Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity
1,297 Commits 2 Branches 291 Tags 8.2 MiB
060d7d890a
Commit Graph

1297 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Patrick Schleizer
ac8757a031
Merge pull request #59 from madaidan/ldisc 
Restrict loading line disciplines to CAP_SYS_MODULE
 2020-02-15 10:09:46 +00:00
madaidan
31009f0bfa
Shred System.map files 2020-02-14 23:46:19 +00:00
madaidan
9b767139ef
Avoid holes in IOMMU 2020-02-14 18:52:01 +00:00
madaidan
0f49736957
Update control 2020-02-14 18:18:18 +00:00
madaidan
d251c43344
Restrict the SysRq key 2020-02-14 18:17:20 +00:00
madaidan
ace6211176
Update control 2020-02-14 17:51:17 +00:00
madaidan
0ea7dd161b
Restrict loading line disciplines to CAP_SYS_MODULE 2020-02-14 17:50:19 +00:00
Patrick Schleizer
ad6b766886
Merge pull request #57 from madaidan/sysctl 
Prevent symlink/hardlink TOCTOU races
 2020-02-13 18:40:58 +00:00
Patrick Schleizer
14140ad41b
bumped changelog version 2020-02-13 13:39:45 -05:00
Patrick Schleizer
d1fa191bc0
readme 2020-02-13 13:38:21 -05:00
Patrick Schleizer
76a51a3b45
Merge remote-tracking branch 'origin/master' 2020-02-13 13:37:34 -05:00
Patrick Schleizer
5ebab397b2
Merge pull request #58 from madaidan/mitigations 
Improve CPU mitigations documentation
 2020-02-13 18:36:41 +00:00
madaidan
2796c2dd00
Update control 2020-02-12 18:43:19 +00:00
madaidan
700c7ed908
Create 40_cpu_mitigations.cfg 2020-02-12 18:42:13 +00:00
madaidan
ba0043b8a7
Update 40_kernel_hardening.cfg 2020-02-12 18:36:05 +00:00
madaidan
14f8458374
Update control 2020-02-12 18:05:32 +00:00
madaidan
5cb21d0d4d
Prevent symlink/hardlink TOCTOU races 2020-02-12 18:03:23 +00:00
Patrick Schleizer
163e20b886
bumped changelog version 2020-02-05 06:31:48 -05:00
Patrick Schleizer
3024006f63
Merge remote-tracking branch 'origin/master' 2020-02-04 00:24:50 -05:00
Patrick Schleizer
024576e330
Merge pull request #56 from HulaHoop0/patch-1 
kvm.nx_huge_pages=force
 2020-02-04 05:24:05 +00:00
HulaHoop0
e4c6e897cf
kvm.nx_huge_pages=force 2020-02-03 16:06:46 +00:00
Patrick Schleizer
8c5cd865f4
bumped changelog version 2020-02-03 09:23:13 -05:00
Patrick Schleizer
1f6ed2cc70
add support for passing parameters to usr/lib/security-misc/apt-get-update 2020-02-03 08:55:20 -05:00
Patrick Schleizer
2291b7f787
bumped changelog version 2020-02-03 08:43:31 -05:00
Patrick Schleizer
8627c9f76d
/usr/lib/security-misc/apt-get-update increase default timeout_after="600" 2020-01-31 12:18:02 -05:00
Patrick Schleizer
829e28aa90
/usr/lib/security-misc/apt-get-update environment variable timeout_after kill_after support 2020-01-31 12:17:07 -05:00
Patrick Schleizer
0bd0a4a647
bumped changelog version 2020-01-30 06:14:34 -05:00
Patrick Schleizer
85d2aa1365
hide stdout (but not stderr) by sysctl during initramfs 2020-01-30 06:13:42 -05:00
Patrick Schleizer
d69c1839cd
bumped changelog version 2020-01-30 06:02:26 -05:00
Patrick Schleizer
b9d65338bc
unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...) 
this might reduce performance

* `spectre_v2=on`
* `spec_store_bypass_disable=on`
* `tsx=off`
* `tsx_async_abort=full,nosmt`

Thanks to @madaidan for the suggestion!

https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647
 2020-01-30 05:55:13 -05:00
Patrick Schleizer
2711d0f7f0
bumped changelog version 2020-01-30 01:22:32 -05:00
Patrick Schleizer
4df0d6c01c
readme 2020-01-30 01:22:06 -05:00
Patrick Schleizer
c1a0da60be
set kernel boot parameter l1tf=full,force and nosmt=force 
https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
 2020-01-30 00:46:48 -05:00
Patrick Schleizer
efc40da4fb
bumped changelog version 2020-01-24 12:02:27 -05:00
Patrick Schleizer
07dcb32fc2
readme 2020-01-24 11:55:38 -05:00
Patrick Schleizer
f4c54881ac
description 2020-01-24 04:49:19 -05:00
Patrick Schleizer
25317f23e3
bumped changelog version 2020-01-24 04:41:16 -05:00
Patrick Schleizer
be79f0688a
readme 2020-01-24 04:40:20 -05:00
Patrick Schleizer
c0d3726b00
comment 2020-01-24 04:40:03 -05:00
Patrick Schleizer
a37da1c968
add digits to drop-in file names 2020-01-24 04:39:06 -05:00
Patrick Schleizer
2ab940c603
bumped changelog version 2020-01-24 04:34:18 -05:00
Patrick Schleizer
bac6cd601b
readme 2020-01-24 04:33:54 -05:00
Patrick Schleizer
3a4d283169
description 2020-01-24 04:33:30 -05:00
Patrick Schleizer
e0aa67677d
merge the many modprobe.d config files into 1 
and use a name starting with double digits

to make it easier to disable settings using a lexically higher config file
 2020-01-24 04:30:36 -05:00
Patrick Schleizer
6a4c493213
merge the many sysctl config files into 1 
and use a name starting with double digits

to make it easier to disable settings using a lexically higher config file
 2020-01-24 04:26:36 -05:00
Patrick Schleizer
f653b94e77
bumped changelog version 2020-01-24 03:49:02 -05:00
Patrick Schleizer
ca057713e2
readme 2020-01-24 03:39:04 -05:00
Patrick Schleizer
8616728ce0
remove duplicate 2020-01-24 03:35:15 -05:00
Patrick Schleizer
d4a37b6df2
remove-system.map: source /usr/lib/helper-scripts/pre.bsh 2020-01-24 03:18:17 -05:00
Patrick Schleizer
3b283ec00f
bumped changelog version 2020-01-22 07:10:47 -05:00