3 ms·

The recent changes to /usr and /usr/local are a good example: https://www.openbsd.org/faq/upgrade60.html https://www.openbsd.org/faq/upgrade60.html The wxallo

The recent changes to /usr and /usr/local are a good example: https://www.openbsd.org/faq/upgrade60.html https://www.openbsd.org/faq/upgrade60.html The wxallowed mount option. W^X is now strictly enforced by default; a program can only violate it if it is located on a filesystem mounted with the wxallowed mount(8) option. This allows the base system to be more secure as long as /usr/local is a separate filesystem. The base system has no W^X-violating programs, but the ports tree contains quite a few: chromium, mono, node, gnome, libreoffice, jdk, zeal, etc. If you want to run any of these ports on a regular basis, you need to add wxallowed to the mount options for /usr/local in fstab(5), e.g.: 01020304050607.h /usr/local ffs rw,nodev,wxallowed 1 2 Small disks may not have a separate partition for /usr/local. In that case, add wxallowed to the smallest partition containing it: /usr or /. Starting a W^X-violating program from a partition without the wxallowed mount option will produce a core dump and the dmesg(8) will contain an entry such as soffice.bin(15529): mprotect W^X violation. You can temporarily allow W^X-violating ports by issuing mount -uo wxallowed /usr/local.

dredmorbius 9y ago
For those to whom "wxallowed" and W^X aren't immediately clear: https://en.m.wikipedia.org/wiki/W%5EX https://en.m.wikipedia.org/wiki/W%5EX W^X ("Write XOR Execute"; spoken as W xor X) is a security feature in operating systems and virtual machines. It is a memory protection policy whereby every page in a process's or kernel's address space may be either writable or executable, but not both. Without such protection, a program can write (as data) CPU instructions in an area of memory intended for data and then arrange to run (as executable) those instructions. This can be dangerous if the writer of the memory is malicious.

dredmorbius 9y ago

For those to whom "wxallowed" and W^X aren't immediately clear: https://en.m.wikipedia.org/wiki/W%5EX https://en.m.wikipedia.org/wiki/W%5EX W^X ("Write XOR Execute"; spoken as W xor X) is a security feature in operating systems and virtual machines. It is a memory protection policy whereby every page in a process's or kernel's address space may be either writable or executable, but not both. Without such protection, a program can write (as data) CPU instructions in an area of memory intended for data and then arrange to run (as executable) those instructions. This can be dangerous if the writer of the memory is malicious.