HardenedBSD January 2024 Status Report

[shawn.webb]

Happy new year! January saw a few changes in the src repository:

1. Update some internal netlink(4) functions to use an unsigned integer for buffer size.
2. The NETLINK option is now effectively required by our upstream FreeBSD. I would encourage the community to study its code for potential issues.
3. The sysctl knobs vm.objects and vm.swap_objects are now only made available to privileged unjailed processes.
4. A new sysctl node is introduced that disables new USB device connections: hardening.pax.prohibit_new_usb. Possible values to set it to:
   • 0: disabled
   • 1: enabled
   • 2: enabled without possibility to disable without incurring a reboot
   It would be cool to see a new option: 3, enforce a USB device allowlist. I would like to delegate that to anyone who wants to volunteer to do that work. :-)

In ports:

1. An unneeded patch for dns/c-ares was remooved now that the port has been updated by upstream
2. Fix build of devel/ivykis
3. Bump default llvm ports version to 17

In the infrastructure:

As detailed in this announcement, HardenedBSD will slow its OS/update build cadence from bi-weekly to monthly.

The issue plaguing git clone https://... of src or ports has been resolved! Major thanks to h3artbl33d for helping resolve this issue.