19 ms·
OpenBSD Innovations
- commandersaki 2y agoReally surprised that pledge / unveil isn't featured more prominently on this page.
- aomix 2y agoEverything I've read about pledge and unveil really admire the approach and the results but it didn't seem to have a big impact outside of OpenBSD. It took ~20 years for OpenBSD's CSPRNG to be re-implemented everywhere else maybe we're operating on a similar timeline here.
- hellcow 2y agohttps://justine.lol/pledge/ https://justine.lol/pledge/ While not the same, this is a SECCOMP-based Linux alternative (and it can even be used to restrict pre-compiled binaries).
- eyberg 2y agoWe definitely took inspiration and implemented in the nanos unikernel cause we think it's a great idea: https://nanovms.com/dev/tutorials/applying-sandbox-security-node-js-unikernels-openbsd-pledge-unveil https://nanovms.com/dev/tutorials/applying-sandbox-security-...
- saagarjha 2y agoThis is generally how modern systems do sandboxing.
- ajb 2y agoWell, it's in date order. But they could do with a line or so of explanation
- wint3rmute 2y agoMaybe I'm not getting something here, but I find the pledge/unveil approach confusing. Why should I expect a program to set allowed syscalls/filesystem paths? Why would I trust that it will set itself the right permissions? What is allowed should be set externally from the program, similarly how I can map filesystem volumes and add capabilities to a Docker container [1]. I'm not familiar with BSD and I only used it a couple times out of curiosity. What am I missing? [1] https://docs.docker.com/engine/security/#linux-kernel-capabilities https://docs.docker.com/engine/security/#linux-kernel-capabi...
- somat 2y agoThe threat vector is not that you don't trust the program, pledge/unveil is completely unsuitable for that. but that you worry the program will be compromised while it is running. so the observation is that programs tend to have a startup state where they need access to files and a run state where they don't. so pledge/unveil is a mechanism for a program to inform the os that it no longer needs access to files/syscalls and any future access should be considered a hostile takeover. please kill me.
- IcePic 2y ago> Why should I expect a program to set allowed syscalls/filesystem paths? Why would I trust that it will set itself the right permissions? Because the admin or owner will know FAR less about what a complex program needs at all times, and when it will be safe to drop privs. A database might be tested for a week and then it has a special snapshot thing done for the monthly backup and you did not foresee this, whereas the coders would know what perms are needed in order to do these dumps. Hence, you can't set perms just once before starting, and as a user of said software, you can't expect to just make a quick test and then design a fully working harness for it either.
- tptacek 2y agoA phenomenal resource on the same subject: https://isopenbsdsecu.re/mitigations/ https://isopenbsdsecu.re/mitigations/
- i80and 2y agoI like this -- despite the clown nose logo, it's actually fair to my eye and is respectful to parts of OpenBSD that are thoughtfully designed.
- chicom_malware 2y agoOpenBSD is thoughtfully designed because it is one of the best examples of "design by dictator" (Theo) - and a small core team - as opposed to design by committee like every other OS out there. Look me in the eye and tell me 90% of changes and unnecessary features in macOS aren't there because some team needs to justify their existence.
- arp242 2y agoI assume you meant to write "disrespectful"?
- i80and 2y agoWhile much of this document is openly disdainful, there are areas like the malloc implementation[1] and features like the atexit hardening[2] where OpenBSD is unambiguously excellent, and it says as much, noting that the latter is a "pretty cool mitigation". I used to do some OpenBSD ports work, and even got a tiny patch into the base system. I love OpenBSD! I don't have an axe to grind here! But it is not above reproach, and I think this site is overall harsh but fair. [1]: https://isopenbsdsecu.re/mitigations/malloc/ https://isopenbsdsecu.re/mitigations/malloc/ [2]: https://isopenbsdsecu.re/mitigations/atexit_hardening/ https://isopenbsdsecu.re/mitigations/atexit_hardening/
- ardupper 2y agoThanks for posting this, I think in our industry provenance is an underrated piece of knowledge.
- bradley_taunt 2y agoAlso a great resource: https://why-openbsd.rocks/ https://why-openbsd.rocks/
- avodonosov 2y agoIs OpenBSD suitable for daily use on a laptop? Does anyone have such experience? Is it ok?
- hoppp 2y agoYes but depends on the laptop.
