Earlier quoted context omitted.
Thanks. It was not evident from the example whether root inside of the sandbox is necessary - I assumed creating arbitrary symlinks doesn't require any particular capabilities, and there's nothing special about the locations. Though it's not clear to me now: - why was this patched then? - is the point about root that non-root wouldn't have access to passwd anyway?
OpenBSD doesn't have separate user accounts for sandboxes. These sandboxes are not linux-style containers, they're narrowed views of the full install. If you're root inside the sandbox, you're root outside it. This exploit requires you to already be root.
OpenBSD 7.9
241–250 of 314 posts
Re: OpenBSD 7.9
#242Earlier quoted context omitted.
Is OpenBSD actually more secure than Linux? I have not been able to find any data to support this—only some vague opinions.
It's not meaningfully more secure than e.g. Debian. Their claim to fame ("only two remote holes in the default install in X number of years") is definitionally only valid for the default install in its default configuration which means: no httpd, no smtpd, no unbound, etc. etc. etc. The default install isn't very useful, because it doesn't do a lot, and so "only two remote holes" or whatever isn't really saying much.…
Re: OpenBSD 7.9
#243Earlier quoted context omitted.
No, not really. Linux has better options available and is significantly stronger when configured correctly. The OpenBSD approach ls largely based around eliminating bugs in the first place, but isn't as strong at limiting an attacker that successfully exploited a bug they missed or weren't responsible for.
Sorry but that's simply not true. There are various cases where vulnerabilities didn't affect OpenBSD due to defense in-depth in OpenBSD. OpenBSD has a pretty long history of eg. limiting attacks through compile time mitigations while making them more usable for every day use compared to specialized "high security" Linux distributions. This can also be seen in patches of third party software (in the ports (packages)…
OpenBSD didn't invent the concept behind W^X, and if you want to talk of 'copying', which I think is kind of silly personally, then PAX was first.
I'm familiar with the list of OpenBSD innovations, and in turn I would point you to https://https://isopenbsdsecu.re/ for a breakdown of their claims and marketing.
To this date OpenBSD doesn't have anything as simple as a proper ACL, let alone any type of MAC. They claim such systems are too complex, which is of course nonsense.
It's like I said - they focus a lot on preventing an attacker gaining access, but have little available to constrain attackers who DO get access.
Re: OpenBSD 7.9
#244Re: OpenBSD 7.9
#245Earlier quoted context omitted.
Ah, losing the 2.4ghz USB dongle ... Sucks. Feel you. :-( Wireless Earbuds/Headphones are a legit use case. (Still use bluetooth with iPhone every day, sadly, still addicted to the convenience of AirPods ...) But I've got decent wired headphones for my OpenBSD setup. bonus: never have to charge them. ;-) Even more curious now: what do you use the Nintendo Switch controller for on your computer? Have you got it hooked…
Switch controller gets used for flight simming, just as a simple analog input that I can take to the couch (or bed). I've also got a wired pair of my wireless Audio Technica headphones, but I'm not confident that my DAC (or Bitwig for that matter) would work as well on OpenBSD as it does on Linux. For desktop use, I don't think I'll ever end up on OpenBSD. It might power my gateway router one day, but the cost/benefi…
For others who cannot live without Bluetooth on their main machine, consider a USB Bluetooth adapter. see: https://man.openbsd.org/OpenBSD-5.1/ubt.4
Re: OpenBSD 7.9
#246Anyone here using OpenBSD? If so, for what purpose? I’ve always wanted to use NetBSD for an application for an embedded system / IoT device but never had the pleasure (yet!).
Work: I need a simple easy to use system that I can configure to meet third party compliance requirements without jumping through hoops. It really excels when you can mostly use the base system there, maybe couple services. For example it's so nice to just have a couple pledge/unveil lines for example in a Go service.
Also super nice for "set and forget" style stuff. For example "I just need a HTTPS server with acme and SFTP". That's something you get out of the box with no third party packages (so everything vetted, pledge/unveil for everything, maintenance just running syspatch and sysupgrade), which is really nice.
Personal: Private mail server, family website, a quick and dirty "watching streams together" service I set up to watch stuff with people not in the same place as I am. prosody to have XMPP for friends and family.
I would NOT use it for "people throw stuff at you" use cases (Linux and FreeBSD do a far better job there). But I absolutely love it for scenarios where you want very very low maintenance. For example that private email server. I don't have time to do big upgrade plans, or "hardening" systems or reinventing the wheel. I cannot afford to do privately what I do in a day job or consulting (setting up or maintaining really rather complicated infrastructure).
I have done that many years with Debian, but the Linux world sadly is a big complex and complicated mess. That's great, when I get paid to deal with it, but annoying otherwise.
And I don't mean that bashing wise. I use Linux, I like Linux, but somehow there is a huge drive to overengineering and then building hacks and weird workarounds that become normalized until it's a proper job. Without wanting to start a flame war, but the whole Docker, Containers, Kubernetes, Helm, Orchestrators, etc. story is a lot of reinventing the wheel and a static executable like a Go service in a container, so essentially coming with a whole Linux distribution even though one never thinks about it that way is just really absurd. That's what executables, processes, etc. were invented for.
And since I've lived through the story and as mentioned make a limit, I understand how that came to be, but it feels like the industry took a wrong turn because it was cool and exciting and then (nearly) everyone decided to use that hammer for everything one could imagine to be a nail. And then the next layer came and the next and the next. But all of them doing things differently. And suddenly to have a Postgres cluster you need Kubernetes, and Helm, but also need to know both PG config and the orchestrator's config, etc.
It's a mess and the OpenBSD people somehow knew that decades before I did.
Re: OpenBSD 7.9
#247Re: OpenBSD 7.9
#248Earlier quoted context omitted.
Sorry but that's simply not true. There are various cases where vulnerabilities didn't affect OpenBSD due to defense in-depth in OpenBSD. OpenBSD has a pretty long history of eg. limiting attacks through compile time mitigations while making them more usable for every day use compared to specialized "high security" Linux distributions. This can also be seen in patches of third party software (in the ports (packages)…
It really is true. OpenBSD focuses on auditing. In many cases they were not affected because of mitigations, but because they were just using a different stack. OpenBSD wasn't affected by regreSSHion for example, for basically the same reason Alpine wasn't. OpenBSD didn't invent the concept behind W^X, and if you want to talk of 'copying', which I think is kind of silly personally, then PAX was first. I'm familiar wi…
This is partially true; there are numerous other things that are done for mitigation outside of this.
Re: OpenBSD 7.9
#249I would really love to adopt OpenBSD but the one thing I can't deal with is the absence of journalized filesystem. Just the idea not to be able to recover after a power cut and work is hard to accept to be honest. I have been recently considering running it on a minimal Alpine ZFS host but I am not sure how much I can optimize the display experience since I do not think OpenBSD support QXL/SPICE. I would be curious i…
Re: OpenBSD 7.9
#250Earlier quoted context omitted.
OpenBSD doesn't have separate user accounts for sandboxes. These sandboxes are not linux-style containers, they're narrowed views of the full install. If you're root inside the sandbox, you're root outside it. This exploit requires you to already be root.
But the issue of root and accessing outside of the sandbox is orthogonal, no? Even if you're logged in as XYZ, accessing XYZ's contents outside of the sandbox is still a breach and a problem. Or does this issue require actual root to manifest?
So, yes, you need to have root on the box to set up this exploit.