bsdinstall: avoid conflicts with fd 3

Throughout the bsdinstall script fd 3 is used by f_dprintf (set through
$TERMINAL_STDOUT_PASSTHRU). In several places in the bsdinstalls scripts,
we use fd 3 to

bsdinstall: avoid conflicts with fd 3

Throughout the bsdinstall script fd 3 is used by f_dprintf (set through
$TERMINAL_STDOUT_PASSTHRU). In several places in the bsdinstalls scripts,
we use fd 3 to juggle stdout when calling out to other tools, which can
cause the installer to fail with a "Bad file descriptor" error when
f_dprintf attempts to use it.

This commit replaces all constructs like this:

exec 3>&1
SOME_VARIABLE=$(some command 2>&1 1>&3)
exec 3>&-

With:

exec 5>&1
SOME_VARIABLE=$(some command 2>&1 1>&5)
exec 5>&-

PR: 273148
Reviewed by: corvink
Fixes: 1f7746d81f53447ac15cc99395bb714d4dd0a4da ("bsdinstall: stop messing with file descriptors")
MFC after: 1 week

show more ...

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

bsdinstall: remove sendmail hardening option

sendmail is fully disabled in 14.0 by default

Reviewed by: imp, emaste
Differential Revision: https://reviews.freebsd.org/D40367

bsdinstall: allow whitelabeling the scripts

Approved by: allanjude, asiciliano
Differential Revision: https://reviews.freebsd.org/D35197
Sponsored by: Rubicon Communications, LLC ("Netgate")

bsdinstall hardening: Replace dialog with bsddialog

bsdinstall/scripts/hardening: Replace (LGPL) dialog utility with
(BSD-2-CLAUSE) dialog utility.

Approved by: bapt (mentor)
Differential Revision

bsdinstall hardening: Replace dialog with bsddialog

bsdinstall/scripts/hardening: Replace (LGPL) dialog utility with
(BSD-2-CLAUSE) dialog utility.

Approved by: bapt (mentor)
Differential Revision: https://reviews.freebsd.org/D34102

show more ...

Revert "bsdinstall: add knob to set ASLR sysctls"

This reverts commit 020f4112559ebf7e94665c9a69f89d21929ce82a.

Because now ASLR is enabled by default for 64-bit architectures
and the purpose of th

Revert "bsdinstall: add knob to set ASLR sysctls"

This reverts commit 020f4112559ebf7e94665c9a69f89d21929ce82a.

Because now ASLR is enabled by default for 64-bit architectures
and the purpose of the installation menu is to allow choosing
additional 'mitigation'/'hardening' options that are originally
disabled, remove the ASLR knob from bsdinstall.

Discussed with: emaste
Obtained from: Semihalf
Sponsored by: Stormshield

show more ...

bsdinstall: add knob to set ASLR sysctls

Reviewed by: mw
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D28418

bsdinstall: replace multiple ifs with case

Reduce copy-paste and use a more typical construct.

Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D28417

MFH r338661 through r339200.

Sponsored by: The FreeBSD Foundation

Merge ^/head r338731 through r338987.

Add an installer option to disable destructive dtrace.

Submitted by: Jörg Pernfuß <code.jpe@gmail.com>
Approved by: re (kib)
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D

Add an installer option to disable destructive dtrace.

Submitted by: Jörg Pernfuß <code.jpe@gmail.com>
Approved by: re (kib)
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D12474

show more ...

Merge ^/head r323559 through r325504.

MFhead@r324482

bsdinstall(8) hardening menu: Utilize new kern.randompid=1 behaviour

Enabling the PID randomization option in bsdinstall(8)'s hardening menu
now randomizes the effective value of kern.randompid on e

bsdinstall(8) hardening menu: Utilize new kern.randompid=1 behaviour

Enabling the PID randomization option in bsdinstall(8)'s hardening menu
now randomizes the effective value of kern.randompid on each boot.

Previous behaviour:
When kern.randompid was enabled via the the bsdinstall(8) hardening menu,
a random value was generated and placed in the systems /etc/sysctl.conf as
kern.randompid=value
This makes the value of kern.randompid static across reboots.

New behaviour:
When kern.randompid is enabled via the bsdinstall(8) hardening menu, the
line kern.randompid=1 is placed in the systems /etc/sysctl.conf.
This takes advantage of a new kernel feature and makes the value of
kern.randompid be randomized by the kernel on each reboot.

Submitted by: Marie Helene Kvello-Aune <marieheleneka@gmail.com>
Reviewed by: des
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D12433

show more ...

MFhead@r320180

Merge ^/head r319973 through 321382.

Merge ^/head r321307 through r321350.

Remove stack guard option from hardening menu.

Since kib's change the stack guard is now ON by default,
this option in hardening menu of bsdinstall is no longer needed.

Submitted by: Bartlomiej Rut

Remove stack guard option from hardening menu.

Since kib's change the stack guard is now ON by default,
this option in hardening menu of bsdinstall is no longer needed.

Submitted by: Bartlomiej Rutkowski <robak@FreeBSD.org>
Reviewed by: bapt
Approved by: bapt
MFC after: 1 day
Sponsored by: Pixeware LTD
Differential Revision: https://reviews.freebsd.org/D11686

show more ...

Merge ^/head r320573 through r320970.

usr.sbin/bsdinstall/scripts/hardening: fix options numbers

Submitted by: Bartek Rutkowski <robak@FreeBSD.org>
Reviewed by: bapt
Approved by: bapt
MFC after: 1 day
Differential Revision: https://revi

usr.sbin/bsdinstall/scripts/hardening: fix options numbers

Submitted by: Bartek Rutkowski <robak@FreeBSD.org>
Reviewed by: bapt
Approved by: bapt
MFC after: 1 day
Differential Revision: https://reviews.freebsd.org/D11505

show more ...

Add option to bsdinstall to disable insecure console, update stack guard option

This patch adds new bsdinstall option to hardening section that allows users
to change this behaviour to secure one an

Add option to bsdinstall to disable insecure console, update stack guard option

This patch adds new bsdinstall option to hardening section that allows users
to change this behaviour to secure one and updates stack guard option so it
would set the value of relevant sysctl to 512 (2MB)

Submitted by: Bartek Rutkowski
Reviewed by: adrian, bapt, emaste
Approved by: bapt, emaste
MFC after: 1 day
Sponsored by: Pixeware LTD
Differential Revision: https://reviews.freebsd.org/D9700

show more ...

Merge ^/head r320398 through r320572.

Add hardening menu item for security.bsd.see_jail_proc

Approved by: allanjude
Differential Revision: https://reviews.freebsd.org/D11283

Revert changes introduced in r314036 on demand by jhb and bapt.

Approved by: bapt, jhb

Merge ^/head r313896 through r314128.