HardenedBSD June 2022 Status Report

June saw some cool security enhancements to HardenedBSD. So let's kick off our usual list:

In src, 14-CURRENT:

  1. The HardenedBSD amd64 kernel configs have been unified to be based off of HARDENEDBSD-CORE.
  2. OpenSSH's ssh-sk-helper program violates the cfi-icall scheme. Until I get time to dive in (or if someone beats me to it), I've disabled the cfi-icall scheme for that program. Users can now use the integrated FIDO2/U2F key support in OpenSSH.
  3. Our Trusted Path Execution feature from secadm now exists in base. There are some differences, which I will document in our wiki soon. TPE violations are logged. One major thing left to do is integrate with mmap(fd, PROT_EXEC). This would also prevent a PaX NOEXEC bypass by virtue of creating a file with an executable payload, mapping it in memory, and executing it.
  4. The RTLD has been significantly hardened. This has the potential to cause issues, especially when building ports/packages. A new sysctl node (hardening.harden_rtld) has been added and is defaulted to 1 (enabled).

I plan to MFC all of the above to 13-STABLE soon. If you build your own packages or ports, please take special note of item four above. Here's a few more details on how we've hardened the RTLD (when hardening.harden_rtld is set to 1):

  1. LD_PRELOAD is fully prohibited.
  2. Set dangerous_ld_env, which isn't used much in the RTLD, but could be used more in the future.
  3. Sensitive LD_* environment variables are scrubbed.
  4. Using the RTLD to execute applications is prohibited.
  5. Tracing of loaded objects is prohibited. This change in particular breaks ldd(1), which is used by a lot of ports during the build process. This is what can cause the most headaches.

In ports:

  1. SafeStack and CFI are disabled if PKGNAMESUFFIX ends with -static.
  2. PaX PAGEEXEC is disabled for sysutils/syslog-ng
  3. New port added: sysutils/pc-sysinstall
  4. SMB support was added to multimedia/ffmpeg
  5. PaX MPROTECT is disabled for emulators/wine
  6. PaX MPROTECT is disabled for emulators/wine-proton
  7. PaX MPROTECT is disabled for net-im/nheko
  8. PaX MPROTECT is disabled for net-im/quaternion
  9. PaX MPROTECT is disabled for www/node16

Other projects:

  1. Work is now officially underway to provide the HardenedBSD community with a HardenedBSD 13-STABLE based fork of OPNsense. We're really close to providing a proof-of-concept build--likely before the end of July 2022. We will provide periodic (montly? bi-weekly?) updates. If you'd like to follow along, the repos are here.
  2. The old 12-STABLE package building server will be used to perform periodic automated builds of Loic's LiveCD project, making it an official HardenedBSD project. This server will also build the HardenedBSD+OPNsense builds. Time frame for completing this will likely be in August 2022.

HardenedBSD May 2022 Status Report

In May 2022, HardenedBSD saw a few changes.

In src:

  1. chroot(2) is now prohibited when a directory file descriptor is opened.
  2. The HARDENEDBSD-NODEBUG kernel configuration was updated to remove a few more debugging-related options.
  3. Loic merged a lot of updates to 13-STABLE, especially regarding hbsd-update.

In ports:

  1. LTO is now disabled for the firefox port.
  2. The virtualbox ports were fixed by Loic.
  3. net/opennx port is fixed.
  4. Loic fixed devel/mingw32-gcc
  5. Loic fixed devel/bmake

Other projects:

Recent changes in FreeBSD caused breakages with secadm. Shawn fixed secadm by complying to those ABI/API-breaking changes made by FreeBSD.

HardenedBSD April 2022 Status Report

In src:

  1. Shawn introduced the notion of an "insecure/untrustworthy" kernel module. Certain kernel modules, like this linux syscall translation layer commonly called the "linuxulator", may create interesting attack vectrors. Some modules are old and likely contain vulnerabilities (old: smbfs, vulnerable: fusefs.) By default, HardenedBSD prevents loading these kernel modules post-boot (eg, via rc.conf(5)'s `kld_list`). The list of kernel modules currently tagged as "insecure" is below at the end of this status report.
  2. Loic hardened the default sshd_config. Please reference commit b7961aade549f05f62d65b0906db495b9423c940 for more information. The changes that might carry the most impact are:
    • MaxSessions 5
    • AllowTcpForwarding no
    • AllowAgentForwarding no

In ports:

  1. Shawn fixed the harfbuzz bug that plagued devel/doxygen (via pango). Though the errant code was indeed in pango, the harfbuzz project did not do a thorough job at ensuring the sanity of arguments passed in to one of its provided APIs (a NULL dereference bug in harfbuzz, manifest by errant code in pango.)
  2. Loic fixed a compiler error in the wine ports.
  3. Loic fixed the virtualbox-ose-* ports.

