Language Selection

English French German Italian Portuguese Spanish

HOWTO: Installing Grsecurity patched kernel in debian/ubuntu

Filed under
Howtos

Source: http://evolution-security.com

This is based on the same walkthrough I posted for grsecurity on red hat based kernels except this is for debian based kernels. The current stable debian kernel is vulnerable to about all of the new local exploits and if you are running the 2.4 kernel you are vulnerable to even more. Debian even had one of their servers hacked with the local root exploits, they only released a patched kernel for the testing branch to my knowledge.
The PDF version can be found HERE.
Ok so here goes.

If you have not done any compiling or built any kernels you must get the packages needed.

sudo apt-get install build-essential bin86 kernel-package

sudo apt-get install libqt3-headers libqt3-mt-dev (needed for make xconfig)

First get what is needed and patch the kernel.

cd /usr/src


wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.17.7.tar.bz2

wget http://grsecurity.org/grsecurity-2.1.9-2.6.17.7-200607261817.patch.gz

tar -xjvf linux-2.6.17.7.tar.bz2


gunzip < grsecurity-2.1.9-2.6.17.7-200607261817.patch.gz | patch -p0


mv linux-2.6.17.7 linux-2.6.17.7-grsec

ln -s linux-2.6.17.7-grsec linux

cd linux

copy your current config over

do uname -r to see what kernel your running and copy it, example:

cp /boot/config-2.6.15-26-686L .config

*Configure the kernel:

sudo make xconfig

if you are doing this on a server use makeconfig

make sure you select the basic stuff that is needed, iptables, your processor type, and then go in Security Options and to grsecurity, select which level of security you want and any other options you may want.

*In a terminal make sure you are in /usr/src/linux with full root access.

We will build a ".deb" file that can be installed in our Ubuntu system, using make-kpkg.

*In a terminal type:

make-kpkg clean

make-kpkg -initrd --revision=ck2 kernel_image

If there wasn't errors this will build the kernel and a ".deb" file will be created at /usr/src.
*To install it:

sudo dpkg -i kernel-image-2.6.17*.deb

Now reboot and if you did everything correctly it should boot back up and you will be using the new grsecurity kernel.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

hmm, sorry about the bbcode

hmm, sorry about the bbcode errors, you should still know what to copy

re: bbcode

I fixed it best I could using html.

----
You talk the talk, but do you waddle the waddle?

Note

for who ever does this walkthrough, I copied the deb package making off my ck tutorial and left that in one place
make-kpkg -initrd --revision=ck2 kernel_image

when you do that you can make it whatever you want, even that would work just remember that kernel is grsecurity.

Also on the installing on server, use make menuconfig to make your config

I was too worried about the bbcode and made a few typos, couldnt find a way to edit.

More in Tux Machines

GNOME: GNOME Shell, Bug Tracking, GXml

  • How to Install GNOME Shell Extensions GUI / CLI
    GNOME Shell extensions are small and lightweight pieces of codes that enhance GNOME desktop’s functionality and improves the user experience. They are the equivalent of add-ons in your browser. For instance, you can have add-ons that download videos like IDM downloader or block annoying ads such as Adblocker. Similarly, GNOME extensions perform certain tasks e.g. Display weather and geolocation. One of the tools used to install and customize GNOME Shell extensions is the GNOME tweak tool. It comes pre-installed in the latest Linux distributions. This article we cover how to install GNOME Shell extensions from GUI and from the command line on various Linux distros.
  • Musings on bug trackers
    I love bugzilla, I really do. I’ve used it nearly my entire career in free software. I know it well, I like the command line tool integration. But I’ve never had a day in bugzilla where I managed to resolve/triage/close nearly 100 issues. I managed to do that today with our gitlab instance and I didn’t even mean to.
  • ABI stability for GXml
    I’m taking a deep travel across Vala code; trying to figure out how things work. With my resent work on abstract methods for compact classes, may I have an idea on how to provide ABI stability to GXml. GXml have lot of interfaces for DOM4, implemented in classes, like Gom* series. But they are a lot, so go for each and add annotations, like Gee did, to improve ABI, is a hard work.

More on Barcelona Moving to Free Software

  • Barcelona Aims To Oust Microsoft In Open Source Drive
    The city of Barcelona has embarked on an ambitious open source effort aimed at reducing its dependence on large proprietary software vendors such as Microsoft, including the replacement of both applications and operating systems.
  • Barcelona to ditch Microsoft software for open source software
    Barcelona, one of the most popular cities in the Europe is now switching to open-source software by replacing Microsoft Windows, Office and Exchange with Linux, Libre Office and Open Xchange respectively. The city council is already piloting the use of Ubuntu Linux desktops along with Mozilla Firefox as the default browser. With this move, Barcelona city is planning to save money over the years by reducing software/service licensing fees. They are also planning to hire new developers to write open-source software. The open-source product will also be made available to other Spanish municipalities and public bodies further afield allowing them the opportunity to save money on software licences.
  • Barcelona to ditch Microsoft in favour of open source Linux software
    Catalan capital Barcelona is planning to ditch proprietary software products from Microsoft in favour of free, open source alternatives such as Open-Xchange email. That’s according to a report by Spain's national paper El Pais, which reports that Barcelona plans to invest 70% of its annual software budget in open source this year.

