www/59.html - diff

Return to 59.html CVS log

Up to [local] / www

Diff for /www/59.html between version 1.42 and 1.43

version 1.42, 2016/02/25 07:28:57

version 1.43, 2016/02/25 10:27:04

Line 105

<li>453 out of 707 base system binaries adapted to use pledge.

<li>14 ports adapted to use pledge (some decompression tools, mutt,

some pdf tools, chromium/iridium, and the i3 window manager).

<li>pledge exposed several bugs that has been corrected, for example in <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/bgpd/bgpd.c?rev=1.181&content-type=text/x-cvsweb-markup">bgpd(8)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sbin/iked/config.c?rev=1.40&content-type=text/x-cvsweb-markup">iked(8)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ldapd/control.c?rev=1.13&content-type=text/x-cvsweb-markup">ldapd(8)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/constraint.c?rev=1.25&content-type=text/x-cvsweb-markup">ntpd(8)</a> or <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/syslogd/syslogd.c?rev=1.200&content-type=text/x-cvsweb-markup">syslogd(8)</a>,

<li>Several bugs exposed by pledge(2) have been corrected, for example in <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/bgpd/bgpd.c?rev=1.181&content-type=text/x-cvsweb-markup">bgpd(8)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sbin/iked/config.c?rev=1.40&content-type=text/x-cvsweb-markup">iked(8)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ldapd/control.c?rev=1.13&content-type=text/x-cvsweb-markup">ldapd(8)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/constraint.c?rev=1.25&content-type=text/x-cvsweb-markup">ntpd(8)</a>, and <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/syslogd/syslogd.c?rev=1.200&content-type=text/x-cvsweb-markup">syslogd(8)</a>,

<li>and several misguided "features" that has been removed, like <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/asr/asr.c?rev=1.50&content-type=text/x-cvsweb-markup">support for HOSTALIASES from the resolver</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/asr/asr.c?rev=1.49&content-type=text/x-cvsweb-markup">support for "lookup yp" in /etc/resolv.conf</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/gnu/usr.bin/binutils-2.17/binutils/rename.c?rev=1.2&content-type=text/x-cvsweb-markup">setuid-preserving code in binutils tools</a> or <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/patch/ed.c?rev=1.1&content-type=text/x-cvsweb-markup">ed-style diffs via proc/exec in patch(1)</a>.

<li>Several misguided "features" have been removed, such as <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/asr/asr.c?rev=1.50&content-type=text/x-cvsweb-markup">support for HOSTALIASES from the resolver</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/asr/asr.c?rev=1.49&content-type=text/x-cvsweb-markup">support for "lookup yp" in /etc/resolv.conf</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/gnu/usr.bin/binutils-2.17/binutils/rename.c?rev=1.2&content-type=text/x-cvsweb-markup">setuid-preserving code in binutils tools</a> or <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/patch/ed.c?rev=1.1&content-type=text/x-cvsweb-markup">ed-style diffs via proc/exec in patch(1)</a>.

<li>pledge has require a somehow intensive audit of userland to properly annotate programs, resulting some design changes like in <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/rdate/rdate.c?rev=1.33&content-type=text/x-cvsweb-markup">rdate(1)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/sndiod/sndiod.c?rev=1.18&content-type=text/x-cvsweb-markup">sndiod(8)</a> or the introduction of SOCK_DNS <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=socket&sektion=2">socket(2)</a> flag that makes SS_DNS tagged socket conceptually different from plain socket.

<li>A somewhat intensive audit of userland program so that they could be properly annotated with pledge(2) was done, resulting in some design changes such as in <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/rdate/rdate.c?rev=1.33&content-type=text/x-cvsweb-markup">rdate(1)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/sndiod/sndiod.c?rev=1.18&content-type=text/x-cvsweb-markup">sndiod(8)</a> or the introduction of <tt>SOCK_DNS</tt> <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=socket&sektion=2">socket(2)</a> flag that makes an <tt>SS_DNS</tt> tagged socket conceptually different from a plain socket.

<li>it also has been used to constraint programs in a more strict POSIX subset, like some <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/gnu/usr.bin/binutils-2.17/binutils/objdump.c?rev=1.2&content-type=text/x-cvsweb-markup">binutils</a> tools that handle untrusted data (<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=strings&sektion=1">strings(1)</a>, <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=objdump&sektion=1">objdump(1)</a>, ...), or the RSA-privsep process in <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/smtpd/ca.c?rev=1.15&content-type=text/x-cvsweb-markup">smtpd(1)</a>.

<li>It also has been used to constrain programs to a more limited POSIX subset, such as some <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/gnu/usr.bin/binutils-2.17/binutils/objdump.c?rev=1.2&content-type=text/x-cvsweb-markup">binutils</a> tools that handle untrusted data (<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=strings&sektion=1">strings(1)</a>, <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=objdump&sektion=1">objdump(1)</a>, ...), or the RSA-privsep process in <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/smtpd/ca.c?rev=1.15&content-type=text/x-cvsweb-markup">smtpd(1)</a>.

</ul>

<p>

Line 117

<li>Remove support for obsolete IPv6 socket options.

<li>New <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=etherip&sektion=4">etherip(4)</a>

pseudo-device for tunnelling Ethernet frames across IP[46] networks using RFC 3378 EtherIP encapsulation.

<li>New <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pair&sektion=4">pair(4)</a> pseudo-device for ...

<li>...

</ul>

<p>

Line 181

Line 182

<li>Many improvements were made to the GPT kernel support to ensure safe and reliable operation of GPT and MBR processing.

<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=disklabel&sec=8">disklabel(8)</a> no longer supports boot code installation, with the -B and -b flags being removed. The associated fields in the disklabel were also removed. These functions are now all performed by

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=installboot&sektion=8">installboot(8)</a>.

<li>PowerPC converted to secure-PLT ABI variant.

<li>Perform lazy binding updates in <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so&sektion=1">ld.so(1)</a> using <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=kbind&sektion=2">kbind(2)</a> to improve security and reduce overhead in threaded processes.

<li>Over 100 internal or obsolete interfaces have been deleted or are no longer exported by libc, reducing symbol conflicts and process size.

<li>libc now uses local references for most of its own functions to avoid symbol overriding, improve standards compliance, increase speed, and reduce dynamic linking overhead.

<li>Handle intra-thread kills via new <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=thrkill&sektion=2">thrkill(2)</a> system call to tighten pledge(2) restrictions and improve pthread_kill(3) and pthread_cancel(3) compliance.

<li>Added <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getpwnam_shadow&sektion=3">getpwnam_shadow(3)</a> and <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getpwuid_shadow&sektion=3">getpwuid_shadow(3)</a> to permit tighter pledge(2) restrictions.

<li>Added support to <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ktrace&sektion=1">ktrace(1)</a> the arguments to <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=execve&sektion=2">execve(2)</a> and <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pledge&sektion=2">pledge(2)</a>. Removed support for tracing context switch points. <tt>kevent</tt> structures are now dumped.

<li>...

</ul>

<p>