Other projects or items of note:

  1. The HardenedBSD Foundation's Ben Welch has been working on a new static site for us, migrating us away from Drupal. There's a few things to wrap up, but I suspect on the inside of three months, the HardenedBSD website will look quite a bit different from what it looks like today.
  2. I (Shawn) am quite far behind on the administrative side of the HardenedBSD project. I need to do the financials and other administrative things. I apologize for the delays on the various administrative tasks.

Kernel modules currently marked as insecure:

  1. smbfs
  2. accf_http
  3. accf_dns
  4. linux_common
  5. linux/linux64
  6. lindebugfs (NOTE: this impacts drm-*-kmod KMS drivers)
  7. fusefs

As of this writing, HardenedBSD 14-CURRENT (both amd64 and arm64) users can overwrite these insecure markings by using hbsdcontrol:

# hbsdcontrol pax disable insecure_kmod /path/to/kernel/module

This is especially useful for drm-*-kmod users. I plan to MFC the hbsdcontrol integration commit mid-to-late next week (so somewhere between 05 May and 08 May 2022) after more thorough testing on my HardenedBSD laptops.

Please note that April 2022 concludes official support for the 12-STABLE branch. Effective 01 May 2022, support for the 12-STABLE branch must come from the wider HardenedBSD community. On 31 Dec 2022, the package repo and all build artifacts pertaining to 12-STABLE will be fully removed.

HardenedBSD March 2022 Status Report

We made some cool progress in March. Though I, Shawn, am writing this report, I'll refer to myself in the third person for the rest of the report. :-)

In src:

  1. Shawn reverted a potential LPE race condition in ZFS introduced by OpenZFS. Only 14-CURRENT was affected.
  2. Shawn merged in zlib's CVE-2018-25032 fix.
  3. Shawn enabled -ftrivial-auto-var-init=zero in base clang by default. This now means we don't need to pass in any compiler flags to support this feature. All ports that rely on the system compiler will now automatically benefit.
  4. FreeBSD introduced a change that enables dumpon to use the underlying non-encrypted swap device when encrypted swap is used. Shawn reverted this change since users who choose to encrypt their swap encrypt it for a reason--HardenedBSD should proactively protect users by respecting their encryption preferences.
  5. Loic found and fixed an issue with the linuxulator in HardenedBSD, with the default stack permissions.
  6. Coming up soon: sponsored work by BlackhawkNest, Inc that provides support in base for (more) easily building HardenedBSD 13-STABLE based versions of OPNsense. This is in the hopes to provide the wider community with the ability to produce their own builds. Some of this work has landed in a special feature branch.

In ports:

  1. In tandem with src change #3, Shawn modified the ports tree to rely on the system compiler's application of -ftrivial-auto-var-init=zero. There's no need to apply that feature via CFLAGS injection.
  2. Loic removed `stackautoinit:off` USE_HARDENING flag from a very large number of ports. This was a huge lift and his work on this is very much appreciated. He and Shawn worked a lot on this.
  3. Ibrahim Kaikaa (Mr.UNIX) has helped fix a number of ports. We still have a number of outstanding merge requests that I need to verify.


  1. The HardenedBSD GitLab server had a drive failure. I had already planned to rebuild the pool from a bunch of older 1TB spinning rust drives to a bunch of 2TB SSDs. The drive failure accellerated the pool rebuild, which completed successfully.
  2. After a large number of months of downtime, our arm64 package building server has come back online! We're now building 14-CURRENT/arm64 packages.
  3. After src change #3 landed, all of the build infrastructure servers were updated.

