6 ms·

No, I understand absolutely. I've been playing with OpenBSD for over 20 years. My point is that OpenBSD wants to focus on trying to remove bugs as much as poss

No, I understand absolutely. I've been playing with OpenBSD for over 20 years. My point is that OpenBSD wants to focus on trying to remove bugs as much as possible, and securing the system in case a bug is exploited is very much a secondary objective. Pledge and unveil are nice, but insufficient compared to what SELinux can do, or similar systems. That's simply objectively true, regardless of if your bias towards OpenBSD will let you admit it or not. So no, my point isn't wrong, you're just possibly out of your depth in this convo. OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't.

yjftsjthsd-h 4y ago
> OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't. Alright, if we're talking about things that are objectively true, this is objectively false. They specifically go to great lengths to make it impossible to get root.
- Zurrrrr 4y ago
  It seems you didn't properly read my comment. I'm not talking about GETTING root, I'm talking about in the situation where an attacker already HAS root.
  - yjftsjthsd-h 4y ago
    You did, actually; you said that OpenBSD just "really really really hopes" that an attacker won't get root, and I pointed out that that was nonsense and that they are in fact taking measures to ensure it. Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process.
    - Zurrrrr 4y ago
      Sigh. No, I didn't. Saying OpenBSD 'really really really hopes' an attacker doesn't get root is still 100% correct. They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. > Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process. Which is where things like SELinux come in, which is my whole point.....
      - yjftsjthsd-h 4y ago
        > They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. They're absolutely dealing with that situation as well. So let's say for instance that the default OpenBSD httpd turns out to have some bug that allows an attacker to execute any arbitrary code of their choosing on the server. That's a problem, but it's hardly the end of the world. First, the server is using pledge+unveil, so it can't actually do all that much other than serving web pages. Second, even if the attacker can work within those restrictions, they're running as a completely unprivileged user, because OpenBSD is actually a great fan of defense in depth. > Which is where things like SELinux come in, which is my whole point..... If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, at which point you've just basically added a second word for root and nothing helps.
        anthk 4y ago
        Also, pledge would SIGABRT that's process under a milisecond upon trying a non-allowed syscall. So, as I said, good luck trying to call something outside pledge. Being root? You wish if you can even run something alonside the process. Because even the subprocesses from a pledged process are pledged too.
        Zurrrrr 4y ago
        If someone has remote root pledge is basically irrelevant.
  - ori_b 4y ago
    "When you've already been compromised, OpenBSD doesn't prevent you from being compromised"
    - Zurrrrr 4y ago
      Well yeah, kind of. If you consider there are levels of compromise at least. SELinux and similar frameworks do prevent further compromise. That's the point.
      - ori_b 4y ago
        By your logic elsewhere -- if you're root, you can just remove the selinux policies.
        Zurrrrr 4y ago
        You're really just showing you have no clue what you are talking about lol. That seems to be true for most of the people in this thread defending OpenBSD, as you're not the first to make the point. The reason it's wrong, the reason it's clear that you have no clue what you are talking about, is it's a basic design decision that it is not the root user that configures or removes policies. Root has no ability to do what you describe, and under SELinux is just another user. But hey, keep spouting nonsense because your feelings are hurt because you have some weird attachment to an obscure OS.
        ori_b 4y ago
        If you believe that there's a way to become root, why don't you believe there's a way to become some other non-root user? Possibly by using the same exploit you'd use to get root, or possibly by using the permissions root has?
        Zurrrrr 4y ago
        I'm not being smug or insulting when I ask this, but are you familiar with SELinux at all, or have you administered any systems? > If you believe that there's a way to become root, why don't you believe there's a way to become some other non-root user? SELinux maintains it's own set of users that map to unix user. SELinux users have their own roles and capabilities that are very granular. It's frequently configured to make root 'just another user' as much as possible, and remove any access root doesn't need. So if you 'get root' on a properly configured SELinux system, you don't actually 'have root', you just have a user with a user id of 0 but no real access. You can switch to whatever user administers SELinux policies, but you will only be switching in the unix sense, not the SELinux sense, so you won't actually be able to do anything. To do what you are suggesting would require a kernel exploit, but even if you get root you won't have any access to run it. What you suggest simply is not possible barring very specific vulnerabilities being found, which afaik, have not been.
stonogo 4y ago
I don't know why you're acting like anyone actually uses SELinux the way you are describing it. It's notoriously a pain in the ass to configure any meaningful system-level protection from root accounts, to the degree that most deployments who bother at all only protect one or two directories. Even then SELinux is such a bolted-on mess that it's still subject to evil maid attacks and so forth. And you're wrong about OpenBSD. I'm not going to get as angry about this as you appear to be, but I recommend you run "man 7 securelevel" on one of the OpenBSD systems you've been playing with for 20 years.
- Zurrrrr 4y ago
  You're very wrong about SELinux and I assume haven't touched it in years. It's enabled by default in Fedora, other distros use it as well, and it really isn't at all that big a deal to learn and configure proportional to the benefit. I'm not remotely wrong about OpenBSD, and that manpage doesn't contain anything that contradicts a point I've made.
  - stonogo 4y ago
    I administer thousands of selinux boxes professionally. I, like the vast majority of Earth's population, remain steadfastly uninterested in Fedora's default behavior. You claim that OpenBSD has no conpromised-root mitigation. I have provided evidence to back my counterclaim. I will assume your rejection of actual evidence indicates a disinterest in good-faith argument, so I won't bother pressing the point, except to mention that you may be more successful persuading people to support your case if you adopt a reality-based approach to argument instead of just making wild-ass assumptions about other people.
    - Zurrrrr 4y ago
      You haven't provided evidence at all, that's the thing. You're either wrong or misunderstanding something.

yjftsjthsd-h 4y ago

> OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't. Alright, if we're talking about things that are objectively true, this is objectively false. They specifically go to great lengths to make it impossible to get root.

