FreeBSD 11

Hi folks,

Real followers of FreeBSD know already that despite FreeBSD 11 is not yet officially released, it is somehow available already for the impatients ;-) Well, speaking on this, due to the difference of pace with OpenBSD, the impression is pretty different. Indeed, I contributed in quite small amount back then circa 2014/2015 especially when I was into HardenedBSD (which I wish very good luck, no doubt they are successful), the difference with the now previous branch is quite enormous as you can see. In my side, I already look forward FreeBSD 12 :-) ...

For OpenBSD, a lot of work are done to push clang in base, mainly modifying the codebase to make it compilable with both gcc and clang, that might be all ready for 6.1 ? We ll see ... Apart of this, I continue my usual work, I plan to update jack(audio) and openal although other OpenBSD folks are very busy right now that might not happen too soon ;-) Ah and a small bunch of fixes were pushed to the next release of xserver, which I honestly did not expect to happen :-)

OpenSSH discovery

Hi folks,

Recently, I overlooked a small project from Matt Dillon, basically protecting OpenSSH servers from Man of the middle attacks from clients. So sshlockout were born ! He confirmed to me slightly later it was more a kind of "proof of concept" rather than a guenine project. I decided in my side to use a completely different approach and to implement a mitigation against those attacks in OpenSSH directly. My base os was OpenBSD and the idea is to use Packet Filter tables. Indeed, if an ip address has too many failed authentication, it is pushed in "quarantine", every further attempts to connect to the server are blocked, the packet are dropped by PF ... Some new SSH parameters are added, FailedLoginsGard to turn it on/off and FailedLoginsThreshold for the amount of failures (max_authtries / 2 per default) ... Not yet finished but was able already to block some test ip addresses. Later, will be useful to make it more portable ... FreebSD/IPFW2 ? Linux/Netfilter ? Will see ...

For HardenedBSD, was studying the OpenSSL library replacement by LibreSSL. Had successfully did the code replacement but FreeBSD still uses OpenSSL in base and update it and as the code is quite different (LibreSSL is less "hacky" and more readable), some git conflicts occur ... Solving those git conflicts by bringing back OpenSSL's code logic in LibreSSL won't bring any good for sure ... Somehow, lately some FreeBSD people begin to consider switching to LibreSSL, so hopefully will be able to see it on base in the future !

And to conclude this 2014 year ...

Hi folks,

In right time, the new BSDMag issue arrived. It contains many well written and interesting topics ... Dtrace, Python tips and my article about HardenedBSD, focused this time on my contributions mainly. Even if I am less "stunned" than with the first article, it is still amazing to me to appear in this excellent magazine. As always, was a great pleasure to write it.

So, I wish you the best for the following 2015 year ;-)

Stack smashing protection by default on FreeBSD and other things ...

Hi folks,

Recently, the Stack Smashing Protection is enabled by default in ports, hence -fstack-protector flag is added which protects against stack buffer overflow (This feature is by default on OpenBSD since ... 12 years). So, concretally, what is the purpose ? Let's try by an example ... with our C wrapper for change ;-)

#include <mtld/devatlas-c.h>
#include <stdio.h>
int
main(int argc, char *argv[])
{
       mobi_devatlas *atlas;
       mobi_devatlas_ctx *ctx;
       mobi_http_header headers[1] = { 0 };
       char buf[10];
       printf("Please enter an user agent:\n");
       /* Bad idea !! but this is just for the sake of the example */
       gets(buf);
       atlas = mobi_mtld_da_init(NULL);
       if (atlas != NULL)
       {
               headers[0].name = "user-agent";
               headers[0].value = buf;
               ctx = mobi_mtld_da_ctx_init(atlas, NULL, headers, 1, NULL);
               ... etc ...
       }
}

In first glance, that looks good. Sure. But what if the user type more than 10 characters ? Buffer overflow. gets does not perform any boundaries checking ...
In that case, with this stack protection flag, you can get this kind of message "stack overflow detected" then the program aborts ... One detail ... that does NOT protect for attacks in the heap.

About HardenedBSD, I added recently my second syscall, getdtablecount which gives you the number of file descriptors open by the current process, that comes from OpenBSD (Linux has a similar function I think with a different name...) so hopefully the maintainer of the FreeBSD relayd port (load balancer from OpenBSD), for example, can find usefulness ... indeed OpenBSD version uses this to protect against Dos attacks. Unluckily, another syscall, ppoll (I think the Linux emulation layer needs this ...) arrived the same time, so we got some conflicts with syscalls ids on git at some point :-)

Working on both OpenBSD and FreeBSD is a great advantage for me as if I need to port something, it is quite fast in general !

