mirror of
https://github.com/Kicksecure/security-misc.git
synced 2025-11-25 18:16:39 -05:00
Merge branch 'master' into master
This commit is contained in:
Patrick Schleizer
GitHub
commit
3229dd8967
34 changed files with 1860 additions and 207 deletions
58
README.md
58
README.md
|
|
@ -44,16 +44,15 @@ configuration file and significant hardening is applied to a myriad of component
|
|||
|
||||
- Restrict kernel profiling and the performance events system to `CAP_PERFMON`.
|
||||
|
||||
- Force the kernel to panic on both "oopses", which can potentially indicate and thwart
|
||||
certain kernel exploitation attempts, and also kernel warnings in the `WARN()` path.
|
||||
- Force the kernel to immediately panic on both "oopses" (which can potentially indicate
|
||||
and thwart certain kernel exploitation attempts) and kernel warnings in the `WARN()` path.
|
||||
|
||||
- Optional - Force immediate reboot on the occurrence of a single kernel panic and also
|
||||
(when using Linux kernel >= 6.2) limit the number of allowed panics to one.
|
||||
- Force immediate system reboot on the occurrence of a single kernel panic, reducing the
|
||||
risk and impact of both denial of service and cold boot attacks.
|
||||
|
||||
- Disable the use of legacy TIOCSTI operations which can be used to inject keypresses.
|
||||
|
||||
- Disable asynchronous I/O (when using Linux kernel >= 6.6) as `io_uring` has been
|
||||
the source of numerous kernel exploits.
|
||||
- Disable asynchronous I/O as `io_uring` has been the source of numerous kernel exploits.
|
||||
|
||||
#### User space
|
||||
|
||||
|
|
@ -221,12 +220,10 @@ Kernel space:
|
|||
|
||||
- Disable 32-bit vDSO mappings as they are a legacy compatibility feature.
|
||||
|
||||
- Optional - Use kCFI as the default CFI implementation (when using Linux kernel >= 6.2)
|
||||
since it may be slightly more resilient to attacks that are able to write
|
||||
arbitrary executables in memory.
|
||||
- Use kCFI as the default CFI implementation as it is more resilient to attacks that are
|
||||
able to write arbitrary executables into memory omitting the necessary hash validation.
|
||||
|
||||
- Optional - Disable support for all x86 processes and syscalls (when using Linux kernel >= 6.7)
|
||||
to reduce attack surface.
|
||||
- Disable support for all 32-bit x86 processes and syscalls to reduce attack surface.
|
||||
|
||||
- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs
|
||||
and other persistent data to either the UEFI variable storage or ACPI ERST backends.
|
||||
|
|
@ -280,23 +277,15 @@ Completely disables `ptrace()`. Can be enabled easily if needed.
|
|||
|
||||
* [security-misc pull request #242](https://github.com/Kicksecure/security-misc/pull/242)
|
||||
|
||||
2. `sysctl kernel.panic=-1`
|
||||
|
||||
Forces an immediate reboot on kernel panic. This can be enabled, but it may lead to unexpected
|
||||
system crashes.
|
||||
|
||||
* [security-misc pull request #264](https://github.com/Kicksecure/security-misc/pull/264)
|
||||
* [security-misc pull request #268](https://github.com/Kicksecure/security-misc/pull/268)
|
||||
|
||||
**Non-compliance:**
|
||||
|
||||
3. `sysctl user.max_user_namespaces=0`
|
||||
2. `sysctl user.max_user_namespaces=0`
|
||||
|
||||
Disables user namespaces entirely. Not recommended due to the potential for widespread breakages.
|
||||
|
||||
* [security-misc pull request #263](https://github.com/Kicksecure/security-misc/pull/263)
|
||||
|
||||
4. `sysctl fs.binfmt_misc.status=0`
|
||||
3. `sysctl fs.binfmt_misc.status=0`
|
||||
|
||||
Disables the registration of interpreters for miscellaneous binary formats. Currently not
|
||||
feasible due to compatibility issues with Firefox.
|
||||
|
|
@ -712,6 +701,19 @@ See:
|
|||
* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040
|
||||
* https://forums.whonix.org/t/cannot-use-pkexec/8129
|
||||
|
||||
## Emergency shutdown
|
||||
|
||||
- Forcibly powers off the system if the drive the system booted from is
|
||||
removed from the system.
|
||||
- Forcibly powers off the system if a user-configurable "panic key sequence"
|
||||
is pressed (Ctrl+Alt+Delete by default).
|
||||
- Forcibly powers off the system if
|
||||
`sudo /run/emerg-shutdown --instant-shutdown` is called.
|
||||
- Optional - Forcibly powers off the system if shutdown gets stuck for longer
|
||||
than a user-configurable number of seconds (30 by default). Requires tuning
|
||||
by the user to function properly, see notes in
|
||||
`/etc/security-misc/emerg-shutdown/30_security_misc.conf`.
|
||||
|
||||
## Application-specific hardening
|
||||
|
||||
- Enables "`apt-get --error-on=any`" which makes apt exit non-zero for
|
||||
|
|
@ -723,20 +725,14 @@ See:
|
|||
- Deactivates thumbnails in Thunar.
|
||||
- Rationale: lower attack surface when using the file manager
|
||||
- https://forums.whonix.org/t/disable-preview-in-file-manager-by-default/18904
|
||||
- Thunderbird is hardened with the following options:
|
||||
- Displays domain names in punycode to prevent IDN homograph attacks (a
|
||||
form of phishing).
|
||||
- Strips email client information from sent email headers.
|
||||
- Strips user time information from sent email headers by replacing the
|
||||
originating time zone with UTC and rounding the timestamp to the nearest
|
||||
minute.
|
||||
- Disables scripting when viewing PDF files.
|
||||
- Disables implicit outgoing connections.
|
||||
- Disables all and any kind of telemetry.
|
||||
- Security and privacy enhancements for gnupg's config file
|
||||
`/etc/skel/.gnupg/gpg.conf`. See also:
|
||||
- https://raw.github.com/ioerror/torbirdy/master/gpg.conf
|
||||
- https://github.com/ioerror/torbirdy/pull/11
|
||||
- Hardens SSH client
|
||||
`/etc/ssh/ssh_config.d/30_security-misc.conf`
|
||||
- Hardens SSH server
|
||||
`/etc/ssh/sshd_config.d/30_security-misc.conf`
|
||||
|
||||
### Project scope of application-specific hardening
|
||||
|
||||
|
|
|
|||
|
|
@ -28,7 +28,7 @@ sudo cp ~/derivative.asc /usr/share/keyrings/derivative.asc
|
|||
3\. Add the derivative repository.
|
||||
|
||||
```
|
||||
echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
|
||||
echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com trixie main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
|
||||
```
|
||||
|
||||
4\. Update your package lists.
