security/wiki
8
0
Fork 1
generated from sig_core/wiki-template
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deployed 35eb728 with MkDocs version: 1.5.3

Browse Source
This commit is contained in:
2023-10-03 18:04:54 +00:00
parent bba562d123
commit 28dc5739b3
3 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
index.html
View File

@ -331,6 +331,19 @@
Override packages (currently only for EL9)
</a>
<nav class="md-nav" aria-label="Override packages (currently only for EL9)">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#known-effective-vulnerability-mitigations-and-fixes" class="md-nav__link">
Known-effective vulnerability mitigations and fixes
</a>
</li>
</ul>
</nav>
</li>
</ul>
@ -412,12 +425,14 @@
</ul>
<h3 id="override-packages-currently-only-for-el9">Override packages (currently only for EL9)<a class="headerlink" href="#override-packages-currently-only-for-el9" title="Permanent link">&para;</a></h3>
<ul>
<li>glibc (adds many security-hardening changes originating from Owl and ALT Linux on top of EL package, fixes <a href="https://www.openwall.com/lists/oss-security/2023/09/25/1">CVE-2023-4527</a>)</li>
<li>glibc (adds many security-hardening changes originating from Owl and ALT Linux on top of EL package)</li>
<li>openssh (fewer shared libraries exposed in sshd processes while otherwise fully matching EL package's functionality)</li>
</ul>
<p>The changes are described in more detail in the package changelogs.
The inclusion of additional security fixes will be "reverted" if and when those get included in upstream EL packages that we rebase our changes on.
More packages/changes are planned, including override packages also for EL8.</p>
<h4 id="known-effective-vulnerability-mitigations-and-fixes">Known-effective vulnerability mitigations and fixes<a class="headerlink" href="#known-effective-vulnerability-mitigations-and-fixes" title="Permanent link">&para;</a></h4>
<p><code>glibc-2.34-60.el9_2.security.0.2</code> (specifically the <code>.0.2</code> version!) includes mitigations sufficient to avoid security exposure of <a href="https://www.openwall.com/lists/oss-security/2023/10/03/2">CVE-2023-4911</a> and a backport of upstream glibc fix of <a href="https://www.openwall.com/lists/oss-security/2023/09/25/1">CVE-2023-4527</a> that was not yet in upstream EL.</p>
<p>The inclusion of additional security fixes will be "reverted" if and when those get included in upstream EL packages that we rebase our changes on.</p>
<h2 id="source-code">Source code<a class="headerlink" href="#source-code" title="Permanent link">&para;</a></h2>
<p>Just like for other Rocky Linux SIGs, the source trees for Security SIG packages are maintained in <a href="https://git.rockylinux.org/sig/security/src">per-package git repositories</a>. Each repository contains branches <code>r8</code> and/or <code>r9</code> corresponding to target EL version.</p>
<h2 id="contributing">Contributing<a class="headerlink" href="#contributing" title="Permanent link">&para;</a></h2>

