2108 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Patrick Schleizer	dce54d5d0f	bumped changelog version	2020-02-15 15:29:38 -05:00
Patrick Schleizer	3df008f0b9	readme	2020-02-15 15:28:30 -05:00
Patrick Schleizer	4399a512be	Merge pull request #63 from madaidan/ldisc_autoload ... Document ldisc_autoload better	2020-02-15 19:43:05 +00:00
madaidan	a79ce7fa68	Document ldisc_autoload better	2020-02-15 17:30:21 +00:00
Patrick Schleizer	757df8fceb	Merge remote-tracking branch 'origin/master'	2020-02-15 05:43:43 -05:00
Patrick Schleizer	a9a1581720	Merge pull request #60 from madaidan/sysrq ... Restrict the SysRq key	2020-02-15 10:42:20 +00:00
Patrick Schleizer	1e5946c795	Merge branch 'master' into sysrq	2020-02-15 10:41:52 +00:00
Patrick Schleizer	9bbae903fe	remove-system.map: lower verbosity output	2020-02-15 05:29:48 -05:00
Patrick Schleizer	cce35e5109	Merge remote-tracking branch 'origin/master'	2020-02-15 05:27:52 -05:00
Patrick Schleizer	e40351796e	Merge pull request #62 from madaidan/shred ... Shred System.map files	2020-02-15 10:25:15 +00:00
Patrick Schleizer	5124f8cebc	Merge pull request #61 from madaidan/disable_early_pci_dma ... Avoid holes in IOMMU	2020-02-15 10:18:56 +00:00
Patrick Schleizer	ac8757a031	Merge pull request #59 from madaidan/ldisc ... Restrict loading line disciplines to CAP_SYS_MODULE	2020-02-15 10:09:46 +00:00
madaidan	31009f0bfa	Shred System.map files	2020-02-14 23:46:19 +00:00
madaidan	9b767139ef	Avoid holes in IOMMU	2020-02-14 18:52:01 +00:00
madaidan	0f49736957	Update control	2020-02-14 18:18:18 +00:00
madaidan	d251c43344	Restrict the SysRq key	2020-02-14 18:17:20 +00:00
madaidan	ace6211176	Update control	2020-02-14 17:51:17 +00:00
madaidan	0ea7dd161b	Restrict loading line disciplines to CAP_SYS_MODULE	2020-02-14 17:50:19 +00:00
Patrick Schleizer	ad6b766886	Merge pull request #57 from madaidan/sysctl ... Prevent symlink/hardlink TOCTOU races	2020-02-13 18:40:58 +00:00
Patrick Schleizer	14140ad41b	bumped changelog version	2020-02-13 13:39:45 -05:00
Patrick Schleizer	d1fa191bc0	readme	2020-02-13 13:38:21 -05:00
Patrick Schleizer	76a51a3b45	Merge remote-tracking branch 'origin/master'	2020-02-13 13:37:34 -05:00
Patrick Schleizer	5ebab397b2	Merge pull request #58 from madaidan/mitigations ... Improve CPU mitigations documentation	2020-02-13 18:36:41 +00:00
madaidan	2796c2dd00	Update control	2020-02-12 18:43:19 +00:00
madaidan	700c7ed908	Create 40_cpu_mitigations.cfg	2020-02-12 18:42:13 +00:00
madaidan	ba0043b8a7	Update 40_kernel_hardening.cfg	2020-02-12 18:36:05 +00:00
madaidan	14f8458374	Update control	2020-02-12 18:05:32 +00:00
madaidan	5cb21d0d4d	Prevent symlink/hardlink TOCTOU races	2020-02-12 18:03:23 +00:00
Patrick Schleizer	163e20b886	bumped changelog version	2020-02-05 06:31:48 -05:00
Patrick Schleizer	3024006f63	Merge remote-tracking branch 'origin/master'	2020-02-04 00:24:50 -05:00
Patrick Schleizer	024576e330	Merge pull request #56 from HulaHoop0/patch-1 ... kvm.nx_huge_pages=force	2020-02-04 05:24:05 +00:00
HulaHoop0	e4c6e897cf	kvm.nx_huge_pages=force	2020-02-03 16:06:46 +00:00
Patrick Schleizer	8c5cd865f4	bumped changelog version	2020-02-03 09:23:13 -05:00
Patrick Schleizer	1f6ed2cc70	add support for passing parameters to usr/lib/security-misc/apt-get-update	2020-02-03 08:55:20 -05:00
Patrick Schleizer	2291b7f787	bumped changelog version	2020-02-03 08:43:31 -05:00
Patrick Schleizer	8627c9f76d	/usr/lib/security-misc/apt-get-update increase default timeout_after="600"	2020-01-31 12:18:02 -05:00
Patrick Schleizer	829e28aa90	/usr/lib/security-misc/apt-get-update environment variable timeout_after kill_after support	2020-01-31 12:17:07 -05:00
Patrick Schleizer	0bd0a4a647	bumped changelog version	2020-01-30 06:14:34 -05:00
Patrick Schleizer	85d2aa1365	hide stdout (but not stderr) by sysctl during initramfs	2020-01-30 06:13:42 -05:00
Patrick Schleizer	d69c1839cd	bumped changelog version	2020-01-30 06:02:26 -05:00
Patrick Schleizer	b9d65338bc	unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...) ... this might reduce performance * `spectre_v2=on` * `spec_store_bypass_disable=on` * `tsx=off` * `tsx_async_abort=full,nosmt` Thanks to @madaidan for the suggestion! https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647	2020-01-30 05:55:13 -05:00
Patrick Schleizer	2711d0f7f0	bumped changelog version	2020-01-30 01:22:32 -05:00
Patrick Schleizer	4df0d6c01c	readme	2020-01-30 01:22:06 -05:00
Patrick Schleizer	c1a0da60be	set kernel boot parameter l1tf=full,force and nosmt=force ... https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17	2020-01-30 00:46:48 -05:00
Patrick Schleizer	efc40da4fb	bumped changelog version	2020-01-24 12:02:27 -05:00
Patrick Schleizer	07dcb32fc2	readme	2020-01-24 11:55:38 -05:00
Patrick Schleizer	f4c54881ac	description	2020-01-24 04:49:19 -05:00
Patrick Schleizer	25317f23e3	bumped changelog version	2020-01-24 04:41:16 -05:00
Patrick Schleizer	be79f0688a	readme	2020-01-24 04:40:20 -05:00
Patrick Schleizer	c0d3726b00	comment	2020-01-24 04:40:03 -05:00