HardenedBSD in BSDMag ....

Hi folks,

The "little something" I said while ago was the article I have written for BSDMag, explaining the goals of HardenedBSD and talking about its main feature, Address Space Layout Randomisation. For who does not wish to register, it can be viewed here ... Was a guenine pleasure to write it :-)

Another Microkernel based OS ... with DeviceAtlas

Hi folks,

As usual, the ... unusual can get my attention. So this time, it is Minix 3 (the 3.3.0, but tested previously 3.2,0 which, apparently, did not have shared library linkage support ...), which is a quite small smart Unix OS. But this one is a Micro kernel based one and it is exactly one of the reasons it is interested me in first place. So if it is a micro kernel, not surprising, that the kernel itself does not have million of lines of code but only something like 9000 ... Also, the userland is NetBSD compatible, they gave up on GGC suite; then now it is the couple LLVM/Clang.

So after charging the two Device Atlas C++ API on this VM, everything was compiled in a few seconds (Remember it is NetBSD compatible so Carrier Identification is compilable directly). Very good ! All work as expected (apache module included...), did not get the issue I had with 3.2.0 version.

Althought I would not use Minix 3 as my daily OS (alright ... its first target is the embedded world...), it is somehow an interesting and worthy one, its educational "roots" should not make you think it is a very poor Unix like (it is SMP capable, has ASLR even in the kernel part ...).

HardenedBSD, some examples

Hi folks,

For testing ASLR, I just wrote this very basic example :

#include <mtld/devatlas.h>

using namespace Mobi::Mtld;

int

main(int argc, char *argv[])

{

Da::DeviceAtlas *da = new Da::DeviceAtlas();

printf("Address of da ptr %p\n", da);

delete da;

return (0);

}

Compiled without fPIE and aslr disabled (sysctl hardening.pax.aslr.status=0).
clang++ -I/usr/local/include -L/usr/local/lib -ldevatlas -lcommon -o da-test-aslr da-test-aslr.cc
So each time it is called, it should be the same address all the time.
For example

./da-test-aslr

Address of da ptr 0x802417000

./da-test-aslr

Address of da ptr 0x802417000

...

Now let's enable ASLR and compile with PIE flag
clang++ -I/usr/local/include -L/usr/local/lib -fPIE -ldevatlas -lcommon -o da-test-aslr da-test-aslr.cc

./da-test-aslr

Address of da ptr 0x887017000

./da-test-aslr

Address of da ptr 0x86bc17000

...

Another topic ...
With the ptrace hardening feature, it is possible to allow only root and possibly via PTRACE_HARDENING_GRP kernel option enabled to allow only one specific gid to perform any kind of ptrace call. It is also possible to set ugidfw utility with ptracehdflags to disable ptrace hardening for a specific binary for example.

ugidfw add subject uid dcarlier object filesys /usr/bin/top mode rx ptracehdflags a

HardenedBSD, SEGVGUARD and other friends

Hi folks,

Again about HardenedBSD, that starts small but smoothly, we got an article on Phoronix recently which is quite nice to be honest as this website is more for Linux topics. Also I got few but usually positive feedbacks when I talk about it ...

Also recently the SEGVGUARD branch was well updated (this feature is to avoid to get attacked via malicious segmentation faults usage).

In my part, after a long night to code MAC extended support for my PTRACE hardening branch (which allows to disable/enable hardening on a particular executable for example with the new ptracehdflags ...) + I applied also the DragonflyBSD's patch for taking care of SYSRET privilege escalation issue (Matt Dillon is really an hard worker ...), I am now responsible for the whole "ptrace" topic, I ll implement for next finer grained control over this.

All of these features provide this new sysctl tree :

security.pax.aslr.*
security.pax.segvguard.*
security.ptrace.hardening.*

But that a good chance it ll change soon in more consistent way ...

Small update :

Now the sysctl tree is under the root hardening oid just created by oliver :

hardening.pax.aslr.*
hardening.pax.segvguard.*
hardening.ptrace.*

Also just added some logging in case the ptrace call is not authorised.

ASLR on FreeBSD

Hi folks.
During my free time I wanted to see the "status" of BSD and decided to dedicate an old laptop for OpenBSD. It is worthy, apart of its secure reputation, nothing fancy installed, everything is consistent and rocks solid.

The ASLR implementation is quite good and helpful to detect some "nasty" hidden bugs :-) and with MALLOC_STATS enabled (thanks Mr Moerbeek ... OpenBSD does not have Valgrind, not yet at least ...) for the memory leaks, I have all I need :-).

Then I checked the ASLR status for FreeBSD, the last BSD without it (I know FreeBSD since 2004 and I expect ASLR implementation on it since those years, while Linux has it since quite long time and it rocks solid ...). Still nothing ! But ... will be for the next 11 branch and can be set on/off not only globally but for a specific jail for example !

Awesome and quite interesting ... I am looking for it.