UPDATING-HardenedBSD

[20180701] OpenSSL
__HardenedBSD_version = 1100056

	Switch back to OpenSSL as the default crypto library in base.


[20180210] PAX_JAIL_SUPPORT
__HardenedBSD_version = 1100055

	Added infrastructure to change hardening settings at
	jail creation time. You can use the same "mibs" as
	jail params, which exists under the hardening sysctl
	node. See the example jail.conf sniplet:

	  exec.start = "/bin/sh /etc/rc";
	  exec.stop = "/bin/sh /etc/rc.shutdown";
	  exec.clean;
	  mount.devfs;
	  
	  path = "/usr/jails/$name";
	  host.hostname = "$name";
	  
	  hbsdnx {
	          hardening.pax.segvguard.status = 3;
	          hardening.pax.mprotect.status = 3;
	          hardening.pax.pageexec.status = 3;
	          hardening.pax.aslr.status = 3;
	          persist;
	  }

	In the current implementation the settings are still
	modifiable via sysctls inside from the jail, but this
	will change in the future. The same is true for the
	nested jails.


[20171116] Changed AT_PAXFLAGS auxevector
__HardenedBSD_version = 1100054

	After the recent upstream commit which pulls in a new AUX vector
	entry (namely the AT_HWCAP2) the AT_PAXFLAGS aux entry moved to
	other position. This breaks our rtld, and that's why this bump
	required to reflect the need of update.
	For more information see the fea694b75ea6704d14c7867ee98e4acb949ca6fc
	and 4c04e4a613679510cd16bb13d7974c18e3f54460 commits.


[20171112] LibreSSL 2.6.3
__HardenedBSD_version = 1100053

	LibreSSL has been updated to 2.6.3.


[20171017] Changed auxvector after b8515f8f387edbf541e0be5a7b346ad69e2db1ea
__HardenedBSD_version = 1100052

	> commit b8515f8f387edbf541e0be5a7b346ad69e2db1ea
	> Author: jhb <jhb@FreeBSD.org>
	> Date:   Tue Oct 17 12:45:51 2017 +0000
	> 
	>     MFC 323579,323585: Add AT_HWCAP and AT_EHDRFLAGS on all platforms.
	>     
	>     To preserve KBI on stable/11, a new SV_HWCAP flag is added which
	>     indicates if the sv_hwcap field is present and valid to avoid examining
	>     the field in old modules.  Only sysentvec's which wish to use sv_hwcap
	>     need to set the flag in stable/11.
	>     
	>     323579:
	>     Add AT_HWCAP and AT_EHDRFLAGS on all platforms.
	>     
	>     A new 'u_long *sv_hwcap' field is added to 'struct sysentvec'.  A
	>     process ABI can set this field to point to a value holding a mask of
	>     architecture-specific CPU feature flags.  If an ABI does not wish to
	>     supply AT_HWCAP to processes the field can be left as NULL.
	>     
	>     The support code for AT_EHDRFLAGS was already present on all systems,
	>     just the #define was not present.  This is a step towards unifying the
	>     AT_* constants across platforms.
	>     
	>     323585:
	>     Add AT_EHDRFLAGS and AT_HWCAP on amd64.
	>     
	>     x86 has two separate (but identical) list of AT_* constants and the
	>     earlier commit to add AT_HWCAP only updated the i386 list.
	> 
	> Notes:
	>     svn path=/stable/11/; revision=324687

	the AT_PAXFLAGS has been changed from 24 to 26 position in
	elf auxvector. This may break some functionality, especially
	the SHLIBRAND feature, when you running on a newer kernel
	with an older user-space.


[20171002] TOCTOU fix, PAX_CONTROL_{ACL,EXTATTR}
__HardenedBSD_version = 1100051

	hbsdcontrol
	-----------------------------------------------------------------------
	The hbsdcontrol subsystem is an extattr(9) based control pane for
	HardenedBSD's security settings.
	
	Currently only the system namespace supported. (The FreeBSD's extattr
	subsystem has two namespace: system and user. The system namespace is
	writeable only from non-jail root user, the user namespace is writeable
	from all users.)
	This means only the root can assign rules to specific file. The other
	restriction is similar, only from the host is allowed to set rules to
	specific file, and prohibited a such operation from jails, for jail's
	root user too prohibited.
	
	To enable the hbsdcontrol subsystem, you should add the
	
	options       PAX_CONTROL_EXTATTR
	
	kernel knob to your kernel config.
	
