Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-25 06:19:23 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #222 from raja-grewal/text

Browse Source 
Update Readme and Copyright
This commit is contained in:
Patrick Schleizer 2024-05-18 16:30:07 -04:00 committed by GitHub
commit 12e006ef9c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
98 changed files with 105 additions and 102 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
COPYING
View File

@ -1,7 +1,7 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Files: *
Copyright: 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
Copyright: 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
License: AGPL-3+
License: AGPL-3+

11
README.md
View File

@ -52,12 +52,12 @@ configuration file.
- TCP timestamps are disabled as it can allow detecting the system time.
- Enforces the logging of martian packets, those with a source address which
is blatantly wrong.
- Set coredump file name based on core_pattern value instead of the default of
naming it 'core'.
- Will disable `io_uring` interface for performing asynchronous I/O as it has
historically been a significant attack surface.
### mmap ASLR
- The bits of entropy used for mmap ASLR are maxed out via
@ -89,7 +89,7 @@ Boot parameters are outlined in configuration files located in the
- Enables randomisation of the kernel stack offset on syscall entries.
- All mitigations for known CPU vulnerabilities are enabled and SMT is
- Mitigations for known CPU vulnerabilities are enabled and SMT is
disabled.
- IOMMU is enabled to prevent DMA attacks along with strict enforcement of
@ -169,6 +169,9 @@ surface via the `/etc/modprobe.d/30_security-misc.conf` configuration file.
Engine (ME)](https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html)
and the OS.
- Disables several kernel modules responsible for GPS such as GNSS (Global
Navigation Satellite System).
- Incorporates much of
[Ubuntu's](https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d?h=ubuntu/disco)
default blacklist of modules to be blocked from automatically loading.

2
debian/control vendored
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@kicksecure.com>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@kicksecure.com>
## See the file COPYING for copying conditions.
Source: security-misc

2
debian/copyright vendored
View File

@ -1,7 +1,7 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Files: *
Copyright: 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
Copyright: 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
License: AGPL-3+
License: AGPL-3+

2
debian/make-helper-overrides.bsh vendored
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/24

2
debian/rules vendored
View File

@ -1,6 +1,6 @@
#!/usr/bin/make -f
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
#export DH_VERBOSE=1

2
debian/security-misc.displace vendored
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
/etc/securetty.security-misc

2
debian/security-misc.install vendored
View File

@ -1,4 +1,4 @@
## Copyright (C) 2020 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2020 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## This file was generated using 'genmkfile debinstfile'.

2
debian/security-misc.maintscript vendored
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
rm_conffile /etc/sudoers.d/umask-security-misc

2
debian/security-misc.postinst vendored
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then

2
debian/security-misc.postrm vendored
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then

2
debian/security-misc.preinst vendored
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then

2
debian/security-misc.prerm vendored
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then

2
debian/security-misc.undisplace vendored
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
/etc/login.defs.security-misc

2
debian/watch vendored
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
version=4

2
etc/apparmor.d/tunables/home.d/security-misc
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
alias /etc/pam.d/common-session -> /etc/pam.d//etc/pam.d/common-session.security-misc,

2
etc/apt/apt.conf.d/40error-on-any
View File

@ -1,4 +1,4 @@
## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Make "sudo apt-get update" exit non-zero for transient failures.

2
etc/apt/apt.conf.d/40sandbox
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702

2
etc/default/grub.d/40_cpu_mitigations.cfg
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Enables known mitigations for CPU vulnerabilities.

2
etc/default/grub.d/40_distrust_bootloader.cfg
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Distrusts the bootloader for initial entropy at boot.

2
etc/default/grub.d/40_distrust_cpu.cfg
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Distrusts the CPU for initial entropy at boot as it is not possible to

2
etc/default/grub.d/40_enable_iommu.cfg
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Enables IOMMU to prevent DMA attacks.

2
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
kpkg="linux-image-$(dpkg --print-architecture)" || true

2
etc/default/grub.d/40_remmount-secure.cfg
View File

@ -1,4 +1,4 @@
## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## https://www.kicksecure.com/wiki/Security-misc#Remount_Secure

2
etc/default/grub.d/41_quiet.cfg
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Prevent kernel info leaks in console during boot.

2
etc/hide-hardware-info.d/30_default.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Disable the /sys whitelist.

