SECURITY(8)             NetBSD System Manager's Manual             SECURITY(8)

NNAAMMEE
     sseeccuurriittyy -- NetBSD security features

DDEESSCCRRIIPPTTIIOONN
     NetBSD supports a variety of security features.  Below is a brief
     description of them with some quick usage examples that will help you get
     started.

     Contents:
     --   Veriexec (file integrity)
     --   Exploit mitigation
     --   Per-user _/_t_m_p directory
     --   Information filtering

VVEERRIIEEXXEECC
     _V_e_r_i_e_x_e_c is an in-kernel, real-time, file-system independent, file
     integrity subsystem.  It can be used for a variety of purposes, including
     defense against trojaned binaries, indirect attacks via third-party
     remote file-systems, and configuration file corruption.  _V_e_r_i_e_x_e_c can
     operate in four modes, also referred to as strict levels:

     Learning mode (strict level 0)
           The only level at which the fingerprint tables can be modified,
           this level is used to help fine-tune the signature database.  No
           enforcement is made, and verbose information is provided (finger-
           print matches and mismatches, file removals, incorrect access,
           etc.).

     IDS mode (strict level 1)
           IDS (intrusion detection system) mode provides an adequate level of
           integrity for the files it monitors.  Implications:

           --   Monitored files cannot be removed
           --   If raw disk access is granted to a disk with monitored files on
               it, all monitored files' fingerprints will be invalidated
           --   Access to files with mismatched fingerprints is denied
           --   Write access to monitored files is allowed
           --   Access type is not enforced

     IPS mode (strict level 2)
           IPS (intrusion prevention system) mode provides a high level of
           integrity for the files it monitors.  Implications:

           --   All implications of IDS mode
           --   Write access to monitored files is denied
           --   Access type is enforced
           --   Raw disk access to disk devices with monitored files on them is
               denied
           --   Execution of non-monitored files is denied
           --   Write access to kernel memory via _/_d_e_v_/_m_e_m and _/_d_e_v_/_k_m_e_m is
               denied

     Lockdown mode (strict level 3)
           Lockdown mode provides high assurance integrity for the entire sys-
           tem.  Implications:

           --   All implications of IPS mode
           --   Access to non-monitored files is denied
           --   Write access to files is allowed only if the file was opened
               before the strict level was raised to this mode
           --   Creation of new files is denied
           --   Raw access to system disks is denied

     _V_e_r_i_e_x_e_c requires a list of monitored files, along with their digital
     fingerprint and (optionally) access modes.  NetBSD provides a tool,
     veriexecgen(8), for this purpose.  Example usage:

           # veriexecgen

     _V_e_r_i_e_x_e_c requires a pseudo-device to run:

           pseudo-device veriexec 1

     Additionally, one or more options for digital fingerprint algorithm sup-
     port:

           options VERIFIED_EXEC_FP_SHA256
           options VERIFIED_EXEC_FP_SHA512

     See your kernel's config file for an example.

     On amd64, i386, prep, and sparc64 GENERIC kernels, _V_e_r_i_e_x_e_c is enabled by
     default.

     _V_e_r_i_e_x_e_c also requires enabling in rc.conf(5):

           veriexec=YES
           veriexec_strict=1 # IDS mode

EEXXPPLLOOIITT MMIITTIIGGAATTIIOONN
     NetBSD incorporates some exploit mitigation features.  The purpose of
     exploit mitigation features is to interfere with the way exploits work,
     in order to prevent them from succeeding.  Due to that, some features may
     have other impact on the system, so be sure to fully understand the
     implications of each feature.

     NetBSD provides the following exploit mitigation features:
     --   PaX MPROTECT (mprotect(2) restrictions)
     --   PaX SegvGuard
     --   gcc(1) stack-smashing protection (SSP)

   PPaaXX MMPPRROOTTEECCTT
     _P_a_X _M_P_R_O_T_E_C_T implements memory protection restrictions, meant to comple-
     ment non-executable mappings.  Their purpose is to prevent situations
     where malicious code attempts to mark writable memory regions as exe-
     cutable, often by trashing arguments to an mprotect(2) call.

     While it can be enabled globally, NetBSD provides a tool, paxctl(8), to
     enable _P_a_X _M_P_R_O_T_E_C_T on a per-program basis.

