OpenBSD Archive

For some reason I like small laptops and the constraints they place on me (as long as they're still usable). I used a Dell Mini 9 for a long time back in the netbook days and was recently using an 11" MacBook Air as my primary development machine for many years. Recently Microsoft announced a smaller, cheaper version of its Surface tablets called Surface Go which piqued my interest.

Let me preface this by saying that this is a (very) long and medium-rare technical article about the security considerations and minutiae of porting (most of) the Arcan ecosystem to work under OpenBSD. The main point of this article is not so much flirting with the OpenBSD crowd or adding further noise to software engineering topics, but to go through the special considerations that had to be taken, as notes to anyone else that decides to go down this overgrown and lonesome trail, or are curious about some less than obvious differences between how these things "work" on Linux vs. other parts of the world.

If you've noticed a disruption in the time-space continuum recently, it is likely because I have finally been able to compile and install the Common Desktop Environment (CDE) in a current and actively-developed operating system (OpenBSD 6.2 in this case).

Over the last three weeks I've been working on a new randomization feature which will protect the kernel.

The situation today is that many people install a kernel binary from OpenBSD, and then run that same kernel binary for 6 months or more. We have substantial randomization for the memory allocations made by the kernel, and for userland also of course.

However that kernel is always in the same physical memory, at the same virtual address space (we call it KVA).

Improving this situation takes a few steps.

Recent events have rocked the mobile computing world to its core. OpenBSD retired the zaurus port, leaving users in desperate need of a new device. And not long before that, Microsoft released the Anniversary Update to Windows 10, but increased the free space requirement needed to install the update to exceed what's possible on devices with only 32GB, leaving users with cheap 32GB eMMC equipped devices such as the HP Stream series searching for a new operating system. With necessity as both mother and father, the scene is set for a truly epic pairing. OpenBSD on the HP Stream 7.

The HP Stream line is a series of budget computers in a couple form factors. The Stream 11 is a fairly typical netbook. However, the Stream 7 and 8 are tablets. They look like cheap Android devices, but inside the case, they’re real boys, er PCs, with Intel Atom CPUs.

To install OpenBSD on such a device, we need a few parts.

In their latest attempt to push better security practices to the software ecosystem, OpenBSD has turned W^X on by default for the base system. Binaries can only violate W^X if they're marked with PT_OPENBSD_WXNEEDED and their filesystem is mounted with the new wxallowed option. The installer will set this flag on the /usr/local partition (where third party packages go) by default now, but users may need to manually add it if you're upgrading. More details can be found in this email. If you don't use any W^X-violating applications, you don't need the flag at all.

OpenBSD is an amazing project and has some of the best code around but some of us are of the opinion that it could use a bit of modernization. OpenBSD is a very security conscious project and, correspondingly, has to be more conservative with features. We want to be less restrictive with the codebase when it comes to experimenting with features.

For those of you who'd been looking forward to using those blue USB ports of yours, now's the time to plug in as many 3.0 devices as you can find! Of course, just about the time we publish this story, USB1.x devices are now supported on a USB 3.x controller.

In light of shrinking funding, we do need to look for a source to cover project expenses. If need be the OpenBSD Foundation can be involved in receiving donations to cover project electrical costs.

But the fact is right now, OpenBSD will shut down if we do not have the funding to keep the lights on.

If you or a company you know are able to assist us, it would be greatly appreciated, but right now we are looking at a significant funding shortfall for the upcoming year - Meaning the project won't be able to cover 20 thousand dollars in electrical expenses before being able to use money for other things. That sort of situation is not sustainable.

We are pleased to announce the official release of OpenBSD 5.4. This is our 34th release on CD-ROM (and 35th via FTP). We remain proud of OpenBSD's record of more than ten years with only two remote holes in the default install.