Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'github/master'

Browse Source
This commit is contained in:
Patrick Schleizer 2021-01-12 03:18:41 -05:00
commit 94627f0875
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 295 additions and 230 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

525
README.md
View File

@ -1,48 +1,76 @@
# enhances misc security settings # # Enhances miscellaneous security settings
Inspired by Kernel Self Protection Project (KSPP) ## Kernel hardening
* Implements most if not all recommended Linux kernel settings (sysctl) and This section is inspired by the Kernel Self Protection Project (KSPP). It
kernel parameters by KSPP. implements all recommended Linux kernel settings by the KSPP and many
more.
* https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project * https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
kernel hardening: ### sysctl
* deactivates Netfilter's connection tracking helper sysctl settings are configured via the `/etc/sysctl.d/30_security-misc.conf`
Netfilter's connection tracking helper module increases kernel attack configuration file.
surface by enabling superfluous functionality such as IRC parsing in
the kernel. (!) Hence, this package disables this feature by shipping the
`/etc/modprobe.d/30_security-misc.conf` configuration file.
* Kernel symbols in various files in `/proc` are hidden as they can be * A kernel pointer points to a specific location in kernel memory. These
very useful for kernel exploits. can be very useful in exploiting the kernel so they are restricted to `CAP_SYSLOG`.
* Kexec is disabled as it can be used to load a malicious kernel. * The kernel logs are restricted to `CAP_SYSLOG` as they can often leak sensitive
`/etc/modprobe.d/30_security-misc.conf` information such as kernel pointers.
* ASLR effectiveness for mmap is increased. * The `ptrace()` system call is restricted to `CAP_SYS_PTRACE`.
* The TCP/IP stack is hardened by disabling ICMP redirect acceptance, * eBPF is restricted to `CAP_BPF` (`CAP_SYS_ADMIN` on kernel versions prior
ICMP redirect sending and source routing to prevent man-in-the-middle attacks, to 5.8) and JIT hardening techniques such as constant blinding are enabled.
ignoring all ICMP requests, enabling TCP syncookies to prevent SYN flood
attacks, enabling RFC1337 to protect against time-wait assassination
attacks and enabling reverse path filtering to prevent IP spoofing and
mitigate vulnerabilities such as CVE-2019-14899.
* Avoids unintentional writes to attacker-controlled files. * Restricts performance events to `CAP_PERFMON` (`CAP_SYS_ADMIN` on kernel
versions prior to 5.8).
* Prevents symlink/hardlink TOCTOU races. * Restricts loading line disciplines to `CAP_SYS_MODULE` to prevent unprivileged
attackers from loading vulnerable line disciplines with the `TIOCSETD` ioctl which
has been abused in a number of exploits before.
* SACK can be disabled as it is commonly exploited and is rarely used by * Restricts the `userfaultfd()` syscall to `CAP_SYS_PTRACE` as `userfaultfd()` is
uncommenting settings in file `/etc/sysctl.d/30_security-misc.conf`. often abused to exploit use-after-free flaws.
* Slab merging is disabled as sometimes a slab can be used in a vulnerable * Kexec is disabled as it can be used to load a malicious kernel and gain
way which an attacker can exploit. arbitrary code execution in kernel mode.
* Sanity checks and redzoning are enabled. * The bits of entropy used for mmap ASLR are increased, therefore improving
its effectiveness.
* Memory zeroing at allocation and free time is enabled. * Prevents unintentional writes to attacker-controlled files.
* Prevents common symlink and hardlink TOCTOU races.
* Restricts the SysRq key so it can only be used for shutdowns and the
Secure Attention Key.
* The kernel is only allowed to swap if it is absolutely necessary. This
prevents writing potentially sensitive contents of memory to disk.
* TCP timestamps are disabled as it can allow detecting the system time.
### Boot parameters
Boot parameters are configured via the `/etc/modprobe.d/30_security-misc.conf`
configuration file.
