Over the last few months, Brian Salcedo has been working on rewriting our secadm tool from scratch. We're excited to announce the first beta release of secadm 0.3.0. User-facing changes in this release include:

1. secadm set is now secadm load and requires a file path.
2. secadm list is now secadm show.
   • You can now export the ruleset to different formats with the -f argument! For example, secadm show -f json exports the rules to JSON format.
3. You can now add/remove rules one at a time with secadm add and secadm del.
4. You can now enable/disable rules one at a time with secadm enable and secadm disable.
5. UCL rule language is nearly the same.

Please give this release a try. You can download the tarball here and the GPG signature here. If you find any issues, please email Brian Salcedo (brian.salcedo {at} hardenedbsd.org) and CC Shawn Webb (shawn.webb {at} hardenedbsd.org).

Follow this example for the new UCL syntax:

secadm {
    pax = {
        path = "/usr/local/bin/testpie";
        aslr = false;
    }
}

Update 2015-11-22 21:58 EST: An issue was found with the PAGEEXEC and MPROTECT feature parsing. The version number has been bumped to 0.3.0-beta-02 and the links have been updated accordingly.

On 11 July 2015, we announced a Call For Donations. The community has been very gracious towards us. As of today, we have now exceeded our goal. We are grateful to each and every one of our donors, no matter the amount they contributed or in what form. HardenedBSD is growing and we need all the help we can get. We would especially like to thank Xinuos and ISC for their sizable contributions.

Here's what we've managed to do so far with the donations provided:

• Replace two failing hard drives in the package building server along with ordering two extra for hot spares.
• Purchase multiple ARM and ARM64 development boards for porting and testing efforts.
• Stickers!
• Minor expenses for conferences.
• Hosting expenses.
• Other hardware replacement and acquisition.

In January of 2016, work will start for becoming a 501(C)(3) not-for-profit organization in the United States. This will mean that US-based donations will be tax-deductible, giving a tangible incentive for donations.

We couldn't have done all of this had it not been for all the generous contributions, large and small. Even though we've reached our goal, we're still accepting donations. The more that comes in, the more that we can accomplish. We look forward to the coming year and the advancements we'll make.

We at HardenedBSD have decided to do a periodic (likely quarterly) status report in order to keep the community informed of what's going on in HardenedBSD. So here goes the first status report:

The Call for Donations is going well. We have raised nearly $1,000 USD of our goal of $7,000 USD. The Internet Systems Consortium, the people behind BIND and ISC-DHCPD, have offered to match donations up to $1,000 USD. We've decided to run the donations until November 30th. We appreciate all the help and support from the community. We're excited to see where this round of donations takes us. We plan to start the 501(C)(3) organization investigation in January.

We added Brian Salcedo as an official developer, tasked with rewriting secadm nearly from scratch. He has been hard at work revamping how the rules are stored in the kernel. As part of the rewrite, he'll include ugidfw(8) functionality. The basic rewrite is 100% complete and pending a thorough code review. We're hoping to have a beta released soon.

We have started storing a cache of secadm rules for applications that are known to misbehave with our awesome enhancements. If you have a secadm rule for an application and would like to see it up there, please send us either a Pull Request on GitHub or email us a patch. Feel free to also drop in IRC and let us know. Oliver has created a little script to help in rule validation.

Shawn has been working with the OPNSense team to deliver quality builds based on HardenedBSD. Experimental builds have been posted here, the latest build being hbsd-exp-05. Work is in progress to provide a binary upgrade path and an official download location. Shawn has also been working with Baptiste Darrousin from the FreeBSD project to test his RELRO patch. The RELRO patch is in the hardened/current/unstable branch and is undergoing extensive testing, including a full package build with a number of packages being compiled with RELRO. We hope to have the RELRO patch merged into the hardened/current/master branch within the next week or two. Shawn is also preparing to give a number of presentations. He'll be speaking at vBSDcon, DerbyCon, and BSidesDC. The BSidesDC will be a recorded, four-hour presentation diving deep into HardenedBSD's internals.

Oliver has been working hard on bringing FORTIFY_SOURCE to FreeBSD for his Google Summer of Code project. He has made a lot of progress. He's currently splitting the work out into smaller patches for easier review by the FreeBSD development team. It builds fine with both clang and gcc. He also backported our ASLR code to 10-STABLE. Oliver also has been keeping tabs on HardenedBSD's infrastructure, ensuring everything runs smoothly. We had a failing disk earlier this week on our Jenkins machine and we got that replaced within a few hours. The main CPU fan pinout on the motherboard of the package building server has stopped working. Luckily there's a second pinout for an additional CPU fan. The motherboard should be under warranty. As a bandaid, the CPU fan was moved to the second pinout. We'll be working on replacing the motherboard through the normal warranty process soon.

A user reported having issues with golang on HardenedBSD. After some digging, we found out that in golang versions prior to 1.5, COMPAT_FREEBSD32 needs to be enabled in your kernel config. We have removed it from the HARDENEDBSD kernel config. Golang version 1.5, which is already in the ports tree, fixes this. We will be following up with a new package build soon.

Over the July 4th weekend, we implemented randomization of the VDSO (Virtual Dynamic Shared Object). The VDSO is a spot in memory that is shared between the kernel and userland memory. It contains the signal trampoline and time-related code (like gettimeofday(2)). Randomizing the VDSO was the last piece of the address space to randomize. Now that it is implemented, our ASLR implementation is now complete. Our version of ASLR is the strongest form ever implemented in any BSD operating system. Read on for the full feature list.

HardenedBSD is gaining a lot of traction. We maintain our own packages to ensure proper ABI/API compatibility with HardenedBSD. We are looking for those who would be interested in mirroring our package repositories. You'd be looking at 2x50GB per repository. Right now, we only have one repo for 11-CURRENT/amd64. But we will soon be expanding to also building 10-STABLE/amd64 packages as well. We are currently restructuring the way our repo works. Of course, if you decide to become an official mirror, your name will be listed on our donors page. We appreciate the help and support the community has given us already and we look forward to working further with the community as we grow. Please contact us at core@hardenedbsd.org to discuss further details.