OpenBSD 7.5

https://www.openbsd.org/75.html

by SoftTalker • 2 years ago

326 120 2 years ago

openbsd.org

brynet2• 2 years ago

Announcement mail: https://marc.info/?l=openbsd-announce&m=171228270018970&w=2

Panino2• 2 years ago

I'm currently switching my Go code to Rust in part because of the syscall related Go trouble:

Users of syscall(2), such as Perl and the Go programming language were converted to use the libc functions.

I think the following may still need to be converted:

  * unix.Pledge from golang.org/x/sys/unix
  * unix.Unveil from golang.org/x/sys/unix
  * terminal.ReadPassword from golang.org/x/crypto/ssh/terminal

qweqwe142• 2 years ago

Didn't Go already realize that it can't use direct syscalls on anything other than Linux? They made some mistakes in the past but by this point I think they learned their lesson.

On Linux, using direct syscalls is a good idea, since it's the stable userspace-kernel interface. There's really no need for libc on Linux, each language should just implement it's standard library on top of syscalls.

int_19h3• 2 years ago

They knew it all along, since it's well-documented. But they don't seem to care about it until they get burned. Which first happened on macOS, so that was switched; then OpenBSD.

This was previously discussed at length here: https://news.ycombinator.com/item?id=25999623

LAC-Tech• 2 years ago

There's really no need for libc on Linux, each language should just implement it's standard library on top of syscalls.

Rustix is a great implementation of that idea https://docs.rs/rustix/latest/rustix/

Any similar projects in other langs?

zokier2• 2 years ago

There's really no need for libc on Linux, each language should just implement it's standard library on top of syscalls.

Its not always not so clearcut. For example using pthreads instead of just calling clone can be useful for interop etc. Similarly, anything involving NSS is probably best done through libc. Having libc malloc integrated makes interacting with other C libs easier. And so on.

tedunangst2• 2 years ago

They were converted months ago.

citizenpaul• 2 years ago

Forgive my ignorance but is this something limited to go on openbsd? Or is it a general isssue with go?

ikmckenz• 2 years ago

Have you updated your packages with ‘pkg_add -u’?

Panino2• 2 years ago

Yes, I run -current so I update packages frequently.

After tedu's comment here I installed 7.5 in a VM and could build and run my Go software in it successfully, so I figured there were some Go build or config files or something somewhere getting in the way. I pkg_delete'd go, removed every Go build/config file I could find, and re-added Go with pkg_add. Now I can build apps with the previously mentioned modules; everything works fine now.

Thank you for the responses. :-)

a-french-anon• 2 years ago

Does anyone know if there's any plan to reintroduce xattrs in FFS2? Probably the only modern UNIX without it in its main FS(s).

Or for a more standard/modern FS like XFS (I don't expect OpenBSD to go for ZFS bloat).

ByQuyzzy7• 2 years ago

They made their FFS 64-bit. That’s what you get. And FFS is THE standard.

In short no. Also they removed softupdates, code was old and slow and was holding back the quest to unlock.

znpy• 2 years ago

And FFS is THE standard

What's that supposed to mean? ed is the standard text editor, yet we don't actually expect anyone to use it (let alone know it...)

jabl• 2 years ago

They made their FFS 64-bit.

What does this mean? 64-bit inode numbers? 64-bit timestamps? Something else?

Also they removed softupdates,

Shame in a way, I remember reading McKusick's paper and being impressed. But I guess it's the antithesis of batching, which turned out to be more important for performance than avoiding the extra I/O due to journalling. Also the implementation was AFAIU fearsomely subtle and tricky.

yjftsjthsd-h3• 2 years ago

Or for a more standard/modern FS like XFS (I don't expect OpenBSD to go for ZFS bloat).

At some point, I think I heard that they might use HAMMER2, which would be nice.

alberth5• 2 years ago

https://github.com/kusumi/openbsd_hammer2

A developer was making active progress, but hasn't made any commits since Dec

jmclnx2• 2 years ago

plan to reintroduce xattrs in FFS2?

With unveil(2) and maybe pledge(2), I do not think there is a need for Extended Attributes. To me, all it does is add complexities not really needed in OpenBSD.

zokier2• 2 years ago

I don't see how unveil/pledge is in any way related to xattrs

patrakov• 2 years ago

You confuse ACLs and xattrs. SAMBA uses Extended Attributes to store thinks like Hidden and System flags on files, so that Windows clients can manipulate them. NT ACLs, too.

omnibrain• 2 years ago

No song this time.

dbolgheroni• 2 years ago

Sometimes the song release comes after the software release.

bheadmaster2• 2 years ago

The removal of generic syscall(), and introduction of pinsyscalls() which registers the precise entry location of every system call used by a program, makes me think of some kernel-level ABI issues that Linux has.

