Grsecurity Limits Availability of Stable Linux Kernel Patches

The developers of Grsecurity, a set of patches designed to provide security enhancements to the Linux kernel, announced on Wednesday that the stable patches will no longer be publicly available starting two weeks from now.

The decision comes after several large companies in the embedded Linux industry have been caught violating the Grsecurity GNU General Public License (GPL) and even its trademark.

The Grsecurity stable patches will only be available to project sponsors, which are mainly companies in the web hosting industry.

None of the offenders have been named, but the incident that “broke the camel’s back” involves a multi-billion dollar corporation that allegedly uses a modified variant of an old, unsupported version of Grsecurity.

“The aforementioned company has been using the grsecurity name all over its marketing material and blog posts to describe their backported, unsupported, unmaintained version in a version of Linux with other code modifications that haven’t been evaluated by us for security impact,” Brad Spengler, the man behind Grsecurity, explained in an announcement posted on Wednesday. “Simply put, it is NOT grsecurity – it doesn’t meet our standards and at the same time it uses our brand and reputation to further its marketing.”

Spengler says the project has spent a large amount of money on legal battles with embedded device manufacturers that have violated the Grsecurity GPL and its trademark. Despite being used by many device manufacturers, the embedded Linux industry has not contributed to the development and maintenance of the project, Spengler noted.

That is why the Grsecurity project has decided to limit the availability of stable Linux kernel patches to sponsors. The test series of patches will continue to be publicly available in order to avoid impacting the Gentoo Hardened and Arch Linux communities, but Spengler believes these patches are not fit for production use.

“This announcement is our public statement that we’ve had enough. Companies in the embedded industry not playing by the same rules as every other company using our software violates users’ rights, misleads users and developers, and harms our ability to continue our work,” Spengler said.

Some have speculated that the list of offenders might include Intel subsidiary Wind River Systems, and Verifone. Both companies have been contacted for comment.

If the decision to limit the availability of stable patches to sponsors does not address the issue, Grsecurity might follow on the footsteps of Red Hat, which in 2011 decided to stop publicly providing the patch files for the Red Hat Enterprise Linux (RHEL) kernel.

“If this does not resolve the issue, despite strong indications that it will have a large impact, we may need to resort to a policy similar to Red Hat’s, […] or eventually stop the stable series entirely as it will be an unsustainable development model,” Spengler said.

Organizations that sponsor Grsecurity (pricing begins at $200/month) receive personal support, information on major Linux vulnerabilities and impact the patches have on their exploitation, on-request customized features, and audits for role-based access control (RBAC) policies and kernel configurations.

The US gov spends billions on cybersecurity. That none of it has gone to support work like @grsecurity is a travesty https://t.co/irTYFqZrSZ

— Christopher Soghoian (@csoghoian) August 26, 2015