The release of the free UNIX-like operating system OpenBSD 7.3 has been announced. The OpenBSD project was founded by Theo de Raadt in 1995 after a conflict with the NetBSD developers, which resulted in Theo being denied access to the NetBSD CVS repository. After this, Theo de Raadt and a group of like-minded individuals created a new open-source operating system based on the NetBSD source tree, with the main goals of development being portability (supporting 13 hardware platforms), standardization, correctness, proactive security, and integrated cryptographic tools. The size of the full installation ISO image of the base system OpenBSD 7.3 is 620 MB.
In addition to the operating system itself, the OpenBSD project is known for its components, which have been adopted in other systems and established themselves as some of the safest and highest-quality solutions. Among them are: LibreSSL (a fork of OpenSSL), OpenSSH, the packet filter PF, the OpenBGPD and OpenOSPFD routing daemons, the OpenNTPD NTP server, mail server OpenSMTPD, terminal multiplexer (similar to GNU screen) tmux, the identd daemon implementing the IDENT protocol, BSDL alternative to the GNU groff package — mandoc, protocol for organizing fault-tolerant systems CARP (Common Address Redundancy Protocol), lightweight HTTP server, and file synchronization utility OpenRSYNC. server Support for Raspberry Pi 5 boards has been added in the port for the ARM64 architecture, the acpicpu driver has been implemented, and apm (Advanced Power Management) and sysctl hw.cpuspeed are operational on devices with Qualcomm Snapdragon X Elite chips.
Key Improvements:
- System calls implemented include waitid (waiting for process state changes), pinsyscall (to pass information about the execve entry point for protection against ROP exploits), getthrname, and setthrname (to get and set thread names).
- A clockintr interrupt scheduler, hardware-independent, has been utilized for all architectures.
- A new sysctl kern.autoconf_serial has been added, which can be used to track changes in the device tree state in the kernel from user space.
- Support for multiprocessor systems (SMP) has been improved. The event filters for tun and tap devices have been classified as mp-safe. The following functions have been freed from locks: select, pselect, poll, ppoll, getsockopt, setsockopt, mmap, munmap, mprotect, sched_yield, minherit, and utrace, as well as ioctl SIOCGIFCONF, SIOCGIFGMEMB, SIOCGIFGATTR, and SIOCGIFGLIST. Improvements have been made to lock management in the packet filter pf, increasing system and network stack performance on multi-core systems.
- The implementation of the drm (Direct Rendering Manager) framework has been synchronized with the Linux kernel 6.1.15 (previously 5.15.69). Support for the GPU Ryzen 7000 'Raphael', Ryzen 7020 'Mendocino', Ryzen 7045 'Dragon Range', Radeon RX 7900 XT/XTX 'Navi 31', Radeon RX 7600M (XT), 7700S, and 7600S 'Navi 33' has been added to the amdgpu driver. The amdgpu now includes support for controlling backlighting and running xbacklight using the X.Org modesetting driver. Shader caching is enabled by default in Mesa.
- Improvements have been made to the VMM hypervisor.
- Capabilities have been implemented for enhanced protection of process memory in user space: the mimmutable system call and its corresponding library function, allowing access rights to be fixed when reflected in memory (memory mappings). Once fixed, the access rights set for the memory area, such as write and execute restrictions, cannot be changed through subsequent calls to mmap(), mprotect(), and munmap(), which will return an EPERM error if an attempt is made to modify them.
- On the AMD64 architecture, a RETGUARD protection mechanism has been implemented for system calls, aimed at complicating the execution of exploits built using code reuse and return-oriented programming techniques.
- Protection against the exploitation of vulnerabilities based on unpredictable re-compilation of the sshd executable at each system boot has been enabled. Re-compilation makes function offsets in sshd less predictable, making it more challenging to create exploits using return-oriented programming methods.
- More aggressive stack layout randomization has been provided for 64-bit systems.