In particular, kernel ABI is the main stable interface that Linux exposes - and all applications can just use syscalls directly without having to interface with the libc at all. However, that means that kernel must not change its ABI lest it risks breaking compatibility, and each functionality that isn't implemented inside of the kernel (e.g. GUI stuff) cannot be implemented completely portably.

However, using pinsyscalls(), a kernel can make sure that syscalls can only be called from the libc - therefore, making the libc de-facto ABI! Which allows for much more freedom in changing kernel ABI, as long as the libc follows through. Perhaps this way the system can go away from the syscall-level ABI and move over to the libc ABI / shared library ABI?

newpavlov3• 2 years ago

Honestly, I think that making libc THE system interface is a mistake. Ok, I understand issues with the Linux approach of exposing raw syscalls (though it works well enough in practice and ossification could be amended by some kind of syscall versioning scheme), but why in the world can't you introduce libsystem/libsyscall/libopenbsd which would contain only "syscall" functions? Why do you need all the C junk in a library for talking with OS?

tedunangst2• 2 years ago

Nothing stops you from making your own libsystem. Or still just making syscalls.

Nobody seems to understand how this feature works, even though it's quite simple. The process asks the kernel to only allow system calls from one segment. If you don't like that, don't ask for it.

pjmlp4• 2 years ago

UNIX is the C language runtime, so to speak, so naturally libc is THE system interface.

It only became something else, when C got standardised, a tiny subset of it landed into ISO C, grew beyond UNIX, and the rest of the UNIX API surface landed at Open Group's POSIX.

Obviously on the UNIX world nothing changed, until GNU/Linux came into scene and decided to act in another way, due to being GNU ecosystem + Linux kernel combo.

ByQuyzzy7• 2 years ago

Do you know what Unix is or the C programming language? Your bafflement is entirely baffling. OpenBSD is never switching to Rust or Go or any of the new fad languages, so why not use libc? It’s the Unix way after all.

int_19h3• 2 years ago

libc is already de jure ABI on the BDSs though, no? Since the OS doesn't really guarantee their stability or portability.

bheadmaster2• 2 years ago

True, but making it de-facto ABI (by making syscalls impossible outside of the libc) would solve the problem of programs breaking on kernel breaking change.

dfc2• 2 years ago

Does anyone know the story behind the artwork? Puffy does not look so good.

gattilorenz• 2 years ago

Vaguely reminiscent of https://en.wikipedia.org/wiki/Creature_from_the_Black_Lagoon...

riffraff• 2 years ago

I thought it was a nod to the statue of liberty at the end of Planet of the Apes (1968). I miss the days all OpenBSD releases came with a song!

greyface-2• 2 years ago

https://en.wikipedia.org/wiki/Ozymandias

NortySpock• 2 years ago

If you prefer to hear it from a excellent narrator: https://youtu.be/xbLdz1kcQNw

dfc2• 2 years ago

Do you know this to be the inspiration for the artwork or best guess?

krylon• 2 years ago

Look upon my source tree, ye mighty, and despair!

lenerdenator3• 2 years ago

feels relevant looking over their list of discontinued architectures.

each was made by teams sure they were going to be the next big thing in some market space...

jaypatelani• 2 years ago

https://merveilles.town/@prahou/112217694585794119

ch0ic32• 2 years ago

For anybody wondering about the new pinsyscalls(2) suggest having a look at https://isopenbsdsecu.re/mitigations/pinsyscall/ . To be clear: I use OpenBSD on all my external-facing systems. I trust it infinitely more than any GNU/Linux distribution (esp with the recent xz.. "issue"), but I think it's important to do your own research and see what the contrarians say from time to time.

calvinmorrison• 2 years ago

Do you think there's more value in combining 2 heterogenous systems (like openbsd up front, linux behind) than using one 'more secure' system throughout? I feel like the number of critical issues that have faced two systems at once is far fewer than a single system.

Also I think it shows value in having independent implementations of standards. If you have 5x different xz tools or C compilers or Javascript engines, the threat is chopped in half, plus you can easily compare reference outputs between them (RE: on trusting trust)

wannacboatmovie• 2 years ago

It's common practice for the ultra paranoid to use two firewalls, from different vendors, back to back, for this reason.

terlisimo• 2 years ago

There is a name for this https://en.wikipedia.org/wiki/Swiss_cheese_model

ch0ic32• 2 years ago

For sure! An argument in OpenBSD circles is that contrary to popular belief one can have security through depth. This means that even though you'll never be 100% secure you can definitely make an attacker's job harder and their life more miserable. Of course, if the NSA wants to attack you then they'll probably succeed, but for your average script kiddy / botnet scanner / worm exploiting some vulnerability having multiple layers might be enough of a deterrent.

