Patrick Schleizer
|
40fd8cb608
|
no nofail mount option to avoid breaking the boot of a system
unit testing belongs elsewhere
https://github.com/Kicksecure/security-misc/issues/157
|
2023-12-25 09:51:09 -05:00 |
|
Patrick Schleizer
|
4aa645f29f
|
comment
https://github.com/Kicksecure/security-misc/issues/157
|
2023-12-25 09:46:33 -05:00 |
|
Patrick Schleizer
|
2b7aeedb4a
|
mount /dev/cdrom to /mnt/cdrom (instead of /mnt/cdrom0) and
nodev,nosuid,noexec
as per:
https://www.debian.org/doc/manuals/securing-debian-manual/ch04s10.en.html
https://github.com/Kicksecure/security-misc/issues/157
|
2023-12-25 09:44:51 -05:00 |
|
Patrick Schleizer
|
0d9e9780da
|
formatting
https://github.com/Kicksecure/security-misc/issues/157
|
2023-12-25 09:37:14 -05:00 |
|
Patrick Schleizer
|
00f9ab4394
|
/dev devtmpfs
https://github.com/Kicksecure/security-misc/issues/157
|
2023-12-25 09:36:05 -05:00 |
|
Patrick Schleizer
|
55709b3aa0
|
/tmp tmpfs
https://github.com/Kicksecure/security-misc/issues/157
|
2023-12-25 09:30:57 -05:00 |
|
Patrick Schleizer
|
b0dd967611
|
usrmerge
https://github.com/Kicksecure/security-misc/issues/157
|
2023-12-25 09:28:08 -05:00 |
|
Patrick Schleizer
|
269fada14a
|
combine bind lines
https://github.com/Kicksecure/security-misc/issues/157
|
2023-12-25 09:25:14 -05:00 |
|
Patrick Schleizer
|
039de1dc9b
|
add hardened fstab /usr/share/doc/security-misc/fstab-vm
to the documentation folder as an example
not directly used by security-misc
will later be used by Kicksecure VM build process
https://github.com/Kicksecure/security-misc/issues/157
|
2023-12-12 11:50:11 -05:00 |
|
Patrick Schleizer
|
5a73817a95
|
move to /usr/lib/issue.d/20_security-misc.issue
https://github.com/Kicksecure/security-misc/pull/167
|
2023-12-04 11:38:49 -05:00 |
|
Patrick Schleizer
|
dc04040cb3
|
typo
|
2023-12-04 10:36:48 -05:00 |
|
Patrick Schleizer
|
2634dbff2b
|
shuffle
|
2023-12-04 10:36:21 -05:00 |
|
Patrick Schleizer
|
a1e00be0e0
|
update link
|
2023-11-06 16:58:23 -05:00 |
|
Patrick Schleizer
|
df5f3e8056
|
output
|
2023-11-06 16:36:22 -05:00 |
|
Patrick Schleizer
|
3bc831a1f7
|
lintian
|
2023-11-06 16:27:29 -05:00 |
|
Patrick Schleizer
|
ad010ef5b4
|
debugging
|
2023-11-05 17:52:44 -05:00 |
|
Patrick Schleizer
|
3130a39d8c
|
set -e
|
2023-11-05 17:43:07 -05:00 |
|
Patrick Schleizer
|
36f3c30440
|
Merge pull request #148 from monsieuremre/module-loading-hardening
Harden the loading of new modules to the kernel after install
|
2023-11-05 17:41:56 -05:00 |
|
Patrick Schleizer
|
4219347f0a
|
fix permission-hardener config parsing issue
|
2023-11-05 16:43:44 -05:00 |
|
Patrick Schleizer
|
e72f79236b
|
refactoring
|
2023-11-05 16:41:41 -05:00 |
|
Patrick Schleizer
|
dea0d9a78a
|
fix permission-hardener config parsing issue
|
2023-11-05 16:40:49 -05:00 |
|
Patrick Schleizer
|
017ae18ad7
|
fix permission-hardener config parsing issue
|
2023-11-05 16:39:10 -05:00 |
|
Patrick Schleizer
|
65e3c14643
|
fix permission-hardener config parsing issue
|
2023-11-05 16:35:11 -05:00 |
|
Patrick Schleizer
|
d4494fd3c3
|
disable remount-secure dracut modules
pending new systemd based implementation
https://github.com/Kicksecure/security-misc/pull/152
|
2023-11-05 15:27:09 -05:00 |
|
Patrick Schleizer
|
4a19fbae0b
|
move permission-hardening to /usr/bin to make it more easily accessible
|
2023-11-05 15:13:01 -05:00 |
|
Patrick Schleizer
|
c75f80b29f
|
lower verbosity of permission hardener