Cool projects:

  1. Loic released an unofficial livecd of HardenedBSD that boots into XFCE[0]. I've started the discussion with him to convert that from from an "unofficial" project to an "official" one. :-)

Special notes:

  1. As a reminder, support for HardenedBSD 12-STABLE will be delegated to the community. As such, binary updates and package builds will cease. The hardened/12-stable/master branch will no longer be auto-synced.
  2. Please remember to let us know if you have any thoughts to share on whether HardenedBSD should support the linuxulator by 15 Apr 2022.
  3. Please remember to let us know if you have any thoughts to share on the proposed changes to the default sshd configuration[1].

[0]: https://groups.google.com/a/hardenedbsd.org/g/users/c/QUTUJfm30Dg/m/0VNK...
[1]: https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/merge_requests/60

HardenedBSD January 2022 Status Report

The first month of the year started strong. I'm going to get right into it.

In base:

  1. FreeBSD landed their Virtual Dynamic Shared Object (VDSO) late last year. I brought those changes in to 14-CURRENT (and subsequently 13-STABLE). I ensured that the VDSO's userland mapping was still randomized. As it stands today, the VDSO is active on amd64, but not on arm64. I tested to make sure that both scenarios still work by testing on the development ThunderX1.
  2. In the back port of the VDSO work to 13-STABLE, I introduced a single-character typo. I chased that down, squashing the bug.
  3. FreeBSD's pkgbase work has advanced quite a bit. Our pkgbase integration didn't follow those advancements, so I belatedly fixed that. This was needed for work sponsored by BlackhawkNest, Inc.

  4. Loic made it so that the kernel's config file isn't embedded in the kernel.
  5. I made it so that we apply a separate delta for the RTLD upon image activation time. Previously, we would apply the same delta we use for regular mmap calls. Re-using the mmap delta placed the RTLD right next to the other dependent shared objects. As the RTLD contains high-value targets, applying a separate delta helps protect those targets.
  6. I identified a problem with the OpenSSH import in base whereby the in-app sftpd service would crash when a Windows client attempted to connect. I resolved that issue by fixing a kernel check on the process control KPI.
  7. FreeBSD introduced a new `security.bsd.allow_ptrace` sysctl node and its corresponding integration code. When PAX_HARDENING is set in the kernel (it is set by default), the sysctl node will default to 0.
  8. CVE-2021-4034 came out. I took inspiration from OpenBSD's general mitigation of checking that (argc == 0) in the kernel before allowing execve(2) to complete. The implementation of the argc check differs between FreeBSD and HardenedBSD. FreeBSD's implementation occurs much sooner in the code path, whereas my implementation occurs after the sysentvec-specific sv_copyout_strings function pointer is called. Should there be a weird sv_copyout_strings implementation, our argc check will be more resilient than the FreeBSD check.
  9. The old Berkely DataBase (bdb) implementation requires downstream consumers to reference function pointers in a contextual structure returned (and filled out) by dbopen(3). These function pointers point to uninstrumented functions in libc. Thus, when the cfi-icall scheme is applied, applications attempting to call those function pointers will be killed with SIGILL by CFI.
  10. I spent around twenty hours this month on Cross-DSO CFI, the longest amount of time spent in a while. I've identified some chicken-and-egg scenarios, especially revolving around the dlopen dance in libc and the rtld. The Cross-DSO CFI runtime intercepts calls to dlopen in order to add the shared object's memory to the CFI allow list.

In ports:

  1. Loic hardened the multimedia/ffmpeg port
  2. I fixed the misc/seabios port.
  3. Loic removed an unneeded patch in the security/osiris port.
  4. I disabled the DTRACE option for a few ports. DTrace support is broken when using a more complete llvm compiler toolchain. I need to file a bug report upstream in llvm to address this, but haven't due to lack of time.
  5. I fixed the openjdk ports.
  6. Loic fixed the devel/aarch64-none-elf-gcc ports.
  7. I disabled PaX MPROTECT for the mongodb ports.

Infrastructure work:

All of the HardenedBSD build infrastructure is graciously hosted by my employer, BlackhawkNest, Inc. Due to COVID-19, we're still working remotely 99.9% of the time, myself included. The 27th of this month was the first time in around three months since I had been in the office.

With my focus being more on the development side, I've not taken the time to set up a proper network and system monitoring solution. Some servers are experiencing hardware failures (mostly just dead drives).