* Slab merging is disabled which significantly increases the difficulty of
heap exploitation by preventing overwriting objects from merged caches and
by making it harder to influence slab cache layout.
* Sanity checks are enabled which add various checks to prevent corruption
in certain slab operations.
* Redzoning is enabled which adds extra areas around slabs that detect when
a slab is overwritten past its real size which can help detect overflows.
* Memory zeroing at allocation and free time is enabled to mitigate some
use-after-free vulnerabilities and erase sensitive information in memory.
* Page allocator freelist randomization is enabled.
* The machine check tolerance level is decreased which makes the kernel panic * The machine check tolerance level is decreased which makes the kernel panic
on uncorrectable errors in ECC memory that could be exploited. on uncorrectable errors in ECC memory that could be exploited.
@ -50,293 +78,330 @@ on uncorrectable errors in ECC memory that could be exploited.
* Kernel Page Table Isolation is enabled to mitigate Meltdown and increase * Kernel Page Table Isolation is enabled to mitigate Meltdown and increase
KASLR effectiveness. KASLR effectiveness.
* Enables all mitigations for CPU vulnerabilities and disables SMT. * vsyscalls are disabled as they are obsolete, are at fixed addresses and thus,
are a potential target for ROP.
* A systemd service clears System.map on boot as these contain kernel symbols * The kernel panics on oopses to thwart certain kernel exploits.
that could be useful to an attacker.
`/etc/kernel/postinst.d/30_remove-system-map`
`/lib/systemd/system/remove-system-map.service`
`/usr/lib/security-misc/remove-system.map`
* Coredumps are disabled as they may contain important information such as * All mitigations for known CPU vulnerabilities are enabled and SMT is
encryption keys or passwords. disabled.
`/etc/security/limits.d/30_security-misc.conf`
`/etc/sysctl.d/30_security-misc.conf`
`/lib/systemd/coredump.conf.d/30_security-misc.conf`
* The thunderbolt and firewire kernel modules are blacklisted as they can be * IOMMU is enabled to prevent DMA attacks.
used for DMA (Direct Memory Access) attacks.
* IOMMU is enabled with a boot parameter to prevent DMA attacks. ### Blacklisted kernel modules
* Bluetooth is blacklisted to reduce attack surface. Bluetooth also has Certain kernel modules are blacklisted to reduce attack surface via the
`/etc/modprobe.d/30_security-misc.conf` configuration file.
* Deactivates Netfilter's connection tracking helper — this module
increases kernel attack surface by enabling superfluous functionality
such as IRC parsing in the kernel. Hence, this feature is disabled.
* Uncommon network protocols are blacklisted. This includes:
DCCP - Datagram Congestion Control Protocol
SCTP - Stream Control Transmission Protocol
RDS - Reliable Datagram Sockets
TIPC - Transparent Inter-process Communication
HDLC - High-Level Data Link Control
AX25 - Amateur X.25
NetRom
X25
ROSE
DECnet
Econet
af_802154 - IEEE 802.15.4
IPX - Internetwork Packet Exchange
AppleTalk
PSNAP - Subnetwork Access Protocol
p8023 - Novell raw IEEE 802.3
p8022 - IEEE 802.2
CAN — Controller Area Network
ATM
* Bluetooth is also blacklisted to reduce attack surface. Bluetooth has
a history of security concerns. a history of security concerns.
https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
`/etc/modprobe.d/30_security-misc.conf`
* A systemd service restricts `/proc/cpuinfo`, `/proc/bus`, `/proc/scsi` and * The Thunderbolt and FireWire kernel modules are blacklisted as they are
`/sys` to the root user only. This hides a lot of hardware identifiers from often vulnerable to DMA attacks.
unprivileged users and increases security as `/sys` exposes a lot of
information that shouldn't be accessible to unprivileged users. As this will * The vivid kernel module is only required for testing and has been the cause
break many things, it is disabled by default and can optionally be enabled by of multiple vulnerabilities so it is blacklisted.
running `systemctl enable hide-hardware-info.service` as root.