	The hbsdcontrol subsystem use the following extended attributes:
	
	    hbsd.pax.aslr
	    hbsd.pax.noaslr
	    hbsd.pax.segvguard
	    hbsd.pax.nosegvguard
	    hbsd.pax.pageexec
	    hbsd.pax.nopageexec
	    hbsd.pax.mprotect
	    hbsd.pax.nomprotect
	    hbsd.pax.shlibrandom
	    hbsd.pax.noshlibrandom
	    hbsd.pax.disallow_map32bit
	    hbsd.pax.nodisallow_map32bit
	
	Valid values are only the 0 (= disabled) and 1 (= enabled).
	Valid settings are the following in system FS-EA namespace (with the ASLR
	example, the same is true for the other settings):
	
	* no hbsd.pax.aslr, nor hbsd.pax.noaslr assigned to the file -> system default
	* hbsd.pax.aslr = 1 and hbsd.pax.noaslr = 0 -> enabled ASLR
	* hbsd.pax.aslr = 0 and hbsd.pax.noaslr = 1 -> disabled ASLR
	* hbsd.pax.aslr = 0 and hbsd.pax.noaslr = 0 -> invalid, warning message + execution error
	* hbsd.pax.aslr = 1 and hbsd.pax.noaslr = 1 -> invalid, warning message + execution error
	
	Attributes in user namespace are ignored.

	TOCTOU fix, PAX_ACL
	-----------------------------------------------------------------------
	As preparation to hbsdcontrol, and to clean up the whole control logic
	there is some new kernel knob:

	* PAX_CONTROL_ACL
	* PAX_CONTROL_ACL_OVERRIDE_SUPPORT
	* PAX_CONTROL_EXTATTR

	If you want to use the external secadm utility to manage hardenedbsd's
	security features, then you should add 

	 options PAX_CONTROL_ACL

	to your kernel config.

	If you want to use the extattr(9) based hbsdcontrol, you should add
	the

	 options PAX_CONTROL_EXTATTR

	kernel knob.

	If you want to use both hbsdcontrol and secadm, and it's nice to add

	 option PAX_CONTROL_ACL_OVERRIDE_SUPPORT

	too. This is nice in very special case, when you set rules both
	from hbsdcontrol and from secadm on the _same_ file. By default
	always the hbsdcontrol wins this situation, and what was set up
	by hbsdcontrol gets applied as policy. To override this behavior
	you can add a special flag in you secadm conf to override this
	behavior. For more details consult with secadm's source code /
	readme / man page.


[20170917] Added LibreSSL to the base
__HardenedBSD_version = 1100050

	The LibreSSL SSL and TLS implementation
	was added to 11-STABLE's base system as
	an OpenSSL alternative. It is enabled by
	default.
	If you encounter any problem, you can
	switch back to OpenSSL by adding the
	WITHOUT_LIBRESSL= knob to /etc/src.conf,
	and then do a full buildworld + installworld.


[20170904] Changed pax_elf API
__HardenedBSD_version = 1100049

	As preparation to hardenedBSD rationalize
	the pax_elf(...) functions signature, to
	follow the codes in kern_exec's style.
	For the details, see the code.


[20170716] Enforced KPI
__HardenedBSD_version = 1100048

	Enfore the KPI version at compile time. This
	will implicate the recompilation of external
	modules even once __HardenedBSD_version or
	__FreeBSD_version gets bumped.


[20170618] Changed __HardenedBSD_version scheme
__HardenedBSD_version = 1100047

       The version numbers may differ in different branches (10-STABLE,
       11-STABLE, 12-CURRENT) and to keep the version number in pair
       with the features state, there is a need to allow to bump they
       differently.


[20170618] Changed default protection settings for text section
__HardenedBSD_version = 47

       Fixes the (theoretically) last outstanding memory
       protection related weakness in HBSD's user-space detectable
       with paxtest.


[20160423] RELRO + BIND_NOW
__HardenedBSD_version = 46

	Enable RELRO + BIND_NOW for base.
	Introduce WITHOUT_RELRO and WITHOUT_BIND_NOW.
	Setting WITHOUT_RELRO also sets WITHOUT_BIND_NOW.


[20160408] PIEified base for amd64 and i386
__HardenedBSD_version = 45

	Remove WANTS_PIE.
	Default PIE for base for amd64 and i386 only.
	When PIE is enabled, compile non-static libraries with -fPIC.
	Default WITH_SHARED_TOOLCHAIN to enabled by default.

