Patrick Schleizer
76a51a3b45
Merge remote-tracking branch 'origin/master'
2020-02-13 13:37:34 -05:00
Patrick Schleizer
5ebab397b2
Merge pull request #58 from madaidan/mitigations
...
Improve CPU mitigations documentation
2020-02-13 18:36:41 +00:00
madaidan
2796c2dd00
Update control
2020-02-12 18:43:19 +00:00
madaidan
700c7ed908
Create 40_cpu_mitigations.cfg
2020-02-12 18:42:13 +00:00
madaidan
ba0043b8a7
Update 40_kernel_hardening.cfg
2020-02-12 18:36:05 +00:00
madaidan
14f8458374
Update control
2020-02-12 18:05:32 +00:00
madaidan
5cb21d0d4d
Prevent symlink/hardlink TOCTOU races
2020-02-12 18:03:23 +00:00
Patrick Schleizer
163e20b886
bumped changelog version
2020-02-05 06:31:48 -05:00
Patrick Schleizer
3024006f63
Merge remote-tracking branch 'origin/master'
2020-02-04 00:24:50 -05:00
Patrick Schleizer
024576e330
Merge pull request #56 from HulaHoop0/patch-1
...
kvm.nx_huge_pages=force
2020-02-04 05:24:05 +00:00
HulaHoop0
e4c6e897cf
kvm.nx_huge_pages=force
2020-02-03 16:06:46 +00:00
Patrick Schleizer
8c5cd865f4
bumped changelog version
2020-02-03 09:23:13 -05:00
Patrick Schleizer
1f6ed2cc70
add support for passing parameters to usr/lib/security-misc/apt-get-update
2020-02-03 08:55:20 -05:00
Patrick Schleizer
2291b7f787
bumped changelog version
2020-02-03 08:43:31 -05:00
Patrick Schleizer
8627c9f76d
/usr/lib/security-misc/apt-get-update increase default timeout_after="600"
2020-01-31 12:18:02 -05:00
Patrick Schleizer
829e28aa90
/usr/lib/security-misc/apt-get-update environment variable timeout_after kill_after support
2020-01-31 12:17:07 -05:00
Patrick Schleizer
0bd0a4a647
bumped changelog version
2020-01-30 06:14:34 -05:00
Patrick Schleizer
85d2aa1365
hide stdout (but not stderr) by sysctl during initramfs
2020-01-30 06:13:42 -05:00
Patrick Schleizer
d69c1839cd
bumped changelog version
2020-01-30 06:02:26 -05:00
Patrick Schleizer
b9d65338bc
unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...)
...
this might reduce performance
* `spectre_v2=on`
* `spec_store_bypass_disable=on`
* `tsx=off`
* `tsx_async_abort=full,nosmt`
Thanks to @madaidan for the suggestion!
https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647
2020-01-30 05:55:13 -05:00
Patrick Schleizer
2711d0f7f0
bumped changelog version
2020-01-30 01:22:32 -05:00
Patrick Schleizer
4df0d6c01c
readme
2020-01-30 01:22:06 -05:00
Patrick Schleizer
c1a0da60be
set kernel boot parameter l1tf=full,force and nosmt=force
...
https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
2020-01-30 00:46:48 -05:00
Patrick Schleizer
efc40da4fb
bumped changelog version
2020-01-24 12:02:27 -05:00
Patrick Schleizer
07dcb32fc2
readme
2020-01-24 11:55:38 -05:00
Patrick Schleizer
f4c54881ac
description
2020-01-24 04:49:19 -05:00
Patrick Schleizer
25317f23e3
bumped changelog version
2020-01-24 04:41:16 -05:00
Patrick Schleizer
be79f0688a
readme
2020-01-24 04:40:20 -05:00
Patrick Schleizer
c0d3726b00
comment
2020-01-24 04:40:03 -05:00
Patrick Schleizer
a37da1c968
add digits to drop-in file names
2020-01-24 04:39:06 -05:00
Patrick Schleizer
2ab940c603
bumped changelog version
2020-01-24 04:34:18 -05:00
Patrick Schleizer
bac6cd601b
readme
2020-01-24 04:33:54 -05:00
Patrick Schleizer
3a4d283169
description
2020-01-24 04:33:30 -05:00
Patrick Schleizer
e0aa67677d
merge the many modprobe.d config files into 1
...
and use a name starting with double digits
to make it easier to disable settings using a lexically higher config file
2020-01-24 04:30:36 -05:00
Patrick Schleizer
6a4c493213
merge the many sysctl config files into 1
...
and use a name starting with double digits
to make it easier to disable settings using a lexically higher config file
2020-01-24 04:26:36 -05:00
Patrick Schleizer
f653b94e77
bumped changelog version
2020-01-24 03:49:02 -05:00
Patrick Schleizer
ca057713e2
readme
2020-01-24 03:39:04 -05:00
Patrick Schleizer
8616728ce0
remove duplicate
2020-01-24 03:35:15 -05:00
Patrick Schleizer
d4a37b6df2
remove-system.map: source /usr/lib/helper-scripts/pre.bsh
2020-01-24 03:18:17 -05:00
Patrick Schleizer
3b283ec00f
bumped changelog version
2020-01-22 07:10:47 -05:00
Patrick Schleizer
531f17cb68
add update initramfs trigger
...
https://github.com/Whonix/security-misc/pull/53
2020-01-22 07:08:31 -05:00
Patrick Schleizer
df0b2afda1
bumped changelog version
2020-01-21 10:12:32 -05:00
Patrick Schleizer
18041efa2f
fix pam tally2 check when read-only disk boot without ro-mode-init or grub-live
2020-01-21 10:01:17 -05:00
Patrick Schleizer
627b95e0b3
bumped changelog version
2020-01-20 08:51:25 -05:00
Patrick Schleizer
fbe9b60d95
fix Whonix / Kicksecure
...
/var/lib/dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted.
/var/lib/dpkg/tmp.ci/preinst: ERROR: You probably want to run:
sudo adduser user console
2020-01-20 08:49:02 -05:00
Patrick Schleizer
960e1ff6e8
bumped changelog version
2020-01-17 03:32:57 -05:00
Patrick Schleizer
1304341868
readme
2020-01-17 03:10:56 -05:00
Patrick Schleizer
6f8d89c6c5
error handling
2020-01-15 15:54:06 -05:00
Patrick Schleizer
7211f6e019
Merge remote-tracking branch 'origin/master'
2020-01-15 15:53:36 -05:00
Patrick Schleizer
f6cc76acd7
Merge pull request #55 from madaidan/sysctl.conf
...
Process sysctl.conf in initramfs
2020-01-15 20:52:33 +00:00
