714 Commits

Author	SHA1	Message	Date
Patrick Schleizer	0d9e9780da	formatting ... https://github.com/Kicksecure/security-misc/issues/157	2023-12-25 09:37:14 -05:00
Patrick Schleizer	00f9ab4394	/dev devtmpfs ... https://github.com/Kicksecure/security-misc/issues/157	2023-12-25 09:36:05 -05:00
Patrick Schleizer	55709b3aa0	/tmp tmpfs ... https://github.com/Kicksecure/security-misc/issues/157	2023-12-25 09:30:57 -05:00
Patrick Schleizer	b0dd967611	usrmerge ... https://github.com/Kicksecure/security-misc/issues/157	2023-12-25 09:28:08 -05:00
Patrick Schleizer	269fada14a	combine bind lines ... https://github.com/Kicksecure/security-misc/issues/157	2023-12-25 09:25:14 -05:00
Raja Grewal	f055fe5da2	Disable asynchronous I/O ... io_uring creation is disabled for all processes. io_uring_setup always fails with -EPERM. Existing io_uring instances can still be used.	2023-12-15 08:33:36 +00:00
Patrick Schleizer	039de1dc9b	add hardened fstab /usr/share/doc/security-misc/fstab-vm ... to the documentation folder as an example not directly used by security-misc will later be used by Kicksecure VM build process https://github.com/Kicksecure/security-misc/issues/157	2023-12-12 11:50:11 -05:00
Patrick Schleizer	5a73817a95	move to /usr/lib/issue.d/20_security-misc.issue ... https://github.com/Kicksecure/security-misc/pull/167	2023-12-04 11:38:49 -05:00
Patrick Schleizer	dc04040cb3	typo	2023-12-04 10:36:48 -05:00
Patrick Schleizer	2634dbff2b	shuffle	2023-12-04 10:36:21 -05:00
Patrick Schleizer	a1e00be0e0	update link	2023-11-06 16:58:23 -05:00
Patrick Schleizer	df5f3e8056	output	2023-11-06 16:36:22 -05:00
Patrick Schleizer	3bc831a1f7	lintian	2023-11-06 16:27:29 -05:00
Patrick Schleizer	ad010ef5b4	debugging	2023-11-05 17:52:44 -05:00
Patrick Schleizer	3130a39d8c	set -e	2023-11-05 17:43:07 -05:00
Patrick Schleizer	36f3c30440	Merge pull request #148 from monsieuremre/module-loading-hardening ... Harden the loading of new modules to the kernel after install	2023-11-05 17:41:56 -05:00
Patrick Schleizer	4219347f0a	fix permission-hardener config parsing issue	2023-11-05 16:43:44 -05:00
Patrick Schleizer	e72f79236b	refactoring	2023-11-05 16:41:41 -05:00
Patrick Schleizer	dea0d9a78a	fix permission-hardener config parsing issue	2023-11-05 16:40:49 -05:00
Patrick Schleizer	017ae18ad7	fix permission-hardener config parsing issue	2023-11-05 16:39:10 -05:00
Patrick Schleizer	65e3c14643	fix permission-hardener config parsing issue	2023-11-05 16:35:11 -05:00
Patrick Schleizer	d4494fd3c3	disable remount-secure dracut modules ... pending new systemd based implementation https://github.com/Kicksecure/security-misc/pull/152	2023-11-05 15:27:09 -05:00
Patrick Schleizer	4a19fbae0b	move permission-hardening to /usr/bin to make it more easily accessible	2023-11-05 15:13:01 -05:00
Patrick Schleizer	c75f80b29f	lower verbosity of permission hardener ... fixes https://github.com/Kicksecure/security-misc/issues/158	2023-11-05 15:09:29 -05:00
Patrick Schleizer	55ba5d4832	renamed: usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf -> usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf ... renamed: usr/lib/NetworkManager/conf.d/99_randomize-mac.conf -> usr/lib/NetworkManager/conf.d/80_randomize-mac.conf renamed: usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf -> usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf	2023-11-05 14:51:31 -05:00
