HardenedBSD-11-STABLE-v46.18 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...

Warning: this is a security update!

Highlights:

• Based on FreeBSD 11.1-BETA1
• Security fixes in nandsim (b585a6c019be3fb79ec968c327ea67190565342b) [FreeBSD-SA-Candidate]
• Update to libpcap 1.8.1
• Implement INHERIT_ZERO for minherit
• Support Execute-Never bit in the arm64 pmap (edb010ea9cd5ce05e055474ade71fb8687a74eb6)
• Enable Privileged Access Never on arm64 (44c9bb43d0bd6f6d94443c9efa27cbaf86a38825)
• Enable EARLY_AP_STARTUP on amd64 and i386 kernels by default.

Installer images:
http://installer.hardenedbsd.org/pub/HardenedBSD/releases/amd64/amd64/IS...

CHECKSUM.SHA512:

SHA512 (HardenedBSD-11-STABLE-v46.18-amd64-bootonly.iso) = 5aad79d864b01c02871cf152bb1ed30d16f4f68775472034de255fbb2fcb26f7caaacb7e9ed77364201af72582b5b69fc0af55a06cc7066e061b21b9a2341b7d
SHA512 (HardenedBSD-11-STABLE-v46.18-amd64-disc1.iso) = fedf9ffae1f3be5807dd44bc2621acb574cb1cb33a5ca30459b014a3ff2a6238dadc518476ba1ed57fc8eff63bae1c28f91d78b4b6d4dab4bd19d9c276504bee
SHA512 (HardenedBSD-11-STABLE-v46.18-amd64-memstick.img) = 0ccdfa51a25b0f947743a4c1ac0b1aad1a208b69ac9a39f2063ac035fe5236b975a4f485e1f3b29965b3dc51e04168066f0e18e0e5d37c4770248e9bf7abb6ed
SHA512 (HardenedBSD-11-STABLE-v46.18-amd64-mini-memstick.img) = f5d266af8f6a275bb75ce778335342ca010cd91b2420871f96d882d2d333a51a4877c91faefa9e14f86977bcafb7aedb44629955eb871bf82eed370189e9a259


CHECKSUM.SHA512.asc:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEu1M4jTvZiSgVy54wgZsRom/9GI0FAllAly0ACgkQgZsRom/9
GI02zBAAogqk6ZrHg5I/mtBk+KX8sWlOLj0ddqyK2emQRSoVolpAhaBcZbAVxQyg
i6Crmgz1sWo5Ztt5UqrGF9+pfcfy6TwyD2qUSSbE1OyawScJaFWzqCDyCVi19Ltz
5EHP9bWJIH9m2kPs5uAHftvhywBJv9SH2wCCZXdy1W/8rLs7IAZjnK18Q1WqFJ/+
KSg80p7sZ4A++jR91cs0+Bt8U153GKspYUNB9SVZyHZUbdy8tKitic//rDXqA3ls
UcpTaBYL53WNIKIiIaVjfuNQDzXB8jDX8jXip7wNgQT+R6Nbr3PORKKuQpaTiu+p
fteIzx1CvRAsGM3N96LQmoAgjTTPBVcHR/pQV/37spP+nfQQHdJ4TkCM/x6rQCsB
VGaOSwlxGgQ+HrBfGXmKF8HcCFQH1oNKo6nQFUmaDkquAIVPLuZ14mJmN2Ke++y7
yEUml01+xeIme+o7uKMQZtyFrYQ86vjQWHPvWIIJ1MzFT8SDuLINZxWoC2LB8kWC
MY/+YCcM4cFx3KMrp3Uutp1xLv5lWs7W9cdf+P61qN8mdnPnbbqEYVDtXZ1+wUki
bxcXPZDBSiv+DxT2YbJf0x5dz9x9jPRQEzYzFHO5b1iCTsjGwJCxGiZXcSXLdJIL
rtL0bqtgbXpeKvs84fk+A1Z3ED4HN1DjjUXguFt9WWOBp2+S3f4=
=M0Ah
-----END PGP SIGNATURE-----


Changelog:

Oliver Pinter + (38):


• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master

Shawn Webb (7):

• Merge remote-tracking branch 'origin/freebsd/11-stable/master' into hardened/11-stable/master
• HBSD: Resolve merge conflict
• Merge remote-tracking branch 'origin/freebsd/11-stable/master' into hardened/11-stable/master
• Merge remote-tracking branch 'origin/freebsd/11-stable/master' into hardened/11-stable/master
• HBSD: Resolve merge conflict
• Merge remote-tracking branch 'origin/freebsd/11-stable/master' into hardened/11-stable/master
• HBSD: Resolve merge conflict

ae (4):

