Patrick Schleizer
40fd8cb608
no nofail mount option to avoid breaking the boot of a system
...
unit testing belongs elsewhere
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:51:09 -05:00
Patrick Schleizer
4aa645f29f
comment
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:46:33 -05:00
Patrick Schleizer
2b7aeedb4a
mount /dev/cdrom to /mnt/cdrom (instead of /mnt/cdrom0) and
...
nodev,nosuid,noexec
as per:
https://www.debian.org/doc/manuals/securing-debian-manual/ch04s10.en.html
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:44:51 -05:00
Patrick Schleizer
0d9e9780da
formatting
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:37:14 -05:00
Patrick Schleizer
00f9ab4394
/dev devtmpfs
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:36:05 -05:00
Patrick Schleizer
55709b3aa0
/tmp tmpfs
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:30:57 -05:00
Patrick Schleizer
b0dd967611
usrmerge
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:28:08 -05:00
Patrick Schleizer
269fada14a
combine bind lines
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:25:14 -05:00
Raja Grewal
f055fe5da2
Disable asynchronous I/O
...
io_uring creation is disabled for all processes. io_uring_setup always fails with -EPERM. Existing io_uring instances can still be used.
2023-12-15 08:33:36 +00:00
Patrick Schleizer
039de1dc9b
add hardened fstab /usr/share/doc/security-misc/fstab-vm
...
to the documentation folder as an example
not directly used by security-misc
will later be used by Kicksecure VM build process
https://github.com/Kicksecure/security-misc/issues/157
2023-12-12 11:50:11 -05:00
Patrick Schleizer
5a73817a95
move to /usr/lib/issue.d/20_security-misc.issue
...
https://github.com/Kicksecure/security-misc/pull/167
2023-12-04 11:38:49 -05:00
Patrick Schleizer
dc04040cb3
typo
2023-12-04 10:36:48 -05:00
Patrick Schleizer
2634dbff2b
shuffle
2023-12-04 10:36:21 -05:00
Patrick Schleizer
a1e00be0e0
update link
2023-11-06 16:58:23 -05:00
Patrick Schleizer
df5f3e8056
output
2023-11-06 16:36:22 -05:00
Patrick Schleizer
3bc831a1f7
lintian
2023-11-06 16:27:29 -05:00
Patrick Schleizer
ad010ef5b4
debugging
2023-11-05 17:52:44 -05:00
Patrick Schleizer
3130a39d8c
set -e
2023-11-05 17:43:07 -05:00
Patrick Schleizer
36f3c30440
Merge pull request #148 from monsieuremre/module-loading-hardening
...
Harden the loading of new modules to the kernel after install
2023-11-05 17:41:56 -05:00
Patrick Schleizer
4219347f0a
fix permission-hardener config parsing issue
2023-11-05 16:43:44 -05:00
Patrick Schleizer
e72f79236b
refactoring
2023-11-05 16:41:41 -05:00
Patrick Schleizer
dea0d9a78a
fix permission-hardener config parsing issue
2023-11-05 16:40:49 -05:00
Patrick Schleizer
017ae18ad7
fix permission-hardener config parsing issue
2023-11-05 16:39:10 -05:00
Patrick Schleizer
65e3c14643
fix permission-hardener config parsing issue
2023-11-05 16:35:11 -05:00
Patrick Schleizer
d4494fd3c3
disable remount-secure dracut modules
...
pending new systemd based implementation
https://github.com/Kicksecure/security-misc/pull/152
2023-11-05 15:27:09 -05:00
Patrick Schleizer
4a19fbae0b
move permission-hardening to /usr/bin to make it more easily accessible
2023-11-05 15:13:01 -05:00
Patrick Schleizer
c75f80b29f
lower verbosity of permission hardener
...
fixes https://github.com/Kicksecure/security-misc/issues/158
2023-11-05 15:09:29 -05:00
Patrick Schleizer
55ba5d4832
renamed: usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf -> usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf
...
renamed: usr/lib/NetworkManager/conf.d/99_randomize-mac.conf -> usr/lib/NetworkManager/conf.d/80_randomize-mac.conf
renamed: usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf -> usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf
2023-11-05 14:51:31 -05:00
Patrick Schleizer
5a75bcfb19
Merge pull request #145 from monsieuremre/wifi-and-bluetooth
...
Wifi and Bluetooth Patch | Security and Privacy
2023-11-05 14:49:00 -05:00
Patrick Schleizer
d9b5d770cf
Merge pull request #150 from monsieuremre/sysreq
...