|
||||
|
|
|
|||
|
|
@ -1,3 +1,167 @@
|
|||
commit 3629f2c3a59d44e265f0c66389435de1b2414998
|
||||
Merge: 5dc251c c59a3b2
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Sun Aug 10 02:25:48 2025 -0400
|
||||
|
||||
Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown'
|
||||
|
||||
commit c59a3b233bd8893d466c020a2e2695ab545c6e60
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Sat Aug 9 21:55:03 2025 -0500
|
||||
|
||||
Fix unexpected shutdowns when booting Kicksecure from optical media
|
||||
|
||||
commit 5dc251c5da724092d264481740e4f6ed347aa0a7
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Sat Aug 9 09:45:35 2025 +0000
|
||||
|
||||
bumped changelog version
|
||||
|
||||
commit 046c932898290d250a7900e3c59973a698e5c55f
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Sat Aug 9 05:40:11 2025 -0400
|
||||
|
||||
`disable emerg-shutdown.service`:
|
||||
|
||||
Disabled due to bug: breaks ISO Live Mode Calamares installer
|
||||
|
||||
commit 0cc0a8310020afc10de6512095336e55559a84d9
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Thu Aug 7 07:08:19 2025 +0000
|
||||
|
||||
bumped changelog version
|
||||
|
||||
commit 505a2b7d7995ad48a17add86513ced3499f64ee9
|
||||
Merge: 4294165 3a77abe
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Thu Aug 7 03:08:02 2025 -0400
|
||||
|
||||
Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown'
|
||||
|
||||
commit 3a77abe5c9807caec530e69c41d5cf803b625e70
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Wed Aug 6 20:05:57 2025 -0500
|
||||
|
||||
Port hardening options from kloak to emerg-shutdown, fix new compiler warnings
|
||||
|
||||
commit 0c1af00aae50dba2983c3736744e0da320bb9330
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Wed Aug 6 19:33:38 2025 -0500
|
||||
|
||||
Implement paranoid mode in emerg-shutdown
|
||||
|
||||
commit 29480df770047c8ada3e993cf28f87ffbfd71dec
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Wed Aug 6 19:24:34 2025 -0500
|
||||
|
||||
Improve emerg-shutdown usage documentation
|
||||
|
||||
commit 2a3bc39eba317d5f9b0e710dd3663c82d92add94
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Wed Aug 6 19:10:37 2025 -0500
|
||||
|
||||
Use Ctrl+Alt+End as the default panic key rather than Ctrl+Alt+Delete
|
||||
|
||||
commit 44e7d3059a5618991a1408f77707132bfea86fef
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Wed Aug 6 19:10:14 2025 -0500
|
||||
|
||||
Integrate emerg-shutdown into the initramfs
|
||||
|
||||
commit 42941653621311187650f12e8d7aa39c45cb6984
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Wed Aug 6 08:27:15 2025 +0000
|
||||
|
||||
bumped changelog version
|
||||
|
||||
commit 784ff8af3616765a9c22febf66b522376ecedf12
|
||||
Merge: c2690ef 5a17e67
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Wed Aug 6 04:26:37 2025 -0400
|
||||
|
||||
Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown'
|
||||
|
||||
commit 5a17e67c0a7678300f6342d5c90ded5494ebc838
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Tue Aug 5 20:14:07 2025 -0500
|
||||
|
||||
Fix local-fs.target dependency in emerg-shutdown.service
|
||||
|
||||
commit c2690efcacbf7be7c57751ba1cee7f910d350cfc
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Mon Aug 4 09:27:11 2025 +0000
|
||||
|
||||
bumped changelog version
|
||||
|
||||
commit 166bc257b0b2eea87d684cc847bf6da1fba7c4b4
|
||||
Merge: d1bca02 63f2909
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Mon Aug 4 05:26:55 2025 -0400
|
||||
|
||||
Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown'
|
||||
|
||||
commit 63f29093416a5f21ae14b398cf805c864b5541d7
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Sun Aug 3 15:00:14 2025 -0500
|
||||
|
||||
Fix emerg-shutdown and ensure-shutdown libexec scripts, start emerg-shutdown and ensure-shutdown earlier
|
||||
|
||||
commit d1bca0204fa1dac9ec3fb6e9b121af9526778181
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Sun Aug 3 11:33:03 2025 +0000
|
||||
|
||||
bumped changelog version
|
||||
|
||||
commit 92bcd824e4af8a90a18a7726d4a5715c0b20e2ca
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Sun Aug 3 07:17:25 2025 -0400
|
||||
|
||||
also parse /usr/local/etc
|
||||
|
||||
commit 4da810c8fa4fd40b8701e7dfe217125d965ee03e
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Sun Aug 3 07:16:00 2025 -0400
|
||||
|
||||
comment
|
||||
|
||||
commit b9416fa77a1e8850c5f579314875671799a55c60
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Sun Aug 3 07:15:41 2025 -0400
|
||||
|
||||
validate configuration file
|
||||
|
||||
commit 4ba029471e8c12d5691f7ee94897137fb3cbe15f
|
||||
Merge: c1e76aa 1a60da7
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Sun Aug 3 07:04:20 2025 -0400
|
||||
|
||||
Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown'
|
||||
|
||||
commit 1a60da71eddfcc6fb72a34596c770cd754146887
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Tue Jul 29 21:16:51 2025 -0500
|
||||
|
||||
emerg-shutdown: Add shutdown timeout for preventing stuck shutdowns, briefly document feature set and usage
|
||||
|
||||
commit e42078e90d7d7e5339a7c4682eb93c844fd38580
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Mon Jul 28 20:42:14 2025 -0500
|
||||
|
||||
emerg-shutdown: fix the hang-on-shutdown bug, add autodetection of new keyboards, shutdown key configuration, and instant shutdown option
|
||||
|
||||
commit a1d1c5603300106f06c1a798088521b77430ff95
|
||||
Merge: 5889d13 c1e76aa
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Sun Jul 27 21:43:43 2025 -0500
|
||||
|
||||
Merge branch 'master' into arraybolt3/emerg-shutdown
|
||||
|
||||
commit c1e76aa52cd28f38c1ab6550e0f4de0010a9ea14
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Mon Jul 21 10:00:25 2025 +0000
|
||||
|
||||
bumped changelog version
|
||||
|
||||
commit 36114e29a2ce1045b5f5d82372fcf0463efc5ca7
|
||||
Merge: e3ce9c3 f851886
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
|
|
@ -14,12 +178,43 @@ Date: Mon Jul 21 05:58:44 2025 -0400
|
|||
|
||||
Enable `indirect_target_selection=force`
|
||||
|
||||
commit 5889d134a23b3d4f8db5d81171ea12907bb10d4d
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Sun Jul 20 14:14:09 2025 -0500
|
||||
|
||||
emerg-shutdow: Improve recvmsg handling, call reboot syscall directly
|
||||
|
||||
commit 6f9763f525097b8f8ad5f9864c1694a2642e1bd6
|
||||
Author: raja-grewal <rg_public@proton.me>
|
||||
Date: Sat Jul 19 05:19:27 2025 +0000
|
||||
|
||||
Enable `indirect_target_selection=force`
|
||||
|
||||
commit b745c8ddae74d5e1684919442fa74d64e95263b8
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Mon Jul 14 21:51:52 2025 -0500
|
||||
|
||||
emerg-shutdown: Enable actual shutdown code, fix infinite loop when started too early
|
||||
|
||||
commit e387086de4b6e6b90b23d4c32ddf8a566beb858c
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Mon Jul 14 21:05:16 2025 -0500
|
||||
|
||||
Allow specifying alternative keys in panic key combo, fix optical disk eject handling
|
||||
|
||||
commit dfb6f143f0324d0903ae2dd106bc0fb6907c1cb0
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Sun Jul 13 20:53:29 2025 -0500
|
||||
|
||||
Add panic key handling to emergency shutdown utility
