Trending
What is
grsecurity?
grsecurity?
Beyond
access control
access control
Hardens Container
Isolation
Isolation
Defends against
zero-day
zero-day
Integrates with
your distribution
your distribution
20-year proven
track record
track record
What is grsecurity?
Grsecurity® is an extensive security enhancement to the Linux kernel that defends against a wide range of security threats through intelligent access control, memory corruption-based exploit prevention, and a host of other system hardening that generally require no configuration.
It has been actively developed and maintained for the past 23 years. Commercial support for grsecurity is available through Open Source Security, Inc.
Have questions about our services? Check out our FAQ or features for more information.
Get an offer 5.15.174 Last updated: 12/16/24 6.6.66 Last updated: 12/16/24Hardens Container Isolation
In any kind of shared computing environment, whether it be simple UID separation, OpenVZ, LXC, Linux-VServer, Docker, or Kubernetes, the most common and often easiest method of full system compromise is through kernel exploitation. No other software exists to mitigate this weakness while maintaining usability and performance.
Get an offer 5.15.174 Last updated: 12/16/24 6.6.66 Last updated: 12/16/24Defends against zero-day
Only grsecurity provides protection against zero-day and other advanced threats that buys administrators valuable time while vulnerability fixes make their way out to distributions and production testing. This is made possible by our focus on eliminating entire bug classes and exploit vectors, rather than the status-quo elimination of individual vulnerabilities.
Get an offer 5.15.174 Last updated: 12/16/24 6.6.66 Last updated: 12/16/24Integrates with your distribution
Grsecurity confines its changes to the Linux kernel itself, making it possible to use with any distribution or device: embedded, server, or desktop. Use your existing distribution's kernel configuration if you wish and answer a simple series of questions about your use case to optimally configure grsecurity automatically. X86, ARM, or MIPS -- grsecurity has been developed for and used on them all and many more.
Get an offer 5.15.174 Last updated: 12/16/24 6.6.66 Last updated: 12/16/24Has a proven track record
Grsecurity has been developed and maintained since 2001, from the very first 2.4 Linux kernel to the latest and greatest 6.x. In addition to tracking the latest stable kernel, we provide stable releases for both the 5.4 and 5.15 kernels with additional security backports.
We stay on top of -- and in many cases drive -- the state of the art in security research. While the security teams of Linux distributions react to the latest widespread exploit simply by fixing the associated vulnerability, we quickly work in addition to close down any new exploit vectors, reduce the chance of similar vulnerabilities, and insert additional roadblocks for ancillary techniques that made the exploit possible or reliable.
As a result of this extensive approach, it is not uncommon to find in the event of a published exploit, particularly against the kernel, that the exploit's success is prevented by several separate features of grsecurity.
Get an offer 5.15.174 Last updated: 12/16/24 6.6.66 Last updated: 12/16/24Beyond Access Control
Unlike the LSMs you're used to, grsecurity tackles a wider scope of security problems. While access control has its place, it is incapable of dealing with many real-life security issues, especially in webhosting environments where an attacker can fraudulently purchase local access to the system. To see what you're missing out on by relying on just access control, see our feature comparison matrix.
A major component of grsecurity is its approach to memory corruption vulnerabilities and their associated exploit vectors. Through partnership with the PaX project, creators of ASLR and many other exploit prevention techniques -- some now imitated by Microsoft and Apple, grsecurity makes many attacks technically and economically infeasible by introducing unpredictability and complexity to attempted attacks, while actively responding in ways that deny the attacker another chance.
Get an offer 5.15.174 Last updated: 12/16/24 6.6.66 Last updated: 12/16/24
Testimonials
I don't usually endorse security products, but I will say that when it comes to Linux security, the ONLY .. and I mean ONLY Linux systems that me or anyone I know have not been able to consistently achieve privesc against are grsecurity protected systems.
Few, if any, people can lay claim to a bigger impact on modern exploit mitigation than the PaX and grsecurity teams. Their work has shaped how security works today, and they continue to remain at the forefront. Grsecurity is built and trusted by experts.
Draper strongly recommends grsecurity to all of our Department of Defense (DoD) customers so they have the latest and state-of-the-art in vulnerability prevention and exploit defense.
When building systems that hold sensitive customer data, no other platform is as trusted by professional security engineers, like those at Immunity, than grsecurity. We have 15 years of experience breaking systems, and grsecurity has 15 years of experience protecting them from people like us.
A lot of work has been done in the past 17 years on exploit mitigations - some practical, and some effective. Very few mechanisms were both practical and effective. The grsecurity and PaX team have been behind almost all of them.
The people behind grsecurity/PaX are pioneers in computer security. Your Linux servers are in good hands with them.
