mirror of
https://github.com/Kicksecure/security-misc.git
synced 2024-12-25 05:59:22 -05:00
simplify disabling of SUID Disabler and Permission Hardener whitelist
split `/etc/permission-hardening.d/30_default.conf` into multiple files `/etc/permission-hardening.d/40_default_whitelist_[...].conf` therefore make it easier to delete any whitelisted SUID binaries
This commit is contained in:
Patrick Schleizer
parent
cf07e977bd
commit
318ab570aa
@ -34,29 +34,6 @@
|
||||
# SUID exact match whitelist
|
||||
######################################################################
|
||||
|
||||
/usr/bin/sudo exactwhitelist
|
||||
/bin/sudo exactwhitelist
|
||||
/usr/bin/bwrap exactwhitelist
|
||||
/bin/bwrap exactwhitelist
|
||||
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper exactwhitelist
|
||||
/usr/lib/chromium/chrome-sandbox exactwhitelist
|
||||
|
||||
/usr/bin/pkexec exactwhitelist
|
||||
/bin/pkexec exactwhitelist
|
||||
/usr/bin/pkexec.security-misc-orig exactwhitelist
|
||||
/bin/pkexec.security-misc-orig exactwhitelist
|
||||
|
||||
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
|
||||
## Protect from 'chmod -x' (and SUID removal).
|
||||
## SUID will be removed below in separate step.
|
||||
/bin/mount exactwhitelist
|
||||
/usr/bin/mount exactwhitelist
|
||||
|
||||
## There is a controversy about firejail but those who choose to install it
|
||||
## should be able to use it.
|
||||
## https://www.whonix.org/wiki/Dev/Firejail#Security
|
||||
/usr/bin/firejail exactwhitelist
|
||||
|
||||
## In case you need to use 'su'. See also:
|
||||
## https://www.whonix.org/wiki/root#su
|
||||
#/bin/su exactwhitelist
|
||||
@ -72,42 +49,17 @@
|
||||
#/usr/lib/xorg/Xorg.wrap whitelist
|
||||
|
||||
######################################################################
|
||||
# SUID regex match whitelist - research required
|
||||
# SUID regex match whitelist
|
||||
######################################################################
|
||||
|
||||
/usr/lib/virtualbox/ matchwhitelist
|
||||
|
||||
## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c
|
||||
## match both:
|
||||
#/usr/lib/qubes/qfile-unpacker whitelist
|
||||
#/lib/qubes/qfile-unpacker
|
||||
/qubes/qfile-unpacker matchwhitelist
|
||||
|
||||
## match both:
|
||||
#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
|
||||
#/lib/policykit-1/polkit-agent-helper-1
|
||||
polkit-agent-helper-1 matchwhitelist
|
||||
|
||||
######################################################################
|
||||
# SUID regex match whitelist
|
||||
######################################################################
|
||||
|
||||
dbus-daemon-launch-helper matchwhitelist
|
||||
/utempter/utempter matchwhitelist
|
||||
|
||||
## required for AppImages such as electrum Bitcoin wallet
|
||||
## https://forums.whonix.org/t/disable-suid-binaries/7706/57
|
||||
/fusermount matchwhitelist
|
||||
|
||||
######################################################################
|
||||
# Permission Hardening
|
||||
######################################################################
|
||||
|
||||
## Remove SUID from 'mount' but keep executable.
|
||||
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
|
||||
/bin/mount 745 root root
|
||||
/usr/bin/mount 745 root root
|
||||
|
||||
/home/ 0755 root root
|
||||
/home/user/ 0700 user user
|
||||
/root/ 0700 root root
|
||||
|
||||
@ -0,0 +1,9 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/bin/bwrap exactwhitelist
|
||||
/bin/bwrap exactwhitelist
|
||||
@ -0,0 +1,8 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/lib/chromium/chrome-sandbox exactwhitelist
|
||||
@ -0,0 +1,8 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
dbus-daemon-launch-helper matchwhitelist
|
||||
@ -0,0 +1,11 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## There is a controversy about firejail but those who choose to install it
|
||||
## should be able to use it.
|
||||
## https://www.whonix.org/wiki/Dev/Firejail#Security
|
||||
/usr/bin/firejail exactwhitelist
|
||||
10
etc/permission-hardening.d/40_default_whitelist_fuse.conf
Normal file
10
etc/permission-hardening.d/40_default_whitelist_fuse.conf
Normal file
@ -0,0 +1,10 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## required for AppImages such as electrum Bitcoin wallet
|
||||
## https://forums.whonix.org/t/disable-suid-binaries/7706/57
|
||||
/fusermount matchwhitelist
|
||||
17
etc/permission-hardening.d/40_default_whitelist_mount.conf
Normal file
17
etc/permission-hardening.d/40_default_whitelist_mount.conf
Normal file
@ -0,0 +1,17 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
|
||||
## Protect from 'chmod -x' (and SUID removal).
|
||||
## SUID will be removed below in separate step.
|
||||
/bin/mount exactwhitelist
|
||||
/usr/bin/mount exactwhitelist
|
||||
|
||||
## Remove SUID from 'mount' but keep executable.
|
||||
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
|
||||
/bin/mount 745 root root
|
||||
/usr/bin/mount 745 root root
|
||||
@ -0,0 +1,17 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/bin/pkexec exactwhitelist
|
||||
/bin/pkexec exactwhitelist
|
||||
/usr/bin/pkexec.security-misc-orig exactwhitelist
|
||||
/bin/pkexec.security-misc-orig exactwhitelist
|
||||
|
||||
## TODO: research
|
||||
## match both:
|
||||
#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
|
||||
#/lib/policykit-1/polkit-agent-helper-1
|
||||
polkit-agent-helper-1 matchwhitelist
|
||||
13
etc/permission-hardening.d/40_default_whitelist_qubes.conf
Normal file
13
etc/permission-hardening.d/40_default_whitelist_qubes.conf
Normal file
@ -0,0 +1,13 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## TODO: research
|
||||
## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c
|
||||
## match both:
|
||||
#/usr/lib/qubes/qfile-unpacker whitelist
|
||||
#/lib/qubes/qfile-unpacker
|
||||
/qubes/qfile-unpacker matchwhitelist
|
||||
@ -0,0 +1,8 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/utempter/utempter matchwhitelist
|
||||
@ -0,0 +1,8 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper exactwhitelist
|
||||
@ -0,0 +1,9 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/bin/sudo exactwhitelist
|
||||
/bin/sudo exactwhitelist
|
||||
@ -0,0 +1,9 @@
|
||||
## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## TODO: research
|
||||
/usr/lib/virtualbox/ matchwhitelist
|
||||
Loading…
Reference in New Issue
Block a user