|
||||
|
||||
commit 2a7071055f94f984398fe2ec49c32b206913bea2
|
||||
Merge: f3d46ee e3ce9c3
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Sun Jul 13 15:21:34 2025 -0500
|
||||
|
||||
Merge branch 'master' into arraybolt3/emerg-shutdown
|
||||
|
||||
commit e3ce9c38c5b241f789945de7229c0ee15fa0a266
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Wed Jul 2 20:52:17 2025 +0000
|
||||
|
|
@ -473,6 +668,12 @@ Date: Thu May 15 15:06:10 2025 -0400
|
|||
|
||||
* Only rudimentary tests were conducted
|
||||
|
||||
commit f3d46ee56233c4ef0552c20304413d137e90acfe
|
||||
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
|
||||
Date: Fri May 9 18:46:41 2025 -0500
|
||||
|
||||
Add emergency shutdown feature, triggered by root device removal
|
||||
|
||||
commit 341dce33fb806ab03822470e6af91604662c22dd
|
||||
Author: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Date: Fri Apr 25 09:54:23 2025 +0000
|
||||
|
|
|
|||
36
debian/changelog
vendored
36
debian/changelog
vendored
|
|
@ -1,3 +1,39 @@
|
|||
security-misc (3:47.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 10 Aug 2025 06:34:30 +0000
|
||||
|
||||
security-misc (3:46.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 09 Aug 2025 09:45:34 +0000
|
||||
|
||||
security-misc (3:46.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 07 Aug 2025 07:08:19 +0000
|
||||
|
||||
security-misc (3:46.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 06 Aug 2025 08:27:15 +0000
|
||||
|
||||
security-misc (3:46.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 04 Aug 2025 09:27:11 +0000
|
||||
|
||||
security-misc (3:46.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 03 Aug 2025 11:33:03 +0000
|
||||
|
||||
security-misc (3:46.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
|
|
|||
4
debian/control
vendored
4
debian/control
vendored
|
|
@ -13,13 +13,14 @@ Build-Depends: config-package-dev,
|
|||
Homepage: https://www.kicksecure.com/wiki/Security-misc
|
||||
Vcs-Browser: https://github.com/Kicksecure/security-misc
|
||||
Vcs-Git: https://github.com/Kicksecure/security-misc.git
|
||||
Standards-Version: 4.6.2
|
||||
Standards-Version: 4.7.2
|
||||
Rules-Requires-Root: no
|
||||
|
||||
Package: security-misc
|
||||
Architecture: all
|
||||
Depends: adduser,
|
||||
apparmor-profile-dist,
|
||||
build-essential,
|
||||
dmsetup,
|
||||
helper-scripts,
|
||||
libcap2-bin,
|
||||
|
|
@ -27,6 +28,7 @@ Depends: adduser,
|
|||
libpam-modules-bin,
|
||||
libpam-runtime,
|
||||
libpam-umask,
|
||||
memlockd,
|
||||
python3,
|
||||
secure-delete,
|
||||
sudo,
|
||||
|
|
|
|||
|
|
@ -186,15 +186,14 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0"
|
|||
## The default implementation is FineIBT as of Linux kernel 6.2.
|
||||
## The Intel-developed IBT (Indirect Branch Tracking) is only used if supported by the CPU.
|
||||
## kCFI is software-only while FineIBT is a hybrid software/hardware implementation.
|
||||
## FineIBT may result in some performance benefits as it only performs checking at destinations.
|
||||
## FineIBT may result in some performance benefits as it only performs hash checks at the destinations.
|
||||
## kCFI mandates hash validation at the source (which is randomized), making it more difficult to bypass.
|
||||
## FineIBT is considered weaker against attacks that can write arbitrary executables into memory.
|
||||
## Upstream hardening work has provided users the ability to disable FineIBT based on requests.
|
||||
## Choice of CFI implementation is highly dependent on user threat model as there are pros/cons to both.
|
||||
## Do not modify from the default setting if unsure of implications.
|
||||
##
|
||||
## https://lore.kernel.org/all/20221027092842.699804264@infradead.org/
|
||||
## https://lwn.net/Articles/891976/
|
||||
## https://lore.kernel.org/lkml/202210010918.4918F847C4@keescook/T/#u
|
||||
## https://lore.kernel.org/lkml/202210182217.486CBA50@keescook/T/
|
||||
## https://lore.kernel.org/all/20221027092842.699804264@infradead.org/
|
||||
## https://lore.kernel.org/lkml/202407150933.E1871BE@keescook/
|
||||
## https://isopenbsdsecu.re/mitigations/forward_edge_cfi/
|
||||
## https://docs.kernel.org/next/x86/shstk.html
|
||||
|
|
@ -205,12 +204,9 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0"
|
|||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter.
|
||||
##
|
||||
## TODO: Debian 13 Trixie
|
||||
## Applicable when using Linux kernel >= 6.2 (retained here for future-proofing and completeness).
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cfi=kcfi"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cfi=kcfi"
|
||||
|
||||
## Disable support for x86 processes and syscalls.
|
||||
## Disable support for all 32-bit x86 processes and syscalls.
|
||||
## Unconditionally disables IA32 emulation to substantially reduce attack surface.
|
||||
##
|
||||
## https://lore.kernel.org/all/20230623111409.3047467-7-nik.borisov@suse.com/
|
||||
|
|
@ -218,10 +214,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0"
|
|||
## KSPP=yes
|
||||
## KSPP does not set CONFIG_COMPAT, CONFIG_IA32_EMULATION, CONFIG_X86_X32, CONFIG_X86_X32_ABI, and CONFIG_MODIFY_LDT_SYSCALL.
|
||||
##
|
||||
## TODO: Debian 13 Trixie
|
||||
## Applicable when using Linux kernel >= 6.7 (retained here for future-proofing and completeness).
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0"
|
||||
|
||||
## Disable EFI persistent storage feature.
|
||||
## Disable Error Record Serialization Table (ERST) support as a form of defense-in-depth.
|
||||
|
|
|
|||
|
|
@ -7,14 +7,17 @@
|
|||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
||||
|
||||
## Disable access to single-user (recovery) mode.
|
||||
## Disable access to the GRUB single-user (recovery) mode menu entries.
|
||||
##
|
||||
## https://forums.kicksecure.com/t/remove-linux-recovery-mode-boot-option-from-default-grub-boot-menu/727
|
||||
##
|
||||
GRUB_DISABLE_RECOVERY="true"
|
||||
|
||||
## Disable access to Dracut's recovery console.
|
||||
## Prevents the emergency shell from starting automatically during boot failures.
|
||||
##
|
||||
## https://insinuator.net/2025/07/insecure-boot-injecting-initramfs-from-a-debug-shell/
|
||||
## https://serverfault.com/questions/554853/how-can-i-secure-the-dracut-shell
|
||||
## https://forums.kicksecure.com/t/harden-dracut-initramfs-generator-by-disabling-recovery-console/724
|
||||
##
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.emergency=halt"
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ blacklist sr_mod
|
|||
## Partial selection of their infrastructure blacklist.
|
||||
## Duplicate and already disabled modules have been omitted.
|
||||
##
|
||||
## https://github.com/GrapheneOS/infrastructure/blob/main/modprobe.d/local.conf
|
||||
## https://github.com/GrapheneOS/infrastructure/blob/main/etc/modprobe.d/local.conf
|
||||
##
|
||||
#blacklist cfg80211
|
||||
#blacklist intel_agp
|
||||
|
|
|
|||
34
etc/security-misc/emerg-shutdown/30_security_misc.conf
Normal file
34
etc/security-misc/emerg-shutdown/30_security_misc.conf
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/security-misc/emerg-shutdown/50_user.conf" or
