Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Security Architecture

Grsecurity Limits Availability of Stable Linux Kernel Patches

The developers of Grsecurity, a set of patches designed to provide security enhancements to the Linux kernel, announced on Wednesday that the stable patches will no longer be publicly available starting two weeks from now.

The developers of Grsecurity, a set of patches designed to provide security enhancements to the Linux kernel, announced on Wednesday that the stable patches will no longer be publicly available starting two weeks from now.

The decision comes after several large companies in the embedded Linux industry have been caught violating the Grsecurity GNU General Public License (GPL) and even its trademark.

The Grsecurity stable patches will only be available to project sponsors, which are mainly companies in the web hosting industry.

None of the offenders have been named, but the incident that “broke the camel’s back” involves a multi-billion dollar corporation that allegedly uses a modified variant of an old, unsupported version of Grsecurity.

“The aforementioned company has been using the grsecurity name all over its marketing material and blog posts to describe their backported, unsupported, unmaintained version in a version of Linux with other code modifications that haven’t been evaluated by us for security impact,” Brad Spengler, the man behind Grsecurity, explained in an announcement posted on Wednesday. “Simply put, it is NOT grsecurity – it doesn’t meet our standards and at the same time it uses our brand and reputation to further its marketing.”

Spengler says the project has spent a large amount of money on legal battles with embedded device manufacturers that have violated the Grsecurity GPL and its trademark. Despite being used by many device manufacturers, the embedded Linux industry has not contributed to the development and maintenance of the project, Spengler noted.

That is why the Grsecurity project has decided to limit the availability of stable Linux kernel patches to sponsors. The test series of patches will continue to be publicly available in order to avoid impacting the Gentoo Hardened and Arch Linux communities, but Spengler believes these patches are not fit for production use.

“This announcement is our public statement that we’ve had enough. Companies in the embedded industry not playing by the same rules as every other company using our software violates users’ rights, misleads users and developers, and harms our ability to continue our work,” Spengler said.

Advertisement. Scroll to continue reading.

Some have speculated that the list of offenders might include Intel subsidiary Wind River Systems, and Verifone. Both companies have been contacted for comment.

If the decision to limit the availability of stable patches to sponsors does not address the issue, Grsecurity might follow on the footsteps of Red Hat, which in 2011 decided to stop publicly providing the patch files for the Red Hat Enterprise Linux (RHEL) kernel.

“If this does not resolve the issue, despite strong indications that it will have a large impact, we may need to resort to a policy similar to Red Hat’s, […] or eventually stop the stable series entirely as it will be an unsustainable development model,” Spengler said.

Organizations that sponsor Grsecurity (pricing begins at $200/month) receive personal support, information on major Linux vulnerabilities and impact the patches have on their exploitation, on-request customized features, and audits for role-based access control (RBAC) policies and kernel configurations.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Artificial Intelligence

ChatGPT is increasingly integrated into cybersecurity products and services as the industry is testing its capabilities and limitations.

Compliance

Government agencies in the United States have made progress in the implementation of the DMARC standard in response to a Department of Homeland Security...

Network Security

Attack surface management is nothing short of a complete methodology for providing effective cybersecurity. It doesn’t seek to protect everything, but concentrates on areas...

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Artificial Intelligence

Microsoft and Mitre release Arsenal plugin to help cybersecurity professionals emulate attacks on machine learning (ML) systems.

Management & Strategy

Hundreds of companies are showcasing their products and services this week at the 2023 edition of the RSA Conference in San Francisco.

Endpoint Security

Apple has launched a new security research blog and website, which will also be the new home of the company’s bug bounty program.