Zurrrrr 4y ago
It seems you didn't properly read my comment. I'm not talking about GETTING root, I'm talking about in the situation where an attacker already HAS root.
- yjftsjthsd-h 4y ago
  You did, actually; you said that OpenBSD just "really really really hopes" that an attacker won't get root, and I pointed out that that was nonsense and that they are in fact taking measures to ensure it. Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process.
  - Zurrrrr 4y ago
    Sigh. No, I didn't. Saying OpenBSD 'really really really hopes' an attacker doesn't get root is still 100% correct. They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. > Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process. Which is where things like SELinux come in, which is my whole point.....
    - yjftsjthsd-h 4y ago
      > They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. They're absolutely dealing with that situation as well. So let's say for instance that the default OpenBSD httpd turns out to have some bug that allows an attacker to execute any arbitrary code of their choosing on the server. That's a problem, but it's hardly the end of the world. First, the server is using pledge+unveil, so it can't actually do all that much other than serving web pages. Second, even if the attacker can work within those restrictions, they're running as a completely unprivileged user, because OpenBSD is actually a great fan of defense in depth. > Which is where things like SELinux come in, which is my whole point..... If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, at which point you've just basically added a second word for root and nothing helps.
      - anthk 4y ago
        Also, pledge would SIGABRT that's process under a milisecond upon trying a non-allowed syscall. So, as I said, good luck trying to call something outside pledge. Being root? You wish if you can even run something alonside the process. Because even the subprocesses from a pledged process are pledged too.
        Zurrrrr 4y ago
        If someone has remote root pledge is basically irrelevant.
- ori_b 4y ago
  "When you've already been compromised, OpenBSD doesn't prevent you from being compromised"
  - Zurrrrr 4y ago
    Well yeah, kind of. If you consider there are levels of compromise at least. SELinux and similar frameworks do prevent further compromise. That's the point.
    - ori_b 4y ago
      By your logic elsewhere -- if you're root, you can just remove the selinux policies.
      - Zurrrrr 4y ago
        You're really just showing you have no clue what you are talking about lol. That seems to be true for most of the people in this thread defending OpenBSD, as you're not the first to make the point. The reason it's wrong, the reason it's clear that you have no clue what you are talking about, is it's a basic design decision that it is not the root user that configures or removes policies. Root has no ability to do what you describe, and under SELinux is just another user. But hey, keep spouting nonsense because your feelings are hurt because you have some weird attachment to an obscure OS.
        ori_b 4y ago
        If you believe that there's a way to become root, why don't you believe there's a way to become some other non-root user? Possibly by using the same exploit you'd use to get root, or possibly by using the permissions root has?
        Zurrrrr 4y ago
        I'm not being smug or insulting when I ask this, but are you familiar with SELinux at all, or have you administered any systems? > If you believe that there's a way to become root, why don't you believe there's a way to become some other non-root user? SELinux maintains it's own set of users that map to unix user. SELinux users have their own roles and capabilities that are very granular. It's frequently configured to make root 'just another user' as much as possible, and remove any access root doesn't need. So if you 'get root' on a properly configured SELinux system, you don't actually 'have root', you just have a user with a user id of 0 but no real access. You can switch to whatever user administers SELinux policies, but you will only be switching in the unix sense, not the SELinux sense, so you won't actually be able to do anything. To do what you are suggesting would require a kernel exploit, but even if you get root you won't have any access to run it. What you suggest simply is not possible barring very specific vulnerabilities being found, which afaik, have not been.

stonogo 4y ago

I don't know why you're acting like anyone actually uses SELinux the way you are describing it. It's notoriously a pain in the ass to configure any meaningful system-level protection from root accounts, to the degree that most deployments who bother at all only protect one or two directories. Even then SELinux is such a bolted-on mess that it's still subject to evil maid attacks and so forth. And you're wrong about OpenBSD. I'm not going to get as angry about this as you appear to be, but I recommend you run "man 7 securelevel" on one of the OpenBSD systems you've been playing with for 20 years.

Zurrrrr 4y ago
You're very wrong about SELinux and I assume haven't touched it in years. It's enabled by default in Fedora, other distros use it as well, and it really isn't at all that big a deal to learn and configure proportional to the benefit. I'm not remotely wrong about OpenBSD, and that manpage doesn't contain anything that contradicts a point I've made.
- stonogo 4y ago
  I administer thousands of selinux boxes professionally. I, like the vast majority of Earth's population, remain steadfastly uninterested in Fedora's default behavior. You claim that OpenBSD has no conpromised-root mitigation. I have provided evidence to back my counterclaim. I will assume your rejection of actual evidence indicates a disinterest in good-faith argument, so I won't bother pressing the point, except to mention that you may be more successful persuading people to support your case if you adopt a reality-based approach to argument instead of just making wild-ass assumptions about other people.
  - Zurrrrr 4y ago
    You haven't provided evidence at all, that's the thing. You're either wrong or misunderstanding something.