Debian Bug report logs - #816439
Grsec's RANDSTRUCT and Reproducible Builds

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: bancfc@openmailbox.org

To: submit@bugs.debian.org

Subject: Grsec's RANDSTRUCT and Reproducible Builds

Date: Tue, 01 Mar 2016 20:44:07 +0000

Package: linux-grsec
Severity: normal

While sill a long way Reproducible builds might pose a problem for a 
Grsec kernel when CONFIG_GRKERNSEC_RANDSTRUCT is set to 'y' because this 
feature randomizes kernel symbols and structures during compilation and 
is not meant to be the same. For a publicly distributed kernel binary 
this feature does not provide any protection anyhow because these 
addresses are already known. This feature will need to be disabled for 
full compatibility with reproducible build systems.


-- System Information:
Debian Release: 8.2

Message #10 received at 816439@bugs.debian.org (full text, mbox, reply):

From: Dato Simó <dato@debian.org>

To: bancfc@openmailbox.org, 816439@bugs.debian.org

Subject: Re: Bug#816439: Grsec's RANDSTRUCT and Reproducible Builds

Date: Wed, 2 Mar 2016 04:43:26 -0300

> While sill a long way Reproducible builds might pose a problem for a Grsec
> kernel when CONFIG_GRKERNSEC_RANDSTRUCT is set to 'y' because this feature
> randomizes kernel symbols and structures during compilation and is not meant
> to be the same. For a publicly distributed kernel binary this feature does
> not provide any protection anyhow because these addresses are already known.
> This feature will need to be disabled for full compatibility with
> reproducible build systems.

Just FYI, the @grsecurity account tweeted the following today:

    Contrary to: https://bugs.debian.org/816439, RANDSTRUCT is
    actually compatible with reproducible builds, just need to
    keep randomize_layout_seed.h.

    https://twitter.com/grsecurity/status/704869584218685440

No idea how relevant this is for reproducible builds in Debian. Just
relaying it.

Ciao,
-d

Message #15 received at 816439@bugs.debian.org (full text, mbox, reply):

From: Yves-Alexis Perez <corsac@debian.org>

To: Dato Simó <dato@debian.org>, 816439@bugs.debian.org, bancfc@openmailbox.org

Subject: Re: Bug#816439: Grsec's RANDSTRUCT and Reproducible Builds

Date: Wed, 02 Mar 2016 09:23:59 +0100

[Message part 1 (text/plain, inline)]

control: reassign -1 src:linux-grsec
control: forcemerge -1 #814787

On mer., 2016-03-02 at 04:43 -0300, Dato Simó wrote:
> > 
> > While sill a long way Reproducible builds might pose a problem for a Grsec
> > kernel when CONFIG_GRKERNSEC_RANDSTRUCT is set to 'y' because this feature
> > randomizes kernel symbols and structures during compilation and is not
> > meant
> > to be the same. For a publicly distributed kernel binary this feature does
> > not provide any protection anyhow because these addresses are already
> > known.
> > This feature will need to be disabled for full compatibility with
> > reproducible build systems.
> Just FYI, the @grsecurity account tweeted the following today:
> 
>     Contrary to: https://bugs.debian.org/816439, RANDSTRUCT is
>     actually compatible with reproducible builds, just need to
>     keep randomize_layout_seed.h.
> 
>     https://twitter.com/grsecurity/status/704869584218685440
> 
> No idea how relevant this is for reproducible builds in Debian. Just
> relaying it.
> 
I'm merging it to #814787 which is also about RANDKSTRUCT. I still think
RANDKSTRUCT is useful, and someone should be able to make it work with
reproducible builds and external/DKMS modules. As far as I understand it, it's
just packaging issues.

Any help welcome on this, because I don't think I'll do it myself.

