mirror of
https://github.com/Kicksecure/security-misc.git
synced 2025-04-25 13:09:11 -04:00
Compare commits
No commits in common. "master" and "14.2-1" have entirely different histories.
723
COPYING
723
COPYING
@ -1,668 +1,73 @@
|
|||||||
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
||||||
|
|
||||||
Files: *
|
Files: *
|
||||||
Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
Copyright: 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
License: AGPL-3+
|
License: GPL-3+-with-additional-terms-1
|
||||||
|
This program is free software: you can redistribute it and/or modify
|
||||||
License: AGPL-3+
|
it under the terms of the GNU General Public License as published by
|
||||||
GNU AFFERO GENERAL PUBLIC LICENSE
|
the Free Software Foundation, either version 3 of the License, or
|
||||||
Version 3, 19 November 2007
|
(at your option) any later version.
|
||||||
.
|
.
|
||||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
This program is distributed in the hope that it will be useful,
|
||||||
Everyone is permitted to copy and distribute verbatim copies
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
of this license document, but changing it is not allowed.
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
.
|
GNU General Public License for more details.
|
||||||
Preamble
|
.
|
||||||
.
|
You should have received a copy of the GNU General Public License
|
||||||
The GNU Affero General Public License is a free, copyleft license for
|
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||||
software and other kinds of works, specifically designed to ensure
|
.
|
||||||
cooperation with the community in the case of network server software.
|
On Debian systems, the full text of the GNU General Public
|
||||||
.
|
License version 3 can be found in the file
|
||||||
The licenses for most software and other practical works are designed
|
`/usr/share/common-licenses/GPL-3'.
|
||||||
to take away your freedom to share and change the works. By contrast,
|
.
|
||||||
our General Public Licenses are intended to guarantee your freedom to
|
ADDITIONAL TERMS APPLICABLE per GNU GPL version 3 section 7
|
||||||
share and change all versions of a program--to make sure it remains free
|
.
|
||||||
software for all its users.
|
1. Replacement of Section 15. Section 15 of the GPL shall be deleted in its
|
||||||
.
|
entirety and replaced with the following:
|
||||||
When we speak of free software, we are referring to freedom, not
|
.
|
||||||
price. Our General Public Licenses are designed to make sure that you
|
15. Disclaimer of Warranty.
|
||||||
have the freedom to distribute copies of free software (and charge for
|
.
|
||||||
them if you wish), that you receive source code or can get it if you
|
THE PROGRAM IS PROVIDED WITHOUT ANY WARRANTIES, WHETHER EXPRESSED OR IMPLIED,
|
||||||
want it, that you can change the software or use pieces of it in new
|
INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR
|
||||||
free programs, and that you know you can do these things.
|
PURPOSE, NON-INFRINGEMENT, TITLE AND MERCHANTABILITY. THE PROGRAM IS BEING
|
||||||
.
|
DELIVERED OR MADE AVAILABLE 'AS IS', 'WITH ALL FAULTS' AND WITHOUT WARRANTY OR
|
||||||
Developers that use our General Public Licenses protect your rights
|
REPRESENTATION. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||||
with two steps: (1) assert copyright on the software, and (2) offer
|
PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||||
you this License which gives you legal permission to copy, distribute
|
|
||||||
and/or modify the software.
|
|
||||||
.
|
|
||||||
A secondary benefit of defending all users' freedom is that
|
|
||||||
improvements made in alternate versions of the program, if they
|
|
||||||
receive widespread use, become available for other developers to
|
|
||||||
incorporate. Many developers of free software are heartened and
|
|
||||||
encouraged by the resulting cooperation. However, in the case of
|
|
||||||
software used on network servers, this result may fail to come about.
|
|
||||||
The GNU General Public License permits making a modified version and
|
|
||||||
letting the public access it on a server without ever releasing its
|
|
||||||
source code to the public.
|
|
||||||
.
|
|
||||||
The GNU Affero General Public License is designed specifically to
|
|
||||||
ensure that, in such cases, the modified source code becomes available
|
|
||||||
to the community. It requires the operator of a network server to
|
|
||||||
provide the source code of the modified version running there to the
|
|
||||||
users of that server. Therefore, public use of a modified version, on
|
|
||||||
a publicly accessible server, gives the public access to the source
|
|
||||||
code of the modified version.
|
|
||||||
.
|
|
||||||
An older license, called the Affero General Public License and
|
|
||||||
published by Affero, was designed to accomplish similar goals. This is
|
|
||||||
a different license, not a version of the Affero GPL, but Affero has
|
|
||||||
released a new version of the Affero GPL which permits relicensing under
|
|
||||||
this license.
|
|
||||||
.
|
|
||||||
The precise terms and conditions for copying, distribution and
|
|
||||||
modification follow.
|
|
||||||
.
|
|
||||||
TERMS AND CONDITIONS
|
|
||||||
.
|
|
||||||
0. Definitions.
|
|
||||||
.
|
|
||||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
|
||||||
.
|
|
||||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
|
||||||
works, such as semiconductor masks.
|
|
||||||
.
|
|
||||||
"The Program" refers to any copyrightable work licensed under this
|
|
||||||
License. Each licensee is addressed as "you". "Licensees" and
|
|
||||||
"recipients" may be individuals or organizations.
|
|
||||||
.
|
|
||||||
To "modify" a work means to copy from or adapt all or part of the work
|
|
||||||
in a fashion requiring copyright permission, other than the making of an
|
|
||||||
exact copy. The resulting work is called a "modified version" of the
|
|
||||||
earlier work or a work "based on" the earlier work.
|
|
||||||
.
|
|
||||||
A "covered work" means either the unmodified Program or a work based
|
|
||||||
on the Program.
|
|
||||||
.
|
|
||||||
To "propagate" a work means to do anything with it that, without
|
|
||||||
permission, would make you directly or secondarily liable for
|
|
||||||
infringement under applicable copyright law, except executing it on a
|
|
||||||
computer or modifying a private copy. Propagation includes copying,
|
|
||||||
distribution (with or without modification), making available to the
|
|
||||||
public, and in some countries other activities as well.
|
|
||||||
.
|
|
||||||
To "convey" a work means any kind of propagation that enables other
|
|
||||||
parties to make or receive copies. Mere interaction with a user through
|
|
||||||
a computer network, with no transfer of a copy, is not conveying.
|
|
||||||
.
|
|
||||||
An interactive user interface displays "Appropriate Legal Notices"
|
|
||||||
to the extent that it includes a convenient and prominently visible
|
|
||||||
feature that (1) displays an appropriate copyright notice, and (2)
|
|
||||||
tells the user that there is no warranty for the work (except to the
|
|
||||||
extent that warranties are provided), that licensees may convey the
|
|
||||||
work under this License, and how to view a copy of this License. If
|
|
||||||
the interface presents a list of user commands or options, such as a
|
|
||||||
menu, a prominent item in the list meets this criterion.
|
|
||||||
.
|
|
||||||
1. Source Code.
|
|
||||||
.
|
|
||||||
The "source code" for a work means the preferred form of the work
|
|
||||||
for making modifications to it. "Object code" means any non-source
|
|
||||||
form of a work.
|
|
||||||
.