I'm not a security person but I also think a lot of malware damage comes from companies / users using misconfigured or outdated software. As such, if you were a sysadmin, knew what you were doing and had the time, then running GNU/Linux is probably fine, but I'm not super knowledgeable. I just want to host a website or run a tor-relay on a VPS and not have to worry about updating my system as soon as some 0-day is announced in glibc or systemd; even if it's in the service itself, my hope is that by using a non-mainstream OS the exploit might not initially target it, hence giving sufficient time to see the news somewhere and patch / update.

nanolith11• 2 years ago

This site is often fairly balanced, but I think the author often jumps to conclusions. The pinsyscall feature is one place where many security researchers have jumped to conclusions, because they only see it from their narrow x86 oriented view.

Yeah, on x86, I can craft a ROP attack that allows me to discover relocations for functions fairly trivially, especially for coarse ASLR, because I can read the text segment. But, ARM64 has execute-only support so that it's possible for code to execute, but not read, a text segment. In this situation, pinsyscall does add a valid defense in depth layer. It's still imperfect, but this does in fact raise the bar necessary to carry out a ROP attack when combined with randomized re-linking on boot ASLR. Further, once dynamic linking has occurred, the text segment for a binary is made immutable so that no mapping changes can occur, including mmap.

I think that OpenBSD still has a long way to go before all of these defenses align, but they are far less trivial than the author makes them out to be, because none of them are meant to be used alone. OpenBSD developer decisions like these can sometimes appear to be casting about randomly, because they are making small improvements instead of building toward a particular goal. Sometimes, they hit gold as with W^X, which was widely adopted. Sometimes, their ideas stink, like systrace. But, I don't think it's wise to just dismiss these ideas out of hand.

Instead, I recommend that people look to the history of OpenBSD, which has been more of an evolutionary approach to security instead of a revolutionary approach (i.e. Fuchsia). From an evolutionary perspective, pinsyscall makes sense as it is low-hanging fruit that can buy some security and can force applications to use a standard interface (libc) instead of making raw system calls. From a revolutionary perspective, pinsyscall just seems like a dead end. Revolutionary design has convergent effects -- all of the pieces come together in a perfectly engineered defensive shell. Evolutionary design has emergent effects -- fixes and features build on each other until they co-evolve into strong defenses.

alberth5• 2 years ago

Since you're clearly knowledgable ...

What's your take on http://cheribsd.org (and CHERI as a concept overall)?

pstuart• 2 years ago

Would the evolutionary approach be an advantage in allowing existing code bases to run with minimal modifications? So not perfect but safer than linux with minimal effort?

brynet2• 2 years ago

ARM64 has execute-only support so that it's possible for code to execute, but not read, a text segment.

OpenBSD does xonly by default on multiple architectures (arm64, risc-v, ... g5 powerpc), including even amd64 on recent Intel/AMD CPUs supporting MPK/PKU:

https://marc.info/?l=openbsd-cvs&m=167423045918820&w=2

On machines that lack hardware-enforcement, at least on CPUs that can differentiate between traps for instruction-fetch and data-fetch, there is still benefit:

https://marc.info/?l=openbsd-cvs&m=167517831914525&w=2 (msyscall(2) part is now handled by pinsyscalls in -current)

lenerdenator3• 2 years ago

Would it be correct to say that OpenBSD is far more of a unified approach to kernel and userland development than GNU/Linux? As in, both ship as one unit, end-to-end, instead of interchangeable modules that make up GNU's ecosystem?

alberth5• 2 years ago

That's correct for all BSD's, not just OpenBSD.

BSD = kernel + userland

alberth5• 2 years ago

Does pinsyscall mean Cosmo will no longer work on OpenBSD?

https://github.com/jart/cosmopolitan

The_Colonel• 2 years ago

Copyright 1997-2024, Theo de Raadt.