OSS Leftovers

  • Open Source turns 20
    While open source software is ubiquitous, recognized across industries as a fundamental infrastructure component as well as a critical factor for driving innovation, the "open source" label was coined only 20 years ago. The concept of open source software - as opposed to free software or freeware - is credited to Netscape which, in January 1998, announced plans to release the source code of its proprietary browser, Navigator, under a license that would freely permit modification and redistribution. This code is today the basis for Mozilla Firefox and Thunderbird. The Open Source Initiative (OSI) regards that event as the point at which "software freedom extended its reach beyond the enthusiast community and began its ascent into the mainstream".
  • Coreboot 4.7 Released With 47 More Motherboards Supported, AMD Stoney Ridge
    Coreboot 4.7 is now available as the latest release of this free and open-source BIOS/UEFI replacement. Coreboot 4.7 is the latest tagged release for this project developed via Git. This release has initial support for AMD Stoney Ridge platforms, Intel ICH10 Southbridge support, Intel Denverton/Denverton-NS platform support, and initial work on supporting next-gen Intel Cannonlake platforms.
  • Thank you CUSEC!
    Last week, I spoke at CUSEC (Canadian Undergraduate Software Engineering Conference) in Montreal.   I really enjoy speaking with students and learning what they are working on.  They are the future of our industry!  I was so impressed by the level of organization and the kindness and thoughtfulness of the CUSEC organizing committee who were all students from various universities across Canada. I hope that you all are enjoying some much needed rest after your tremendous work in the months approaching the conference and last week.
  • Percona Announces Sneak Peek of Conference Breakout Sessions for Seventh Annual Percona Live Open Source Database Conference
  • The Universal Donor
    A few people reacted negatively to my article on why Public Domain software is broadly unsuitable for inclusion in a community open source project. Most argued that because public domain gave them the rights they need where they live (mostly the USA), I should not say it was wrong to use it. That demonstrates either parochialism or a misunderstanding of what public domain really means. It should not be used for the same reason code known to be subject to software patents should not be used — namely that only code that, to the best efforts possible, can be used by anyone, anywhere without the need to ask permission (e.g. by buying a patent license) or check it it’s needed (e.g. is that PD code PD here?) can be used in an open source project. Public domain fails the test for multiple reasons: global differences in copyright term, copyright as an unalienable moral rather than as a property right, and more. Yes, public domain may give you the rights you need. But in an open source project, it’s not enough for you to determine you personally have the rights you need. In order to function, every user and contributor of the project needs prior confidence they can use, improve and share the code, regardless of their location or the use to which they put it. That confidence also has to extend to their colleagues, customers and community as well.

Ubuntu: Ubuntu Core, Ubuntu Free Culture Showcase for 18.04, Lubuntu 17.04 EoL

  • Ubuntu Core: A secure open source OS for IoT
    Canonical's Ubuntu Core, a tiny, transactional version of the Ubuntu Linux OS for IoT devices, runs highly secure Linux application packages, known as "snaps," that can be upgraded remotely.
  • Introducing the Ubuntu Free Culture Showcase for 18.04
    Ubuntu’s changed a lot in the last year, and everything is leading up to a really exciting event: the release of 18.04 LTS! This next version of Ubuntu will once again offer a stable foundation for countless humans who use computers for work, play, art, relaxation, and creation. Among the various visual refreshes of Ubuntu, it’s also time to go to the community and ask for the best wallpapers. And it’s also time to look for a new video and music file that will be waiting for Ubuntu users on the install media’s Examples folder, to reassure them that their video and sound drivers are quite operational. Long-term support releases like Ubuntu 18.04 LTS are very important, because they are downloaded and installed ten times more often than every single interim release combined. That means that the wallpapers, video, and music that are shipped will be seen ten times more than in other releases. So artists, select your best works. Ubuntu enthusiasts, spread the word about the contest as far and wide as you can. Everyone can help make this next LTS version of Ubuntu an amazing success.
  • Lubuntu 17.04 has reached End of Life
    The Lubuntu Team announces that as a non-LTS release, 17.04 has a 9-month support cycle and, as such, reached end of life on Saturday, January 13, 2018. Lubuntu will no longer provide bug fixes or security updates for 17.04, and we strongly recommend that you update to 17.10, which continues to be actively supported with security updates and select high-impact bug fixes.