• MFC r318400: Allow zero port specification in table entries with type flow.
• MFC r318399: Set M_BCAST and M_MCAST flags on mbuf sent via divert socket.
• MFC r318734: Fix possible double releasing for SA reference.
• MFC r319118: Disable IPsec debugging code by default when IPSEC_DEBUG kernel option is not specified.

allanjude (1):

• MFC r318765: Allow cpuset_{get,set}affinity in capabilities mode

andrew (10):

• MFC r312703:
• MFC r316755:
• MFC r316732, r316756: Enable Privileged Access Never on arm64.
• MFC r316734, r316761: Support Execute-Never bit in the arm64 pmap.
• MFC r313396:
• MFC r317192:
• MFC r317197:
• MFC r317361:
• MFC r317824:
• MFC r307334, r318252: Support write-through caches on arm64

asomers (6):

• MFC r317715:
• MFC r317755, r317758
• MFC r317759:
• MFC r318141, r318143-r318144
• MFC r318593:
• MFC r312919 (by rwatson)

avg (7):

• MFC r316643: use msr 0xc001100c to discover multi-node AMD processors
• MFC r316853: dtrace: fix normalization of stddev aggregation
• MFC r316854: rename vfs.zfs.debug_flags to vfs.zfs.debugflags
• MFC r308826: zfs: fix up after the removal of PG_CACHED pages in r308691
• MFC r319096: zfs_lookup: fix bogus arguments to lookup of "snapshot" directory
• MFC r318830: MFV r316921: 8027 tighten up dsl_pool_dirty_delta
• MFC r318832: MFV r316923: 8026 retire zfs_throttle_delay and zfs_throttle_resolution

badger (1):

• move p_sigqueue to the end of struct proc

bapt (1):

• MFC r318900:

bdrewery (1):

• MFC r318194,r319481:

brd (1):

• MFC r316030, r317378: Add some useful examples to the sed man page.

cy (6):

• MFC r315368:
• MFC r318745:
• MFC r318578:
• MFC r318588:
• MFC r318606:
• MFC r318998:

davidcs (3):

• MFC r318382 1. Move Rx Processing to fp_taskqueue(). With this CPU utilization for processing interrupts drops to around 1% for 100G and under 1% for other speeds. 2. Use sysctls for TRACE_LRO_CNT and TRACE_TSO_PKT_LEN 3. remove unused mtx tx_lock 4. bind taskqueue kernel thread to the appropriate cpu core 5. when tx_ring is full, stop further transmits till at least 1/16th of the Tx Ring is empty. In our case 1K entries. Also if there are rx_pkts to process, put the taskqueue thread to sleep for 100ms, before enabling interrupts. 6. Use rx_pkt_threshold of 128.
• MFC r318383 QL_DPRINT macro modfied to handle multiple args; print line#.
• MFC r318676 Check for IPV6 TCP/UDP CSUM offload in pkt header during transmits.

dchagin (3):

• MFC r317601:
• MFC r319052:
• MFC r319571:

delphij (12):

• MFC r318975:
• MFC r315615:
• MFC r315272, r315370
• MFC r313695, r313760, r314769, r314863, r314865, r316125
• MFC r313327:
• MFC r316635:
• MFC r311989 (cem):
• MFC r318514-r318515, r318517, r318917
• MFC r316649 (kan):
• MFC r304106:
• MFC r306691,310036:
• MFC r319369:

dim (3):

• MFC r318655:
• MFC r318906:
• MFC r319473:

emaste (6):

• MFC r318603: nm: document 'r' symbol type
• MFC r312599 (cem): Add remaining ELF compression definitions and structs
• MFC r318316: uniq: allow -c to be used with -d or -u
• MFC arch.7 man page describing some arch-specific details
• MFC r318305: makeman: reword description, based on feedback from wblock
• MFC r318974: uart: add AMT SOL PCI ID

gjb (40):