|
|
||||||
A "Standard Interface" means an interface that either is an official
|
|
||||||
standard defined by a recognized standards body, or, in the case of
|
|
||||||
interfaces specified for a particular programming language, one that
|
|
||||||
is widely used among developers working in that language.
|
|
||||||
.
|
|
||||||
The "System Libraries" of an executable work include anything, other
|
|
||||||
than the work as a whole, that (a) is included in the normal form of
|
|
||||||
packaging a Major Component, but which is not part of that Major
|
|
||||||
Component, and (b) serves only to enable use of the work with that
|
|
||||||
Major Component, or to implement a Standard Interface for which an
|
|
||||||
implementation is available to the public in source code form. A
|
|
||||||
"Major Component", in this context, means a major essential component
|
|
||||||
(kernel, window system, and so on) of the specific operating system
|
|
||||||
(if any) on which the executable work runs, or a compiler used to
|
|
||||||
produce the work, or an object code interpreter used to run it.
|
|
||||||
.
|
|
||||||
The "Corresponding Source" for a work in object code form means all
|
|
||||||
the source code needed to generate, install, and (for an executable
|
|
||||||
work) run the object code and to modify the work, including scripts to
|
|
||||||
control those activities. However, it does not include the work's
|
|
||||||
System Libraries, or general-purpose tools or generally available free
|
|
||||||
programs which are used unmodified in performing those activities but
|
|
||||||
which are not part of the work. For example, Corresponding Source
|
|
||||||
includes interface definition files associated with source files for
|
|
||||||
the work, and the source code for shared libraries and dynamically
|
|
||||||
linked subprograms that the work is specifically designed to require,
|
|
||||||
such as by intimate data communication or control flow between those
|
|
||||||
subprograms and other parts of the work.
|
|
||||||
.
|
|
||||||
The Corresponding Source need not include anything that users
|
|
||||||
can regenerate automatically from other parts of the Corresponding
|
|
||||||
Source.
|
|
||||||
.
|
|
||||||
The Corresponding Source for a work in source code form is that
|
|
||||||
same work.
|
|
||||||
.
|
|
||||||
2. Basic Permissions.
|
|
||||||
.
|
|
||||||
All rights granted under this License are granted for the term of
|
|
||||||
copyright on the Program, and are irrevocable provided the stated
|
|
||||||
conditions are met. This License explicitly affirms your unlimited
|
|
||||||
permission to run the unmodified Program. The output from running a
|
|
||||||
covered work is covered by this License only if the output, given its
|
|
||||||
content, constitutes a covered work. This License acknowledges your
|
|
||||||
rights of fair use or other equivalent, as provided by copyright law.
|
|
||||||
.
|
|
||||||
You may make, run and propagate covered works that you do not
|
|
||||||
convey, without conditions so long as your license otherwise remains
|
|
||||||
in force. You may convey covered works to others for the sole purpose
|
|
||||||
of having them make modifications exclusively for you, or provide you
|
|
||||||
with facilities for running those works, provided that you comply with
|
|
||||||
the terms of this License in conveying all material for which you do
|
|
||||||
not control copyright. Those thus making or running the covered works
|
|
||||||
for you must do so exclusively on your behalf, under your direction
|
|
||||||
and control, on terms that prohibit them from making any copies of
|
|
||||||
your copyrighted material outside their relationship with you.
|
|
||||||
.
|
|
||||||
Conveying under any other circumstances is permitted solely under
|
|
||||||
the conditions stated below. Sublicensing is not allowed; section 10
|
|
||||||
makes it unnecessary.
|
|
||||||
.
|
|
||||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
|
||||||
.
|
|
||||||
No covered work shall be deemed part of an effective technological
|
|
||||||
measure under any applicable law fulfilling obligations under article
|
|
||||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
|
||||||
similar laws prohibiting or restricting circumvention of such
|
|
||||||
measures.
|
|
||||||
.
|
|
||||||
When you convey a covered work, you waive any legal power to forbid
|
|
||||||
circumvention of technological measures to the extent such circumvention
|
|
||||||
is effected by exercising rights under this License with respect to
|
|
||||||
the covered work, and you disclaim any intention to limit operation or
|
|
||||||
modification of the work as a means of enforcing, against the work's
|
|
||||||
users, your or third parties' legal rights to forbid circumvention of
|
|
||||||
technological measures.
|
|
||||||
.
|
|
||||||
4. Conveying Verbatim Copies.
|
|
||||||
.
|
|
||||||
You may convey verbatim copies of the Program's source code as you
|
|
||||||
receive it, in any medium, provided that you conspicuously and
|
|
||||||
appropriately publish on each copy an appropriate copyright notice;
|
|
||||||
keep intact all notices stating that this License and any
|
|
||||||
non-permissive terms added in accord with section 7 apply to the code;
|
|
||||||
keep intact all notices of the absence of any warranty; and give all
|
|
||||||
recipients a copy of this License along with the Program.
|
|
||||||
.
|
|
||||||
You may charge any price or no price for each copy that you convey,
|
|
||||||
and you may offer support or warranty protection for a fee.
|
|
||||||
.
|
|
||||||
5. Conveying Modified Source Versions.
|
|
||||||
.
|
|
||||||
You may convey a work based on the Program, or the modifications to
|
|
||||||
produce it from the Program, in the form of source code under the
|
|
||||||
terms of section 4, provided that you also meet all of these conditions:
|
|
||||||
.
|
|
||||||
a) The work must carry prominent notices stating that you modified
|
|
||||||
it, and giving a relevant date.
|
|
||||||
.
|
|
||||||
b) The work must carry prominent notices stating that it is
|
|
||||||
released under this License and any conditions added under section
|
|
||||||
7. This requirement modifies the requirement in section 4 to
|
|
||||||
"keep intact all notices".
|
|
||||||
.
|
|
||||||
c) You must license the entire work, as a whole, under this
|
|
||||||
License to anyone who comes into possession of a copy. This
|
|
||||||
License will therefore apply, along with any applicable section 7
|
|
||||||
additional terms, to the whole of the work, and all its parts,
|
|
||||||
regardless of how they are packaged. This License gives no
|
|
||||||
permission to license the work in any other way, but it does not
|
|
||||||
invalidate such permission if you have separately received it.
|
|
||||||
.
|
|
||||||
d) If the work has interactive user interfaces, each must display
|
|
||||||
Appropriate Legal Notices; however, if the Program has interactive
|
|
||||||
interfaces that do not display Appropriate Legal Notices, your
|
|
||||||
work need not make them do so.
|
|
||||||
.
|
|
||||||
A compilation of a covered work with other separate and independent
|
|
||||||
works, which are not by their nature extensions of the covered work,
|
|
||||||
and which are not combined with it such as to form a larger program,
|
|
||||||
in or on a volume of a storage or distribution medium, is called an
|
|
||||||
"aggregate" if the compilation and its resulting copyright are not
|
|
||||||
used to limit the access or legal rights of the compilation's users
|
|
||||||
beyond what the individual works permit. Inclusion of a covered work
|
|
||||||
in an aggregate does not cause this License to apply to the other
|
|
||||||
parts of the aggregate.
|
|
||||||
.
|
|
||||||
6. Conveying Non-Source Forms.
|
|
||||||
.
|
|
||||||
You may convey a covered work in object code form under the terms
|
|
||||||
of sections 4 and 5, provided that you also convey the
|
|
||||||
machine-readable Corresponding Source under the terms of this License,
|
|
||||||
in one of these ways:
|
|
||||||
.
