Patrick Schleizer
a077ae54ea
modify call of stat to use NUL delimiter
...
for more robust string parsing
2024-07-24 10:56:08 -04:00
Patrick Schleizer
7200e9bd8c
output
2024-07-24 09:15:02 -04:00
Patrick Schleizer
1b6161c2dc
Merge remote-tracking branch 'ben-grande/fuzz'
2024-07-24 09:13:48 -04:00
Ben Grande
8be21b6eff
Handle newlines in file names
2024-07-23 19:36:12 +02:00
Ben Grande
aa99de68d3
Log output with defined levels
2024-07-23 18:50:16 +02:00
Ben Grande
06fbcdac1d
Prettify log messages
2024-07-23 09:55:02 +02:00
Ben Grande
7ee1ea2cc7
Unify functions that evaluate commands
2024-07-22 17:06:07 +02:00
Ben Grande
9c3566f524
Delimit file names with null terminator
2024-07-22 16:56:42 +02:00
Raja Grewal
8f3896c3da
Upgrade hyperlinks to HTTPS
2024-07-17 23:44:37 +10:00
Patrick Schleizer
df80385289
Merge pull request #237 from raja-grewal/intel_pmt
...
Disable some Intel PMT kernel modules
2024-07-17 09:04:18 -04:00
Patrick Schleizer
6e63fc8985
Merge remote-tracking branch 'ben-grande/fuzz'
2024-07-15 17:14:25 -04:00
Raja Grewal
61941da375
Create disabled-intelpmt-by-security-misc
2024-07-15 22:38:09 +10:00
Raja Grewal
a8bc1144c3
Updated wording of error files for disabled modules
2024-07-15 21:10:13 +10:00
Raja Grewal
fda3832eaf
Replace bash file presented for disabling of miscellaneous modules
2024-07-15 21:08:45 +10:00
Raja Grewal
c52b1a3fd2
Create disabled-miscellaneous-by-security-misc
2024-07-15 20:58:45 +10:00
Raja Grewal
f31dc8aebc
Fix error in error script
2024-07-12 16:21:03 +10:00
Raja Grewal
b02230a783
Split modprobe into blacklisted and disabled configurations
2024-07-12 02:42:37 +10:00
Ben Grande
b7796a5334
Unify method to find SUID files
2024-07-11 11:04:22 +02:00
Raja Grewal
1bb843ec38
Update Copyright (C) to 2024
2024-05-11 13:18:36 +10:00
Patrick Schleizer
8d01fc2d35
chmod +x
2024-05-10 06:48:26 -04:00
raja-grewal
f3800a4e2b
Create disabled-gps-by-security-misc
2024-05-09 02:25:46 +00:00
Patrick Schleizer
7dba3fb7be
no longer disable MSR by default
...
fixes https://github.com/Kicksecure/security-misc/issues/215
2024-04-01 02:56:27 -04:00
Patrick Schleizer
d13d1aa7ec
comments
2024-02-22 15:07:53 -05:00
Patrick Schleizer
c3dd178b19
output
2024-02-22 14:57:50 -05:00
Patrick Schleizer
6d7cf3c12a
output
2024-02-22 09:49:48 -05:00
Patrick Schleizer
f7831db197
do not exit non-zero if folder does not exist
2024-02-22 09:17:41 -05:00
Patrick Schleizer
5bdd7b8475
output
2024-02-22 09:14:52 -05:00
Patrick Schleizer
44a15cd97d
mount --make-private
...
https://github.com/Kicksecure/security-misc/issues/172
2024-02-22 09:13:56 -05:00
Patrick Schleizer
c0f98b05b6
comment
...
https://github.com/Kicksecure/security-misc/pull/202
2024-02-22 06:03:59 -05:00
Patrick Schleizer
1e1613aa93
allow /opt exec as usually optional binaries are placed there such as firefox
...
https://github.com/Kicksecure/security-misc/pull/202
2024-02-22 06:02:28 -05:00
Patrick Schleizer
7c7b4b24b4
fix home_noexec_maybe -> most_noexec_maybe
...
https://github.com/Kicksecure/security-misc/pull/202
2024-02-22 06:02:00 -05:00
Patrick Schleizer
38783faf60
add more bind mounts of mount options hardening
...
as suggested in https://github.com/Kicksecure/security-misc/pull/202
2024-02-22 05:58:53 -05:00
Patrick Schleizer
0efee2f50f
usrmerge
...
fixes https://github.com/Kicksecure/security-misc/issues/190
2024-01-17 13:39:56 -05:00
Patrick Schleizer
3ba8fe586e
update permission-hardener.service
...
Which is now only an additional opt-in systemd unit,
because permission-hardener is run by default at security-misc
package installation time.
https://github.com/Kicksecure/security-misc/pull/181
2024-01-16 09:23:54 -05:00
Ben Grande
bc02c72018
Fix unbound variable
...
- Run messages preceded by INFO;
- Comment unknown unused variables;
- Remove unnecessary variables; and
- Deal with unbound variable due to subshell by writing to a file;
2024-01-02 17:08:45 +01:00
Ben Grande
abf72c2ee4
Rename file permission hardening script
...
Hardener as the script is the agent that is hardening the file
permissions.
2024-01-02 13:34:29 +01:00
Ben Grande
f138cf0f78
Refactor permission-hardener
...
- Organize comments from default configuration;
- Apply and undo changes from a single file controlled by parameters;
- Arrays should be evaluated as arrays and not normal variables;
- Quote variables;
- Brackets around variables;
- Standardize test cases to "test" command;
- Test against empty or non-empty variables with "-z" and "-n";
- Show a usage message when necessary;
- Require root to run the script with informative message;
- Permit the user to see the help message without running as root;
- Do not create root directories without passing root check;
- Use long options for "set" command;
2024-01-02 12:17:16 +01:00
Patrick Schleizer
b0dd967611
usrmerge
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:28:08 -05:00
Patrick Schleizer
a1e00be0e0
update link
2023-11-06 16:58:23 -05:00
Patrick Schleizer
df5f3e8056
output
2023-11-06 16:36:22 -05:00
Patrick Schleizer
4219347f0a
fix permission-hardener config parsing issue
2023-11-05 16:43:44 -05:00
Patrick Schleizer
e72f79236b
refactoring
2023-11-05 16:41:41 -05:00
Patrick Schleizer
dea0d9a78a
fix permission-hardener config parsing issue
2023-11-05 16:40:49 -05:00
Patrick Schleizer
017ae18ad7
fix permission-hardener config parsing issue
2023-11-05 16:39:10 -05:00
Patrick Schleizer
65e3c14643
fix permission-hardener config parsing issue
2023-11-05 16:35:11 -05:00
Patrick Schleizer
4a19fbae0b
move permission-hardening to /usr/bin to make it more easily accessible
2023-11-05 15:13:01 -05:00
Patrick Schleizer
1123d23114
remount-secure: disable debugging to save space in initrd
2023-10-26 18:45:07 -04:00
monsieuremre
f0857fd560
Fix double mount issue for /var/log and /var/tmp
...
Mounting var with bind and mounting a subdirectory causes /var/tmp and /var/log bind mounted twice each. can be checked with lsblk. When we bind mount var only after having mounted the subdirectories, everything is mounted only one.
2023-10-23 15:33:05 +00:00
Patrick Schleizer
d2e8a6dad3
debugging
2023-10-22 19:21:51 -04:00
Patrick Schleizer
e7aafd64d4
refactoring
2023-10-22 19:16:12 -04:00
