We provide you with updates to Spectre & Meltdown from various BSD projects, a review of TrueOS from Linux, how to set up FreeBSD on ThinkPad x240 & a whole bunch of beastie bits.
As 18.1 is drawing near this stable update for the 17.7 series could be the last one. So whether there will be a hotfix to enable the update path or a full 17.7.13 remains to be seen, but we will keep you informed either way. The targeted release date for 18.1 is January 29.
For now we refrain from letting users upgrade directly to the release candidates, but suffice to say that with the development version accompanying this update it is possible from the console. And again thank you to all early adopters which have made the release candidates a thoroughly enjoyable experience.
We review Meltdown & Spectre responses from various BSD projects, show you how to run CentOS with bhyve, GhostBSD 11.1 is out & we look at the case against the fork syscall.
The commands rcp(1), rlogin(1), rlogind(1), rsh(1) and rshd(1) have been removed from DragonFly. There’s a net/bsdrcmds port if you still need them… though I imagine/hope ssh is filling the void for everyone.
A message to tech@ from Philip Guenther (guenther@) provides the first public information from developers regarding the OpenBSD response to the recently announced CPU vulnerabilities:
So, yes, we the OpenBSD developers are not totally asleep and a handful of
us are working out how to deal with Intel's fuck-up aka the Meltdown
attack. While we have the advantage of less complexity in this area (e.g.,
no 32bit-on-64bit compat), there's still a pile of details to work through
about what has to be *always* in the page tables vs what can/should/must be
hidden. Read it.
By now you’ve probably heard of the Meltdown/Spectre attacks. (background rumors, technical note) Matthew Dillon’s put together a Meltdown mitigation in DragonFly, done in four commits.
It’s turned off and on by the sysctl machdep.isolated_user_pmap – and defaults to on for Intel CPUs. Buildworld tests show about a 4-5% performance hit, but that’s only one form of activity, measured, so there will surely be other effects.
Note that Spectre is not mitigated by this commit series, and as I understand it, cannot be realistically fixed in software.
Update: Matthew Dillon posted a summary to users@.
The unveiling of the three new CPU bug classes, collected in the two brandbugs “Meltdown” and “Spectre”, has mostly shocked the BSDs; I’ve got it on some authority that even FreeBSD was not informed ahead of time, left alone the others. Thanks to laffer1 from MidnightBSD for a couple of heads-up warnings into our direction!
Here’s what I could gather until now (please do correct me if I’m wrong):
Meltdown is specific to Intel® CPUs with out-of-order execution, that is, all P6-class (Pentium Pro/MMX, Pentium Ⅱ, but not Pentium Ⅰ/MMX) or newer (except old Atom) CPUs. It appears to allow user processes to read kernel memory, but not across VMs, nor to attack a hypervisor. A variant for ARM exists but AMD’s x86 CPUs are supposedly safe. The KAISER/FUCKWIT/UASS/KPTI patches for Linux fix this, at huge performance cost on x86, not so much on ARM, and no cost for unaffected CPU models (runtime detected).
Spectre affects x86, ARM, POWER CPUs and possibly others. I’ve not yet found information on whether it is also limited to CPUs with out-of-order executions, but it seems likely. SPARC CPUs might be safe; Solaris/SPARC64 is safe due to the way its memory addressing works. If the OOO execution assumption is true, 80486 and P5 class x86 CPUs are also safe. This one does allow cross-VM and hypervisor attacks, so if the bare metal CPU is vulnerable, SOL. There does not yet seem to be a generic fix; some hint at having to patch the compiler and recompile everything with a workaround that has a performance cost, even if the CPU is not affected, or was fixed with a microcode update. AMD’s x86 CPUs are partially hit, one of the variants does not work on them.
“CERT recommends throwing away your CPU and buying an non-vulnerable one” (thanks to El Reg), but nobody states which CPUs are not vulnerable.
At the present time, we suggest any MirBSD/i386 instances that run on any CPU other than an 80486 or P5-class (Pentium Ⅰ or a non-PPro MMX) to be restricted to single user or trusted user access only, and no untrusted software including ECMAscript to be run on them.
Watch this space for updates. Oh, and, if you know what you’re (and I’m) talking about, please, again, do provide me with information necessary to provide those updates, both to MirBSD and to this space.