Ah another small detail, my port of arc4random is merged in master branch :-)

Outside of pure technical topics, Shawn Webb began to get our development servers and began to play with Jenkins (which, honestly, I find it much better than I thought...). Now that he wants to take care of HardenedBSD communication, I prefer to let him speaks about what he and Oliver do specifically and the "biggest picture" as well ... But you can be sure they have numerous great ideas to add ;-)

HardenedBSD in BSDMag ....

Hi folks,

The "little something" I said while ago was the article I have written for BSDMag, explaining the goals of HardenedBSD and talking about its main feature, Address Space Layout Randomisation. For who does not wish to register, it can be viewed here ... Was a guenine pleasure to write it :-)

PIC my PIE

Hi folks,

Quite a lot of events happen since the last time. some awesome features mostly done by Shawn and Oliver like a mprotect protection which blocks a memory area to be set as executable if, it in first place, it was not set this way. An official Intel SMAP support was added lately. In my side, what I mentioned previously, arc4random (kernel and userland) updates (chacha 20 + minherit new flag INHERIT_ZERO) then adding getentropy syscall are done and merged. Plus, at the moment, I continue the work started by Shawn about the integration of PIC (Position Independant Code) on some libraries and PIE (Position Independant Executable) in a subset of binaries (let's say the most popular attack targets) ... for a start, rather than to apply it widely. The discussion about it started already on arch@ and it goes not badly ... The hope is, for sure, to push it upstream. Few of my under/overflow fixes on base were pushed (like sysctl) for last ...

As many of my fellows, I eat my own "dog food", hence I have a guenine laptop which runs HardenedBSD (and not only in a VM ;-)) daily, ... was important, for example, to test arc4random (used for so many things like creating processes id ...) widely by provoking many events ... compiling ... launching various daemons etc etc ... during hours.

Apart of pure technical topics, Shawn was able to desposit HardenedBSD and it is mentioned in FreeBSD Quaterly report ... Once ASLR is pushed upstream other security features would be as well ... Nice ! it is getting concrete :-)

For next, some features and fixes are planned. Plus a little something in my side ... hopefully ;-)

Bugs, bugs, bugs ...

Hi folks,

I m awaiting the great talk Shawn Webb will give this week end, I ll watch it once available for sure.
Meanwhile, things evolve smoothly for HardenedBSD, some FreeBSD are looking at it with interest, Oliver works hard to make Pax features better. In my side, I am still taking care of bugs in my own branch, some will be pushed upstream (one is already anyway ...), while I deal with more and more FreeBSD commiters, even more generally with other BSD people as well. I particularly like productive exchanges like this instead of making "flamewars" to each other.
There is no point and this is not interesting at all ;-)
This is quite good to get known with people I knew only via articles and such :-)

For last I wanted particularly thank Sean Bruno and Pedro Giffuni for their efforts.

EuroBSDcon and other things

Hi folks,

The EuroBSDcon 2014 is very close now and will bring many interesting topics like running NetBSD  as rump kernel, the LLDB debugger as first class stuff and so on ... Ah also, Shawn will talk about HardenedBSD the 28th :-)

Meanwhile Oliver is planning to implement various PAX features and other things. In my side,  I still work both on userlandenhanced and ptrace stuff. Apart of that I plan to test Hadoop with FreeBSD's fuse implementation and as the API version is quite old (only 2.7 while Linux is 2.9.3), I'll see if I can update it myself :-) never worked on Filesystems topic before but why not after all.

HardenedBSD slight updates

Hi folks,

I am still a new bee in FreeBSD development, Oliver and Shawn still give me good advices to do things better. Still thanks to them ;-). Somehow was able to make progress in the userlandenhanced branch, made the necessary strtonum optimisation (first time I touch something in the libc, although strtonum is not standard ... Around 5% of performance gain, the important thing is to avoid breaking reentrancy and such ...), hence uses it in more utilities instead of the legacy atoi. Also I was trying to solve some bugs (like segfault with BSDgrep, I hope Gabor will be happy with it :-)).