|
||||
## "/usr/local/etc/security-misc/emerg-shutdown/50_user.conf"
|
||||
## for your custom configuration, which will override the defaults found here.
|
||||
## When Kicksecure is updated, this file may be overwritten.
|
||||
|
||||
## Set the key combo for forcing immediate shutdown. See the "Keys and
|
||||
## buttons" section of "/usr/include/linux/input-event-codes.h" for possibly
|
||||
## supported values. Not all keys are supported.
|
||||
##
|
||||
## All specified keys must be depressed at the same time to trigger a
|
||||
## shutdown. Use a comma (",") to separate keys. If you want to alias certain
|
||||
## keys to each other from emerg-shutdown's standpoint, use a pipe
|
||||
## character("|").
|
||||
##
|
||||
## The default key sequence triggers a shutdown when Ctrl+Alt+Delete is
|
||||
## pressed, allowing the use of either the left or right Ctrl and Alt keys.
|
||||
EMERG_SHUTDOWN_KEYS="KEY_LEFTCTRL|KEY_RIGHTCTRL,KEY_LEFTALT|KEY_RIGHTALT,KEY_END"
|
||||
|
||||
## Set the maximum number of seconds shutdown can take. If shutdown gets stuck
|
||||
## for longer than this, the system will forcibly power down.
|
||||
##
|
||||
## NOTE: This requires ensure-shutdown.service and
|
||||
## ensure-shutdown-trigger.service to be enabled, which is not done by
|
||||
## default. Enabling ensure-shutdown.service will cause shutdown to always
|
||||
## take at least as long as systemd's DefaultTimeoutStopSec (which by default
|
||||
## is 90 seconds). If you are going to enable ensure-shutdown.service, it is
|
||||
## highly recommended to set DefaultTimeoutStopSec to a much smaller value,
|
||||
## such as 5 seconds. The maximum shutdown time set here should be at least 10
|
||||
## seconds *longer* than DefaultTimeoutStopSec, to give normal shutdown a
|
||||
## chance to actually succeed before forcibly shutting down the system.
|
||||
ENSURE_SHUTDOWN_TIMEOUT=30
|
||||
|
|
@ -2,4 +2,6 @@
|
|||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Disable coredumps.
|
||||
* - core 0
|
||||
## `-` in the second field sets both hard and soft limits at the same time.
|
||||
## See `man 5 limits.conf`.
|
||||
* - core 0
|
||||
22
etc/ssh/ssh_config.d/30_security-misc.conf
Normal file
22
etc/ssh/ssh_config.d/30_security-misc.conf
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Don't edit this file, to overwrite any options, edit a file with a higher
|
||||
## number that is read later by SSH, such as
|
||||
## '/etc/ssh/ssh_config.d/50_user.conf'. If your configuration changes do not
|
||||
## need to be system-wide, you may also consider placing overrides in
|
||||
## ~/.ssh/config.
|
||||
|
||||
## See also:
|
||||
## https://www.kicksecure.com/wiki/SSH#Client_Configuration_File
|
||||
|
||||
Host *
|
||||
VisualHostKey yes
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org
|
||||
## To force the use of quantum-resistant key exchange algorithms, override
|
||||
## the above with
|
||||
# KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256
|
||||
HostKeyAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519
|
||||
PubkeyAcceptedAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519
|
||||
78
etc/ssh/sshd_config.d/30_security-misc.conf
Normal file
78
etc/ssh/sshd_config.d/30_security-misc.conf
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Don't edit this file, to overwrite any options, edit a file with a higher
|
||||
## number that is read later by SSHD, such as
|
||||
## '/etc/ssh/sshd_config.d/50_user.conf'.
|
||||
|
||||
## See also:
|
||||
## https://www.kicksecure.com/wiki/SSH#Server_Configuration_File
|
||||
|
||||
## Number of allowed login attempts per connection.
|
||||
MaxAuthTries 3
|
||||
|
||||
## Require strong ciphers and algorithms.
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
HostKeyAlgorithms ssh-ed25519
|
||||
PubkeyAcceptedAlgorithms ssh-ed25519,sk-ssh-ed25519@openssh.com
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
|
||||
MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org
|
||||
## To force the use of quantum-resistant key exchange algorithms, override the
|
||||
## above with
|
||||
# KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256
|
||||
|
||||
## Override with 'no' to fully deny root login, or leave this as
|
||||
## 'prohibit-password' for denying root password login but still allowing
|
||||
## other authentication methods such as public key.
|
||||
PermitRootLogin prohibit-password
|
||||
|
||||
## Public key authentication is transparent, non-interactive and more secure.
|
||||
PasswordAuthentication no
|
||||
|
||||
## Change to 'yes' to enable challenge-response passwords (beware issues with
|
||||
## some PAM modules and threads)
|
||||
KbdInteractiveAuthentication no
|
||||
|
||||
## PAM can be used for account and session processing when using
|
||||
## ChallengeResponseAuthentication or PasswordAuthentication.
|
||||
##
|
||||
## Depending on your PAM configuration, PAM authentication via
|
||||
## ChallengeResponseAuthentication may bypass the setting of "PermitRootLogin
|
||||
## without-password".
|
||||
##
|
||||
## If you want PAM account and session checks to run without PAM
|
||||
## authentication, then enable this but set PasswordAuthentication and
|
||||
## ChallengeResponseAuthentication to 'no'.
|
||||
##
|
||||
## The default upstream is 'no', Debian sets this to 'yes'. If using a locked
|
||||
## account, read:
|
||||
## https://www.kicksecure.com/wiki/SSH#SSH_Login_Comparison_Table
|
||||
## We set it to 'yes' to work with libpam-tmpdir.
|
||||
## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#libpam-tmpdir
|
||||
## Also folders such as '/run/user/1000' will exist thanks to PAM.
|
||||
## The absence of that folder can lead to issues (such as with msgcollector).
|
||||
UsePAM yes
|
||||
|
||||
## Block dangerous forwarding.
|
||||
AllowAgentForwarding no
|
||||
AllowTcpForwarding no
|
||||
X11Forwarding no
|
||||
|
||||
## Hide unnecessary login banners.
|
||||
PrintMotd no
|
||||
#Banner /etc/issue.net
|
||||
#Hiding Debian version from SSH banner (obscurity)
|
||||
DebianBanner no
|
||||
|
||||
## Some options are dangerous but may be required in certain circumstances. As
|
||||
## an example, if forwarding is required, selectively allow it with a 'Match'
|
||||
## block. Consider a new separate user named 'tunnel' which wants to forward
|
||||
## its local port to be available on the server on port 443. Note that a
|
||||
## tunnel user doesn't even require a TTY nor a shell, so don't forget to
|
||||
## change the 'tunnel' shell to something that prevents login such as
|
||||
## '/usr/sbin/nologin'.
|
||||
#Match User tunnel
|
||||
# AllowTcpForwarding yes
|
||||
# PermitListen localhost:443
|
||||
# PermitTTY no
|
||||
|
|
@ -1,59 +0,0 @@
|
|||
//#### Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
//#### See the file COPYING for copying conditions.
|
||||
|
||||
//#### meta start
|
||||
//#### project Whonix and Kicksecure
|
||||
//#### category security and apps
|
||||
//#### description https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
||||
//#### meta end
|
||||
|
||||
// https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
||||
pref("network.IDN_show_punycode", true);
|
||||
|
||||
// Disable all and any kind of telemetry by default
|
||||
pref("toolkit.telemetry.enabled", false);
|
||||
pref("toolkit.telemetry.unified", false);
|
||||
pref("toolkit.telemetry.shutdownPingSender.enabled", false);
|
||||
pref("toolkit.telemetry.updatePing.enabled", false);
|
||||
pref("toolkit.telemetry.archive.enabled", false);
|
||||
pref("toolkit.telemetry.bhrPing.enabled", false);
|
||||
pref("toolkit.telemetry.firstShutdownPing.enabled", false);
|
||||
pref("toolkit.telemetry.newProfilePing.enabled", false);
|
||||
pref("toolkit.telemetry.server", ""); // Defense in depth
|
||||
pref("toolkit.telemetry.server_owner", ""); // Defense in depth
|
||||
pref("datareporting.healthreport.uploadEnabled", false);
|
||||
pref("datareporting.policy.dataSubmissionEnabled", false);
|
||||
pref("toolkit.telemetry.coverage.opt-out", true); // from Firefox
|
||||
pref("toolkit.coverage.opt-out", true); // from Firefox
|
||||
|
||||
// Disable implicit outbound traffic
|
||||
pref("network.connectivity-service.enabled", false);
|
||||
pref("network.prefetch-next", false);
|
||||
pref("network.dns.disablePrefetch", true);
|
||||
pref("network.predictor.enabled", false);
|
||||
|
||||
// No need to explain the problems with javascript
|
||||
// If you want javascript, use your browser
|
||||
// Thunderbird needs no javascript
|
||||
// pref("javascript.enabled", false); // Will break setting up services that require redirecting to their javascripted webpage for login, like gmail etc. So commented out for now.
