OpenBSD and post release ... status

Hi folks,

Had been warned by other openbsd folks there is a new MAP_CONCEAL feature (and consumers called malloc_conceal/calloc_conceal (a realloc_conceal is absolutely not necessary, the address will keep the flag internally), I decided to rebuild the whole system despite having done this just last night. This is interesting feature, controlling the informations you want to disclose for debugging. To be more concrete, let's use a very basic C++ application reading an external file containing sensitive information, purposely generating a core dump :

#include <sys/mman.h>

#include <sys/stat.h>

#include <string>

#include <stdio.h>

#include <errno.h>

#include <signal.h>

#include <stdlib.h>

#include <iostream>

int main(int argc, char **argv) {

...

                auto st = fstat(fd, &s);

                auto sz = s.st_size;

                auto flg = MAP_PRIVATE;

#if defined(HIDEIT)

                flg |= MAP_CONCEAL;

#endif

                auto p = ::mmap(nullptr, sz, PROT_READ|PROT_WRITE, flg, fd, 0);

                if (p != MAP_FAILED) {

                        auto str = reinterpret_cast<char *>(p);

                        ::raise(SIGSEGV);

                        ::munmap(p, sz);

...

        return 0;

}

The version without the new flag would disclose the value of the mapped file content as you can see

gdb ./test_without ./test_without.core

...

(gdb) f 1  

#1  0x000006c2da1db473 in main (argc=2, argv=0x7f7ffffc3548) at test_conceal.cc:26

26 ::raise(SIGSEGV);

(gdb) p str

$1 = 0x6c5d77c5000 "My credit card number -- whoooops\n"

...

whereas the version with the new flag ...

gdb ./test_with ./test_with.core

... f 1

#1  0x000006e7271c1484 in main (argc=2, argv=0x7f7ffffcc868) at test_conceal.cc:26

26 ::raise(SIGSEGV);

(gdb) p str

$1 = 0x6e9b7336000 <Address 0x6e9b7336000 out of bounds>

It can be useful that's for sure, we shall see if other operating systems would implement similar feature (edit they do but via madvise) ...

Also if like me you possess a Thinkpad with AMD Ryzen, I would recommend following up this topic from openbsd-misc. The GPU driver had been updated but still the kernel need to be updated accordingly before being able to feel its full potential ...

To finish with OpenBSD, there who is still very active on advertising video games, had updated the list, just to remind there is quite a handful possibility to entertain yourself even on a pretty secure os as this one ;-) His enthusiasm is a nice thing to see !

Harder time for some ...

Hi folks,

These days a lot more scary news about Intel chips, more disappointments ... Seems AMD is a slightly better choice if any purchase is scheduled ...

Also an historical (nearly 20 years) subtle bug of openssh, another bad spot since Heartbleed and such.

Anyway ... apart of this, I still pushed few changes to php 7.3 series, one to fix fixed paging to avoid old mapping discarding (when it s possible ...) so this function really fullfill its "contract" (and seems to give a bit of performance gain), one to fix compilation warning ... that should be nearly all, it is very soon time for pure bug fixes and also to switch new developments to master/future 7.4 ...

Finally, my old golang contribution had been merged so it can benefit (near future) FreeBSD's stronger randomness generation ... Otherwise, little commits here and there, helping other OpenBSD folks when they port something, if I can fix bugs in the meantime :-)

Now Barony 3.2.0, after a short beta time, had been released on Steam and seems changes please its players ... Expecting Gog.com "shortly" ...