Skip to content

Commit 6e8abfb

Browse files
committed
Updating README
1 parent 991f7a7 commit 6e8abfb

File tree

1 file changed

+4
-5
lines changed

1 file changed

+4
-5
lines changed

README.md

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -631,7 +631,7 @@ To uninstall:
631631

632632
Use the `-c` flag to also remove `_wsddn` daemon user and group.
633633

634-
As is standard on FreeBSD daemon will not be enabled or started after installation.
634+
As is standard on OpenBSD daemon will not be enabled or started after installation.
635635
To enable it call
636636
```console
637637
# rcctl enable wsddn
@@ -687,7 +687,6 @@ configurable settings.
687687
* Git
688688
* C++20 capable compiler. Minimal compilers known to work are GCC 10.2, Clang 13 and Xcode 13.
689689
* CMake 3.25 or greater. If your distribution CMake is older than that you can download a newer version from https://cmake.org/download/
690-
* `patch` tool. Most operating system distributions have it available by default but some minimalistic ones might not.
691690
* _Optional_: On Linux if you wish to enable `systemd` integration make sure you have `libsystemd` library and headers installed on your system. On APT systems use:
692691
```bash
693692
sudo apt install libsystemd-dev
@@ -727,7 +726,7 @@ This controls whether to enable `systemd` integration. Auto performs auto-detect
727726

728727
### Setting up daemon
729728

730-
The [config](config) directory of this repo contains sample configuration files for different init systems (systemd, FreeBSD rc.d and macOS launchd). You can adapt those as appropriate to your system.
729+
The [config](config) directory of this repo contains sample configuration files for different init systems (Systemd, Launchd, SysV init, FreeBSD and OpenBSD rc.d and OpenRC). You can adapt those as appropriate to your system.
731730

732731
Command line flags and configuration file entries are documented in `man wsddn` and online [here][manpage]
733732

@@ -763,8 +762,8 @@ There are four main security concerns with a daemon that accepts network request
763762
Currently the implementation ignores the second concern. The things **wsdd-native** discloses are the existence of the local host, its name, presence of Samba on it and domain/workgroup membership. All of these are generally disclosed by Samba itself via SMB broadcasts so, assuming the firewall is configured as described above, there is no net gain for an attacker. WS-Discovery protocol contains provisions for encrypting its HTTP traffic and potentially authenticating clients accessing your host via their client certificates. This limits exposure somewhat but at a significant configuration and maintenance cost. If there is interest in any of it it is possible to easily add this functionality in a future version.
764763

765764
The first concern is by far the most significant one. All software contains bugs and despite developer's best efforts there is always a risk that a bad actor can discover some kind of input that allows him to hijack the server process. To address this possibility **wsdd-native** takes the following measures (apart from general secure coding practices):
766-
* The process performing network communications never runs as root. If launched as root it will create an unprivileged account (`_wsddn:_wsddn` on macOS and `wsddn:wsddn` on other platforms) and run network process under it.
767-
* Similarly when started as root the daemon will lock the network process in a [chroot jail][chroot_jail] (`/var/empty` on macOS and `/var/run/wsddn` on other platforms).
765+
* The process performing network communications never runs as root. If launched as root it will create an unprivileged account (`_wsddn:_wsddn` or `wsddn:wsddn` based on platform conventions) and run network process under it.
766+
* Similarly when started as root the daemon will lock the network process in a [chroot jail][chroot_jail] (usually `/var/empty` or `/var/run/wsddn` or another platform appropriate location).
768767

769768
These measures are automatic and cannot be bypassed. Taken together they should limit the fallout of any vulnerability though, of course, nothing ever can be claimed to be 100% secure.
770769

0 commit comments

Comments
 (0)