FreeBSD was made aware of the problems in late December 2017. We're working with CPU vendors and the published papers on these attacks to mitigate them on FreeBSD. Due to the fundamental nature of the attacks, no estimate is yet available for the publication date of patches.
We've just published our goals for 2018. We've got a number of new goals planned, some that require new infrastructure. In 2018, we plan to migrate at least 90% of our infrastructure to a single data center in addition to expanding out existing infrastructure.
More user group news: Helsinki, Finland, has a new BSD User Group: HelBUG. First meeting is February 7th. There’s no mailing list/site that I know of, yet.
We walk through dumping a PS4 kernel in only 6 days, tell you the news that NetBSD 7.1.1 has been released, details on how to run FreeBSD on a Thinkpad T470 & there’s progress in OpenBSD’s pledge.
Highlights:
- fixed syslogd - restore host name handling in UDP case
- fixed ARM64 control flow problem
- fixed MAP_GUARRD issues
- upgrade to Unicode 10.0.0
- ZFS fixes
(side note: the recent OpenSSL security issues (FreeBSD-SA-17:11.openssl) are already fixed in previous releases) Download
If you’re booting DragonFly in UEFI mode, and you have unsupported video (i.e. NVIDIA), there’s the scfb driver for xorg. It doesn’t support NVIDIA chipsets either, but it gives more options than the generic vesa driver. It appears to be present in all the BSDs to some extent.
A shiny new update is available, addressing the recent security advisories from FreeBSD, OpenSSL, Sudo and a number of minor bugs.
To all our 18.1-BETA testers we say this: thank you! The results have been thoroughly positive. If you would like to participate as well, please take a closer look:
https://forum.opnsense.org/index.php?topic=6257.0
pfSense software version 2.4.2 is a maintenance release bringing security patches and stability fixes for issues present in previous pfSense 2.4.x branch releases.
I just wasted an hour trying to figure out why xorg had strange output but no errors on this laptop, and it’s because I had i915_load=”YES” in /boot/loader.conf instead of i915_load=”YES” in /etc/rc.conf. I’m almost nearly sure I’ve mentioned that before, but if not: here you go.
(though if you never plan to run X, you can put it in loader.conf and everything will just work.)
If you happen to be running an old version of DragonFly, you may need to do an intermediate upgrade to move to releases after 5.0. This is in part because of commits to support C++14. This only applies to version of DragonFly before 4.4.
Tthis is a security update and reinstallation of pkgs/ports are required due LibreSSL upgrade!
Highlights:
- Changed AT_PAXFLAG auxvector position (4c04e4a613679510cd16bb13d7974c18e3f54460)
- Properly bzero kldstat structure to prevent kernel information leak. (3ff3ec467d4eb11cdbf706cf386935d5e58c2e91) [FreeBSD-SA-17:10.kldstat, CVE-2017-1088]
- CloudABI 0.17 (cf6ac9b4efa43a9c64c5ab311666080a0e8632b1)
- MFH (r325010): don't bother verifying a password that we know is too long. (b242fe393914310e50673eb62d480ce03706d745) [CVE-2016-6210] Installer
We have a first PS4 kernel exploit, the long awaited OpenZFS devsummit report by Allan, DragonflyBSD 5.0 is out, we show you vmadm to manage jails, parallel processing with Unix tools & more!
So, again this release the tradition of making Theo do art has continued! Up for sale by auction to the highest bidder on Ebay is the only OpenBSD 6.2 CD set to be produced. The case and CD's feature the 6.2 artwork, custom drawn ans signed by Theo. All proceeds to support OpenBSD Go have a look at the auction
As with previous OpenBSD auctions, if you are not the successful bidder, we would like to encourage you to donate the equivalent of you highest bid to the project.
This week on BSDNow, Allan is away in the UK for BSDCam, but we
still have a full episode for you! Don’t miss our interview with Myke
Geiger talking about using FreeBSD in the ISP environment & the
latest news, here on your place to B...SD!
16.7-RC2 is here and brings major additions to amd64
architectures: Intel’s Hyperscan library to speed up Suricata rule
matching and UEFI boot support! It also brings language packs to their
correct 16.7 state, with Japanese already having been completed by the
amazing Chie Taguchi.