|
|
||||||
a) Convey the object code in, or embodied in, a physical product
|
|
||||||
(including a physical distribution medium), accompanied by the
|
|
||||||
Corresponding Source fixed on a durable physical medium
|
|
||||||
customarily used for software interchange.
|
|
||||||
.
|
|
||||||
b) Convey the object code in, or embodied in, a physical product
|
|
||||||
(including a physical distribution medium), accompanied by a
|
|
||||||
written offer, valid for at least three years and valid for as
|
|
||||||
long as you offer spare parts or customer support for that product
|
|
||||||
model, to give anyone who possesses the object code either (1) a
|
|
||||||
copy of the Corresponding Source for all the software in the
|
|
||||||
product that is covered by this License, on a durable physical
|
|
||||||
medium customarily used for software interchange, for a price no
|
|
||||||
more than your reasonable cost of physically performing this
|
|
||||||
conveying of source, or (2) access to copy the
|
|
||||||
Corresponding Source from a network server at no charge.
|
|
||||||
.
|
|
||||||
c) Convey individual copies of the object code with a copy of the
|
|
||||||
written offer to provide the Corresponding Source. This
|
|
||||||
alternative is allowed only occasionally and noncommercially, and
|
|
||||||
only if you received the object code with such an offer, in accord
|
|
||||||
with subsection 6b.
|
|
||||||
.
|
|
||||||
d) Convey the object code by offering access from a designated
|
|
||||||
place (gratis or for a charge), and offer equivalent access to the
|
|
||||||
Corresponding Source in the same way through the same place at no
|
|
||||||
further charge. You need not require recipients to copy the
|
|
||||||
Corresponding Source along with the object code. If the place to
|
|
||||||
copy the object code is a network server, the Corresponding Source
|
|
||||||
may be on a different server (operated by you or a third party)
|
|
||||||
that supports equivalent copying facilities, provided you maintain
|
|
||||||
clear directions next to the object code saying where to find the
|
|
||||||
Corresponding Source. Regardless of what server hosts the
|
|
||||||
Corresponding Source, you remain obligated to ensure that it is
|
|
||||||
available for as long as needed to satisfy these requirements.
|
|
||||||
.
|
|
||||||
e) Convey the object code using peer-to-peer transmission, provided
|
|
||||||
you inform other peers where the object code and Corresponding
|
|
||||||
Source of the work are being offered to the general public at no
|
|
||||||
charge under subsection 6d.
|
|
||||||
.
|
|
||||||
A separable portion of the object code, whose source code is excluded
|
|
||||||
from the Corresponding Source as a System Library, need not be
|
|
||||||
included in conveying the object code work.
|
|
||||||
.
|
|
||||||
A "User Product" is either (1) a "consumer product", which means any
|
|
||||||
tangible personal property which is normally used for personal, family,
|
|
||||||
or household purposes, or (2) anything designed or sold for incorporation
|
|
||||||
into a dwelling. In determining whether a product is a consumer product,
|
|
||||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
|
||||||
product received by a particular user, "normally used" refers to a
|
|
||||||
typical or common use of that class of product, regardless of the status
|
|
||||||
of the particular user or of the way in which the particular user
|
|
||||||
actually uses, or expects or is expected to use, the product. A product
|
|
||||||
is a consumer product regardless of whether the product has substantial
|
|
||||||
commercial, industrial or non-consumer uses, unless such uses represent
|
|
||||||
the only significant mode of use of the product.
|
|
||||||
.
|
|
||||||
"Installation Information" for a User Product means any methods,
|
|
||||||
procedures, authorization keys, or other information required to install
|
|
||||||
and execute modified versions of a covered work in that User Product from
|
|
||||||
a modified version of its Corresponding Source. The information must
|
|
||||||
suffice to ensure that the continued functioning of the modified object
|
|
||||||
code is in no case prevented or interfered with solely because
|
|
||||||
modification has been made.
|
|
||||||
.
|
|
||||||
If you convey an object code work under this section in, or with, or
|
|
||||||
specifically for use in, a User Product, and the conveying occurs as
|
|
||||||
part of a transaction in which the right of possession and use of the
|
|
||||||
User Product is transferred to the recipient in perpetuity or for a
|
|
||||||
fixed term (regardless of how the transaction is characterized), the
|
|
||||||
Corresponding Source conveyed under this section must be accompanied
|
|
||||||
by the Installation Information. But this requirement does not apply
|
|
||||||
if neither you nor any third party retains the ability to install
|
|
||||||
modified object code on the User Product (for example, the work has
|
|
||||||
been installed in ROM).
|
|
||||||
.
|
|
||||||
The requirement to provide Installation Information does not include a
|
|
||||||
requirement to continue to provide support service, warranty, or updates
|
|
||||||
for a work that has been modified or installed by the recipient, or for
|
|
||||||
the User Product in which it has been modified or installed. Access to a
|
|
||||||
network may be denied when the modification itself materially and
|
|
||||||
adversely affects the operation of the network or violates the rules and
|
|
||||||
protocols for communication across the network.
|
|
||||||
.
|
|
||||||
Corresponding Source conveyed, and Installation Information provided,
|
|
||||||
in accord with this section must be in a format that is publicly
|
|
||||||
documented (and with an implementation available to the public in
|
|
||||||
source code form), and must require no special password or key for
|
|
||||||
unpacking, reading or copying.
|
|
||||||
.
|
|
||||||
7. Additional Terms.
|
|
||||||
.
|
|
||||||
"Additional permissions" are terms that supplement the terms of this
|
|
||||||
License by making exceptions from one or more of its conditions.
|
|
||||||
Additional permissions that are applicable to the entire Program shall
|
|
||||||
be treated as though they were included in this License, to the extent
|
|
||||||
that they are valid under applicable law. If additional permissions
|
|
||||||
apply only to part of the Program, that part may be used separately
|
|
||||||
under those permissions, but the entire Program remains governed by
|
|
||||||
this License without regard to the additional permissions.
|
|
||||||
.
|
|
||||||
When you convey a copy of a covered work, you may at your option
|
|
||||||
remove any additional permissions from that copy, or from any part of
|
|
||||||
it. (Additional permissions may be written to require their own
|
|
||||||
removal in certain cases when you modify the work.) You may place
|
|
||||||
additional permissions on material, added by you to a covered work,
|
|
||||||
for which you have or can give appropriate copyright permission.
|
|
||||||
.
|
|
||||||
Notwithstanding any other provision of this License, for material you
|
|
||||||
add to a covered work, you may (if authorized by the copyright holders of
|
|
||||||
that material) supplement the terms of this License with terms:
|
|
||||||
.
|
|
||||||
a) Disclaiming warranty or limiting liability differently from the
|
|
||||||
terms of sections 15 and 16 of this License; or
|
|
||||||
.
|
|
||||||
b) Requiring preservation of specified reasonable legal notices or
|
|
||||||
author attributions in that material or in the Appropriate Legal
|
|
||||||
Notices displayed by works containing it; or
|
|
||||||
.
|
|
||||||
c) Prohibiting misrepresentation of the origin of that material, or
|
|
||||||
requiring that modified versions of such material be marked in
|
|
||||||
reasonable ways as different from the original version; or
|
|
||||||
.
|
|
||||||
d) Limiting the use for publicity purposes of names of licensors or
|
|
||||||
authors of the material; or
|
|
||||||
.
|
|
||||||
e) Declining to grant rights under trademark law for use of some
|
|
||||||
trade names, trademarks, or service marks; or
|
|
||||||
.
|
|
||||||
f) Requiring indemnification of licensors and authors of that
|
|
||||||
material by anyone who conveys the material (or modified versions of
|
|
||||||
it) with contractual assumptions of liability to the recipient, for
|
|
||||||
any liability that these contractual assumptions directly impose on
|
|
||||||
those licensors and authors.
|
|
||||||
.
|
|
||||||
All other non-permissive additional terms are considered "further
|
|
||||||
restrictions" within the meaning of section 10. If the Program as you
|
|
||||||
received it, or any part of it, contains a notice stating that it is
|
|
||||||
governed by this License along with a term that is a further
|
|
||||||
restriction, you may remove that term. If a license document contains
|
|
||||||
a further restriction but permits relicensing or conveying under this
|
|
||||||
License, you may add to a covered work material governed by the terms
|
|
||||||
of that license document, provided that the further restriction does
|
|
||||||
not survive such relicensing or conveying.
|
|
||||||
.
|
|
||||||
If you add terms to a covered work in accord with this section, you
|
|
||||||
must place, in the relevant source files, a statement of the
|
|
||||||
additional terms that apply to those files, or a notice indicating
|
|
||||||
where to find the applicable terms.
|
|
||||||
.
|
|
||||||
Additional terms, permissive or non-permissive, may be stated in the
|
|
||||||
form of a separately written license, or stated as exceptions;
|
|
||||||
the above requirements apply either way.
|
|
||||||
.
|
|
||||||
8. Termination.
|
|
||||||
.
|
|
||||||
You may not propagate or modify a covered work except as expressly
|
|
||||||
provided under this License. Any attempt otherwise to propagate or
|
|
||||||
modify it is void, and will automatically terminate your rights under
|
|
||||||
this License (including any patent licenses granted under the third
|
|
||||||
paragraph of section 11).
|
|
||||||
.
|
|
||||||
However, if you cease all violation of this License, then your
|
|
||||||
license from a particular copyright holder is reinstated (a)
|
|
||||||
provisionally, unless and until the copyright holder explicitly and
|
|
||||||
finally terminates your license, and (b) permanently, if the copyright
|
|
||||||
holder fails to notify you of the violation by some reasonable means
|
|
||||||
prior to 60 days after the cessation.
|
|
||||||
.
|
|
||||||
Moreover, your license from a particular copyright holder is
|
|
||||||
reinstated permanently if the copyright holder notifies you of the
|
|
||||||
violation by some reasonable means, this is the first time you have
|
|
||||||
received notice of violation of this License (for any work) from that
|
|
||||||
copyright holder, and you cure the violation prior to 30 days after
|
|
||||||
your receipt of the notice.
|
|
||||||
.
|
|
||||||
Termination of your rights under this section does not terminate the
|
|
||||||
licenses of parties who have received copies or rights from you under
|
|
||||||
this License. If your rights have been terminated and not permanently
|
|
||||||
reinstated, you do not qualify to receive new licenses for the same
|
|
||||||
material under section 10.
|
|
||||||
.
|
|
||||||
9. Acceptance Not Required for Having Copies.
|
|
||||||
.
|
|
||||||
You are not required to accept this License in order to receive or
|
|
||||||
run a copy of the Program. Ancillary propagation of a covered work
|
|
||||||
occurring solely as a consequence of using peer-to-peer transmission
|
|
||||||
to receive a copy likewise does not require acceptance. However,
|
|
||||||
nothing other than this License grants you permission to propagate or
|
|
||||||
modify any covered work. These actions infringe copyright if you do
|
|
||||||
not accept this License. Therefore, by modifying or propagating a
|
|
||||||
covered work, you indicate your acceptance of this License to do so.
|
|
||||||
.
|
|
||||||
10. Automatic Licensing of Downstream Recipients.
|
|
||||||
.
|
|
||||||
Each time you convey a covered work, the recipient automatically
|
|
||||||
receives a license from the original licensors, to run, modify and
|
|
||||||
propagate that work, subject to this License. You are not responsible
|
|
||||||
for enforcing compliance by third parties with this License.
|
|
||||||
.
|
|
||||||
An "entity transaction" is a transaction transferring control of an
|
|
||||||
organization, or substantially all assets of one, or subdividing an
|
|
||||||
organization, or merging organizations. If propagation of a covered
|
|
||||||
work results from an entity transaction, each party to that
|
|
||||||
transaction who receives a copy of the work also receives whatever
|
|
||||||
licenses to the work the party's predecessor in interest had or could
|
|
||||||
give under the previous paragraph, plus a right to possession of the
|
|
||||||
Corresponding Source of the work from the predecessor in interest, if
|
|
||||||
the predecessor has it or can get it with reasonable efforts.
|
|
||||||
.
|
|
||||||
You may not impose any further restrictions on the exercise of the
|
|
||||||
rights granted or affirmed under this License. For example, you may
|
|
||||||
not impose a license fee, royalty, or other charge for exercise of
|
|
||||||
rights granted under this License, and you may not initiate litigation
|
|
||||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
|
||||||
any patent claim is infringed by making, using, selling, offering for
|
|
||||||
sale, or importing the Program or any portion of it.
|
|
||||||
.
|
|
||||||
11. Patents.
|
|
||||||
.
|
|
||||||
A "contributor" is a copyright holder who authorizes use under this
|
|
||||||
License of the Program or a work on which the Program is based. The
|
|
||||||
work thus licensed is called the contributor's "contributor version".
|
|
||||||
.
|
|
||||||
A contributor's "essential patent claims" are all patent claims
|
|
||||||
owned or controlled by the contributor, whether already acquired or
|
|
||||||
hereafter acquired, that would be infringed by some manner, permitted
|
|
||||||
by this License, of making, using, or selling its contributor version,
|
|
||||||
but do not include claims that would be infringed only as a
|
|
||||||
consequence of further modification of the contributor version. For
|
|
||||||
purposes of this definition, "control" includes the right to grant
|
|
||||||
patent sublicenses in a manner consistent with the requirements of
|
|
||||||
this License.
|
|
||||||
.
|
|
||||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
|
||||||
patent license under the contributor's essential patent claims, to
|
|
||||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
|
||||||
propagate the contents of its contributor version.
|
|
||||||
.
|
|
||||||
In the following three paragraphs, a "patent license" is any express
|
|
||||||
agreement or commitment, however denominated, not to enforce a patent
|
|
||||||
(such as an express permission to practice a patent or covenant not to
|
|
||||||
sue for patent infringement). To "grant" such a patent license to a
|
|
||||||
party means to make such an agreement or commitment not to enforce a
|
|
||||||
patent against the party.
|
|
||||||
.
