What is grsecurity?
Grsecurity® is an extensive security enhancement to the Linux kernel that defends against a wide range of security threats through intelligent access control, memory corruption-based exploit prevention, and a host of other system hardening that generally require no configuration.
It has been actively developed and maintained for the past 18 years. Commercial support for grsecurity is available through Open Source Security, Inc.Get an offer 4.4.176 Last updated: 03/15/19 4.14.107 Last updated: 03/19/19
Hardens Container Isolation
In any kind of shared computing environment, whether it be simple UID separation, OpenVZ, LXC, or Linux-VServer, the most common and often easiest method of full system compromise is through kernel exploitation. No other software exists to mitigate this weakness while maintaining usability and performance.Get an offer 4.4.176 Last updated: 03/15/19 4.14.107 Last updated: 03/19/19
Defends against zero-day
Only grsecurity provides protection against zero-day and other advanced threats that buys administrators valuable time while vulnerability fixes make their way out to distributions and production testing. This is made possible by our focus on eliminating entire bug classes and exploit vectors, rather than the status-quo elimination of individual vulnerabilities.Get an offer 4.4.176 Last updated: 03/15/19 4.14.107 Last updated: 03/19/19
Integrates with your distribution
Grsecurity confines its changes to the Linux kernel itself, making it possible to use with any distribution or device: embedded, server, or desktop. Use your existing distribution's kernel configuration if you wish and answer a simple series of questions about your use case to optimally configure grsecurity automatically. X86, ARM, or MIPS -- grsecurity has been developed for and used on them all and many more.Get an offer 4.4.176 Last updated: 03/15/19 4.14.107 Last updated: 03/19/19
Has a proven track record
Grsecurity has been developed and maintained since 2001, from the very first 2.4 Linux kernel to the latest and greatest 4.x. In addition to tracking the latest stable kernel, we provide stable releases for both the 4.4 and 4.14 kernels with additional security backports.
We stay on top of -- and in many cases drive -- the state of the art in security research. While the security teams of Linux distributions react to the latest widespread exploit simply by fixing the associated vulnerability, we quickly work in addition to close down any new exploit vectors, reduce the chance of similar vulnerabilities, and insert additional roadblocks for ancillary techniques that made the exploit possible or reliable.
As a result of this extensive approach, it is not uncommon to find in the event of a published exploit, particularly against the kernel, that the exploit's success is prevented by several separate features of grsecurity.Get an offer 4.4.176 Last updated: 03/15/19 4.14.107 Last updated: 03/19/19
Beyond Access Control
Unlike the LSMs you're used to, grsecurity tackles a wider scope of security problems. While access control has its place, it is incapable of dealing with many real-life security issues, especially in webhosting environments where an attacker can fraudulently purchase local access to the system. To see what you're missing out on by relying on just access control, see our feature comparison matrix.
A major component of grsecurity is its approach to memory corruption vulnerabilities and their associated exploit vectors. Through partnership with the PaX project, creators of ASLR and many other exploit prevention techniques -- some now imitated by Microsoft and Apple, grsecurity makes many attacks technically and economically infeasible by introducing unpredictability and complexity to attempted attacks, while actively responding in ways that deny the attacker another chance.Get an offer 4.4.176 Last updated: 03/15/19 4.14.107 Last updated: 03/19/19
Few, if any, people can lay claim to a bigger impact on modern exploit mitigation than the PaX and grsecurity teams. Their work has shaped how security works today, and they continue to remain at the forefront. Grsecurity is built and trusted by experts.
When building systems that hold sensitive customer data, no other platform is as trusted by professional security engineers, like those at Immunity, than grsecurity. We have 15 years of experience breaking systems, and grsecurity has 15 years of experience protecting them from people like us.
A lot of work has been done in the past 17 years on exploit mitigations - some practical, and some effective. Very few mechanisms were both practical and effective. The grsecurity and PaX team have been behind almost all of them.
The people behind grsecurity/PaX are pioneers in computer security. Your Linux servers are in good hands with them.
During the Bugtraq "golden era" I witnessed first-hand the direct effect of the pioneering research by the grsecurity and PaX team on real world vulnerability exploit feasibility. What was once possible with a simple stack overflow now requires a complex multiple-vulnerability bug chain.
You can thank Grsecurity/PaX for many of the memory safety mitigations the world relies on today. These projects redefined software security.
PaX and grsecurity are world class innovators in software security. They have played a pivotal role in creating multiple exploit mitigation technologies that are now considered industry standard.
grsecurity and PaX have driven the state of the art in effective and realistic exploit mitigations for the past 17+ years. They've defined what are now considered industry standards and are still ahead of what's coming in the future elsewhere.
Grsecurity provides a full suite of synergistic defenses, from security-enhanced compilation and our world-class memory corruption defenses to access control.Learn More
We're best known for our memory corruption defenses, whose effectiveness have been repeatedly validated by their eventual adoption in all mainstream operating systems and even processor hardware.Learn more
Our filesystem defenses help isolate users through heavily-hardened chroot jails, preventing webservers from being tricked by symlinks pointing to other users' directories, and much more.Learn more
We offer a number of unique defenses, like automatically limiting the attack surface of highly-modular kernels without impacting usability.Learn more
Our Role Based Access Control system auto-learns least privilege policies for an entire system in minutes. Policy enforcement ensures a secure base and helps eliminate manual policy mistakes.Learn more
Defeating ROP, improving entropy on IoT devices, defusing uninitialized stack infoleaks, preventing many exploitable integer overflows: our GCC plugins make it possible.Learn more
An Ancient Kernel Hole is (Not) Closed
A case study in how grsecurity's defense-in-depth strategy resulted in it being effectively immune to StackClash, a critical vulnerability that was improperly fixed upstream for 7 years.Read more
Passing the Baton
Today we announce a refocusing of our efforts on next-generation security technologies and tackling the remaining class of data-only attacks.Read more
New Blog Post: The Infoleak that (Mostly) Wasn't
A Linux kernel stack infoleak vulnerability present in the kernel for 14 years was fixed recently, but its impact isn't as large as it first seems.Read more
RAP Demonstrates World-First Fully CFI-Hardened OS Kernel
Today's release of grsecurity® for Linux kernel version 4.9 makes good on our promise of publishing the implementation of the deterministic type-based return check portion of the Reuse Attack Protector (RAP) initially described at H2HC in October 2015.Read more
RAP is here. Public demo in 4.5 test patch and commercially available today!
Today's release of grsecurity® for the Linux 4.5 kernel marks an important milestone in the project's history. It is the first kernel to contain RAP, a patented defense mechanism against code reuse attacks. RAP is the result of our multi-years research and development in Control Flow Integrity (CFI) technologies by PaX. It ground-breakingly scales to C and C++ code bases of arbitrary sizes and provides best-effort protection against code reuse attacks with minimal performance impact.Read more