Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-05-23 05:21:10 -04:00
Code Issues Projects Releases Packages Wiki Activity

Add option to disabe /sys hardening

Browse source
This commit is contained in:
Daniel Winzen 2024-02-22 16:51:23 +01:00
parent 3bc1765dbb
commit ef44ecea44
No known key found for this signature in database
GPG key ID: 222FCC3F35C41077
2 changed files with 43 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

3
etc/hide-hardware-info.d/30_default.conf
View file

@ -7,6 +7,9 @@
## Disable the /proc/cpuinfo whitelist. ## Disable the /proc/cpuinfo whitelist.
#cpuinfo_whitelist=0 #cpuinfo_whitelist=0
## Disable /sys hardening.
#sysfs=0
## Disable selinux mode. ## Disable selinux mode.
## https://www.whonix.org/wiki/Security-misc#selinux ## https://www.whonix.org/wiki/Security-misc#selinux
#selinux=0 #selinux=0

7
usr/libexec/security-misc/hide-hardware-info
View file

@ -8,6 +8,8 @@ set -e
sysfs_whitelist=1 sysfs_whitelist=1
cpuinfo_whitelist=1 cpuinfo_whitelist=1
sysfs=1
## https://www.whonix.org/wiki/Security-misc#selinux ## https://www.whonix.org/wiki/Security-misc#selinux
selinux=0 selinux=0
@ -53,6 +55,7 @@ for i in /proc/cpuinfo /proc/bus /proc/scsi /sys
do do
if [ -e "${i}" ]; then if [ -e "${i}" ]; then
if [ "${i}" = "/sys" ]; then if [ "${i}" = "/sys" ]; then
if [ "${sysfs}" = "1" ]; then
## Whitelist for /sys. ## Whitelist for /sys.
if [ "${sysfs_whitelist}" = "1" ]; then if [ "${sysfs_whitelist}" = "1" ]; then
create_whitelist sysfs create_whitelist sysfs
@ -60,6 +63,7 @@ do
chmod og-rwx /sys chmod og-rwx /sys
echo "INFO: The sysfs whitelist is not enabled. Some things may not work properly." echo "INFO: The sysfs whitelist is not enabled. Some things may not work properly."
fi fi
fi
elif [ "${i}" = "/proc/cpuinfo" ]; then elif [ "${i}" = "/proc/cpuinfo" ]; then
## Whitelist for /proc/cpuinfo. ## Whitelist for /proc/cpuinfo.
if [ "${cpuinfo_whitelist}" = "1" ]; then if [ "${cpuinfo_whitelist}" = "1" ]; then
@ -80,6 +84,8 @@ do
fi fi
done done
if [ "${sysfs}" = "1" ]; then
## restrict permissions on everything but ## restrict permissions on everything but
## what is needed ## what is needed
for i in /sys/* /sys/fs/* for i in /sys/* /sys/fs/*
@ -111,3 +117,4 @@ if [ -d /sys/fs/selinux ]; then
echo "INFO: SELinux detected, but SELinux mode is not enabled. Some userspace utilities may not work properly." echo "INFO: SELinux detected, but SELinux mode is not enabled. Some userspace utilities may not work properly."
fi fi
fi fi
fi