Updates SecureDrop metapackage logic

freedomofpress / ansible-role-grsecurity

The documentation and build system for the grsecurity kernel maintained by the Freedom of the Press Foundation for SecureDrop

GNU General Public License v2.0

49 stars 13 forks source link

Updates SecureDrop metapackage logic #91

Closed conorsch closed 7 years ago

conorsch commented 7 years ago

Overhaul of the build-grsec-metapackage role. Makes it more generally applicable to reuse, and importantly adds a postinst kernel hook to ensure state of PaX flags on grub binaries (closes #90). These changes recently shipped in the context of SecureDrop, and the config presented here was used for the build.

Also adds a dedicated grsec-build-securedrop VM, tracking Trusty and using a dedicated playbook specifically for the SD build process (closes #89).

conorsch commented 7 years ago

Just to confirm: these are the exact changes we used to build the latest SD kernel we shipped?

Yes! That's the goal of submitting these, and also for isolating the SD-specific vars in a dedicated playbook: so we have clear and transparent documentation of the build process we use for shipping custom kernels for SD instances.