Caught my eye. I'm vaguely aware that Theo de Raadt is not the paragon of modesty, but would still expect a more "communal" copyright. Or is OpenBSD largely a one-man show?

ninjin• 2 years ago

One would probably have to define "one-man show". But, no, Theo does not write most of OpenBSD's code. Although he certainly is the leader of the project. If the copyright statement bothers you, I can recommend the announcement e-mail (see "THANKS" in particular):

https://marc.info/?l=openbsd-announce&m=171228270018970&w=2

You will also find separate copyright statements in a lot of the source files and many carry the name of their authors.

gtirloni• 2 years ago

Uh? Of course it's not a one-man show.

https://github.com/search?q=repo%3Aopenbsd%2Fsrc%20copyright...

jmclnx2• 2 years ago

Are you referring to the text in the WEB Page ?

https://www.openbsd.org/75.html

I think that is because Theo de Raadt maintains the Site. As someone said the source files have their own copyright comments.

phone8675309• 2 years ago

I believe that copyright notice is for organizing the layout of the actual distribution images (ISO, etc) and for the music and artwork (though work-for-hire), not that Theo de Raadt is claiming copyright over all of the code in the distribution.

ByQuyzzy7• 2 years ago

The advantage of Theo being dictator is that big companies can’t take over like they did with Linux.

flykespice• 2 years ago

Linus is still dictator in the Linux kernel...

clort• 2 years ago

The problem with having a benvolent dictator is that the system is set up for a dictator to control things, and the chances of the next dictator being quite as benevolent are low.

perhaps Theo has a plan for an eventual succession, perhaps not. Sometimes dictators can't really conceive of somebody else running the show so they don't plan for it.

shrubble• 2 years ago

Is the artwork a reference to the poem, Ozymandias?

rydgel• 2 years ago

it is

another2another• 2 years ago

Always interesting to see the amount of work going into LibreSSL, but I'm not sure how much use it gets outside of OpenBSD which seems a bit of a shame.

anonymous_union• 2 years ago

apple ships it

lemper• 2 years ago

what i enjoy the most when openbsd has a new release is their new song. my favourite is the legend of puffy hood.

https://www.openbsd.org/lyrics.html

kstrauser• 2 years ago

“Pond-erosa Puff” lives in my head.

I think we’ve been using this a while, huh?

dyingkneepad• 2 years ago

Does anybody know what are the major companies employing OpenBSD developers these days? To what level are they invested?

alberth5• 2 years ago

I think this will be difficult to know, because IIRC, to commit to OpenBSD you must use an @openbsd.org account.

So it's not like you can just look at the commit log and search for private company @names

http://cdn.openbsd.org/pub/OpenBSD/Changelogs/

whitepoplar• 2 years ago

Can anyone comment on the OpenBSD security model in 2024? Is it more secure than a minimal linux distro (or one configured to be so) such as Ubuntu Minimal or Debian Stable?

I'm finding it quite difficult to compare OS "security" these days, whatever that means. Everyone seems to have their own crackpot opinions. If anyone with a security background could chime in, I'd be forever grateful.

ranger_danger• 2 years ago

As far as I know, all of these statements are still true:

https://web.archive.org/web/20220227172102/https://madaidans...

https://isopenbsdsecu.re/

yjftsjthsd-h3• 2 years ago

OpenBSD has no Mandatory Access Control (MAC) system like AppArmor or SELinux which prevents you from fully locking down user space.

Isn't that pledge?

And in general, I observe that lots of people are happy to say that OpenBSD's protections are no good, but somehow they can't be bothered to actually show a working exploit.

zvmaz• 2 years ago

Is OpenBSD used in industry, in critical systems, etc.? If so, what are some examples of its use? Truly interested to know.

mrweasel• 2 years ago

m:tier (https://www.mtier.org/refs/) claims to have customers in the oil and gas industry.

tranxen2• 2 years ago

There was this interesting talk [1] about how this ISP uses OpenBSD as BGP control plane.

I used to heard that OpenBSD was often used as Internet facing middlebox (like firewalls/proxy/network load balancer) because of how good pf and relayd are.

But it would surprise me if it would still be the case nowadays, OpenBSD seems to perform poorly [2] in terms of network throughput compared to the competition (VyOS/VPP). And I don't think this 7.5 upgrade helped a lot regarding this topic.

[1] https://gregsowell.com/?p=7069 [2]: https://ipng.ch/s/articles/2021/07/19/pcengines-apu6.html

binkHN• 2 years ago

https://ipng.ch/s/articles/2021/07/19/pcengines-apu6.html

Nice little write-up. I found it interesting that OpenBSD outperformed Linux, but DPDK-based systems blew the roof off.

sjaak• 2 years ago

Just upgraded my small homeserver

   sysupgrade; sysmerge; pkg_add -u;

Done! What a delight!

OpenBSD 7.5

Related Stories