HardenedBSD @HardenedBSD@bsd.network

#HardenedBSD bug report: https://radicle.network/nodes/rad.hardenedbsd.org/src/issues/746623c1093a6813256cba7162bbf54f3cfb4170

Update the hardening(4) manual page

If writing mandoc is your thing, and you would like to contribute to HardenedBSD, please submit us a patch over #Radicle.

If you're unfamiliar with Radicle, I can help step you through the initial process of getting started (on a HardenedBSD system, of course.) Getting familiarized with their User Guide is a good first step: https://radicle.dev/guides/user

Today is #FreeBSD Security Advisory day. I will cherry-pick the fixes into the relevant #HardenedBSD quarterly branches today.

I will probably kick off new builds either tomorrow (Thursday) or Saturday.

#infosec

Official update on the #HardenedBSD 2026Q3 builds is out: https://groups.google.com/a/hardenedbsd.org/g/users/c/lJOnzLWfVGI/m/-d1pOBipAwAJ

This includes a slight detour to talk about adjusting our release engineering process to take into account an interesting security feature built into #Radicle.

#HardenedBSD 16-CURRENT 2026Q3 installer images and OS update published.

I am going to wait a little bit to let my body recover to do the Cross-DSO CFI and Pledge feature branches. I'll work on those next week. I'll make sure to base them on around the same time as the last update to our primary development branch (aka, 16-CURRENT) hardened/current/master.

#HardenedBSD 15-STABLE 2026Q3 installer images and OS update published.

#HardenedBSD 15-stable 2026q3 installer/update build process started. quarterly release for 15-stable should complete in around 24-48 hours.

I plan to start on the #HardenedBSD 2026q3 release engineering process this afternoon after the next autosync. I hope to have the builds published by the end of this coming weekend.

I'm supposed to start the #HardenedBSD quarterly release engineering process this coming weekend. that work might be delayed. I'll probably ssh into the build VMs and comment out the cronjob before this weekend.

#HardenedBSD mitigated #FreeBSD SA-26:34 back in March 2023 with commit c7d6d4bb4874720d9dab1625df62c2ea6eeb9df5.

Correction to come soon regarding TIOSCTI. Sorry for the misinformation. Hopefully the text above, included for transparency, is rendered strikethrough.

FreeBSD SA-26:32 is not applicable at all to HardenedBSD.

#infosec

This #FreeBSD bug highlights a strength of one of the features that makes #HardenedBSD attractive: optional blocking of loading of kernel modules.

HardenedBSD provides a sysctl node: hardening.pax.kmod_load_disable. By default, it is set to 0, permitting loading of kernel modules. When set to 1, loading kernel modules is prohibited. When set to 2, loading kernel modules is prohibited and a reboot is required to permit loading kernel modules once again.

HardenedBSD also has a notion of "insecure/untrusted" kernel modules. Some kernel modules in base, most notably the #Linux syscall emulation layer known as the linuxulator, are explicitly marked as untrustworthy. Users wishing to use those kernel modules must explicitly tag them as trusted (hbsdcontrol pax disable insecure_kmod /path/to/kernel/module.ko). Only then will the kernel module be permitted to load (the hardening.pax.kmod_load_disable sysctl node does need to be set to 0).

These two features can help protect users against situations where kernel modules get autoloaded, like with puppet, ifconfig, zfs, and other tools.

#infosec #FatGid

This kernel vulnerability in #FreeBSD is fully mitigated in #HardenedBSD by default: https://www.freebsd.org/security/advisories/FreeBSD-SA-26:21.ptrace.asc

HardenedBSD does not permit ptrace(PT_REMOTE_SC) by default. In fact, multiple sysctl nodes must be toggled to even support ptrace. We have a separate sysctl node for performing syscalls over the ptrace boundary (hardening.prohibit_ptrace_syscall, default 1).

I've now written some documentation on how to bootstrap the larger #HardenedBSD repos (src and ports) with #Radicle : https://radicle.network/nodes/rad.hardenedbsd.org/rad%3Az4Aucnb2nozutuek6o8PC9YfaBeTm#contributing-to-hardenedbsd

The #HardenedBSD wiki is now on #Radicle: https://radicle.network/nodes/rad.hardenedbsd.org/rad:z4Aucnb2nozutuek6o8PC9YfaBeTm/tree/Home.md

RID: rad:z4Aucnb2nozutuek6o8PC9YfaBeTm