Posts in category www.undeadly.org
RETGUARD, the OpenBSD next level in e...
In a message to the tech mailling list, Theo de Raadt(deraadt@) offered a preview of the next big thing in exploit mitigation, dubbed RETGUARD:
This year I went to BSDCAN in Ottawa. I spent much of it in the
\'hallway track\', and had an extended conversation with various people
regarding our existing security mitigations and hopes f [...]
Undeadly to be Upgraded Next Week
As there have been no reports of functional bugs since the last beta, and the primary goal of the work was achieved long ago, the (main) Undeadly server is to be upgraded.
The upgrade, which is expected to involve downtime of no more than one hour, is scheduled for next Tuesday, 2017-08-22 07:00 UTC.
Changes since the last public (Read mo [...]
t2k17 Hackathon Report: Ted Unangst O...
The second report from the just completed t2k17 hackathon
comes from Ted Unangst (tedu@), who writes:
I did a bit of this and that, but the project that probably has the most
interesting explanation has to do with pseudo terminals. This has a bit of
history behind it that goes back to the early days of unix.
Read (Read more...)
Smartisan Makes Another Iridium Donat...
News from the OpenBSD Foundation: The Foundation has this year\'s first Iridium donor.
The official statement from the foundation, via director Ken Westerback reads,
The OpenBSD Foundation is excited to announce that it has received the
first 2017 Iridium level donation. For the second consecutive year,
Smartisan (http://www.smartisa [...]
t2k17 Hackathon Report: Bob Beck on b...
The first report from the just completed t2k17 hackathon comes from Bob Beck, who writes:
Unusually I had basically nothing to do with organizing this year, I
let krw@ do all the dirty work, which was good since life has been a
bit crazy over the last couple months with things keeping me from
openbsd.
Read more...
Beta Update – Request for (more...
https://beta.undeadly.org/ has received an update. The most significant changes include:
The site has been given a less antiquated "look".
(As the topic icons have been eliminated, we are no longer seeking help with those graphics.)
The site now uses a moderate amount of semantic HTML5.
Several bugs in the HTML fragment vali [...]
Large Batch of Kernel Errata Patches ...
In response to the DEF CON presentation by Ilja van Sprundel,
a large set of kernel patches have been released (for OpenBSD 6.0 and 6.1).
These important patches should be applied ASAP!
From the announce@ mailing list:
Errata patches for a number of kernel issues have been released for
OpenBSD 6.1 and 6.0.
Read more...
mandoc-1.14.2 released
Ingo Schwarze (schwarze@) writes in saying:
i just released portable mandoc-1.14.2.
It is available now from http://mandoc.bsd.lv/.
The whole message reads,
Read more...
Default compiler switched to clang on...
With this commit, the default compiler for (-current base system on the) amd64 and i386 platforms has been changed to clang(1):
CVSROOT: /cvs
Module name: src
Changes by: robert@cvs.openbsd.org 2017/07/26 13:44:42
Modified files:
share/mk : bsd.own.mk
Log message:
switch the default compiler on amd64 and i386 to clang,
[...]
Add vmctl send and vmctl receive
As we see from the commit message, new developer Pratik Vyas (pd@) adds the ability to do paused VM migrations for VMM.
Mike Larkin also writes on Twitter:
#OpenBSD vmctl(8) : vmctl send myvm | ssh mlarkin@somewhere.com vmctl receive Yes, it's that easy.
Ed: this is *paused* migrations, not live migrations.
OpenBSD and the modern laptop
Over at his blog, Undeadly co-editor Peter Hansteen describes the experience of installing OpenBSD-current on a new laptop.
The article, OpenBSD and the modern laptop, goes into some detail on the install procedure, and hits only minor snags even when using modern and recent additions such as UEFI boot.
The conclusion is that OpenBSD i [...]
Request for testing: https://beta.und...
TL;DR - A modernised version of Undeadly is available for testing at <https://beta.undeadly.org/>.
Broken features of the current site have been fixed, removed, or replaced.
The new software supports - and, where appropriate, requires - HTTPS. Testing, contributions, and constructive feedback would be appreciated.
An effort to mo [...]
Ted Unangst on notable recent changes...
The flak reports by Ted Unangst (tedu@) continue with part 624.
Update - part 625
Kernel relinking status from Theo de ...
As you may have heard (and as was mentioned in an earlier article), on recent OpenBSD snapshots we have KARL, which means that the kernel is relinked so each boot comes with a new kernel where all .o files are linked in random order and with random offsets. Theo de Raadt summarized the status in a message to the (Read more...)
On the Insecurity of TIOCSTI
Theo de Raadt (deraadt@) provided some history on the insecurity of TIOCSTI [simulate typed input on terminal], with a proposal to disable it on OpenBSD:
[...] there\'s always been the risk
that a program manages to retain tty association beyond it\'s intended
lifetime, and then it can perform injections with TIOCSTI.
So I\'ve always w [...]
BSDCan 2017 – Trip report doubl...
The OpenBSD presence at the just concluded BSDCan was quite strong, and here is the first trip report, from Phillipp Buehler:
Prologue
Most overheard in Tokyo was "see you in Ottawaaaaah", so with additional "personal item" being Groff I returned home to plan the trip to BSDCan.
Dan was very helpful with getting al [...]
d2k17 hackathon report: Martin Pieuch...
Our next report from the d2k17 hackathon comes from Martin Pieuchot, who writes:
Hackathons are generally good to start or finish something, at Starnberg
I managed to do both.
I came to unlock the forwarding path and thanks to the multiple reviews
from bluhm@, sashan@ and claudio@ it happened! It started as a boring
hackathon b [...]
d2k17 Hackathon Report: Alexander Blu...
Alexander Bluhm (bluhm@) wrote in with a hackathon report:
As usual hackathons are a great time to get things commited. All
the other developers are around, you can discuss ideas and get code
reviewed quickly.
To move towards network input without big kernel lock, I have looked
at the protocol functions and refactored them. Especial [...]
OpenBSD now has Trapsleds to make lif...
You heard it here (or on tech@) first: Trapsleds are in, and it makes OpenBSD even safer. Work done by Todd Mortimer and submitted to tech@ in the Trapsleds thread was later committed by Theo de Raadt.
Todd\'s message to tech says,
I have attached a patch that converts NOP padding from the assembler
into INT3 padding on amd64. The [...]
KARL – kernel address randomize...
In a
message to the tech@ mailing list,
Theo de Raadt (deraadt@) has announced a new randomization feature for
kernel protection:
Over the last three weeks I\'ve been working on a new randomization
feature which will protect the kernel.
[...]
Recently I moved all our kernels to a new mapping model, with patrick
and visa taking ca [...]
