HardenedBSD Status Report Shawn Webb shawn.webb@hardenedbsd.org Oliver Pinter oliver.pinter@hardenedbsd.org Introducing HardenedBSD's New Binary Updater secadm Beta Published New Package Building Server secadm HardenedBSD Haswell Support Nightly Builds for HardenedBSD Haswell Support

HardenedBSD has been hard at work with major improvements. We have been working on making our enhancements more performant and stable. We switched from basing the per-process security flags to per-thread, increasing performance by removing an extra layer of locking when checking and applying the security flags. We've refactored how ASLR is applied to mmap(MAP_32BIT) requests. lib32 is now disabled by default in HardenedBSD.

We've implemented a new binary update mechanism called hbsd-update, fully replacing freebsd-update. hbsd-update can even install into jails and ZFS Boot Environments (ZFS BEs). It uses RSA keys embedded into X.509 certificates in order to provide secure updates.

secadm 0.3-beta has landed. It has been rewritten from scratch in order to be more efficient. As such, the rule syntax has changed and you'll need to update your rules according to the README in the project.

HardenedBSD's infrastructure is growing at a tremendous pace. We now have a server donated by G2, Inc and hosted by Automated Tendencies that can do a full package build within 35 hours, down from 75 hours. This new server will serve as the new package building server and will also provide weekly binary updates for base and kernel.

The awesome work FreeBSD's dumbbell@ is doing to support Haswell has been integrated into an experimental HardenedBSD 11-CURRENT branch. Shawn Webb and Michael Shirk are both running this branch on their laptops with complete success. Shawn's laptop is his daily driver, also utilizing multiple monitors. Binary updates are provided for this branch.

In order to focus on making HardenedBSD as awesome as it can be, we have officially closed the ASLR upstreaming patches. The upstreaming attempt has taken over two years and did not succeed. As real-world deployments over the past two years have shown, our ASLR implementation is rock solid and performs well. We would love it if FreeBSD merged in our work as this is something the whole FreeBSD community at large could benefit from. FreeBSD is always welcome to pull from HardenedBSD.

Automated Tendencies G2, Inc SoldierX