Apart of this branch, all of these are available too with all other amazing features from Shawn and Oliver in the unstable branch.

HardenedBSD again

Hi folks,

While Shawn and Oliver are working hard to make automatic builds fully workable (as mentioned here), I have just finished my long week end of coding to improve the ptrace branch. Now all request flags (for example hardening.ptrace.flag.trace_me) can de enabled/disabled atomically (or all at once via sysctl hardening.ptrace.flag_all) at will. Everything is on the unstable branch.

For now I m going to help them to fix some issues and will surely come back on it for adding more features.

More things are coming but will be known in due time ;-)

HardenedBSD, some examples

Hi folks,

For testing ASLR, I just wrote this very basic example :

#include <mtld/devatlas.h>

using namespace Mobi::Mtld;

int

main(int argc, char *argv[])

{

Da::DeviceAtlas *da = new Da::DeviceAtlas();

printf("Address of da ptr %p\n", da);

delete da;

return (0);

}

Compiled without fPIE and aslr disabled (sysctl hardening.pax.aslr.status=0).
clang++ -I/usr/local/include -L/usr/local/lib -ldevatlas -lcommon -o da-test-aslr da-test-aslr.cc
So each time it is called, it should be the same address all the time.
For example

./da-test-aslr

Address of da ptr 0x802417000

./da-test-aslr

Address of da ptr 0x802417000

...

Now let's enable ASLR and compile with PIE flag
clang++ -I/usr/local/include -L/usr/local/lib -fPIE -ldevatlas -lcommon -o da-test-aslr da-test-aslr.cc

./da-test-aslr

Address of da ptr 0x887017000

./da-test-aslr

Address of da ptr 0x86bc17000

...

Another topic ...
With the ptrace hardening feature, it is possible to allow only root and possibly via PTRACE_HARDENING_GRP kernel option enabled to allow only one specific gid to perform any kind of ptrace call. It is also possible to set ugidfw utility with ptracehdflags to disable ptrace hardening for a specific binary for example.

ugidfw add subject uid dcarlier object filesys /usr/bin/top mode rx ptracehdflags a

HardenedBSD, SEGVGUARD and other friends

Hi folks,

Again about HardenedBSD, that starts small but smoothly, we got an article on Phoronix recently which is quite nice to be honest as this website is more for Linux topics. Also I got few but usually positive feedbacks when I talk about it ...

Also recently the SEGVGUARD branch was well updated (this feature is to avoid to get attacked via malicious segmentation faults usage).

In my part, after a long night to code MAC extended support for my PTRACE hardening branch (which allows to disable/enable hardening on a particular executable for example with the new ptracehdflags ...) + I applied also the DragonflyBSD's patch for taking care of SYSRET privilege escalation issue (Matt Dillon is really an hard worker ...), I am now responsible for the whole "ptrace" topic, I ll implement for next finer grained control over this.

All of these features provide this new sysctl tree :

security.pax.aslr.*
security.pax.segvguard.*
security.ptrace.hardening.*

But that a good chance it ll change soon in more consistent way ...

Small update :

Now the sysctl tree is under the root hardening oid just created by oliver :

hardening.pax.aslr.*
hardening.pax.segvguard.*
hardening.ptrace.*

Also just added some logging in case the ptrace call is not authorised.

Hardened BSD, ASLR + PIE, and so forth ...

Hi folks,

What happened to me recently it s basically "a dream comes true" ... kind of.
Indeed, Shawn Webb (and Oliver Pinter), the men behind Hardened BSD (which is originally to bring proper ASLR support on FreeBSD), wrote me that :

"
Hey David,

Oliver and I would like to add you as a direct contributor to the
HardenedBSD project. We've looked over your pull requests and have been
impressed with your code. Would you like to become an official developer
for the project?

Thanks,
"

Even after nearly 14 years of experience, I was quite shaked by those words, coming from an important person. I extended the goal of HardenedBSD by also providing security fixes in the base userland and he trusted me since the beginning. So I m thankful for his generosity, I won't forget ;-).
It existed before some unofficial ASLR projects but as you can easily mess up things, I did not trust much. But when I first heard about Shawn's work I said to myself "Yes he got it right!", then I saw his interview I was convinced ...

So for next, I m trying to provide optional hardening ptrace calls and will see what will come next.
As it is quite time consuming, I ll probably give much less time to some other projects but this is life !