`/usr/lib/security-misc/hide-hardware-info`
`/lib/systemd/system/hide-hardware-info.service`
`/lib/systemd/system/user@.service.d/sysfs.conf`
`/etc/hide-hardware-info.d/30_default.conf`
* The MSR kernel module is blacklisted to prevent CPU MSRs from being * The MSR kernel module is blacklisted to prevent CPU MSRs from being
abused to write to arbitrary memory. abused to write to arbitrary memory.
* Vsyscalls are disabled as they are obsolete, are at fixed addresses and are ### Other
a target for ROP.
* Page allocator freelist randomization is enabled. * A systemd service clears the System.map file on boot as these contain kernel
pointers. The file is completely overwritten with zeroes to ensure it cannot
be recovered. See:
* The vivid kernel module is blacklisted as it's only required for testing `/etc/kernel/postinst.d/30_remove-system-map`
and has been the cause of multiple vulnerabilities.
`/lib/systemd/system/remove-system-map.service`
`/usr/lib/security-misc/remove-system.map`
* Coredumps are disabled as they may contain important information such as
encryption keys or passwords. See:
`/etc/security/limits.d/30_security-misc.conf`
`/etc/sysctl.d/30_security-misc.conf`
`/lib/systemd/coredump.conf.d/30_security-misc.conf`
* An initramfs hook sets the sysctl values in `/etc/sysctl.conf` and * An initramfs hook sets the sysctl values in `/etc/sysctl.conf` and
`/etc/sysctl.d` before init is executed so sysctl hardening is enabled `/etc/sysctl.d` before init is executed so sysctl hardening is enabled
as early as possible. as early as possible.
* The kernel panics on oopses to prevent it from continuing to run a flawed ## Network hardening
process and to deter brute forcing.
* Restricts the SysRq key so it can only be used for shutdowns and the * TCP syncookies are enabled to prevent SYN flood attacks.
Secure Attention Key.
* Restricts loading line disciplines to `CAP_SYS_MODULE`. * ICMP redirect acceptance, ICMP redirect sending, source routing and
IPv6 router advertisements are disabled to prevent man-in-the-middle attacks.
* Restricts the `userfaultfd()` syscall to root. * The kernel is configured to ignore all ICMP requests to avoid Smurf attacks,
make the device more difficult to enumerate on the network and prevent clock
fingerprinting through ICMP timestamps.
Improve Entropy Collection * RFC1337 is enabled to protect against time-wait assassination attacks by
dropping RST packets for sockets in the time-wait state.
* Load `jitterentropy_rng` kernel module. * Reverse path filtering is enabled to prevent IP spoofing and mitigate
`/usr/lib/modules-load.d/30_security-misc.conf` vulnerabilities such as CVE-2019-14899.
## Entropy collection improvements
* The `jitterentropy_rng` kernel module is loaded as early as possible
during boot to gather more entropy via the
`/usr/lib/modules-load.d/30_security-misc.conf` configuration file.
* Distrusts the CPU for initial entropy at boot as it is not possible to * Distrusts the CPU for initial entropy at boot as it is not possible to
audit, may contain weaknesses or a backdoor. audit, may contain weaknesses or a backdoor. For references, see:
* https://en.wikipedia.org/wiki/RDRAND#Reception `/etc/default/grub.d/40_distrust_cpu.cfg`
* https://twitter.com/pid_eins/status/1149649806056280069
* For more references, see:
* `/etc/default/grub.d/40_distrust_cpu.cfg`
* Gathers more entropy during boot if using the linux-hardened kernel patch. * Gathers more entropy during boot if using the linux-hardened kernel patch.
Uncommon network protocols are blacklisted: ## Restrictive mount options
These are rarely used and may have unknown vulnerabilities.
`/etc/modprobe.d/30_security-misc.conf`
The network protocols that are blacklisted are:
* DCCP - Datagram Congestion Control Protocol `/home`, `/tmp`, `/dev/shm` and `/run` are remounted with the `nosuid` and `nodev`
* SCTP - Stream Control Transmission Protocol mount options to prevent execution of setuid or setgid binaries and creation of
* RDS - Reliable Datagram Sockets devices on those filesystems.
