{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"SIG/Security Wiki","text":"<p>The Security SIG repositories provide extra security-related packages and security-hardened override packages (replacing those from the main distribution) for Rocky Linux and other Enterprise Linux (EL) distributions.</p> <p>If you've been to this wiki before, you'll likely want to check out what's new.</p>"},{"location":"#responsibilities","title":"Responsibilities","text":"<p>Developing and maintaining various security related packages that are not in upstream EL. Identifying, developing, and maintaining security hardening changes relative to upstream EL packages. Occasionally including/backporting additional security fixes that are not yet in upstream EL packages. Contributing to the respective upstreams where practical.</p>"},{"location":"#repo-installation","title":"Repo Installation","text":""},{"location":"#on-rocky-linux","title":"On Rocky Linux","text":"<pre><code>dnf install rocky-release-security\n</code></pre>"},{"location":"#on-another-compatible-el-distro","title":"On another compatible EL distro","text":"<p>Download the release package containing our repository configuration file and package signing public key. Use the version that corresponds to the major version of your EL distro.</p> <ul> <li>rocky-release-security-9</li> <li>rocky-release-security-8</li> </ul> <p>Verify the package file's SHA-256 digest with <code>sha256sum</code>. The currently expected digests are:</p> <pre><code>0d0cfcb16379b4c374b45a7a4ec86894f5bbdd977103cc5544be0f6fc2581a2a rocky-release-security-9-3.el9.noarch.rpm\n8dc7912f0ab55dff4cb2b1dc9262c22aa89d911cdb680d33213737597d865006 rocky-release-security-8-3.el8.noarch.rpm\n</code></pre> <p>This isn't as secure as checking the package signature would be if you previously had our package signing public key, but on another distro you probably don't have that yet, so checking the digest against its copy obtained from this separate website is a best-effort measure.</p>"},{"location":"#packages","title":"Packages","text":""},{"location":"#extra-packages-for-el8-and-el9","title":"Extra packages (for EL8 and EL9)","text":"<ul> <li>lkrg (Linux Kernel Runtime Guard)</li> <li>passwdqc (password/passphrase strength checking and policy enforcement)</li> </ul>"},{"location":"#extra-packages-currently-only-for-el9","title":"Extra packages (currently only for EL9)","text":"<ul> <li>control (a common interface to register and control security-relevant system facilities)</li> <li>hardened_malloc (security-focused memory allocator providing the malloc API, and a script to preload it into existing program binaries)</li> </ul>"},{"location":"#override-packages-for-el8-and-el9","title":"Override packages (for EL8 and EL9)","text":"<ul> <li>microcode_ctl (updates Intel CPU microcode to fix CVE-2023-23583)</li> </ul>"},{"location":"#override-packages-currently-only-for-el9","title":"Override packages (currently only for EL9)","text":"<ul> <li>glibc (adds many security-hardening changes originating from Owl and ALT Linux on top of EL package)</li> <li>openssh (fewer shared libraries exposed in sshd processes while otherwise fully matching EL package's functionality)</li> </ul> <p>The changes are described in more detail on the per-package wiki pages linked above, as well as in the package changelogs. More packages/changes are planned, including override packages also for EL8.</p>"},{"location":"#source-code","title":"Source code","text":"<p>Just like for other Rocky Linux SIGs, the source trees for Security SIG packages are maintained in per-package git repositories. Each repository contains branches <code>r8</code> and/or <code>r9</code> corresponding to target EL version.</p>"},{"location":"#contributing","title":"Contributing","text":"<p>Ifanyoneelsewantstojointhiseffort-inanycapacityincludingdevelopment,maintenance,testing,documentation,usersupport,spreadingtheword,orsomethingelse-pleasejointheMattermostchannelbelowandletuskn
