From owner-freebsd-security@freebsd.org Wed May 20 07:20:05 2020 Return-Path: Delivered-To: freebsd-security@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 0B4992C903A for ; Wed, 20 May 2020 07:20:05 +0000 (UTC) (envelope-from damien.deville@stormshield.eu) Received: from work.stormshield.eu (gwlille.netasq.com [91.212.116.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 49RkfW6Vm8z3Ydd; Wed, 20 May 2020 07:20:03 +0000 (UTC) (envelope-from damien.deville@stormshield.eu) Received: from work.stormshield.eu (localhost.localdomain [127.0.0.1]) by work.stormshield.eu (Postfix) with ESMTPS id 49EA037A2787; Wed, 20 May 2020 09:20:01 +0200 (CEST) Received: from localhost (localhost.localdomain [127.0.0.1]) by work.stormshield.eu (Postfix) with ESMTP id 1689B3778060; Wed, 20 May 2020 09:20:01 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 work.stormshield.eu 1689B3778060 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stormshield.eu; s=BBC9ECEA-016A-11EA-9CC1-8A393C11FBBB; t=1589959201; bh=3pcV5B5kzdxYlAlwQKXDtO81DzIxPL9ZPjuH/EWIaBo=; h=Date:From:To:Message-ID:MIME-Version; b=xocbkjOaAWgOtKjMoxSbs91ZWrPRSc6y2iihLMd/8s/6iRW3INpTG1VTye2ww3dNu rqwvBcfF8lSfKmIe4AY6GDY6yJrn2Gy7d2dlytyAJ2pN2qtQDEHalJEvEI6BYxn7sv 53x1lLm0JB0LV1R2KkKTxszunKth3htvfESrHOXlZGvxNnc9/2VWuSY4zXi9OCqV/6 te4aWu5iUitWm7pPxWQDJ3dA5e3y65mhwQ0ydsA5p7DiYSxsv4tDagQHCGUbo0bweN j3uxcfQao1G6oh2YoNhP0dHBm5UvcOMY2cnFhOAI7nINZQcCMiA2TEME7eh4F3lyGq hd3f0C9ugAE3w== Received: from work.stormshield.eu ([127.0.0.1]) by localhost (work.stormshield.eu [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id vU0YhA0Imkej; Wed, 20 May 2020 09:20:01 +0200 (CEST) Received: from work.stormshield.eu (localhost.localdomain [127.0.0.1]) by work.stormshield.eu (Postfix) with ESMTP id EA14837A7884; Wed, 20 May 2020 09:20:00 +0200 (CEST) Date: Wed, 20 May 2020 09:20:00 +0200 (CEST) From: Damien DEVILLE To: Marcin Wojtas Cc: emaste , freebsd-security@freebsd.org, Rafal Jaworowski Message-ID: <151792368.1257575.1589959200761.JavaMail.zimbra@stormshield.eu> In-Reply-To: References: Subject: Re: ASLR/PIE status in FreeBSD HEAD MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thread-Topic: ASLR/PIE status in FreeBSD HEAD Thread-Index: tMqGYIrSrJEaHZeuwLHjt3yAwySeLQ== X-Rspamd-Queue-Id: 49RkfW6Vm8z3Ydd X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=stormshield.eu header.s=BBC9ECEA-016A-11EA-9CC1-8A393C11FBBB header.b=xocbkjOa; dmarc=none; spf=pass (mx1.freebsd.org: domain of damien.deville@stormshield.eu designates 91.212.116.1 as permitted sender) smtp.mailfrom=damien.deville@stormshield.eu X-Spamd-Result: default: False [-2.23 / 15.00]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-0.92)[-0.920]; RCVD_COUNT_FIVE(0.00)[5]; R_DKIM_ALLOW(-0.20)[stormshield.eu:s=BBC9ECEA-016A-11EA-9CC1-8A393C11FBBB]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[4]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:91.212.116.1]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[stormshield.eu]; TO_MATCH_ENVRCPT_SOME(0.00)[]; DKIM_TRACE(0.00)[stormshield.eu:+]; NEURAL_HAM_SHORT(-0.81)[-0.806]; RCVD_IN_DNSWL_NONE(0.00)[91.212.116.1:from]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_TLS_LAST(0.00)[]; ASN(0.00)[asn:49068, ipnet:91.212.116.0/24, country:FR]; MID_RHS_MATCH_FROM(0.00)[] X-Mailman-Approved-At: Thu, 21 May 2020 13:30:15 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 May 2020 07:20:05 -0000 Hi everyone, This a very good news. Thanks to Semihalf to their commitment on this subje= ct. At Stormshield as a security vendor using FreeBSD we are highly interested = in all subjects that enhance the security level of FreeBSD. What is your target in term of timing ? Are there any plans to work on othe= r hardening subjects (like for example improving W^X) ? Do you have any roa= dmap in terms of features and deadlines ? We would be interested to take part to live discussions as a vendor if some= are planned. Internally we have some plans to work on this subject with deadlines by the= end of the year. Thanks to all of you for working on this subject, Damien -- Damien Deville IPS Technical Leader http://www.stormshield.eu Stormshield 2/6 Avenue de l'Horizon, Bat. 6 - FR 59650 Villeneuve d'Ascq ----- Le 14 Mai 20, =C3=A0 10:00, Marcin Wojtas mw@semihalf.com a =C3=A9cri= t : | Hi, |=20 | wt., 5 maj 2020 o 12:03 Marcin Wojtas napisa=C5=82(a): |> |> pon., 4 maj 2020 o 17:24 Ed Maste napisa=C5=82(a): |> > |> > On Mon, 20 Apr 2020 at 10:22, Marcin Wojtas wrote: |> > > |> > > Indeed I thought of kyua and measuring buildworld execution time for |> > > stressing the DUT and having the first comparison numbers for the lo= w |> > > price. |> > > |> > > Do you think it is possible to get help here, i.e. is there a FreeBS= D |> > > devops team, maintaining the Jenkins CI whose spare cycles could be |> > > used for this purpose? Or is this a field requiring external help fr= om |> > > interested parties? |> > |> > There aren't a lot of spare cycles to go around, but putting |> > automation in place so that tests like this can easily be performed is |> > certainly something that's in the Jenkins team's domain. |> |> Of course the available bandwidth is a limitation, but IMO we should |> start with defining the requirements so that eventually it could be |> added to the backlog. |> |> > |> > > Yes, making use of something actively maintained would be great. Do |> > > you see a need for IO stressing/benchmarking for the discussed cases= ? |> > |> > In the fullness of time I think it's important, but my opinion is that |> > it's really functional tests that we need, for enabling features in |> > -CURRENT; we can work on benchmarking before and after changing a |> > default. |> |> Understood. Since there seem to be no blockers / major objections at |> this point, how do you suggest proceed with the topic? How about |> having a live discussion with interested parties, so that we can |> establish at least a rough plan allowing to achieve the enablement of |> this (and possibly other) feature in a foreseeable perspective? |> |=20 | Any thoughts about having a live discussion on the ALSR/PIE enablement to= pic? |=20 | Best regards, | Marcin | _______________________________________________ | freebsd-security@freebsd.org mailing list | https://lists.freebsd.org/mailman/listinfo/freebsd-security | To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.or= g"