2019-12-19 12:01:33 -05:00
|
|
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
|
|
|
|
## See the file COPYING for copying conditions.
|
|
|
|
|
|
2019-12-20 05:54:16 -05:00
|
|
|
## Please use "/etc/permission-hardening.d/50_user.conf" or
|
|
|
|
|
## "/usr/local/etc/permission-hardening.d/50_user.conf" for your custom
|
|
|
|
|
## configuration. When security-misc is updated, this file may be overwritten.
|
|
|
|
|
|
2019-12-08 11:50:11 -05:00
|
|
|
## File permission hardening.
|
|
|
|
|
##
|
|
|
|
|
## Syntax:
|
|
|
|
|
## [filename] [mode] [owner] [group] [capability]
|
|
|
|
|
##
|
2019-12-19 12:01:33 -05:00
|
|
|
## To remove all SUID/SGID binaries in a directory, you can use the "nosuid"
|
|
|
|
|
## argument.
|
2019-12-20 03:45:01 -05:00
|
|
|
|
2019-12-23 02:38:53 -05:00
|
|
|
## TODO: white spaces inside file name untested and probably will not work.
|
|
|
|
|
|
2019-12-23 02:29:47 -05:00
|
|
|
######################################################################
|
|
|
|
|
# SUID disablewhitelist
|
|
|
|
|
######################################################################
|
|
|
|
|
|
2019-12-23 02:38:53 -05:00
|
|
|
## disablewhitelist disables below (or in lexically higher) files
|
|
|
|
|
## exactwhitelist and matchwhitelist. Add these here (discouraged) or better
|
|
|
|
|
## in file "/etc/permission-hardening.d/20_user.conf".
|
|
|
|
|
|
|
|
|
|
## For example, if you are not using SELinux the following might make sense to
|
|
|
|
|
## enable. TODO: research
|
2019-12-23 02:35:13 -05:00
|
|
|
#/utempter/utempter disablewhitelist
|
|
|
|
|
|
2019-12-20 13:02:33 -05:00
|
|
|
######################################################################
|
|
|
|
|
# SUID exact match whitelist
|
|
|
|
|
######################################################################
|
|
|
|
|
|
2019-12-23 02:29:47 -05:00
|
|
|
/usr/bin/sudo exactwhitelist
|
|
|
|
|
/bin/sudo exactwhitelist
|
|
|
|
|
/usr/bin/bwrap exactwhitelist
|
|
|
|
|
/bin/bwrap exactwhitelist
|
|
|
|
|
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper exactwhitelist
|
|
|
|
|
/usr/lib/chromium/chrome-sandbox exactwhitelist
|
2019-12-20 08:13:23 -05:00
|
|
|
|
2019-12-20 12:50:35 -05:00
|
|
|
## There is a controversy about firejail but those who choose to install it
|
|
|
|
|
## should be able to use it.
|
|
|
|
|
## https://www.whonix.org/wiki/Dev/Firejail#Security
|
2019-12-23 02:29:47 -05:00
|
|
|
/usr/bin/firejail exactwhitelist
|
2019-12-20 12:50:35 -05:00
|
|
|
|
2019-12-23 03:28:42 -05:00
|
|
|
## In case you need to use 'su'. See also:
|
|
|
|
|
## https://www.whonix.org/wiki/root#su
|
|
|
|
|
#/bin/su exactwhitelist
|
|
|
|
|
#/usr/bin/su exactwhitelist
|
|
|
|
|
|
2019-12-20 13:02:33 -05:00
|
|
|
######################################################################
|
2019-12-23 01:38:31 -05:00
|
|
|
# SUID exact match whitelist
|
2019-12-20 13:02:33 -05:00
|
|
|
######################################################################
|
|
|
|
|
|
2019-12-20 12:59:27 -05:00
