Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-02-03 02:59:59 -05:00
Code Issues Packages Projects Releases Wiki Activity

Rename file permission hardening script

Browse Source 
Hardener as the script is the agent that is hardening the file
permissions.
This commit is contained in:
Ben Grande 2024-01-02 13:34:29 +01:00
parent f138cf0f78
commit abf72c2ee4
No known key found for this signature in database
GPG Key ID: 00C64E14F51F9E56
24 changed files with 54 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@ -430,23 +430,23 @@ include but are not limited to:
- Protecting the information of sudoers from others. - Protecting the information of sudoers from others.
- Protecting various system relevant files and modules. - Protecting various system relevant files and modules.
##### permission-hardening ##### ##### permission-hardener #####
`permission-hardener` removes SUID / SGID bits from non-essential binaries as `permission-hardener` removes SUID / SGID bits from non-essential binaries as
these are often used in privilege escalation attacks. It runs at package these are often used in privilege escalation attacks. It runs at package
installation and upgrade time. installation and upgrade time.
There is also an optional systemd unit which does the same at boot time that There is also an optional systemd unit which does the same at boot time that
can be enabled by running `systemctl enable permission-hardening.service` as can be enabled by running `systemctl enable permission-hardener.service` as
root. The hardening at boot time is not the default because this slows down root. The hardening at boot time is not the default because this slows down
the boot too much. the boot too much.
See: See:
* `/usr/bin/permission-hardening` * `/usr/bin/permission-hardener`
* `debian/security-misc.postinst` * `debian/security-misc.postinst`
* `/lib/systemd/system/permission-hardening.service` * `/lib/systemd/system/permission-hardener.service`
* `/etc/permission-hardening.d` * `/etc/permission-hardener.d`
* https://forums.whonix.org/t/disable-suid-binaries/7706 * https://forums.whonix.org/t/disable-suid-binaries/7706
* https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener * https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener

6
debian/security-misc.postinst vendored
View File

@ -20,8 +20,8 @@ permission_hardening() {
echo "Running SUID Disabler and Permission Hardener... See also:" echo "Running SUID Disabler and Permission Hardener... See also:"
echo "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener" echo "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener"
echo "" echo ""
echo "$0: INFO: running: permission-hardening" echo "$0: INFO: running: permission-hardener"
if ! permission-hardening ; then if ! permission-hardener ; then
echo "$0: ERROR: Permission hardening failed." >&2 echo "$0: ERROR: Permission hardening failed." >&2
return 0 return 0
fi fi
@ -59,7 +59,7 @@ esac
pam-auth-update --package pam-auth-update --package
/usr/libexec/security-misc/permission-lockdown /usr/libexec/security-misc/permission-lockdown
permission_hardening permission_hardener
## https://phabricator.whonix.org/T377 ## https://phabricator.whonix.org/T377
## Debian has no update-grub trigger yet: ## Debian has no update-grub trigger yet:

4
etc/permission-hardening.d/25_default_passwd.conf → etc/permission-hardener.d/25_default_passwd.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
# Keep the `passwd` utility executable to prevent issues with the # Keep the `passwd` utility executable to prevent issues with the

4
etc/permission-hardening.d/25_default_sudo.conf → etc/permission-hardener.d/25_default_sudo.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## https://forums.whonix.org/t/restrict-root-access/7658/116 ## https://forums.whonix.org/t/restrict-root-access/7658/116

4
etc/permission-hardening.d/25_default_whitelist_bubblewrap.conf → etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/bwrap exactwhitelist /usr/bin/bwrap exactwhitelist

4
etc/permission-hardening.d/25_default_whitelist_chromium.conf → etc/permission-hardener.d/25_default_whitelist_chromium.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
chrome-sandbox matchwhitelist chrome-sandbox matchwhitelist

4
etc/permission-hardening.d/25_default_whitelist_dbus.conf → etc/permission-hardener.d/25_default_whitelist_dbus.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
dbus-daemon-launch-helper matchwhitelist dbus-daemon-launch-helper matchwhitelist

4
etc/permission-hardening.d/25_default_whitelist_firejail.conf → etc/permission-hardener.d/25_default_whitelist_firejail.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## There is a controversy about firejail but those who choose to install it ## There is a controversy about firejail but those who choose to install it

4
etc/permission-hardening.d/25_default_whitelist_fuse.conf → etc/permission-hardener.d/25_default_whitelist_fuse.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## required for AppImages such as electrum Bitcoin wallet ## required for AppImages such as electrum Bitcoin wallet

4
etc/permission-hardening.d/25_default_whitelist_hardened_malloc.conf → etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
libhardened_malloc.so matchwhitelist libhardened_malloc.so matchwhitelist

4
etc/permission-hardening.d/25_default_whitelist_mount.conf → etc/permission-hardener.d/25_default_whitelist_mount.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## https://forums.whonix.org/t/disable-suid-binaries/7706/61 ## https://forums.whonix.org/t/disable-suid-binaries/7706/61

4
etc/permission-hardening.d/25_default_whitelist_pam.conf → etc/permission-hardener.d/25_default_whitelist_pam.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## Without this, Xfce fails to start with a dbus-launch error. ## Without this, Xfce fails to start with a dbus-launch error.

