Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-08-05 18:34:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

comment out proc-hidepid.service hardening for now

Browse source 
since broken in Qubes Debian AppVMs

https://forums.whonix.org/t/kernel-hardening/7296/104
This commit is contained in:
Patrick Schleizer 2019-07-01 03:43:02 -04:00
parent 0bffc7a930
commit 24cc8e380d
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
1 changed files with 16 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

31
lib/systemd/system/proc-hidepid.service
View file

@ -10,21 +10,22 @@ After=local-fs.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
ProtectSystem=strict
ProtectHome=true #ProtectSystem=strict
ProtectKernelTunables=true #ProtectHome=true
ProtectKernelModules=true #ProtectKernelTunables=true
ProtectControlGroups=true #ProtectKernelModules=true
PrivateTmp=true #ProtectControlGroups=true
PrivateMounts=true #PrivateTmp=true
PrivateDevices=true #PrivateMounts=true
PrivateNetwork=true #PrivateDevices=true
MemoryDenyWriteExecute=true #PrivateNetwork=true
NoNewPrivileges=true #MemoryDenyWriteExecute=true
RestrictRealtime=true #NoNewPrivileges=true
SystemCallArchitectures=native #RestrictRealtime=true
RestrictNamespaces=true #SystemCallArchitectures=native
SystemCallFilter=mount munmap access read open close stat fstat lstat mmap mprotect brk rt_sigaction rt_sigprocmask execve readlink getrlimit getuid getgid geteuid getegid statfs prctl arch_prctl set_tid_address newfstatat set_robust_list openat mkdir #RestrictNamespaces=true
#SystemCallFilter=mount munmap access read open close stat fstat lstat mmap mprotect brk rt_sigaction rt_sigprocmask execve readlink getrlimit getuid getgid geteuid getegid statfs prctl arch_prctl set_tid_address newfstatat set_robust_list openat mkdir
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target