SoylentNews is people
SoylentNews
https://marc.info/?l=openbsd-tech&m=149732026405941&w=2
https://marc.info/?l=openbsd-tech&m=149732265506347&w=2
There is now scaffolding to ensure booting to a newly-linked kernel for every reboot. New random kernels can be linked together, automatically in the background by the rc
scripts, and installed as /bsd. On a fast machine it takes less than a second. A mail is sent to the system administrator. A reboot runs the new kernel, and yet another kernel is built for the next boot.
From Theo de Raadt's email to the list:
Over the last three weeks I've been working on a new randomization feature which will protect the kernel.
The situation today is that many people install a kernel binary from OpenBSD, and then run that same kernel binary for 6 months or more. We have substantial randomization for the memory allocations made by the kernel, and for userland also of course.
However that kernel is always in the same physical memory, at the same virtual address space (we call it KVA).
Improving this situation takes a few steps.
Recently I moved all our kernels to a new mapping model, with patrick and visa taking care of two platforms.
Previously, the kernel assembly language bootstrap/runtime locore.S was compiled and linked with all the other .c files of the kernel in a deterministic fashion. locore.o was always first, then the .c files order specified by our config(8) utility and some helper files.
In the new world order, locore is split into two files: One chunk is bootstrap, that is left at the beginning. The assembly language runtime and all other files are linked in random fashion. There are some other pieces to try to improve the randomness of the layout.
As a result, every new kernel is unique. The relative offsets between functions and data are unique.
[...] Our immune systems work better when they are unique. Otherwise one airline passenger from Singapore with a new flu could wipe out Europe (they should fly to Washington instead).
Our computers should be more immune.
[Editors note: This is a couple weeks old now, but was by far the best tech story I could find in the submission queue]
(Score: 4, Insightful) by McGruber on Tuesday June 27 2017, @10:39PM (1 child)
I just wanted to thank canopic jug for submitting, Coolhand for posting this story and to Theo & the OpenBSD team for their work. This is the most interesting topic I've read on SN and /. in some time!
(Score: 2) by CoolHand on Thursday June 29 2017, @12:00PM
Your welcome, sir! (or ma'am as the case may be)
Anyone who is capable of getting themselves made President should on no account be allowed to do the job-Douglas Adams