The mirrors have been expanded to allow trackers of -stable or -devel
packages to upgrade to the release candidate. Users of LibreSSL wanting
to upgrade can now switch to OpenSSL instead of seeing upgrade errors
until LibreSSL becomes available again and their systems move back to
LibreSSL automatically.
Otherwise, only minor issues have been reported and fixed. This likely means there will not be another release candidate.
New images are available from all known mirrors with all checksums listed after this announcement: https://opnsense.org/download/
There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 46.5 Changelog v46.5
Now with heal-harddrive.sh script included from Martin Sugioarto. Check Instructions of use.
You can grab it from Here. (48.4 Mb) root password: solobsd
With the pending departure of Chris Buechler, we wanted to
find a way to express to the community our continued commitment to keep
pfSense® software open source.
As such, pfSense is moving to the Apache License 2.0 in order to align the goals of the project with other (unannounced) offerings from Netgate. The Apache License 2.0
is a permissive license similar to the MIT License. The main conditions
of this license require preservation of copyright and license notices.
Where the 2-Clause and 3-Clause BSD licenses provides no direct
language around the areas of copyright, patents and trademarks, the
Apache License does. The Apache License is very clear that individual
contributors grant copyright license to anyone who receives the code,
that their contribution is free from patent encumbrances (and if it is
not, that they license that patent to anyone who receives the code,) and
that use of Trademarks extends only as far as is necessary to use the
product. As a reminder, only genuine pfSense software can bear the
registered trademark of pfSense. It also includes a patent termination
clause, should a lawsuit arise.
The Apache License 2.0 is the third most popular license on github. Android, Apache, Chef, Docker, OpenStack, Salt Stack, and Swift use the Apache License 2.0.
Now pfSense does as well.
Today on the show, we are going to be talking to Jim Brown
(of BSD Cert Fame) about his home-brew sprinkler system… Wait for it…
That runs FreeBSD!
That plus news & of course your feedback, keep it tuned to BSD Now, the place to B...SD!
The source tree for the Lumina desktop
has just been soft-frozen in preparation for the upcoming release of
version 1.0.0 in mid-August (tentatively targeting August 8th for final
reviews/checks).
This means that all interface elements (GUI’s, widgets, etc) as well
as any text which requires translation may no longer be changed without
approval from both Ken Moore and the documentation team (basically only
things like bug fixes or spelling errors).
This is now the time to go through and perform any translations of
the Lumina desktop in preparation for the release. You can see the
current translation progress and help perform translations on the PC-BSD translations website.
We have also created a new tarball of the Lumina source tree on github (v1.0.0-Beta2)
so that package distributors have time to audit their current build
systems and ensure that the Lumina files/binaries are being packaged
properly (please report any packaging issues ASAP so that we can adjust
things as necessary). This is very important as a few binary names and
install locations for files have changed, and some optional dependencies
have changed as well (“compton” may be used instead of “xcompmgr” for
example).
This week on the show, Allan & I are going to be showing you
a very interesting interview we did talking about using FreeBSD to
drive a Robot! You won’t want to miss this one. That plus all the latest
news, heading your way right now!
Today on the show, we are going to be chatting with Michael
Dexter about a variety of topics, but of course including bhyve! That
plus the latest news is heading your way right now on BSDNow, the place
to B….SD!
In my two previous posts I talked about creating a new port and
copying a port from head to a branch. The goal of this post is the
creation of a new function: CreatePortOnBranch($category_name,
$port_name, $CommitBranch) The failed start I started out with this
stored procedure: Running it gave this message: # select
CreatePort('sysutils', 'bacula-server', [...]
We are pleased to announce the availability of the LibreSSL package
repo for 11-CURRENT/amd64. This repo is based off of the
LibreSSL-in-base branch (hardened/current/master-libressl) that Bernard
Spil has been working on. Going forward, along with providing binary
updates for that branch via hbsd-update(8), we will also
provide binary packages. We will also provide binary packages soon for
the LibreSSL 10-STABLE branch (hardened/10-stable/master-libressl).
Having both the feature branches along with package repos will allow us
to investigate making LibreSSL the standard in HardenedBSD.
