Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-03-12 21:56:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

Don't worry about files under /bin anymore, Bookworm uses a merged /usr directory

Browse Source
This commit is contained in:
Aaron Rainbolt 2025-01-07 14:10:46 -06:00
parent c6be621968
commit 5941195e96
No known key found for this signature in database
GPG Key ID: A709160D73C79109
6 changed files with 0 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
usr/lib/permission-hardener.d/25_default_passwd.conf
View File

@ -11,4 +11,3 @@
#
# See also: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#passwd
/usr/bin/passwd 0755 root root
/bin/passwd 0755 root root

1
usr/lib/permission-hardener.d/25_default_sudo.conf
View File

@ -17,4 +17,3 @@
## compromised network-facing daemon (such as web servers, time synchronization daemons,
## etc.) running as its own user from exploiting sudo to escalate privileges.
#/usr/bin/sudo 4750 root sudo
#/bin/sudo 4750 root sudo

1
usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf
View File

@ -6,4 +6,3 @@
## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/bwrap exactwhitelist
/bin/bwrap exactwhitelist

4
usr/lib/permission-hardener.d/25_default_whitelist_mount.conf
View File

@ -8,14 +8,10 @@
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
## Protect from 'chmod -x' (and SUID removal).
## SUID will be removed below in separate step.
/bin/mount exactwhitelist
/usr/bin/mount exactwhitelist
/bin/umount exactwhitelist
/usr/bin/umount exactwhitelist
## Remove SUID from 'mount' but keep executable.
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
/bin/mount 755 root root
/usr/bin/mount 755 root root
/bin/umount 755 root root
/usr/bin/umount 755 root root

2
usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf
View File

@ -6,9 +6,7 @@
## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/pkexec exactwhitelist
/bin/pkexec exactwhitelist
/usr/bin/pkexec.security-misc-orig exactwhitelist
/bin/pkexec.security-misc-orig exactwhitelist
## TODO: research
## match both:

1
usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf
View File

@ -6,4 +6,3 @@
## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/sudo exactwhitelist
/bin/sudo exactwhitelist