Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-25 17:59:24 -05:00
Code Issues Packages Projects Releases Wiki Activity

simplify disabling of SUID Disabler and Permission Hardener whitelist

Browse Source 
split `/etc/permission-hardening.d/30_default.conf` into multiple files

`/etc/permission-hardening.d/40_default_whitelist_[...].conf`

therefore make it easier to delete any whitelisted SUID binaries
This commit is contained in:
Patrick Schleizer 2020-12-01 04:28:15 -05:00
parent cf07e977bd
commit 318ab570aa
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
13 changed files with 128 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
etc/permission-hardening.d/30_default.conf
View File

@ -34,29 +34,6 @@
# SUID exact match whitelist # SUID exact match whitelist
###################################################################### ######################################################################
/usr/bin/sudo exactwhitelist
/bin/sudo exactwhitelist
/usr/bin/bwrap exactwhitelist
/bin/bwrap exactwhitelist
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper exactwhitelist
/usr/lib/chromium/chrome-sandbox exactwhitelist
/usr/bin/pkexec exactwhitelist
/bin/pkexec exactwhitelist
/usr/bin/pkexec.security-misc-orig exactwhitelist
/bin/pkexec.security-misc-orig exactwhitelist
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
## Protect from 'chmod -x' (and SUID removal).
## SUID will be removed below in separate step.
/bin/mount exactwhitelist
/usr/bin/mount exactwhitelist
## There is a controversy about firejail but those who choose to install it
## should be able to use it.
## https://www.whonix.org/wiki/Dev/Firejail#Security
/usr/bin/firejail exactwhitelist
## In case you need to use 'su'. See also: ## In case you need to use 'su'. See also:
## https://www.whonix.org/wiki/root#su ## https://www.whonix.org/wiki/root#su
#/bin/su exactwhitelist #/bin/su exactwhitelist
@ -72,42 +49,17 @@
#/usr/lib/xorg/Xorg.wrap whitelist #/usr/lib/xorg/Xorg.wrap whitelist
###################################################################### ######################################################################
# SUID regex match whitelist - research required # SUID regex match whitelist
###################################################################### ######################################################################
/usr/lib/virtualbox/ matchwhitelist
## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c
## match both:
#/usr/lib/qubes/qfile-unpacker whitelist
#/lib/qubes/qfile-unpacker
/qubes/qfile-unpacker matchwhitelist
## match both:
#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
#/lib/policykit-1/polkit-agent-helper-1
polkit-agent-helper-1 matchwhitelist
###################################################################### ######################################################################
# SUID regex match whitelist # SUID regex match whitelist
###################################################################### ######################################################################
dbus-daemon-launch-helper matchwhitelist
/utempter/utempter matchwhitelist
## required for AppImages such as electrum Bitcoin wallet
## https://forums.whonix.org/t/disable-suid-binaries/7706/57
/fusermount matchwhitelist
###################################################################### ######################################################################
# Permission Hardening # Permission Hardening
###################################################################### ######################################################################
## Remove SUID from 'mount' but keep executable.
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
/bin/mount 745 root root
/usr/bin/mount 745 root root
/home/ 0755 root root /home/ 0755 root root
/home/user/ 0700 user user /home/user/ 0700 user user
/root/ 0700 root root /root/ 0700 root root

9
etc/permission-hardening.d/40_default_whitelist_bubblewrap.conf Normal file
View File

@ -0,0 +1,9 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/bwrap exactwhitelist
/bin/bwrap exactwhitelist

8
etc/permission-hardening.d/40_default_whitelist_chromium.conf Normal file
View File

@ -0,0 +1,8 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
/usr/lib/chromium/chrome-sandbox exactwhitelist

8
etc/permission-hardening.d/40_default_whitelist_dbus.conf Normal file
View File

@ -0,0 +1,8 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
dbus-daemon-launch-helper matchwhitelist

11
etc/permission-hardening.d/40_default_whitelist_firejail.conf Normal file
View File

@ -0,0 +1,11 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
## There is a controversy about firejail but those who choose to install it
## should be able to use it.
## https://www.whonix.org/wiki/Dev/Firejail#Security
/usr/bin/firejail exactwhitelist

10
etc/permission-hardening.d/40_default_whitelist_fuse.conf Normal file
View File

@ -0,0 +1,10 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
## required for AppImages such as electrum Bitcoin wallet
## https://forums.whonix.org/t/disable-suid-binaries/7706/57
/fusermount matchwhitelist

17
etc/permission-hardening.d/40_default_whitelist_mount.conf Normal file
View File

@ -0,0 +1,17 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
## Protect from 'chmod -x' (and SUID removal).
## SUID will be removed below in separate step.
/bin/mount exactwhitelist
/usr/bin/mount exactwhitelist
## Remove SUID from 'mount' but keep executable.
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
/bin/mount 745 root root
/usr/bin/mount 745 root root

17
etc/permission-hardening.d/40_default_whitelist_policykit.conf Normal file
View File

@ -0,0 +1,17 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/pkexec exactwhitelist
/bin/pkexec exactwhitelist
/usr/bin/pkexec.security-misc-orig exactwhitelist
/bin/pkexec.security-misc-orig exactwhitelist
## TODO: research
## match both:
#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
#/lib/policykit-1/polkit-agent-helper-1
polkit-agent-helper-1 matchwhitelist

13
etc/permission-hardening.d/40_default_whitelist_qubes.conf Normal file
View File

@ -0,0 +1,13 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
## TODO: research
## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c
## match both:
#/usr/lib/qubes/qfile-unpacker whitelist
#/lib/qubes/qfile-unpacker
/qubes/qfile-unpacker matchwhitelist

8
etc/permission-hardening.d/40_default_whitelist_selinux.conf Normal file
View File

@ -0,0 +1,8 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
/utempter/utempter matchwhitelist

8
etc/permission-hardening.d/40_default_whitelist_spice.conf Normal file
View File

@ -0,0 +1,8 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper exactwhitelist

9
etc/permission-hardening.d/40_default_whitelist_sudo.conf Normal file
View File

@ -0,0 +1,9 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/sudo exactwhitelist
/bin/sudo exactwhitelist

9
etc/permission-hardening.d/40_default_whitelist_virtualbox.conf Normal file
View File

@ -0,0 +1,9 @@
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
## TODO: research
/usr/lib/virtualbox/ matchwhitelist