Disable SysRq by default
2023-11-05 14:31:26 -05:00
monsieuremre
19eceaa810
more fix
2023-11-04 20:56:46 +00:00
Patrick Schleizer
d71ac03d96
comment
2023-11-03 10:36:15 -04:00
Patrick Schleizer
b85d48eb83
do not change default umask for root
...
since this causes permission issues in `/etc/`
https://github.com/Kicksecure/security-misc/pull/151
2023-11-03 10:31:59 -04:00
Patrick Schleizer
07540db90d
Revert "Revert "set default umask to 027""
...
This reverts commit f8913ceb2e
2023-11-03 09:45:12 -04:00
Patrick Schleizer
f8913ceb2e
Revert "set default umask to 027"
...
This reverts commit cd216095eb
2023-11-03 09:43:44 -04:00
Patrick Schleizer
cd216095eb
set default umask to 027
...
using package libpam-umask
https://www.debian.org/doc/manuals/securing-debian-manual/ch04s11.en.html#id-1.5.14.19
https://github.com/Kicksecure/security-misc/pull/151
2023-11-03 09:12:24 -04:00
monsieuremre
ac224b270a
disable sysrq
2023-11-02 13:01:55 +00:00
monsieuremre
9f063584c1
disable-kernel-module-loading
2023-11-02 10:28:41 +00:00
monsieuremre
229032d691
Rename etc/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf to usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf
2023-11-01 17:54:05 +00:00
monsieuremre
1049298e7b
Update and rename etc/NetworkManager/conf.d/99_randomize-mac.conf to usr/lib/NetworkManager/conf.d/99_randomize-mac.conf
2023-11-01 17:52:40 +00:00
monsieuremre
76e684cc0a
Update and rename etc/NetworkManager/conf.d/99_ipv6-privacy.conf to usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf
2023-11-01 17:51:27 +00:00
monsieuremre
c975c3c0ff
new lines 990-security-misc.conf
...
added new recommended hardening settings with comments
2023-10-27 11:07:53 +00:00
Patrick Schleizer
a330a9fd75
refactor permission-lockdown
2023-10-26 19:20:21 -04:00
Patrick Schleizer
8bf5ff82be
Merge remote-tracking branch 'github-kicksecure/master'
2023-10-26 19:15:04 -04:00
Patrick Schleizer
1123d23114
remount-secure: disable debugging to save space in initrd
2023-10-26 18:45:07 -04:00
monsieuremre
91c445244c
actually we do it once indeed
2023-10-26 19:41:07 +00:00
monsieuremre
88f396264c
avoiding /etc/passwd
2023-10-26 19:35:59 +00:00
monsieuremre
b5ba03247a
readability
2023-10-26 19:31:25 +00:00
monsieuremre
f487752ba1
not limiting ourselves. we do not do this not just once.
2023-10-26 19:30:58 +00:00
monsieuremre
88cd5a905d
strip unnecessary
2023-10-26 19:25:24 +00:00
monsieuremre
d9f10c221a
new permission-lockdown
2023-10-26 18:17:50 +00:00
Patrick Schleizer
e5d989af5a
comment
2023-10-26 12:04:13 -04:00
Patrick Schleizer
6a22351d29
renamed: usr/lib/sysctl.d/30_security-misc.conf -> usr/lib/sysctl.d/990-security-misc.conf
2023-10-25 17:30:07 -04:00
Patrick Schleizer
b7c52800f4
renamed: etc/sysctl.d/30_security-misc.conf -> usr/lib/sysctl.d/30_security-misc.conf
...
renamed: etc/sysctl.d/30_security-misc_kexec-disable.conf -> usr/lib/sysctl.d/30_security-misc_kexec-disable.conf
renamed: etc/sysctl.d/30_silent-kernel-printk.conf -> usr/lib/sysctl.d/30_silent-kernel-printk.conf
2023-10-25 17:28:43 -04:00
monsieuremre
f0857fd560
Fix double mount issue for /var/log and /var/tmp
...
Mounting var with bind and mounting a subdirectory causes /var/tmp and /var/log bind mounted twice each. can be checked with lsblk. When we bind mount var only after having mounted the subdirectories, everything is mounted only one.
