veyepar: Maintaining the Unmaintainable: Picking up the Baton of a Secure Kernel Patchset

Author(s):	Matthew Ruffell
Location	C3
Date	jan Fri 25	Days Raw Files
Start	14:25	First Raw Start	14:01
Duration	0:45:0	Offset	0:23:36
End	15:10	Last Raw End	15:26
Chapters	00:00 0:06:19 0:17:28 0:22:49 0:36:18
Total cuts_time	39 min.

https://2019.linux.conf.au/schedule/presentation/180/
raw-playlist raw-mp4-playlist encoded-files-playlist host public tweet mp4 svg png

assets release.pdf Maintaining_the_Unmaintainable_Picking_up_the_Baton_of_a_Secure_Kernel_Patchset.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:
Locked:	clear this to unlock
Locked by:	user/process that locked.
Start:	initially scheduled time from master, adjusted to match reality
Duration:	length in hh:mm:ss
Name:	Video Title (shows in video search results)
Emails:	email(s) of the presenter(s)
Released:	has someone authorised pubication
Normalise:
Channelcopy:	m=mono, 01=copy left to right, 10=right to left, 00=ignore.
Thumbnail:	filename.png
Description:	The world of kernel security forever changed on April 26th 2017, when Open Source Security Inc published a press release announcing that they are no longer making their grsecurity kernel patchset available to the public, and that they are "handing over future maintenance of grsecurity test patches to the community". Citing their wishes for newcomers to experiment with new ideas, and that the future will be shaped by the next generation, they challenged the world to continue maintenance on grsecurity themselves. Left with little more than the previous patch to 4.9.24, and the knowledge that 4.9 will receive back ported fixes from upstream for two years, it was clear that there were large shoes to fill. At the time, I was building my distro, Dapper Linux, and one of its key value propositions is running a grsec kernel out of the box. Feeling left high and dry, and unwilling to give up on the technological advancements that the patchset provides, I decided to learn kernel development, and attempt to maintain the patchset as a complete kernel newbie. In this talk, we will have a look at the internals of the patchset, and what features are provided, slightly touch on the politics surrounding the patchset (and epic flamewars on the kernel-hardening list). We will also see what I have done to keep the patchset alive, and my attempts to forward port the patchset to newer major kernel versions, as well as the typical maintenance for 4.9 LTS. We will also see how a kernel newbie became the sole maintainer of the patchset in its entirety, and the roadblocks that have arisen that have caused far more experienced developers to give up. Finally, we will talk about what the future holds, once support for 4.9 LTS ends in Jan 2020. markdown
Comment:	production notes