tlsdate/HARDENING

Platforms offer varying security features; we'd like to support the best.

This is a document that notes which security hardening we have implemented and
which things we'd like to see implemented for various platforms. We
specifically address exploitation mitigation and containment; security issues
such as x509 certification validation are not addressed here, yet. Patches,
suggestions and improvements are welcome! We always want the strongest set of
options by default on each supported platform.

We attempt to use the C programming language correctly and in a standard way.
We do however use some compiler specific options such as defining integer
wrapping because we believe the practical benefit outweights the implied risks.
As such, we prefer to be explicit rather than implicit in our casting or other
possible ambiguity.

We should treat all compiler and linker warnings as fatal errors. Currently,
consider autotools warnings to be an exception as we would like to support
platforms imperfectly rather than not at all. We generally wish to support
autotools bootstrapping on all of our supported platforms. This is not possible
on Plan 9. Currently autotools will complain on the BSD systems.

On all platforms we attempt to support available compiler hardening and linking
options. Please do not disable these options. Additional compiler and linker
hardening options are welcome and the current options are implemented in the
following file:

  configure.ac

On all platforms, we attempt to switch from the administrative user to an
unimportant role account which shares data with no other processes. If we start
as any user other than an administrative user, we will likely be unable to
switch to our normal unprivileged account. These users are defined at
`configure` time. It is most effective if such a user is not the traditional
'nobody' or group 'nogroup' as is often the tradition.

In addition to the above hardening options, we have tried to extend our
hardening when the platform supports it. Each additional security measure that
we take is documented as well as planned or desired improvements.

We do not currently support or set ulimits, we should do so where possible.

On Debian Gnu/Linux platforms, we ship with a minimal AppArmor profile, see
the policy for details:

  apparmor-profile

We'd like to have an SELinux policy specifically for tlsdate.
We'd like to support capability dropping with libcap or libcap-ng.
We'd like to support libseccomp2 filters.
Other kernel hardening suggestions are welcome.

On ChromeOS we use minijail and seccomp filters, see the following policies for
details:

  tlsdate-seccomp-amd64.policy
  tlsdate-seccomp-arm.policy
  tlsdate-seccomp-x86.policy

These are enabled by default in ChromeOS.

On FreeBSD, we'd like to support jails, chroot, and Capsicum.

On OpenBSD, we'd like to support chroot and systrace.

On NetBSD, we'd like to chroot.

On DragonFly BSD, we'd like to support chroot and jails.

On Mac OS X, we'd like to support chroot and seatbelt.

On Plan9, we'd like to chroot.

On Windows, we do nothing beyond compile time hardening. We'd like to do more.

On other platforms, we'll try to run correctly with the understanding that any
bug is likely a much more serious problem.