HardenedBSD 12 released [LWN.net]

HardenedBSD has released version 12 of its security-enhanced fork of FreeBSD. Improvements in this release include Non-Cross-DSO Control-Flow Integrity (CFI) for applications on amd64 and arm64; jailed bhyve; per-jail toggles for unprivileged process debugging; Spectre v2 mitigation with retpoline applied to the entirety of base and ports; Symmetric Multi-Threading (SMT) disabled by default; and more.

to post comments

HardenedBSD 12 released

Posted Dec 20, 2018 2:13 UTC (Thu) by nopsled (guest, #129072) [Link] (1 responses)

Quite impressive for a project that some FreeBSD developers have, in the past, described as a one man project, a "joke", and a PR campaign, among other things, which ofcourse, has had nothing except Capsicum to back itself, on their side. It's funny some even go to lengths to call it mitigation.

I heard today's bootpd buffer overflow was also prevented by the combination of their ASLR+PaX NOEXEC+SafeStack that HBSD makes use of, but that's ofcourse not the first (nor would it be the last) bug it has eliminated. Maybe that's just my pessimistic view of security in FreeBSD, and that everything is fine (as people are often told to believe)...

HardenedBSD 12 released

Posted Dec 20, 2018 15:44 UTC (Thu) by cornelio (guest, #117499) [Link]

I don't follow much HardenedBSD but the last time I looked, the SafeStack implementation they carry is nowhere near complete: it ignores the changes on the FreeBSD side provided from EPFL, which by now probably conflict with other changes upstream.

I think it's great that someone is trying new things but overall the FreeBSD people are wise not to take HBSD seriously.