• MFC r313955 (emaste): bsdgrep: document ignored option -u
• MFC r307469 (imp): Allow root_rw_mount to be both lower and upper case. Before, if it was upper case, you'd wind up with a read-only filesystem when you should sometimes.
• MFC r305613 (gabor): Fix typo.
• Document the requirement for two SA entries, following the IPSEC overhaul.
• Move the SA entry to the tcpmd5 module addition.
• Document r318763, EARLY_AP_STARTUP enabled by default.
• MFC r308737, r308779: r308737: Pass SWAPSIZE in env(1) when invoking mk-vmimage.sh, otherwise mkimg(1) does not create the second partition after r307008.
• MFC r318599, r318643: r318599 (bjk): Updates for efivar.8
• MFC r318646: Allow PORTSDIR to be overridden in the pkg-stage target.
• Document r318785, vfs.zfs.debug_flags -> vfs.zfs.debugflags rename.
• Document r318660, various NFS client fixes.
• Document r318660, Amazon EFS support in the NFS client.
• Document r312790, EC2 IPv6 by default.
• Further expand the r318785 entry, noting vfs.zfs.debugflags can be set in loader.conf(5), whereas vfs.zfs.debug_flags could not.
• MFC r318748: Honor WITHOUT_TFTP for check-old* and delete-old* targets.
• MFC r314935 (thompsa): Change ec2.conf to use the pkg tool from a chroot rather than trying to bootstrap it and fail from the livecd readonly filesystem.
• MFC r318794, r318795: Update the "first appeared in" version in several manual pages.
• MFC r318872: Enable DHCP and IPv6 autoconfig on non-cloud VM images.
• Document r319269, cxgbe(4) firmware update.
• Document r319244, rpcbind(8) warmstart support knob.
• Document r319349, byacc(1) version 20170201.
• Document r305514, getdtablesize(2) in capability mode. Document r305516, kern.proc.nfds in capability mode. Document r306213, bspatch(1) capsicum support.
• Document r305837, readelf(1) ARM program and section header reporting. Document r305844, ELF Tool Chain updated to r3490. Document r309125, strings(1) exit status fix.
• Document r305845, UEFI boot loader build reproducibility. Document r307631, groff(1) reproducibility fixes. Document r309183, makewhatis(1) reproducibility fixes. Document r312249, newvers.sh reproducibility fixes. Document r312730, WITH_REPRODUCIBLE_BUILD src.conf(5) knob.
• Document r310372, libmd fd(4) function additions.
• Fix a typo.
• Fix grammar.
• Fix a grammar nit.
• Fix grammar: s/warning/warnings/
• Reorder the NAT_T and IPSEC_NAT_T sentences.
• Document r319435, mpr(4) tri-mode support.
• Note groff(1) is planned for deprecation as of 12.0.
• Document r319388, cxgbetool(8) addition.
• Document r295930, truss(1) '-H' flag. Document r308154, cxgbe(4) additional virtual interface support.
• Revert r319607, which documents items that existed in 11.0-RELEASE.
• MFC r318943 (avg):
• MFC r319603, r319608, r319609:
• MFC r319621:
• Rename stable/11 from PRERELEASE to BETA1 as part of the 11.1-RELEASE cycle.
• Document r319884, make(1) version 20170510.

glebius (2):

• MFC r318677: Fix regression in ndis(4) after r286410. This adds a bunch of checks for whether this is a Ethernet or 802.11 device and does proper dereferencing.
• MFC r317806: The nandsim(4) simulator driver doesn't have any protection against races at least in its ioctl handler, and at the same time it creates device entry with 0666 permissions.

hselasky (5):

• MFC r318353: Avoid use of contiguous memory allocations in busdma when possible.
• MFC r318820: Increase the allowed maximum number of audio channels from 31 to 127 in the PCM feeder mixer. Without this change a value of 32 channels is treated like zero, due to using a mask of 0x1f, causing a kernel assert when trying to playback bitperfect 32-channel audio. Also update the AWK script which is generating the division tables to handle more than 18 channels. This commit complements r282650.
• MFC r318860: Declare the "snd_fxdiv_table" once. This shaves around 24Kbytes of binary data from sound.ko and the kernel.
• MFC r319414: Allow communication between functions on the same host when using the mlx4en(4) driver in SRIOV mode.
• MFC r319413: Free hardware queue resource after port is stopped in the mlx4en(4) driver. Else if the port is up the resource might still be busy and the MTT free will fail.

jhb (5):

• MFC 310177: Enable EARLY_AP_STARTUP on amd64 and i386 kernels by default.
• MFC 315283: Fix sysdecode_cap_rights which currently prints bogus capability rights.
• MFC 315310: Spell "const" properly.
• MFC 315334: Decode arguments to chflagsat().
• MFC 315335,315336,315496,315497,315500,315502,315504,315509,315523,315524, 315525: Decode more system call arguments in truss.

