The release of the free UNIX-like operating system OpenBSD 7.4 has been presented. The OpenBSD project was founded by Theo de Raadt in 1995 after a conflict with the NetBSD developers, which resulted in Theo being locked out of the NetBSD CVS repository. Following this, Theo de Raadt and a group of like-minded individuals created a new open operating system based on the NetBSD source tree, with the main development goals being portability (supporting 13 hardware platforms), standardization, correct operation, proactive security, and integrated cryptographic tools. The size of the full installation ISO image of the base system OpenBSD 7.4 is 630 MB. <\/p>\n
In addition to the operating system itself, the OpenBSD project is known for its components, which have gained popularity in other systems and have established themselves as some of the safest and highest-quality solutions. Among them are: LibreSSL (a fork of OpenSSL), OpenSSH, the packet filter PF, the routing daemons OpenBGPD and OpenOSPFD, the NTP server OpenNTPD, the email server OpenSMTPD, the terminal multiplexer (similar to GNU screen) tmux, the identd daemon implementing the IDENT protocol, the BSDL alternative to the GNU groff package \u2014 mandoc, the protocol for organizing fault-tolerant systems CARP (Common Address Redundancy Protocol), and a lightweight HTTP server along with the OpenRSYNC file synchronization utility. <\/p>\n
Key Improvements: <\/p>\n
\n
Components for updating the microcode for AMD processors have been added for amd64 and i386 architectures. New versions of the microcode are automatically installed at boot time. A port has been prepared for distributing the microcode binaries: 'ports\/sysutils\/firmware\/amd'. The installation of the new microcode is carried out using the standard utility fw_update. Similar support for microcode updates for Intel processors was implemented in 2018 and offered in the OpenBSD 6.3 release.\n
For the kernel and user space, protections mechanisms IBT (Indirect Branch Tracking, amd64) and BTI (Branch Target Identification, arm64) have been included, designed to block disruptions to normal execution order (control flow) as a result of exploits that alter stored function pointers in memory (the implemented protection does not allow malicious code to jump to the middle of a function).\n
On systems with arm64 architecture, pointer authentication has been enabled for user space protection. This technology allows the use of specialized ARM64 instructions to verify return addresses using digital signatures stored in the unused upper bits of the pointer itself.\n
The settings for the system compiler clang, as well as clang and gcc from the ports, have been modified to apply the aforementioned protection mechanisms, significantly strengthening the protection of all core applications and most applications from ports against exploits that use return-oriented programming (ROP) methods. In ROP technique, the attacker does not attempt to place their code in memory but operates with existing snippets of machine instructions in the loaded libraries that end with a return instruction (usually the endings of library functions). The exploit operates by constructing a chain of calls to such blocks ('gadgets') to achieve the desired functionality.\n
A new system call kqueue1 has been added, differing from kqueue by the way it handles flags. Currently, kqueue1 only supports the O_CLOEXEC (close-on-exec) flag for automatic closure of file descriptors in the child process after the exec() call.\n
Support for the pseudo-device dt has been implemented for amd64 and i386 architectures to organize dynamic tracing of systems and applications. A system call utrace has been added to insert user records into the ktrace log.\n
Fixes have been ported from FreeBSD to eliminate undefined behavior when using MS-DOS file systems.\n
The softdep mounting option applied for delayed grouped metadata writes has been disabled.\n
Programs secured by the unveil system call are allowed to save core dumps in the current working directory.\n
For the ARM64 architecture, the ability to transition into deep idle states available in Apple M1\/M2 chips has been implemented for energy savings and sleep mode realization.\n
A bypass protection against the Zenbleed vulnerability in AMD processors has been added.\n
Support for multiprocessor systems (SMP) has been improved. The arprequest() function, code for processing incoming ARP packets, and implementation for neighbor discovery in the IPv6 stack have been freed from locks.\n
The interface for synchronizing the packet filter tables pfsync has been rewritten to improve locking performance and compatibility with future efforts aimed at parallelizing the network stack.\n
The implementation of the Direct Rendering Manager (drm) framework has been synchronized with the Linux kernel 6.1.55 (previous release was 6.1.15). Performance has been improved on systems with Intel processors based on Alder Lake and Raptor Lake microarchitectures.\n
Enhancements have been made to the VMM hypervisor. Support for a multi-threaded model for block and network virtio devices has been implemented in vmd. The block virtio device now supports vector input\/output in zero-copy mode. Access to AMD processors' p-state modes has been restricted for guest systems. Owners are allowed to override the loaded kernel through vmctl. of virtual machines<\/a> Owners are permitted to override the loaded kernel through vmctl.\n