425 Commits

Author	SHA1	Message	Date
Patrick Schleizer	c29b21c08a	output	2022-07-02 15:45:19 -04:00
Patrick Schleizer	d34fe21963	fix	2022-07-02 15:32:42 -04:00
Patrick Schleizer	32fdcf522b	- introduce wiperam=skip kernel parameter to skip wipe ram ... - introduce `wiperam=force` kernel parameter to force wipe ram inside VMs	2022-06-30 14:47:45 -04:00
Patrick Schleizer	036f518ddc	improvement	2022-06-30 13:56:29 -04:00
Patrick Schleizer	0e2fae2b69	skip ram wipe inside VMs ... https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596/40	2022-06-30 13:50:18 -04:00
Patrick Schleizer	e06405c7be	undo	2022-06-29 16:56:16 -04:00
Patrick Schleizer	1b97d9cb76	fix	2022-06-29 16:30:31 -04:00
Patrick Schleizer	92c543e71f	output	2022-06-29 16:24:52 -04:00
Patrick Schleizer	d4161b2748	output	2022-06-29 16:23:42 -04:00
Patrick Schleizer	1ce7b27297	improvement	2022-06-29 16:23:12 -04:00
Patrick Schleizer	f5e0c1742a	credits	2022-06-29 16:02:05 -04:00
Patrick Schleizer	42e24f3c24	update file names	2022-06-29 15:54:49 -04:00
Patrick Schleizer	52aaac9b6d	rename	2022-06-29 15:53:52 -04:00
Patrick Schleizer	619bb3cf4d	rename	2022-06-29 15:53:24 -04:00
Patrick Schleizer	2a8504cf1b	move	2022-06-29 15:51:14 -04:00
Patrick Schleizer	af8b211c23	improvements	2022-06-29 15:50:20 -04:00
Patrick Schleizer	e9cd5d934b	copyright	2022-06-29 15:24:27 -04:00
Patrick Schleizer	9ab81d4581	do not power off too fast so wipe ram messages can be read	2022-06-29 15:22:00 -04:00
Patrick Schleizer	19439033de	copyright	2022-06-29 15:19:56 -04:00
Patrick Schleizer	fc202ede16	delete no longer required usr/lib/dracut/modules.d/40sdmem-security-misc/README.md	2022-06-29 15:18:28 -04:00
Patrick Schleizer	6d3a08a936	improvements	2022-06-29 15:17:40 -04:00
Patrick Schleizer	8a072437cc	ram wipe on shutdown: fix, added need_shutdown hook ... Otherwise dracut does not run on shutdown. Without `need_shutdown` file `/run/initramfs/.need_shutdown` does not get created. And without that file `/usr/lib/dracut/dracut-initramfs-restore`, which itself is started by `/lib/systemd/system/dracut-shutdown.service` does nothing.	2022-06-29 14:13:30 -04:00
Patrick Schleizer	924077e04c	verbose	2022-06-29 13:02:53 -04:00
Patrick Schleizer	db301dfd7f	comment	2022-06-29 13:02:39 -04:00
Patrick Schleizer	73d2ada0de	comment	2022-06-29 13:02:01 -04:00
Patrick Schleizer	295811a88f	improvements	2022-06-29 11:14:52 -04:00
Patrick Schleizer	024d52a67e	improve usr/lib/dracut/modules.d/40sdmem-security-misc/module-setup.sh	2022-06-29 09:52:53 -04:00
Patrick Schleizer	29253004b6	minor	2022-06-29 09:38:18 -04:00
Patrick Schleizer	6f19af1542	add shebang /bin/sh ... to fix lintian warning security-misc: executable-not-elf-or-script usr/lib/dracut/modules.d/40sdmem-security-misc/wipe.sh	2022-06-29 09:35:08 -04:00
Patrick Schleizer	38cdf2722b	- Wipe LUKS Disk Encryption Key for Root Disk from RAM during Shutdown to defeat Cold Boot Attacks ... - Confirm in console output if encrypted mounts (root disk) is unmounted. (Because that is a pre-condition for wiping the LUKS full disk encryption key from RAM.) Thanks to @friedy10! https://github.com/friedy10/dracut/tree/master/modules.d/40sdmem https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596	2022-06-29 09:32:55 -04:00
Patrick Schleizer	2d37e3a1af	copyright	2022-05-20 14:46:38 -04:00
Patrick Schleizer	4fadaad8c0	lintian FHS	2021-08-03 12:52:10 -04:00
Patrick Schleizer	6607c1e4bd	move /usr/lib/helper-scripts and /usr/lib/curl-scripts to /usr/libexec/helper-scripts as per lintian FHS	2021-08-03 12:48:57 -04:00