jilles (2):

• MFC r318591: compress: Add basic tests.
• MFC r318592: compress: Allow uncompress -c with multiple pathnames, as required by POSIX.

jkim (1):

• MFC: r313105, r313106

jlh (1):

• MFC r318863: Replace stale handbook URL with the proper one.

jpaetzel (1):

• MFC 318401

kib (14):

• MFC r318298: Fix several buffer overflows in realpath(3), and other minor issues.
• MFC r318299: Simplify cleanup on failure in realpath(3).
• MFC r318303: Style.
• MFC r318318: Ensure that resume path on amd64 only accesses page tables for normal operation after processor is configured to allow all required features.
• MFC r318312: Fix the AT_EXECFD functionality.
• MFC direct execution mode for rtld.
• MFC r318446: Update my copyright, note The FreeBSD Foundation involvement.
• MFC r319086: Mention that the basep argument to getdirentries(2) can be NULL.
• MFC r319138: Document direct execution mode for rtld.
• MFC r319137: Correct explanation of the dynamic tokens handling.
• MFC r318450: Add tests for some cases in r318298.
• MFC r318781: Add BIT_OR2(), BIT_AND2(), BIT_NAND2(), BIT_XOR() and BIT_XOR2().
• MFC r318780: Use __BSD_VISIBLE test instead checking for absense of _POSIX_SOURCE.
• MFC r319518: Ensure that cached struct thread does not keep spurious td_su reference on an UFS mount point.

lidl (1):

• MFC r318755: Extend libblacklist support with new action types

loos (1):

• MFC r312346:

manu (1):

• Currently stable/11 is using custom DTS for beaglebone(-black) while CURRENT is using the upstream ones from Linux. U-Boot ports have been changed to use the upstream names so 11.1-PRERELEASE doesn't boot. Since we cannot MFC the DTS easily (a lot of drivers would have to be modified) add links on the dts with upstream names.

markj (4):

• MFC r308474, r308691, r309203, r309365, r309703, r309898, r310720, r308489, r308706: Add PQ_LAUNDRY and remove PG_CACHED pages.
• MFC r318191: Let ptracestop() suspend threads sleeping in an SBDRY section.
• MFC r318476, r318478: Fix up some kern_yield() usages.
• MFC r318479: Don't bother enqueuing a page immediately before freeing it.

mav (6):

• MFC r309321: Add `gmirror create` subcommand, alike to gstripe, gconcat, etc.
• MFC r318516: Fix time handling in cv_timedwait_hires().
• MFC r318689: Add parent interface reference counting to if_vlan.
• MFC r318907: Remove some code, dead from the day one.
• MFC r318966: Improve applying unified capabilities to the lagg ports.
• MFC r318970: Call VLAN_CAPABILITIES() when LAGG capabilities change.

mjg (1):

• MFC r319167:

mmel (3):

• MFC r318024,r318025:
• MFC r318021,r318251:
• MFC r318135:

n_hibma (1):

• MFC 317729:

ngie (62):

• MFC r317288,r317289:
• MFC r318546:
• MFC r316099:
• MFC r319008:
• MFC r319010:
• MFC r317290,r317291,r317292,r317293,r317294,r317295,r317304,r317306,r317307,r317308,r317309:
• MFC r317310,r317316:
• MFC r316131:
• MFC r309412,r316109,r316132:
• MFC r315698:
• MFC r318315:
• MFC r316179,r316180,r316181,r316260:
• MFC r315561: r315561 (by trasz):
• MFC r314659,r314676:
• MFC r314659,r314676:
• MFC r317313:
• MFC r318010:
• MFC r319015:
• MFC r318007,r318008,r318009,r318011:
• MFC r318094,r318098,r318099:
• MFC r312913,r318100,r318107:
• MFC r318006:
• MFC r308161: r308161 (by lwhsu):
• MFC r307698: r307698 (by lwhsu):
• MFC r314651,r318439,r318440:
• MFC r314657:
• MFC r314655:
• MFC r314655:
• MFC r315170: r315170 (by imp):
• MFC r307741: r307741 (by emaste):
• MFC r318439:
• MFC r314658:
• MFC r314541:
• MFC r314451,r314452,r314453,r314456,r314457,r314458,r314459,r314460,r314461,r314462,r314464,r314466,r314468,r314470,r314472,r314478:
• MFC r306375,r307802:
• MFC r314463:
• Regenerate src.conf(5) after MK_DIALOG was added
• MFC r317155,r317162,r317163,r317164:
• MFC r317168:
• MFC r313169,r319246:
• Regenerate src.conf(5)
• MFC r319062:
• MFC r319027,r319028,r319029,r319030,r319031,r319033,r319034,r319035,r319036,r319037,r319038,r319039,r319040,r319041,r319042,r319043,r319044,r319045,r319046:
• MFC r319056,r319058,r319059,r319060,r319061,r319078:
• MFC r317311,r317312,r319019:
• MFC r316740:
• MFC r316742:
• MFC r317632:
• MFC r319156,r319159:
• MFC r318175,r318178,r318179:
• MFC r319158:
• MFC r319157:
• MFC r318177:
• MFC r318434:
• MFC r318436:
• MFC r318437:
• MFC r314579,r314785:
• Regenerate src.conf(5)
• MFC r318210,r318211:
• MFC r316503,r316504,r316505:
• MFC r319294:
• MFC r313398:

