control: reassign -1 src:linux-grsec control: forcemerge -1 #814787 On mer., 2016-03-02 at 04:43 -0300, Dato Simó wrote: > > > > While sill a long way Reproducible builds might pose a problem for a Grsec > > kernel when CONFIG_GRKERNSEC_RANDSTRUCT is set to 'y' because this feature > > randomizes kernel symbols and structures during compilation and is not > > meant > > to be the same. For a publicly distributed kernel binary this feature does > > not provide any protection anyhow because these addresses are already > > known. > > This feature will need to be disabled for full compatibility with > > reproducible build systems. > Just FYI, the @grsecurity account tweeted the following today: > > Contrary to: https://bugs.debian.org/816439, RANDSTRUCT is > actually compatible with reproducible builds, just need to > keep randomize_layout_seed.h. > > https://twitter.com/grsecurity/status/704869584218685440 > > No idea how relevant this is for reproducible builds in Debian. Just > relaying it. > I'm merging it to #814787 which is also about RANDKSTRUCT. I still think RANDKSTRUCT is useful, and someone should be able to make it work with reproducible builds and external/DKMS modules. As far as I understand it, it's just packaging issues.
Any help welcome on this, because I don't think I'll do it myself. Regards, -- Yves-Alexis
signature.asc
Description: This is a digitally signed message part