Patrick Schleizer	240ec7672a	replace no longer required /usr/lib/security-misc/apt-get-wrapper with apt-get --error-on=any	2021-08-03 12:19:26 -04:00
Patrick Schleizer	bb3e65f7a8	bullseye	2021-08-03 03:25:35 -04:00
Patrick Schleizer	74e39cbf69	pam-abort-on-locked-password: more descriptive error handling ... https://forums.whonix.org/t/restrict-root-access/7658/1	2021-06-20 11:18:56 -04:00
Patrick Schleizer	a67007f4b7	copyright	2021-03-17 09:45:21 -04:00
Patrick Schleizer	a1819e8cab	comment	2021-03-01 09:15:44 -05:00
Kenton Groombridge	4db7d6be64	hide-hardware-info: allow unrestricting selinuxfs ... On SELinux systems, the /sys/fs/selinux directory must be visible to userspace utilities in order to function properly.	2021-02-06 03:02:08 -05:00
Patrick Schleizer	af3244741d	comment	2021-01-29 23:15:52 -05:00
Patrick Schleizer	b0b7f569ee	comment	2021-01-28 02:11:54 -05:00
Patrick Schleizer	9622f28e25	skip counting failed login attempts from dovecot ... Failed dovecot logins should not result in account getting locked. revert "use pam_tally2 only for login"	2021-01-27 05:49:34 -05:00
Patrick Schleizer	c5097ed599	comment	2020-12-06 04:23:09 -05:00
Patrick Schleizer	c031f22995	SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists ... `whitelists_disable_all=true`	2020-12-01 05:14:48 -05:00
Patrick Schleizer	b09cc0de6a	Revert "SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists" ... This reverts commit 36a471ebce.	2020-12-01 05:10:26 -05:00
Patrick Schleizer	36a471ebce	SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists ... `whitelists_disable_all=true`	2020-12-01 05:02:34 -05:00
Patrick Schleizer	28a326a8a1	add feature /usr/lib/security-misc/permission-hardening-undo /path/to/filename ... to allow removing 1 SUID fix, show INFO message if file does not exist during removal rather than ERROR	2020-11-28 05:31:12 -05:00
Patrick Schleizer	abae787186	usability: pam abort when attempting to login to root when root password is locked	2020-11-05 06:47:16 -05:00
Patrick Schleizer	581e31af81	comment	2020-11-05 06:46:57 -05:00
Patrick Schleizer	dfe9b0f6c7	fix, no longer unconditionally abort pam for user accounts with locked passwords ... as locked user accounts might have valid sudoers exceptions Thanks to @mimp for the bug report! https://forums.whonix.org/t/pam-abort-on-locked-password-and-running-privileged-command-from-web-browser/10521	2020-11-05 06:42:47 -05:00
Patrick Schleizer	211769dc65	comment	2020-11-05 06:41:51 -05:00
Patrick Schleizer	7952139731	comment	2020-11-05 06:39:32 -05:00
Patrick Schleizer	bb72c1278d	copyright	2020-11-05 06:36:39 -05:00
Patrick Schleizer	1188a44f47	port to python 3.7	2020-04-04 16:49:30 -04:00
Patrick Schleizer	2ceea8d1fe	update copyright year	2020-04-01 08:49:59 -04:00
Patrick Schleizer	9bbae903fe	remove-system.map: lower verbosity output	2020-02-15 05:29:48 -05:00
madaidan	31009f0bfa	Shred System.map files	2020-02-14 23:46:19 +00:00
Patrick Schleizer	1f6ed2cc70	add support for passing parameters to usr/lib/security-misc/apt-get-update	2020-02-03 08:55:20 -05:00
Patrick Schleizer	8627c9f76d	/usr/lib/security-misc/apt-get-update increase default timeout_after="600"	2020-01-31 12:18:02 -05:00
Patrick Schleizer	829e28aa90	/usr/lib/security-misc/apt-get-update environment variable timeout_after kill_after support	2020-01-31 12:17:07 -05:00
Patrick Schleizer	d4a37b6df2	remove-system.map: source /usr/lib/helper-scripts/pre.bsh	2020-01-24 03:18:17 -05:00
Patrick Schleizer	18041efa2f	fix pam tally2 check when read-only disk boot without ro-mode-init or grub-live	2020-01-21 10:01:17 -05:00
Patrick Schleizer	5031e7cc4b	better output if trying to login with non-existing user	2019-12-31 08:18:38 -05:00
