diff --git a/pkgs/os-specific/linux/gradm/default.nix b/pkgs/os-specific/linux/gradm/default.nix
new file mode 100644
index 00000000000..7272b5a22fa
--- /dev/null
+++ b/pkgs/os-specific/linux/gradm/default.nix
@@ -0,0 +1,51 @@
+{ fetchurl, stdenv, bison, flex, pam,
+  gcc, coreutils, findutils, binutils, bash }:
+
+stdenv.mkDerivation rec {
+  name    = "gradm-${version}";
+  version = "3.0-201401291757";
+
+  src  = fetchurl {
+    url    = "http://grsecurity.net/stable/${name}-${version}.tar.gz";
+    sha256 = "19p7kaqbvf41scc63n69b5v5xzpw3mbf5zy691rply8hdm7736cw";
+  };
+
+  buildInputs = [ gcc coreutils findutils binutils pam flex bison bash ];
+  preBuild = ''
+    substituteInPlace ./Makefile --replace "/usr/include/security/pam_" "${pam}/include/security/pam_"
+    substituteInPlace ./gradm_defs.h --replace "/sbin/grlearn"   "$out/sbin/grlearn"
+    substituteInPlace ./gradm_defs.h --replace "/sbin/gradm"     "$out/sbin/gradm"
+    substituteInPlace ./gradm_defs.h --replace "/sbin/gradm_pam" "$out/sbin/gradm_pam"
+  '';
+
+  postInstall = ''
+    mkdir -p $out/lib/udev/rules.d
+    cat > $out/lib/udev/rules.d/80-grsec.rules <<EOF
+    ACTION!="add|change", GOTO="permissions_end"
+    KERNEL=="grsec",          MODE="0622"
+    LABEL="permissions_end"
+    EOF
+  '';
+
+  makeFlags =
+    [ "DESTDIR=$(out)"
+      "CC=${gcc}/bin/gcc"
+      "FLEX=${flex}/bin/flex"
+      "BISON=${bison}/bin/bison"
+      "FIND=${findutils}/bin/find"
+      "STRIP=${binutils}/bin/strip"
+      "INSTALL=${coreutils}/bin/install"
+      "MANDIR=/share/man"
+      "MKNOD=true"
+    ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "grsecurity RBAC administration and policy analysis utility";
+    homepage    = "https://grsecurity.net";
+    license     = stdenv.lib.licenses.gpl2;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/pkgs/os-specific/linux/pax-utils/default.nix b/pkgs/os-specific/linux/pax-utils/default.nix
new file mode 100644
index 00000000000..9ab3183e92a
--- /dev/null
+++ b/pkgs/os-specific/linux/pax-utils/default.nix
@@ -0,0 +1,24 @@
+{ fetchurl, stdenv }:
+
+stdenv.mkDerivation rec {
+  name = "pax-utils-${version}";
+  version = "0.7";
+
+  src = fetchurl {
+    url = "http://dev.gentoo.org/~vapier/dist/${name}-${version}.tar.xz";
+    sha256 = "111vmwn0ikrmy3s0w3rzpbzwrphawljrmcjya0isg5yam7lwxi0s";
+  };
+
+  makeFlags = [
+    "DESTDIR=$(out)"
+    "PREFIX=$(out)"
+  ];
+
+  meta = {
+    description = "A suite of tools for PaX/grsecurity";
+    homepage    = "http://dev.gentoo.org/~vapier/dist/";
+    license     = stdenv.lib.licenses.gpl2;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/pkgs/os-specific/linux/paxctl/default.nix b/pkgs/os-specific/linux/paxctl/default.nix
new file mode 100644
index 00000000000..253c0dd5ed2
--- /dev/null
+++ b/pkgs/os-specific/linux/paxctl/default.nix
@@ -0,0 +1,28 @@
+{ fetchurl, stdenv }:
+
+stdenv.mkDerivation rec {
+  name = "paxctl-${version}";
+  version = "0.7";
+
+  src = fetchurl {
+    url = "https://pax.grsecurity.net/${name}-${version}.tar.bz2";
+    sha256 = "1j6dg6wd1v7na5i4xj8zmbff0mdqdnw6cvqy0rsbz5anra27f1zp";
+  };
+
+  preBuild = ''
+    sed "s|--owner 0 --group 0||g" -i Makefile
+  '';
+
+  makeFlags = [
+    "DESTDIR=$(out)"
+    "MANDIR=share/man/man1"
+  ];
+
+  meta = {
+    description = "A tool for controlling PaX flags on a per binary basis";
+    homepage    = "https://pax.grsecurity.net";
+    license     = stdenv.lib.licenses.gpl2;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 746d475b7a6..c0c4155d606 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6585,6 +6585,8 @@ let
 
   gpm = callPackage ../servers/gpm { };
 
+  gradm = callPackage ../os-specific/linux/gradm { };
+
   hdparm = callPackage ../os-specific/linux/hdparm { };
 
   hibernate = callPackage ../os-specific/linux/hibernate { };
@@ -6991,6 +6993,10 @@ let
 
   pam_usb = callPackage ../os-specific/linux/pam_usb { };
 
+  paxctl = callPackage ../os-specific/linux/paxctl { };
+
+  pax-utils = callPackage ../os-specific/linux/pax-utils { };
+
   pcmciaUtils = callPackage ../os-specific/linux/pcmciautils {
     firmware = config.pcmciaUtils.firmware or [];
     config = config.pcmciaUtils.config or null;