Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-02-13 08:41:24 -05:00
Code Issues Packages Projects Releases Wiki Activity

comment

Browse Source
This commit is contained in:
Patrick Schleizer 2025-01-14 04:04:09 -05:00
parent 9f1759ba0e
commit d89ffcde30
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf
View File

@ -9,7 +9,19 @@
/usr/bin/pkexec.security-misc-orig exactwhitelist
## TODO: research
## match both:
#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
#/lib/policykit-1/polkit-agent-helper-1
## TODO: Should be handled in user-sysmaint-split?
##
## Required for PolicyKit (Polkit) to function.
##
## https://polkit-devel.freedesktop.narkive.com/zXO4yEg7/documentation-on-polkit-agent-helper-1-and-suid#
## https://gitlab.freedesktop.org/polkit/polkit/-/issues/168
## https://cgit.freedesktop.org/polkit/tree/src/polkitagent/polkitagenthelper-pam.c#n93
##
## Changing permissions here may break more than just normal privilege escalation.
## May be safe to disable for users other than sysmaint similar to what was done with pkexec and sudo,
## however even that might not be safe.
##
## matches both:
## - /usr/lib/policykit-1/polkit-agent-helper-1
## - /lib/policykit-1/polkit-agent-helper-1
polkit-agent-helper-1 matchwhitelist