Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-08-02 18:16:08 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge remote-tracking branch 'github-kicksecure/master'

Browse source
This commit is contained in:
Patrick Schleizer 2022-06-08 08:20:24 -04:00
commit fcaec49675
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
3 changed files with 37 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
etc/permission-hardening.d/25_default_passwd.conf Normal file
View file

@ -0,0 +1,14 @@
## Copyright (C) 2012 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
# Keep the `passwd` utility executable to prevent issues with the
# /usr/libexec/security-misc/pam-abort-on-locked-password script blocking
# user logins with `su` and KScreenLocker
#
# See also: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#passwd
/usr/bin/passwd 0755 root root
/bin/passwd 0755 root root

11
etc/permission-hardening.d/25_default_whitelist_unix_chkpwd.conf Normal file
View file

@ -0,0 +1,11 @@
## Copyright (C) 2012 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Please use "/etc/permission-hardening.d/20_user.conf" or
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
## configuration. When security-misc is updated, this file may be overwritten.
## required for performing password validation from unprivileged user
## processes such as KScreenLocker’s unlock prompt
/usr/sbin/unix_chkpwd exactwhitelist
/sbin/unix_chkpwd exactwhitelist