On Wed, Feb 22, 2017 at 7:07 AM, Joel Dahl <j...@vnode.se> wrote: > On Tue, Feb 21, 2017 at 02:40:02PM +0000, Alexey Dokuchaev wrote: > > On Tue, Feb 21, 2017 at 08:34:29AM -0600, Eric Badger wrote: > > > Thanks for working on making it easier to harden FreeBSD. While > > > defaulting some of these options to "on" seem pretty harmless (e.g. > > > random_pid), others are likely to cause confusion for new and > > > experienced users alike (e.g. proc_debug. I've never used that option > > > before, so I gave it a try. It simply causes gdb to hang when > attempting > > > to start a process, with no obvious indication of why). > > > > I concur. In fact, harmless knobs should probably be turned on by > default > > in FreeBSD itself (i.e., without any "hardening" help from the > installer), > > while more intrusive ones should be opt-in, not opt-out. > > I agree. Can we back this out and discuss it on current@? >
With all due respect, I would rather not. The only reason is that it's been discussed so many times over the years and neither of the discussion ended up in anything improving the security of the OS and this is exactly why I took the action and started introducing the hardening options to the bsdinstall. Mind, you can always disable them, they won't be enabled in base OS for a while and this is the best way to assert wether they do have any negative impact. They've been around as OFF by default since 11.0-R and so far no one complained. Kind regards, Bartek Rutkowski _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
