Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-25 06:09:22 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix, sysctl-initramfs: switch log to /run/initramfs/sysctl-initramfs-error.log

Browse Source 
since ephemeral, in RAM, not written to disk, no conflict with grub-live

https://forums.whonix.org/t/kernel-hardening/7296/435
This commit is contained in:
Patrick Schleizer 2020-04-16 07:54:33 -04:00
parent 701da5f6cc
commit 4898a9e753
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 5 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs
View File

@ -15,19 +15,12 @@ prereqs)
;;
esac
## ${rootmnt} is mounted read-only in the initramfs so it needs to be remounted first.
if mount | grep "${rootmnt}" | grep -q "(ro,"; then
remount="yes"
mount -o remount,rw "${rootmnt}"
fi
## Write to '/run/initramfs' folder.
## https://forums.whonix.org/t/kernel-hardening/7296/435
sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null 2> "${rootmnt}/var/log/sysctl-initramfs-error.log"
sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null 2>> "${rootmnt}/var/log/sysctl-initramfs-error.log"
sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null 2> "/run/initramfs/sysctl-initramfs-error.log"
sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null 2>> "/run/initramfs/sysctl-initramfs-error.log"
if [ "${remount}" = "yes" ]; then
mount -o remount,ro "${rootmnt}"
fi
grep -v "unprivileged_userfaultfd" "${rootmnt}/var/log/sysctl-initramfs-error.log"
grep -v "unprivileged_userfaultfd" "/run/initramfs/sysctl-initramfs-error.log"
true