|
||||
|
||||
// Disable scripting when viewing pdf files
|
||||
user_pref("pdfjs.enableScripting", false);
|
||||
|
||||
// If you want cookies, use your browser
|
||||
pref("network.cookie.cookieBehavior", 2);
|
||||
|
||||
// Do not send user agent information
|
||||
// For email clients, this is more like a relic of the past
|
||||
// Completely not necessary and just exposes a lot of information about the client
|
||||
// Since v115.0 Thunderbird already minimizes the user agent
|
||||
// But we want it gone for good for no information leak at all
|
||||
// https://hg.mozilla.org/comm-central/rev/cbbbc8d93cd7
|
||||
pref("mailnews.headers.sendUserAgent", false);
|
||||
|
||||
// Normally we send emails after marking them with a time stamp
|
||||
// That includes our local time zone
|
||||
// This option makes our local time zone appear as UTC
|
||||
// And rounds the time stamp to the closes minute
|
||||
// https://hg.mozilla.org/comm-central/rev/98aa0bf2e719
|
||||
pref("mail.sanitize_date_header", true);
|
||||
55
etc/usbguard/rules.d/30_security-misc.conf
Normal file
55
etc/usbguard/rules.d/30_security-misc.conf
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
## We allow devices that were plugged in before the daemon starts. Everything
|
||||
## is blocked as the default. Following rules apply on top of this.
|
||||
|
||||
## Explicitly reject any interface that is not documented and/or defined by
|
||||
## USB.org.
|
||||
## Note: Most probably superfluous.
|
||||
reject with-interface none-of { 00:*:* 01:*:* 02:*:* 03:*:* 05:*:* 06:*:* 07:*:* 08:*:* 09:*:* 0a:*:* 0b:*:* 0d:*:* 0e:*:* 0f:*:* 10:*:* 11:*:* 12:*:* 13:*:* 14:*:* 3c:*:* dc:*:* e0:*:* ef:*:* fe:*:* ff:*:* }
|
||||
|
||||
## Allow all mouses and keyboards, in a sense, so the user can conveniently
|
||||
## change them without restrating the daemon.
|
||||
|
||||
## Allow only one keyboard to be connected
|
||||
allow with-interface equals { 03:01:01 } if !allowed-matches(with-interface equals { 03:01:01 })
|
||||
## Allow only one mouse to be connected
|
||||
allow with-interface equals { 03:01:02 } if !allowed-matches(with-interface equals { 03:01:02 })
|
||||
## NOTE: Some HID devices will have an interface of 03:00:00 - these are HID
|
||||
## devices that do not support a "boot interface". **These are blocked
|
||||
## entirely.** It is very likely that this will cause issues with some mice
|
||||
## and keyboards. Also note, all HID devices other than mice and keyboards
|
||||
## will be blocked, **including touchscreens.**
|
||||
|
||||
## Explicitly reject any device with a mouse/keyboard interface in
|
||||
## combination with some other interface.
|
||||
## Mice and keyboards should likely never have non-HID interfaces provided
|
||||
## alongside them.
|
||||
reject with-interface all-of { 03:*:* 00:*:* }
|
||||
reject with-interface all-of { 03:*:* 01:*:* }
|
||||
reject with-interface all-of { 03:*:* 02:*:* }
|
||||
reject with-interface all-of { 03:*:* 05:*:* }
|
||||
reject with-interface all-of { 03:*:* 06:*:* }
|
||||
reject with-interface all-of { 03:*:* 07:*:* }
|
||||
reject with-interface all-of { 03:*:* 08:*:* }
|
||||
reject with-interface all-of { 03:*:* 09:*:* }
|
||||
reject with-interface all-of { 03:*:* 0a:*:* }
|
||||
reject with-interface all-of { 03:*:* 0b:*:* }
|
||||
reject with-interface all-of { 03:*:* 0d:*:* }
|
||||
reject with-interface all-of { 03:*:* 0e:*:* }
|
||||
reject with-interface all-of { 03:*:* 0f:*:* }
|
||||
reject with-interface all-of { 03:*:* 10:*:* }
|
||||
reject with-interface all-of { 03:*:* 11:*:* }
|
||||
reject with-interface all-of { 03:*:* 12:*:* }
|
||||
reject with-interface all-of { 03:*:* 13:*:* }
|
||||
reject with-interface all-of { 03:*:* 14:*:* }
|
||||
reject with-interface all-of { 03:*:* 3c:*:* }
|
||||
reject with-interface all-of { 03:*:* dc:*:* }
|
||||
reject with-interface all-of { 03:*:* e0:*:* }
|
||||
reject with-interface all-of { 03:*:* ef:*:* }
|
||||
reject with-interface all-of { 03:*:* fe:*:* }
|
||||
reject with-interface all-of { 03:*:* ff:*:* }
|
||||
|
||||
## Allow USB mass storage, if and only if the USB device only has the mass
|
||||
## storage interface and nothing extra.
|
||||
## Suspicious interface combinations with mass storage are blocked.
|
||||
allow with-interface equals { 08:*:* }
|
||||
|
||||
48
usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh
Executable file
48
usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh
Executable file
|
|
@ -0,0 +1,48 @@
|
|||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## called by dracut
|
||||
check() {
|
||||
require_binaries /run/emerg-shutdown || return 1
|
||||
return 255
|
||||
}
|
||||
|
||||
## called by dracut
|
||||
depends() {
|
||||
echo 'systemd bash'
|
||||
return 0
|
||||
}
|
||||
|
||||
## called by dracut
|
||||
install() {
|
||||
local config_file
|
||||
|
||||
inst systemd-notify
|
||||
|
||||
inst_simple /usr/libexec/security-misc/emerg-shutdown
|
||||
inst_simple /usr/share/security-misc/emerg-shutdown-initramfs.service /usr/lib/systemd/system/emerg-shutdown-initramfs.service
|
||||
inst_simple /run/emerg-shutdown /emerg-shutdown
|
||||
|
||||
for config_file in /etc/security-misc/emerg-shutdown/*.conf; do
|
||||
if [ -f "${config_file}" ]; then
|
||||
inst_multiple /etc/security-misc/emerg-shutdown/*.conf
|
||||
break
|
||||
fi
|
||||
done
|
||||
for config_file in /usr/local/etc/security-misc/emerg-shutdown/*.conf; do
|
||||
if [ -f "${config_file}" ]; then
|
||||
inst_multiple /usr/local/etc/security-misc/emerg-shutdown/*.conf
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
mkdir -p "${initdir}/usr/lib/systemd/system/initrd.target.wants"
|
||||
ln -s '../emerg-shutdown-initramfs.service' "${initdir}/usr/lib/systemd/system/initrd.target.wants/emerg-shutdown-initramfs.service"
|
||||
}
|
||||
|
||||
## called by dracut
|
||||
installkernel () {
|
||||
hostonly='' instmods evdev
|
||||
}
|
||||
|
|
@ -6,14 +6,14 @@
|
|||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## Used for SSH client key management