|
|
||||||
If you convey a covered work, knowingly relying on a patent license,
|
|
||||||
and the Corresponding Source of the work is not available for anyone
|
|
||||||
to copy, free of charge and under the terms of this License, through a
|
|
||||||
publicly available network server or other readily accessible means,
|
|
||||||
then you must either (1) cause the Corresponding Source to be so
|
|
||||||
available, or (2) arrange to deprive yourself of the benefit of the
|
|
||||||
patent license for this particular work, or (3) arrange, in a manner
|
|
||||||
consistent with the requirements of this License, to extend the patent
|
|
||||||
license to downstream recipients. "Knowingly relying" means you have
|
|
||||||
actual knowledge that, but for the patent license, your conveying the
|
|
||||||
covered work in a country, or your recipient's use of the covered work
|
|
||||||
in a country, would infringe one or more identifiable patents in that
|
|
||||||
country that you have reason to believe are valid.
|
|
||||||
.
|
|
||||||
If, pursuant to or in connection with a single transaction or
|
|
||||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
|
||||||
covered work, and grant a patent license to some of the parties
|
|
||||||
receiving the covered work authorizing them to use, propagate, modify
|
|
||||||
or convey a specific copy of the covered work, then the patent license
|
|
||||||
you grant is automatically extended to all recipients of the covered
|
|
||||||
work and works based on it.
|
|
||||||
.
|
|
||||||
A patent license is "discriminatory" if it does not include within
|
|
||||||
the scope of its coverage, prohibits the exercise of, or is
|
|
||||||
conditioned on the non-exercise of one or more of the rights that are
|
|
||||||
specifically granted under this License. You may not convey a covered
|
|
||||||
work if you are a party to an arrangement with a third party that is
|
|
||||||
in the business of distributing software, under which you make payment
|
|
||||||
to the third party based on the extent of your activity of conveying
|
|
||||||
the work, and under which the third party grants, to any of the
|
|
||||||
parties who would receive the covered work from you, a discriminatory
|
|
||||||
patent license (a) in connection with copies of the covered work
|
|
||||||
conveyed by you (or copies made from those copies), or (b) primarily
|
|
||||||
for and in connection with specific products or compilations that
|
|
||||||
contain the covered work, unless you entered into that arrangement,
|
|
||||||
or that patent license was granted, prior to 28 March 2007.
|
|
||||||
.
|
|
||||||
Nothing in this License shall be construed as excluding or limiting
|
|
||||||
any implied license or other defenses to infringement that may
|
|
||||||
otherwise be available to you under applicable patent law.
|
|
||||||
.
|
|
||||||
12. No Surrender of Others' Freedom.
|
|
||||||
.
|
|
||||||
If conditions are imposed on you (whether by court order, agreement or
|
|
||||||
otherwise) that contradict the conditions of this License, they do not
|
|
||||||
excuse you from the conditions of this License. If you cannot convey a
|
|
||||||
covered work so as to satisfy simultaneously your obligations under this
|
|
||||||
License and any other pertinent obligations, then as a consequence you may
|
|
||||||
not convey it at all. For example, if you agree to terms that obligate you
|
|
||||||
to collect a royalty for further conveying from those to whom you convey
|
|
||||||
the Program, the only way you could satisfy both those terms and this
|
|
||||||
License would be to refrain entirely from conveying the Program.
|
|
||||||
.
|
|
||||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
|
||||||
.
|
|
||||||
Notwithstanding any other provision of this License, if you modify the
|
|
||||||
Program, your modified version must prominently offer all users
|
|
||||||
interacting with it remotely through a computer network (if your version
|
|
||||||
supports such interaction) an opportunity to receive the Corresponding
|
|
||||||
Source of your version by providing access to the Corresponding Source
|
|
||||||
from a network server at no charge, through some standard or customary
|
|
||||||
means of facilitating copying of software. This Corresponding Source
|
|
||||||
shall include the Corresponding Source for any work covered by version 3
|
|
||||||
of the GNU General Public License that is incorporated pursuant to the
|
|
||||||
following paragraph.
|
|
||||||
.
|
|
||||||
Notwithstanding any other provision of this License, you have
|
|
||||||
permission to link or combine any covered work with a work licensed
|
|
||||||
under version 3 of the GNU General Public License into a single
|
|
||||||
combined work, and to convey the resulting work. The terms of this
|
|
||||||
License will continue to apply to the part which is the covered work,
|
|
||||||
but the work with which it is combined will remain governed by version
|
|
||||||
3 of the GNU General Public License.
|
|
||||||
.
|
|
||||||
14. Revised Versions of this License.
|
|
||||||
.
|
|
||||||
The Free Software Foundation may publish revised and/or new versions of
|
|
||||||
the GNU Affero General Public License from time to time. Such new versions
|
|
||||||
will be similar in spirit to the present version, but may differ in detail to
|
|
||||||
address new problems or concerns.
|
|
||||||
.
|
|
||||||
Each version is given a distinguishing version number. If the
|
|
||||||
Program specifies that a certain numbered version of the GNU Affero General
|
|
||||||
Public License "or any later version" applies to it, you have the
|
|
||||||
option of following the terms and conditions either of that numbered
|
|
||||||
version or of any later version published by the Free Software
|
|
||||||
Foundation. If the Program does not specify a version number of the
|
|
||||||
GNU Affero General Public License, you may choose any version ever published
|
|
||||||
by the Free Software Foundation.
|
|
||||||
.
|
|
||||||
If the Program specifies that a proxy can decide which future
|
|
||||||
versions of the GNU Affero General Public License can be used, that proxy's
|
|
||||||
public statement of acceptance of a version permanently authorizes you
|
|
||||||
to choose that version for the Program.
|
|
||||||
.
|
|
||||||
Later license versions may give you additional or different
|
|
||||||
permissions. However, no additional obligations are imposed on any
|
|
||||||
author or copyright holder as a result of your choosing to follow a
|
|
||||||
later version.
|
|
||||||
.
|
|
||||||
15. Disclaimer of Warranty.
|
|
||||||
.
|
|
||||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
|
||||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
|
||||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
|
||||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
|
||||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
||||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
|
||||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
|
||||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||||
.
|
.
|
||||||
16. Limitation of Liability.
|
2. Replacement of Section 16. Section 16 of the GPL shall be deleted in its
|
||||||
|
entirety and replaced with the following:
|
||||||
.
|
.
|
||||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
16. LIMITATION OF LIABILITY.
|
||||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
|
||||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
|
||||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
|
||||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
|
||||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
|
||||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
|
||||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
|
||||||
SUCH DAMAGES.
|
|
||||||
.
|
.
|
||||||
17. Interpretation of Sections 15 and 16.
|
UNDER NO CIRCUMSTANCES SHALL ANY COPYRIGHT HOLDER OR ITS AFFILIATES, OR ANY
|
||||||
|
OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE
|
||||||
|
LIABLE TO YOU, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, FOR ANY
|
||||||
|
DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, DIRECT, INDIRECT, SPECIAL,
|
||||||
|
INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES ARISING FROM, OUT OF OR IN
|
||||||
|
CONNECTION WITH THE USE OR INABILITY TO USE THE PROGRAM OR OTHER DEALINGS WITH
|
||||||
|
THE PROGRAM(INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED
|
||||||
|
INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE
|
||||||
|
PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), WHETHER OR NOT ANY COPYRIGHT HOLDER
|
||||||
|
OR SUCH OTHER PARTY RECEIVES NOTICE OF ANY SUCH DAMAGES AND WHETHER OR NOT SUCH
|
||||||
|
DAMAGES COULD HAVE BEEN FORESEEN.
|
||||||
.
|
.