4
etc/permission-hardening.d/25_default_whitelist_policykit.conf → etc/permission-hardener.d/25_default_whitelist_policykit.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/pkexec exactwhitelist /usr/bin/pkexec exactwhitelist

4
etc/permission-hardening.d/25_default_whitelist_qubes.conf → etc/permission-hardener.d/25_default_whitelist_qubes.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## TODO: research ## TODO: research

4
etc/permission-hardening.d/25_default_whitelist_selinux.conf → etc/permission-hardener.d/25_default_whitelist_selinux.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
/utempter/utempter matchwhitelist /utempter/utempter matchwhitelist

4
etc/permission-hardening.d/25_default_whitelist_spice.conf → etc/permission-hardener.d/25_default_whitelist_spice.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
spice-client-glib-usb-acl-helper matchwhitelist spice-client-glib-usb-acl-helper matchwhitelist

4
etc/permission-hardening.d/25_default_whitelist_ssh.conf → etc/permission-hardener.d/25_default_whitelist_ssh.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## TODO: research ## TODO: research

4
etc/permission-hardening.d/25_default_whitelist_sudo.conf → etc/permission-hardener.d/25_default_whitelist_sudo.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
/usr/bin/sudo exactwhitelist /usr/bin/sudo exactwhitelist

4
etc/permission-hardening.d/25_default_whitelist_unix_chkpwd.conf → etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## required for performing password validation from unprivileged user ## required for performing password validation from unprivileged user

4
etc/permission-hardening.d/25_default_whitelist_virtualbox.conf → etc/permission-hardener.d/25_default_whitelist_virtualbox.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## TODO: research ## TODO: research

8
etc/permission-hardening.d/30_default.conf → etc/permission-hardener.d/30_default.conf
View File

@ -1,8 +1,8 @@
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or ## Please use "/etc/permission-hardener.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten. ## configuration. When security-misc is updated, this file may be overwritten.
## File permission hardening. ## File permission hardening.
@ -60,8 +60,8 @@
/home/ 0755 root root /home/ 0755 root root
/root/ 0700 root root /root/ 0700 root root
/boot/ 0700 root root /boot/ 0700 root root
/etc/permission-hardening.d 0600 root root /etc/permission-hardener.d 0600 root root
/usr/local/etc/permission-hardening.d 0600 root root /usr/local/etc/permission-hardener.d 0600 root root
/lib/modules/ 0700 root root /lib/modules/ 0700 root root
/usr/src 0700 root root /usr/src 0700 root root
/etc/cups/cupsd.conf 0400 root root /etc/cups/cupsd.conf 0400 root root

2
lib/systemd/system-preset/50-security-misc.preset
View File

@ -5,7 +5,7 @@
disable hide-hardware-info.service disable hide-hardware-info.service
## Disable for now until development finished / tested. ## Disable for now until development finished / tested.
disable permission-hardening.service disable permission-hardener.service
## Disable for now until development finished / tested. ## Disable for now until development finished / tested.
## https://github.com/Kicksecure/security-misc/pull/152 ## https://github.com/Kicksecure/security-misc/pull/152

2
lib/systemd/system/permission-hardening.service → lib/systemd/system/permission-hardener.service
View File

@ -13,7 +13,7 @@ After=local-fs.target
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=permission-hardening ExecStart=permission-hardener
[Install] [Install]
WantedBy=sysinit.target WantedBy=sysinit.target

9
usr/bin/permission-hardening → usr/bin/permission-hardener
View File

@ -6,13 +6,10 @@
## https://forums.whonix.org/t/disable-suid-binaries/7706 ## https://forums.whonix.org/t/disable-suid-binaries/7706
## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 ## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707
## To undo:
## sudo permission-hardening disable
set -o errexit -o nounset -o pipefail set -o errexit -o nounset -o pipefail
exit_code=0 exit_code=0
store_dir="/var/lib/permission-hardening" store_dir="/var/lib/permission-hardener"
dpkg_admindir_parameter_existing_mode="--admindir ${store_dir}/existing_mode" dpkg_admindir_parameter_existing_mode="--admindir ${store_dir}/existing_mode"
dpkg_admindir_parameter_new_mode="--admindir ${store_dir}/new_mode" dpkg_admindir_parameter_new_mode="--admindir ${store_dir}/new_mode"
@ -507,6 +504,8 @@ parse_config_folder() {
shopt -s nullglob shopt -s nullglob
for config_file in \ for config_file in \
/etc/permission-hardener.d/*.conf \
/usr/local/etc/permission-hardener.d/*.conf \
/etc/permission-hardening.d/*.conf \ /etc/permission-hardening.d/*.conf \
/usr/local/etc/permission-hardening.d/*.conf /usr/local/etc/permission-hardening.d/*.conf
do do
@ -620,7 +619,7 @@ spare() {
To remove all: To remove all:
$0 disable all $0 disable all
This change might not be permanent (because of the permission-hardening.service systemd unit). For full instructions, see: This change might not be permanent (because of the permission-hardener.service systemd unit). For full instructions, see:
https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener
To view list of changed by SUID Disabler and Permission Hardener: To view list of changed by SUID Disabler and Permission Hardener: