OpenPaX, a New Linux Memory Security Patch, Arrives
Of all the top security worries, we have sweated greatly over storage and network attacks. In the last few years, memory attacks have also become more troublesome. To address this security issue, Edera has released OpenPaX, a new open source Linux kernel patch. This patch mitigates common memory safety errors and enhances system hardening.
If its name rings a bell, chances are you’re a Linux administrator. Open Source Security‘s GrSecurity, a set of Linux kernel security programs, includes a component called PaX. This kernel program flags data memory as non-executable and program memory as non-writable. This helps prevent memory overwrite attacks and provides address space layout randomization (ASLR).
So, why OpenPaX? Because back in April 2017, Open Source Security announced it would no longer release public GrSecurity patches. Today, you can still get updated versions of GrSecurity and PaX, but you must have a subscription.
Yes, that is legal under Linux’s governing license, the GNU General Public License, version 2 (GPLv2) clause 3.a. To the best of my knowledge, Open Source Security is the only major company that has ever adopted this particular approach to monetizing a Linux kernel component.
RBAC and Other Features
Some have argued that Open Source Security’s approach is somewhat like Red Hat’s retirement of CentOS. But that’s an enterprise Linux distribution, not a single kernel module.
I should add that GrSecurity is more than PaX. It also includes other security features such as role-based access control (RBAC), Chroot restrictions, enhanced auditing capabilities and trusted path execution. OpenPaX is only a potential replacement for PaX.
“Until now, access to common sense memory safety mitigations … required developers and companies to license an expensive kernel patch that they could not redistribute without losing access to updated versions of the patch, arguably violating the GP,” said Ariadne Conill, distinguished engineer and co-founder at Edera and maintainer of Alpine Linux, in a statement. “OpenPaX changes all that for the better.”
In an e-mail message to The New Stack, Conill added that the OpenPaX patch has been pushed upstream to Linus Torvald‘s Linux tree. So, in time, OpenPax may become part of the mainline Linux kernel.
You can apply OpenPaX to your Linux kernel today. It offers improved runtime memory safety protections and better hardening against application-level memory safety attacks. If you want it already baked in, Alpine Linux has announced it will include a PaX-enabled kernel as a technical preview in its upcoming 3.21 release, with further integration planned for version 3.22.
