Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Security Architecture

Grsecurity Limits Availability of Stable Linux Kernel Patches

The developers of Grsecurity, a set of patches designed to provide security enhancements to the Linux kernel, announced on Wednesday that the stable patches will no longer be publicly available starting two weeks from now.

The developers of Grsecurity, a set of patches designed to provide security enhancements to the Linux kernel, announced on Wednesday that the stable patches will no longer be publicly available starting two weeks from now.

The decision comes after several large companies in the embedded Linux industry have been caught violating the Grsecurity GNU General Public License (GPL) and even its trademark.

The Grsecurity stable patches will only be available to project sponsors, which are mainly companies in the web hosting industry.

None of the offenders have been named, but the incident that “broke the camel’s back” involves a multi-billion dollar corporation that allegedly uses a modified variant of an old, unsupported version of Grsecurity.

“The aforementioned company has been using the grsecurity name all over its marketing material and blog posts to describe their backported, unsupported, unmaintained version in a version of Linux with other code modifications that haven’t been evaluated by us for security impact,” Brad Spengler, the man behind Grsecurity, explained in an announcement posted on Wednesday. “Simply put, it is NOT grsecurity – it doesn’t meet our standards and at the same time it uses our brand and reputation to further its marketing.”

Spengler says the project has spent a large amount of money on legal battles with embedded device manufacturers that have violated the Grsecurity GPL and its trademark. Despite being used by many device manufacturers, the embedded Linux industry has not contributed to the development and maintenance of the project, Spengler noted.

That is why the Grsecurity project has decided to limit the availability of stable Linux kernel patches to sponsors. The test series of patches will continue to be publicly available in order to avoid impacting the Gentoo Hardened and Arch Linux communities, but Spengler believes these patches are not fit for production use.

“This announcement is our public statement that we’ve had enough. Companies in the embedded industry not playing by the same rules as every other company using our software violates users’ rights, misleads users and developers, and harms our ability to continue our work,” Spengler said.

Some have speculated that the list of offenders might include Intel subsidiary Wind River Systems, and Verifone. Both companies have been contacted for comment.

If the decision to limit the availability of stable patches to sponsors does not address the issue, Grsecurity might follow on the footsteps of Red Hat, which in 2011 decided to stop publicly providing the patch files for the Red Hat Enterprise Linux (RHEL) kernel.

“If this does not resolve the issue, despite strong indications that it will have a large impact, we may need to resort to a policy similar to Red Hat’s, […] or eventually stop the stable series entirely as it will be an unsustainable development model,” Spengler said.

Organizations that sponsor Grsecurity (pricing begins at $200/month) receive personal support, information on major Linux vulnerabilities and impact the patches have on their exploitation, on-request customized features, and audits for role-based access control (RBAC) policies and kernel configurations.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Audits

Out of the 335 public recommendations on a comprehensive cybersecurity strategy made since 2010, 190 were not implemented by federal agencies as of December...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Application Security

Big-game malware hunters at Volexity are shining the spotlight on a sophisticated Chinese APT caught recently exploiting a Sophos firewall zero-day to plant backdoors...

Incident Response

Implementation of security automation can be overwhelming, and has remained a barrier to adoption

Endpoint Security

Apple has launched a new security research blog and website, which will also be the new home of the company’s bug bounty program.

ICS/OT

The White House announced on Wednesday that the Industrial Control Systems (ICS) Cybersecurity Initiative has been expanded to include the chemical sector.

Application Security

Vulnerability researchers at Google Project Zero are calling attention to the ongoing “patch-gap” problem in the Android ecosystem, warning that downstream vendors continue to...