OpenBSD Memory protection mechanisms that are not enabled by default?

Question

Besides the "S" option for malloc.conf and increasing kern.stackgap_random and removing the wxallowed mount option, what else memory-related hardening mechanism are in OpenBSD that can be turned on and it is not enabled by default?

Even options would be useful if we have to re-compile the kernel, if minimal source code modification is needed.

Usually they don't enable it because many application, exampe from ports would crash because of bad code.

Tried to get lists/ideas from grsecurity (if there is any, that is not already used in OpenBSD), but it is hard when you are not a programmer: https://grsecurity.net/features.php

Answer 1

"... what else memory-related hardening mechanism are in OpenBSD that can be turned on and it is not enabled by default?

Even options would be useful if we have to re-compile the kernel [or programs I use], if minimal source code modification is needed.".

What I dug up so far:

Always update to the latest stable version of the Kernel. Also look at http://www.trustedbsd.org/. Read references such as Wikipedia's OpenBSD security features webpage.

OpenBSD memory related security features:

• Address Space Layout Randomization (ASLR): setting the sysctl vm.randomize_mmap to 1 (should be on by default, but it's off in DragonflyBSD and apparently not implemented in FreeBSD).

• Use timingsafe_bcmp(3) and timingsafe_memcmp(3) instead of bcmp(3) or memcmp(3).

• Use the explicit_bzero(3) variant instead of bzero(3) to clear sensitive memory (like password variables).

• Position Independent Executables (PIE): Link with -pie or --pic-executable

  Create a position independent executable. This is currently only supported on ELF platforms. Position independent executables are similar to shared libraries in that they are relocated by the dynamic linker to the virtual address the OS chooses for them (which can vary between invocations). Like normal dynamically linked executables they can be executed and symbols defined in the executable cannot be overridden by shared libraries.

• Randomized mmap(2): Don't use MAP_FIXED. Check with mquery.

• Replace random(): rand(3), random(3), and rand48(3), etc. replaced with BSD's arc4random(3).

• Consider using reallocarray(3) and recallocarray(3) and freezero(3) for sensitive data instead of malloc(3), calloc(3), or realloc(3).

• Stack Smashing Protection (SSP): GCC + Propolice (SSP) activated by default to build all libraries and applications.

• KERN_STACKGAPRANDOM (kern.stackgap_random) Sets the range of the random value added to the stack pointer on each program execution. The random value is added to make buffer overflow exploitation slightly harder. The bigger the number, the harder it is to brute force this added protection, but it also means bigger waste of memory. Default: 262144.

• Use the new strlcpy(3) and strlcat(3) instead of strcpy(3), strcat(3), strncpy(3) or strncat(3) - allows safe string copies.

• Use strtonum(3) function instead of the atoi(3) and strtol(3) family of interfaces.

• W^X policy: A page may be both writable or executable, but not both. Hence W^X. The idea is to create a .rodata segment with the PROT_READ attribute only thus it loses the PROT_EXEC attribute.