Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

bsdinstall: remove sendmail hardening option

sendmail is fully disabled in 14.0 by default

Reviewed by: imp, emaste
Differential Revision: https://reviews.freebsd.org/D40367

bsdinstall: allow whitelabeling the scripts

Approved by: allanjude, asiciliano
Differential Revision: https://reviews.freebsd.org/D35197
Sponsored by: Rubicon Communications, LLC ("Netgate")

bsdinstall hardening: Replace dialog with bsddialog

bsdinstall/scripts/hardening: Replace (LGPL) dialog utility with
(BSD-2-CLAUSE) dialog utility.

Approved by: bapt (mentor)
Differential Revision

bsdinstall hardening: Replace dialog with bsddialog

bsdinstall/scripts/hardening: Replace (LGPL) dialog utility with
(BSD-2-CLAUSE) dialog utility.

Approved by: bapt (mentor)
Differential Revision: https://reviews.freebsd.org/D34102

show more ...

Revert "bsdinstall: add knob to set ASLR sysctls"

This reverts commit 020f4112559ebf7e94665c9a69f89d21929ce82a.

Because now ASLR is enabled by default for 64-bit architectures
and the purpose of th

Revert "bsdinstall: add knob to set ASLR sysctls"

This reverts commit 020f4112559ebf7e94665c9a69f89d21929ce82a.

Because now ASLR is enabled by default for 64-bit architectures
and the purpose of the installation menu is to allow choosing
additional 'mitigation'/'hardening' options that are originally
disabled, remove the ASLR knob from bsdinstall.

Discussed with: emaste
Obtained from: Semihalf
Sponsored by: Stormshield

show more ...

bsdinstall: add knob to set ASLR sysctls

Reviewed by: mw
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D28418

bsdinstall: replace multiple ifs with case

Reduce copy-paste and use a more typical construct.

Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D28417

Add an installer option to disable destructive dtrace.

Submitted by: Jörg Pernfuß <[email protected]>
Approved by: re (kib)
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D

Add an installer option to disable destructive dtrace.

Submitted by: Jörg Pernfuß <[email protected]>
Approved by: re (kib)
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D12474

show more ...

bsdinstall(8) hardening menu: Utilize new kern.randompid=1 behaviour

Enabling the PID randomization option in bsdinstall(8)'s hardening menu
now randomizes the effective value of kern.randompid on e

bsdinstall(8) hardening menu: Utilize new kern.randompid=1 behaviour

Enabling the PID randomization option in bsdinstall(8)'s hardening menu
now randomizes the effective value of kern.randompid on each boot.

Previous behaviour:
When kern.randompid was enabled via the the bsdinstall(8) hardening menu,
a random value was generated and placed in the systems /etc/sysctl.conf as
kern.randompid=value
This makes the value of kern.randompid static across reboots.

New behaviour:
When kern.randompid is enabled via the bsdinstall(8) hardening menu, the
line kern.randompid=1 is placed in the systems /etc/sysctl.conf.
This takes advantage of a new kernel feature and makes the value of
kern.randompid be randomized by the kernel on each reboot.

Submitted by: Marie Helene Kvello-Aune <[email protected]>
Reviewed by: des
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D12433

show more ...

Remove stack guard option from hardening menu.

Since kib's change the stack guard is now ON by default,
this option in hardening menu of bsdinstall is no longer needed.

Submitted by: Bartlomiej Rut

Remove stack guard option from hardening menu.

Since kib's change the stack guard is now ON by default,
this option in hardening menu of bsdinstall is no longer needed.

Submitted by: Bartlomiej Rutkowski <[email protected]>
Reviewed by: bapt
Approved by: bapt
MFC after: 1 day
Sponsored by: Pixeware LTD
Differential Revision: https://reviews.freebsd.org/D11686

show more ...

usr.sbin/bsdinstall/scripts/hardening: fix options numbers

Submitted by: Bartek Rutkowski <[email protected]>
Reviewed by: bapt
Approved by: bapt
MFC after: 1 day
Differential Revision: https://revi

usr.sbin/bsdinstall/scripts/hardening: fix options numbers

Submitted by: Bartek Rutkowski <[email protected]>
Reviewed by: bapt
Approved by: bapt
MFC after: 1 day
Differential Revision: https://reviews.freebsd.org/D11505

show more ...