Starting 02 Feb 2022, I plan to go up to the office at least twice per week. I've ordered replacement drives and will install them as soon as they arrive. The server hit hardest is the 12-STABLE nightly build server, which is at the point where I will need to rebuild it with new drives, performing a fresh reinstall and reconfiguration.

I plan to divert some of my development time towards infrastructure maintenance in February, setting up that infrastructure monitoring solution. I'd like to get us to the point where we can be anticipatory with our infrastructure's needs rather than reactionary.


HardenedBSD has had a very busy and productive January. We've made several substantial improvements. This project would not be possible without the generous and greatly appreciated contributions of the community. The HardenedBSD team and I are grateful for the opportunity to serve you.

HardenedBSD December 2021 Status Report

It has been a busy December! I worked on 14-CURRENT/arm64 support. HardenedBSD now builds (nearly) all of world (both libraries and applications) with Link-Time Optimization (LTO). We now have two ThunderX1 systems. Over the past few months, FreeBSD introduced one or more commits that is causing the ThunderX1 system we use for package builds to fail to boot. Oddly, the other ThunderX1 server (used for arm64 development, rather than package builds) boots just fine. I've been working on tracking down which commit(s) are the culprit, but doing so takes time.

FreeBSD also landed a proper VDSO implementation. However, the implementation lacks ASLR support. Due to scheduling issues, I've reverted the VDSO-related commits until I have a solid weekend to hack on it, applying our PaX-inspired ASLR implementation to it. I hope to have that time mid-January or early February.

I narrowed down a few more issues in ports related to our switch to a more complete LLVM compiler toolchain. There are still a large number of ports to fix, which stands as a testament that the development community relies heavily on a GNU-based toolchain. Ideally, projects shouldn't care what toolchain is being used.

Loic landed ClonOS support in the HardenedBSD ports tree. He also helped address more LLVM toolchain fallout. I have a number of merge requests to review from him. Keep up the good work, Loic!

On Sunday (26 Dec 2021), I plan to work on HardenedBSD financials. I'm a bit late in sending out the typical "would you like to be listed on our donor's page" emails. I hope to also work on a 2022 project roadmap.

HardenedBSD has had a lot of help in 2021. The community's contributions have directly improved HardenedBSD. We received a number of server donations, which enables us to build packages quicker and more reliably. We were able to expand our arm64 support. All donations have gone to support either hardware or the few monthly expenses we have. I am grateful for any contribution, no matter the form it comes in--whether that's advocacy, patch submissions, monetary donations, hardware donations, etc. Your generosity enables the success of this project.

HardenedBSD November 2021 Status Report

November saw a number of improvements to HardenedBSD. Loic fixed a bunch of old cruft in base. Among the changes from Loic:

  1. Remove Oliver Pinter's old kernel config
  2. Clean up line breaks
  3. Fix the motd generation code to use HardenedBSD's motd template
  4. Bug fixes in hbsd-update
  5. Use HTTPS with hbsd-update (possible now that FreeBSD distributs trusted CA root certificates.)

I need to MFC a bunch of his work to 13-STABLE and 12-STABLE where applicable.

The HardenedBSD Foundation's Ben La Monica has been stellar at keeping our self-hosted GitLab up-to-date and making sure that runs smoothly.

FreeBSD updated llvm in 14-CURRENT base to llvm 13. I've been working on addressing the fallout from that. Note that though there is fallout, it's the good kind: the llvm compiler toolchain is progressing and finding buggy code. The problem comes when you build 30,000+ packages. ;-)

Speaking of building packages, the 14-CURRENT/amd64 package build server experienced a catastrophic failure. Just today (30 Nov 2021), I went into the datacenter to rebuild the server. 14-CURRENT/amd64 packages will lag behind for a little bit while I transfer backed up config files and the like and kick off a new build.

The 14-CURRENT/arm64 package builder is also in a paused state. I'm working on bisecting one or more commits from FreeBSD that trigger a kernel panic on the ThunderX1.

We also purchased and received another ThunderX1. This new TX1 will be used for development purposes (for example: porting SafeStack to HardenedBSD/arm64). The TX1 referenced in the paragraph above is solely for package builds. The git bisect is being performed on this second TX1. I've yet to find the offending commit(s), but hope to by the end of this coming weekend.

