14.5 is slightly faster then 3.2.x. Difference range from few percent up to 30%(?). This is only approximation as i did not check them precisely. If you want to play with it download ESK 3.14.5-1. 

I have released AMI (Amazon Machine Images) with ESK kernel and system security enhancements to the AWS community portal. AMI is based on Debian 7.5 bootstrap - minimal installation. Only additional packages installed are that required for kernel compilation. I will refer to it as ES-Debian for short name.

Here are highlights of the AMI:

name: debian-7.5-amd64-grsec-enhanced-security available in 2 regions: us-east-1 (ami-64dc300c) and eu-west-1 (ami-818747f6)

kernel: latest 3.2.58 ESK

gradm 3.0

paxctl 0.8

umask 027

special groups: untrusted, readproc, symlinkrestr

TPE enabled

build script for getting and compiling new kernel and grsecurity patch (warning: dirty scripting), see in /usr/src/

sudo: only users in group admin can authenticate

some overall system tweaks for performance in sysctl.conf

It looks like this is only AMI available with grsecurity support. This seems to be perfect choice for anyone considered in security, especially developers writing code in languages like ruby. It prevents a whole range of zero-day exploits and together with TPE and RBAC enhances greatly security of your server. 

Thanks goes to ProcessOne for hosting AMI.

You may run into a problem when using grsecurity or ESK kernel together with erlang. Seems like grsec prevents erlang runtime from properly detect CPU topology when running as unprivileged user :

1> erlang:system_info(cpu_topology). undefined

there is simple solution to this problem, you need to define topology by hand using +sct flag. For 2 core machine it's like:

erl +sct L0-1c0-1

and now you can bind schedulers (+sbt) to cores:

erl +sct L0-1c0-1 +sbt s