search

anthraxx / linux-hardened

Minimal supplement to upstream Kernel Self Protection Project changes. Features already provided by SELinux + Yama and archs other than multiarch arm64 / x86_64 aren't in scope. Only tags have stable history. Shared IRC channel with KSPP: irc.libera.chat #linux-hardening
Other
567 stars 56 forks source link

Is this project dead or in need of help? #44

Closed hyder365 closed 4 years ago

hyder365 commented 4 years ago

Hi, the linux-hardened patchset seems to be in a state of decay. The volunteer work of the single linux-hardened maintainer is very much appreciated, but I'd like to find out what can be done to help out.

First, why is this patch needed? Have any/all of the patches been rejected by upstream? I have read the whole patch and it's fairly small.

Anyway, it's still on the 5.6 branch, meaning it won't get all of the security-related fixes that go in upstream. They simply do not backport everything. The 5.6 branch will also have a limited lifespan. Is the lack of update to 5.7 due to lack of developer time? Would donations from users help?

Even keeping with 5.6, assuming 5.7 has some merge issues that haven't been resolved, the updates are getting slower and slower behind upstream 5.6 releases.

I have seen some smart peoples from Whonix and other groups helping the project, contributing patches, and answering questions on Github. Would it be a good idea to introduce a second maintainer for the patch and Arch package?

anthraxx commented 4 years ago

It's active and some features are extended that can't be managed to get upstreamed. Accepting new things is being done with lots of care and testing and feedback and mostly if they are deemed non accepted by vanilla due to politics, performance concerns or other reason.

5.7 has issues with KASAN since the slab freepointer was relocated to the middle of the object. The slab canaries and SLAB_SANITIZE_VERIFY fails after unpoisoning the shadow area by KASAN. Feel free to dig into it and get it fixed, just enable KASAN with SLAB_SANITIZE_VERIFY should yield to immediate early boot crash. That's basically the concerns that keeps 5.7 from being published

Ultimately I'm working on getting github sponsorship running to be able to invest more of my time dedicated to this project instead of just being able to maintain this in some of my free time. Once that's set up donations are very much appreciated to make this goal happen.

I'm closing this issue, but feel invited to help however you can/wish or get in contact with me.

Bernhard40 commented 4 years ago

@anthraxx could SLAB_SANITIZE_VERIFY depend on !KASAN for the time being? Nobody should use the latter in production anyway.

anthraxx commented 4 years ago

@Bernhard40 it would also require to disable slab canary checks, as they get trashed too once slab verify passes. considering KASAN wasn't even usable until a couple of major releases ago, thats most likely what will temporarily happen as 5.6 is EOL now, but its important to understand the nature of this issue.

tsautereau-anssi commented 4 years ago

@Bernhard40 it would also require to disable slab canary checks, as they get trashed too once slab verify passes.

IIRC, my fix to use get_info_end() in get_canary() was enough to make SLAB_SANITIZE_VERIFY ^ KASAN work fine with SLAB_CANARY. So we could indeed have SLAB_SANITIZE_VERIFY depend on !KASAN, at least temporarily, but as @anthraxx pointed out we'd really like to fully understand the roots of this conflict. Anyway, it's a bit out of topic here :stuck_out_tongue:

hyder365 commented 4 years ago

For those of us depending on linux-hardened for our systems, we're currently left without security fixes being merged to 5.7.x. Is there any ETA for an update, even if it has to temporarily disable the one feature that needs more porting time?

anthraxx commented 4 years ago

@hyder365 its planned for this weekend after doing some more test rounds and with excluding SLAB_SANITIZE_VERIFY if KASAN is enabled.

hyder365 commented 4 years ago

@hyder365 its planned for this weekend after doing some more test rounds and with excluding SLAB_SANITIZE_VERIFY if KASAN is enabled.

Weekend has come and gone with the planned update nowhere to be found...

If @madaidan was interested in co-maintaining the github project (can't speak for him) would you consider it? He also has various pull requests for nice features that still haven't been integrated.

hyder365 commented 4 years ago

@anthraxx we're now 2 versions behind on 5.8 and 4 versions behind on 5.7.