Xorg can now run without privilege on OpenBSD

http://undeadly.org/cgi?action=article&sid=20140223112426

by protomyth • 12 years ago

137 79 12 years ago

darklajid9• 12 years ago

I want to like OpenBSD. I'm so happy about openssh and like the whole mindset, philosophy. Or so I thought.

Recently (like, weeks ago) I investigated the big three BSDs for a small mail server project. OpenBSD was the first thing I looked at, I was especially interested in opensmtpd. Looking for documentation I stumbled upon [1] (note: Same aggregator, same domain. I consider that 'The canonical source for OpenBSD').

So that article praises the features of opensmtpd and then shows how to implement a filter. With this:

/* block idiots */ if (! strcmp(p->domain, "0pointer.net")) { filter_api_reject(id, 530, "You're not welcome, go away !"); return; }

At that point I shook my head in disbelief, labeled the author as person I don't want to read from again and moved on to NetBSD (and FreeBSD, still not sure with which one I'll go). OpenBSD's obviously for more elite persons and ad hominem attacks in random samples are .. I don't know. Funny? Cool with the users/the project? The Right Way™?

That project has lots of attitude problems.

1: http://undeadly.org/cgi?action=article&sid=20130130081741

octo_t• 12 years ago

OpenBSD is run by Theo de Raadt, who is famous for being a more acerbic version of Linus Torvalds.

atmosx• 12 years ago

I always wondered if he has half the skills of Linus when it comes to programming. But since I don't have the means to measure them (both geniuses in their own field), I just tend to speculate about it :-)

eurleif• 12 years ago

"This person said something I don't agree with[1], therefore they're an idiot." isn't nice, but it's also not ad hominem. Ad hominem is the other way around: "This person is an idiot, therefore I don't agree with them."

[1] http://bsd.slashdot.org/story/11/07/16/0020243/lennart-poett...

darklajid9• 12 years ago

Thanks a lot for correcting me.

I still doubt that 'I consider that guy an idiot' is a reasonable thing to write in an article about smtpd filters. And _technically_ I question the example for blacklisting a whole domain, while the 'idiot' is probably just one guy (and for all I know, he might share that domain with friends or family).

If someone says something (arguably) stupid, the reaction isn't to write something utterly braindead in response. At least not among adults. Plus, 'I think BSDs are holding us back' (or even: 'BSDs suck!' if you want to condense that and distill it a bit) is targeting a family of operating systems, that example code/comment targets a person. That's just .. socially awkward at best, if we're friendly.

sdfjkl• 12 years ago

moved on to NetBSD (and FreeBSD, still not sure with which one I'll go)

Generally, FreeBSD will perform better for servers and offers a larger feature set than the other two. NetBSD aims for maximum portability, and OpenBSD for security. Therefore I typically recommend FreeBSD for servers, OpenBSD for routers and NetBSD for playing around on oddball hardware.

protomyth4• 12 years ago

I use FreeBSD for our Samba / home directory server (ZFS), but use OpenBSD for mail, dns, and the router.

chrismsnz• 12 years ago

OpenBSD for security

I dunno, I hear this a lot. Sure OpenBSD has created and implemented some (often very bleeding edge) hardening features, but nothing that hasn't seen the light of day in something like GRSecuriy.

But the lack of other security layers and constructs seem puzzling to me. No RBAC-based system like selinux? No attempt to secure the supply chain until very recently with package signing? Chroot functionality inferior to something like FreeBSD's jails?

Not to mention that many services you would deploy an OpenBSD server for are provided by ports and not the base system, forgoing the strict auditing that OpenBSD provides.

I think for anything besides a standalone router or mail/DNS server you're probably better off looking at other general purpose operating systems like FreeBSD or Linux.

I should note here that I've used various BSD's for various jobs over the years, including OpenBSD. I enjoy using it and never had any troubles with it. I would still consider it for uses that don't require much stepping out of the base system.

kylebgorman• 12 years ago

Could you explain exactly why that triggered so much outrage for you?

