The release of the free cross-platform UNIX-like operating system OpenBSD 7.0 has been announced. It is noted that this is the 51st release of the project, which will turn 26 years old on October 18. The OpenBSD project was founded by Theo de Raadt in 1995 after a conflict with the developers of NetBSD, which resulted in Theo being denied access to the NetBSD CVS repository. Subsequently, Theo de Raadt, along with a group of like-minded individuals, created a new open operating system based on the source code tree of NetBSD, with primary goals of portability (supporting 13 hardware platforms), standardization, correctness, proactive security, and integrated cryptographic tools. The full installation ISO image size of the base system OpenBSD 7.0 is 554 MB.
In addition to the operating system itself, the OpenBSD project is known for its components, which have been adopted in other systems and established themselves as some of the safest and highest-quality solutions. Among them are: LibreSSL (a fork of OpenSSL), OpenSSH, the packet filter PF, the OpenBGPD and OpenOSPFD routing daemons, the OpenNTPD NTP server, mail server OpenSMTPD, terminal multiplexer (similar to GNU screen) tmux, the identd daemon implementing the IDENT protocol, BSDL alternative to the GNU groff package — mandoc, protocol for organizing fault-tolerant systems CARP (Common Address Redundancy Protocol), lightweight HTTP server, and file synchronization utility OpenRSYNC. server Support for Raspberry Pi 5 boards has been added in the port for the ARM64 architecture, the acpicpu driver has been implemented, and apm (Advanced Power Management) and sysctl hw.cpuspeed are operational on devices with Qualcomm Snapdragon X Elite chips.
Key Improvements:
- A port for 64-bit systems based on the RISC-V architecture has been added. Currently, support is provided for operation on HiFive Unmatched boards and partially on the PolarFire SoC Icicle Kit.
- In the port for ARM64 platforms, support for Apple devices with M1 processors has been improved, though still not fully finalized. As it stands, installation of OpenBSD on a disk with GPT is supported, and there are drivers for USB 3, NVME, GPIO, and SPMI. In addition to M1, support for Raspberry Pi 3 Model B+ and boards based on the Rockchip RK3399 SoC has also been expanded.
- For the AMD64 architecture, the GCC compiler is disabled by default (only Clang is left). Previously, GCC was disabled for the armv7 and i386 architectures.
- Maintenance of the SGI platform has been discontinued.
- For amd64, arm64, i386, sparc64, and powerpc64 platforms, the kernel build with dynamic tracing system dt support is enabled by default. A kprobes provider has been added for collecting information on events at the kernel level.
- In btrace, support for the operators "" in filters has been implemented, and the output of time spent in user space during kernel stack analysis has been ensured.
- A configuration file /etc/bsd.re-config has been added, which can be used to configure the kernel at boot time and to enable/disable specific devices.
- Support has been provided for detecting the presence of TPM 2.0 devices and correctly executing commands for transitioning to sleep mode (resolving the issue with waking up ThinkPad X1 Carbon Gen 9 and ThinkPad X1 Nano laptops).
- The implementation of kqueue has been converted to use mutexes.
- The ability to configure the buffer size for PF_UNIX sockets via sysctl has been implemented. The default buffer size has been increased to 8 KB.
- Improved support for multiprocessor systems (SMP). The pmap_extract() call has been made mp-safe on hppa and amd64 systems. The code for counting references to anonymous objects, part of the exception handler, and the functions lseek, connect, and setrtable has been moved out of the kernel's global lock. Separate CPU message buffers have been implemented for each core during a crash (panic).
- The Direct Rendering Manager (drm) framework implementation has been synchronized with the Linux kernel 5.10.65. Improved support for Intel chips based on the Tiger Lake microarchitecture has been added to the inteldrm driver. The amdgpu driver now supports the GPU Navi 12, Navi 21 'Sienna Cichlid', Arcturus, and the APU Cezanne 'Green Sardine' Ryzen 5000.