Add option to bsdinstall to disable insecure console, update stack guard option

This patch adds new bsdinstall option to hardening section that allows users
to change this behaviour to secure one an

Add option to bsdinstall to disable insecure console, update stack guard option

This patch adds new bsdinstall option to hardening section that allows users
to change this behaviour to secure one and updates stack guard option so it
would set the value of relevant sysctl to 512 (2MB)

Submitted by: Bartek Rutkowski
Reviewed by: adrian, bapt, emaste
Approved by: bapt, emaste
MFC after: 1 day
Sponsored by: Pixeware LTD
Differential Revision: https://reviews.freebsd.org/D9700

show more ...

Add hardening menu item for security.bsd.see_jail_proc

Approved by: allanjude
Differential Revision: https://reviews.freebsd.org/D11283

Revert changes introduced in r314036 on demand by jhb and bapt.

Approved by: bapt, jhb

Enable bsdinstall hardening options by default.

As discussed previously, in order to introduce new OS hardening
defaults, we've added them to bsdinstall in 'off by default' mode.
It has been there f

Enable bsdinstall hardening options by default.

As discussed previously, in order to introduce new OS hardening
defaults, we've added them to bsdinstall in 'off by default' mode.
It has been there for a while, so the next step is to change them
to 'on by defaul' mode, so that in future we could simply enable
them in base OS.

Reviewed by: brd
Approved by: adrian
Differential Revision: https://reviews.freebsd.org/D9641

show more ...

Add 0-8 as shortcuts for jumping to menu items in the hardening menu.

Submitted by: skreuzer
Reviewed by: allanjude, robak
Approved by: allanjude
Differential Revision: https://reviews.freebsd.org/D

Add 0-8 as shortcuts for jumping to menu items in the hardening menu.

Submitted by: skreuzer
Reviewed by: allanjude, robak
Approved by: allanjude
Differential Revision: https://reviews.freebsd.org/D6826

show more ...

Write kern.randompid to /etc/sysctl.conf

PR: 211471
Reported by: [email protected]
Reviewed by: robak@
Approved by: allanjude@
MFC after: 3 days
Differential Revision: https://reviews.freebsd.o

Write kern.randompid to /etc/sysctl.conf

PR: 211471
Reported by: [email protected]
Reviewed by: robak@
Approved by: allanjude@
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D7440

show more ...

Fix non-functional bsdinstall services dialog.

The most recent version of bsdinstall does not seem to respect any of
the checkboxes in the "Choose the services you would like to be started
at boot"

Fix non-functional bsdinstall services dialog.

The most recent version of bsdinstall does not seem to respect any of
the checkboxes in the "Choose the services you would like to be started
at boot" dialog. None of the chosen services end up in the rc.conf file
that is installed onto the target system.

This is caused by the bsdinstall/scripts/hardening script, which
implements the new hardening options dialog. The script starts by
overwriting the previously written rc.conf.services file:

echo -n > $BSDINSTALL_TMPETC/rc.conf.services

which is obviously incorrect. It should clear out rc.conf.hardening
instead.

Reviewed by: allanjude
PR: 211506
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D7387

show more ...

Add new System Hardening menu and options to bsdinstall.

This patch add new 'hardening' file responsible for new bsdinstall
'System Hardening' menu allowing users to set some sane and carefully
pick

Add new System Hardening menu and options to bsdinstall.

This patch add new 'hardening' file responsible for new bsdinstall
'System Hardening' menu allowing users to set some sane and carefully
picked system security options (like random process id's, hiding
other users/groups processes and others).

All options are OFF by default in this patch due to POLA principle
with intention to turn change some of them to ON by default in future.

Reviewed by: adrian, allanjude, bdrewery, nwhitehorn
Approved by: adrian, allanjude
MFC after: 7 days

show more ...