We would like to thank Bernard Spil for his continuous hard work.
We're glad to have him on the team. Thanks to him, HardenedBSD is the
first downstream FreeBSD project to have both LibreSSL in base along
with a package repo that matches.
On this episode of BSDNow, we will be talking to Glen Barber
& Peter Wemm of the FreeBSD RE and Cluster Admin teams! That plus
our re-cap of BSDCan and the latest news, all on your place to B...SD!
For those interested in the latest developments of ubuntuBSD,
the developer mentions that the official release will come bundled with
BusyBox and OpenRC, sans systemd. You can try out the BETA version from
their website. In a series of tweets, ubuntuBSD project leader Jon
Boden has announced a few of the technical features coming to […]
It has been a long journey for HardenedBSD and OPNsense, and finally
the paths start to merge as the splendid and battle-proven ASLR
implementation gets incorporated into the default installation! It is
just the beginning as we will start to leverage the extra security by
enabling position independent execution in 16.7 and merge more
security-related features. We thank again the HardenedBSD team for their
continued efforts on making this world a safer place.
In other news, there is a thoroughly revamped dashboard for you to
enjoy and a handful of security fixes in FreeBSD and the ports
ecosystem. LibreSSL has been updated to the latest production release
and the BETA version is progressing nicely as we change our working mode
from “rework all the things” to “polish all the things”. A release
candidate is coming up soon.
Hi everyone,
The FreeBSD Foundation needs your input. Please help us by filling out
the 2016 FreeBSD Community Survey. The survey should only take about 10
minutes, and will help us determine the direction of our efforts in
supporting the Project and community. Please submit all responses by
July, 7, 2016.
https://www.surveymonkey.com/r/freebsd2016
We appreciate your feedback!
Thanks
Anne
Anne Dickison
Marketing Director
FreeBSD Foundation
A brief description of playing around with SunOS 4.1.4, which was the last version of SunOS to be based on BSD.
File Info: 17Min, 8Mb
Ogg Link: https://archive.org/download/bsdtalk265/bsdtalk265.ogg
It’s only one-week away from BSDCan, both Allan & I are
excited to meet some of you in person! However, the show keeps on
chugging & this week we have an interview with Kristof Provost, to
tell us about PF improvements in FreeBSD. That plus the latest news,
here on your place to B….SD!
We are excited to announce the ability to easily utilize Integriforce with base. From now on, hbsd-update(8) will install a full Integriforce ruleset as /etc/secadm.d/base.integriforce.rules for base. If you include this file in your normal secadm.rules(5)
ruleset, you will get full integrity enforcement on all executable
files in base. If you include the applications from ports/packages in
your secadm.rules(5) file, you can turn on whitelisting
mode, in which case, all executable files that aren't protected by
Integriforce will be denied execution. If you only utilize applications
from base, you can turn on whitelisting mode and get the same results.
Using the Integriforce ruleset is entirely optional, but highly recommended.
An example secadm.rules file might look something like this:
2.3.1 Update 1 (2.3.1_1) is now available. This includes one
security fix to the web GUI, and 7 other bug fixes. The 2.3.1-RELEASE
change list has been updated with an Update 1 section specifying the changes.
This update will reboot the system after installing.
The NetBSD Project is pleased to announce NetBSD 7.0.1, the
first security/bugfix update of the NetBSD 7.0 release branch. It
represents a selected subset of fixes deemed important for security or
stability reasons. If you are running an earlier release of NetBSD, we
strongly suggest updating to 7.0.1.
For more details, please see the release notes.
Complete source and binaries for NetBSD are available for download at
many sites around the world. A list of download sites providing FTP,
AnonCVS, SUP, and other services may be found at http://www.NetBSD.org/mirrors/
This second ALPHA development release is for
testing and debugging new feature in GhostBSD 10.3, MATE and XFCE is
available on SourceForge for the i386, amd64, and amd64-uefi
architectures.
Most Free/Open Source Software users run Linux as their operating
system of choice, choosing one (or more) of the 300 or so distros
currently active on DistroWatch. Not as many have crossed the street,
rhetorically speaking, and taken a look at the other Open Source
operating system, BSD and its many variants.
