-
linux-hardened
Minimal supplement to upstream Kernel Self Protection Project changes. Features already provided by SELinux + Yama and archs other than multiarch arm64 / x86_64 aren't in scope. Only tags have stable history. Shared IRC channel with KSPP: irc.libera.chat #linux-hardening
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
Overall those patches do protect you in a lot of cases. Per default upstream features are chose to honor security first. Furthermore patches do frequently protect against upstream failures and vulnerabilities. One of the latest examples is CVE-2022-1729 https://seclists.org/oss-sec/2022/q2/122 a local privilege vulnerability that linux-hardened simply protects since before day 0: https://github.com/anthraxx/linux-hardened/commit/4dd6bdf3b079ef73e597661ee961d225bfccbe2a On top the approach in several places of fail-early instead of potentially continuing with known corruption or certain use-after-free regularly uncovers problems that get fixed upstream and where the vanilla kernels just keep on running, which include exploitable problems. One example of a faulty very recent commit that has been bisected and fixed because of linux-hardened: https://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev.git/commit/?h=for-next&id=acde4003efc16480375543638484d8f13f2e99a3