Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity
1,285 Commits 2 Branches 291 Tags 8.2 MiB
f5b0e4b5b8
Commit Graph

1285 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
madaidan
2796c2dd00
Update control 2020-02-12 18:43:19 +00:00
madaidan
700c7ed908
Create 40_cpu_mitigations.cfg 2020-02-12 18:42:13 +00:00
madaidan
ba0043b8a7
Update 40_kernel_hardening.cfg 2020-02-12 18:36:05 +00:00
madaidan
14f8458374
Update control 2020-02-12 18:05:32 +00:00
madaidan
5cb21d0d4d
Prevent symlink/hardlink TOCTOU races 2020-02-12 18:03:23 +00:00
Patrick Schleizer
163e20b886
bumped changelog version 2020-02-05 06:31:48 -05:00
Patrick Schleizer
3024006f63
Merge remote-tracking branch 'origin/master' 2020-02-04 00:24:50 -05:00
Patrick Schleizer
024576e330
Merge pull request #56 from HulaHoop0/patch-1 
kvm.nx_huge_pages=force
 2020-02-04 05:24:05 +00:00
HulaHoop0
e4c6e897cf
kvm.nx_huge_pages=force 2020-02-03 16:06:46 +00:00
Patrick Schleizer
8c5cd865f4
bumped changelog version 2020-02-03 09:23:13 -05:00
Patrick Schleizer
1f6ed2cc70
add support for passing parameters to usr/lib/security-misc/apt-get-update 2020-02-03 08:55:20 -05:00
Patrick Schleizer
2291b7f787
bumped changelog version 2020-02-03 08:43:31 -05:00
Patrick Schleizer
8627c9f76d
/usr/lib/security-misc/apt-get-update increase default timeout_after="600" 2020-01-31 12:18:02 -05:00
Patrick Schleizer
829e28aa90
/usr/lib/security-misc/apt-get-update environment variable timeout_after kill_after support 2020-01-31 12:17:07 -05:00
Patrick Schleizer
0bd0a4a647
bumped changelog version 2020-01-30 06:14:34 -05:00
Patrick Schleizer
85d2aa1365
hide stdout (but not stderr) by sysctl during initramfs 2020-01-30 06:13:42 -05:00
Patrick Schleizer
d69c1839cd
bumped changelog version 2020-01-30 06:02:26 -05:00
Patrick Schleizer
b9d65338bc
unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...) 
this might reduce performance

* `spectre_v2=on`
* `spec_store_bypass_disable=on`
* `tsx=off`
* `tsx_async_abort=full,nosmt`

Thanks to @madaidan for the suggestion!

https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647
 2020-01-30 05:55:13 -05:00
Patrick Schleizer
2711d0f7f0
bumped changelog version 2020-01-30 01:22:32 -05:00
Patrick Schleizer
4df0d6c01c
readme 2020-01-30 01:22:06 -05:00
Patrick Schleizer
c1a0da60be
set kernel boot parameter l1tf=full,force and nosmt=force 
https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
 2020-01-30 00:46:48 -05:00
Patrick Schleizer
efc40da4fb
bumped changelog version 2020-01-24 12:02:27 -05:00
Patrick Schleizer
07dcb32fc2
readme 2020-01-24 11:55:38 -05:00
Patrick Schleizer
f4c54881ac
description 2020-01-24 04:49:19 -05:00
Patrick Schleizer
25317f23e3
bumped changelog version 2020-01-24 04:41:16 -05:00
Patrick Schleizer
be79f0688a
readme 2020-01-24 04:40:20 -05:00
Patrick Schleizer
c0d3726b00
comment 2020-01-24 04:40:03 -05:00
Patrick Schleizer
a37da1c968
add digits to drop-in file names 2020-01-24 04:39:06 -05:00
Patrick Schleizer
2ab940c603
bumped changelog version 2020-01-24 04:34:18 -05:00
Patrick Schleizer
bac6cd601b
readme 2020-01-24 04:33:54 -05:00
Patrick Schleizer
3a4d283169
description 2020-01-24 04:33:30 -05:00
Patrick Schleizer
e0aa67677d
merge the many modprobe.d config files into 1 
and use a name starting with double digits

to make it easier to disable settings using a lexically higher config file
 2020-01-24 04:30:36 -05:00
Patrick Schleizer
6a4c493213
merge the many sysctl config files into 1 
and use a name starting with double digits

to make it easier to disable settings using a lexically higher config file
 2020-01-24 04:26:36 -05:00
Patrick Schleizer
f653b94e77
bumped changelog version 2020-01-24 03:49:02 -05:00
Patrick Schleizer
ca057713e2
readme 2020-01-24 03:39:04 -05:00
Patrick Schleizer
8616728ce0
remove duplicate 2020-01-24 03:35:15 -05:00
Patrick Schleizer
d4a37b6df2
remove-system.map: source /usr/lib/helper-scripts/pre.bsh 2020-01-24 03:18:17 -05:00
Patrick Schleizer
3b283ec00f
bumped changelog version 2020-01-22 07:10:47 -05:00
Patrick Schleizer
531f17cb68
add update initramfs trigger 
https://github.com/Whonix/security-misc/pull/53
 2020-01-22 07:08:31 -05:00
Patrick Schleizer
df0b2afda1
bumped changelog version 2020-01-21 10:12:32 -05:00
Patrick Schleizer
18041efa2f
fix pam tally2 check when read-only disk boot without ro-mode-init or grub-live 2020-01-21 10:01:17 -05:00
Patrick Schleizer
627b95e0b3
bumped changelog version 2020-01-20 08:51:25 -05:00
Patrick Schleizer
fbe9b60d95
fix Whonix / Kicksecure 
/var/lib/dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted.
/var/lib/dpkg/tmp.ci/preinst: ERROR: You probably want to run:

sudo adduser user console
 2020-01-20 08:49:02 -05:00
Patrick Schleizer
960e1ff6e8
bumped changelog version 2020-01-17 03:32:57 -05:00
Patrick Schleizer
1304341868
readme 2020-01-17 03:10:56 -05:00
Patrick Schleizer
6f8d89c6c5
error handling 2020-01-15 15:54:06 -05:00
Patrick Schleizer
7211f6e019
Merge remote-tracking branch 'origin/master' 2020-01-15 15:53:36 -05:00
Patrick Schleizer
f6cc76acd7
Merge pull request #55 from madaidan/sysctl.conf 
Process sysctl.conf in initramfs
 2020-01-15 20:52:33 +00:00
madaidan
1df48a226d
Update control 2020-01-15 20:30:17 +00:00
madaidan
f7fde60b67
Process sysctl.conf too 2020-01-15 20:28:32 +00:00