2
etc/initramfs-tools/hooks/sysctl-initramfs
View File

@ -1,6 +1,6 @@
#!/bin/sh
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
set -e

2
etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs
View File

@ -1,6 +1,6 @@
#!/bin/sh
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
PREREQ=""

2
etc/kernel/postinst.d/30_remove-system-map
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
if test -x /usr/libexec/security-misc/remove-system.map ; then

2
etc/modprobe.d/30_security-misc.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## See the following links for a community discussion and overview regarding the selections

2
etc/permission-hardener.d/25_default_passwd.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_sudo.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_chromium.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_dbus.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_firejail.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_fuse.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_mount.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_pam.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_policykit.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_qubes.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_selinux.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_spice.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_ssh.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_sudo.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/permission-hardener.d/25_default_whitelist_virtualbox.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardener.d/20_user.conf" or

2
etc/profile.d/30_security-misc.sh
View File

@ -1,6 +1,6 @@
#!/bin/sh
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
if [ -z "$XDG_CONFIG_DIRS" ]; then

2
etc/security/access-security-misc.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## To enable root login, see:

2
etc/security/limits.d/30_security-misc.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Disable coredumps.

2
etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
View File

@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- ## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> -->
<!-- ## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> -->
<!-- ## See the file COPYING for copying conditions. -->
<!-- Configuration for Thunar. -->

2
etc/sudoers.d/pkexec-security-misc
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## REVIEW: is it ok that users can find out the PATH setting of root?

2
etc/sudoers.d/security-misc
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
user ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops

2
etc/sudoers.d/xfce-security-misc
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## https://forums.whonix.org/t/xfce4-power-manager-xfpm-power-backlight-helper-pkexec-lxsudo-popup/8764

2
etc/thunderbird/pref/40_security-misc.js
View File

@ -1,4 +1,4 @@
//#### Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
//#### Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
//#### See the file COPYING for copying conditions.
//#### meta start

2
usr/bin/disabled-bluetooth-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/disabled-cdrom-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/disabled-filesys-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/disabled-firewire-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/disabled-gps-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/disabled-intelme-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/disabled-netfilesys-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/disabled-network-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/disabled-thunderbolt-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/disabled-vivid-by-security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.

2
usr/bin/pkexec.security-misc
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with

2
usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
# called by dracut

2
usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh
View File

@ -1,6 +1,6 @@
#!/bin/sh
## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## This script is intended to remount specified mount points with more secure

2
usr/lib/modules-load.d/30_security-misc.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## https://www.whonix.org/wiki/Dev/Entropy

2
usr/lib/sysctl.d/30_security-misc_kexec-disable.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Quote https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html

2
usr/lib/sysctl.d/30_silent-kernel-printk.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Prevent kernel info leaks in console during boot.

2
usr/lib/sysctl.d/990-security-misc.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## NOTE:

2
usr/lib/systemd/system-preset/50-security-misc.preset
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618

2
usr/lib/systemd/system/haveged.service.d/30_security-misc.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
[Service]

2
usr/lib/systemd/system/hide-hardware-info.service
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
[Unit]

2
usr/lib/systemd/system/permission-hardener.service
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
[Unit]

2
usr/lib/systemd/system/proc-hidepid.service
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
[Unit]

2
usr/lib/systemd/system/remount-secure.service
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
[Unit]

2
usr/lib/systemd/system/remove-system-map.service
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
[Unit]

2
usr/libexec/security-misc/apt-get-update
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
sigterm_trap() {

2
usr/libexec/security-misc/apt-get-update-sanity-test
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
set -x

2
usr/libexec/security-misc/askpass
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
set -e

2
usr/libexec/security-misc/echo-path
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
set -e

2
usr/libexec/security-misc/hide-hardware-info
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
set -e

4
usr/libexec/security-misc/mmap-rnd-bits
View File

@ -1,6 +1,6 @@
#!/usr/bin/env bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## This script enforces the maximum ASLR hardening settings for mmap, given the
@ -56,7 +56,7 @@ fi
## Generate a sysctl.d conf file.
SYSCTL="\
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## This file is automatically generated by:

2
usr/libexec/security-misc/pam-abort-on-locked-password
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## This is only a usability feature to avoid needlessly bumping pam_faillock

2
usr/libexec/security-misc/pam-info
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## To enable debug log, run:

2
usr/libexec/security-misc/pam_faillock_not_if_x
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files

2
usr/libexec/security-misc/pam_only_if_login
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files

2
usr/libexec/security-misc/panic-on-oops
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
set -e

2
usr/libexec/security-misc/permission-lockdown
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Doing this for all users would create many issues.

2
usr/libexec/security-misc/remove-system.map
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then

2
usr/libexec/security-misc/virusforget
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## VirusForget is inspired by Christopher Laprise.

2
usr/share/lintian/overrides/security-misc
View File

@ -1,4 +1,4 @@
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## The whole point of the package.

2
usr/share/security-misc/dolphinrc
View File

@ -1,4 +1,4 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions
[PreviewSettings]

2
usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf
View File

@ -1,4 +1,4 @@
## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## LKRG VirtualBox host configuration

2
usr/share/security-misc/lkrg/lkrg-virtualbox
View File

@ -1,6 +1,6 @@
#!/bin/bash
## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
#set -x