|
||||
## https://manpages.debian.org/bookworm/openssh-client/ssh-agent.1.en.html
|
||||
## https://manpages.debian.org/ssh-agent
|
||||
## Debian installs ssh-agent with setgid permissions (2755) and with
|
||||
## _ssh as the group to help mitigate ptrace attacks that could extract
|
||||
## private keys from the agent's memory.
|
||||
ssh-agent matchwhitelist
|
||||
|
||||
## Used only for SSH host-based authentication
|
||||
## https://linux.die.net/man/8/ssh-keysign
|
||||
## https://manpages.debian.org/ssh-keysign
|
||||
## Needed to allow access to the machine's host key for use in the
|
||||
## authentication process. This is a non-default method of authenticating to
|
||||
## SSH, and is likely rarely used, thus this should be safe to disable.
|
||||
|
|
|
|||
|
|
@ -164,14 +164,14 @@ kernel.sysrq=0
|
|||
##
|
||||
kernel.perf_event_paranoid=3
|
||||
|
||||
## Force the kernel to panic on "oopses" and kernel warnings in the WARN() path.
|
||||
## Can sometimes potentially indicate and thwart certain kernel exploitation attempts.
|
||||
## Force the kernel to immediately panic on "oopses" and kernel warnings in the WARN() path.
|
||||
## Panics may be due to false-positives such as bad drivers.
|
||||
## Both allowed limits are set to one so that panics occur on the single first instance of either scenario.
|
||||
## Oopses are serious but non-fatal errors.
|
||||
## Certain "oopses" can sometimes indicate and thwart potential kernel exploitation attempts.
|
||||
## Warnings are messages generated by the kernel to indicate unexpected conditions or errors.
|
||||
## By default, code execution continues regardless of warnings emitted by macros like WARN() and WARN_ON().
|
||||
## Note that by forcing kernel panics on oopses and warnings, this exposes the system to targeted denial of service attacks.
|
||||
## Forcing immediate system reboots on any single kernel panic is an extreme option.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/Kernel_panic#Linux
|
||||
## https://en.wikipedia.org/wiki/Linux_kernel_oops
|
||||
|
|
@ -180,36 +180,40 @@ kernel.perf_event_paranoid=3
|
|||
## https://git.sr.ht/~gregkh/presentation-security/tree/3fdaf81a2f8b2c8d64cdb2f529cc714624868aa8/item/security-stuff.pdf
|
||||
## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panisc-on-oops-1-sysctl-for-better-security/7713
|
||||
##
|
||||
## KSPP=partial
|
||||
## KSPP sets the sysctls, CONFIG_PANIC_ON_OOPS=y, but also requires CONFIG_PANIC_TIMEOUT=-1.
|
||||
## KSPP=yes
|
||||
## KSPP sets the sysctls and CONFIG_PANIC_ON_OOPS=y
|
||||
##
|
||||
## See /usr/libexec/security-misc/panic-on-oops for implementation.
|
||||
##
|
||||
## TODO: Debian 13 Trixie
|
||||
## The limits are applicable when using Linux kernel >= 6.2 (retained here for future-proofing and completeness).
|
||||
##
|
||||
#kernel.panic=-1
|
||||
#kernel.panic_on_oops=1
|
||||
#kernel.panic_on_warn=1
|
||||
#kernel.oops_limit=1
|
||||
#kernel.warn_limit=1
|
||||
|
||||
## Force immediate system reboots on the occurrence of a single kernel panic.
|
||||
## Ensures the system does not hang forever if a panic occurs, reducing susceptibility to cold boot attacks.
|
||||
## Increases resilience and limits impact of denial of service attacks as system automatically restarts.
|
||||
## Immediate rebooting also prevents persistent information disclosure on panic details that were dumped to screen.
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets CONFIG_PANIC_TIMEOUT=-1.
|
||||
##
|
||||
## See /usr/libexec/security-misc/panic-on-oops for implementation.
|
||||
##
|
||||
#kernel.panic=-1
|
||||
|
||||
## Disable the use of legacy TIOCSTI operations which can be used to inject keypresses.
|
||||
## Can lead to privilege escalation by pushing characters into a controlling TTY.
|
||||
## Will break out-dated screen readers that continue to rely on this legacy functionality.
|
||||
## Note this was already disabled by default as of Linux kernel 6.2.
|
||||
##
|
||||
## https://lore.kernel.org/lkml/20221228205726.rfevry7ud6gmttg5@begin/T/
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the sysctl and does not set CONFIG_LEGACY_TIOCSTI.
|
||||
##
|
||||
## TODO: Debian 13 Trixie
|
||||
## This is disabled by default when using Linux kernel >= 6.2.
|
||||
##
|
||||
dev.tty.legacy_tiocsti=0
|
||||
|
||||
## Disable asynchronous I/O for all processes.
|
||||
## Leading cause of numerous kernel exploits.
|
||||
## Use of io_uring has been the leading cause of numerous kernel exploits.
|
||||
## Disabling will reduce the read/write performance of storage devices.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/Io_uring#Security
|
||||
|
|
@ -218,9 +222,6 @@ dev.tty.legacy_tiocsti=0
|
|||
## https://github.com/moby/moby/pull/46762
|
||||
## https://forums.whonix.org/t/io-uring-security-vulnerabilties/16890
|
||||
##
|
||||
## TODO: Debian 13 Trixie
|
||||
## Applicable when using Linux kernel >= 6.6 (retained here for future-proofing and completeness).
|
||||
##
|
||||
kernel.io_uring_disabled=2
|
||||
|
||||
## 2. User Space:
|
||||
|
|
|
|||
|
|
@ -17,3 +17,12 @@ disable proc-hidepid.service
|
|||
## Disable due to issues. See:
|
||||
## https://github.com/Kicksecure/security-misc/issues/159
|
||||
disable harden-module-loading.service
|
||||
|
||||
## TODO: polish, test
|
||||
## Disable due to timing difficulties. See:
|
||||
## https://github.com/systemd/systemd/issues/38261#issuecomment-3134580852
|
||||
disable ensure-shutdown.service
|
||||
disable ensure-shutdown-trigger.service
|
||||
|
||||
## TODO: Disabled due to bug: breaks ISO Live Mode Calamares installer
|
||||
disable emerg-shutdown.service
|
||||
|
|
|
|||
29
usr/lib/systemd/system/block-shutdown.service
Normal file
29
usr/lib/systemd/system/block-shutdown.service
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## This unit, if uncommented and started, will prevent the system from ever