Patrick Schleizer	20697db3ee	improve console lockdown info output	2019-12-31 02:53:02 -05:00
Patrick Schleizer	788914de95	group ssh check was removed ... https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/27	2019-12-31 02:46:32 -05:00
Patrick Schleizer	1a0f7a7733	debugging	2019-12-29 04:43:32 -05:00
Patrick Schleizer	5271892cb1	debugging	2019-12-29 04:42:54 -05:00
Patrick Schleizer	683028049c	debugging	2019-12-29 04:41:23 -05:00
Patrick Schleizer	e3e1ff2a31	exit with error if a config line cannot be processed rather than skipping ... https://forums.whonix.org/t/disable-suid-binaries/7706/59	2019-12-29 04:35:46 -05:00
Patrick Schleizer	d5c99f3a60	output	2019-12-29 04:27:21 -05:00
Patrick Schleizer	04f438f75d	comment	2019-12-24 18:09:37 -05:00
Patrick Schleizer	9da0e428ed	debugging	2019-12-24 17:54:31 -05:00
Patrick Schleizer	e18ec533c3	comment	2019-12-24 17:54:02 -05:00
Patrick Schleizer	f8f2e6c704	fix disablewhitelist feature	2019-12-23 02:35:13 -05:00
Patrick Schleizer	47ddcad0c0	rename keyword whitelist to exactwhitelist ... add new keyword disablewhitelist refactoring	2019-12-23 02:29:47 -05:00
Patrick Schleizer	34bf245713	output	2019-12-23 01:35:45 -05:00
Patrick Schleizer	ba30e45d15	output	2019-12-23 01:32:42 -05:00
Patrick Schleizer	ee9c5742da	output	2019-12-23 01:29:48 -05:00
Patrick Schleizer	6d05359abc	output	2019-12-23 01:21:52 -05:00
Patrick Schleizer	a1e78e8515	fix needlessly re-adding entries	2019-12-23 01:20:56 -05:00
Patrick Schleizer	906b3d32e7	output	2019-12-23 01:09:57 -05:00
Patrick Schleizer	4f76867da6	lower debugging	2019-12-23 01:08:02 -05:00
Patrick Schleizer	dc6e5d8508	fix	2019-12-23 01:06:38 -05:00
Patrick Schleizer	87b999f92a	refactoring	2019-12-23 00:59:43 -05:00
Patrick Schleizer	065ff4bd05	sanity_tests	2019-12-23 00:59:24 -05:00
Patrick Schleizer	fef1469fe6	exit non-zero if capability removal failed	2019-12-23 00:51:14 -05:00
Patrick Schleizer	17a8c29470	fix capability removal error handling ... https://forums.whonix.org/t/disable-suid-binaries/7706/45	2019-12-23 00:47:49 -05:00
Patrick Schleizer	b631e2ecd8	refactoring	2019-12-23 00:36:41 -05:00
Patrick Schleizer	7aea304549	comment	2019-12-23 00:26:15 -05:00
Patrick Schleizer	f4b1df02ee	Remove suid / gid and execute permission for 'group' and 'others'. ... Similar to: chmod og-ugx /path/to/filename Removing execution permission is useful to make binaries such as 'su' fail closed rather than fail open if suid was removed from these. Do not remove read access since no security benefit and easier to manually undo for users. chmod 744	2019-12-22 19:42:40 -05:00
Patrick Schleizer	d300db3cde	output	2019-12-21 14:45:11 -05:00
Patrick Schleizer	3921846df6	comment	2019-12-21 14:36:42 -05:00
Patrick Schleizer	1e8457ea47	no longer remount /lib ... https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25	2019-12-21 14:06:10 -05:00
Patrick Schleizer	10c19d6a8f	Merge remote-tracking branch 'origin/master'	2019-12-21 13:00:41 -05:00
madaidan	f5a52aeddc	Don't remount /sys/kernel/security	2019-12-21 14:55:28 +00:00
Patrick Schleizer	b2260f48f4	add support for /etc/exec / /usr/local/etc/exec ... to allow enabling exec on a per VM basis	2019-12-21 08:03:33 -05:00
Patrick Schleizer	b74e5ca972	comment	2019-12-21 07:47:00 -05:00
Patrick Schleizer	8fb17624bc	comment	2019-12-21 07:44:51 -05:00
Patrick Schleizer	aef796a524	disable debugging	2019-12-21 07:44:23 -05:00
Patrick Schleizer	1fe83d683f	comment	2019-12-21 07:43:55 -05:00
Patrick Schleizer	7c3da38bd5	comment	2019-12-21 07:42:25 -05:00
Patrick Schleizer	9050058bc2	fix	2019-12-21 07:42:01 -05:00
