Building a grsec-patched Linux kernel for Debian 8 and DigitalOcean
It's possible to run a custom (instead of hypervisor-managed) kernel for use with Debian 8.x on a DigitalOcean droplet.
We'll build one with grsecurity, "an extensive security enhancement to the Linux kernel that defends against a wide range of security threats through intelligent access control, memory corruption-based exploit prevention, and a host of other system hardening".
Note: The stable patches for Linux 3.14.x and 3.2.x are not publicly available anymore, so we'll be applying the free 4.3.x (test) patch. The URLs and filenames in this document may become outdated, so fetch the latest from grsecurity.net and kernel.org.
apt-get install libncurses5-dev build-essential fakeroot kernel-package gcc-4.9 gcc-4.9-plugin-dev make
Grab Spender's key and verify it:
wget https://grsecurity.net/spender-gpg-key.asc gpg --import spender-gpg-key.asc gpg --keyserver pool.sks-keyservers.net --recv-key 647F28654894E3BD457199BE38DBBDC86092693E gpg --with-fingerprint spender-gpg-key.asc gpg --fingerprint 647F28654894E3BD457199BE38DBBDC86092693E
Grab the kernel source and grsecurity patch, plus signatures for each:
wget https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.3.3.tar.xz wget https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.3.3.tar.sign wget https://grsecurity.net/test/grsecurity-3.1-4.3.3-201601051958.patch wget https://grsecurity.net/test/grsecurity-3.1-4.3.3-201601051958.patch.sig
Decompress the tarball:
Verify that the signatures are good:
gpg --verify grsecurity-3.1-4.3.3-201601051958.patch.sig gpg --verify linux-4.3.3.tar.sign
Extract the kernel source and apply the patch:
tar -xf linux-4.3.3.tar cd linux-4.3.3/ patch -p1 < ../grsecurity-3.1-4.3.3-201601051958.patch
Start with the VPS's existing kernel configuration, and then configure stuff:
cp /boot/config-3.16.0-4-amd64 .config make menuconfig
Under Security options, enable Grsecurity (press Y), set Configuration Method to Automatic, set Usage Type to Server, set Virtualization Type to Guest, set Virtualization Software to KVM and Required Priorities to Security. Save and exit.
You may want to ensure all CPU cores participate in the build by exporting this environment variable:
export CONCURRENCY_LEVEL="$(grep -c '^processor' /proc/cpuinfo)"
Now you can compile the kernel. It can take a while to finish, and ideally you shouldn't be doing this as root.
fakeroot make-kpkg --initrd kernel_image
In the parent directory, you'll have the package
linux-image-4.3.3-grsec_4.3.3-grsec-10.00.Custom_amd64.deb. Copy it to the target machine and install with
Install some tools to use with PaX (which hardens userland binaries against common exploitation techniques based on memory corruption):
apt-get install paxtest paxctl
Grab the kernel version string used in the GRUB bootloader menu:
grep menuentry /boot/grub/grub.cfg | cut -d "'" -f2 | grep "grsec$"
Set the new kernel to boot by default, and reboot:
sed -i "s/^GRUB_DEFAULT=.*$/GRUB_DEFAULT=\"Advanced options for Debian GNU\/Linux>Debian GNU\/Linux, with Linux 4.3.3-grsec\"/" /etc/default/grub update-grub grub-reboot "Advanced options for Debian GNU/Linux>Debian GNU/Linux, with Linux 4.3.3-grsec" shutdown -r now
When the machine comes back after rebooting, check
uname -r to verify that you're running grsec.
Set these sysctl variables (use
sysctl -p to activate after editing
kernel.grsecurity.rwxmap_logging = 0 kernel.grsecurity.grsec_lock = 1
Set some PaX flags for GRUB:
paxctl -Cpm /usr/sbin/grub-probe paxctl -Cpm /usr/sbin/grub-mkdevicemap paxctl -Cpm /usr/sbin/grub-install paxctl -Cpm /usr/bin/grub-script-check paxctl -Cpm /usr/bin/grub-mount
You may find that some stuff won't work like common interpreters for scripting languages because of memory protection. As an example, you can disable MPROTECT for Python like so:
paxctl -c /usr/bin/python2.7 paxctl -m /usr/bin/python2.7
paxtest blackhat and check the output. If PaX is working, you should see something like this:
Executable anonymous mapping : Killed Executable bss : Killed Executable data : Killed Executable heap : Killed Executable stack : Killed Executable shared library bss : Killed Executable shared library data : Killed Executable anonymous mapping (mprotect) : Killed Executable bss (mprotect) : Killed Executable data (mprotect) : Killed Executable heap (mprotect) : Killed Executable stack (mprotect) : Killed Executable shared library bss (mprotect) : Killed Executable shared library data (mprotect): Killed Writable text segments : Killed Anonymous mapping randomisation test : 33 bits (guessed) Heap randomisation test (ET_EXEC) : 23 bits (guessed) Heap randomisation test (PIE) : 40 bits (guessed) Main executable randomisation (ET_EXEC) : 33 bits (guessed) Main executable randomisation (PIE) : 33 bits (guessed) Shared library randomisation test : 33 bits (guessed) Stack randomisation test (SEGMEXEC) : 40 bits (guessed) Stack randomisation test (PAGEEXEC) : 40 bits (guessed) Arg/env randomisation test (SEGMEXEC) : 44 bits (guessed) Arg/env randomisation test (PAGEEXEC) : 44 bits (guessed) Randomization under memory exhaustion @~0: 33 bits (guessed) Randomization under memory exhaustion @0 : 33 bits (guessed) Return to function (strcpy) : paxtest: return address contains a NULL byte. Return to function (memcpy) : Killed Return to function (strcpy, PIE) : paxtest: return address contains a NULL byte. Return to function (memcpy, PIE) : Killed
Congratulations! You're now running grsecurity on your Debian DigitalOcean droplet. A similar process should work on a Linode VPS with PV-GRUB enabled — you'd just have to select Xen as the virtualization type instead (unless your Linode is on their brand new, upgraded KVM infrastructure).
See also paxctld, a daemon for applying PaX flags to bianries persistently across package updates. I also suggest evaluating the grsecurity RBAC (role-based access control), which is extremely powerful.