- Protection against the Spectre-BHB vulnerability has been added in the microarchitectural structures of processors.
- On ARM64 processors, the DIT (Data Independent Timing) flag has been utilized for user space and kernel to block side-channel attacks that manipulate the timing dependencies of executed instructions based on the data being processed in those instructions.
- The ability to use lladdr for determining network configurations has been provided. For instance, in addition to binding to an interface name (hostname.fxp0), binding to a MAC address (hostname.00:00:6e:00:34:8f) can be utilized.
- Improved support for transitioning to sleep mode for ARM64 architecture-based systems.
- Support for Apple ARM chips has been significantly expanded.
- Support for new hardware has been added, and new drivers have been included.
- In the bwfm driver for wireless cards based on Broadcom and Cypress chips, support for encryption for WEP has been implemented.
- The installer has improved compatibility with software RAID and initial support for disk encryption (Guided Disk Encryption) has been implemented.
- New scroll-top and scroll-bottom commands have been added to tmux ("terminal multiplexer") for scrolling the cursor to the beginning and end. LibreSSL and OpenSSH packages have been updated. A detailed overview of improvements can be found in the release notes for LibreSSL 3.7.0, OpenSSH 9.2, and OpenSSH 9.3.
- The number of ports for the AMD64 architecture has reached 11,764 (up from 11,451), for aarch64 — 11,561 (up from 11,261), and for i386 — 10,572 (up from 10,225). Among the versions of applications in the ports are:
- Asterisk 16.30.0, 18.17.0, and 20.2.0
- Audacity 3.2.5
- CMake 3.25.2
- Chromium 111.0.5563.110
- Emacs 28.2
- FFmpeg 4.4.3
- GCC 8.4.0 and 11.2.0
- GHC 9.2.7
- GNOME 43.3
- Go 1.20.1
- JDK 8u362, 11.0.18, and 17.0.6
- KDE Gears 22.12.3
- KDE Frameworks 5.103.0
- Krita 5.1.5
- LLVM/Clang 13.0.0
- LibreOffice 7.5.1.2
- Lua 5.1.5, 5.2.4, 5.3.6, and 5.4.4
- MariaDB 10.9.4
- Mono 6.12.0.182
- Mozilla Firefox 111.0 and ESR 102.9.0
- Mozilla Thunderbird 102.9.0
- Mutt 2.2.9 and NeoMutt 20220429
- Node.js 18.15.0
- OCaml 4.12.1
- OpenLDAP 2.6.4
- PHP 7.4.33, 8.0.28, 8.1.16, and 8.2.3
- Postfix 3.5.17 and 3.7.3
- PostgreSQL 15.2
- Python 2.7.18, 3.9.16, 3.10.10, and 3.11.2
- Qt 5.15.8 and 6.4.2
- R 4.2.1
- Ruby 3.0.5, 3.1.3, and 3.2.1
- Rust 1.68.0
- SQLite 2.8.17 and 3.41.0
- Shotcut 22.12.21
- Sudo 1.9.13.3
- Suricata 6.0.10
- Tcl/Tk 8.5.19 and 8.6.13
- TeX Live 2022
- Vim 9.0.1388 and Neovim 0.8.3
- Xfce 4.18
- Third-party components included in OpenBSD 7.3 have been updated:
- The Xenocara graphics stack based on X.Org 7.7 with xserver 1.21.6 + patches, freetype 2.12.1, fontconfig 2.14, Mesa 22.3.4, xterm 378, xkeyboard-config 2.20, fonttosfnt 1.2.2.
- LLVM/Clang 13.0.0 (+ patches)
- GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
- Perl 5.36.1 (+ patches)
- NSD 4.6.1
- Unbound 1.17
- Ncurses 5.7
- Binutils 2.17 (+ patches)
- Gdb 6.3 (+ patch)
- Awk 12.9.2022
- Expat 2.5.0.
Source: opennet.ru
