4 ms·

> "For a security focused OS, OpenBSD is terrible in this regard. Pledge and Unveil are simply not sufficient." Does that mean that OpenBSD's mitigations are t

> "For a security focused OS, OpenBSD is terrible in this regard. Pledge and Unveil are simply not sufficient." Does that mean that OpenBSD's mitigations are trivial to exploit? "Terrible" and "simply not sufficient" are strong words. If so, can you provide a working proof-of-concept? I keep asking this of people who make this statement because I'm genuinely interested in seeing it demonstrated as it has negative implications for me, but no one wants to spend time proving their point.

beachhead 4y ago
It'll never happen. Every single time this comes up it turns into the same thing over and over again. You must remember the person that said they'd "write a blogpost bypassing OpenBSD mitigations next week" and that's been well over a month now and, surprise, there's no blog about this. Everything OpenBSD does is wrong and trivial to bypass but everyone's too busy to do it. Maybe the dumbest part about this is that nobody on the other side of this is making claims that these mitigations are perfect in any way. Qualys has bypassed some OpenBSD malloc hardening features recently but then they don't go around making wild or insulting claims about how wrong and trivial they are either. Go figure.
- g0xA52A2A 4y ago
  Just replying to provide some context [1] for those who come across this comment as I think it's pretty interesting. Also OpenBSD are working on something for this [2]. [1] https://seclists.org/oss-sec/2023/q1/92 https://seclists.org/oss-sec/2023/q1/92 [2] https://marc.info/?l=openbsd-tech&m=167673316325935&w=2 https://marc.info/?l=openbsd-tech&m=167673316325935&w=2
  - beachhead 4y ago
    More from Qualys: https://seclists.org/oss-sec/2023/q1/109 https://seclists.org/oss-sec/2023/q1/109 More from OpenBSD: https://marc.info/?l=openbsd-tech&m=167715187212393&w=2 https://marc.info/?l=openbsd-tech&m=167715187212393&w=2
Zurrrrr 4y ago
No. It means if you look at any number of the security vulnerabilities that affected OpenBSD base system that they disclosed, or any number of bugs in third party software they haven't audieted, out of the vulns that allow root and/or rce, a lot of damage can be done on a 'secure' OpenBSD system, which something like SELinux can prevent. Lets say Apache or something had a remote root bug (despite not running as root) that granted a shell was was pretty easy to exploit. An SELinux system can protect an unkown but actively exploited bug like that more than OpenBSD can. The OpenBSD approach is just to keep looking and hope you've found every bug that would possibly allow for anything like that, and hope they've found them all.
- beachhead 4y ago
  I'm sorry, what?
  - Zurrrrr 4y ago
    Take a breath. Read it again. If you still don't understand something, think about what it is you don't understand, then state your issue clearly so I can help you.
    - beachhead 4y ago
      Nothing you wrote made any sense at all. So, explain the whole thing again, I guess?
      - Zurrrrr 4y ago
        It did make sense, so I'm guessing it's just beyond your technical level of comprehension. I'd suggest reading up more on what stuff like SELinux actually does.
        beachhead 4y ago
        Yeah it couldn't possibly be you.

beachhead 4y ago

It'll never happen. Every single time this comes up it turns into the same thing over and over again. You must remember the person that said they'd "write a blogpost bypassing OpenBSD mitigations next week" and that's been well over a month now and, surprise, there's no blog about this. Everything OpenBSD does is wrong and trivial to bypass but everyone's too busy to do it. Maybe the dumbest part about this is that nobody on the other side of this is making claims that these mitigations are perfect in any way. Qualys has bypassed some OpenBSD malloc hardening features recently but then they don't go around making wild or insulting claims about how wrong and trivial they are either. Go figure.

g0xA52A2A 4y ago
Just replying to provide some context [1] for those who come across this comment as I think it's pretty interesting. Also OpenBSD are working on something for this [2]. [1] https://seclists.org/oss-sec/2023/q1/92 https://seclists.org/oss-sec/2023/q1/92 [2] https://marc.info/?l=openbsd-tech&m=167673316325935&w=2 https://marc.info/?l=openbsd-tech&m=167673316325935&w=2
- beachhead 4y ago
  More from Qualys: https://seclists.org/oss-sec/2023/q1/109 https://seclists.org/oss-sec/2023/q1/109 More from OpenBSD: https://marc.info/?l=openbsd-tech&m=167715187212393&w=2 https://marc.info/?l=openbsd-tech&m=167715187212393&w=2

Zurrrrr 4y ago

No. It means if you look at any number of the security vulnerabilities that affected OpenBSD base system that they disclosed, or any number of bugs in third party software they haven't audieted, out of the vulns that allow root and/or rce, a lot of damage can be done on a 'secure' OpenBSD system, which something like SELinux can prevent. Lets say Apache or something had a remote root bug (despite not running as root) that granted a shell was was pretty easy to exploit. An SELinux system can protect an unkown but actively exploited bug like that more than OpenBSD can. The OpenBSD approach is just to keep looking and hope you've found every bug that would possibly allow for anything like that, and hope they've found them all.

beachhead 4y ago
I'm sorry, what?
- Zurrrrr 4y ago
  Take a breath. Read it again. If you still don't understand something, think about what it is you don't understand, then state your issue clearly so I can help you.
  - beachhead 4y ago
    Nothing you wrote made any sense at all. So, explain the whole thing again, I guess?
    - Zurrrrr 4y ago
      It did make sense, so I'm guessing it's just beyond your technical level of comprehension. I'd suggest reading up more on what stuff like SELinux actually does.
      - beachhead 4y ago
        Yeah it couldn't possibly be you.