A resource for the OpenBSD community

4 min read Original article ↗

OpenBSD's pledge(2) and unveil(2) are developer-friendly, study finds

Contributed by Peter N. M. Hansteen on from the pledge+unveil for much goodness dept.

Academic studies of OpenBSD's features and their practical impact on security are somewhat rare, but we were pleasantly surprised to see the recent paper A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System, by Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari (all at University of Southern Denmark).

The paper studies the adoption of the pledge(2) and unveil(2) in the OpenBSD base system and packages over time, and finds that the features provided actually seem to facilitate adoption of secure coding practices.

The paper's abstracts concludes,

All in all, the measurement results indicate that the adoption of system call minimization and sandboxing techniques is not necessarily as troublesome as has often been discussed in the literature.

The full text of the paper is available too, as PDF, HTML, or TeX source, for your advocacy use and pleasure.

relayd(8) and httpd(8) TLS settings update.

Contributed by Janne Johansson on from the is it secret, is it safe? dept.

Both relayd(8) and httpd(8) now have the "secure" list of allowed crypto methods for HTTPS, which include TLSv1.3 and the TLSv1.2 AEAD cipher suites. The previous list was "HIGH:!aNULL" which contain non-perfect-forward-security methods and this change may cause old clients to not be able to connect.

OpenBSD/amd64 kernel virtual address space is now 512GB

Contributed by Peter N. M. Hansteen on from the where-would-sir-like-his-640kB? dept.

We almost missed this in a flurry of commits by Jonathan gray (jsg@), but following this commit, OpenBSD/amd64 kernels now have a 512GB address space.

The commit message innocently reads, 

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Jonathan Gray <jsg () cvs ! openbsd ! org>
Date:       2026-06-22 0:27:33
Message-ID: 162f075352ec66cd () cvs ! openbsd ! org

CVSROOT:	/cvs
Module name:	src
Changes by:	jsg@cvs.openbsd.org	2026/06/21 18:27:33

Modified files:
	sys/arch/amd64/include: vmparam.h 

Log message:
raise the size of amd64 kernel virtual address space from 4G to 512G

Read more…

syslogd(8) privileged and non-privileged parts now separate binaries

Contributed by Peter N. M. Hansteen on from the logged, separately dept.

In OpenBSD, the syslogd(8) system logger has already for a while now fork(2)ed the privileged from the non-privileged parts.

Now Alexander Bluhm (bluhm@) decided it's time to split these parts into separate binaries in order to provide even better separation. The final commit message reads, 

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Alexander Bluhm <bluhm () openbsd ! org>
Date:       2026-06-11 15:41:33

CVSROOT:	/cvs
Module name:	src
Changes by:	bluhm@cvs.openbsd.org	2026/06/11 09:41:33

Modified files:
	usr.sbin/syslogd: Makefile privsep.c syslogd.c syslogd.h 
	etc/rc.d       : syslogd 
Added files:
	usr.sbin/syslogd: Makefile.inc parent.c 
	usr.sbin/syslogd/parent: Makefile 
	usr.sbin/syslogd/syslogd: Makefile 

Log message:
Provide a separate executable file for syslogd parent.

Read more…

Random relinking at boot comes to httpd(8) and smtpd(8)

Contributed by Peter N. M. Hansteen on from the the joy of relinking dept.

Random order relinking of critical components is an OpenBSD feature specifically designed to make it harder to exploit bugs in the resulting binary. sshd(8) was the first of the network-facing daemons to get the random treatment (see this previous report).

Now in a series of commits that split one daemon (smptd(8)) into six separate binaries, Theo de Raadt (deraadt@) is bringing httpd(8) and smptd(8), both common in network facing configrations, into the random relink at boot fold.

httpd(8) was the first of the two:

Read more…