3 ms·

Not only sandboxed, but many are pledge(2)'d now also. One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (

by petee 8y ago

Not only sandboxed, but many are pledge(2)'d now also. One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe syspatch(8) changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken) Same with packages - unless you use mTier to get binary updates, security fixes and updates for packages need to be compiled yourself. Not the worst, but depends how much free time you have to keep on it. FreeBSD has a larger ecosystem, and seems to be more performance oriented

black_knight 8y ago
On the other hand, upgrading OpenBSD to a new version is just about as easy as updating the packages on any other OS. If not easier! Also, yes, syspatch makes the paching between releases a five seconds task.
- 4ad 8y ago
  Unfortunately, OpenBSD normally requires booting into a special kernel for upgrading unless you do this: https://www.openbsd.org/faq/upgrade63.html#NoInstKern https://www.openbsd.org/faq/upgrade63.html#NoInstKern. This really makes it hard to use on AWS.
  - asveikau 8y ago
    I agree it is tedious, however, I have found it is pretty simple to put those instructions in a shell script and use it across multiple machines.
    - 4ad 8y ago
      My problem is not that it is tedious, but that it is not a recommended configuration. Stuff might break, it's much less tested, etc.
krylon 8y ago
> Not only sandboxed, but many are pledge(2)'d now also. And here I was thinking that pledge(2) was the sandbox. Did I miss something?
- petee 8y ago
  In a way, just not in the traditional filesystem sense; e.g., jail, chroot. Pledge allows a program to 'promise' which calls it is expected to make. For example, a program promising only to use 'stdio', will SIGABORT if you try to open a socket, fork, exec, or anything not part of the stdio group (as defined by pledge) https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2

by petee 8y ago

black_knight 8y ago

On the other hand, upgrading OpenBSD to a new version is just about as easy as updating the packages on any other OS. If not easier! Also, yes, syspatch makes the paching between releases a five seconds task.

4ad 8y ago
Unfortunately, OpenBSD normally requires booting into a special kernel for upgrading unless you do this: https://www.openbsd.org/faq/upgrade63.html#NoInstKern https://www.openbsd.org/faq/upgrade63.html#NoInstKern. This really makes it hard to use on AWS.
- asveikau 8y ago
  I agree it is tedious, however, I have found it is pretty simple to put those instructions in a shell script and use it across multiple machines.
  - 4ad 8y ago
    My problem is not that it is tedious, but that it is not a recommended configuration. Stuff might break, it's much less tested, etc.

krylon 8y ago

> Not only sandboxed, but many are pledge(2)'d now also. And here I was thinking that pledge(2) was the sandbox. Did I miss something?

petee 8y ago
In a way, just not in the traditional filesystem sense; e.g., jail, chroot. Pledge allows a program to 'promise' which calls it is expected to make. For example, a program promising only to use 'stdio', will SIGABORT if you try to open a socket, fork, exec, or anything not part of the stdio group (as defined by pledge) https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2