Patrick Schleizer	6b13a644df	add /usr/lib/security-misc/permission-hardening-undo	2019-12-21 07:37:41 -05:00
Patrick Schleizer	c336bc4fd2	comment	2019-12-21 06:39:13 -05:00
Patrick Schleizer	b5f88efe20	fix	2019-12-21 06:27:01 -05:00
Patrick Schleizer	2088628c8d	debugging	2019-12-21 06:24:08 -05:00
Patrick Schleizer	2dca031527	debugging	2019-12-21 06:22:46 -05:00
Patrick Schleizer	195e00cc87	output	2019-12-21 06:16:38 -05:00
Patrick Schleizer	4b21b6df41	fix	2019-12-21 06:11:44 -05:00
Patrick Schleizer	8436da2b7b	output	2019-12-21 05:58:50 -05:00
Patrick Schleizer	da15265e1c	fix	2019-12-21 05:55:23 -05:00
Patrick Schleizer	2a248fe0de	fix	2019-12-21 05:54:39 -05:00
Patrick Schleizer	4f12664362	output	2019-12-21 05:54:07 -05:00
Patrick Schleizer	e3355843c8	fix	2019-12-21 05:51:22 -05:00
Patrick Schleizer	234ec5fe93	fix	2019-12-21 05:47:35 -05:00
Patrick Schleizer	7ff900c204	fix	2019-12-21 05:37:43 -05:00
Patrick Schleizer	e1a5ee4bcf	output	2019-12-21 05:26:55 -05:00
Patrick Schleizer	66aaf3e22c	output	2019-12-21 05:25:54 -05:00
Patrick Schleizer	7aa7d0b5a0	improve error handling	2019-12-21 05:22:27 -05:00
Patrick Schleizer	8919d38de9	disable debugging	2019-12-21 05:21:46 -05:00
Patrick Schleizer	cf5dee64fd	refactoring	2019-12-21 05:18:34 -05:00
Patrick Schleizer	29cd9a0c38	fix	2019-12-21 05:17:35 -05:00
Patrick Schleizer	486027a4d7	fix	2019-12-21 05:15:38 -05:00
Patrick Schleizer	1fd26be864	fix	2019-12-21 05:14:51 -05:00
Patrick Schleizer	0fc97c37be	fix	2019-12-21 05:14:39 -05:00
Patrick Schleizer	1018d5b3b0	output	2019-12-21 05:11:51 -05:00
Patrick Schleizer	4388fc4d5a	refactoring	2019-12-21 05:11:19 -05:00
Patrick Schleizer	ed20980f4c	refactoring	2019-12-21 05:07:10 -05:00
Patrick Schleizer	315ce86b9a	refactoring	2019-12-21 04:33:03 -05:00
Patrick Schleizer	0c5848494b	do not remount if already has intended mount options	2019-12-21 04:21:26 -05:00
Patrick Schleizer	203f4ad46e	refactoring	2019-12-21 04:17:10 -05:00
Patrick Schleizer	e7fd0dadb0	output	2019-12-21 04:09:35 -05:00
Patrick Schleizer	e6ea21c775	record existing modes in separate dpkg-statoverwrite databases ... to have a history of what was modified and to allow to undo changes	2019-12-21 04:08:35 -05:00
Patrick Schleizer	17e8605119	add matchwhitelist feature ... add "/usr/lib/virtualbox/ matchwhitelist"	2019-12-20 12:57:24 -05:00
Patrick Schleizer	1b569ea790	comment	2019-12-20 12:32:36 -05:00
Patrick Schleizer	f88ca25889	fix terminology, sguid -> sgid ... Thanks to @madaidan for the bug report! https://forums.whonix.org/t/permission-hardening/8655/21	2019-12-20 11:58:07 -05:00
Patrick Schleizer	ff0a26fb5d	comment	2019-12-20 11:49:19 -05:00
Patrick Schleizer	71496a33ab	skip folders are these are not suid / guid	2019-12-20 11:47:53 -05:00
Patrick Schleizer	9321ecff41	no more need to add/remove /	2019-12-20 11:43:53 -05:00
Patrick Schleizer	b95225b6a6	pipefail	2019-12-20 11:37:05 -05:00
Patrick Schleizer	cad6f328f4	minor	2019-12-20 11:34:44 -05:00
Patrick Schleizer	3265f9894d	output	2019-12-20 11:27:43 -05:00
Patrick Schleizer	1615ebec58	output	2019-12-20 11:07:44 -05:00
Patrick Schleizer	1e11b775cf	output	2019-12-20 11:05:05 -05:00
Patrick Schleizer	731f802895	output	2019-12-20 11:04:12 -05:00
Patrick Schleizer	cd8efe5800	output	2019-12-20 11:03:22 -05:00
Patrick Schleizer	b31abea0af	improve error handling	2019-12-20 10:49:31 -05:00
Patrick Schleizer	79cd3b86b6	comment	2019-12-20 10:47:23 -05:00
Patrick Schleizer	b3458cc6ee	fix checking existing entries to avoid needless calls to dpkg-statoverride	2019-12-20 10:45:59 -05:00
Patrick Schleizer	370f3c5e54	comment	2019-12-20 10:35:05 -05:00