Re:Linus: Don't bother with grsecurity. Their patches are pu...
by technion on Sunday June 25, 2017 @11:59PM
(#14633980)
Similarly, I used to run grsec on RedHat once upon a time. But the whole thing just got too hard. When a critical update came, I could get a stock kernel running "yum update", or I could play around building a whole new grsec kernel.
I wish there was a way to take personalities out of this and let mainline merge the useful parts of grsec.
It's a shame - there's a lot of good stuff in grsec/PaX, but I think the upstream community is better off without the people involved. The KSPP effort to upstream grsec/PaX features is, of course, a good thing.
[disclaimer: upstream developer who lurks on kernel-hardening]