* TIPC - Transparent Inter-process Communication
* HDLC - High-Level Data Link Control
* AX25 - Amateur X.25
* NetRom
* X25
* ROSE
* DECnet
* Econet
* af_802154 - IEEE 802.15.4
* IPX - Internetwork Packet Exchange
* AppleTalk
* PSNAP - Subnetwork Access Protocol
* p8023 - Novell raw IEEE 802.3
* p8022 - IEEE 802.2
user restrictions: Optionally, they can also be mounted with `noexec` to prevent execution of any
binary. To opt-in to applying `noexec`, execute `touch /etc/noexec` as root
and reboot.
* remount `/home`, `/tmp`, `/dev/shm` and `/run` with `nosuid,nodev` To disable this, execute `touch /etc/remount-disable` as root.
(default) and `noexec` (opt-in). To disable this, run
`sudo touch /etc/remount-disable`. To opt-in `noexec`, run
`sudo touch /etc/noexec` and reboot (easiest).
Alternatively file `/usr/local/etc/remount-disable` or file
`/usr/local/etc/noexec` could be used.
`/lib/systemd/system/remount-secure.service`
`/usr/lib/security-misc/remount-secure`
* An optional systemd service mounts `/proc` with `hidepid=2` at boot to Alternatively, file `/usr/local/etc/remount-disable` or `/usr/local/etc/noexec`
prevent users from seeing each other's processes. Not enabled because not could be used.
compatible with pkexec.
* The kernel logs are restricted to root only. ## Root access restrictions
* The BPF JIT compiler is restricted to the root user and is hardened.
* The ptrace system call is restricted to the root user only.
restricts access to the root account:
* `su` is restricted to only users within the group `sudo` which prevents * `su` is restricted to only users within the group `sudo` which prevents
users from using `su` to gain root access or to switch user accounts. users from using `su` to gain root access or to switch user accounts —
`/usr/share/pam-configs/wheel-security-misc` `/usr/share/pam-configs/wheel-security-misc`
(Which results in a change in file `/etc/pam.d/common-auth`.) (which results in a change in file `/etc/pam.d/common-auth`).
* Add user `root` to group `sudo`. This is required to make above work so * Add user `root` to group `sudo`. This is required due to the above restriction so
login as a user in a virtual console is still possible. that logging in from a virtual console is still possible — `debian/security-misc.postinst`
`debian/security-misc.postinst`
* Abort login for users with locked passwords. * Abort login for users with locked passwords —
`/usr/lib/security-misc/pam-abort-on-locked-password` `/usr/lib/security-misc/pam-abort-on-locked-password`.
* Logging into the root account from a virtual, serial, whatnot console is * Logging into the root account from a virtual, serial, whatnot console is
prevented by shipping an existing and empty `/etc/securetty`. prevented by shipping an existing and empty `/etc/securetty` file
(Deletion of `/etc/securetty` has a different effect.) (deletion of `/etc/securetty` has a different effect).
`/etc/securetty.security-misc`
* Console Lockdown. This package does not yet automatically lock the root account password. It
Allow members of group 'console' to use console. is not clear if this would be sane in such a package although, it is recommended
Everyone else except members of group to lock and expire the root account.
'console-unrestricted' are restricted from using console using ancient,
unpopular login methods such as using `/bin/login` over networks, which might
be exploitable. (CVE-2001-0797) Using pam_access.
Not enabled by default in this package since this package does not know which
users shall be added to group 'console' and would break console.
`/usr/share/pam-configs/console-lockdown-security-misc`
`/etc/security/access-security-misc.conf`
Protect Linux user accounts against brute force attacks. In new Whonix builds, root account will be locked by package
Lock user accounts after 50 failed login attempts using `pam_tally2`. dist-base-files.
