Contents:
/tmp
directory
For more information about it, and a quick guide on how to use it, please see veriexec(8).
In a nutshell, once enabled, Veriexec can be started as follows:
# veriexecgen && veriexecctl load
NetBSD provides the following exploit mitigation features:
(
2
restrictions)
When PaX ASLR is used, it is more likely the attacker will fail to predict the addresses of such functions, causing the application to segfault. To detect cases where an attacker might try and brute-force the return address of respawning services, PaX Segvguard can be used (see below).
For non-PIE (Position Independent Executable) executables, the NetBSD PaX ASLR implementation introduces randomization to the following memory regions:
For PIE executables:
While it can be enabled globally, NetBSD provides a tool, paxctl(8), to enable PaX ASLR on a per-program basis.
Example usage:
# paxctl +A /usr/sbin/sshd
Enabling PaX ASLR globally:
# sysctl -w security.pax.aslr.global=1
While it can be enabled globally, NetBSD provides a tool, paxctl(8), to enable PaX MPROTECT on a per-program basis.
Example usage:
# paxctl +M /usr/sbin/sshd
Enabling PaX MPROTECT globally:
# sysctl -w security.pax.mprotect.global=1
PaX Segvguard consumes kernel memory, so use it wisely. While it provides rate-limiting protections, records are tracked for all users on a per-program basis, meaning that irresponsible use may result in tracking all segmentation faults in the system, possibly consuming all kernel memory.
For this reason, it is highly recommended to have PaX Segvguard enabled explicitly only for network services, etc. Enabling PaX Segvguard explicitly works like this:
# paxctl +G /usr/sbin/sshd
However, a global knob is still provided, for use in strict environments with no local users (some network appliances, embedded devices, firewalls, etc.):
# sysctl -w security.pax.segvguard.global=1
Explicitly disabling PaX Segvguard is also possible:
# paxctl +g /bin/ls
In addition, PaX Segvguard provides several tunable options. For example, to limit a program to 5 segmentation faults from the same user in a 60 second timeframe:
# sysctl -w security.pax.segvguard.max_crashes=5
# sysctl -w security.pax.segvguard.expiry_timeout=60
The number of seconds a user will be suspended from running the culprit program is also configurable. For example, 10 minutes seem like a sane setting:
# sysctl -w security.pax.segvguard.suspend_timeout=600
Upon detection of a buffer overrun, SSP will immediately abort execution of the program and send a log message to syslog(3).
The system (userland and kernel) can be built with
SSP
by using the
``USE_SSP''
flag in
/etc/mk.conf
:
USE_SSP=yes
You are encouraged to use SSP for software you build, by providing one of the -fstack-protector or -fstack-protector-all flags to gcc(1). Keep in mind, however, that SSP will not work for functions that make use of alloca(3), as the latter modifies the stack size during run-time, while SSP relies on it being a compile-time static.
Use of SSP is especially encouraged on platforms without per-page execute bit granularity such as i386.
/tmp
.
To enable per-user temporary storage, add the following line to rc.conf(5):
per_user_tmp=YES
If
/tmp
is a mount point, you will also need to update its
fstab(5)
entry to use
``/private/tmp''
(or whatever directory you want, if you override the default using the
``per_user_tmp_dir''
rc.conf(5)
keyword) instead of
``/tmp''.
Following that, run:
# /etc/rc.d/perusertmp start
The hooks that manage this restriction are located in various parts of the system and affect programs such as ps(1), fstat(1), and netstat(1). Information filtering is enabled as follows:
# sysctl -w security.curtain=1