The developers of the Rocky Linux distribution, aimed at creating a free build of RHEL to take the place of classic CentOS, have announced the formation of a new SIG (Special Interest Group) for Security. This group will focus on maintaining packages related to providing enhanced protection and supplying additional tools for security. It will also publish alternative versions of existing packages compiled with various mechanisms to enhance security or address vulnerabilities that remain unpatched in RHEL and CentOS Stream.
The developed efforts will be published in a separate repository, which can also be used in other distributions compatible with Red Hat Enterprise Linux. To connect to the repository in Rocky Linux, the command “dnf install rocky-release-security” can already be used. Currently, the repository offers the following packages:
- The LKRG (Linux Kernel Runtime Guard) kernel module, designed to detect and block attacks and integrity breaches in kernel structures (for example, this module can protect against unauthorized changes to the running kernel and attempts to escalate user process privileges). The package is built for RHEL8 and RHEL9 branches.
- The passwdqc toolkit for controlling password and passphrase complexity, including the pam_passwdqc module, the pwqcheck, pwqfilter, and pwqgen programs, as well as the libpasswdqc library. The package is built for the RHEL9 branch.
- A package with Glibc, including security enhancements developed by the Owl project and applied in ALT Linux. The package also includes fixes to block two vulnerabilities: a vulnerability in ld.so (CVE-2023-4911), which allows a local user to escalate their privileges in the system by specifying specially formatted data in the GLIBC_TUNABLES environment variable, and a vulnerability (CVE-2023-4527) in the getaddrinfo function that may lead to data leakage from the stack or cause crashes. The package is built for the RHEL9 branch.
- A package with OpenSSH, in which sshd is linked to a smaller number of shared libraries. The package is built for the RHEL9 branch.
- Related packages: pam_ssh_agent_auth, libnsl, nscd, nss_db, nss_hesiod.
Source: opennet.ru
