The most significant feature is the addition of a role-based access control system (RBAC) that monitors what each user can execute based on their role and denies execution if they overstep their pre-defined rules. Other useful features include ip-based rules, extensive chroot restrictions, address space modification restrictions (PaX), auditing/logging features and /proc and dmesg anti-leak features. A full feature list can be found at the Grsecurity homepage.
Installing Grsecurity:
First we need to download the Linux kernel and Grsec patch.
$ wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.19.2.tar.gzFor your convenience, the PGP keys are located at:
$ wget http://grsecurity.net/grsecurity-2.1.10-2.6.19.2-200701222307.patch.gz
http://GRSecurity.net/spender-gpg-key.asc
http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.19.2.tar.gz.sign
Move the kernel and patch into the /usr/src directory.
$ su -c “cp linux-2.6* /usr/src; cp grsec* /usr/src”Extract the kernel and patch (you need to be in root since you're working in /usr/src).
$ suStart with the kernel configuration.
# tar zxvf linux-2.6.19.2.tar.gz
# gunzip grsecurity-2.1.10-2.6.19.2-200701222307.patch.gz
# patch -p0 < grsecurity-2.1.10-2.6.19.2-200701222307.patch
# make cleanChoose all of the options that are required for your hardware, or use “make oldconfig” and se an old configuration file. When you arrive at the “GRSECURITY” section, enable it by hitting the spacebar. You are now prompted with an array of security features. Building a custom scheme is as easy as selecting a few features, or select a pre-defined security level based on your needs. Taylor Merry created a fantastic list that shows what each level of security provides. His table is listed below:
# make mrproper
# make menuconfig
Low Security:
- linking restrictions
- fifo restrictions
- random pids
- enforcing nproc on execve()
- restricted dmesg
- random ip ids
- enforced chdir("/") on chroot< /li>
Medium Security (includes all of the Low Security options):
- random tcp source ports
- altered ping ids
- failed fork logging
- time change logging
- signal logging
- deny mounts in chroot
- deny double chrooting
- deny sysctl writes in chroot
- deny mknod in chroot
- deny access to abstract AF_UNIX sockets out of chroot
- deny pivot_root in chroot
- denied writes of /dev/kmem, /dev/mem, and /dev/port• /proc restrictions with special gid set to 10 (usually wheel)
- address space layout randomization
High Security (includes all of the Low and Medium Security options):
- additional /proc restrictions
- chmod restrictions in chroot
- no signals, ptrace, or viewing processes outside of chroot
- capability restrictions in chroot
- deny fchdir out of chroot
- priority restrictions in chroot
- segmentation-based implementation of PaX
- mprotect restrictions
- removal of /proc/
/[maps|mem] - kernel stack randomization
- mount/unmount/remount logging
- kernel symbol hiding(18)
- PaX: PAGEEXEC
- PaX: EMUTRAMP
- PaX: EMUSIGRT
- PaX: Disallow ELF text relocations (DANGEROUS)
- Disable privileged I/O (should not use with XFree86)
- Hide kernel processes
- Allow a user group access to /proc
- Auditing options
- Set up a single group that is the only one audited
- Exec logging
- Log execs within chroot
- Chdir logging
- IPC logging
- Trusted path execution
- Socket restrictions
- Sysctl support
- Netfilter Configuration: stealth match support(18) *1
After you have selected all of the necessary options, lets compile the kernel.
Finally, copy the new kernel into your /boot directory and adjust your bootloader to load the new kernel. Your new kernel will be located in "usr/src/linux/arch/i386/boot/." At this point, you now have a Linux kernel with copious amounts of added security and protection.
Check back soon because our next article will show you how to use the role based access control system and how to compile programs to take advantage of the PaX address space modification restrictions!
References:
*1 Merry, Taylor. Linux Kernel Hardening. 18 November 2003
GrSecurity Homepage
PaX Homepage