np (21):

• MFC r317170, r317389, and r317390.
• MFC r311846: cxgbe(4): Refresh t4_msg.h, mainly for definitions related to the crypto engine.
• MFC r316774:
• MFC r311880, r314167, r316118, r316571, r316573, r316580, r316936-r316937, r316940, and r317410.
• MFC r314131:
• MFC r313346:
• MFC r313318:
• MFC r307008:
• MFC r307380:
• MFC r309725:
• MFC r316172:
• MFC r316506:
• MFC r316971:
• MFC r317041:
• MFC r317820 and r317837.
• MFC r318124:
• MFC r317702, r317847, r318307
• MFC r318014, r318091, r318125, and r318263.
• MFC r314176 and r318973.
• MFC r318762:
• MFC r318774:

pfg (1):

• MFC r318788: bhyvegc_resize: make use of reallocarray(3) for bounds-checking.

rgrimes (1):

• MFC r314833 Convert absolute links to relative links. Style.Makefile(9) has been ignored to produce minimal diffs.

rmacklem (3):

• MFC: r317906 Fix the client side krpc from doing TCP reconnects for ERESTART from sosend().
• MFC: r317931 Fix mount_nfs so that it doesn't create mounttab entries for NFSv4 mounts.
• MFC: r318287 Make nfscl_mtofh() return ENXIO when *nfhpp == NULL.

royger (3):

• MFC r318520:
• MFC r318523, r318631:
• MFC r318632, r318633:

rpokala (1):

• MFC r318688: "struct ata_params" field "reserved206[2]" actually starts at offset 20*7*.

sjg (1):

• Update bmake to 20170510

slm (2):

• MFC r308217, r308301, r311958, r312437, r318188, r318427, r318679
• MFC r318895: Fix several problems with mapping code in mps(4). MFC r318896: Fix several problems with mapping code in mpr(4).

stevek (1):

• MFC r318314

trasz (18):

• MFC r317901:
• MFC r317905:
• MFC r317909:
• MFC r317933:
• MFC rr317934:
• MFC r317935:
• MFC r318116:
• MFC r318138:
• MFC r318481:
• MFC r317904:
• MFC r318398:
• MFC r318861:
• MFC r318816:
• MFC r319072:
• MFC r319073:
• MFC r319074:
• MFC r319075:
• MFC r319076:

truckman (2):

• MFC r318511
• MFC r318527

tuexen (20):

• MFC r312063:
• MFC r312722:
• MFC r313030:
• MFC r313031:
• MFC r313032:
• MFC r314155:
• MFC r316038:
• MFC r316743:
• MFC r317208:
• MFC r317244:
• MFC r317457:
• MFC 317464:
• MFC r317512:
• MFC r317558:
• MFC r317592:
• MFC r317597:
• MFC r318649:
• MFC r317730: Add support for listen() call.
• When a SYN-ACK is received in SYN-SENT state, RFC 793 requires the validation of SEG.ACK as the first step. If the ACK is not acceptable, a RST segment should be sent and the segment should be dropped. Up to now, the segment was partially processed. This patch moves the check for the SEG.ACK validation up to the front as required.
• MFC r319556: Fix the ICMP6 handling for TCP.

vangyzen (7):

• MFC r319020
• MFC r319022
• MFC r318585
• MFC r318586
• MFC r318539 r318580 r318581 r318584 r318749 r318952 r318953 r318955
• MFC r318954
• MFC r318582