phoronix covers my work on OpenPaX, a patch to restore userspace W^X and some other common sense functionality from PaX: https://www.phoronix.com/news/Edera-OpenPaX-Announced

Ariadne Conill 🐰:therian:

this patch is the cornerstone of the new “alpine hardened” project, which is intended to produce a spin of alpine which is similar to the old grsecurity days of alpine.

Ariadne Conill 🐰:therian:

as i’m sure spender will be irritated by this coverage, i will just point to https://grsecurity.net/passing_the_baton

thanks for the baton dude, I’m just following your instructions

gaytabase

@ariadne well gosh if it bothered them, they could always have kept on maintaining it themselves.

nina

@ariadne is this going to be just a git tree, or are there going to be patches for stable releases or at least repo tags? i'd be interested in providing a kernel build flavor, but the way that would be done depends on how this is distributed

Ariadne Conill 🐰:therian:

@q66 there is a monolithic patch option available at distfiles.ariadne.space/openpax

nina

@ariadne ah, i did not see that linked anywhere

doesn't look too bad; if i understand this right, everything is on by default, unless disabled via xattr?

Ariadne Conill 🐰:therian:

@q66 correct. it is only the modern PaX experience which is reproduced. i dropped all legacy stuff.

Ariadne Conill 🐰:therian:

anyway, OpenPaX is (obviously) not a complete reimplementation of grsecurity. it is only a few months old.

our goal is to upstream things to @torvalds as we have increased confidence in them.

so this will probably start with ASLR hardening first, and then userspace W^X.

next on my list of new development is UDEREF, followed by KERNEXEC. but this will happen after the upstreaming work, most likely.

Eloy

@ariadne @torvalds do you think grsecurity patches were not upstreamed before for technical reasons, personality clashes between Torvalds and Spender or both?

ティージェーグレェ

@ariadne As someone who used Adamantix way back in the day, good luck on upstreaming that kind of stuff.

You'll probably need it.

Ariadne Conill 🐰:therian:

@teajaygrey i think it is possible. we just have to show that the userspace contract is not materially violated.

for example, the main point of pushback against userspace W^X was that PaX included NX-bit emulation for old CPUs. OpenPaX does not bother with this because basically every CPU sold in the past 20 years has NX-bit.

additionally: systemd already got opt-in userspace W^X as a prctl upstream

like jam or bootlaces

@eloy

I seem to remember there were provenance concerns over patches submitted to grsecurity that it accepted but that upstream Linux wasn't so comfortable accepting

@ariadne @torvalds

Ariadne Conill 🐰:therian:

@idlestate @eloy @torvalds yes, that is part of it. nobody knows who "The PaX team" is.

well, presumably spender knows.

but the kernel community sure doesn't...

F. Maury ⏚

@ariadne FWIW, it's Spengler, not spender

F. Maury ⏚

@ariadne @torvalds

"my work on OpenPaX"
"our goal"
"nobody knows who "The PaX team" is."

Ariadne Conill 🐰:therian:

@x_cli @torvalds openpax and the original pax are different projects

Ariadne Conill 🐰:therian:

@x_cli spender is his irc nickname