HardenedBSD June / July 2026 Status Report

[Shawn Webb]

Hey all,

This status report covers both June and July 2026. It has been a rather chaotic
couple of months for me.

I am going to use quite the number of backticks (`) in this status report. I
apologize in advance. Think of then as used in Markdown to convey a command or
static text.

In my announcement[1] about force pushing the ports branch: I neglected to
clarify the underlying issue and who is impacted. So, a non-malicious
less-than-desireable commit made its way to the FreeBSD ports tree. FreeBSD
needed to effectively remove the offending commit from the history due to
licensing issues (there could be additional factors to which I am not privvy.)
Since further commits made it to the tree, this made recovering from that state
a bit more difficult.

This naturally caused a chain reaction downstream for us. In addition to
FreeBSD's commits, I had made multiple commits to migrate some of our ports
entries to Radicle. This means that, we, too, have to break git commit history.

Those downstream from HardenedBSD, even, could be further impacted in a similar
fashion. Those impacted primarily are those who maintain their own patches atop
our ports tree. HardenedBSD uses a merge-based workflow for bringing in changes
from upstream. I recognize that there may be downstream users who use a
different workflow. I cannot advise you in that case--I'm most familiar with a
merge-based workflow and haven't been sufficiently motivated to try others.

What I did was `git reset --hard` the tree back to the HardenedBSD
auto-sync merge commit just prior to the offending commit from upstream.
Afterwards, I merged the new freebsd main HEAD commit to our hardenedbsd/main
branch.

If the last time you updated your ports tree was in the period we accepted the
bad commit and our subsequent rollback, but you do NOT carry patches, you might
find yourself in a weird state. I'm unsure what to tell users who use `git
pull`, since I use a `git fetch && git merge` model. So, if you use the same,
you can simply `git reset --hard rad/hardenedbsd/main` (after fetching `rad` of
course).

I did run into issues with Radicle: primarily issues with mental models for this
kind of situation. Previously, I consdiered the `rad` remote (which Radicle sets
up by default) to be okay to use for both fetching and pushing. I used it like I
would any normal git remote with push access.

Instead, I really should have considered the `rad` remote as read-only: use it
only for fetching. I instructed Radicle to create a new remote, pointed to my
own Radicle node: `rad remote add --name self $(rad self --did)`. I should push
to this new remote, named `self`. For a more nuanced discussion, please see
Appendix A below.

I haven't forgotten about re-establishing our GitHub mirror. I have other
higher priority tasking at the moment, but I just wanted to say it is not
forgotten. (And, I'm somewhat glad that our GitHub mirror hasn't been updated,
since it hasn't been updated in so long, it didn't see the bad ports commit.)

In src:

1. Robert set the default VMSIZE to 80gb for release VM images
2. Shawn Webb: Harden the new security.bsd.allow_tiocsti sysctl node
3. Shawn Webb: rc.conf(5): Support custom values for KLD prohibition value
(hbsd_late_kld_prohibition_value, default: 1)
4. Shawn Webb: Harden security.bsd.unprivileged_kenv_read
5. Shawn Webb: Enable stack auto-init to zero for the linuxulator
6. Shawn Webb: jail(8): Use safer memory management APIs
7. Shawn Webb: Enable -ftrivial-var-auto-init=zero for linuxkpi_{hdmi,video}
8. Shawn Webb: HBSD: Harden new sysctl nodes and reorganize PTrace hardening
A. Harden vm.phys_fictitious_segs sysctl node with CTLFLAG_ROOTONLY
B. Harden ptrace(PT_SET_SC_RET) in the same fashion as ptrace(PT_SC_REMOTE)
9. Shawn Webb: Enable trivial var auto-init for uvideo(4)
10. Shawn Webb: Enable -ftrivial-var-auto-init=zero for opensolaris.ko
11. Shawn Webb: Garbage collect unused sysctl node
12. Shawn Webb: Harden the GEOM and related control interfaces

In ports:

1. Robert added a new port: misc/robert
2. Robert migrated misc/robert to Radicle
3. Robert updated the misc/robert port a few times, currently sitting at
version 0.10.0.
4. Robert migrated hardenedbsd/ctrl to Radicle
5. Shawn Webb disabled COMPAT32 for the following ports:
A. misc/compat13x
B. misc/compat14x
C. misc/compat15x
6. Shawn Webb fixed the build of graphics/mesa-libs
7. Shawn Webb fixed the build of graphics/mesa-dri
8. Shawn Webb fixed the python version used with net-p2p/reticulum
9. Shawn Webb fixed the build of lang/zig015 (which has, as of this writing, is
broken again and on my queue to figure out.)
10. Default devel/wasi-libc to llvm 21
11. Migrate the default llvm version to 21 globally now that 15-STABLE LLVM in
base has been updated to llvm 21
12. Update ports-mgmt/pkg to 2.8.1
13. Migrate hardenedbsd/liblattutil to Radicle
14. Migrate hardenedbsd/hbsdmon to Radicle
15. Migrate net/libpushover to Radicle
16. Migrate sysutils/vm-bhyve-hbsd to Radicle and update to 1.7.4 (from 1.5.0)

#### Appendix A ####

Note: Relevant Zulip discussion[2].

It is suggested that if you plan to contribute to a repository, you create a new
remote called `self`: `rad remote add --name self $(rad self --did)`. Fetch from
`rad`, push to `self`.

Treat `rad` as a virtual peer/contributor that tracks the network consensus and
`self` is where you do all your own work.

Your `self` is what others see when they `rad remote add` you, and vice versa,
so they're good for ad-hoc sharing. `rad` looks around at everybody and gathers
up the crefs that satisfy sig requirements, so it's where you fetch canonical
state from. As a convenience, `rad` also gathers up all the open patches so you
don't have to hunt them down in the specific remote they came from.

[1]: https://groups.google.com/a/hardenedbsd.org/g/users/c/o4Fs_RhND5o/m/vKLp-Cg5BwAJ
[2]: https://radicle.zulipchat.com/#narrow/channel/369274-General/topic/HardenedBSD.20Switching.20to.20Radicle/near/613944717

Thanks,

--
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

Signal Username: shawn_webb.74
Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27
https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc