Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-08-07 15:02:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'master' into arraybolt3/emerg-shutdown

Browse source
This commit is contained in:
Aaron Rainbolt 2025-07-13 15:21:34 -05:00
commit 2a7071055f
No known key found for this signature in database
GPG key ID: A709160D73C79109
14 changed files with 638 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

8
usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf
View file

@ -5,11 +5,17 @@
## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
## Used for SSH client key management
## https://manpages.debian.org/bookworm/openssh-client/ssh-agent.1.en.html
## Debian installs ssh-agent with setgid permissions (2755) and with
## _ssh as the group to help mitigate ptrace attacks that could extract
## private keys from the agent's memory.
ssh-agent matchwhitelist
## Used only for SSH host-based authentication
## https://linux.die.net/man/8/ssh-keysign
## Needed to allow access to the machine's host key for use in the
## authentication process. This is a non-default method of authenticating to
## SSH, and is likely rarely used, thus this should be safe to disable.
#ssh-agent matchwhitelist
#ssh-keysign matchwhitelist
#/usr/lib/openssh matchwhitelist

5
usr/lib/sysctl.d/990-security-misc.conf
View file

@ -360,6 +360,8 @@ kernel.core_pattern=|/bin/false
## Prevent setuid processes or otherwise protected/tainted binaries from creating core dumps.
## Any process which has changed privilege levels or is execute-only will not be dumped.
##
## https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598
##
## KSPP=yes
## KSPP sets the sysctl.
##
@ -475,6 +477,9 @@ net.ipv4.conf.*.arp_filter=1
## https://github.com/mullvad/mullvadvpn-app/pull/7141
## https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf
##
## Can lead to breakages with certain VM configurations that may be resolved by lowering protection to `arp_ignore=1`.
## https://github.com/Kicksecure/security-misc/pull/290
##
net.ipv4.conf.*.arp_ignore=2
## Drop gratuitous ARP (Address Resolution Protocol) packets.