Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity
1,110 Commits 2 Branches 291 Tags 8.2 MiB
354af7085b
Commit Graph

1110 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Patrick Schleizer
9f072ce4f9
comment 2019-12-23 03:46:02 -05:00
Patrick Schleizer
26fe9394ff
disable lockdown for now due to module loading 2019-12-23 03:41:54 -05:00
Patrick Schleizer
9ec5b0ee82
description: lockdown not enabled yet 2019-12-23 03:38:49 -05:00
Patrick Schleizer
b05669accf
Merge branch 'madaidan-kernel-hardening' 2019-12-23 03:38:04 -05:00
Patrick Schleizer
1ff51ee061
merge 2019-12-23 03:37:28 -05:00
madaidan
535c258b83
More kernel hardening 2019-12-23 03:35:07 -05:00
Patrick Schleizer
11b4192fbd
comments 2019-12-23 03:28:42 -05:00
Patrick Schleizer
42ff53e9ad
bumped changelog version 2019-12-23 02:42:07 -05:00
Patrick Schleizer
2152fa2d61
comment 2019-12-23 02:38:53 -05:00
Patrick Schleizer
f8f2e6c704
fix disablewhitelist feature 2019-12-23 02:35:13 -05:00
Patrick Schleizer
47ddcad0c0
rename keyword whitelist to exactwhitelist 
add new keyword disablewhitelist

refactoring
 2019-12-23 02:29:47 -05:00
Patrick Schleizer
175d1c2845
bumped changelog version 2019-12-23 02:13:13 -05:00
Patrick Schleizer
0409aac3ae
readme 2019-12-23 02:09:04 -05:00
Patrick Schleizer
1ff56625a1
polkit-agent-helper-1 matchwhitelist to match both 
- /usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
- /lib/policykit-1/polkit-agent-helper-1
 2019-12-23 01:42:03 -05:00
Patrick Schleizer
d484b299ea
matchwhitelist /qubes/qfile-unpacker to match both 
- /usr/lib/qubes/qfile-unpacker whitelist
- /lib/qubes/qfile-unpacker
 2019-12-23 01:38:31 -05:00
Patrick Schleizer
34bf245713
output 2019-12-23 01:35:45 -05:00
Patrick Schleizer
ba30e45d15
output 2019-12-23 01:32:42 -05:00
Patrick Schleizer
ee9c5742da
output 2019-12-23 01:29:48 -05:00
Patrick Schleizer
6d05359abc
output 2019-12-23 01:21:52 -05:00
Patrick Schleizer
a1e78e8515
fix needlessly re-adding entries 2019-12-23 01:20:56 -05:00
Patrick Schleizer
906b3d32e7
output 2019-12-23 01:09:57 -05:00
Patrick Schleizer
4f76867da6
lower debugging 2019-12-23 01:08:02 -05:00
Patrick Schleizer
dc6e5d8508
fix 2019-12-23 01:06:38 -05:00
Patrick Schleizer
87b999f92a
refactoring 2019-12-23 00:59:43 -05:00
Patrick Schleizer
065ff4bd05
sanity_tests 2019-12-23 00:59:24 -05:00
Patrick Schleizer
fef1469fe6
exit non-zero if capability removal failed 2019-12-23 00:51:14 -05:00
Patrick Schleizer
3670fcf48b
depend on libcap2-bin for setcap / getcap / capsh 2019-12-23 00:49:33 -05:00
Patrick Schleizer
17a8c29470
fix capability removal error handling 
https://forums.whonix.org/t/disable-suid-binaries/7706/45
 2019-12-23 00:47:49 -05:00
Patrick Schleizer
b631e2ecd8
refactoring 2019-12-23 00:36:41 -05:00
Patrick Schleizer
7aea304549
comment 2019-12-23 00:26:15 -05:00
Patrick Schleizer
f4b1df02ee
Remove suid / gid and execute permission for 'group' and 'others'. 
Similar to: chmod og-ugx /path/to/filename

Removing execution permission is useful to make binaries such as 'su' fail closed rather
than fail open if suid was removed from these.

Do not remove read access since no security benefit and easier to manually undo for users.

chmod 744
 2019-12-22 19:42:40 -05:00
Patrick Schleizer
58a4e0bc7d
dbus-daemon-launch-helper matchwhitelist 2019-12-22 19:12:10 -05:00
Patrick Schleizer
15e3a2832d
comment 2019-12-22 18:57:23 -05:00
Patrick Schleizer
6eb8fd257a
suid utempter/utempter matchwhitelist 
to cover both:

/usr/lib/x86_64-linux-gnu/utempter/utempter
/lib/x86_64-linux-gnu/utempter/utempter
 2019-12-22 18:56:36 -05:00
Patrick Schleizer
9409209b48
Merge remote-tracking branch 'origin/master' 2019-12-22 10:29:08 -05:00
Patrick Schleizer
bce02ffdc0
Merge pull request #47 from madaidan/msr 
Blacklist CPU MSRs
 2019-12-22 15:26:07 +00:00
madaidan
8f11a520f4
Update control 2019-12-22 13:54:16 +00:00
madaidan
dd93b11321
Blacklist CPU MSRs 2019-12-22 13:52:43 +00:00
Patrick Schleizer
008ce4817c
bumped changelog version 2019-12-21 14:55:03 -05:00
Patrick Schleizer
d300db3cde
output 2019-12-21 14:45:11 -05:00
Patrick Schleizer
3921846df6
comment 2019-12-21 14:36:42 -05:00
Patrick Schleizer
1213415ce6
bumped changelog version 2019-12-21 14:23:35 -05:00
Patrick Schleizer
2ddf7b5db5
/lib/ nosuid 2019-12-21 14:06:51 -05:00
Patrick Schleizer
1e8457ea47
no longer remount /lib 
https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25
 2019-12-21 14:06:10 -05:00
Patrick Schleizer
10c19d6a8f
Merge remote-tracking branch 'origin/master' 2019-12-21 13:00:41 -05:00
Patrick Schleizer
fffdf5090c
Merge pull request #46 from madaidan/remount-secure 
Don't remount /sys/kernel/security
 2019-12-21 17:59:56 +00:00
madaidan
f5a52aeddc
Don't remount /sys/kernel/security 2019-12-21 14:55:28 +00:00
Patrick Schleizer
b2260f48f4
add support for /etc/exec / /usr/local/etc/exec 
to allow enabling exec on a per VM basis
 2019-12-21 08:03:33 -05:00
Patrick Schleizer
1c99b56c9b
bumped changelog version 2019-12-21 07:49:55 -05:00
Patrick Schleizer
161b6f6b88
readme 2019-12-21 07:49:29 -05:00