Patrick Schleizer	5a75bcfb19	Merge pull request #145 from monsieuremre/wifi-and-bluetooth ... Wifi and Bluetooth Patch | Security and Privacy	2023-11-05 14:49:00 -05:00
Patrick Schleizer	d9b5d770cf	Merge pull request #150 from monsieuremre/sysreq ... Disable SysRq by default	2023-11-05 14:31:26 -05:00
monsieuremre	19eceaa810	more fix	2023-11-04 20:56:46 +00:00
Patrick Schleizer	d71ac03d96	comment	2023-11-03 10:36:15 -04:00
Patrick Schleizer	b85d48eb83	do not change default umask for root ... since this causes permission issues in `/etc/` https://github.com/Kicksecure/security-misc/pull/151	2023-11-03 10:31:59 -04:00
Patrick Schleizer	07540db90d	Revert "Revert "set default umask to 027"" ... This reverts commit f8913ceb2e.	2023-11-03 09:45:12 -04:00
Patrick Schleizer	f8913ceb2e	Revert "set default umask to 027" ... This reverts commit cd216095eb.	2023-11-03 09:43:44 -04:00
Patrick Schleizer	cd216095eb	set default umask to 027 ... using package libpam-umask https://www.debian.org/doc/manuals/securing-debian-manual/ch04s11.en.html#id-1.5.14.19 https://github.com/Kicksecure/security-misc/pull/151	2023-11-03 09:12:24 -04:00
monsieuremre	ac224b270a	disable sysrq	2023-11-02 13:01:55 +00:00
monsieuremre	9f063584c1	disable-kernel-module-loading	2023-11-02 10:28:41 +00:00
monsieuremre	229032d691	Rename etc/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf to usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf	2023-11-01 17:54:05 +00:00
monsieuremre	1049298e7b	Update and rename etc/NetworkManager/conf.d/99_randomize-mac.conf to usr/lib/NetworkManager/conf.d/99_randomize-mac.conf	2023-11-01 17:52:40 +00:00
monsieuremre	76e684cc0a	Update and rename etc/NetworkManager/conf.d/99_ipv6-privacy.conf to usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf	2023-11-01 17:51:27 +00:00
monsieuremre	c975c3c0ff	new lines 990-security-misc.conf ... added new recommended hardening settings with comments	2023-10-27 11:07:53 +00:00
Patrick Schleizer	a330a9fd75	refactor permission-lockdown	2023-10-26 19:20:21 -04:00
Patrick Schleizer	8bf5ff82be	Merge remote-tracking branch 'github-kicksecure/master'	2023-10-26 19:15:04 -04:00
Patrick Schleizer	1123d23114	remount-secure: disable debugging to save space in initrd	2023-10-26 18:45:07 -04:00
monsieuremre	91c445244c	actually we do it once indeed	2023-10-26 19:41:07 +00:00
monsieuremre	88f396264c	avoiding /etc/passwd	2023-10-26 19:35:59 +00:00
monsieuremre	b5ba03247a	readability	2023-10-26 19:31:25 +00:00
monsieuremre	f487752ba1	not limiting ourselves. we do not do this not just once.	2023-10-26 19:30:58 +00:00
monsieuremre	88cd5a905d	strip unnecessary	2023-10-26 19:25:24 +00:00
monsieuremre	d9f10c221a	new permission-lockdown	2023-10-26 18:17:50 +00:00
Patrick Schleizer	e5d989af5a	comment	2023-10-26 12:04:13 -04:00
Patrick Schleizer	6a22351d29	renamed: usr/lib/sysctl.d/30_security-misc.conf -> usr/lib/sysctl.d/990-security-misc.conf	2023-10-25 17:30:07 -04:00
Patrick Schleizer	b7c52800f4	renamed: etc/sysctl.d/30_security-misc.conf -> usr/lib/sysctl.d/30_security-misc.conf ... renamed: etc/sysctl.d/30_security-misc_kexec-disable.conf -> usr/lib/sysctl.d/30_security-misc_kexec-disable.conf renamed: etc/sysctl.d/30_silent-kernel-printk.conf -> usr/lib/sysctl.d/30_silent-kernel-printk.conf	2023-10-25 17:28:43 -04:00
