Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-12 22:59:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

remove unicode

Browse Source
This commit is contained in:
Patrick Schleizer 2022-06-08 09:27:02 -04:00
parent 55d16e1602
commit d7dd188651
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
README.md
View File

@ -93,7 +93,7 @@ disabled.
Certain kernel modules are blacklisted to reduce attack surface via the Certain kernel modules are blacklisted to reduce attack surface via the
`/etc/modprobe.d/30_security-misc.conf` configuration file. `/etc/modprobe.d/30_security-misc.conf` configuration file.
* Deactivates Netfilter's connection tracking helper — this module * Deactivates Netfilter's connection tracking helper - this module
increases kernel attack surface by enabling superfluous functionality increases kernel attack surface by enabling superfluous functionality
such as IRC parsing in the kernel. Hence, this feature is disabled. such as IRC parsing in the kernel. Hence, this feature is disabled.
@ -133,7 +133,7 @@ such as IRC parsing in the kernel. Hence, this feature is disabled.
p8022 - IEEE 802.2 p8022 - IEEE 802.2
CAN — Controller Area Network CAN - Controller Area Network
ATM ATM
@ -225,14 +225,14 @@ could be used.
## Root access restrictions ## Root access restrictions
* `su` is restricted to only users within the group `sudo` which prevents * `su` is restricted to only users within the group `sudo` which prevents
users from using `su` to gain root access or to switch user accounts — users from using `su` to gain root access or to switch user accounts -
`/usr/share/pam-configs/wheel-security-misc` `/usr/share/pam-configs/wheel-security-misc`
(which results in a change in file `/etc/pam.d/common-auth`). (which results in a change in file `/etc/pam.d/common-auth`).
* Add user `root` to group `sudo`. This is required due to the above restriction so * Add user `root` to group `sudo`. This is required due to the above restriction so
that logging in from a virtual console is still possible — `debian/security-misc.postinst` that logging in from a virtual console is still possible - `debian/security-misc.postinst`
* Abort login for users with locked passwords — * Abort login for users with locked passwords -
`/usr/libexec/security-misc/pam-abort-on-locked-password`. `/usr/libexec/security-misc/pam-abort-on-locked-password`.
* Logging into the root account from a virtual, serial, whatnot console is * Logging into the root account from a virtual, serial, whatnot console is
@ -353,10 +353,10 @@ See:
## Application-specific hardening ## Application-specific hardening
* Enables "`apt-get --error-on=any`" which makes apt exit non-zero for * Enables "`apt-get --error-on=any`" which makes apt exit non-zero for
transient failures. — `/etc/apt/apt.conf.d/40error-on-any`. transient failures. - `/etc/apt/apt.conf.d/40error-on-any`.
* Enables APT seccomp-BPF sandboxing — `/etc/apt/apt.conf.d/40sandbox`. * Enables APT seccomp-BPF sandboxing - `/etc/apt/apt.conf.d/40sandbox`.
* Deactivates previews in Dolphin. * Deactivates previews in Dolphin.
* Deactivates previews in Nautilus — * Deactivates previews in Nautilus -
`/usr/share/glib-2.0/schemas/30_security-misc.gschema.override`. `/usr/share/glib-2.0/schemas/30_security-misc.gschema.override`.
* Deactivates thumbnails in Thunar. * Deactivates thumbnails in Thunar.
* Displays domain names in punycode (`network.IDN_show_punycode`) in * Displays domain names in punycode (`network.IDN_show_punycode`) in

8
usr/libexec/security-misc/permission-hardening
View File

@ -437,7 +437,7 @@ set_file_perms() {
if [ "$capability_from_config" = "none" ]; then if [ "$capability_from_config" = "none" ]; then
## https://forums.whonix.org/t/disable-suid-binaries/7706/45 ## https://forums.whonix.org/t/disable-suid-binaries/7706/45
# sudo setcap -r /bin/ping 2>/dev/null # sudo setcap -r /bin/ping 2>/dev/null
# Failed to set capabilities on file `/bin/ping' (No data available) # Failed to set capabilities on file '/bin/ping' (No data available)
# The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file # The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file
## Therefore use echo_wrapper_ignore. ## Therefore use echo_wrapper_ignore.
echo_wrapper_ignore setcap -r "$fso" echo_wrapper_ignore setcap -r "$fso"
@ -465,9 +465,9 @@ parse_config_folder() {
# Query contents of password and group databases only once and buffer them # Query contents of password and group databases only once and buffer them
# #
# If we don't buffer we sometimes get incorrect results when checking for entries using # If we don't buffer we sometimes get incorrect results when checking for entries using
# `if getent passwd | grep -q '^root:'; …` since `grep` exits after the first match in # 'if getent passwd | grep -q '^root:'; ...' since 'grep' exits after the first match in
# this case causing `getent` to receive SIGPIPE, which then fails the pipeline since # this case causing 'getent' to receive SIGPIPE, which then fails the pipeline since
# `set -o pipefail` is set for this script. # 'set -o pipefail' is set for this script.
passwd_file_contents="$(getent passwd)" passwd_file_contents="$(getent passwd)"
group_file_contents="$(getent group)" group_file_contents="$(getent group)"