As a long time and current Linux user new to PC-BSD — essentially the BSD equivalent to Linux Mint — my intention is to:
· Outline the (many) similarities and (few) differences between Linux and BSD,
· Walk the audience through the process of moving from Linux to BSD,
unless the audience is in a hurry, then I’ll run them through it,
· Describe the ease-of-use and pitfalls of day-to-day use of PC-BSD for the average user, and
· How to pitch in and make code and other contributions (e.g.,
documentation, translation) to BSD variants, even while doing the same
for Linux distributions,
· And more!
This year's dotSecurity conference featured a presentation from OpenBSD founder Theo de Raadt, titled "Privilege Separation and Pledge."
The video is now available here, in addition to the slides.
This week on BSDNow, we have an interview with Matthew Macy, who
has some exciting news to share with us regarding the state of graphics
on FreeBSD. That plus all the latest news on BSDNow, the place to
B...SD!
Progress on the armv7 platform continues, and Jonathan Gray writes in to the arm@ mailing list with some promising news:
There is now a bootloader for armv7 thanks to kettenis@
Recent armv7 snapshots will configure disks to use efiboot and install
device tree dtb files on a fat partition at the start of the disk.
u-boot kernel images are no longer part of the release but can still
be built for the time being. We are going to start assuming the
kernel has been loaded with a dtb file to describe the hardware sometime
soon. Those doing new installs can ignore the details but here they
are.
This week on BSDNow, Allan is back in down from Europe! We’ll
get to hear some of his wrap-up and get caught up on the latest BSD
news. That plus our interview about Backtrace.io! Keep it tuned to
BSDNow, the place to B….SD!
A few months ago, we added
Bernard Spil to the HardenedBSD team with a goal to bring in and
maintain LibreSSL in base. Given the effort involved in maintaining such
a complex piece of software, we at HardenedBSD have made the decision
to keep it as a feature branch in the playground repo for now. Those who
wish to check out Bernard's awesome, hard work can check out the repo here.
We will soon start auto-syncing that feature branch on our normal
six-hour cycle and we will produce periodic binary updates. As of today,
the first binary update has been published. You can use thishbsd-update.conf file to tell hbsd-update
to switch to the LibreSSL branch. If you wish to compile your own
version of HardenedBSD with LibreSSL base, you will need to add WITH_LIBRESSL=yes to src.conf.
We would like to thank Bernard for volunteering. He has been a tremendous help. Here is a teaser screenshot.
As announced in the earlier wlog entry about server reorg
I’ve now switched over most services from the soon-to-be-defunct
eurynome to fish, with gecko2’s www.ig42.org
providing the redirection HTTP vhost for hostname-less mirbsd.org
requests (i.e. people who don’t know how this works) and, soon, fallback
HTTP services should they be needed. (He’s trusted with the SSL key and
certificate.)
This also involves switching SSH hostkeys for AnonCVS, unfortunately;
I’ve taken the chance to generate a fresh key for fish. Look in
/MirOS/ for the files (gzsig(1)
signed) hostkeys.gz or (PGP signed) hostkeys.asc for a
less-dependent source for the new keys.
cd /usr; make src-update
(or src-create-shallow if you don't already have source)
make buildworld && make buildkernel
make installkernel && make installworld
make upgrade
reboot
OpenBSD developers from around the world have just gathered in Nantes, France for the p2k16
hackathon. This event is technically a ports hackathon, but many
non-porters have showed up too, which means you can expect a variety of
different improvements.
As an early example, ajacoutot@ has just set sysmerge to run automatically during the upgrade process.
Head over to the hackathons page to see the artwork, and stay tuned to Undeadly for some post-hackathon reports.
This week on the show, we will be talking to Benedict Reushling
about his role with the FreeBSD foundation and the journey that took him
there. That plus a few weeks worth of news to get caught up on, coming
up next on BSDNow!
On behalf of the EuroBSDCon 2016 Program Committee, here is the Call for Papersfor the EuroBSDCon 2016 conference which will take place in Bergrade, Serbiabetween 22-25 September 2016.
This week on the show, we will be interviewing GNN of the
FreeBSD project to talk about the new TeachBSD initiative. That plus the
latest BSD headlines, all coming your way right now!