|
||||||
If the disclaimer of warranty and limitation of liability provided
|
3. LEGAL NOTICES; NO TRADEMARK LICENSE; ORIGIN. You must reproduce faithfully
|
||||||
above cannot be given local legal effect according to their terms,
|
all trademark, copyright and other proprietary and legal notices on any copies
|
||||||
reviewing courts shall apply local law that most closely approximates
|
of the Program or any other required author attributions. This license does not
|
||||||
an absolute waiver of all civil liability in connection with the
|
grant you rights to use any copyright holder or any other party's name, logo, or
|
||||||
Program, unless a warranty or assumption of liability accompanies a
|
trademarks. Neither the name of the copyright holder or its affiliates, or any
|
||||||
copy of the Program in return for a fee.
|
other party who modifies and/or conveys the Program may be used to endorse or
|
||||||
|
promote products derived from this software without specific prior written
|
||||||
|
permission. The origin of the Program must not be misrepresented; you must not
|
||||||
|
claim that you wrote the original Program. Altered source versions must be
|
||||||
|
plainly marked as such, and must not be misrepresented as being the original
|
||||||
|
Program.
|
||||||
.
|
.
|
||||||
END OF TERMS AND CONDITIONS
|
4. INDEMNIFICATION. IF YOU CONVEY A COVERED WORK AND AGREE WITH ANY RECIPIENT
|
||||||
.
|
OF THAT COVERED WORK THAT YOU WILL ASSUME ANY LIABILITY FOR THAT COVERED WORK,
|
||||||
How to Apply These Terms to Your New Programs
|
YOU HEREBY AGREE TO INDEMNIFY, DEFEND AND HOLD HARMLESS THE OTHER LICENSORS AND
|
||||||
.
|
AUTHORS OF THAT COVERED WORK FOR ANY DAMAGES, DEMANDS, CLAIMS, LOSSES, CAUSES OF
|
||||||
If you develop a new program, and you want it to be of the greatest
|
ACTION, LAWSUITS, JUDGMENTS EXPENSES (INCLUDING WITHOUT LIMITATION REASONABLE
|
||||||
possible use to the public, the best way to achieve this is to make it
|
ATTORNEYS' FEES AND EXPENSES) OR ANY OTHER LIABILITY ARISING FROM, RELATED TO OR
|
||||||
free software which everyone can redistribute and change under these terms.
|
IN CONNECTION WITH YOUR ASSUMPTIONS OF LIABILITY.
|
||||||
.
|
|
||||||
To do so, attach the following notices to the program. It is safest
|
|
||||||
to attach them to the start of each source file to most effectively
|
|
||||||
state the exclusion of warranty; and each file should have at least
|
|
||||||
the "copyright" line and a pointer to where the full notice is found.
|
|
||||||
.
|
|
||||||
<one line to give the program's name and a brief idea of what it does.>
|
|
||||||
Copyright (C) <year> <name of author>
|
|
||||||
.
|
|
||||||
This program is free software: you can redistribute it and/or modify
|
|
||||||
it under the terms of the GNU Affero General Public License as published by
|
|
||||||
the Free Software Foundation, either version 3 of the License, or
|
|
||||||
(at your option) any later version.
|
|
||||||
.
|
|
||||||
This program is distributed in the hope that it will be useful,
|
|
||||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
GNU Affero General Public License for more details.
|
|
||||||
.
|
|
||||||
You should have received a copy of the GNU Affero General Public License
|
|
||||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
||||||
.
|
|
||||||
Also add information on how to contact you by electronic and paper mail.
|
|
||||||
.
|
|
||||||
If your software can interact with users remotely through a computer
|
|
||||||
network, you should also make sure that it provides a way for users to
|
|
||||||
get its source. For example, if your program is a web application, its
|
|
||||||
interface could display a "Source" link that leads users to an archive
|
|
||||||
of the code. There are many ways you could offer source, and different
|
|
||||||
solutions will be better for different programs; see section 13 for the
|
|
||||||
specific requirements.
|
|
||||||
.
|
|
||||||
You should also get your employer (if you work as a programmer) or school,
|
|
||||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
|
||||||
For more information on this, and how to apply and follow the GNU AGPL, see
|
|
||||||
<https://www.gnu.org/licenses/>.
|
|
||||||
|
|||||||
674
GPLv3
Normal file
674
GPLv3
Normal file
@ -0,0 +1,674 @@
|
|||||||
|
GNU GENERAL PUBLIC LICENSE
|
||||||
|
Version 3, 29 June 2007
|
||||||
|
|
||||||
|
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
|
||||||
|
Everyone is permitted to copy and distribute verbatim copies
|
||||||
|
of this license document, but changing it is not allowed.
|
||||||
|
|
||||||
|
Preamble
|
||||||
|
|
||||||
|
The GNU General Public License is a free, copyleft license for
|
||||||
|
software and other kinds of works.
|
||||||
|
|
||||||
|
The licenses for most software and other practical works are designed
|
||||||
|
to take away your freedom to share and change the works. By contrast,
|
||||||
|
the GNU General Public License is intended to guarantee your freedom to
|
||||||
|
share and change all versions of a program--to make sure it remains free
|
||||||
|
software for all its users. We, the Free Software Foundation, use the
|
||||||
|
GNU General Public License for most of our software; it applies also to
|
||||||
|
any other work released this way by its authors. You can apply it to
|
||||||
|
your programs, too.
|
||||||
|
|
||||||
|
When we speak of free software, we are referring to freedom, not
|
||||||
|
price. Our General Public Licenses are designed to make sure that you
|
||||||
|
have the freedom to distribute copies of free software (and charge for
|
||||||
|
them if you wish), that you receive source code or can get it if you
|
||||||
|
want it, that you can change the software or use pieces of it in new
|
||||||
|
free programs, and that you know you can do these things.
|
||||||
|
|
||||||
|
To protect your rights, we need to prevent others from denying you
|
||||||
|
these rights or asking you to surrender the rights. Therefore, you have
|
||||||
|
certain responsibilities if you distribute copies of the software, or if
|
||||||
|
you modify it: responsibilities to respect the freedom of others.
|
||||||
|
|
||||||
|
For example, if you distribute copies of such a program, whether
|
||||||
|
gratis or for a fee, you must pass on to the recipients the same
|
||||||
|
freedoms that you received. You must make sure that they, too, receive
|
||||||
|
or can get the source code. And you must show them these terms so they
|
||||||
|
know their rights.
|
||||||
|
|
||||||
|
Developers that use the GNU GPL protect your rights with two steps:
|
||||||
|
(1) assert copyright on the software, and (2) offer you this License
|
||||||
|
giving you legal permission to copy, distribute and/or modify it.
|
||||||
|
|
||||||
|
For the developers' and authors' protection, the GPL clearly explains
|
||||||
|
that there is no warranty for this free software. For both users' and
|
||||||
|
authors' sake, the GPL requires that modified versions be marked as
|
||||||
|
changed, so that their problems will not be attributed erroneously to
|
||||||
|
authors of previous versions.
|
||||||
|
|
||||||
|
Some devices are designed to deny users access to install or run
|
||||||
|
modified versions of the software inside them, although the manufacturer
|
||||||
|
can do so. This is fundamentally incompatible with the aim of
|
||||||
|
protecting users' freedom to change the software. The systematic
|
||||||
|
pattern of such abuse occurs in the area of products for individuals to
|
||||||
|
use, which is precisely where it is most unacceptable. Therefore, we
|
||||||
|
have designed this version of the GPL to prohibit the practice for those
|
||||||
|
products. If such problems arise substantially in other domains, we
|
||||||
|
stand ready to extend this provision to those domains in future versions
|
||||||
|
of the GPL, as needed to protect the freedom of users.
|
||||||
|
|
||||||
|
Finally, every program is threatened constantly by software patents.
|
||||||
|
States should not allow patents to restrict development and use of
|
||||||
|
software on general-purpose computers, but in those that do, we wish to
|
||||||
|
avoid the special danger that patents applied to a free program could
|
||||||
|
make it effectively proprietary. To prevent this, the GPL assures that
|
||||||
|
patents cannot be used to render the program non-free.
|
||||||
|
|
||||||
|
The precise terms and conditions for copying, distribution and
|
||||||
|
modification follow.
