Merge remote-tracking branch 'origin/master'

debian/control

@@ -109,3 +109,8 @@ Description: enhances misc security settings
  DMA (Direct Memory Access) attacks.
  .
  IOMMU is enabled with a boot parameter to prevent DMA attacks.
+ .
+ Coredumps are disabled as they may contain important information such as encryption keys or passwords.
+ .
+ A systemd service mounts /proc with hidepid=2 at boot to prevent users from seeing each other's processes.
+ .

etc/security/limits.d/disable-coredumps.conf

@@ -0,0 +1,2 @@
+# Disable coredumps.
+* hard core 0

etc/sysctl.d/coredumps.conf

@@ -0,0 +1,3 @@
+# Disables coredumps. This setting may be overwritten by systemd so this may not be useful.
+# security-misc also disables coredumps in other ways.
+kernel.core_pattern=|/bin/false

etc/sysctl.d/suid_dumpable.conf

@@ -0,0 +1,2 @@
+# Prevent setuid processes from creating coredumps.
+fs.suid_dumpable=0

lib/systemd/system/coredump.conf.d/disable-coredumps.conf

@@ -0,0 +1,2 @@
+[Coredump]
+Storage=none

lib/systemd/system/proc-hidepid.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=Mounts /proc with hidepid=2
+Documentation=https://github.com/Whonix/security-misc
+Requires=local-fs.target
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+PrivateTmp=true
+PrivateMounts=true
+PrivateDevices=true
+PrivateNetwork=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+RestrictNamespaces=true
+SystemCallFilter=mount munmap access read open close stat fstat lstat mmap mprotect brk rt_sigaction rt_sigprocmask execve readlink getrlimit getuid getgid geteuid getegid statfs prctl arch_prctl set_tid_address newfstatat set_robust_list
+
+[Install]
+WantedBy=multi-user.target