(As it turns out, this doesn't meet the definition of an ad hominem since there is no attempt to invalidate any arguments from "0pointer.net".)

eksith• 12 years ago

It's funny you mention this. On the actual OpenBSD installation, if a non-privileged user tries to login and fails (bad password etc..), the error message is "Are you on drugs?"

No, seriously, that's the actual error message. I just double-checked in 5.4 and it's still there.

OpenBSD, for many reasons, is definitely an acquired taste in both configuration and documentation for said configuration. There are a lots of technical points that make it a great OS.

They're still only technical points, though.

Edit: Correction, it's not on initial login. Only on sudo. The rest of the list : https://github.com/toddfries/OpenBSD-usr.bin-patches/blob/ma...

darklajid9• 12 years ago

Hmm.. Humor's a special thing. I actually like those. They insult the user (me) for doing something stupid or wrong. Classy? Probably not. But fair game in my world.

"Hey, see this nice smtpd we created? Here's how you blacklist the domain of a Linux guy we like to make fun of/blame for everything wrong in the world" is .. childish. But again, sense of humor is certainly something that is open for interpretation and all..

anjbe• 12 years ago

That’s only part of the list of insults. Sudo has more, and you can see them on any platform by setting “Defaults insults” in /etc/sudoers. See the sudoers(5) manpage.

ajasmin• 12 years ago

What is that suppose to mean? NULL pointer bugs are the realm of idiots?

Is there a more troubling reference in here that I just don't get?

agwa• 12 years ago

That's Lennart Poettering (pulseaudio/systemd creator)'s personal domain.

emillon• 12 years ago

It's Lennart Poettering's website.

omnibrain• 12 years ago

0pointer.net is the website oft Lennart Poettering of pulseaudio and systemd fame.

jrockway2• 12 years ago

It's all posturing.

This is a common problem that people have; they read what's easy, rather than what's relevant. If you really want to learn about the BSDs, you have to read through the source code. If you go by what people write in blogs, all you're getting is someone's opinion, not what will actually run on your machine.

Finally, an OpenBSD tutorial using strcmp? I believe they spell it strlcmp.

dmm3• 12 years ago

OpenBSD has lots of fine documentation. Read the man pages they aren't generally useless like the gnu ones.

http://www.opensmtpd.org/manual.html

nitrogen2• 12 years ago

Well, when the owner of 0pointer.net steamrolls across the land with a new init system that takes over every aspect of the userland, and is Linux exclusive, I wouldn't be surprised to find OpenBSD developers a bit upset.

protomyth4• 12 years ago

Calling BSD irrelevant probably didn't sit well with many of them. I do wonder what darklajid would think an appropriate response would be? Seems rejecting his e-mail after he called you and yours "irrelevant" isn't that hard to believe.

also, as others have pointed out, not ad hominem

So, we get one more post where the first comment is basically a negative comment with not one word about the submitted story.

B-Con• 12 years ago

How possible is it that this is sarcasm or just a joke?

I know HN likes to pretend it can't ever read between the lines, but, seriously, are there even remote odds that that snippet you quoted is actually expressing deep feelings of superiority?

darklajid9• 12 years ago

You might be totally right. In that case I'm prepared for an apology.

That said, even here (mostly OS X/Linux as far as I can tell) there's Lennart bashing everywhere. Check a random systemd thread, you'll find lots of that. Expecting a friendly jab in some random text about the opensmtpd features (not related to _anything_ that is usually blamed on Lennart, funnily enough) is .. unlikely.

My reaction is based on my belief that it is much more likely to see these low punches instead of "Hey, I made a friendly joke about the domain of this Linux dude I'm cool with".

Bottom line: Sure, you might totally be right, I might be the jerk here and take everything the wrong way. So far I still don't believe that and consider that less likely.

raverbashing3• 12 years ago

Funny how they use the word "idiot" then use strcmp instead of strncmp for comparison.

icebraining• 12 years ago

Since they're comparing against a literal string, which is guaranteed to be NULL terminated, what's wrong with that?