monsieuremre	f0857fd560	Fix double mount issue for /var/log and /var/tmp ... Mounting var with bind and mounting a subdirectory causes /var/tmp and /var/log bind mounted twice each. can be checked with lsblk. When we bind mount var only after having mounted the subdirectories, everything is mounted only one.	2023-10-23 15:33:05 +00:00
Patrick Schleizer	d2e8a6dad3	debugging	2023-10-22 19:21:51 -04:00
Patrick Schleizer	e7aafd64d4	refactoring	2023-10-22 19:16:12 -04:00
Patrick Schleizer	d521662d04	comment	2023-10-22 16:49:36 -04:00
Patrick Schleizer	0e80acf38d	fix	2023-10-22 16:45:10 -04:00
Patrick Schleizer	5182d7502b	improve remount-secure	2023-10-22 16:08:21 -04:00
Patrick Schleizer	a88c0a3ad2	fix	2023-10-22 15:44:30 -04:00
Patrick Schleizer	a7629b98cf	fix	2023-10-22 15:40:49 -04:00
Patrick Schleizer	7112eac3be	output	2023-10-22 15:37:21 -04:00
Patrick Schleizer	f80b5fe376	fix	2023-10-22 15:36:16 -04:00
Patrick Schleizer	ce0babce21	comment	2023-10-22 15:35:03 -04:00
Patrick Schleizer	70cbe4daaa	fix	2023-10-22 15:33:11 -04:00
Patrick Schleizer	9b9e9ce1c0	fix	2023-10-22 15:27:01 -04:00
Patrick Schleizer	3731716a49	fix	2023-10-22 15:14:22 -04:00
Patrick Schleizer	eec87a0508	fix	2023-10-22 15:11:26 -04:00
Patrick Schleizer	f3286cf440	fix	2023-10-22 15:10:21 -04:00
Patrick Schleizer	eb90d38d8c	fix	2023-10-22 15:05:33 -04:00
Patrick Schleizer	7f03c2b137	fix	2023-10-22 14:45:45 -04:00
Patrick Schleizer	c85db586ca	improve	2023-10-22 14:44:58 -04:00
Patrick Schleizer	7c0ea4324a	fix	2023-10-22 14:39:52 -04:00
Patrick Schleizer	6198ae317c	fix	2023-10-22 14:29:02 -04:00
Patrick Schleizer	245fad0986	fix	2023-10-22 14:00:06 -04:00
Patrick Schleizer	619f1705e1	output	2023-10-22 13:58:55 -04:00
Patrick Schleizer	52fa7db087	output	2023-10-22 13:57:38 -04:00
Patrick Schleizer	8a592c2e37	fix remountsecure kernel parameter logic	2023-10-22 13:56:17 -04:00
Patrick Schleizer	e689f38ad0	todo	2023-10-22 13:31:44 -04:00
Patrick Schleizer	6675a2e931	fix	2023-10-22 13:30:50 -04:00
Patrick Schleizer	4288e10554	fix, rework remount-secure kernel parameters parsing	2023-10-22 13:25:31 -04:00
Patrick Schleizer	b0181af099	fix	2023-10-22 13:12:25 -04:00
Patrick Schleizer	28cb53341d	remount-secure dracut module: improve output	2023-10-22 13:11:44 -04:00
Patrick Schleizer	84ca0ac8a0	improve remount-secure	2023-10-22 12:54:25 -04:00
Patrick Schleizer	e7d30955e8	debugging	2023-10-22 11:28:08 -04:00
Patrick Schleizer	8eb4607a0e	improve	2023-10-22 11:12:54 -04:00
Patrick Schleizer	f1da0ce746	fix	2023-10-22 11:11:10 -04:00
Patrick Schleizer	26826e8398	fix	2023-10-22 11:06:34 -04:00
Patrick Schleizer	233fa4625b	output	2023-10-22 10:49:53 -04:00
Patrick Schleizer	3ebe8cf4de	refactoring	2023-10-22 10:41:42 -04:00
Patrick Schleizer	24d2e26397	no longer reproducible	2023-10-22 10:40:19 -04:00
Patrick Schleizer	fcba70df2e	refactoring	2023-10-22 10:38:48 -04:00
Patrick Schleizer	a05bd3dd0e	/home last because most likely to fail	2023-10-22 10:37:02 -04:00
Patrick Schleizer	41077c94fb	improve remount-secure	2023-10-22 10:32:24 -04:00
Patrick Schleizer	ef69e512bd	refactoring	2023-10-22 10:25:57 -04:00
Patrick Schleizer	d5cb7ecec9	use findmnt	2023-10-22 10:22:21 -04:00
Patrick Schleizer	45ce0ff74d	debugging	2023-10-22 10:16:43 -04:00
Patrick Schleizer	b81a991731	fix	2023-10-22 10:15:11 -04:00
Patrick Schleizer	292a5c3a8a	fix	2023-10-22 10:11:31 -04:00
Patrick Schleizer	bb57b1a289	fix	2023-10-22 10:10:51 -04:00
Patrick Schleizer	181a642479	root check	2023-10-22 10:01:38 -04:00
Patrick Schleizer	84fd41931c	/var/run -> /run	2023-10-22 09:44:17 -04:00