During the Bugtraq "golden era" I witnessed first-hand the direct effect of the pioneering research by the grsecurity and PaX team on real world vulnerability exploit feasibility. What was once possible with a simple stack overflow now requires a complex multiple-vulnerability bug chain.
You can thank Grsecurity/PaX for many of the memory safety mitigations the world relies on today. These projects redefined software security.
PaX and grsecurity are world class innovators in software security. They have played a pivotal role in creating multiple exploit mitigation technologies that are now considered industry standard.
grsecurity and PaX have driven the state of the art in effective and realistic exploit mitigations for the past 17+ years. They've defined what are now considered industry standards and are still ahead of what's coming in the future elsewhere.
Latest News
New Blog Post: CVE-2021-4440: A Linux CNA Case Study
This blog serves as a case study into how the newly-formed Linux CNA (CVE Numbering Authority) has affected Linux kernel vulnerability management, through the mishandling of a vulnerability we reported this year in the upstream 5.10 LTS kernel.
Read moreNew Blog Post: Toolchain Necromancy: Past Mistakes Haunting ASLR
This blog extends on earlier work from January by Justin Miller involving hugepage-related changes to the memory management interfaces in the Linux kernel and how they affected ASLR. In this blog, the damage from an old change to binutils is brought into focus, with a script provided for developers to check their binary builds for remnants of the issue.
Read more6.6 Chosen as Next Stable Tree
Grsecurity has selected Linux 6.6 for its next stable tree, to be supported at least through the end of 2026. 5.15 will continue to be supported through the end of 2025.
New Blog Post: Stability in the Wake of Linux XLTS Sunsetting
This blog covers the news of the sunsetting of Linux's 6-year eXtended Long Term Support (XLTS) offering, how this move won't affect grsecurity or its customers, and why businesses can continue to rely on grsecurity's stable offerings for a longer period than future two-year upstream LTS releases.
Read moreNew Blog Post: Canary in the Kernel Mine: Exploiting and Defending Against Same-Type Object Reuse
This blog covers a difficult-to-defend subclass of use-after-free vulnerabilities in the Linux kernel, grsecurity's defense for it, and why our defense required compiler plugin involvement. Included PoC exploits demonstrate the power and simplicity of this kind of vulnerability, as well as the effectiveness of grsecurity's defense.
Read moreNew Blog Post: Tetragone: A Lesson in Security Fundamentals
In this blog post, we take the reader on a journey through a bypass of a new eBPF-based observability and mitigation tool named Tetragon, developed in the two hours after the tool was first set up, as a hopefully instructive lesson on the importance of security fundamentals.
Read moreNew Blog Post: The AMD Branch (Mis)predictor Part 2: Where No CPU has Gone Before (CVE-2021-26341)
In this blog post, OSS Security Researcher Pawel Wieczorkiewicz shares his journey from trying to save one byte of code to the discovery of two new cases of Straight-Line-Speculation (SLS) which affect the Zen1 and Zen2 microarchitectures of AMD CPUs. Using the findings presented in his earlier blog on the AMD branch predictor, he demonstrates a proof-of-concept exploit for eBPF against the current Linux kernel adaptable for defeating KASLR.
Read moreNew Blog Post: The AMD Branch (Mis)predictor: Just Set it and Forget it!
In this blog post, OSS Security Researcher Pawel Wieczorkiewicz goes on a deep dive following a recent investigation of his into the behavior of AMD's branch predictor and how it relates to Spectre v1 exploitation. He details the discovery that due to this behavior, Spectre v1 gadgets can be exploited much more easily on modern AMD CPUs than was previously understood. He also covers the viability of vendor-recommended mitigations and the nebulous nature of Spectre v1 gadgets themselves.
Read moreNew Blog Post: How AUTOSLAB Changes the Memory Unsafety Game
In this guest blog, Zhenpeng Lin details the three-month evaluation he performed of AUTOSLAB during a research internship with Open Source Security, Inc. AUTOSLAB is a compiler-plugin-enhanced feature of grsecurity introduced in 2020 that provides some interesting security and debug properties. The evaluation covers the completeness of AUTOSLAB's approach, how exploitation is changed, and how it affects performance.
Read moreNew Presentation: 10 Years of Linux Security - A Report Card
This presentation covers the last decade of Linux kernel security, including the stable process, the KSPP, and what changes and process improvements actually had the biggest impact.
Read moreAnnouncing Respectre®: The State of the Art in Spectre Defenses
Open Source Security Inc. is proud to announce the release of the world's most advanced, effective, and high-performance defense against Spectre speculation attacks. Today's release is the result of its months of investment in prototyping different Spectre defense strategies, finally resulting in Respectre®
Read morePassing the Baton
Today we announce a refocusing of our efforts on next-generation security technologies and tackling the remaining class of data-only attacks.
Read more