It has been an exciting month for HardenedBSD. First up is an important announcement. I am officially looking for new job opportunities. This is important for the HardenedBSD project since the development and build infrastructure is housed at my (now former) employer's office.

I'm grateful for the two-and-a-half years in which BlackhawkNest has provided the project with free hosting. They have agreed to continue hosting the development/build infrastructure for free until the end of November. BlackhawkNest has been incredibly supportive of the project in many ways and I wish them well in their future endeavors.

HardenedBSD's development and build infrastructure will need to find a new home. Looking at the long term, I would eventually like HardenedBSD to stand independent of my employment. However, we currently lack the funding and will need to continue to rely on my employer until we gain enough sustained funding.

It is my hope that HardenedBSD's development and build infrastructure is transitioned in a timely manner to its new home, where ever that may be, before the end of November 2022. If you would like to help out in the effort to make HardenedBSD's infrastructure stand independent, please donate. We appreciate the community's contributions to the project, regardless of the form those contributions come in (code, advocacy, funding, etc.)

Please note that OS binary updates, package repos, and installer images are hosted elsewhere and will not be interrupted. GitLab and the build systems will be the only systems impacted.

Now, let's get into progress in the project itself!

In src:

1. Shawn added a new sysctl tunable (hardening.pax.kmod_laod_disable) that, when set, disables loading all kernel modules from that point forward. The kld rc script has been updated such that users can specify hbsd_late_kld_prohibit in rc.conf, which will set the sysctl node after loading modules specified in kld_list. This work was sponsored by BlackhawkNest, Inc.
2. Significant progress has been made on Cross-DSO CFI support. An installable version of HardenedBSD 14-CURRENT with Cross-DSO CFI enable can now build itself (meaning, `make buildworld buildkernel` works in a fully Cross-DSO CFI'd system.)
   • There's still more work to be done here. On a normal install of HardenedBSD 14-CURRENT, the following command fails when building the compiler toolchain:
     make buildworld WITHOUT_SYSTEM_COMPILER=yes WITHOUT_SYSTEM_LINKER=yes
   • The `ctfmerge` application segfaults when building the kernel. ctfmerge is needed for DTrace support. I plan to disable ctfmerge (thus disabling DTrace) in the Cross-DSO CFI feature branch and circle back around to fixing whatever bugs lie in ctfmerge. I'd rather keep the momentum around Cross-DSO CFI support going.

In ports:

1. Shawn forked FreeBSD's Poudriere project to support the needs of building packages in HardenedBSD. By default, Poudriere creates a 1GB tmpfs mount for data. HardenedBSD has (slightly) outgrown that, so the size has increased to 2GB to account for future growth.
2. Shawn disabled CFI for x11-servers/xorg-server
3. Loic fixed x11-wm/enlightenment
4. Loic fixed mail/bogofilter
5. Loic fixed sysutils/pefs-kmod
6. Loic fixed net-mgmt/netdisco-mibs
7. Loic fixed x11-toolkits/gtkd
8. Loic fixed x11-wm/piewm
9. Loic removed lib32 in emulators/libc6-shim
10. Shawn bumped the version for hardenedbsd/liblattutil

It's that time of the month for the HardenedBSD status report! My own status is pretty darn simple: Little time, no hacks. I hope to be back in the swing of things by the beginning of November. Life is keeping me busy. So I'm ever more grateful for the continued contributions by the HardenedBSD community.

However, Loic and MrUnix fixed a number of issues in both the source and ports repos.

In src:

1. Loic fixed an issue MrUnix reported about a missing PaX ASLR macro when building a kernel with COMPAT_FREEBSD32 enabled.
2. Loic updated bsdinstall with a few changes, updating which sysctl nodes to set.
3. I pulled in a change from OpenBSD that randomizes how often the chacha20-based arc4random(3) reseeds itself.
4. HardenedBSD user "apache2" enabled multi-console booting by default, enabling use of the serial console by default.

In ports:

1. Loic disabled PIE for java/eclipse
2. I disabled SafeStack for x11-servers/xorg-server
3. Loic added a new port: hardenedbsd/kernel-nodebug
4. Loic disabled PIE for sysutils/grub2-efi
5. Loic disabled PIE for net-im/profanity
6. Loic disabled PIE for astr/xephem
7. Loic disabled PIE for lang/zig-devel
8. Loic fixed sysutils/pefs-kmod
9. Loic fixed textproc/sxml
10. Loic disabled PIE for sysutils/fluent-bit
11. Loic disabled PIE for mat/4ti2
12. Loic disabled PIE for mat/mprime
13. Loic disabled DTRACE for lang/erlang-runtime25
14. Loic disabled the PDF option in comms/fl_moxgen
15. Loic fixed mail/bogofilter
16. Loic fixed lang/gcc13-devel
17. Shawn disable variable auto-init for security/tor
18. MrUNIX disabled the JIT for net-im/signal-desktop
19. MrUNIX disabled MPROTECT and PAGEEXEC for games/veloren
20. MrUNIX fixed the build of lang/mono5.10, lang/mono5.20, and lang/mono6.8

For hbsdfw:

hbsdfw, aka the HardenedBSD Firewall, has a new build for this month. As usual, the process for updating is:

1. Backup your config
2. Reinstall with the new build
3. Restore your config

The default username and password have been changed:

Username: root
Password: hbsdfw

You can find the new build at [0].