- myaccountonhn 2y agoIt works quite well. The OOB experience is very complete and hardware gets picked up without issue. However you’re limited in the amount of apps and it’s also incredibly slow, so you’ll need to really use minimal, fast cli apps. I left it ultimately because it had way worse battery life than Linux on my T480s and I also wanted to play some games with steam.
- jmclnx 2y agoOpenBSD foundation raised around ~380 thousand IIRC. By creating OpenSSH and the fact all fortune 500 companies use it, I would say every year, the foundation should be bringing in around 1 or 2 million. It is time these companies really give back. And while I am here, hardware vendors should open up their source, looking directly an Nvidia.
- olddustytrail 2y agoThey could easily raise a few million if they bothered working on sales, but they don't.
- dbtc 2y agoa) they shouldn't have to b) part of what makes it great is that they don't
- hoppp 2y agoIts not really a for profit project and I prefer it stays that way. Projects that raise money tend to get "corrupted" by the greed. Not that there is anything wrong with raising money, but the ideology behind openBSD don't really fit if they go for profit
- renewiltord 2y agoThey have a sales team of online enthusiasts who work for free. Unfortunately, they got what they paid for.
- fc417fc802 2y ago> Unfortunately, they got what they paid for. Industry wide adoption?
- renewiltord 2y agoWe’re happy; they’re happy. But the sales team works on commission.
- brynet 2y agoIn addition to work pioneering privdrop/privsep design for network daemons, and the almost ubiquitous adoption of pledge(2)/unveil(2) across the base system, I think people are missing out on much more recent mitigation work, such as mimmutable (which Linux is just beginning to land with mseal), on OpenBSD, most of a programs static address space (.text/ld.so's .text/.bss/main stack) is now automatically immutable. There's also execute-only memory and BTI/IBT on modern Intel/AMD, and ARM machines, enabled by default. Including a significant amount of ports development work to make the larger software ecosystem ready for this.
- saagarjha 2y agoExecute-only memory on ARM is a footgun (bypasses PAN); Linux and macOS both block it. OpenBSD probably should too.
- brynet 2y agoWhy? OpenBSD seems to think execute-only in userland is important. We've had SMAP on x86 for many years, it helped fixed bugs early, these bugs are rare now, so why is everyone concerned about kernel accesses that aren't using copyin(9)? EPAN is already supported, hardware is now arriving, it's used if available, but the idea that execute-only was less important than PAN was probably misguided.
- saagarjha 2y agoIf you have EAN feel free to turn it back on but I generally believe that execute-only is less important than PAN, yes.
- crest 2y agoHow does execute only memory disable privileged access never memory? The bigger problem I expect is the overhead of loosing PC-relative loads unless the hardware still allows these as instruction fetching related? Would you have to dedicated one of your 31 GPRs as the table of contents pointer similar to PowerPC’s ABI (e.g. sizeof(void()(void)) == 2sizeof(void *))?
- eru 2y ago> Random-data memory: the ability to specify that a variable should be initialized at load time with random byte values (placed into a new ELF .openbsd.randomdata section) was implemented in OpenBSD 5.3 by Matthew Dempsky. What's the use case for this? EDIT: further down is one example: > RETGUARD is a replacement for the stack-protector which uses a per-function random cookie (located in the read-only ELF .openbsd.randomdata section) to consistency-check the return address on the stack. Implemented for amd64 and arm64 by Todd Mortimer in OpenBSD 6.4, for mips64 in OpenBSD 6.7, and powerpc/powerpc64 in OpenBSD 6.9. amd64 system call stubs also protected in OpenBSD 7.3.
- ephaeton 2y agoI suppose: Sometimes things work fine with the implicit default value that you end up with. So this will cause problems when you forget to initialize values to expected sane defaults.
- brynet 2y agohttps://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/libexec/ld.so/SPECS.randomdata https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/lib... Many things, retguard uses this for per-function random cookies, for instance. The bootloader uses this mechanism to pass data to the kernel. https://www.openbsd.org/papers/hackfest2014-arc4random/mgp00020.html https://www.openbsd.org/papers/hackfest2014-arc4random/mgp00...
- ndesaulniers 2y agoI would imagine that the use of uninitialized locals could no longer be deterministically used to exploit a program.
- Joker_vD 2y agoPerhaps one day the OpenBSD folks will figure out how to completely prevent user programs from making syscalls. It seems they are mostly there but still not quite. Please don't mention WASM in your replies.
- ori_b 2y agoIt's rather hard to do anything useful if you disable i/o.