- Support for new hardware has been added, including Aquantia AQC111U/AQC112U USB Ethernet, Aquantia 1/2.5/5/10Gb/s PCIe Ethernet, Cadence GEM, Broadcom BCM5725, RTL8168FP/RTL8111FP/RTL8117. Improved support for Intel platforms based on the Tiger Lake microarchitecture. A driver for keyboards with a USB HID Consumer Control interface has been added, which uses application call buttons, audio playback control, and volume adjustment.
- Improvements have been made to the VMM hypervisor. A limit of 512 VCPUs per virtual machine has been added. Issues with VCPU locks have been resolved. The vmd backend for managing virtual machines now includes support for protection against guest systems with malicious virtio drivers.
- The timeout utility has been ported from NetBSD, allowing command execution time to be limited.
- In the openrsync file synchronization utility, 'include' and 'exclude' options have been implemented.
- The ps utility now displays information about associated groups.
- The mg text editor has added the 'dired-jump' command.
- The fdisk and newfs utilities have improved support for disks with a 4K sector size. The fdisk code for MBR/GPT initialization has been revamped, and recognition of GPT partitions 'BIOS Boot', 'APFS', 'APFS ISC', 'APFS Recovery' (sic), 'HiFive FSBL', and 'HiFive BBL' has been added. An '-A' option for initializing GPT without removing boot partitions has been added.
- In the traceroute utility, processing verification packets and DNS requests asynchronously has been implemented to speed up operations.
- The doas utility now provides three attempts for password entry.
- In xterm, filesystem access isolation has been ensured using the unveil() system call. ftpd processes are protected using pledge.
- Implemented logging of incorrect usage of the formatting parameter "%n" in the printf function.
- The implementation of IPsec in iked has added support for DNS configuration on the client side.
- Support for SNMPv1 and SNMPv2c protocols is disabled by default in snmpd in favor of using SNMPv3.
- By default, dhcpleased and resolvd processes are enabled, allowing configuration of IPv4 addresses via DHCP. The dhclient utility remains in the system as an option. The route utility has added the "nameserver" command to pass DNS server information to resolvd.
- LibreSSL has added support for TLSv3 API from OpenSSL 1.1.1 and activated a new X.509 validator that supports correct verification of cross-signed certificates.
- OpenSMTPD has added support for TLS options "cafile=(path)", "nosni", "noverify", and "servername=(name)". In SMTP, it is now possible to select cipher and protocol options for TLS.
- The OpenSSH package has been updated. A detailed overview of improvements can be found here: OpenSSH 8.7, OpenSSH 8.8. Support for digital signatures rsa-sha has been disabled.
- The number of ports for the AMD64 architecture reached 11325, for aarch64 — 11034, for i386 — 10248. Among the application versions in the ports: FFmpeg 4.4, GCC 8.4.0 and 11.2.0, GNOME 40.4, Go 1.17, JDK 8u302, 11.0.12 and 16.0.2, KDE Applications 21.08.1, KDE Frameworks 5.85.0, LLVM/Clang 11.1.0, LibreOffice 7.2.1.2, Lua 5.1.5, 5.2.4 and 5.3.6, MariaDB 10.6.4, Node.js 12.22.6, PHP 7.3.30, 7.4.23 and 8.0.10, Postfix 3.5.12, PostgreSQL 13.4, Python 2.7.18, 3.8.12 and 3.9.7, Qt 5.15.2 and 6.0.4, Ruby 2.6.8, 2.7.4 and 3.0.2, Rust 1.55.0, SQLite 3.35.5, Xfce 4.16.
- Updated third-party components included in OpenBSD 7.0:
- The Xenocara graphics stack based on X.Org 7.7 with xserver 1.20.13 + patches, freetype 2.10.4, fontconfig 2.12.4, Mesa 21.1.8, xterm 367, xkeyboard-config 2.20, fonttosfnt 1.2.2.
- LLVM/Clang 11.1.0 (+ patches)
- GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
- Perl 5.32.1 (+ patches)
- NSD 4.3.7
- Unbound 1.13.3
- Ncurses 5.7
- Binutils 2.17 (+ patches)
- Gdb 6.3 (+ patch)
- Awk 18.12.2020
- Expat 2.4.1
Source: opennet.ru