`/usr/share/pam-configs/tally2-security-misc`
informational output during Linux PAM: See:
* https://www.whonix.org/wiki/Root
* https://www.whonix.org/wiki/Dev/Permissions
* https://forums.whonix.org/t/restrict-root-access/7658
However, a locked root password will break rescue and emergency shell.
Therefore, this package enables passwordless rescue and emergency shell.
This is the same solution that Debian will likely adapt for Debian
installer: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
See:
* `/etc/systemd/system/emergency.service.d/override.conf`
* `/etc/systemd/system/rescue.service.d/override.conf`
Adverse security effects can be prevented by setting up BIOS password
protection, GRUB password protection and/or full disk encryption.
## Console lockdown
This uses pam_access to allow members of group `console` to use console but
restrict everyone else (except members of group `console-unrestricted`) from
using console with ancient, unpopular login methods such as `/bin/login`
over networks as this might be exploitable. (CVE-2001-0797)
This is not enabled by default in this package since this package does not
know which users shall be added to group 'console' and thus, would break console.
See:
* `/usr/share/pam-configs/console-lockdown-security-misc`
* `/etc/security/access-security-misc.conf`
## Brute force attack protection
User accounts are locked after 50 failed login attempts using `pam_tally2`.
Informational output during Linux PAM:
* Show failed and remaining password attempts. * Show failed and remaining password attempts.
* Document unlock procedure if Linux user account got locked. * Document unlock procedure if Linux user account got locked.
* Point out, that there is no password feedback for `su`. * Point out that there is no password feedback for `su`.
* Explain locked (root) account if locked. * Explain locked root account if locked.
See:
* `/usr/share/pam-configs/tally2-security-misc` * `/usr/share/pam-configs/tally2-security-misc`
* `/usr/lib/security-misc/pam_tally2-info` * `/usr/lib/security-misc/pam_tally2-info`
* `/usr/lib/security-misc/pam-abort-on-locked-password` * `/usr/lib/security-misc/pam-abort-on-locked-password`
access rights restrictions: ## Access rights restrictions
* Strong Linux User Account Separation. ### Strong user account separation
Removes read, write and execute access for others for all users who have
home folders under folder `/home` by running for example
"chmod o-rwx /home/user"
during package installation, upgrade or pam `mkhomedir`. This will be done
only once per folder in folder `/home` so users who wish to relax file
permissions are free to
do so. This is to protect previously created files in user home folder which
were previously created with lax file permissions prior installation of this
package.
`debian/security-misc.postinst`
`/usr/lib/security-misc/permission-lockdown`
`/usr/share/pam-configs/mkhomedir-security-misc`
* SUID / GUID removal and permission hardening. Read, write and execute access for "others" are removed during package
A systemd service removed SUID / GUID from non-essential binaries as these are installation, upgrade or PAM `mkhomedir` for all users who have home
often used in privilege escalation attacks. folders in `/home` by running, for example:
It is disabled by default for now during testing and can optionally be enabled
by running `systemctl enable permission-hardening.service` as root.
https://forums.whonix.org/t/disable-suid-binaries/7706
`/usr/lib/security-misc/permission-hardening`
`/lib/systemd/system/permission-hardening.service`
`/etc/permission-hardening.d/30_default.conf`
access rights relaxations: ```
chmod o-rwx /home/user
```
Redirect calls for `pkexec` to `lxqt-sudo` because `pkexec` is incompatible This will be done only once per folder in `/home` so users who wish to
with `hidepid`. relax file permissions are free to do so. This is to protect files in a
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 home folder that were previously created with lax file permissions prior
https://forums.whonix.org/t/cannot-use-pkexec/8129 to the installation of this package.
`/usr/bin/pkexec.security-misc`
This package does (not yet) automatically lock the root account password. See:
It is not clear that would be sane in such a package.
It is recommended to lock and expire the root account.
