See https://www.openbsd.org/security.html https://www.openbsd.org/security.html and https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations

See https://www.openbsd.org/security.html https://www.openbsd.org/security.html and https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html Some snippets: > OpenBSD believes in strong security. Our aspiration is to be NUMBER ONE in the industry for security (if we are not already there). Our open software development model permits us to take a more uncompromising view towards increased security than most vendors are able to. We can make changes the vendors would not make. Also, since OpenBSD is exported with cryptography, we are able to take cryptographic approaches towards fixing security problems. > ASLR: OpenBSD 3.4 [Nov 2003] was the first widely used operating system to provide it by default. > W^X: First used for sparc, sparc64, alpha, and hppa in OpenBSD 3.3. Strictly enforced by default since OpenBSD 6.0: a program can only violate it if the executable is marked with PT_OPENBSD_WXNEEDED and it is located on a filesystem mounted with the wxallowed mount(8) option. > Kernel relinking at boot: the .o files of the kernel are relinked in random order from a link-kit, before every reboot. This provides substantial interior randomization in the kernel's text and data segments for layout and relative branches/calls. Basically a unique address space for each kernel boot, similar to the userland fork+exec model described above but for the kernel. Theo de Raadt, June 2017.