Re: NetBSD 5.x security

[christos%astron.com@localhost (Christos Zoulas)]

In article <20100405201404.GB19056%drozd.smutek.pl@localhost>,
Piotr Meyer  <aniou%smutek.pl@localhost> wrote:
>I made some research and I found following issues on NetBSD 5.x / i386
>in features described in security(8):
>
>1. ASLR
>
>   a) Bug described in: 
>      http://mail-index.netbsd.org/netbsd-bugs/2009/08/12/msg012786.html
>      still exists and made ASLR unusable (random crashes, frequently
>      in applications linked with '-ltph').

This has to do with stack size; you can reduce the number of random
bits via sysctl if you want to use large stack sizes, or disable ASLR
on the binary. The bug report is still open, and we'll fix it properly
but this is a work-around.

>
>   b) System built witch MKPIE doesn't work at all, init still panics,
>      as described in:
>      http://mail-index.netbsd.org/port-i386/2009/05/01/msg001339.html
>
>   - I tested botch cases. Yes, this doesn't work.

I think it is missing /lib/libgcc_s.so too. This has been fixed in current.
I think you can either compile init without PIE or copy the library there.

>2. SSP (Stack Smashing Protection) is disabled by default:
>   http://mail-index.netbsd.org/current-users/2009/11/12/msg011206.html
>
>   (Interesting: looks like FreeBSD 8 has stack protection enabled by 
>    default: http://www.freebsd.org/releases/8.0R/relnotes.html)

I think so do we in x86/current.

>3. CVE-2009-2793 problem, described in:
>   http://seclists.org/fulldisclosure/2009/Sep/221 was fixed in Jan 2010
>   but still isn't backported to stable branch, so any local user can
>   cause panic on "stable" NetBSD 5.x installation (I test it). Is any
>   backport planned?

Yes, we will investigate what it would take to back-port it to netbsd-5.

>Did I miss something? I'm curious to know, how looks current TODO for 
>security in NetBSD: will be these issues fixed, or - maybe - some features 
>will be removed from distribution (or from specific ports)? 

Thanks for the report!

christos