[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Fwd: Re: OpenBSD and PaX]

I'm sending this here, but am moving this discussion to misc@.


-------- Original Message --------
From: Peter Busser <peter@trusteddebian.org>
Subject: Re: OpenBSD and PaX
To: Rafael Coninck Teigao <rafael@SafeCore.NET>


>     it should be noted that it is possible to choose how many bits you
> want to use in OpenBSD through sysctl. It's just a matter of
> configuration.

I know that. And the OpenBSD motto is: ``Secure by default''. And I
don't think
10 bits is a secure default, it is merely a small obfuscation which is
easy to
get around by using brute force methods. Some would argue that the
number of bits is 8, because of the alignment of the stack pointer.

>     Also, IIRC, and I may be wrong here, I think that the heap and
> libraries are also positioned randomly after the 1GB gap. I'm sure some
> developer@OpenBSD can confirm if that's correct or not.

So far noone has claimed that it is not true. And if it is not true, I
make a statement about it on the web site.

I don't know anything about the OpenBSD kernel. And if you want to
discuss the
details, you better contact pagexec@freemail.hu. He gave me this
and he has looked at the OpenBSD kernel implementation. He is also the
guy who
programmed PaX and he can tell you everything about this stuff, because
he has
been developing this for several years now (long before the OpenBSD
started to write something similar).

>     Could you please elaborate more on:
> "Except for OpenBSD, but it falls short in the level of protection it
> provides."

[when compared to the Trusted Debian kernel]. There is only so much you
can put
in a press release and it is already too long as it is. This refers to
level of buffer overflow protection, not OpenBSD in general. But it
people are able read anything, no matter how careful you try to word it.

I should add that these words were chosen to make Trusted Debian stand
out from
the crowd so to say, and not to attack OpenBSD. I think that at a
level the OpenBSD people do a good job, especially the auditing is great
the motivation page on the Trusted Debian site). But I think the OpenBSD
project got a bit carried away too much with this auditing, because it
is not
going to solve all security problems. (Which is also what some NSA
people point
out in a paper called: The Inevitability of Failure: The Flawed
Assumption of
Security in Modern Computing Environments, which you can find at:
http://www.nsa.gov/selinux/doc/inevitability/inevitability.html.) This
is one
of the reasons Trusted Debian also features RSBAC.

Peter Busser