Spittie• 12 years ago

I've recently came across this: http://bsd-geek.de/FreeBSD/NO_POETTERING.patch

I don't know (and doubt) if it got merged into FreeBSD, but it shows that lots of people just hate him.

darklajid9• 12 years ago

Wow. Well, that doesn't seem to be part of the FreeBSD ports tree as far as I can tell (at least not in this snapshot here).

What a sad idea..

lmm2• 12 years ago

I hate him because I had to spend some time fixing my sound, which had been working fine before, not for personal reasons. I don't think I'm being unreasonable.

Pacabel2• 12 years ago

I don't really see any hatred there.

Software he has been significantly involved with has caused problems for a lot of people in the past. The recent strife and disagreement surrounding systemd surely hasn't helped the situation.

If somebody has had bad experiences with multiple software systems developed by a particular developer/project/organization, it's totally understandable why they'd want to avoid that developer's/project's/organization's software in the future. Nor is it unreasonable to want to protect oneself in such a manner. Furthermore, this can be the case without holding any sort of hateful emotions toward the developer/project/organization in question.

Do you have a better name for such a flag that may not involve his name directly? It does seem like a very descriptive name for what it does, even if some people may incorrectly interpret it as being "hateful" or something like that.

steeve• 12 years ago

I've known Gilles (opensmtpd author) personally for close to 10 years. This is just his kind of humour.

That you might not find it funny, I get. But dismissing all the work that has been put on this project because of what your perceive as attitude is like you not using OpenSSH because you don't like Theo de Raadt.

shadowfox• 12 years ago

like you not using OpenSSH because you don't like Theo de Raadt

It looked to me like people do this sort of thing all the time? This happens even in non-tech scenarios (e.g. not reading an author's works because you don't like his politics, even when the work itself is non-political etc)

darklajid9• 12 years ago

Thanks a lot for sharing that. Without personal knowledge like yours a text medium (sans explicit "jk" or /sarcasm tags) is hard to parse right.

I'm not dismissing all the work, I just decided that I've to move on. The project (we're talking opensmtpd here?) very well might be great. This was just a crappy first impression. No hard feelings, no rage or whatever - it seems people think I feel much stronger about this than I actually do.

I was disappointed, consider this distasteful/low (see elsewhere in this thread: I certainly get that humor's different and context matters), decided that for me, personally, this isn't cool and moved on.

I really feel sorry for sharing this here by now, though. It was something that immediately came back to me when the OpenBSD headline came up, I found it worth commenting/sharing and now I started a big thread of .. noise. I'll make sure to remember this outcome next time I'm feeling the urge to post a rather unrelated/negative piece like this.

borando• 12 years ago

You don't need to run OpenSMTPD in order to get Xorg to work, of course. Also, OpenBSD is just the operating system. You can run whatever MTA you want.

Just a reminder, this thread is about Xorg running without privileges on OpenBSD -- an amazing feat!

dmm3• 12 years ago

undeadly is most definitely not the canonical source for openbsd. Just read the man pages.

http://www.opensmtpd.org/smtpd.conf.5.html

axman62• 12 years ago

I'm quite confused, you read a joke, which apparently you didn't like, on an unofficial (albeit heavily OpenBSD focused) blog, and that's a reason not to use OpenBSD? Isn't this almost the definition of an ad hominem argument towards OpenBSD? "I don't like something this person says so I won't use something he uses".

I used OpenBSD for years as a router on a Pentium with 32MB of RAM I got for free somewhere, and it was fantastic. It filtered all my traffic and ran Irssi with 8MB RAM to spare. It's an awesome operating system that I wish I had a good use for at the moment. PF was wonderful to work with. This seems like an absolutely ludacris reason to dismiss the system and I have no idea why it's the top comment on a thread about a interesting technical innovation. What is wrong with you people.

FeeTinesAMady• 12 years ago

Hey, nousernamesleft, you've been hellbanned. Your most recent posts are showing up as dead.

dobbsbob2• 12 years ago

That project has lots of attitude problems

I believe you have the attitude problem. How did you survive reading Phrack, early 2600, Linux kernel mailing lists or IRC if this tiny example of "block idiots" offends you. It wasn't even directed at you, it's just an example in a dev journal. This undeadly post is internal dev stuff on the mailing list, not the actual end user documentation which is the official man pages, that's where all the up to date and complete documentation is. Most of the humor is also European, so some Germans joking around on the pf or SMTPD mailing list may also offend you with their weird humor.