|
||||
## shutting down unless ensure-shutdown.service is enabled and correctly
|
||||
## configured. If you have enabled ensure-shutdown.service and tuned the
|
||||
## ENSURE_SHUTDOWN_TIMEOUT and DefaultTimeoutStopSec variables (in
|
||||
## /etc/security-misc/emerg-shutdown/30_security_misc.conf and
|
||||
## /etc/systemd/system.conf respectively) and want to make sure
|
||||
## ensure-shutdown.service actually works, you can uncomment this unit and
|
||||
## start it with `sudo systemctl start block-shutdown.service`. If the systems
|
||||
## successfully powers down even with this unit started,
|
||||
## ensure-shutdown.service is working.
|
||||
|
||||
# [Unit]
|
||||
# Description=Blocks shutdown indefinitely unless ensure-shutdown.service is enabled
|
||||
#
|
||||
# [Service]
|
||||
# Type=exec
|
||||
# ExecStart=bash -c -- "trap '' SIGTERM; sleep infinity"
|
||||
# KillSignal=SIGTERM
|
||||
# FinalKillSignal=SIGTERM
|
||||
# RestartKillSignal=SIGTERM
|
||||
# WatchdogSignal=SIGTERM
|
||||
# SendSIGHUP=no
|
||||
# TimeoutStopSec=infinity
|
||||
#
|
||||
# [Install]
|
||||
# WantedBy=multi-user.target
|
||||
20
usr/lib/systemd/system/emerg-shutdown.service
Normal file
20
usr/lib/systemd/system/emerg-shutdown.service
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
[Unit]
|
||||
Description=Emergency shutdown when boot media is removed
|
||||
Documentation=https://github.com/Kicksecure/security-misc
|
||||
DefaultDependencies=no
|
||||
Before=sysinit.target
|
||||
Requires=systemd-udevd.service
|
||||
After=systemd-udevd.service
|
||||
Requires=local-fs.target
|
||||
After=local-fs.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/libexec/security-misc/emerg-shutdown
|
||||
NotifyAccess=main
|
||||
|
||||
[Install]
|
||||
WantedBy=sysinit.target
|
||||
18
usr/lib/systemd/system/ensure-shutdown-trigger.service
Normal file
18
usr/lib/systemd/system/ensure-shutdown-trigger.service
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## NOTE: If enabling this unit, also enable ensure-shutdown.service, otherwise
|
||||
## this will do nothing.
|
||||
|
||||
[Unit]
|
||||
Description=Forcibly shut down the system if normal shutdown gets stuck (alternate trigger unit)
|
||||
Documentation=https://github.com/Kicksecure/security-misc
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=true
|
||||
ExecStart=true
|
||||
ExecStop=bash -c -- 'echo "d" > /run/emerg-shutdown-trigger'
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
25
usr/lib/systemd/system/ensure-shutdown.service
Normal file
25
usr/lib/systemd/system/ensure-shutdown.service
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## NOTE: If enabling this unit, also enable ensure-shutdown-trigger.service,
|
||||
## otherwise this will likely be unable to unstick a stuck shutdown.
|
||||
|
||||
[Unit]
|
||||
Description=Forcibly shut down the system if normal shutdown gets stuck
|
||||
Documentation=https://github.com/Kicksecure/security-misc
|
||||
DefaultDependencies=no
|
||||
Before=sysinit.target
|
||||
Requires=systemd-udevd.service
|
||||
After=systemd-udevd.service
|
||||
Wants=emerg-shutdown.service
|
||||
After=emerg-shutdown.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=true
|
||||
ExecStart=/usr/libexec/security-misc/ensure-shutdown
|
||||
ExecStop=bash -c -- 'echo "d" > /run/emerg-shutdown-trigger'
|
||||
KillMode=process
|
||||
|
||||
[Install]
|
||||
WantedBy=sysinit.target
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
## See the file COPYING for copying conditions.
|
||||
|
||||
[Unit]
|
||||
Description=Sets 'sysctl kernel.panic_on_oops=1' late during the boot process.
|
||||
Description=Sets 'sysctl' settings relating to kernel panics on both oopses and warnings late during the boot process.
|
||||
Documentation=https://github.com/Kicksecure/security-misc
|
||||
|
||||
ConditionKernelCommandLine=!panic-on-oops=0
|
||||
|
|
|
|||
9
usr/lib/udev/rules.d/95-emerg-shutdown.rules
Normal file
9
usr/lib/udev/rules.d/95-emerg-shutdown.rules
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
SUBSYSTEM!="input", GOTO="end"
|
||||
|
||||
# new keyboard or mouse attached or removed, restart emerg-shutdown
|
||||
KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEYBOARD}=="1", RUN+="/usr/bin/systemctl restart emerg-shutdown.service"
|
||||
KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEYBOARD}=="1", GOTO="end"
|
||||
KERNEL=="event*", ACTION=="remove", ENV{ID_INPUT_KEYBOARD}=="1", RUN+="/usr/bin/systemctl restart emerg-shutdown.service"
|
||||
KERNEL=="event*", ACTION=="remove", ENV{ID_INPUT_KEYBOARD}=="1", GOTO="end"
|
||||
|
||||
LABEL="end"
|
||||
|
|
@ -1,46 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## TODO: Move this to helper-scripts.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o errtrace
|
||||
set -o pipefail
|
||||
|
||||
command -v start-stop-daemon >/dev/null
|
||||
command -v timeout >/dev/null
|
||||
command -v apt-get >/dev/null
|
||||
|
||||
export LC_ALL=C
|
||||
pidfile="/run/helper-scripts/security-misc-apt-get-update-pid"
|
||||
|
||||
sigterm_trap() {
|
||||
/usr/libexec/helper-scripts/apt-get-update-kill-helper &>/dev/null
|
||||
exit 143
|
||||
}
|
||||
|
||||
## terminate potential previous invocations.
|
||||
/usr/libexec/helper-scripts/apt-get-update-kill-helper &>/dev/null
|
||||
|
||||
trap "sigterm_trap" SIGTERM SIGINT
|
||||
|
||||
[[ -v timeout_after ]] || timeout_after="600"
|
||||
[[ -v kill_after ]] || kill_after="10"
|
||||
|
||||
start-stop-daemon \
|
||||
--make-pidfile \
|
||||
--pidfile "$pidfile" \
|
||||
--exec /usr/bin/timeout \
|
||||
--start \
|
||||
-- \
|
||||
--kill-after="$kill_after" \
|
||||
"$timeout_after" \
|
||||
apt-get update --error-on=any "$@" &
|
||||
|
||||
lastpid="$!"
|
||||
wait "$lastpid"
|
||||
|
||||
exit "$?"
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
set -x
|
||||
set -e
|
||||
set -o pipefail
|
||||
|
||||
if ! printf '%s\n' "" | wc -l >/dev/null ; then
|
||||
printf '%s\n' "\
|
||||
$0: ERROR: command 'wc' test failed! Do not ignore this!
|
||||
|
||||
'wc' can core dump. Example:
|
||||
zsh: illegal hardware instruction (core dumped) wc -l
|
||||
https://github.com/rspamd/rspamd/issues/5137" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
wc -L "/var/lib/apt/lists/"*InRelease
|
||||
wc -L "/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}'
|
||||
|
|
@ -7,4 +7,4 @@ set -e
|
|||
|
||||
title="$0: password required for $(whoami) to perform action as superuser"
|
||||
|
||||
zenity --password --title="$title"
|
||||
yad --password --title="$title"
|
||||
|
|
|
|||
79
usr/libexec/security-misc/emerg-shutdown
Executable file
79
usr/libexec/security-misc/emerg-shutdown
Executable file
|
|
@ -0,0 +1,79 @@
|
|||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o errtrace
|
||||
set -o pipefail
|
||||
|
||||
## Make sure globs sort in a predictable, reproducible fashion
|
||||
export LC_ALL=C
|
||||
|
||||
in_dracut='false'
|
||||
if [ -f '/dracut-state.sh' ]; then
|
||||
in_dracut='true'
|
||||
fi
|
||||
binary_prefix='/run'
|
||||
EMERG_SHUTDOWN_KEYS=''
|
||||
root_devices[0]=''
|
||||
|
||||
## Taken from kloak/Makefile, see it for more information
|
||||
gcc_hardening_options=(
|
||||
"-Wall" "-Wformat" "-Wformat=2" "-Wconversion"
|
||||
"-Wimplicit-fallthrough" "-Werror=format-security" "-Werror=implicit"
|
||||
"-Werror=int-conversion" "-Werror=incompatible-pointer-types"
|
||||
"-Wtrampolines" "-Wbidi-chars=any" "-U_FORTIFY_SOURCE" "-D_FORTIFY_SOURCE=3"
|
||||
"-fstack-clash-protection" "-fstack-protector-strong"
|
||||
"-fno-delete-null-pointer-checks" "-fno-strict-overflow"
|
||||
"-fno-strict-aliasing" "-fsanitize=undefined" "-fcf-protection=full"
|
||||
"-Wl,-z,nodlopen" "-Wl,-z,noexecstack" "-Wl,-z,relro" "-Wl,-z,now"
|
||||
"-Wl,--as-needed" "-Wl,--no-copy-dt-needed-entries" "-pie"
|
||||
)
|
||||
|
||||
## Read emergency shutdown key configuration
|
||||
for config_file in /etc/security-misc/emerg-shutdown/*.conf /usr/local/etc/security-misc/emerg-shutdown/*.conf; do
|
||||
if [ -f "${config_file}" ]; then
|
||||
bash -n "${config_file}"
|
||||
source "${config_file}"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "${in_dracut}" = 'true' ]; then
|
||||
binary_prefix=''
|
||||
modprobe evdev || {
|
||||
printf '%s\n' 'Failed to load evdev driver!'