Regards,
-- 
Yves-Alexis

[signature.asc (application/pgp-signature, inline)]

Message #24 received at 816439@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: 816439@bugs.debian.org, control@bugs.debian.org

Cc: reproducible-builds@lists.alioth.debian.org

Subject: linux-grsec: feeding the seed with SOURCE_DATE_EPOCH + usertagging

Date: Fri, 6 May 2016 10:59:52 +0000

[Message part 1 (text/plain, inline)]

user reproducible-builds@lists.alioth.debian.org
usertag 816439 randomness
thanks

Hi,

Dato wrote:
> Just FYI, the @grsecurity account tweeted the following today:
> 
>     Contrary to: https://bugs.debian.org/816439, RANDSTRUCT is
>     actually compatible with reproducible builds, just need to
>     keep randomize_layout_seed.h.
>     https://twitter.com/grsecurity/status/704869584218685440

seens like the it should be seeded with 
https://reproducible-builds.org/specs/source-date-epoch/


-- 
cheers,
	Holger

[signature.asc (application/pgp-signature, inline)]

Message #29 received at 816439@bugs.debian.org (full text, mbox, reply):

From: bancfc@openmailbox.org

To: Dato Simó <dato@debian.org>

Cc: 816439@bugs.debian.org, lunar@debian.org

Subject: Re: Bug#816439: Grsec's RANDSTRUCT and Reproducible Builds

Date: Sun, 15 May 2016 01:59:28 +0200

On 2016-03-02 08:43, Dato Simó wrote:
>> While sill a long way Reproducible builds might pose a problem for a 
>> Grsec
>> kernel when CONFIG_GRKERNSEC_RANDSTRUCT is set to 'y' because this 
>> feature
>> randomizes kernel symbols and structures during compilation and is not 
>> meant
>> to be the same. For a publicly distributed kernel binary this feature 
>> does
>> not provide any protection anyhow because these addresses are already 
>> known.
>> This feature will need to be disabled for full compatibility with
>> reproducible build systems.
> 
> Just FYI, the @grsecurity account tweeted the following today:
> 
>     Contrary to: https://bugs.debian.org/816439, RANDSTRUCT is
>     actually compatible with reproducible builds, just need to
>     keep randomize_layout_seed.h.
> 
>     https://twitter.com/grsecurity/status/704869584218685440
> 
> No idea how relevant this is for reproducible builds in Debian. Just
> relaying it.
> 
> Ciao,
> -d

Spender's solution is better than completely disabling randkstruct 
because it forces adversaries to maintain exploit versions against every 
kernel version released - forcing them to expend more resources.

Message #34 received at 816439@bugs.debian.org (full text, mbox, reply):

From: Steven Chamberlain <stevenc@debian.org>

To: Reproducible Builds discussion list <reproducible-builds@lists.alioth.debian.org>

Cc: 816439@bugs.debian.org

Subject: Re: Bug#816439: linux-grsec: feeding the seed with SOURCE_DATE_EPOCH

Date: Wed, 13 Jul 2016 00:43:57 +0100

[Message part 1 (text/plain, inline)]

tags 816439 + patch
thanks

Hi,

> >     Contrary to: https://bugs.debian.org/816439, RANDSTRUCT is
> >     actually compatible with reproducible builds, just need to
> >     keep randomize_layout_seed.h.
> >     https://twitter.com/grsecurity/status/704869584218685440

Holger Levsen wrote:
> seens like the it should be seeded with 
> https://reproducible-builds.org/specs/source-date-epoch/

Patch attached!  (please read it for the long description)

I'm afraid I couldn't find where to do this in linux-grsec Git.
So I've attached it in debdiff form instead.

There might still be other reproducibility issues after this.

Thanks,
Regards,
-- 
Steven Chamberlain
steven@pyro.eu.org

[linux-grsec_4.6.3-1+grsec201607062159+1.debdiff (text/plain, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #37 received at 814787-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 810506-done@bugs.debian.org,814787-done@bugs.debian.org,816309-done@bugs.debian.org,820464-done@bugs.debian.org,849056-done@bugs.debian.org,863060-done@bugs.debian.org,888702-done@bugs.debian.org,892400-done@bugs.debian.org,

Cc: linux-grsec@packages.debian.org

Subject: Bug#895433: Removed package(s) from unstable

Date: Sun, 15 Apr 2018 15:47:34 +0000

Version: 4.9.65-2+grsecunoff1+rm

Dear submitter,

as the package linux-grsec has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/895433

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Send a report that this bug log contains spam.