4 ms·
I wish someone from the FreeBSD project with authority and expertise would speak out instead of being silent when these discussions come up; a clearly communica
by feld 12y ago
I wish someone from the FreeBSD project with authority and expertise would speak out instead of being silent when these discussions come up; a clearly communicated security roadmap would be nice. I suspect there's no desire to start internet flamewars or heated discussions about FreeBSD's security situation as they're weary of the discussions.
OpenBSD pioneers a lot of security research and best practices but I think many people get misled by all the hand waving and subsequently have more faith in certain features and less knowledge. I'm a victim myself.
As an example, I recently brought up W^X and wanted to know what the status / stance was and was met with a healthy dose of skepticism. As I was told, "W^X is very useful for debugging but not for security as the kernel has a read-write 1:1 map of all physical memory... you can still write to memory that will later be executed, you just have to use a different address" (not a direct quote) This was completely new information to me that nobody seems to talk about.
Likewise when I asked about securelevel=1 -- I was met with "securelevel is more likely to be removed entirely than enabled by default ... not convincing because there's no coherent model ... easy to work around as an attacker unless the system is very, very carefully configured, which means it's locked down beyond usability for most configurations ... though it's useful for jails since you can still do maintenance from the jailhost"
tl;dr I think the FreeBSD devs who can call the shots are more interested in ASLR and pushing Capsicum hard.
- ghswa 12y agoAre you referring to discussions on their mailing lists? If so, could you link to them?
- feld 12y agoNo, it was in an IRC chat
- mlarkin 12y agoWhoever told you about that direct map "issue" didn't do their homework, and is talking out of their ass. http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/arch/amd64/amd64/locore.S?rev=1.61&content-type=text/x-cvsweb-markup http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/arch/amd64/...
- feld 12y agoThanks for the link, I'll share it. edit: would this prevent you from being able to support 1GB pages?
- mlarkin 12y agoWe don't use 1GB pages in the direct map today, and likely won't for some time. They aren't supported on all amd64 CPUs so if we decided we were interested in doing that, we'd need two types of direct map layouts, one to support CPUs that had 1GB page support and one that didn't. That seems like an awful lot of complexity for questionable gain. edit: ... and if we did decide, in the future, to take advantage of 1GB page support in the direct map, I'd probably just break out the kernel area separately and continue to map it with 2MB pages.
- feld 12y agoThanks for the reply. There's currently no support for 1GB pages in FreeBSD but someone provided a patch set that does it and has considerably improved performance for their network appliance workload. It needs to be reworked a bit before being merged, but I hope it will happen before 11-RELEASE.
- ketralnis 12y ago> There's currently no support for 1GB pages in FreeBSD but someone provided a patch set that does it Probably others, but some of the discussion: https://lists.freebsd.org/pipermail/freebsd-hackers/2014-November/046449.html https://lists.freebsd.org/pipermail/freebsd-hackers/2014-Nov...
- nailer 12y agoDo OpenBSD use CVS?
- PuercoPop 12y agoyes.
- brynet 12y agoI wouldn't be so quick to declare the work done in OpenBSD as hand-waiving, especially when the FreeBSD developers you've been talking to are just as uninformed as you are now. Feel free to point them at the link mlarkin himself has posted here.
- feld 12y agogladly will. learning is an important process. :-)