2023-10-23 15:33:05 +00:00
Patrick Schleizer
d2e8a6dad3
debugging
2023-10-22 19:21:51 -04:00
Patrick Schleizer
e7aafd64d4
refactoring
2023-10-22 19:16:12 -04:00
Patrick Schleizer
d521662d04
comment
2023-10-22 16:49:36 -04:00
Patrick Schleizer
0e80acf38d
fix
2023-10-22 16:45:10 -04:00
Patrick Schleizer
5182d7502b
improve remount-secure
2023-10-22 16:08:21 -04:00
Patrick Schleizer
a88c0a3ad2
fix
2023-10-22 15:44:30 -04:00
Patrick Schleizer
a7629b98cf
fix
2023-10-22 15:40:49 -04:00
Patrick Schleizer
7112eac3be
output
2023-10-22 15:37:21 -04:00
Patrick Schleizer
f80b5fe376
fix
2023-10-22 15:36:16 -04:00
Patrick Schleizer
ce0babce21
comment
2023-10-22 15:35:03 -04:00
Patrick Schleizer
70cbe4daaa
fix
2023-10-22 15:33:11 -04:00
Patrick Schleizer
9b9e9ce1c0
fix
2023-10-22 15:27:01 -04:00
Patrick Schleizer
3731716a49
fix
2023-10-22 15:14:22 -04:00
Patrick Schleizer
eec87a0508
fix
2023-10-22 15:11:26 -04:00
Patrick Schleizer
f3286cf440
fix
2023-10-22 15:10:21 -04:00
Patrick Schleizer
eb90d38d8c
fix
2023-10-22 15:05:33 -04:00
Patrick Schleizer
7f03c2b137
fix
2023-10-22 14:45:45 -04:00
Patrick Schleizer
c85db586ca
improve
2023-10-22 14:44:58 -04:00
Patrick Schleizer
7c0ea4324a
fix
2023-10-22 14:39:52 -04:00
Patrick Schleizer
6198ae317c
fix
2023-10-22 14:29:02 -04:00
Patrick Schleizer
245fad0986
fix
2023-10-22 14:00:06 -04:00
Patrick Schleizer
619f1705e1
output
2023-10-22 13:58:55 -04:00
Patrick Schleizer
52fa7db087
output
2023-10-22 13:57:38 -04:00
Patrick Schleizer
8a592c2e37
fix remountsecure kernel parameter logic
2023-10-22 13:56:17 -04:00
Patrick Schleizer
e689f38ad0
todo
2023-10-22 13:31:44 -04:00
Patrick Schleizer
6675a2e931
fix
2023-10-22 13:30:50 -04:00
Patrick Schleizer
4288e10554
fix, rework remount-secure kernel parameters parsing
2023-10-22 13:25:31 -04:00
Patrick Schleizer
b0181af099
fix
2023-10-22 13:12:25 -04:00
Patrick Schleizer
28cb53341d
remount-secure dracut module: improve output
2023-10-22 13:11:44 -04:00
Patrick Schleizer
84ca0ac8a0
improve remount-secure
2023-10-22 12:54:25 -04:00
Patrick Schleizer
e7d30955e8
debugging
2023-10-22 11:28:08 -04:00
Patrick Schleizer
8eb4607a0e
improve
2023-10-22 11:12:54 -04:00
Patrick Schleizer
f1da0ce746
fix
2023-10-22 11:11:10 -04:00
Patrick Schleizer
26826e8398
fix
2023-10-22 11:06:34 -04:00
Patrick Schleizer
233fa4625b
output
2023-10-22 10:49:53 -04:00
Patrick Schleizer
3ebe8cf4de
refactoring
2023-10-22 10:41:42 -04:00
Patrick Schleizer
24d2e26397
no longer reproducible
2023-10-22 10:40:19 -04:00
Patrick Schleizer
fcba70df2e
refactoring
2023-10-22 10:38:48 -04:00
Patrick Schleizer
a05bd3dd0e
/home last because most likely to fail
2023-10-22 10:37:02 -04:00
Patrick Schleizer
41077c94fb
improve remount-secure
2023-10-22 10:32:24 -04:00
Patrick Schleizer
ef69e512bd
refactoring
2023-10-22 10:25:57 -04:00
Patrick Schleizer
d5cb7ecec9
use findmnt
2023-10-22 10:22:21 -04:00
Patrick Schleizer
45ce0ff74d
debugging
2023-10-22 10:16:43 -04:00
Patrick Schleizer
b81a991731
fix
2023-10-22 10:15:11 -04:00
Patrick Schleizer
292a5c3a8a
fix
2023-10-22 10:11:31 -04:00
