I'm [email protected], and grsec is the reason I can sleep at night.
As an example of an exploit blocked by grsec, you can look at almost any of the recent kernel vulnerabilities. Stock exploits simply don't work against a grsec kernel.
As an example of a vulnerability blocked by grsec, and in particular UDEREF, you have the recent x86_32 local root.
Grsec (minus rbac) won't do anything against "logic" problems (shellshock, hearthbleed, the LD_* problems) but, together with an hardened toolchain, it makes some classes of bugs much more difficult to exploit.
What it does help against are kernel bugs.
Then you have RBAC. Rbac is a MAC (mandatory access control) system, like SELinux or AppArmor, which offers further protection, even from root.
Plus, grsec will allow you to enable some nifty restrictions which are really useful if you can bear them. The main ones are:
- socket restrictions (no listen/no connect/nothing)
- /proc visibility restriction (per user)
- stronger chroots
- restrict runnable programs to only root-approved ones
The point is: grsec will make your system safer, but bugs will be found even on the safest system.