21–30 of 139 posts
This seems like a big deal: One thing to note: this will be the last version of OpenBSD to be pressed on CD. The project will now focus on internet-only distribution, giving much more flexibility in the release schedule.
It does? I was under the impression the only reason anyone still did that was to give something physical to donators.
Earlier quoted context omitted.
It does? I was under the impression the only reason anyone still did that was to give something physical to donators.
Perhaps I'm the only person using computers in 2016 who only installs OpenBSD via CD :-)
ps: a bit like vynil lovers who take their player out for similar reasons.
Earlier quoted context omitted.
If I understand correctly, this also means that the main excuse for it not being supported on DigitalOcean is now alleviated. :- )
Doesn't DigitalOcean use KVM?
Seems some other people were confused. I've been told in other places that it's Xen. OpenBSD has had working virtio-blk and virtio-net drivers since about 5.3/5.4/5.5 IIRC. hmm...
> "Unfortunately there is important third-party code, such as just-in-time compilers, that still uses mmap(2) to make memory both writable and executable, so for the time being, we have to arrange ourselves with it."
If a program wants to JIT on OpenBSD, how should it do it in a secure, OpenBSD-approved way?
This seems like a big deal: One thing to note: this will be the last version of OpenBSD to be pressed on CD. The project will now focus on internet-only distribution, giving much more flexibility in the release schedule.
It does? I was under the impression the only reason anyone still did that was to give something physical to donators.
It's a niche concern of course, but I suspect it's a little bit more common in the OpenBSD community than in many others. Of course it shouldn't be too hard for those users to build their own install boot CDs with the tarballs for installation, just skip the big package sets and install them later if the whole won't fit on the disc.
One big step in this release is the mandating of W^X by default. > "Unfortunately there is important third-party code, such as just-in-time compilers, that still uses mmap(2) to make memory both writable and executable, so for the time being, we have to arrange ourselves with it." If a program wants to JIT on OpenBSD, how should it do it in a secure, OpenBSD-approved way?
This is good portable programming practise anyway...
Yay! I get to spend 5 hours figuring out how to update the syntax for my pf.conf rules.
Gets PF for free, complains.
One big step in this release is the mandating of W^X by default. > "Unfortunately there is important third-party code, such as just-in-time compilers, that still uses mmap(2) to make memory both writable and executable, so for the time being, we have to arrange ourselves with it." If a program wants to JIT on OpenBSD, how should it do it in a secure, OpenBSD-approved way?
Use mprotect(2) on the region of memory that the program wants to make executable. http://man.openbsd.org/OpenBSD-current/man2/mprotect.2 This is good portable programming practise anyway...
How does this stop an attacker doing the same via ROP?
ADDED: The approach that comes to my mind is that they could have two processes. One process has the sourcecode, and pages where it can write code. The other process can execute the code. The code updates performance counters which the JITing process can read, so the JITter has feedback to know what to optimise.
However, this sounds a large architectural change, prevents programs JITting programs they generate on the fly, and causes the JIT to lack behind somewhat.
On the Mill CPU (disclaimer: I'm on the Mill team) the CPU can change processes ("turfs" in Mill terms) using a "portal" function call. This alleviates somewhat the performance concerns, as the JITted program can call into the JITer process synchronously and cheaply.
Earlier quoted context omitted.
Gets PF for free, complains.
Gmail is free, would you be happy if they updated it and your email didn't work anymore? I love OpenBSD but they constantly change the rule syntax for pf, which invalidates huge swaths of forum posts and other online documentation, even published books. The man page doesn't contain every conceivable explanation and example for every scenario either, nor could it, so that is also not a solution. Whether or not the pri…