HardenedBSD June 2023 Status Report

I'm a few days late to June's status report. But I have extremely good news. The development and build infrastructure is back online! All of our equipment made it safe and sound to Colorado. I'm currently being serenaded by the hum of the infrastructure in my home office.

If you cannot reach any bit of our public infrastructure, please let me know. There's a chance we may bring more servers online, depending on power availability and stability.

In addition to moving across the country, here's what happened in the src tree:

  1. Process tracing a process that has entered capabilities mode (aka, it successfully called `cap_enter(2)`) is now prohibited by default. A new per-jail sysctl tunable, `hardening.prohibit_ptrace_capsicum`, has been added. System administrators can also use `hbsdcontrol(8)` to toggle the restriction on a per-application basis.
  2. Some llvm work. FreeBSD imported llvm 16 into base. We needed to fix a few things regarding llvm16.

In ports:

  1. First-time patch submitter, vujo, disabled RELRO for editors/vscode.