Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-07-25 21:55:20 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge remote-tracking branch 'ArrayBolt3/arraybolt3/usrmerge'

Browse source
This commit is contained in:
Patrick Schleizer 2025-01-09 09:30:58 -05:00
commit 3a31cc99b3
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
6 changed files with 0 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

1
usr/lib/permission-hardener.d/25_default_sudo.conf
View file

@ -17,4 +17,3 @@
## compromised network-facing daemon (such as web servers, time synchronization daemons, ## compromised network-facing daemon (such as web servers, time synchronization daemons,
## etc.) running as its own user from exploiting sudo to escalate privileges. ## etc.) running as its own user from exploiting sudo to escalate privileges.
#/usr/bin/sudo 4750 root sudo #/usr/bin/sudo 4750 root sudo
#/bin/sudo 4750 root sudo

1
usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf
View file

@ -6,4 +6,3 @@
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/bwrap exactwhitelist /usr/bin/bwrap exactwhitelist
/bin/bwrap exactwhitelist

4
usr/lib/permission-hardener.d/25_default_whitelist_mount.conf
View file

@ -8,14 +8,10 @@
## https://forums.whonix.org/t/disable-suid-binaries/7706/61 ## https://forums.whonix.org/t/disable-suid-binaries/7706/61
## Protect from 'chmod -x' (and SUID removal). ## Protect from 'chmod -x' (and SUID removal).
## SUID will be removed below in separate step. ## SUID will be removed below in separate step.
/bin/mount exactwhitelist
/usr/bin/mount exactwhitelist /usr/bin/mount exactwhitelist
/bin/umount exactwhitelist
/usr/bin/umount exactwhitelist /usr/bin/umount exactwhitelist
## Remove SUID from 'mount' but keep executable. ## Remove SUID from 'mount' but keep executable.
## https://forums.whonix.org/t/disable-suid-binaries/7706/61 ## https://forums.whonix.org/t/disable-suid-binaries/7706/61
/bin/mount 755 root root
/usr/bin/mount 755 root root /usr/bin/mount 755 root root
/bin/umount 755 root root
/usr/bin/umount 755 root root /usr/bin/umount 755 root root

1
usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf
View file

@ -14,4 +14,3 @@
/usr/bin/passwd exactwhitelist /usr/bin/passwd exactwhitelist
/bin/passwd exactwhitelist /bin/passwd exactwhitelist
/usr/bin/passwd 0755 root root /usr/bin/passwd 0755 root root
/bin/passwd 0755 root root

2
usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf
View file

@ -6,9 +6,7 @@
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/pkexec exactwhitelist /usr/bin/pkexec exactwhitelist
/bin/pkexec exactwhitelist
/usr/bin/pkexec.security-misc-orig exactwhitelist /usr/bin/pkexec.security-misc-orig exactwhitelist
/bin/pkexec.security-misc-orig exactwhitelist
## TODO: research ## TODO: research
## match both: ## match both:

1
usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf
View file

@ -6,4 +6,3 @@
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/sudo exactwhitelist /usr/bin/sudo exactwhitelist
/bin/sudo exactwhitelist