4 ms·

>What other system has enabled by default the following security mitigations Let's see. >Enforced W^X in the kernel Linux, OS X, Windows >Enforced W^X userl

>What other system has enabled by default the following security mitigations Let's see. >Enforced W^X in the kernel Linux, OS X, Windows >Enforced W^X userland as of 6.0 Linux >Stack protector (..which OpenBSD pushed into wide adoption). Literally every other OS out there has stack protector, and it was Windows pushing it to wide adoption >PIE by default for base and ports. Linux >Static-PIE for self-relocating static binaries. Linux >SROP (sigreturn(2) oriented programming) mitigation by default. Useless "mitigation", can be easily bypassed with no effort >C shared library re-ordering at boot time, i.e: libc.so is re-linked at boot time so objects are randomly ordered. Useless mitigation, can be easily bypassed with no effort >System-wide sandboxing (pledge(2)) of a large percentage of the userland Large percentage? I disagree, it's more like 10%.

marios 10y ago
The key word is "by default". I have no idea whether the Linux kernel that each distro ships enforced W^X. For userland, the effort is undergoing. For instance, I recently packaged a C application for Debian. Then, by sheer luck I stumbled upon the Debian Wiki[0] where it explained that one needs to specify "DEB_BUILD_MAINT_OPTIONS = hardening=+all" to enable compiler hardening options. Why isn't that on by default ? The wiki asks the reader to enable hardening if the program handles untrusted data. Doesn't that apply to 99% of the applications out there ? Even it only reads its own configuration file, there is a possibility of a bug in the parser. Why take the risk at all ? Enable it by default for everyone and be done with it. Regarding the pledge(2) sandboxing, pretty much every userland application in the base install of OpenBSD where is makes sense to sandbox is using pledge. Ports/packages are another story entirely. [0] https://wiki.debian.org/Hardening#Using_Hardening_Options https://wiki.debian.org/Hardening#Using_Hardening_Options
- ryuuchin 10y ago
  Arch Linux enables -fstack-protector-strong last I checked by default. I admit Debian often drags it feet on some things like this but I think Ubuntu has enabled it for a number of packages as well.
  - marios 10y ago
    And there lies the difference: "a number of packages" for Ubuntu/Debian, all packages and base software on OpenBSD.
ryuuchin 10y ago
>>Enforced W^X userland as of 6.0 >Linux Well grsecurity's mmap protections are a strict superset of OpenBSD's W^X which we've had for what 10 years now? >Literally every other OS out there has stack protector, and it was Windows pushing it to wide adoption I don't know when OpenBSD or Linux distro's were starting to add SSP support but stack protection/BSC (buffer security checks) have been enabled by default in every Visual Studio version since (at least) 2005. The mitigation has been improved over the years as well. DEP and ASLR became default in 2008 (not really relevant here though).

marios 10y ago

The key word is "by default". I have no idea whether the Linux kernel that each distro ships enforced W^X. For userland, the effort is undergoing. For instance, I recently packaged a C application for Debian. Then, by sheer luck I stumbled upon the Debian Wiki[0] where it explained that one needs to specify "DEB_BUILD_MAINT_OPTIONS = hardening=+all" to enable compiler hardening options. Why isn't that on by default ? The wiki asks the reader to enable hardening if the program handles untrusted data. Doesn't that apply to 99% of the applications out there ? Even it only reads its own configuration file, there is a possibility of a bug in the parser. Why take the risk at all ? Enable it by default for everyone and be done with it. Regarding the pledge(2) sandboxing, pretty much every userland application in the base install of OpenBSD where is makes sense to sandbox is using pledge. Ports/packages are another story entirely. [0] https://wiki.debian.org/Hardening#Using_Hardening_Options https://wiki.debian.org/Hardening#Using_Hardening_Options

ryuuchin 10y ago
Arch Linux enables -fstack-protector-strong last I checked by default. I admit Debian often drags it feet on some things like this but I think Ubuntu has enabled it for a number of packages as well.
- marios 10y ago
  And there lies the difference: "a number of packages" for Ubuntu/Debian, all packages and base software on OpenBSD.

ryuuchin 10y ago

>>Enforced W^X userland as of 6.0 >Linux Well grsecurity's mmap protections are a strict superset of OpenBSD's W^X which we've had for what 10 years now? >Literally every other OS out there has stack protector, and it was Windows pushing it to wide adoption I don't know when OpenBSD or Linux distro's were starting to add SSP support but stack protection/BSC (buffer security checks) have been enabled by default in every Visual Studio version since (at least) 2005. The mitigation has been improved over the years as well. DEP and ASLR became default in 2008 (not really relevant here though).