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
0. Definitions.
|
||||||
|
|
||||||
|
"This License" refers to version 3 of the GNU General Public License.
|
||||||
|
|
||||||
|
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||||
|
works, such as semiconductor masks.
|
||||||
|
|
||||||
|
"The Program" refers to any copyrightable work licensed under this
|
||||||
|
License. Each licensee is addressed as "you". "Licensees" and
|
||||||
|
"recipients" may be individuals or organizations.
|
||||||
|
|
||||||
|
To "modify" a work means to copy from or adapt all or part of the work
|
||||||
|
in a fashion requiring copyright permission, other than the making of an
|
||||||
|
exact copy. The resulting work is called a "modified version" of the
|
||||||
|
earlier work or a work "based on" the earlier work.
|
||||||
|
|
||||||
|
A "covered work" means either the unmodified Program or a work based
|
||||||
|
on the Program.
|
||||||
|
|
||||||
|
To "propagate" a work means to do anything with it that, without
|
||||||
|
permission, would make you directly or secondarily liable for
|
||||||
|
infringement under applicable copyright law, except executing it on a
|
||||||
|
computer or modifying a private copy. Propagation includes copying,
|
||||||
|
distribution (with or without modification), making available to the
|
||||||
|
public, and in some countries other activities as well.
|
||||||
|
|
||||||
|
To "convey" a work means any kind of propagation that enables other
|
||||||
|
parties to make or receive copies. Mere interaction with a user through
|
||||||
|
a computer network, with no transfer of a copy, is not conveying.
|
||||||
|
|
||||||
|
An interactive user interface displays "Appropriate Legal Notices"
|
||||||
|
to the extent that it includes a convenient and prominently visible
|
||||||
|
feature that (1) displays an appropriate copyright notice, and (2)
|
||||||
|
tells the user that there is no warranty for the work (except to the
|
||||||
|
extent that warranties are provided), that licensees may convey the
|
||||||
|
work under this License, and how to view a copy of this License. If
|
||||||
|
the interface presents a list of user commands or options, such as a
|
||||||
|
menu, a prominent item in the list meets this criterion.
|
||||||
|
|
||||||
|
1. Source Code.
|
||||||
|
|
||||||
|
The "source code" for a work means the preferred form of the work
|
||||||
|
for making modifications to it. "Object code" means any non-source
|
||||||
|
form of a work.
|
||||||
|
|
||||||
|
A "Standard Interface" means an interface that either is an official
|
||||||
|
standard defined by a recognized standards body, or, in the case of
|
||||||
|
interfaces specified for a particular programming language, one that
|
||||||
|
is widely used among developers working in that language.
|
||||||
|
|
||||||
|
The "System Libraries" of an executable work include anything, other
|
||||||
|
than the work as a whole, that (a) is included in the normal form of
|
||||||
|
packaging a Major Component, but which is not part of that Major
|
||||||
|
Component, and (b) serves only to enable use of the work with that
|
||||||
|
Major Component, or to implement a Standard Interface for which an
|
||||||
|
implementation is available to the public in source code form. A
|
||||||
|
"Major Component", in this context, means a major essential component
|
||||||
|
(kernel, window system, and so on) of the specific operating system
|
||||||
|
(if any) on which the executable work runs, or a compiler used to
|
||||||
|
produce the work, or an object code interpreter used to run it.
|
||||||
|
|
||||||
|
The "Corresponding Source" for a work in object code form means all
|
||||||
|
the source code needed to generate, install, and (for an executable
|
||||||
|
work) run the object code and to modify the work, including scripts to
|
||||||
|
control those activities. However, it does not include the work's
|
||||||
|
System Libraries, or general-purpose tools or generally available free
|
||||||
|
programs which are used unmodified in performing those activities but
|
||||||
|
which are not part of the work. For example, Corresponding Source
|
||||||
|
includes interface definition files associated with source files for
|
||||||
|
the work, and the source code for shared libraries and dynamically
|
||||||
|
linked subprograms that the work is specifically designed to require,
|
||||||
|
such as by intimate data communication or control flow between those
|
||||||
|
subprograms and other parts of the work.
|
||||||
|
|
||||||
|
The Corresponding Source need not include anything that users
|
||||||
|
can regenerate automatically from other parts of the Corresponding
|
||||||
|
Source.
|
||||||
|
|
||||||
|
The Corresponding Source for a work in source code form is that
|
||||||
|
same work.
|
||||||
|
|
||||||
|
2. Basic Permissions.
|
||||||
|
|
||||||
|
All rights granted under this License are granted for the term of
|
||||||
|
copyright on the Program, and are irrevocable provided the stated
|
||||||
|
conditions are met. This License explicitly affirms your unlimited
|
||||||
|
permission to run the unmodified Program. The output from running a
|
||||||
|
covered work is covered by this License only if the output, given its
|
||||||
|
content, constitutes a covered work. This License acknowledges your
|
||||||
|
rights of fair use or other equivalent, as provided by copyright law.
|
||||||
|
|
||||||
|
You may make, run and propagate covered works that you do not
|
||||||
|
convey, without conditions so long as your license otherwise remains
|
||||||
|
in force. You may convey covered works to others for the sole purpose
|
||||||
|
of having them make modifications exclusively for you, or provide you
|
||||||
|
with facilities for running those works, provided that you comply with
|
||||||
|
the terms of this License in conveying all material for which you do
|
||||||
|
not control copyright. Those thus making or running the covered works
|
||||||
|
for you must do so exclusively on your behalf, under your direction
|
||||||
|
and control, on terms that prohibit them from making any copies of
|
||||||
|
your copyrighted material outside their relationship with you.
|
||||||
|
|
||||||
|
Conveying under any other circumstances is permitted solely under
|
||||||
|
the conditions stated below. Sublicensing is not allowed; section 10
|
||||||
|
makes it unnecessary.
|
||||||
|
|
||||||
|
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||||
|
|
||||||
|
No covered work shall be deemed part of an effective technological
|
||||||
|
measure under any applicable law fulfilling obligations under article
|
||||||
|
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||||
|
similar laws prohibiting or restricting circumvention of such
|
||||||
|
measures.
