Is the GRsecurity patch enough?

[GBit]

When I patch the kernel with the grsecurity patch (grsecurity-2.9-3.3.8-201206042136.patch) the PAX features seem to open up. But I also see a pax patch (pax-linux-3.3.7-test18.patch) - would I need both of these for the full features?

[spender]

No, the grsecurity patch includes PaX. Using grsecurity is actually necessary to implement some of the things described in the PaX documentation (bruteforce prevention, defense against infoleaks by a local attacker, removal of arbitrary code execution at the filesystem level), which are outside of the scope of the PaX patch itself.

-Brad

[GBit]

Great, thanks so much.