June saw some cool security enhancements to HardenedBSD. So let's kick off our usual list:
In src, 14-CURRENT:
- The HardenedBSD amd64 kernel configs have been unified to be based off of HARDENEDBSD-CORE.
- OpenSSH's ssh-sk-helper program violates the cfi-icall scheme. Until I get time to dive in (or if someone beats me to it), I've disabled the cfi-icall scheme for that program. Users can now use the integrated FIDO2/U2F key support in OpenSSH.
- Our Trusted Path Execution feature from secadm now exists in base. There are some differences, which I will document in our wiki soon. TPE violations are logged. One major thing left to do is integrate with mmap(fd, PROT_EXEC). This would also prevent a PaX NOEXEC bypass by virtue of creating a file with an executable payload, mapping it in memory, and executing it.
- The RTLD has been significantly hardened. This has the potential to cause issues, especially when building ports/packages. A new sysctl node (hardening.harden_rtld) has been added and is defaulted to 1 (enabled).
I plan to MFC all of the above to 13-STABLE soon. If you build your own packages or ports, please take special note of item four above. Here's a few more details on how we've hardened the RTLD (when hardening.harden_rtld is set to 1):
- LD_PRELOAD is fully prohibited.
- Set dangerous_ld_env, which isn't used much in the RTLD, but could be used more in the future.
- Sensitive LD_* environment variables are scrubbed.
- Using the RTLD to execute applications is prohibited.
- Tracing of loaded objects is prohibited. This change in particular breaks ldd(1), which is used by a lot of ports during the build process. This is what can cause the most headaches.
- SafeStack and CFI are disabled if PKGNAMESUFFIX ends with -static.
- PaX PAGEEXEC is disabled for sysutils/syslog-ng
- New port added: sysutils/pc-sysinstall
- SMB support was added to multimedia/ffmpeg
- PaX MPROTECT is disabled for emulators/wine
- PaX MPROTECT is disabled for emulators/wine-proton
- PaX MPROTECT is disabled for net-im/nheko
- PaX MPROTECT is disabled for net-im/quaternion
- PaX MPROTECT is disabled for www/node16
- Work is now officially underway to provide the HardenedBSD community with a HardenedBSD 13-STABLE based fork of OPNsense. We're really close to providing a proof-of-concept build--likely before the end of July 2022. We will provide periodic (montly? bi-weekly?) updates. If you'd like to follow along, the repos are here.
- The old 12-STABLE package building server will be used to perform periodic automated builds of Loic's LiveCD project, making it an official HardenedBSD project. This server will also build the HardenedBSD+OPNsense builds. Time frame for completing this will likely be in August 2022.