	If you encounter build problems during make buildworld,
	try to clean the object files directory, which is typically
	/usr/obj: 
	
		cd /usr/obj; rm -rf *
	
	And retry to build the world. This will require due to not
	proper cleaning mechanizm of FreeBSD's build framework.


[201603XX] noexec and ASLR changes
__HardenedBSD_version = 44

	Fixed noexec's paxflags parser to get usable system on
	bronen setups too.
	Changed ASLR stack randomization settings on 32 machines.

[20160316] ASLR cleanup
__HardenedBSD_version = 43

	Since the hardening.pax.aslr.*_len variables are no longer
	available outside of loader.conf(5), remove them from
	struct hbsd_features, which gets embedded in struct
	prison. This change makes the hardening.pax.aslr.*_len
	variables a global setting, rather than a per-jail setting.


[20160225] RTLD noexec
__HardenedBSD_version = 42

	Enforce nonexec thread stacks, driven by the RTLD.


[20160213] rewritten internals
__HardenedBSD_version = 41

	Changed hardenedBSD core structures.
	Dropped ptrace_hardening.
	Dropped ASLR bit settings.
	Fixed hbsd_update_build bug.
	Added skeleton file.
	Changed feature strings.
	Changed noexec implicit rules.


[20160123] add pax_get_hardenedbsd_version API
__HardenedBSD_version = 40

	Add pax_get_hardenedbsd_version() API to query hardening's version
	from kernel codes.

	Add new types, which represents the PAX_FLAGS.


[20151225] redo rework internal structures
__HardenedBSD_version = 39

	Change pax_get_prison(...) to pax_get_prison_td(...) where possible.
	Fix one segvguard related issue.
	Changed pax_elf signature.

	We reverted this code in version 37, because we observed weird
	issue, but this issues was unrelated to the reworked internals.
	The true root of the problem was a secadm bug and the issue fixed
	with version 38.


[20151218] reworked MAP_32BIT mmap randomization
__HardenedBSD_version = 38

	Previously the MAP_32BIT case mmap randomization was an ASR,
	to fix this and some other issue with the MAP_32BIT related
	mmap, implement a proper ASLR.

	Upstream fixed stability issues with higher order PID randomization


[20151208] revert the reworked internal structures
__HardenedBSD_version = 37

	revert: Change pax_get_prison(...) to pax_get_prison_td(...) where possible.
	revert: Changed pax_elf signature.


[20151206] rework internal structures
__HardenedBSD_version = 36

	Change pax_get_prison(...) to pax_get_prison_td(...) where possible.
	Change noexec's sysctl handlers.
	Fix one segvguard related issue.
	Fix randompid related issue.
	Changed pax_elf signature.


[20151123] changed proc structure : added p_timekeep_base
__HardenedBSD_version = 35

	Follow the recent VDSO changes from kib@.
	This required to introduce new field to struct proc.


[20151018] disabled lib32 build by default
__HardenedBSD_version = 34

	Do not build lib32 and 32bit related stuffs on 64bit platforms
	by default.


[20150924] changed stack-protector level
__HardenedBSD_version = 33

	Bump the default build settings from the --stack-protector
	to --stack-protector-strong.


[20150915] ASLR changes
__HardenedBSD_version = 32

	Changed default VDSO randomization from 20 bits to 28 bits.
	Fixed div by zero in rare cases in pax_aslr_init_vmspace.


[20150907] Reworked DISALLOWMAP32BIT and changes some internal functions
__HardenedBSD_version = 31

	Rename and correctly paxify the DISALLOWMAP32BIT.
	Changed pax flags setup.


[20150905] Added MAP32_PROTECT
__HardenedBSD_version = 30

	Added per-process mode to disable MAP_32BIT mode mmap(2).


[20150823] Fixed pkg bootstrap
__HardenedBSD_version = 29

	With FreeBSD commit 671f0b9, use of pubkey signature_type method is explicitly disallowed.
	This breaks bootstrapping with pubkey signature_type.


[20150715] Fixed vdso randomization
__HardenedBSD_version = 28

	Fixed and simplified vdso and stack mapping.