|
||||
exit 1
|
||||
}
|
||||
## modules may not work immediately after loaded, give them time to
|
||||
## initialize
|
||||
sleep 0.1
|
||||
else
|
||||
## Find the devices that make up the root device
|
||||
readarray -t root_devices < <(/usr/libexec/helper-scripts/get-backing-devices-for-mountpoint '/') || true;
|
||||
|
||||
## Build the actual emerg-shutdown executable
|
||||
if [ ! -f '/run/emerg-shutdown' ]; then
|
||||
gcc \
|
||||
-o \
|
||||
/run/emerg-shutdown \
|
||||
-static \
|
||||
"${gcc_hardening_options[@]}" \
|
||||
/usr/src/security-misc/emerg-shutdown.c \
|
||||
|| {
|
||||
printf "%s\n" 'Could not compile force-shutdown executable!'
|
||||
exit 1
|
||||
}
|
||||
fi
|
||||
|
||||
## memlockd daemonizes itself, so no need to background it.
|
||||
memlockd -c /usr/share/security-misc/security-misc-memlockd.cfg || true
|
||||
fi
|
||||
|
||||
systemd-notify --ready
|
||||
|
||||
## Launch emerg-shutdown
|
||||
OLDIFS="$IFS"
|
||||
IFS=','
|
||||
"${binary_prefix}/emerg-shutdown" "--devices=${root_devices[*]}" "--keys=${EMERG_SHUTDOWN_KEYS}"
|
||||
31
usr/libexec/security-misc/ensure-shutdown
Executable file
31
usr/libexec/security-misc/ensure-shutdown
Executable file
|
|
@ -0,0 +1,31 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
# See the file COPYING for copying conditions.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o errtrace
|
||||
set -o pipefail
|
||||
|
||||
source /usr/libexec/helper-scripts/strings.bsh
|
||||
|
||||
## Make sure globs sort in a predictable, reproducible fashion
|
||||
export LC_ALL=C
|
||||
|
||||
## Read emergency shutdown key configuration
|
||||
for config_file in /etc/security-misc/emerg-shutdown/*.conf /usr/local/etc/security-misc/emerg-shutdown/*.conf; do
|
||||
if [ -f "${config_file}" ]; then
|
||||
bash -n "${config_file}"
|
||||
source "${config_file}"
|
||||
fi
|
||||
done
|
||||
if [ -z "${ENSURE_SHUTDOWN_TIMEOUT}" ] \
|
||||
|| ! is_whole_number "${ENSURE_SHUTDOWN_TIMEOUT}"; then
|
||||
ENSURE_SHUTDOWN_TIMEOUT=30;
|
||||
fi
|
||||
|
||||
/run/emerg-shutdown --monitor-fifo "--timeout=${ENSURE_SHUTDOWN_TIMEOUT}" &
|
||||
sleep 1
|
||||
disown
|
||||
exit 0
|
||||
|
|
@ -12,12 +12,19 @@ if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
|||
source /usr/libexec/helper-scripts/pre.bsh
|
||||
fi
|
||||
|
||||
## Makes the kernel panic on oopses and warnings. This prevents the
|
||||
## kernel from continuing to run a flawed processes. Many kernel
|
||||
## exploits will also cause an oops, these settings will make the
|
||||
## kernel kill the offending processes.
|
||||
#sysctl kernel.panic=-1
|
||||
sysctl kernel.panic_on_oops=1
|
||||
sysctl kernel.panic_on_warn=1
|
||||
#sysctl kernel.oops_limit=1
|
||||
#sysctl kernel.warn_limit=1
|
||||
## Makes the kernel immediately panic on both oopses and warnings.
|
||||
## These settings force a full system crash rather than continuing
|
||||
## to run after an inconsistent state is triggered by a potentially
|
||||
## flawed processes. The reasons for the errors could be kernel
|
||||
## exploit attempts but may also simply be general software bugs.
|
||||
##
|
||||
## https://docs.kernel.org/admin-guide/sysctl/kernel.html#oops-limit
|
||||
sysctl kernel.oops_limit=1
|
||||
## https://docs.kernel.org/admin-guide/sysctl/kernel.html#warn-limit
|
||||
sysctl kernel.warn_limit=1
|
||||
|
||||
## Makes the system immediately reboot on the occurrence of a single
|
||||
## kernel panic. This reduces the risk and impact of both denial of
|
||||
## service and cold boot attacks.
|
||||
## https://docs.kernel.org/admin-guide/sysctl/kernel.html#panic
|
||||
sysctl kernel.panic=-1
|
||||
|
|
|
|||
|
|
@ -15,3 +15,6 @@ security-misc: uses-dpkg-database-directly [usr/bin/remount-secure]
|
|||
|
||||
## Special target to make sure this runs as non-parallelized as possible to avoid race conditions.
|
||||
security-misc: systemd-service-file-refers-to-unusual-wantedby-target sysinit-post.target [usr/lib/systemd/system/remount-secure.service]
|
||||
|
||||
## False-positive. Unit is commented out by default.
|
||||
security-misc: systemd-service-file-missing-install-key [usr/lib/systemd/system/block-shutdown.service]
|
||||
|
|
|
|||
21
usr/share/security-misc/emerg-shutdown-initramfs.service
Normal file
21
usr/share/security-misc/emerg-shutdown-initramfs.service
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## This file should not be installed on the host system, it is intended for
|
||||
## inclusion in a dracut initramfs only.
|
||||
|
||||
[Unit]
|
||||
Description=Emergency shutdown when boot media is removed
|
||||
Documentation=https://github.com/Kicksecure/security-misc
|
||||
DefaultDependencies=no
|
||||
Before=sysinit.target
|
||||
Requires=systemd-udevd.service
|
||||
After=systemd-udevd.service
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/libexec/security-misc/emerg-shutdown
|
||||
NotifyAccess=main
|
||||
|
||||
[Install]
|
||||
WantedBy=sysinit.target
|
||||
2
usr/share/security-misc/security-misc-memlockd.cfg
Normal file
2
usr/share/security-misc/security-misc-memlockd.cfg
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
# Lock systemd and all of its library dependencies into memory
|
||||
+/usr/bin/systemd
|
||||
1055
usr/src/security-misc/emerg-shutdown.c
Normal file
1055
usr/src/security-misc/emerg-shutdown.c
Normal file
File diff suppressed because it is too large
Load diff
Loading…
Add table
Add a link
Reference in a new issue