|
|
|
## https://manpages.debian.org/buster/xserver-xorg-legacy/Xorg.wrap.1.en.html
|
|
|
|
|
## https://lwn.net/Articles/590315/
|
2019-12-21 06:53:07 -05:00
|
|
|
## http://forums.whonix.org/t/permission-hardening/8655/25
|
|
|
|
|
#/usr/lib/xorg/Xorg.wrap whitelist
|
2019-12-20 12:59:27 -05:00
|
|
|
|
2019-12-20 13:02:33 -05:00
|
|
|
######################################################################
|
|
|
|
|
# SUID regex match whitelist - research required
|
|
|
|
|
######################################################################
|
2019-12-20 12:59:27 -05:00
|
|
|
|
2019-12-20 12:57:24 -05:00
|
|
|
/usr/lib/virtualbox/ matchwhitelist
|
2019-12-22 18:57:23 -05:00
|
|
|
|
2019-12-23 01:38:31 -05:00
|
|
|
## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c
|
|
|
|
|
## match both:
|
|
|
|
|
#/usr/lib/qubes/qfile-unpacker whitelist
|
|
|
|
|
#/lib/qubes/qfile-unpacker
|
|
|
|
|
/qubes/qfile-unpacker matchwhitelist
|
|
|
|
|
|
2019-12-23 01:42:03 -05:00
|
|
|
## match both:
|
|
|
|
|
#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
|
|
|
|
|
#/lib/policykit-1/polkit-agent-helper-1
|
|
|
|
|
polkit-agent-helper-1 matchwhitelist
|
|
|
|
|
|
2019-12-22 18:57:23 -05:00
|
|
|
######################################################################
|
|
|
|
|
# SUID regex match whitelist
|
|
|
|
|
######################################################################
|
|
|
|
|
|
2019-12-22 19:12:10 -05:00
|
|
|
dbus-daemon-launch-helper matchwhitelist
|
2019-12-22 18:56:36 -05:00
|
|
|
/utempter/utempter matchwhitelist
|
2019-12-20 12:57:24 -05:00
|
|
|
|
2019-12-20 13:02:33 -05:00
|
|
|
######################################################################
|
|
|
|
|
# Permission Hardening
|
|
|
|
|
######################################################################
|
|
|
|
|
|
2019-12-08 11:50:11 -05:00
|
|
|
/home/ 0755 root root
|
|
|
|
|
/home/user/ 0700 user user
|
|
|
|
|
/root/ 0700 root root
|
|
|
|
|
/boot/ 0700 root root
|
2019-12-20 05:57:41 -05:00
|
|
|
/etc/permission-hardening.d 0600 root root
|
|
|
|
|
/usr/local/etc/permission-hardening.d 0600 root root
|
2019-12-19 12:01:33 -05:00
|
|
|
|
2019-12-20 13:02:33 -05:00
|
|
|
######################################################################
|
|
|
|
|
# SUID/SGID Removal
|
|
|
|
|
######################################################################
|
|
|
|
|
|
2019-12-19 12:01:33 -05:00
|
|
|
## Remove all SUID/SGID binaries/libraries.
|
2019-12-20 13:02:33 -05:00
|
|
|
|
2019-12-19 12:01:33 -05:00
|
|
|
/bin/ nosuid
|
|
|
|
|
/usr/bin/ nosuid
|
|
|
|
|
/usr/local/bin/ nosuid
|
|
|
|
|
/sbin/ nosuid
|
|
|
|
|
/usr/sbin/ nosuid
|
|
|
|
|
/usr/local/sbin/ nosuid
|
2019-12-21 14:06:51 -05:00
|
|
|
/lib/ nosuid
|
2019-12-19 12:01:33 -05:00
|
|
|
/lib32/ nosuid
|
|
|
|
|
/lib64/ nosuid
|
|
|
|
|
/usr/lib/ nosuid
|
|
|
|
|
/usr/lib32/ nosuid
|
|
|
|
|
/usr/lib64/ nosuid
|
|
|
|
|
/usr/local/lib/ nosuid
|
|
|
|
|
/usr/local/lib32/ nosuid
|
|
|
|
|
/usr/local/lib64/ nosuid
|