To better facilitate expansion and development efforts, I have installed a new 25U rack at home, which is where the second TX1 currently lives. My employer (BlackhawkNest, Inc, who graciously hosts the HardenedBSD build infrastructure) recently installed a third rack. We have a few servers to deploy into it, which will likely happen mid-December.

I'd like to take a moment to thank the wider HardenedBSD community. Your help and support is not only crucial to the project, but immensely appreciated. Contributions come in all forms, some of which are advocacy, patch submissions, monetary donations, and community support. Every contribution, no matter the form, helps the project grow. Especially as we enter the last month of the year, we are incredibly grateful for your continued support.

If you have an itch to scratch, please do! We review all patches for the project that come our way, regardless of whether they're security-related or not.

As a reminder, for those who create new accounts on our self-hosted GitLab, please email netops{AT}hardenedbsd{DOT}org for account activation.

Call For Testing: Removing and hardening sensitive files

I've merged into a feature branch (hardened/current/sensitive) a merge request from Loic that hardens file and directory permissions for a handful of files/directories.

I plan to let the feature branch soak for around two months, giving the HardenedBSD community time to test the changes prior to them landing. Of course, should issues arise, we'll take care of them.

I've enabled binary updates for that feature branch and I've configured the auto-sync application to sync the branch along with all the other branches every six hours.

The feature branch will share the same package repo as hardened/current/master (aka, HardenedBSD 14-CURRENT). If you track 14-CURRENT, please help test the hardened/current/sensitive branch.

Attached to this email are the two hbsd-update config files: one for normal hbsd-update users, and another for Tor users.

HardenedBSD October 2021 Status Report

October was pretty quiet. This status may seem a bit more random.

I spent more time learning llvm's compiler toolchain, focusing specifically on llvm-readobj. For those following along, here's FreeBSD's exp-run of enabling WITH_LLVM_TOOLCHAIN in base: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258872

I followed a few FreeBSD commits that affected HardenedBSD. Some of those commits deal with the signal trampoline code. Please let me know if you experience any oddities around signal delivery.

I've ordered a second ThunderX server for better arm64 support. The two SoftIron OverDrive 1000 systems the HardenedBSD Project has just don't deliver enough performance for doing operating systems development on.

Though it's not a part of the HardenedBSD project per se, I wrote a living article on my setup at home. Included are how I use HardenedBSD in several capacities, one being a PiHole alternative. I normally wouldn't include things of a personal nature in a HardenedBSD status update, but this article provides a decent peek into HardenedBSD's infrastructure. The link to the article: https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/personal/2...

HardenedBSD September 2021 Status Report

September saw a few changes. Most notably, in 14-CURRENT, FreeBSD introduced WITH_LLVM_BINUTILS, which we switched to. This makes it so that we use more llvm compiler toolchain tools, like llvm-objcopy, llvm-size, llvm-cxxfilt, etc. This causes a large number of ports to either fail or be skipped. Most notably, ports that include explicit DTrace support. I'm (slowly) learning how these extra llvm tools work to try to figure out how to fix these issues.

I hardened TCP and UDP blackholing (the `net.inet.tcp.blackhole` and `net.inet.udp.blackhole` sysctl nodes) such that connection attempts to unbound ports are ignored; that is, no TCP RST packet or ICMP unreach packets are sent on unbound ports.

I worked a bit on documentation, too. So the main project wiki is more up-to-date with regards to our features and changes. There's still more work to be done, but our documentation is indeed improving.

Loic troubleshooted some kernel panics and worked with FreeBSD to get those fixed. I still need to review a few patches he has submitted. I hope to get to that in the first week in October.

We received a new server donation. The server will be dedicated for Cross-DSO CFI development. We're grateful for any and all contributions. Your support keeps HardenedBSD alive. Thank you for giving the HardenedBSD team the opportunity to serve you.

Looking forward into October, I'm hoping to fix the llvm toolchain issues. I need to put my administrative hat on and take care of financials. I plan to reach out to recent donors, asking if they want their name added to the donor's page. I plan to perform a rather major overhaul of our perimeter firewall towards the end of the month.


Subscribe to HardenedBSD RSS