[0]: https://hardenedbsd.org/~shawn/hbsdfw/hbsdfw_installer_vga_13.1-20220824...

SHA256 (hbsdfw_installer_vga_13.1-20220824-140520.iso.xz) = 0656808643dfaf2ba640c561686da5f861969dadd3ebb9185abfa7c640a6af44

June saw some cool security enhancements to HardenedBSD. So let's kick off our usual list:

In src, 14-CURRENT:

1. The HardenedBSD amd64 kernel configs have been unified to be based off of HARDENEDBSD-CORE.
2. OpenSSH's ssh-sk-helper program violates the cfi-icall scheme. Until I get time to dive in (or if someone beats me to it), I've disabled the cfi-icall scheme for that program. Users can now use the integrated FIDO2/U2F key support in OpenSSH.
3. Our Trusted Path Execution feature from secadm now exists in base. There are some differences, which I will document in our wiki soon. TPE violations are logged. One major thing left to do is integrate with mmap(fd, PROT_EXEC). This would also prevent a PaX NOEXEC bypass by virtue of creating a file with an executable payload, mapping it in memory, and executing it.
4. The RTLD has been significantly hardened. This has the potential to cause issues, especially when building ports/packages. A new sysctl node (hardening.harden_rtld) has been added and is defaulted to 1 (enabled).

I plan to MFC all of the above to 13-STABLE soon. If you build your own packages or ports, please take special note of item four above. Here's a few more details on how we've hardened the RTLD (when hardening.harden_rtld is set to 1):

1. LD_PRELOAD is fully prohibited.
2. Set dangerous_ld_env, which isn't used much in the RTLD, but could be used more in the future.
3. Sensitive LD_* environment variables are scrubbed.
4. Using the RTLD to execute applications is prohibited.
5. Tracing of loaded objects is prohibited. This change in particular breaks ldd(1), which is used by a lot of ports during the build process. This is what can cause the most headaches.

In ports:

1. SafeStack and CFI are disabled if PKGNAMESUFFIX ends with -static.
2. PaX PAGEEXEC is disabled for sysutils/syslog-ng
3. New port added: sysutils/pc-sysinstall
4. SMB support was added to multimedia/ffmpeg
5. PaX MPROTECT is disabled for emulators/wine
6. PaX MPROTECT is disabled for emulators/wine-proton
7. PaX MPROTECT is disabled for net-im/nheko
8. PaX MPROTECT is disabled for net-im/quaternion
9. PaX MPROTECT is disabled for www/node16

Other projects:

1. Work is now officially underway to provide the HardenedBSD community with a HardenedBSD 13-STABLE based fork of OPNsense. We're really close to providing a proof-of-concept build--likely before the end of July 2022. We will provide periodic (montly? bi-weekly?) updates. If you'd like to follow along, the repos are here.
2. The old 12-STABLE package building server will be used to perform periodic automated builds of Loic's LiveCD project, making it an official HardenedBSD project. This server will also build the HardenedBSD+OPNsense builds. Time frame for completing this will likely be in August 2022.

In src:

1. Shawn introduced the notion of an "insecure/untrustworthy" kernel module. Certain kernel modules, like this linux syscall translation layer commonly called the "linuxulator", may create interesting attack vectrors. Some modules are old and likely contain vulnerabilities (old: smbfs, vulnerable: fusefs.) By default, HardenedBSD prevents loading these kernel modules post-boot (eg, via rc.conf(5)'s `kld_list`). The list of kernel modules currently tagged as "insecure" is below at the end of this status report.
2. Loic hardened the default sshd_config. Please reference commit b7961aade549f05f62d65b0906db495b9423c940 for more information. The changes that might carry the most impact are:
   • MaxSessions 5
   • AllowTcpForwarding no
   • AllowAgentForwarding no

In ports:

1. Shawn fixed the harfbuzz bug that plagued devel/doxygen (via pango). Though the errant code was indeed in pango, the harfbuzz project did not do a thorough job at ensuring the sanity of arguments passed in to one of its provided APIs (a NULL dereference bug in harfbuzz, manifest by errant code in pango.)
2. Loic fixed a compiler error in the wine ports.
3. Loic fixed the virtualbox-ose-* ports.

Other projects or items of note:

1. The HardenedBSD Foundation's Ben Welch has been working on a new static site for us, migrating us away from Drupal. There's a few things to wrap up, but I suspect on the inside of three months, the HardenedBSD website will look quite a bit different from what it looks like today.
2. I (Shawn) am quite far behind on the administrative side of the HardenedBSD project. I need to do the financials and other administrative things. I apologize for the delays on the various administrative tasks.