Tomohiro Kusumi would like to port Hammer (1) to FreeBSD, as noted in this bug discussion. It’s not even begun to happen, but if you can contribute, please do.
Jordan Hubbard has announced the release of a new version of FreeNAS,
a network attached storage project that is based on FreeBSD. The new
version, FreeNAS 9.10, features the same user interface as the earlier
9.3 series, but with an updated FreeBSD core. "This
is an interim release between the 9.3 series and 10 (which is still a
few months away), using the same UI and middleware that everyone is used
to from 9.3 but with new OS underpinnings, specifically FreeBSD
10.3-RC3. Coincident with this release of 9.10, we are also placing 9.3
into maintenance mode and will only be pushing further updates to the
9.3-STABLE train in response to the most critical security advisories or
product flaws. We therefore strongly suggest that all current users of
9.3 upgrade to 9.10 in order to continue to benefit from the ongoing
maintenance and bug fix work we will be doing on the 9.10-STABLE train.
Most, if not all, bug fixes will be made exclusively to the 9.10-STABLE
train in reaction to tickets filed on http://bugs.freenas.org.
Again: Users who choose to stay on the 9.3-STABLE train will see only
the most critical bug fixes and no new features or non-essential
enhancements." This release also supports USB 3.0 devices and USB network adapters. Further information is available in the release announcement and release notes. Download: FreeNAS-9.10-RELEASE.iso (405MB, SHA256).
This quick 16.1.8 release is not a big update, but it means a lot. We
have finished our full sweep of the GUI to update the look and feel of
all pages and made the code ready for what is to come now: new features
that are on our roadmap for 16.7. The first one will be the HTTPS proxy,
but there is also NetFlow and improved statistics / reporting on the
shortlist.
A day after 16.1.7 was out last week, FreeBSD 10.2-RELEASE-p14 was
announced. Of the four patches enclosed, the two Hyper-V patches we have
already brought to OPNsense over a month ago, the OpenSSH patch does
not apply since we only use the port and already had it up-to-date. That
leaves us with only one patch that we are shipping now to complete the
experience.
Attention to everyone using OpenVPN + cryptodev acceleration: the
cryptodev module along with older crypto drivers has been removed from
the kernel itself, which means that if you need to keep using it, go to
System: Settings: Misc and reconfigure your crypto hardware including an
enable of cryptodev usage.
New images based on 16.1.8 will be out early next week.
Here are the full patch notes:
src: updated tzdata to version 2016b[1]
src: fix incorrect argument validation in sysarch[2]
src: fix pfi_table_update: cannot set new addresses
MidnightBSD
is around for more than 10 years, but still, the most of BSD users are
not familiar with it. That's why we decided to have a quick chat with Lucas Holt, MidnightBSD's founder and lead developer. We will talk about how he got started and what he is working on right now.
Lucas Holt is currently a Senior Application/Programmer Analyst - Team
Lead at the University of Michigan. In his own words, MidnightBSD is a
heavily modified version of FreeBSD 9.1 with a custom package manager,
the sensors framework, ZFS, utilities from NetBSD, OpenBSD, DragonFly
and MirBSD, and a good start on a desktop system.
This week on the show, Allan & Kris have gotten a bit more
sleep since AsiaBSDCon, which is excellent since there is a LOT of news
to cover. That plus our interview with Ports SecTeam member Mark Felder.
So keep it tuned to BSDNow, the place to B...SD!
This episode is brought to you by ftp, the Internet file transfer program, which first appeared in 4.2BSD.
An
interview with the hosts of the Garbage Podcast, joshua stein and
Brandon Mercer. You can find their podcast at http://garbage.fm/
File Info: 17Min, 8MB.
Ogg Link: https://archive.org/download/bsdtalk263/bsdtalk263.ogg
John Marino has added the starting framework to use clang as the alternate base compiler in DragonFly.
Note that it’s not hooked into the build yet. This is the first
non-GCC compiler added into DragonFly, so there’s some work yet before
you can have an all-clang system. This should replace GCC 4.7, which is
the current alternate compiler. GCC 5.0 is the default, if you didn’t
know.
Note that clang is present in dports, so it’s already been available
for general use, for some time. This framework is for building
DragonFly itself.
