grsecurity download can fail silently #62
Description
Running under GRSECURITY=1, our script can fail silently when downloading the grsecurity patch set, resulting in a nominal grsec kernel with no grsecurity patches.
Steps to reproduce
$ export GRSECURITY=1
$ make securedrop-core-5.15Expected behavior
The build aborts if there's an error downloading the grsecurity patch set.
Will include grsecurity patch for kernel 6.6.88
2025-04-29 03:43:12 ERROR Credentials not found, set GRSECURITY_USERNAME & GRSECURITY_PASSWORD
Fetching Linux kernel source 6.6.88
Comments
Per @legoktm:
if grsecurity:
# TODO: invoke this through normal Python means
linux_version = subprocess.check_output(
["/usr/local/bin/grsecurity-urls.py", "--print-version"], text=True
).strip()
print("Will include grsecurity patch for kernel", linux_version)
with open("/patches-grsec/grsec", "wb") as f:
# TODO: invoke this through normal Python means
subprocess.run(["/usr/local/bin/grsecurity-urls.py"], stdout=f)
notably,
--print-versiondoes not require auth, while the actual patch download is just subprocess.run with no check=True
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
Status