Kernel modules currently marked as insecure:

1. smbfs
2. accf_http
3. accf_dns
4. linux_common
5. linux/linux64
6. lindebugfs (NOTE: this impacts drm-*-kmod KMS drivers)
7. fusefs

As of this writing, HardenedBSD 14-CURRENT (both amd64 and arm64) users can overwrite these insecure markings by using hbsdcontrol:


# hbsdcontrol pax disable insecure_kmod /path/to/kernel/module


This is especially useful for drm-*-kmod users. I plan to MFC the hbsdcontrol integration commit mid-to-late next week (so somewhere between 05 May and 08 May 2022) after more thorough testing on my HardenedBSD laptops.

Please note that April 2022 concludes official support for the 12-STABLE branch. Effective 01 May 2022, support for the 12-STABLE branch must come from the wider HardenedBSD community. On 31 Dec 2022, the package repo and all build artifacts pertaining to 12-STABLE will be fully removed.

The first month of the year started strong. I'm going to get right into it.

In base:

1. FreeBSD landed their Virtual Dynamic Shared Object (VDSO) late last year. I brought those changes in to 14-CURRENT (and subsequently 13-STABLE). I ensured that the VDSO's userland mapping was still randomized. As it stands today, the VDSO is active on amd64, but not on arm64. I tested to make sure that both scenarios still work by testing on the development ThunderX1.
2. In the back port of the VDSO work to 13-STABLE, I introduced a single-character typo. I chased that down, squashing the bug.

FreeBSD's pkgbase work has advanced quite a bit. Our pkgbase integration didn't follow those advancements, so I belatedly fixed that. This was needed for work sponsored by BlackhawkNest, Inc.

3. Loic made it so that the kernel's config file isn't embedded in the kernel.
4. I made it so that we apply a separate delta for the RTLD upon image activation time. Previously, we would apply the same delta we use for regular mmap calls. Re-using the mmap delta placed the RTLD right next to the other dependent shared objects. As the RTLD contains high-value targets, applying a separate delta helps protect those targets.
5. I identified a problem with the OpenSSH import in base whereby the in-app sftpd service would crash when a Windows client attempted to connect. I resolved that issue by fixing a kernel check on the process control KPI.
6. FreeBSD introduced a new `security.bsd.allow_ptrace` sysctl node and its corresponding integration code. When PAX_HARDENING is set in the kernel (it is set by default), the sysctl node will default to 0.
7. CVE-2021-4034 came out. I took inspiration from OpenBSD's general mitigation of checking that (argc == 0) in the kernel before allowing execve(2) to complete. The implementation of the argc check differs between FreeBSD and HardenedBSD. FreeBSD's implementation occurs much sooner in the code path, whereas my implementation occurs after the sysentvec-specific sv_copyout_strings function pointer is called. Should there be a weird sv_copyout_strings implementation, our argc check will be more resilient than the FreeBSD check.
8. The old Berkely DataBase (bdb) implementation requires downstream consumers to reference function pointers in a contextual structure returned (and filled out) by dbopen(3). These function pointers point to uninstrumented functions in libc. Thus, when the cfi-icall scheme is applied, applications attempting to call those function pointers will be killed with SIGILL by CFI.
9. I spent around twenty hours this month on Cross-DSO CFI, the longest amount of time spent in a while. I've identified some chicken-and-egg scenarios, especially revolving around the dlopen dance in libc and the rtld. The Cross-DSO CFI runtime intercepts calls to dlopen in order to add the shared object's memory to the CFI allow list.

In ports:

1. Loic hardened the multimedia/ffmpeg port
2. I fixed the misc/seabios port.
3. Loic removed an unneeded patch in the security/osiris port.
4. I disabled the DTRACE option for a few ports. DTrace support is broken when using a more complete llvm compiler toolchain. I need to file a bug report upstream in llvm to address this, but haven't due to lack of time.
5. I fixed the openjdk ports.
6. Loic fixed the devel/aarch64-none-elf-gcc ports.
7. I disabled PaX MPROTECT for the mongodb ports.

Infrastructure work:

All of the HardenedBSD build infrastructure is graciously hosted by my employer, BlackhawkNest, Inc. Due to COVID-19, we're still working remotely 99.9% of the time, myself included. The 27th of this month was the first time in around three months since I had been in the office.

With my focus being more on the development side, I've not taken the time to set up a proper network and system monitoring solution. Some servers are experiencing hardware failures (mostly just dead drives).

Starting 02 Feb 2022, I plan to go up to the office at least twice per week. I've ordered replacement drives and will install them as soon as they arrive. The server hit hardest is the 12-STABLE nightly build server, which is at the point where I will need to rebuild it with new drives, performing a fresh reinstall and reconfiguration.

I plan to divert some of my development time towards infrastructure maintenance in February, setting up that infrastructure monitoring solution. I'd like to get us to the point where we can be anticipatory with our infrastructure's needs rather than reactionary.

Conclusion:

HardenedBSD has had a very busy and productive January. We've made several substantial improvements. This project would not be possible without the generous and greatly appreciated contributions of the community. The HardenedBSD team and I are grateful for the opportunity to serve you.