Heh, as a FreeBSD user primarily, OpenBSD sometimes feels kinda empty to me. No ZFS, no DTrace, no jails, no mandatory access control, no CloudABI, no Linux compat layer…
ZFS is large and complicated. http://www.tedunangst.com/flak/post/ZFS-on-OpenBSD
DTrace would be nice to have, but I believe there are CDDL license concerns.
Jails are a way of isolating services so that they cannot do (much) damage to the system in the event they are compromised. The closest alternative in OpenBSD is probably pledge(2), which allows a program to voluntarily renounce the ability to invoke a set of syscalls. There is also chroot if all you need is filesystem virtualization.
MAC can be complicated to implement. This comment explained things very well: https://news.ycombinator.com/item?id=8893749
> OpenBSD doesn't support a MAC framework because they believe the best approach to security is correctness, rather than trying to achieve security by adding features which results in more complexity, making it more difficult to ensure correctness. A common mistake people make is thinking that OpenBSD's primary goal is security; their primary goal is correctness. This just happens to result in better security more often than not.
Linux compat is a similar story. OpenBSD dropped it in the 6.0 release due to complexity and security concerns.
I don't know a whole lot about CloudABI.
pledge is more similar to Capsicum. It is simpler to implement in some programs, sure, but:
1) I don't like how pledge just kills the program. Rude. Capsicum refuses the offending operation.
2) Capsicum has an absolutely brilliant feature for directory access — you just open() a file descriptor to a directory, then you cap_enter()… and in the sandbox mode you can use openat() to open files below that directory! This is just so clever. Meanwhile pledge promised a simple directory whitelist option that is STILL NOT IMPLEMENTED :(
CloudABI is a portable ABI that can be described as POSIX plus Capsicum minus anything incompatible with Capsicum. So CloudABI programs start already in capability mode, expecting necessary file descriptors to be already open (there's a launcher tool for that). You can just run CloudABI binaries unmodified on several operating systems and they are always sandboxed, they have no way to access anything you didn't pass to them. CloudABI is out-of-the-box supported on FreeBSD, there are kernel patches for NetBSD and Linux, and a user-mode syscall translator for macOS. https://nuxi.nl/cloudabi/
Both are valid, and result in very different operating systems. These days most of my work can be fit into the OpenBSD envelope, which makes me feel especially good.
But then FreeBSD itself lacks ACLs on tmpfs, EAs on ZFS, and SO_PEERCRED; and moreover OpenBSD does have wscons.
Yeah, SO_PEERCRED, I remember that one. The sway Wayland compositor relies on it to authenticate privileged programs (desktop bars, screensavers, screenshot tools etc.) When I was porting sway, that really annoyed me.
What are EAs?
* https://www.freebsdnews.com/2016/01/27/zfs-boot-environment-...
I completely understand why these thing aren't being done, but not doing them mean that something will remain a little out of place.