- Joker_vD 2y agoPrecisely! And yet they make it really hard for my shellcode to do anything useful for some reason, ugh.
- ori_b 2y agoSince the only way a program like that would be interacting with the environment via a side channel, it'd be equivalent to not running the code at all. As a result, you can disable all syscalls for your program with one simple request: 'exit()'
- j16sdiz 2y agoPrinting hello world is a syscall - you need that to write to STDOUT . There are alternative to syscall. For example, writing to shared memory. Shared memory as IPC is hard. And you need some syscall to set the memory up.. .
- yjftsjthsd-h 2y agoAre you referring to their only allowing syscalls from libc? Because AFAIK that's fully functional already? Or if you're trying to solve a problem, what are you doing that pledge() doesn't cover? For that matter WASM.... would do that, so why not use it?
- yapyap 2y agowow, 25+ years later and ipv6 is still not fully integrated
- eqvinox 2y agoHave they implemented ISO C11 _Thread_local yet? It's been the number one annoyance¹ with porting software to OpenBSD. It is (was?) the only mainline OS without support for native thread-local storage. ¹ e.g. https://github.com/FRRouting/frr/blob/3f290c97e8325bd9db9363b60e4a42ba8bdca90b/lib/zlog.c#L183-L224 https://github.com/FRRouting/frr/blob/3f290c97e8325bd9db9363...
- p_ing 2y agocarp is one of my favorite things to come out of OpenBSD. It's awesome combined with HAProxy. I really enjoyed managing that system.
- sillywalk 2y agoI also like OpenBSD's release art/songs. "Hello, I'd like to by a CARP license please."[0] [0] https://www.openbsd.org/lyrics.html#35 https://www.openbsd.org/lyrics.html#35
- ksec 2y agoI wonder if we could get router based on OpenBSD.
- alpn 2y agoyes we can - https://www.openbsd.org/faq/pf/example1.html https://www.openbsd.org/faq/pf/example1.html
- jamal-kumar 2y agoIt does the job great with the default install as long as you're comfortable with the console but if you're talking something with a web interface like what pfsense/opnsense on freebsd, there was one out of Sweden I think it was for a while that fizzled out called securityrouter. Nowadays these are what I've seen (But not tested): https://github.com/sonertari/PFFW https://github.com/sonertari/PFFW https://github.com/sonertari/UTMFW https://github.com/sonertari/UTMFW
- kQq9oHeAz6wLLS 2y agoI use OpenBSD as my router and have for years. Works great.
- muppetman 2y agoA LOT of those innovations were first present in grsecurity/PaX. Back when it was freely available to everyone as well. I guess the arguments is the OpenBSD has them by default with needing a 3rd party patch, that's why they're claiming them as their innovations?
- kennysoona 2y agoYup! The idea behind Pledge/Unveil was first in Landlock also. > that's why they're claiming them as their innovations? I think they are just listing their specific implementations as innovations, their particular approach. Too many of what they list was definitely not an original idea, so they can't possible be suggesting otherwise. At least, I would hope not.
- ori_b 2y ago> Yup! The idea behind Pledge/Unveil was first in Landlock also. Landlock was released in Linux 5.13, in 2021. Pledge was released in OpenBSD 5.9, in 2016. As far as I'm aware, Pledge is the first of its kind.
- kennysoona 2y agoLinux 5.13 was the first kernel release with Landlock incorporated, but the Landlock project is from 2016 also. I found the announcement email for Landlock posted to the lkml[1] where the author compares the project to Pledge. There's also his talk[2] from 2016 if you're interested. I was certain landlock predated pledge, as I thought the website or earliest talk was from late 2015, but I am less certain now, indeed I seem to have been wrong in my claim. As for either being the first, at the very least Seatbelt from Apple has a paper dated 2011[3] and was released with macOS 10.5. [1] https://lwn.net/Articles/700607/ https://lwn.net/Articles/700607/ [2] https://archives.kernel-recipes.org/document/landlock-lsm-unprivileged-sandboxing/ https://archives.kernel-recipes.org/document/landlock-lsm-un... [3] https://www.ise.io/wp-content/uploads/2017/07/apple-sandbox.pdf https://www.ise.io/wp-content/uploads/2017/07/apple-sandbox....
- gtirloni 2y agoIncredible. I wonder what's the debugging experience for userland developers with all these security features enabled (especially the memory randomization ones).