fixes https://github.com/Kicksecure/security-misc/issues/158
|
2023-11-05 15:09:29 -05:00 |
|
Patrick Schleizer
|
55ba5d4832
|
renamed: usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf -> usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf
renamed: usr/lib/NetworkManager/conf.d/99_randomize-mac.conf -> usr/lib/NetworkManager/conf.d/80_randomize-mac.conf
renamed: usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf -> usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf
|
2023-11-05 14:51:31 -05:00 |
|
Patrick Schleizer
|
5a75bcfb19
|
Merge pull request #145 from monsieuremre/wifi-and-bluetooth
Wifi and Bluetooth Patch | Security and Privacy
|
2023-11-05 14:49:00 -05:00 |
|
Patrick Schleizer
|
d9b5d770cf
|
Merge pull request #150 from monsieuremre/sysreq
Disable SysRq by default
|
2023-11-05 14:31:26 -05:00 |
|
monsieuremre
|
19eceaa810
|
more fix
|
2023-11-04 20:56:46 +00:00 |
|
Patrick Schleizer
|
d71ac03d96
|
comment
|
2023-11-03 10:36:15 -04:00 |
|
Patrick Schleizer
|
b85d48eb83
|
do not change default umask for root
since this causes permission issues in `/etc/`
https://github.com/Kicksecure/security-misc/pull/151
|
2023-11-03 10:31:59 -04:00 |
|
Patrick Schleizer
|
07540db90d
|
Revert "Revert "set default umask to 027""
This reverts commit f8913ceb2e.
|
2023-11-03 09:45:12 -04:00 |
|
Patrick Schleizer
|
f8913ceb2e
|
Revert "set default umask to 027"
This reverts commit cd216095eb.
|
2023-11-03 09:43:44 -04:00 |
|
Patrick Schleizer
|
cd216095eb
|
set default umask to 027
using package libpam-umask
https://www.debian.org/doc/manuals/securing-debian-manual/ch04s11.en.html#id-1.5.14.19
https://github.com/Kicksecure/security-misc/pull/151
|
2023-11-03 09:12:24 -04:00 |
|
monsieuremre
|
ac224b270a
|
disable sysrq
|
2023-11-02 13:01:55 +00:00 |
|
monsieuremre
|
9f063584c1
|
disable-kernel-module-loading
|
2023-11-02 10:28:41 +00:00 |
|
monsieuremre
|
229032d691
|
Rename etc/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf to usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf
|
2023-11-01 17:54:05 +00:00 |
|
monsieuremre
|
1049298e7b
|
Update and rename etc/NetworkManager/conf.d/99_randomize-mac.conf to usr/lib/NetworkManager/conf.d/99_randomize-mac.conf
|
2023-11-01 17:52:40 +00:00 |
|
monsieuremre
|
76e684cc0a
|
Update and rename etc/NetworkManager/conf.d/99_ipv6-privacy.conf to usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf
|
2023-11-01 17:51:27 +00:00 |
|
monsieuremre
|
c975c3c0ff
|
new lines 990-security-misc.conf
added new recommended hardening settings with comments
|
2023-10-27 11:07:53 +00:00 |
|
Patrick Schleizer
|
a330a9fd75
|
refactor permission-lockdown
|
2023-10-26 19:20:21 -04:00 |
|
Patrick Schleizer
|
8bf5ff82be
|
Merge remote-tracking branch 'github-kicksecure/master'
|
2023-10-26 19:15:04 -04:00 |
|
Patrick Schleizer
|
1123d23114
|
remount-secure: disable debugging to save space in initrd
|
2023-10-26 18:45:07 -04:00 |
|
monsieuremre
|
91c445244c
|
actually we do it once indeed
|
2023-10-26 19:41:07 +00:00 |
|
monsieuremre
|
88f396264c
|
avoiding /etc/passwd
|
2023-10-26 19:35:59 +00:00 |
|
monsieuremre
|
b5ba03247a
|
readability
|
2023-10-26 19:31:25 +00:00 |
|
monsieuremre
|
f487752ba1
|
not limiting ourselves. we do not do this not just once.
|
2023-10-26 19:30:58 +00:00 |
|
monsieuremre
|
88cd5a905d
|
strip unnecessary
|
2023-10-26 19:25:24 +00:00 |
|
monsieuremre
|
d9f10c221a
|
new permission-lockdown
|
2023-10-26 18:17:50 +00:00 |
|