svn commit: r314036 - head/usr.sbin/bsdinstall/scripts

[Joel Dahl]

On Wed, Feb 22, 2017 at 07:56:52AM +0000, Bartłomiej Rutkowski wrote:
> On Tue, Feb 21, 2017 at 2:40 PM, Alexey Dokuchaev <danfe at freebsd.org> wrote:
> 
> > On Tue, Feb 21, 2017 at 08:34:29AM -0600, Eric Badger wrote:
> > > Thanks for working on making it easier to harden FreeBSD. While
> > > defaulting some of these options to "on" seem pretty harmless (e.g.
> > > random_pid), others are likely to cause confusion for new and
> > > experienced users alike (e.g. proc_debug. I've never used that option
> > > before, so I gave it a try. It simply causes gdb to hang when attempting
> > > to start a process, with no obvious indication of why).
> >
> > I concur.  In fact, harmless knobs should probably be turned on by default
> > in FreeBSD itself (i.e., without any "hardening" help from the installer),
> > while more intrusive ones should be opt-in, not opt-out.
> >
> > ./danfe
> >
> 
> I strongly believe we should, by default, ship as secured and hardened as
> possible in order to improve overall security of new users installations.
> Power users will and do change the OS as they please, they most likely
> don't use bsdinstall in first place, so they're not affected in any way.

Sorry, I strongly disagree with that. I'm most likely a "power user" and I use
bsdinstall.

-- 
Joel