Patrick Schleizer
55ba5d4832
renamed: usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf -> usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf
...
renamed: usr/lib/NetworkManager/conf.d/99_randomize-mac.conf -> usr/lib/NetworkManager/conf.d/80_randomize-mac.conf
renamed: usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf -> usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf
2023-11-05 14:51:31 -05:00
Patrick Schleizer
5a75bcfb19
Merge pull request #145 from monsieuremre/wifi-and-bluetooth
...
Wifi and Bluetooth Patch | Security and Privacy
2023-11-05 14:49:00 -05:00
Patrick Schleizer
d9b5d770cf
Merge pull request #150 from monsieuremre/sysreq
...
Disable SysRq by default
2023-11-05 14:31:26 -05:00
Patrick Schleizer
d71ac03d96
comment
2023-11-03 10:36:15 -04:00
Patrick Schleizer
b85d48eb83
do not change default umask for root
...
since this causes permission issues in `/etc/`
https://github.com/Kicksecure/security-misc/pull/151
2023-11-03 10:31:59 -04:00
Patrick Schleizer
07540db90d
Revert "Revert "set default umask to 027""
...
This reverts commit f8913ceb2e
2023-11-03 09:45:12 -04:00
Patrick Schleizer
f8913ceb2e
Revert "set default umask to 027"
...
This reverts commit cd216095eb
2023-11-03 09:43:44 -04:00
Patrick Schleizer
cd216095eb
set default umask to 027
...
using package libpam-umask
https://www.debian.org/doc/manuals/securing-debian-manual/ch04s11.en.html#id-1.5.14.19
https://github.com/Kicksecure/security-misc/pull/151
2023-11-03 09:12:24 -04:00
monsieuremre
ac224b270a
disable sysrq
2023-11-02 13:01:55 +00:00
monsieuremre
229032d691
Rename etc/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf to usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf
2023-11-01 17:54:05 +00:00
monsieuremre
1049298e7b
Update and rename etc/NetworkManager/conf.d/99_randomize-mac.conf to usr/lib/NetworkManager/conf.d/99_randomize-mac.conf
2023-11-01 17:52:40 +00:00
monsieuremre
76e684cc0a
Update and rename etc/NetworkManager/conf.d/99_ipv6-privacy.conf to usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf
2023-11-01 17:51:27 +00:00
monsieuremre
c975c3c0ff
new lines 990-security-misc.conf
...
added new recommended hardening settings with comments
2023-10-27 11:07:53 +00:00
Patrick Schleizer
a330a9fd75
refactor permission-lockdown
2023-10-26 19:20:21 -04:00
Patrick Schleizer
8bf5ff82be
Merge remote-tracking branch 'github-kicksecure/master'
2023-10-26 19:15:04 -04:00
Patrick Schleizer
1123d23114
remount-secure: disable debugging to save space in initrd
2023-10-26 18:45:07 -04:00
monsieuremre
91c445244c
actually we do it once indeed
2023-10-26 19:41:07 +00:00
monsieuremre
88f396264c
avoiding /etc/passwd
2023-10-26 19:35:59 +00:00
monsieuremre
b5ba03247a
readability
2023-10-26 19:31:25 +00:00
monsieuremre
f487752ba1
not limiting ourselves. we do not do this not just once.
2023-10-26 19:30:58 +00:00
monsieuremre
88cd5a905d
strip unnecessary
2023-10-26 19:25:24 +00:00
monsieuremre
d9f10c221a
new permission-lockdown
2023-10-26 18:17:50 +00:00
Patrick Schleizer
e5d989af5a
comment
2023-10-26 12:04:13 -04:00
Patrick Schleizer
6a22351d29
renamed: usr/lib/sysctl.d/30_security-misc.conf -> usr/lib/sysctl.d/990-security-misc.conf
2023-10-25 17:30:07 -04:00
Patrick Schleizer
b7c52800f4
renamed: etc/sysctl.d/30_security-misc.conf -> usr/lib/sysctl.d/30_security-misc.conf
...
renamed: etc/sysctl.d/30_security-misc_kexec-disable.conf -> usr/lib/sysctl.d/30_security-misc_kexec-disable.conf
renamed: etc/sysctl.d/30_silent-kernel-printk.conf -> usr/lib/sysctl.d/30_silent-kernel-printk.conf
2023-10-25 17:28:43 -04:00
monsieuremre
f0857fd560
Fix double mount issue for /var/log and /var/tmp
...
Mounting var with bind and mounting a subdirectory causes /var/tmp and /var/log bind mounted twice each. can be checked with lsblk. When we bind mount var only after having mounted the subdirectories, everything is mounted only one.
2023-10-23 15:33:05 +00:00
Patrick Schleizer
d2e8a6dad3
debugging
2023-10-22 19:21:51 -04:00
Patrick Schleizer
e7aafd64d4
refactoring
2023-10-22 19:16:12 -04:00
Patrick Schleizer
d521662d04
comment
2023-10-22 16:49:36 -04:00
Patrick Schleizer
0e80acf38d
fix
2023-10-22 16:45:10 -04:00
Patrick Schleizer
5182d7502b
improve remount-secure
2023-10-22 16:08:21 -04:00
Patrick Schleizer
a88c0a3ad2
fix
2023-10-22 15:44:30 -04:00
Patrick Schleizer
a7629b98cf
fix
2023-10-22 15:40:49 -04:00
Patrick Schleizer
7112eac3be
output
2023-10-22 15:37:21 -04:00
Patrick Schleizer
f80b5fe376
fix
2023-10-22 15:36:16 -04:00
Patrick Schleizer
ce0babce21
comment
2023-10-22 15:35:03 -04:00
Patrick Schleizer
70cbe4daaa
fix
2023-10-22 15:33:11 -04:00
Patrick Schleizer
9b9e9ce1c0
fix
2023-10-22 15:27:01 -04:00
Patrick Schleizer
3731716a49
fix
2023-10-22 15:14:22 -04:00
Patrick Schleizer
eec87a0508
fix
2023-10-22 15:11:26 -04:00
Patrick Schleizer
f3286cf440
fix
2023-10-22 15:10:21 -04:00
Patrick Schleizer
eb90d38d8c
fix
2023-10-22 15:05:33 -04:00
Patrick Schleizer
7f03c2b137
fix
2023-10-22 14:45:45 -04:00
Patrick Schleizer
c85db586ca
improve
2023-10-22 14:44:58 -04:00
Patrick Schleizer
7c0ea4324a
fix
2023-10-22 14:39:52 -04:00
Patrick Schleizer
6198ae317c
fix
2023-10-22 14:29:02 -04:00
Patrick Schleizer
245fad0986
fix
2023-10-22 14:00:06 -04:00
Patrick Schleizer
619f1705e1
output
2023-10-22 13:58:55 -04:00
Patrick Schleizer
52fa7db087
output
2023-10-22 13:57:38 -04:00
Patrick Schleizer
8a592c2e37
fix remountsecure kernel parameter logic
2023-10-22 13:56:17 -04:00
