Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-09-28 19:09:28 -04:00
Code Issues Projects Releases Packages Wiki Activity

rename keyword whitelist to exactwhitelist

Browse source 
add new keyword disablewhitelist

refactoring
This commit is contained in:
Patrick Schleizer 2019-12-23 02:29:47 -05:00
parent 175d1c2845
commit 47ddcad0c0
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
2 changed files with 46 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

18
etc/permission-hardening.d/30_default.conf
View file

@ -13,23 +13,27 @@
## To remove all SUID/SGID binaries in a directory, you can use the "nosuid"
## argument.
######################################################################
# SUID disablewhitelist
######################################################################
######################################################################
# SUID exact match whitelist
######################################################################
## TODO: white spaces inside file name untested
/usr/bin/sudo whitelist
/bin/sudo whitelist
/usr/bin/bwrap whitelist
/bin/bwrap whitelist
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper whitelist
/usr/lib/chromium/chrome-sandbox whitelist
/usr/bin/sudo exactwhitelist
/bin/sudo exactwhitelist
/usr/bin/bwrap exactwhitelist
/bin/bwrap exactwhitelist
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper exactwhitelist
/usr/lib/chromium/chrome-sandbox exactwhitelist
## There is a controversy about firejail but those who choose to install it
## should be able to use it.
## https://www.whonix.org/wiki/Dev/Firejail#Security
/usr/bin/firejail whitelist
/usr/bin/firejail exactwhitelist
######################################################################
# SUID exact match whitelist