@emaste I apologize if I'm' sending this question to the wrong person. If I did, please let me know who I should redirect to.

I recently wholesale replaced the README.md file with the main #HardenedBSD documentation. Previously, README.md was left untouched.

I just now realized I might have removed some language that might be legally required regarding #FreeBSD. For example, licensing and copyright information.

I would be happy to re-add that language, or anything else legally required, on the main README.md file--whet gets displayed first in a web browser: https://radicle.network/nodes/rad.hardenedbsd.org/rad:z4Aucnb2nozutuek6o8PC9YfaBeTm

(That is the link to our lighter-weight documentation repo. The README.md in our src tree comes from that.)

Would you happen to know, or could direct me to someone who would, whether I need to re-add any language?

(Public visibility on this question to help maintain transparency around a potentially sensitive subject. I realize most folks would likely rather send an email.)

One wonderful thing about migrating from #GitLab to #Radicle is that we got rid of our one and only #Linux VM. The #HardenedBSD dev/build infrastructure now runs 100% on HardenedBSD (rather than 99% 🙂).

Edit[0]: Clarified that it's the dev/build infrastructure that's 100% HardenedBSD. We do have one off-site backup system (maintained by a trusted third party) running OpenBSD.

This #FreeBSD bug highlights a strength of one of the features that makes #HardenedBSD attractive: optional blocking of loading of kernel modules.

HardenedBSD provides a sysctl node: hardening.pax.kmod_load_disable. By default, it is set to 0, permitting loading of kernel modules. When set to 1, loading kernel modules is prohibited. When set to 2, loading kernel modules is prohibited and a reboot is required to permit loading kernel modules once again.

HardenedBSD also has a notion of "insecure/untrusted" kernel modules. Some kernel modules in base, most notably the #Linux syscall emulation layer known as the linuxulator, are explicitly marked as untrustworthy. Users wishing to use those kernel modules must explicitly tag them as trusted (hbsdcontrol pax disable insecure_kmod /path/to/kernel/module.ko). Only then will the kernel module be permitted to load (the hardening.pax.kmod_load_disable sysctl node does need to be set to 0).

These two features can help protect users against situations where kernel modules get autoloaded, like with puppet, ifconfig, zfs, and other tools.

#infosec #FatGid