     Example usage:

           # paxctl +M /usr/sbin/sshd

     Enabling _P_a_X _M_P_R_O_T_E_C_T globally:

           # sysctl -w security.pax.mprotect.global=1

   PPaaXX SSeeggvvgguuaarrdd
     _P_a_X _S_e_g_v_g_u_a_r_d monitors the number of segmentation faults in a program on
     a per-user basis, in an attempt to detect on-going exploitation attempts
     and possibly prevent them.  For instance, _P_a_X _S_e_g_v_g_u_a_r_d can help detect
     when an attacker tries to brute-force a function return address, when
     attempting to perform a return-to-lib attack.

     _P_a_X _S_e_g_v_g_u_a_r_d consumes kernel memory, so use it wisely.  While it pro-
     vides rate-limiting protections, records are tracked for all users on a
     per-program basis, meaning that irresponsible use may result in tracking
     all segmentation faults in the system, possibly consuming all kernel mem-
     ory.

     For this reason, it is highly recommended to have _P_a_X _S_e_g_v_g_u_a_r_d enabled
     explicitly only for network services, etc.  Enabling _P_a_X _S_e_g_v_g_u_a_r_d
     explicitly works like this:

           # paxctl +G /usr/sbin/sshd

     However, a global knob is still provided, for use in strict environments
     with no local users (some network appliances, embedded devices, fire-
     walls, etc.):

           # sysctl -w security.pax.segvguard.global=1

     Explicitly disabling _P_a_X _S_e_g_v_g_u_a_r_d is also possible:

           # paxctl +g /bin/ls

     In addition, _P_a_X _S_e_g_v_g_u_a_r_d provides several tunable options.  For exam-
     ple, to limit a program to 5 segmentation faults from the same user in a
     60 second timeframe:

           # sysctl -w security.pax.segvguard.max_crashes=5
           # sysctl -w security.pax.segvguard.expiry_timeout=60

     The number of seconds a user will be suspended from running the culprit
     program is also configurable.  For example, 10 minutes seem like a sane
     setting:

           # sysctl -w security.pax.segvguard.suspend_timeout=600

   GGCCCC SSttaacckk SSmmaasshhiinngg PPrrootteeccttiioonn (SSSSPP)
     As of NetBSD 4.0, gcc(1) includes _S_S_P, a set of compiler extensions to
     raise the bar on exploitation attempts by detecting corruption of vari-
     ables and buffer overruns, which may be used to affect program control
     flow.

     Upon detection of a buffer overrun, _S_S_P will immediately abort execution
     of the program and send a log message to syslog(3).

     The system (userland and kernel) can be built with _S_S_P by using the
     ``USE_SSP'' flag in _/_e_t_c_/_m_k_._c_o_n_f:

           USE_SSP=yes

     You are encouraged to use _S_S_P for software you build, by providing one of
     the --ffssttaacckk--pprrootteeccttoorr or --ffssttaacckk--pprrootteeccttoorr--aallll flags to gcc(1).  Keep in
     mind, however, that _S_S_P will not work for functions that make use of
     alloca(3), as the latter modifies the stack size during run-time, while
     _S_S_P relies on it being a compile-time static.

     Use of _S_S_P is especially encouraged on platforms without per-page execute
     bit granularity such as _i_3_8_6.

PPEERR--UUSSEERR TTEEMMPPOORRAARRYY SSTTOORRAAGGEE
     It is possible to configure per-user temporary storage to avoid potential
     security issues (race conditions, etc.) in programs that do not make
     secure usage of _/_t_m_p.

     To enable per-user temporary storage, add the following line to
     rc.conf(5):

           per_user_tmp=YES

     If _/_t_m_p is a mount point, you will also need to update its fstab(5) entry
     to use ``/private/tmp'' (or whatever directory you want, if you override
     the default using the ``per_user_tmp_dir'' rc.conf(5) keyword) instead of
     ``/tmp''.

     Following that, run:

           # /etc/rc.d/perusertmp start

IINNFFOORRMMAATTIIOONN FFIILLTTEERRIINNGG
     NetBSD provides administrators the ability to restrict information passed
     from the kernel to userland so that users can only view information they
     ``own''.

     The hooks that manage this restriction are located in various parts of
     the system and affect programs such as ps(1), fstat(1), and netstat(1).
     Information filtering is enabled as follows:

           # sysctl -w security.curtain=1

SSEEEE AALLSSOO
     sysctl(3), options(4), paxctl(8), sysctl(8), veriexecctl(8),
     veriexecgen(8)

AAUUTTHHOORRSS
     Elad Efrat <elad@NetBSD.org>

NetBSD 4.0                     February 4, 2007                     NetBSD 4.0
