GRsecurity and Xen This guide will show you how to install grsecurity and build and customize a kernel on a Xen based VPS. This setup has been tested on the Norwegian provider http://www.cloud1.no and on www.linode.com
This guide has been tested on Debian 6.0 64-bit Linux.
Prerequisites Create a snapshot of your VM Make sure your system packages is up to date You will need packages kernel-package build-essential bzip2 ncurses-dev Download Navigate your browser to https://grsecurity.net/download_stable.php and grab the latest stable release
Download the kernel source tree that matches the latest stable release of grsecurity from http://www.kernel.org, in this example it is version grsecurity-2.9.1-3.2.33.
Unpack the kernel source:
root@testvm:/usr/src# tar xfj linux-3.2.33.tar.bz2 Create a symlink called linux that points to the current source tree
root@testvm:/usr/src# ln -s linux-3.2.33 linux Now, patch your kernel
root@testvm:/usr/src/linux# patch -p1 < ../grsecurity-2.9.1-3.2.33-201211042155.patch The next step is to configure your kernel, I have made an attempt for a minimal kernel, but more canbe done in order to make it smaller, you can find it here:
http://frank2.net/files/grsec.config Enter the kernel configuration
root@testvm:/usr/src/linux# make menuconfig Load the grsec.config, exit and save.
Clean up
root@testvm:/usr/src/linux# make-kpkg clean Set the amount of cores, not necessary if you only have one core
export CONCURRENCY_LEVEL=2 Make the kernel
root@testvm:/usr/src/linux# make-kpkg –rootcmd fakeroot –initrd –revision=grsec.1 kernel_image kernel_headers Install the kernel
root@testvm:/usr/src/linux# dpkg -i ../linux-image-3.2.33-grsec_grsec.1_amd64.deb root@testvm:/usr/src/linux# dpkg -i ../linux-headers-3.2.33-grsec_grsec.1_amd64.deb Reboot and test!
root@testvm:/usr/src/linux# reboot root@testvm:~# uname -r 3.2.33-grsec Next you might want to install and configure gradm
Sources:
http://www.debianadmin.com/step-by-step-tutorial-howto-compile-kernel-in-debian-5-0-lenny.html Kernel build http://www.grsecurity.net Grsecurity http://www.kernel.org Kernel sources https://secure.wikimedia.org/wikibooks/en/wiki/Grsecurity EDIT
It now looks like grsec has an option to choose which virt. technology you are using and autoconfigures based on that.