[20150706] Added shared-page (vdso) randomization
__HardenedBSD_version = 27

	This version brings in true stack randomization.
	Changed ASLR settings:
		vdso random : 20 bit


[20150701] Rewriten stack randomization, and bumped ASLR settings
__HardenedBSD_version = 26

	This version brings in true stack randomization.
	Changed ASLR settings:
		stack random : 26 -> 42 bit
		exec random : 21 -> 30 bit


[20150605] ASLR "rewrite" and NOEXEC fixes after jhb's vm_mmap.c changes 
__HardenedBSD_version = 25
__HardenedBSD_version = 24

	Move the mmap randomization to it's own place and add more state enforcements (KASSERTs).
	Added locking around pax_aslr_mmap(...).
	Factore out the MAP_32BIT related code from pax_aslr_mmap(...), and move to pax_aslr_mmap_map_32bit(...)


[20150604] fix ASLR - randomize the rtld's shared object too
__HardenedBSD_version = 23

	Randomize the rtld's address before load them in imgact_elf.c


[20150604] added PAX_NOTE_{,NO}SHLIBRANDOM extension
__HardenedBSD_version = 22

	This feature will fix the issue mentioned on issue #137


[20150528] Changed internal structure, removed hardening.pax.segvguard.debug sysctl
__HardenedBSD_version = 21

	Changed internal structure
	Removed hardening.pax.segvguard.debug sysctl


[20150415] Bumped stack randomization
__HardenedBSD_version = 20

	Increased stack randomization from 20 bit to 26 bit.


[20150415] Fixed stack randomization
__HardenedBSD_version = 19


[20150408] How to get HardenedBSD and HardenedBSD-ports?

	Without git/svnlite:

	    HardenedBSD source:

		# fetch https://github.com/HardenedBSD/hardenedBSD/archive/hardened/current/master.tar.gz -o hardenedbsd-src.tar.gz
		# tar xf hardenedbsd-src.tar.gz
		# mv hardenedBSD-hardened-current-master /usr/src

	    HardenedBSD ports:

		# fetch https://github.com/HardenedBSD/freebsd-ports/archive/master.tar.gz -o hardenedbsd-ports.tar.gz
		# tar xf hardenedbsd-ports.tar.gz
		# mv freebsd-ports-master /usr/ports

	    Secadm:

		# fetch https://github.com/HardenedBSD/secadm/archive/master.tar.gz -o secadm.tar.gz
		# tar xf secadm.tar.gz

	With git:

	    HardenedBSD-source:

		# git clone https://github.com/HardenedBSD/hardenedBSD.git /usr/src

	    HardenedBSD ports:

		# git clone https://github.com/HardenedBSD/freebsd-ports.git /usr/ports

	    Secadm:

		# git clone https://github.com/HardenedBSD/secadm.git

	With svnlite (much more slower than git version):

	    HardenedBSD-source:

		# svnlite co https://github.com/HardenedBSD/hardenedBSD.git /usr/src

	    HardenedBSD ports:

		# svnlite co https://github.com/HardenedBSD/freebsd-ports.git /usr/ports

	    Secadm:

		# svnlite co https://github.com/HardenedBSD/secadm.git


[20150404] Added secadm hook to rtld
__HardenedBSD_version = 18

Added integriforce secadm hook to rtld to validate
shared object before loading them.


[20150318] Merged first part of NOEXEC project
__HardenedBSD_version = 17

This is the first part of PaX's MPROTECT restriction:
* this merge brings per process level restriction settings
* eliminated the linux's sound related mmap weakness
* improved the logging
...

If you have problem with your application, then install
secadm:

 * from pkg:

	pkg install secadm

 * or from github:

	# git clone https://github.com/hardenedbsd/secadm
	# cd secadm
	# make && make install


[201502011] Changed kernel knobs

Added ``options PAX`` to enable the HardenedBSD framework.
All other PAX_* knob depends on PAX knob.


[20150131] Upgrading from systems before "HBSD: Revert the chacha20 import in full."

After the "HBSD: Revert the chacha20 import in full." commit
we lost the compatibility with the previous version, this
means ABI break, and the system is unable to properly boot.
In the background is the removed VM_INHERIT_ZERO flag, which
was previously used in libc.

The solution is to install the new world, before you booting to the new kernel.

1. make buildworld kernel
2. IMPORTANT: install world before you reboot
 2.1. mergemaster -p && make installworld && mergemaster
3. reboot
4. start in single user mode
5. cd /usr/src
6. make delete-old delete-old-libs
7. if you have buildworld or buildkernel error,
   where the cc aborting and dumping core,
   then you need to delete the content of /usr/obj directory:
 7.1 cd /usr/obj
 7.2 rm -rf *

And probably a full ports rebuild required too...