From 0ea7dd161b3e643c23624e6dcb450116824b6301 Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Fri, 14 Feb 2020 17:50:19 +0000
Subject: [PATCH 1/5] Restrict loading line disciplines to CAP_SYS_MODULE

---
 etc/sysctl.d/30_security-misc.conf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/etc/sysctl.d/30_security-misc.conf b/etc/sysctl.d/30_security-misc.conf
index 4c17bcb..8305bd1 100644
--- a/etc/sysctl.d/30_security-misc.conf
+++ b/etc/sysctl.d/30_security-misc.conf
@@ -118,3 +118,8 @@ net.ipv4.conf.all.rp_filter=1
 net.ipv4.tcp_timestamps=0
 
 #### meta end
+
+## Restrict loading line disciplines to CAP_SYS_MODULE to prevent
+## unprivileged attackers from loading vulnerable line disciplines
+## with the TIOCSETD ioctl to exploit them.
+dev.tty.ldisc_autoload=0

From ace62111761451a13c446767dfd3c32b9b70a7f8 Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Fri, 14 Feb 2020 17:51:17 +0000
Subject: [PATCH 2/5] Update control

---
 debian/control | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/debian/control b/debian/control
index 2abb7ee..99871c4 100644
--- a/debian/control
+++ b/debian/control
@@ -119,6 +119,8 @@ Description: enhances misc security settings
  .
   * The kernel panics on oopses to prevent it from continuing to run a flawed
  process and to deter brute forcing.
+ .
+  * Restricts loading line disciplines to CAP_SYS_MODULE.
  .
  Improve Entropy Collection
  .

From 9b767139ef82279e00d86f7f1e1e8bf73d795651 Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Fri, 14 Feb 2020 18:52:01 +0000
Subject: [PATCH 3/5] Avoid holes in IOMMU

---
 etc/default/grub.d/40_enable_iommu.cfg | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/etc/default/grub.d/40_enable_iommu.cfg b/etc/default/grub.d/40_enable_iommu.cfg
index 1d6dd0a..6e49d49 100644
--- a/etc/default/grub.d/40_enable_iommu.cfg
+++ b/etc/default/grub.d/40_enable_iommu.cfg
@@ -3,3 +3,10 @@
 
 ## Enables IOMMU to prevent DMA attacks.
 GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on amd_iommu=on"
+
+## Disable the busmaster bit on all PCI bridges during very
+## early boot to avoid holes in IOMMU.
+##
+## https://mjg59.dreamwidth.org/54433.html
+## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma"

From 31009f0bfa10e7b67f5823a5be92273e5414fff3 Mon Sep 17 00:00:00 2001
From: madaidan <50278627+madaidan@users.noreply.github.com>
Date: Fri, 14 Feb 2020 23:46:19 +0000
Subject: [PATCH 4/5] Shred System.map files

---
 usr/lib/security-misc/remove-system.map | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr/lib/security-misc/remove-system.map b/usr/lib/security-misc/remove-system.map
index c99b286..7e7f787 100755
--- a/usr/lib/security-misc/remove-system.map
+++ b/usr/lib/security-misc/remove-system.map
@@ -26,7 +26,7 @@ fi
 ## Removes the System.map files as they are only used for debugging or malware.
 for filename in ${system_map_location} ; do
    if [ -f "${filename}" ]; then
-      rm --verbose --force "${filename}"
+      shred --verbose --force --zero -u "${filename}"
    fi
 done
 

From 9bbae903fe5ee58d4a22dfeab51cbb179b8cfb14 Mon Sep 17 00:00:00 2001
From: Patrick Schleizer <adrelanos@riseup.net>
Date: Sat, 15 Feb 2020 05:29:48 -0500
Subject: [PATCH 5/5] remove-system.map: lower verbosity output

---
 usr/lib/security-misc/remove-system.map | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/usr/lib/security-misc/remove-system.map b/usr/lib/security-misc/remove-system.map
index 7e7f787..72ce407 100755
--- a/usr/lib/security-misc/remove-system.map
+++ b/usr/lib/security-misc/remove-system.map
@@ -26,7 +26,9 @@ fi
 ## Removes the System.map files as they are only used for debugging or malware.
 for filename in ${system_map_location} ; do
    if [ -f "${filename}" ]; then
-      shred --verbose --force --zero -u "${filename}"
+      ## 'shred' with '--verbose' is too chatty. (7 lines)
+      shred --force --zero -u "${filename}"
+      echo "removed '${filename}'"
    fi
 done