1395 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
madaidan	9b767139ef	Avoid holes in IOMMU	2020-02-14 18:52:01 +00:00
madaidan	0f49736957	Update control	2020-02-14 18:18:18 +00:00
madaidan	d251c43344	Restrict the SysRq key	2020-02-14 18:17:20 +00:00
madaidan	ace6211176	Update control	2020-02-14 17:51:17 +00:00
madaidan	0ea7dd161b	Restrict loading line disciplines to CAP_SYS_MODULE	2020-02-14 17:50:19 +00:00
Patrick Schleizer	ad6b766886	Merge pull request #57 from madaidan/sysctl ... Prevent symlink/hardlink TOCTOU races	2020-02-13 18:40:58 +00:00
Patrick Schleizer	14140ad41b	bumped changelog version	2020-02-13 13:39:45 -05:00
Patrick Schleizer	d1fa191bc0	readme	2020-02-13 13:38:21 -05:00
Patrick Schleizer	76a51a3b45	Merge remote-tracking branch 'origin/master'	2020-02-13 13:37:34 -05:00
Patrick Schleizer	5ebab397b2	Merge pull request #58 from madaidan/mitigations ... Improve CPU mitigations documentation	2020-02-13 18:36:41 +00:00
madaidan	2796c2dd00	Update control	2020-02-12 18:43:19 +00:00
madaidan	700c7ed908	Create 40_cpu_mitigations.cfg	2020-02-12 18:42:13 +00:00
madaidan	ba0043b8a7	Update 40_kernel_hardening.cfg	2020-02-12 18:36:05 +00:00
madaidan	14f8458374	Update control	2020-02-12 18:05:32 +00:00
madaidan	5cb21d0d4d	Prevent symlink/hardlink TOCTOU races	2020-02-12 18:03:23 +00:00
Patrick Schleizer	163e20b886	bumped changelog version	2020-02-05 06:31:48 -05:00
Patrick Schleizer	3024006f63	Merge remote-tracking branch 'origin/master'	2020-02-04 00:24:50 -05:00
Patrick Schleizer	024576e330	Merge pull request #56 from HulaHoop0/patch-1 ... kvm.nx_huge_pages=force	2020-02-04 05:24:05 +00:00
HulaHoop0	e4c6e897cf	kvm.nx_huge_pages=force	2020-02-03 16:06:46 +00:00
Patrick Schleizer	8c5cd865f4	bumped changelog version	2020-02-03 09:23:13 -05:00
Patrick Schleizer	1f6ed2cc70	add support for passing parameters to usr/lib/security-misc/apt-get-update	2020-02-03 08:55:20 -05:00
Patrick Schleizer	2291b7f787	bumped changelog version	2020-02-03 08:43:31 -05:00
Patrick Schleizer	8627c9f76d	/usr/lib/security-misc/apt-get-update increase default timeout_after="600"	2020-01-31 12:18:02 -05:00
Patrick Schleizer	829e28aa90	/usr/lib/security-misc/apt-get-update environment variable timeout_after kill_after support	2020-01-31 12:17:07 -05:00
Patrick Schleizer	0bd0a4a647	bumped changelog version	2020-01-30 06:14:34 -05:00
Patrick Schleizer	85d2aa1365	hide stdout (but not stderr) by sysctl during initramfs	2020-01-30 06:13:42 -05:00
Patrick Schleizer	d69c1839cd	bumped changelog version	2020-01-30 06:02:26 -05:00
Patrick Schleizer	b9d65338bc	unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...) ... this might reduce performance * `spectre_v2=on` * `spec_store_bypass_disable=on` * `tsx=off` * `tsx_async_abort=full,nosmt` Thanks to @madaidan for the suggestion! https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647	2020-01-30 05:55:13 -05:00
Patrick Schleizer	2711d0f7f0	bumped changelog version	2020-01-30 01:22:32 -05:00
Patrick Schleizer	4df0d6c01c	readme	2020-01-30 01:22:06 -05:00
Patrick Schleizer	c1a0da60be	set kernel boot parameter l1tf=full,force and nosmt=force ... https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17	2020-01-30 00:46:48 -05:00
Patrick Schleizer	efc40da4fb	bumped changelog version	2020-01-24 12:02:27 -05:00
Patrick Schleizer	07dcb32fc2	readme	2020-01-24 11:55:38 -05:00
Patrick Schleizer	f4c54881ac	description	2020-01-24 04:49:19 -05:00
Patrick Schleizer	25317f23e3	bumped changelog version	2020-01-24 04:41:16 -05:00
Patrick Schleizer	be79f0688a	readme	2020-01-24 04:40:20 -05:00
Patrick Schleizer	c0d3726b00	comment	2020-01-24 04:40:03 -05:00
Patrick Schleizer	a37da1c968	add digits to drop-in file names	2020-01-24 04:39:06 -05:00
Patrick Schleizer	2ab940c603	bumped changelog version	2020-01-24 04:34:18 -05:00
Patrick Schleizer	bac6cd601b	readme	2020-01-24 04:33:54 -05:00
Patrick Schleizer	3a4d283169	description	2020-01-24 04:33:30 -05:00
Patrick Schleizer	e0aa67677d	merge the many modprobe.d config files into 1 ... and use a name starting with double digits to make it easier to disable settings using a lexically higher config file	2020-01-24 04:30:36 -05:00
Patrick Schleizer	6a4c493213	merge the many sysctl config files into 1 ... and use a name starting with double digits to make it easier to disable settings using a lexically higher config file	2020-01-24 04:26:36 -05:00
Patrick Schleizer	f653b94e77	bumped changelog version	2020-01-24 03:49:02 -05:00
Patrick Schleizer	ca057713e2	readme	2020-01-24 03:39:04 -05:00
Patrick Schleizer	8616728ce0	remove duplicate	2020-01-24 03:35:15 -05:00
Patrick Schleizer	d4a37b6df2	remove-system.map: source /usr/lib/helper-scripts/pre.bsh	2020-01-24 03:18:17 -05:00
Patrick Schleizer	3b283ec00f	bumped changelog version	2020-01-22 07:10:47 -05:00
Patrick Schleizer	531f17cb68	add update initramfs trigger ... https://github.com/Whonix/security-misc/pull/53	2020-01-22 07:08:31 -05:00
Patrick Schleizer	df0b2afda1	bumped changelog version	2020-01-21 10:12:32 -05:00