This week on BSDNow, we get to hear all of Allans post EuroBSDCon wrap-up and a great interview with Benno Rice from Isilon. We got to discuss some of the pain of doing major forklift upgrades, and why your business should track -CURRENT.
This episode was brought to you by
Headlines
EuroBSDCon Videos
EuroBSDCon has started posting videos of the talks online already.The videos posted online are archives of the live stream, so some of the videos contain multiple talksDue to a technical complication, some videos only have 1 channel of audioEuroBSDCon Talk ScheduleRed Room VideosYellow Room VideosBlue Room VideosPhotos of the conference courtersy of Ollivier Robert***
A series of OpenSMTPd patches fix multiple vulnerabilities
Qualys recently published an audit of the OpenSNMPd source codeThe fixes for these vulnerabilities were released as 5.7.2After its release, two additional vulnerabilities were found. One, in the portable version, newer code that was added after the audit startedAll users are strongly encouraged to upgrade to 5.7.3OpenBSD users should apply the latest errata or upgrade to the newest snapshot***
FreeBSD updates in -CURRENT
Looks like Xen header support has been bumped in FreeBSD from 4.2 -> 4.6It also enables support for ARMUpdate to Clang / LLVM to 3.7.0http://llvm.org/releases/3.7.0/docs/ReleaseNotes.htmlZFS gets FRU (field replaceable unit) trackingOpenCL makes it way into the ports treebhyve has grown UEFI support, plus a CSM modulebhyve can now boot Windows Currently there is still only a serial console, so the post includes an unattended install .xml file and instructions on how to repack the ISO. Once Windows is installed, you can RDP into the machinebhyve can also now run IllumOS ***
OpenBSD Initial Support for Broadwell Graphics
OpenBSD joins DragonFly now with initial support for broadwell GPUs landing in their development branchThis brings Open up to Linux 3.14.52 DRM, and Mark Kettenis mentions that it isn.t perfect yet, and may cause some issues with older hardware, although no major regressions yet***
OpenBSD Slides for TAME and libTLS APIs
The first set of slides are from a talk Theo de Raadt gave in Croatia, they describe the history and impetus for tameTheo specifically avoids comparisons to other sandboxing techniques like capsicum and seccomp, because he is not impartialtame() itself is only about 1200 lines of codeSandboxing the file(1) command with systrace: 300 lines of code, with tame: 4 linesTheo makes the point that .optional security. is irrelevant. If a mitigation feature has a knob to turn it off, some program will break and advise users to turn the feature off. Eventually, no one uses the feature, and it diesThis has lead to OpenBSD.s policy: .Once working, these features cannot be disabled. Application bugs must be fixed.The second talk is by Bob Beck, about LibreSSLwhen LibreSSL was forked from OpenSSL 1.0.1g, it contained 388,000 lines of C code30 days in LibreSSL, they had deleted 90,000 lines of COpenSSL 1.0.2d has 432,000 lines of C (728k total), and OpenSSL Current has 411,000 lines of C (over 1 million total)LibreSSL today, contains 297,000 lines of C (511k total)None of the high risk CVEs against OpenSSL (there have been 5) have affected LibreSSL. It turns out removing old code and unneeded features is good for security.The talk focuses on libtls, an alternative to the OpenSSL API, designed to be easier to use and less error proneIn the libtls api, if -1 is returned, it is always an error. In OpenSSL, it might not be an error, needs additional code to check errnoIn OpenBSD: ftp, nc, ntpd, httpd, spamd, syslog have been converted to the new APIThe OpenBSD Foundation is looking for donations in order to sponsor 2-3 developers to spend 6 months dedicated to LibreSSL***
Interview - Benno Rice - [email protected] / @jeamland
Isilon and building products on top of FreeBSD
News Roundup
ReLaunchd
This past week we got a heads up about another init/launchd replacement, this time .Relaunchd.The goals of this project appear to be keeping launchd functionality, while being portable enough to run on FreeBSD / Linux, etc. It also has aspirations of being .container-aware. with support for jailed services, ala-docker, as well as cluster awareness. Written in ruby :(, it also maintains that it wishes to NOT take over PID1 or replace the initial system boot scripts, but extend / leverage them in new ways. ***
Static Intrusion Detection in NetBSD
Alistar Crooks has committed a new .sid. utility to NetBSD, which allows intrusion detection by comparing the file-system contents to a database of known good valuesThe utility can compare the entire root file system of a modest NetBSD machine in about 15 secondsThe following parameters of each file can be checked: atime, block count, ctime, file type, flags, group, inode, link target, mtime, number of links, permissions, size, user, crc32c checksum, sha256 checksum, sha512 checksumA JSON report is issued at the end, for any detected variances***
LibreSSL 2.3.0 in PC-BSD
If you.re running PC-BSD 10.2-EDGE or October's -CURRENT image, LibreSSL 2.3.0 is now a thingThanks to the hard work of Bernard Spil and others, we have merged in the latest LibreSSL which actually removes SSL support in favor of TLSQuite a number of bugs have been fixed, as well as patches brought over from OpenBSD to fix numerous ports.Allan has started a patchset that sets the OpenSSL in base to "private"This hides the library so that applications and ports cannot find it, so only tools in the base system, like fetch, will be able to use it. This makes OpenSSL no longer part of the base system ABI, meaning the version can be upgraded without breaking the stable ABI promise. This feature may be important in the future as OpenSSL versions now have EoL dates, that may be sooner than the EoL on the FreeBSD stable branches.***
PC-BSD and boot-environments without GRUB
In this month.s -CURRENT image of PC-BSD, we began the process of moving back from the GRUB boot-loader, in favor of FreeBSD.sA couple of patches have been included, which enables boot-environment support via the 4th menus (Thanks Allan) and support for booting ZFS on root via UEFI"beadm" has also been updated to seamlessly support both boot-loadersNo full-disk encryption support yet (hopefully soon), but GRUB is still available on installer for those who need it***
Import of IWM wireless to DragonFly
Matthew Dillon has recently imported the newer if_iwm driver from FreeBSD -> DragonFlyAcross the internet, users with newer Intel chipsets rejoiced!Coupled with the latest Broadwell DRM improvements, DragonFly sounds very ready for the latest laptop chipsetsAlso, looks like progress is being made on i386 removal***
Feedback/Questions
Dan writes in about PCBSDMatt writes in about ZFSAnonymous writes in about problems booting***
