Looking at the proper hardening on sysctl.conf best suited for KDE Plasma

hd_scania

Shawn has told to me to turn mprotect and pageexec at 1 on HardenedBSD-CURRENT then KDE Plasma ceases dying, but with all those lines below, KDE Plasma, KWin, Falkon, KMail are dying again
And more miserably, git-01.md.HardenedBSD.org dies again so i could only ask for help here.

kern.geom.debugflags=16
hardening.pax.aslr.status=3
hardening.pax.segvguard.status=3
hardening.procfs_harden=3
hardening.pax.pageexec.status=1
hardening.pax.mprotect.status=1
vfs.usermount=1
net.inet.ip.random_id=1
net.inet6.ip6.use_deprecated=0
net.inet6.ip6.use_tempaddr=1
net.inet6.ip6.prefer_tempaddr=1
security.bsd.see_other_gids=0
security.bsd.hardlink_check_gid=1
security.bsd.hardlink_check_uid=1
security.bsd.stack_guard_page=1
security.bsd.unprivileged_proc_debug=0
security.bsd.unprivileged_read_msgbuf=0
net.local.stream.recvspace=65536
net.local.stream.sendspace=65536
kern.msgbuf_show_timestamp=1```

JuvenalUrbino

hd_scania Shawn has told to me to turn mprotect and pageexec at 1 on HardenedBSD-CURRENT then KDE Plasma ceases dying,

So I was right? 😛 Good you finally found your solution. Indeed 'bad system call' when executing a shell script really sounded a Pax-alike

hd_scania so i could only ask for help here.

The problem is that unfortunately nobody here uses HBSD but you 😅, so no one actually knows what the values of those sysctl variables stand for, and it's not like you can easily retrieve HBSD documentation anywhere (still have to find an online man for hbsdctl); I may guess at best. And if I had to guess, I'd lower Pax Sevguard (imaging level 3 is actually somehow strict): I've been testing it on NetBSD and enabling it system-wide is not only quite resource angry, but also way too limiting; I'd restrict its use to those binaries which actually matter, representing a possible target for brute-force attacks (sshd, postfix and alikes).

By the way, I can share my FreeBSD's sysctl.conf tuned for desktop if you want 😉

hd_scania

[hd_scania@open /home/data/terminal/src/pkg/logs]$ sudo dmesg|grep -ie plasma -ie kwin -ie falkon -ie kmail
[hd_scania@open /home/data/terminal/src/pkg/logs]$ cat falkon-20200505-182908.kcrash.txt
Application: Falkon (falkon), signal: Bus error
(lldb) process attach --pid 43
(lldb) settings set term-width 200
(lldb) thread info
(lldb) bt all
(lldb) detach
[hd_scania@open /home/data/terminal/src/pkg/logs]$

hd_scania

JuvenalUrbino Finally i’ve reset ASLR to 2 at sysctl.conf, and PageExec, SegVGuard, MProtect to 1, now my KDE Plasma on HBSD is back.☺️
No people else here are using HBSD?🤔🤔

JuvenalUrbino

hd_scania it must be noticed however that PAGEXEC, MPROTECT and SegvGuard are designed to overcome the limits of ASLR; I don't know what level '1' stands for, but the whole point of HardenedBSD is having them enabled (while I'm not sure about how much of a critical and recommendable fix this is for a typical desktop not exposed to WAN, shielded by ISP's router on a trusted private network). You may want to adjust those settings and test various configurations until reaching the one with an accptable balance between security and usability. Enabling Segvguard at least for those binaries most likely going to be brute forced would a rational practice imho; maybe you'd better get in contact with Shawn once again.