bsdinstall: add knob to set ASLR sysctls
Reviewed by: mw Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D28418
This commit is contained in:
parent
fbc57e2df9
commit
020f411255
@ -28,6 +28,20 @@
|
|||||||
|
|
||||||
: ${DIALOG_OK=0}
|
: ${DIALOG_OK=0}
|
||||||
|
|
||||||
|
set_aslr_sysctls()
|
||||||
|
{
|
||||||
|
for bit in 32 64; do
|
||||||
|
if ! sysctl -Nq kern.elf$bit.aslr.enable >/dev/null; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
cat >> $BSDINSTALL_TMPETC/sysctl.conf.hardening <<-EOF
|
||||||
|
kern.elf$bit.aslr.enable=1
|
||||||
|
kern.elf$bit.aslr.pie_enable=1
|
||||||
|
kern.elf$bit.aslr.honor_sbrk=0
|
||||||
|
EOF
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
echo -n > $BSDINSTALL_TMPETC/rc.conf.hardening
|
echo -n > $BSDINSTALL_TMPETC/rc.conf.hardening
|
||||||
echo -n > $BSDINSTALL_TMPETC/sysctl.conf.hardening
|
echo -n > $BSDINSTALL_TMPETC/sysctl.conf.hardening
|
||||||
echo -n > $BSDINSTALL_TMPBOOT/loader.conf.hardening
|
echo -n > $BSDINSTALL_TMPBOOT/loader.conf.hardening
|
||||||
@ -48,6 +62,7 @@ FEATURES=$( dialog --backtitle "FreeBSD Installer" \
|
|||||||
"8 disable_sendmail" "Disable Sendmail service" ${disable_sendmail:-off} \
|
"8 disable_sendmail" "Disable Sendmail service" ${disable_sendmail:-off} \
|
||||||
"9 secure_console" "Enable console password prompt" ${secure_console:-off} \
|
"9 secure_console" "Enable console password prompt" ${secure_console:-off} \
|
||||||
"10 disable_ddtrace" "Disallow DTrace destructive-mode" ${disable_ddtrace:-off} \
|
"10 disable_ddtrace" "Disallow DTrace destructive-mode" ${disable_ddtrace:-off} \
|
||||||
|
"11 enable_aslr" "Enable address layout randomization" ${enable_aslr:-off} \
|
||||||
2>&1 1>&3 )
|
2>&1 1>&3 )
|
||||||
exec 3>&-
|
exec 3>&-
|
||||||
|
|
||||||
@ -86,6 +101,9 @@ for feature in $FEATURES; do
|
|||||||
disable_ddtrace)
|
disable_ddtrace)
|
||||||
echo 'security.bsd.allow_destructive_dtrace=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening
|
echo 'security.bsd.allow_destructive_dtrace=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening
|
||||||
;;
|
;;
|
||||||
|
enable_aslr)
|
||||||
|
set_aslr_sysctls
|
||||||
|
;;
|
||||||
esac
|
esac
|
||||||
done
|
done
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user