OpenSMTPD also works on Linux/MacOSX but I imagine the emails and actions of Steve Jobs or Torvalds might also offend you so better steer clear of both those projects. Better avoid GrSec/Pax twitter account too. Stallman has also said some pretty inflammatory things so the whole Gnu platform is off limits. I recommend installing MS Feelings 2.0

ja30278• 12 years ago

Absolutely agreed.

It seems that some people won't be happy until all human interaction is mediated through vapid, inoffensive office-speak.

poolpOrg2• 12 years ago

and still, it was totally worth it and I would do it again :-)

hiphopyo2• 12 years ago

Choose OpenBSD for your Unix needs. OpenBSD -- the world's simplest and most secure Unix-like OS. Creator of the world's most used SSH implementation OpenSSH, the world's most elegant firewall PF, and the world's most elegant mail server OpenSMTPD. OpenBSD -- the cleanest kernel, the cleanest userland and the cleanest configuration syntax.

jrockway2• 12 years ago

<strike>No</strike> Only <strike>1</strike> 2 remote root holes in the default install.

sillysaurus3• 12 years ago

Is this true?

axman62• 12 years ago

Are you implying this is a bad thing? What other operating system can claim even just an order of magnitude more holes? 2, in what, over a decade? That's incredibly good.

ams61102• 12 years ago

OpenSMTPD is great for people who need a basic MTA. The configuration is not voodoo and the man pages are good.

ars• 12 years ago

Do they block access to advanced features of the video card?

Can't a video card DRM read any memory on the system?

nitrogen2• 12 years ago

I imagine they would have a kernel driver that receives requests from the unprivileged X.org, sanitizes them, and sends safe requests to the hardware.

mcpherrinm• 12 years ago

Presumably there's still some portion of the graphics driver that has to live in the kernel, or otherwise use privileged operations to talk to the hardware. But that driver is a lot smaller of a surface to secure than Xorg, which is a much larger codebase with many complicated moving parts.

Users of a video card should be able to do so securely: Look at something like WebGL, where many of a graphics card's features are exposed to the web, which is very much untrusted code.

mikeash2• 12 years ago

I think you mean DMA, not DRM.

rlpb• 12 years ago

By DRM he probably meant: http://en.wikipedia.org/wiki/Direct_Rendering_Manager

stass• 12 years ago

Great accomplishment! Congratulations to OpenBSD folks!

guyzmo2• 12 years ago

In 2006 one of my teachers, Mr Etiemble, told us about a paper he's participated in to illustrate that no matter how good the security models can be at each level of abstraction, it only needs one piece of code that uses a vertical design to make the overall layers of security models worthless…

http://scholar.google.fr/citations?view_op=view_citation&hl=...

N.B.: That article is really worth a read!

And then, as one could have expected at the time, TdR had a really strong reaction on the matter (can't find the e-mail for reference), saying that OpenBSD is anyway secure, except if you want to have "modern accelerated graphics" (or something less subjective, that's iirc)…

…and here we are eight years later, to finally have the OpenBSD guys show off they've done it. I don't know if that should bug me they needed 8 years to patch that bug that was not really one (as per Theo) or if I should be amazed by the work done to secure that incredible mess that is Xorg :-)

cheers and gg, guys!

dbolgheroni• 12 years ago

http://marc.info/?l=openbsd-misc&m=139321387226212&w=2

sandGorgon• 12 years ago

FYI - the systemd project got a similar thing working on Linux a couple of weeks back. I think Wayland/Weston already leverages systemd to run without privileges.

Part of the whole discussion on why systemd was much more forward looking than anything else on Linux.

[1] https://plus.google.com/+DavidHerrmann/posts/ggK1tStCvJH

openbsddesktop• 12 years ago

Don't forget to donate:

http://www.openbsdfoundation.org/campaign2014.html

Thanks! :)

Xorg can now run without privilege on OpenBSD

Related Stories