Git-Mirrors/Qubes-VM-hardening
1
0
Fork 0
mirror of https://github.com/tasket/Qubes-VM-hardening.git synced 2024-10-01 06:35:42 -04:00
Code Issues Packages Projects Releases Wiki Activity

Update version, readme

Browse Source
This commit is contained in:
Christopher Laprise 2019-07-19 12:48:40 -04:00
parent ab3adf4222
commit 2a8c60e75f
No known key found for this signature in database
GPG Key ID: 448568C8B281C952
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
README.md
View File

@ -82,7 +82,10 @@ Examples where -root should *not* be enabled:
### Notes ### Notes
* The service name has been changed from `vm-sudo-protect` in pre-release to `vm-boot-protect`. The install script will automatically try to disable the old service. * A bug in v0.8.4 will erase anything in '/etc/default/vms' when booting into the template. For proper
future operation with sys-net or other VMs you may have customized in that path, updating Qubes-VM-hardening
to the latest version (using the install script) is recommended, along with restoring any custom files
in '/etc/default/vms'. Thanks to Daniel Moerner for submitting the patch!
* All the user-writable startup files in /home should be protected by the immutable flag; See issue #9 if you notice an omission or other problem. An extra step of disabling the flag using `sudo chattr -i` is required whenever the user wants to modify these startup files. * All the user-writable startup files in /home should be protected by the immutable flag; See issue #9 if you notice an omission or other problem. An extra step of disabling the flag using `sudo chattr -i` is required whenever the user wants to modify these startup files.
@ -95,6 +98,7 @@ Examples where -root should *not* be enabled:
* Currently the service cannot seamlessly handle 'first boot' when the private volume must be initialized. If you enabled the service on a VM before its first startup, on first start the shell will display a notice telling you to restart the VM. Subsequent starts will proceed normally. * Currently the service cannot seamlessly handle 'first boot' when the private volume must be initialized. If you enabled the service on a VM before its first startup, on first start the shell will display a notice telling you to restart the VM. Subsequent starts will proceed normally.
## Releases ## Releases
- v0.8.5 Fix template detection, /etc/default/vms erasure
- v0.8.4 Add protection to /home/user/.config/systemd - v0.8.4 Add protection to /home/user/.config/systemd
- v0.8.3 Fix for install script copying to /etc/default/vms - v0.8.3 Fix for install script copying to /etc/default/vms
- v0.8.2 Working rescue shell. Add sys-net whitelist, sudo config, fixes. - v0.8.2 Working rescue shell. Add sys-net whitelist, sudo config, fixes.

2
vm-boot-protect.sh
View File

@ -36,7 +36,7 @@ rw=/mnt/rwtmp
rwbak=$rw/vm-boot-protect rwbak=$rw/vm-boot-protect
errlog=/var/run/vm-protect-error errlog=/var/run/vm-protect-error
defdir=/etc/default/vms defdir=/etc/default/vms
version="0.8.4" version="0.8.5"
# Function: Make user scripts immutable. # Function: Make user scripts immutable.