Live data from Hacker News

HardenedBSD: Feature comparison vs other BSD distros

hardenedbsd.org

41–43 of 43 posts

Re: HardenedBSD: Feature comparison vs other BSD distros

#41
post #25
post #4

Earlier quoted context omitted.

Not only sandboxed, but many are pledge(2) 'd now also. One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe syspatch(8) changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken) Same with packages - unless you use mTier to get binar…

> Not only sandboxed, but many are pledge(2)'d now also. And here I was thinking that pledge(2) was the sandbox. Did I miss something?

In a way, just not in the traditional filesystem sense; e.g., jail, chroot.

Pledge allows a program to 'promise' which calls it is expected to make. For example, a program promising only to use 'stdio', will SIGABORT if you try to open a socket, fork, exec, or anything not part of the stdio group (as defined by pledge)

https://man.openbsd.org/pledge.2

Re: HardenedBSD: Feature comparison vs other BSD distros

#42

Earlier quoted context omitted.

would probably need to add special list entries for how far behind dragonflybsd is.

what are some of the examples of the entries, that make DragonFly BSD far behind others? I just finished setting up a number of simple dev/test environments for a simple jdk8-based backed service, on DragonFly 5.2.2, using default DF configs. So wanted to understand what I might need to look for hardening (I am still rather far from production, though) ).

Enable this https://gitweb.dragonflybsd.org/dragonfly.git/commit/2620a64...

It will be enabled by default by the next release apparently.

Post reply on HN