2

Besides the "S" option for malloc.conf and increasing kern.stackgap_random and removing the wxallowed mount option, what else memory-related hardening mechanism are in OpenBSD that can be turned on and it is not enabled by default?

Even options would be useful if we have to re-compile the kernel, if minimal source code modification is needed.

Usually they don't enable it because many application, exampe from ports would crash because of bad code.

Tried to get lists/ideas from grsecurity (if there is any, that is not already used in OpenBSD), but it is hard when you are not a programmer: https://grsecurity.net/features.php

  • securelevel=2 man.openbsd.org/securelevel prevents non-console root from doing some nasty things. pledge man.openbsd.org/pledge is "on" by default but some programs need to incorporate it in their source code – Neil McGuigan Feb 13 '18 at 22:19
  • Thank you! Although securelevel is related to make a system more secure, it has nothing to do with memory security. Also, pledge is there by default on OpenBSD, the question was for non-default functions. – Hessnov Feb 14 '18 at 6:58
1

"... what else memory-related hardening mechanism are in OpenBSD that can be turned on and it is not enabled by default?

Even options would be useful if we have to re-compile the kernel [or programs I use], if minimal source code modification is needed.".

What I dug up so far:

Always update to the latest stable version of the Kernel. Also look at http://www.trustedbsd.org/. Read references such as Wikipedia's OpenBSD security features webpage.

OpenBSD memory related security features:

  • Address Space Layout Randomization (ASLR): setting the sysctl vm.randomize_mmap to 1 (should be on by default, but it's off in DragonflyBSD and apparently not implemented in FreeBSD).

  • Use timingsafe_bcmp(3) and timingsafe_memcmp(3) instead of bcmp(3) or memcmp(3).

  • Use the explicit_bzero(3) variant instead of bzero(3) to clear sensitive memory (like password variables).

  • Position Independent Executables (PIE): Link with -pie or --pic-executable

    Create a position independent executable. This is currently only supported on ELF platforms. Position independent executables are similar to shared libraries in that they are relocated by the dynamic linker to the virtual address the OS chooses for them (which can vary between invocations). Like normal dynamically linked executables they can be executed and symbols defined in the executable cannot be overridden by shared libraries.

  • Randomized mmap(2): Don't use MAP_FIXED. Check with mquery.

  • Replace random(): rand(3), random(3), and rand48(3), etc. replaced with BSD's arc4random(3).

  • Consider using reallocarray(3) and recallocarray(3) and freezero(3) for sensitive data instead of malloc(3), calloc(3), or realloc(3).

  • Stack Smashing Protection (SSP): GCC + Propolice (SSP) activated by default to build all libraries and applications.

  • KERN_STACKGAPRANDOM (kern.stackgap_random) Sets the range of the random value added to the stack pointer on each program execution. The random value is added to make buffer overflow exploitation slightly harder. The bigger the number, the harder it is to brute force this added protection, but it also means bigger waste of memory. Default: 262144.

  • Use the new strlcpy(3) and strlcat(3) instead of strcpy(3), strcat(3), strncpy(3) or strncat(3) - allows safe string copies.

  • Use strtonum(3) function instead of the atoi(3) and strtol(3) family of interfaces.

  • W^X policy: A page may be both writable or executable, but not both. Hence W^X. The idea is to create a .rodata segment with the PROT_READ attribute only thus it loses the PROT_EXEC attribute.

  • but the q was for memory protection besides the mentioned ones by me " that can be turned on and it is not enabled by default" - but please, please keep this great list, Thanks! – Hessnov Feb 19 '18 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.