Skip to content

Latest commit

 

History

History
130 lines (88 loc) · 2.27 KB

Recent OpenBSD Awesomeness.markdown

File metadata and controls

130 lines (88 loc) · 2.27 KB
Raw

Recent Awesome - 2015-07-30

  • The Jump
  • Taming the Beast
  • Do as I say, not as I do
  • Hell - Why is it so cold down here?

The Jump

Now in mandoc one can add "tags" to pages, allowing users to hop around to various locations.

Why not just use /?

What does it work with?

  • command line options
  • internal commands
  • environment variables
  • command modifiers

Taming the Beast

From the man page:

The current process is forced into a restricted-service operating mode. A few subsets are available, roughly described as computation, memory management, read-write operations on file descriptors, opening of files, networking. In general, these modes were selected by studying the operation of many programs using libc and other such interfaces.

  • Restrict system operations
  • Simple to add to existing applications
  • Attempts to access restricted syscalls result in SIGKILL

Operations that can be restricted:

  • computation
  • memory management
  • read-write operations on file descriptors
  • opening of files
  • networking

Simple to add

Index: bin/cat/cat.c
===================================================================
RCS file: /cvs/src/bin/cat/cat.c,v
retrieving revision 1.21
diff -u -p -u -r1.21 cat.c
--- bin/cat/cat.c	16 Jan 2015 06:39:28 -0000	1.21
+++ bin/cat/cat.c	24 May 2015 01:03:25 -0000
@@ -35,6 +35,7 @@
 
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/tame.h>
 
 #include <ctype.h>
 #include <err.h>
@@ -65,6 +66,8 @@ main(int argc, char *argv[])
 	int ch;
 
 	setlocale(LC_ALL, "");
+
+	tame(TAME_STDIO | TAME_RPATH);
 
 	while ((ch = getopt(argc, argv, "benstuv")) != -1)
 		switch (ch) {

Do as I say, not as I do

doas

  • sudo replacement
  • much simpler implementation
  • familiar syntax
  • NIH syndrome?

doas

Clocking in at a slim 660ish LOC, doas is a much slimmed down priv esc app.

Familiar syntax

permit jimbob cmd /sbin/reboot
permit nopass keepenv { HTTP_proxy } :wheel

NIH Syndrome

  • Could be, but not likely.
  • Have you seen the things sudo can do?

Hell - Why is it so cold down here?

Microsoft has donated at least 25K to the OpenBSD Foundation \o/

Oracle is adding OpenSSH and PF to Solaris!