Date: Tue, 19 Jul 2022 09:57:54 GMT From: =?utf-8?Q?Kornel=20Dul=C4=99ba?= <kd@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: fec5791f9846 - stable/13 - Revert "bsdinstall: add knob to set ASLR sysctls" Message-ID: <202207190957.26J9vsLD013139@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/13 has been updated by kd: URL: https://cgit.FreeBSD.org/src/commit/?id=fec5791f98468672ca3e37ea357238e29e1f8a50 commit fec5791f98468672ca3e37ea357238e29e1f8a50 Author: Marcin Wojtas <mw@FreeBSD.org> AuthorDate: 2021-11-12 19:32:57 +0000 Commit: Kornel Dulęba <kd@FreeBSD.org> CommitDate: 2022-07-19 09:37:31 +0000 Revert "bsdinstall: add knob to set ASLR sysctls" This reverts commit 020f4112559ebf7e94665c9a69f89d21929ce82a. Because now ASLR is enabled by default for 64-bit architectures and the purpose of the installation menu is to allow choosing additional 'mitigation'/'hardening' options that are originally disabled, remove the ASLR knob from bsdinstall. Discussed with: emaste Obtained from: Semihalf Sponsored by: Stormshield (cherry picked from commit bf410c6eda515364db5f6ed74b765efdec0595ae) --- usr.sbin/bsdinstall/scripts/hardening | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/usr.sbin/bsdinstall/scripts/hardening b/usr.sbin/bsdinstall/scripts/hardening index 67ee3672712d..58ea0a112e26 100755 --- a/usr.sbin/bsdinstall/scripts/hardening +++ b/usr.sbin/bsdinstall/scripts/hardening @@ -28,20 +28,6 @@ : ${DIALOG_OK=0} -set_aslr_sysctls() -{ - for bit in 32 64; do - if ! sysctl -Nq kern.elf$bit.aslr.enable >/dev/null; then - continue - fi - cat >> $BSDINSTALL_TMPETC/sysctl.conf.hardening <<-EOF - kern.elf$bit.aslr.enable=1 - kern.elf$bit.aslr.pie_enable=1 - kern.elf$bit.aslr.honor_sbrk=0 - EOF - done -} - echo -n > $BSDINSTALL_TMPETC/rc.conf.hardening echo -n > $BSDINSTALL_TMPETC/sysctl.conf.hardening echo -n > $BSDINSTALL_TMPBOOT/loader.conf.hardening @@ -62,7 +48,6 @@ FEATURES=$( dialog --backtitle "FreeBSD Installer" \ "8 disable_sendmail" "Disable Sendmail service" ${disable_sendmail:-off} \ "9 secure_console" "Enable console password prompt" ${secure_console:-off} \ "10 disable_ddtrace" "Disallow DTrace destructive-mode" ${disable_ddtrace:-off} \ - "11 enable_aslr" "Enable address layout randomization" ${enable_aslr:-off} \ 2>&1 1>&3 ) exec 3>&- @@ -101,9 +86,6 @@ for feature in $FEATURES; do disable_ddtrace) echo 'security.bsd.allow_destructive_dtrace=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening ;; - enable_aslr) - set_aslr_sysctls - ;; esac done
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202207190957.26J9vsLD013139>