- bentley 2y agoMy general experience has been that it’s great at turning rare crashes into frequent crashes, which are much easier to fix.
- fc417fc802 2y agoCan't you launch the debugger as root and attach to the process? Which is to say, I'd expect the experience to be approximately the same. Alternatively, debug in a VM where the security features are disabled. > especially the memory randomization ones I have never once relied on memory addresses being reproducible between program runs. In an era of ASLR that seems like a really bad plan. Plus multithreading breaks that for malloc'd stuff anyway.
- sidkshatriya 2y agoI am guaranteed to get grief on this but an anti-Innovation in OpenBSD (so obsessed it is about security) is to use an unsafe language like C everywhere in kernel and user space. The implementation of OpenBSD predates many safer systems languages but I think OpenBSD should now start moving to a checked variant of C or a safer language like Rust/OCaml/Odin/Zig/Something else. The conversion can start with some OpenBSD user space programs. I notice a steady stream of C related security fixes in the OpenBSD changelog. Many of these could have been probably avoided if the implementation language was more “safe” by default. I doubt that this is going to happen but I think it is fair to point out that using C does give you some additional security headaches by default.
- chicom_malware 2y agoTheo has addressed this directly. I cannot find the video at the moment - it is somewhere on YouTube - but his response essentially is okay, so where is 'cat'? Where is 'grep'? Where is Korn Shell? Everyone is busy jumping up and down and bitching about reinventing the wheel in Rust but no one has even taken the time to rewrite the simplest of Unix tools in Rust. Not to mention OpenBSD has a rule that "base builds base" and the Rust compiler is a bloated monster that would fail that most basic task. So where is the benefit?
- fc417fc802 2y agoThe worst part is when you come across something advertised as a replacement and it does something like 80% to 90% of what the original does with a WONTFIX for the rest. That can certainly be a valid choice in some cases, but for core tooling it's not realistic to expect widespread replacement to happen in that scenario.
- ptman 2y agohttps://github.com/uutils/coreutils https://github.com/uutils/coreutils Parent wasn't about rust specifically. Just something safer than C
- oguz-ismail 2y ago
- alberth 2y agoDoes OpenBSD still have a giant lock? Genuinely curious, and it’s been years since I’ve looked at it.
- saagarjha 2y agoI still see spl references so I think so?
- daneel_w 2y agoMost of that is gone and the performance upswing is very noticable. A little bit of work remains.
- alberth 2y ago> It turns out that all the OpenBSD locks boiled down to a global netlock rw lock for the entire IPv4/IPv6 stack. I guess addressing the network stack is work that still remains? https://news.ycombinator.com/item?id=40076376 https://news.ycombinator.com/item?id=40076376
- daneel_w 2y agoA lot of the network stack has been unlocked (and parallelized) already. There are probably a few bits left to untangle in there. In my own experience, depending on what driver/MAC is used, the network performance has on average doubled in the last two years.
- IcePic 2y agoIt has, and it is used less and less. Not sure if any OS never does it anywhere, but the important part is to remove it from all "hot paths", not to remove it where its not relevant. Can't say if they still do, but FreeBSD for the longest time used to list the floppy driver being one of the modules using GiantLock and that was a problem for what I guess was about zero people. But if one asks fbsd devs if they still have it, they would have to answer yes, even if the rest of the OS runs super great without locks anywhere else, so the binary question of "is there somewhere something that for some time could possibly call the giant lock" isn't very interesting, but rather "will it do it for the tasks I imagine I will run on my machine?" and that would have to be a more fine-grained question with some research, just like the locks in the kernels are getting more and more fine-grained.
- snvzz 2y agoI am hopeful for got (game of trees). OpenBSD still uses CVS, and I suspect its development will benefit greatly (actually accelerate) from the switch, once it eventually happens.
- snvzz 2y agoIt also leads the BSDs in RISC-V support.
- hackernoops 2y agoBig respect to OpenBSD. Now all it needs is a FS with ZFS's core capabilities and it'll be almost perfect.
- agent327 2y agoPosition-Independent Executables (and ASLR) were used by AmigaOS back in 1985. It had to, since the Amiga lacked an MMU, and had very little memory, so anything that was loaded had to be placed at whatever ram was available. It didn't need the executable to end up in a single block either, every individual section could end up in a different location. Compilers produced large numbers of sections to facilitate this process.