In new Whonix builds, root account will be locked by package
dist-base-files.
https://www.whonix.org/wiki/Root
https://www.whonix.org/wiki/Dev/Permissions
https://forums.whonix.org/t/restrict-root-access/7658
However, a locked root password will break rescue and emergency shell.
Therefore this package enables passwordless rescue and emergency shell.
This is the same solution that Debian will likely adapt for Debian
installer.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
Adverse security effects can be prevented by setting up BIOS password
protection, grub password protection and/or full disk encryption.
`/etc/systemd/system/emergency.service.d/override.conf`
`/etc/systemd/system/rescue.service.d/override.conf`
Let the kernel only swap if it is absolutely necessary. * `debian/security-misc.postinst`
`/etc/sysctl.d/30_security-misc.conf` * `/usr/lib/security-misc/permission-lockdown`
* `/usr/share/pam-configs/mkhomedir-security-misc`
Disables TCP Time Stamps: ### SUID / SGID removal and permission hardening
TCP time stamps (RFC 1323) allow for tracking clock A systemd service removes SUID / SGID bits from non-essential binaries as
information with millisecond resolution. This may or may not allow an these are often used in privilege escalation attacks. It is disabled by
attacker to learn information about the system clock at such default for now during testing and can optionally be enabled by running
a resolution, depending on various issues such as network lag. `systemctl enable permission-hardening.service` as root.
This information is available to anyone who monitors the network
somewhere between the attacked system and the destination server.
It may allow an attacker to find out how long a given
system has been running, and to distinguish several
systems running behind NAT and using the same IP address. It might
also allow one to look for clocks that match an expected value to find the
public IP used by a user.
Hence, this package disables this feature by shipping the See:
`/etc/sysctl.d/30_security-misc.conf` configuration file.
Note that TCP time stamps normally have some usefulness. They are * `/usr/lib/security-misc/permission-hardening`
needed for: * `/lib/systemd/system/permission-hardening.service`
* `/etc/permission-hardening.d`
* https://forums.whonix.org/t/disable-suid-binaries/7706
* the TCP protection against wrapped sequence numbers; however, to ### Access rights relaxations
trigger a wrap, one needs to send roughly 2^32 packets in one
minute: as said in RFC 1700, "The current recommended default
time to live (TTL) for the Internet Protocol (IP) [45,105] is 64".
So, this probably won't be a practical problem in the context
of Anonymity Distributions.
* "Round-Trip Time Measurement", which is only useful when the user
manages to saturate their connection. When using Anonymity Distributions,
probably the limiting factor for transmission speed is rarely the capacity
of the user connection.
Application specific hardening: Calls to `pkexec` are redirected to `lxqt-sudo` because `pkexec` is
incompatible with `hidepid=2`.
* Enables APT seccomp-BPF sandboxing. `/etc/apt/apt.conf.d/40sandbox` See:
* `/usr/bin/pkexec.security-misc`
* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040
* https://forums.whonix.org/t/cannot-use-pkexec/8129
## Application-specific hardening
* Enables APT seccomp-BPF sandboxing — `/etc/apt/apt.conf.d/40sandbox`.
* Deactivates previews in Dolphin. * Deactivates previews in Dolphin.
* Deactivates previews in Nautilus. * Deactivates previews in Nautilus —
`/usr/share/glib-2.0/schemas/30_security-misc.gschema.override` `/usr/share/glib-2.0/schemas/30_security-misc.gschema.override`.
* Deactivates thumbnails in Thunar. * Deactivates thumbnails in Thunar.
* Enables punycode (`network.IDN_show_punycode`) by default in Thunderbird * Displays domain names in punycode (`network.IDN_show_punycode`) in
to make phishing attacks more difficult. Fixing URL not showing real Domain Thunderbird to prevent IDN homograph attacks (a form of phishing).
Name (Homograph attack).
