I ran grsec on servers extensively for several years. This was several years ago so this information may be dated.<p>It&#x27;s not fair to discuss grsec as a whole, when asking &quot;why hasn&#x27;t it been merged?&quot;. The &#x2F;tmp symlink protection was a personal pet peeve of mine for many years. As implemented by grsec, it completely eliminated an entire class of vulnerabilities. It also had zero overhead and was a very small patch. It frustrated me to no end that it took years to land in mainline. When it finally did, nothing broke (afaik). I can&#x27;t understand at all the years of resistance.<p>However, large parts of grsec were basically a competitor to SELinux. If you disagree with the assertion that selinux is fundamentally broken, then you have parts of grsec that don&#x27;t belong in mainline.<p>The chroot restrictions broke BIND on my installations, which happen to be one of the most commonly chroot() users in standard deployments.<p>grsec has some great memory protection capabilities. There should at least be a conversation about some of this going mainline.