2
search/search_index.json
View File

@ -1 +1 @@
{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"SIG/Security Wiki","text":"<p>The Security SIG repositories provide extra security-related packages and security-hardened override packages (replacing those from the main distribution) for Rocky Linux and other Enterprise Linux (EL) distributions.</p>"},{"location":"#responsibilities","title":"Responsibilities","text":"<p>Developing and maintaining various security related packages that are not in upstream EL. Identifying, developing, and maintaining security hardening changes relative to upstream EL packages. Occasionally including/backporting additional security fixes that are not yet in upstream EL packages. Contributing to the respective upstreams where practical.</p>"},{"location":"#repo-installation","title":"Repo Installation","text":"<pre><code>dnf install rocky-release-security\n</code></pre>"},{"location":"#packages","title":"Packages","text":""},{"location":"#extra-packages-for-el8-and-el9","title":"Extra packages (for EL8 and EL9)","text":"<ul> <li>lkrg (Linux Kernel Runtime Guard)</li> <li>passwdqc (Password/passphrase strength checking and policy enforcement)</li> </ul>"},{"location":"#override-packages-currently-only-for-el9","title":"Override packages (currently only for EL9)","text":"<ul> <li>glibc (adds many security-hardening changes originating from Owl and ALT Linux on top of EL package, fixes CVE-2023-4527)</li> <li>openssh (fewer shared libraries exposed in sshd processes while otherwise fully matching EL package's functionality)</li> </ul> <p>The changes are described in more detail in the package changelogs. The inclusion of additional security fixes will be \"reverted\" if and when those get included in upstream EL packages that we rebase our changes on. More packages/changes are planned, including override packages also for EL8.</p>"},{"location":"#source-code","title":"Source code","text":"<p>Just like for other Rocky Linux SIGs, the source trees for Security SIG packages are maintained in per-package git repositories. Each repository contains branches <code>r8</code> and/or <code>r9</code> corresponding to target EL version.</p>"},{"location":"#contributing","title":"Contributing","text":"<p>If anyone else wants to join this effort - in any capacity including development, maintenance, testing, documentation, user support, spreading the word, or something else - please join the Mattermost channel below and let us know!</p> <p>We also welcome well-reasoned suggestions/feedback/preferences on direction we should take (e.g., only making changes on top of EL's vs. offering newer upstream versions), what else to package, and what other changes to include.</p>"},{"location":"#meetings-communications","title":"Meetings / Communications","text":"<p>We hang out in our Security Mattermost channel.</p>"},{"location":"#members","title":"Members","text":"<p>Some of the people particularly active with setting up this SIG so far:</p> Name Mattermost Name Neil Hanlon @neil Scott Shinn @atomicturtle Solar Designer @solardiz"}]}
{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"SIG/Security Wiki","text":"<p>The Security SIG repositories provide extra security-related packages and security-hardened override packages (replacing those from the main distribution) for Rocky Linux and other Enterprise Linux (EL) distributions.</p>"},{"location":"#responsibilities","title":"Responsibilities","text":"<p>Developing and maintaining various security related packages that are not in upstream EL. Identifying, developing, and maintaining security hardening changes relative to upstream EL packages. Occasionally including/backporting additional security fixes that are not yet in upstream EL packages. Contributing to the respective upstreams where practical.</p>"},{"location":"#repo-installation","title":"Repo Installation","text":"<pre><code>dnf install rocky-release-security\n</code></pre>"},{"location":"#packages","title":"Packages","text":""},{"location":"#extra-packages-for-el8-and-el9","title":"Extra packages (for EL8 and EL9)","text":"<ul> <li>lkrg (Linux Kernel Runtime Guard)</li> <li>passwdqc (Password/passphrase strength checking and policy enforcement)</li> </ul>"},{"location":"#override-packages-currently-only-for-el9","title":"Override packages (currently only for EL9)","text":"<ul> <li>glibc (adds many security-hardening changes originating from Owl and ALT Linux on top of EL package)</li> <li>openssh (fewer shared libraries exposed in sshd processes while otherwise fully matching EL package's functionality)</li> </ul> <p>The changes are described in more detail in the package changelogs. More packages/changes are planned, including override packages also for EL8.</p>"},{"location":"#known-effective-vulnerability-mitigations-and-fixes","title":"Known-effective vulnerability mitigations and fixes","text":"<p><code>glibc-2.34-60.el9_2.security.0.2</code> (specifically the <code>.0.2</code> version!) includes mitigations sufficient to avoid security exposure of CVE-2023-4911 and a backport of upstream glibc fix of CVE-2023-4527 that was not yet in upstream EL.</p> <p>The inclusion of additional security fixes will be \"reverted\" if and when those get included in upstream EL packages that we rebase our changes on.</p>"},{"location":"#source-code","title":"Source code","text":"<p>Just like for other Rocky Linux SIGs, the source trees for Security SIG packages are maintained in per-package git repositories. Each repository contains branches <code>r8</code> and/or <code>r9</code> corresponding to target EL version.</p>"},{"location":"#contributing","title":"Contributing","text":"<p>If anyone else wants to join this effort - in any capacity including development, maintenance, testing, documentation, user support, spreading the word, or something else - please join the Mattermost channel below and let us know!</p> <p>We also welcome well-reasoned suggestions/feedback/preferences on direction we should take (e.g., only making changes on top of EL's vs. offering newer upstream versions), what else to package, and what other changes to include.</p>"},{"location":"#meetings-communications","title":"Meetings / Communications","text":"<p>We hang out in our Security Mattermost channel.</p>"},{"location":"#members","title":"Members","text":"<p>Some of the people particularly active with setting up this SIG so far:</p> Name Mattermost Name Neil Hanlon @neil Scott Shinn @atomicturtle Solar Designer @solardiz"}]}

BIN
sitemap.xml.gz
View File

Binary file not shown.