- amiga386 2y agoThat's not what's meant by PIE though. It means the code can appear at any address and still be valid. Amigas could, of course, have position-independent code. Use BSR and BRA rather than JSR and JMP; use LEA label(pc),A0 / MOVE.L (A0),D0 instead of MOVE.L label,D0 .. but the limits for PC-relative addressing are +/- 32k so you need to get creative to reach code or data further than that. More commonly, Amiga executables had relocs, a list of fixups to apply. The code on disk in each hunk was written as if all hunks were loaded at address 0. There was then a list of relocations at the end of each hunk, saying what offsets in that hunk need the base address of another hunk (including themselves) added there, to fixup the absolute address reference. This is relocatable code, but not position independent code. If I used an MMU to make that relocated code appear at another address, all its absolute addressing would be wrong at that new address. Position-independent code can be shared by multiple proceeses, and appear anywhere in their address space, while only existing once in memory
- Joker_vD 2y agoWell, PIC, as it commonly is done nowadays (via PC-relative addressing), requires the static/global data it references to be postioned at very specific offset from it. Which prohibits one not only from e.g. putting in 16 GiB away (why would you actually want this?) but also from having unduly large code modules — x64 only provides ±2GiB for PC-relative addressing so you'd have to use some sort of indirection scheme anyhow.
- IcePic 2y agoWell, resident programs (actual Pure residents in AmigaOS) would be like PIE, though that came a bit later, and gave the same effect, several programs could run the same code with different set of registers, and all data was pointed to by registers and no globals.
- Alifatisk 2y agoFor someone who’s interested in getting into any *BSD, which should I go with? OpenBSD or FreeBSD?
- bell-cot 2y agoWhat's your use case? (FWIW, there several other *BSD's.)
- Alifatisk 2y agoI don't have any specific use case yet, I'm planning on having a little server at home. Things I'll use it for is hosting small apps, local dns server, monitor our LAN and maybe act as a host for multiplayer games.
- p_ing 2y agoWhat games? Few multiplayer servers, if any, would run natively on a BSD. Unless you're spinning up a MUD.
- homebrewer 2y ago
- bell-cot 2y agoFor those interested in actually supporting some of this work: https://www.openbsdfoundation.org/donations.html https://www.openbsdfoundation.org/donations.html https://www.openbsd.org/donations.html https://www.openbsd.org/donations.html
- teddyh 2y ago> This is a list of software and ideas developed or maintained by the OpenBSD project (Emphasis mine.)
- YesThatTom2 2y agoJohn Ioannidis (first name on the list… IPsec) passed away a few weeks ago and almost nobody noticed. I attended a memorial on Zoom and people said he also created the building blocks that permitted Mobile IP (IP on your cell phone) to work.
- StatsAreFun 2y agoOh wow, I was not aware of his passing! Thank you for sharing that information. RIP John :(
- mmooss 2y agoThank you for letting us know. Have you tried to submit something for the front page? If you knew John, then my condolences. We're all using the things he built, every day.
- knorker 2y agoW^X is only true in an extremely narrow sense. They said they were first, and that it cannot be done on x86. Which was a surprise to me, having run it on multiple Linux architectures, including x86, for years with PaX or grsec. Then I guessed they looked around, and saw oh we can do it on x86 too, the pax way.
- arnejenssen 2y agoOff topic: I'm wondering why OpenBSD pages (and many "*ux") just uses basic HTML with no styling or CSS? Typography matters for readability. For the minimum get a decent line height and limit the line length to 60-ish characters. Are OpenBSD not taking (potential) users seriously? User experience matters, and the readability of the docs is part of the UX. (sorry for the rant)
- gkbrk 2y agoThat page uses CSS though. Maybe we're looking at different view-sources. And for readability I already have my browser set up with my favorite fonts and font sizes and background/foreground colors. How can I expect every website to guess my preferences perfectly, as opposed to all the other people with different preferences. So I just set it up one time in the browser UI and it just works everywhere. If a user is not able to navigate a font/color selection UI but wants to give technical advice to the OpenBSD team, I think it's that user not taking OpenBSD developers seriously.
- quotemstr 2y agoYet they can't manage a unified page cache like every other OS on the planet? I'll be more receptive to the concept of OpenBSD innovating when their virtual memory subsystem gets over Reagan leaving office.
- ZevsVultAveHera 2y agoThey forget to list The0's comebacks
- astrostl 2y ago* Best man pages ever