diff --git a/README.md b/README.md index 2b4904a..d47cf1d 100644 --- a/README.md +++ b/README.md @@ -413,6 +413,11 @@ Miscellaneous modules: `/lib/systemd/coredump.conf.d/30_security-misc.conf` +- PStore is disabled as crash logs can contain sensitive system data such as + kernel version, hostname, and users. See: + + `/usr/lib/systemd/pstore.conf.d/30_security-misc.conf` + - An initramfs hook sets the sysctl values in `/etc/sysctl.conf` and `/etc/sysctl.d` before init is executed so sysctl hardening is enabled as early as possible. This is implemented for `initramfs-tools` only because diff --git a/usr/lib/systemd/pstore.conf.d/30_security-misc.conf b/usr/lib/systemd/pstore.conf.d/30_security-misc.conf new file mode 100644 index 0000000..9e513c6 --- /dev/null +++ b/usr/lib/systemd/pstore.conf.d/30_security-misc.conf @@ -0,0 +1,5 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[PStore] +Storage=none