* Security and privacy enhancements for gnupg's config file * Security and privacy enhancements for gnupg's config file
`/etc/skel/.gnupg/gpg.conf`. See also: `/etc/skel/.gnupg/gpg.conf`. See also:
https://raw.github.com/ioerror/torbirdy/master/gpg.conf https://raw.github.com/ioerror/torbirdy/master/gpg.conf
https://github.com/ioerror/torbirdy/pull/11 https://github.com/ioerror/torbirdy/pull/11
Want more? Look into these: ## Opt-in hardening
Some hardening is opt-in as it causes too much breakage to be enabled by
default.
* TCP SACK can be disabled as it is commonly exploited and is rarely used by
uncommenting settings in the `/etc/sysctl.d/30_security-misc.conf`
configuration file.
* An optional systemd service mounts `/proc` with `hidepid=2` at boot to
prevent users from seeing another user's processes. This is disabled by
default because it is incompatible with `pkexec`. It can be enabled by
executing `systemctl enable proc-hidepid.service` as root.
* A systemd service restricts `/proc/cpuinfo`, `/proc/bus`, `/proc/scsi` and
`/sys` to the root user. This hides a lot of hardware identifiers from
unprivileged users and increases security as `/sys` exposes a lot of
information that shouldn't be accessible to unprivileged users. As this will
break many things, it is disabled by default and can optionally be enabled by
executing `systemctl enable hide-hardware-info.service` as root.
## Related
* Linux Kernel Runtime Guard (LKRG) * Linux Kernel Runtime Guard (LKRG)
* tirdad - TCP ISN CPU Information Leak Protection. * tirdad - TCP ISN CPU Information Leak Protection.
* Whonix ™ - Anonymous Operating System * Whonix ™ - Anonymous Operating System
* Kicksecure ™ - A Security-hardened, Non-anonymous Linux Distribution * Kicksecure ™ - A Security-hardened, Non-anonymous Linux Distribution
* SecBrowser ™ - A Security-hardened, Non-anonymous Browser
* And more. * And more.
* https://www.whonix.org/wiki/Linux_Kernel_Runtime_Guard_LKRG * https://www.whonix.org/wiki/Linux_Kernel_Runtime_Guard_LKRG
* https://github.com/Whonix/tirdad * https://github.com/Whonix/tirdad
* https://www.whonix.org * https://www.whonix.org
* https://www.whonix.org/wiki/Kicksecure * https://www.whonix.org/wiki/Kicksecure
* https://www.whonix.org/wiki/SecBrowser
* https://github.com/Whonix * https://github.com/Whonix
Discussion: ## Discussion
Happening primarily in Whonix forums. Happening primarily in Whonix forums.
https://forums.whonix.org/t/kernel-hardening/7296 https://forums.whonix.org/t/kernel-hardening/7296
## How to install `security-misc` ##
## How to install `security-misc`
See https://www.whonix.org/wiki/Security-misc#install See https://www.whonix.org/wiki/Security-misc#install
## How to Build deb Package from Source Code ## ## How to Build deb Package from Source Code
Can be build using standard Debian package build tools such as: Can be build using standard Debian package build tools such as:
@ -349,11 +414,11 @@ See instructions. (Replace `generic-package` with the actual name of this packag
* **A)** [easy](https://www.whonix.org/wiki/Dev/Build_Documentation/generic-package/easy), _OR_ * **A)** [easy](https://www.whonix.org/wiki/Dev/Build_Documentation/generic-package/easy), _OR_
* **B)** [including verifying software signatures](https://www.whonix.org/wiki/Dev/Build_Documentation/generic-package) * **B)** [including verifying software signatures](https://www.whonix.org/wiki/Dev/Build_Documentation/generic-package)
## Contact ## ## Contact
* [Free Forum Support](https://forums.whonix.org) * [Free Forum Support](https://forums.whonix.org)
* [Professional Support](https://www.whonix.org/wiki/Professional_Support) * [Professional Support](https://www.whonix.org/wiki/Professional_Support)
## Donate ## ## Donate
`security-misc` requires [donations](https://www.whonix.org/wiki/Donate) to stay alive! `security-misc` requires [donations](https://www.whonix.org/wiki/Donate) to stay alive!