|
||||||
|
|
||||||
|
When you convey a covered work, you waive any legal power to forbid
|
||||||
|
circumvention of technological measures to the extent such circumvention
|
||||||
|
is effected by exercising rights under this License with respect to
|
||||||
|
the covered work, and you disclaim any intention to limit operation or
|
||||||
|
modification of the work as a means of enforcing, against the work's
|
||||||
|
users, your or third parties' legal rights to forbid circumvention of
|
||||||
|
technological measures.
|
||||||
|
|
||||||
|
4. Conveying Verbatim Copies.
|
||||||
|
|
||||||
|
You may convey verbatim copies of the Program's source code as you
|
||||||
|
receive it, in any medium, provided that you conspicuously and
|
||||||
|
appropriately publish on each copy an appropriate copyright notice;
|
||||||
|
keep intact all notices stating that this License and any
|
||||||
|
non-permissive terms added in accord with section 7 apply to the code;
|
||||||
|
keep intact all notices of the absence of any warranty; and give all
|
||||||
|
recipients a copy of this License along with the Program.
|
||||||
|
|
||||||
|
You may charge any price or no price for each copy that you convey,
|
||||||
|
and you may offer support or warranty protection for a fee.
|
||||||
|
|
||||||
|
5. Conveying Modified Source Versions.
|
||||||
|
|
||||||
|
You may convey a work based on the Program, or the modifications to
|
||||||
|
produce it from the Program, in the form of source code under the
|
||||||
|
terms of section 4, provided that you also meet all of these conditions:
|
||||||
|
|
||||||
|
a) The work must carry prominent notices stating that you modified
|
||||||
|
it, and giving a relevant date.
|
||||||
|
|
||||||
|
b) The work must carry prominent notices stating that it is
|
||||||
|
released under this License and any conditions added under section
|
||||||
|
7. This requirement modifies the requirement in section 4 to
|
||||||
|
"keep intact all notices".
|
||||||
|
|
||||||
|
c) You must license the entire work, as a whole, under this
|
||||||
|
License to anyone who comes into possession of a copy. This
|
||||||
|
License will therefore apply, along with any applicable section 7
|
||||||
|
additional terms, to the whole of the work, and all its parts,
|
||||||
|
regardless of how they are packaged. This License gives no
|
||||||
|
permission to license the work in any other way, but it does not
|
||||||
|
invalidate such permission if you have separately received it.
|
||||||
|
|
||||||
|
d) If the work has interactive user interfaces, each must display
|
||||||
|
Appropriate Legal Notices; however, if the Program has interactive
|
||||||
|
interfaces that do not display Appropriate Legal Notices, your
|
||||||
|
work need not make them do so.
|
||||||
|
|
||||||
|
A compilation of a covered work with other separate and independent
|
||||||
|
works, which are not by their nature extensions of the covered work,
|
||||||
|
and which are not combined with it such as to form a larger program,
|
||||||
|
in or on a volume of a storage or distribution medium, is called an
|
||||||
|
"aggregate" if the compilation and its resulting copyright are not
|
||||||
|
used to limit the access or legal rights of the compilation's users
|
||||||
|
beyond what the individual works permit. Inclusion of a covered work
|
||||||
|
in an aggregate does not cause this License to apply to the other
|
||||||
|
parts of the aggregate.
|
||||||
|
|
||||||
|
6. Conveying Non-Source Forms.
|
||||||
|
|
||||||
|
You may convey a covered work in object code form under the terms
|
||||||
|
of sections 4 and 5, provided that you also convey the
|
||||||
|
machine-readable Corresponding Source under the terms of this License,
|
||||||
|
in one of these ways:
|
||||||
|
|
||||||
|
a) Convey the object code in, or embodied in, a physical product
|
||||||
|
(including a physical distribution medium), accompanied by the
|
||||||
|
Corresponding Source fixed on a durable physical medium
|
||||||
|
customarily used for software interchange.
|
||||||
|
|
||||||
|
b) Convey the object code in, or embodied in, a physical product
|
||||||
|
(including a physical distribution medium), accompanied by a
|
||||||
|
written offer, valid for at least three years and valid for as
|
||||||
|
long as you offer spare parts or customer support for that product
|
||||||
|
model, to give anyone who possesses the object code either (1) a
|
||||||
|
copy of the Corresponding Source for all the software in the
|
||||||
|
product that is covered by this License, on a durable physical
|
||||||
|
medium customarily used for software interchange, for a price no
|
||||||
|
more than your reasonable cost of physically performing this
|
||||||
|
conveying of source, or (2) access to copy the
|
||||||
|
Corresponding Source from a network server at no charge.
|
||||||
|
|
||||||
|
c) Convey individual copies of the object code with a copy of the
|
||||||
|
written offer to provide the Corresponding Source. This
|
||||||
|
alternative is allowed only occasionally and noncommercially, and
|
||||||
|
only if you received the object code with such an offer, in accord
|
||||||
|
with subsection 6b.
|
||||||
|
|
||||||
|
d) Convey the object code by offering access from a designated
|
||||||
|
place (gratis or for a charge), and offer equivalent access to the
|
||||||
|
Corresponding Source in the same way through the same place at no
|
||||||
|
further charge. You need not require recipients to copy the
|
||||||
|
Corresponding Source along with the object code. If the place to
|
||||||
|
copy the object code is a network server, the Corresponding Source
|
||||||
|
may be on a different server (operated by you or a third party)
|
||||||
|
that supports equivalent copying facilities, provided you maintain
|
||||||
|
clear directions next to the object code saying where to find the
|
||||||
|
Corresponding Source. Regardless of what server hosts the
|
||||||
|
Corresponding Source, you remain obligated to ensure that it is
|
||||||
|
available for as long as needed to satisfy these requirements.
|
||||||
|
|
||||||
|
e) Convey the object code using peer-to-peer transmission, provided
|
||||||
|
you inform other peers where the object code and Corresponding
|
||||||
|
Source of the work are being offered to the general public at no
|
||||||
|
charge under subsection 6d.
|
||||||
|
|
||||||
|
A separable portion of the object code, whose source code is excluded
|
||||||
|
from the Corresponding Source as a System Library, need not be
|
||||||
|
included in conveying the object code work.
|
||||||
|
|
||||||
|
A "User Product" is either (1) a "consumer product", which means any
|
||||||
|
tangible personal property which is normally used for personal, family,
|
||||||
|
or household purposes, or (2) anything designed or sold for incorporation
|
||||||
|
into a dwelling. In determining whether a product is a consumer product,
|
||||||
|
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||||
|
product received by a particular user, "normally used" refers to a
|
||||||
|
typical or common use of that class of product, regardless of the status
|
||||||
|
of the particular user or of the way in which the particular user
|
||||||
|
actually uses, or expects or is expected to use, the product. A product
|
||||||
|
is a consumer product regardless of whether the product has substantial
|
||||||
|
commercial, industrial or non-consumer uses, unless such uses represent
|
||||||
|
the only significant mode of use of the product.
|
||||||
|
|
||||||
|
"Installation Information" for a User Product means any methods,
|
||||||
|
procedures, authorization keys, or other information required to install
|
||||||
|
and execute modified versions of a covered work in that User Product from
|
||||||
|
a modified version of its Corresponding Source. The information must
|
||||||
|
suffice to ensure that the continued functioning of the modified object
|
||||||
|
code is in no case prevented or interfered with solely because
|
||||||
|
modification has been made.
|
||||||
|
|
||||||
|
If you convey an object code work under this section in, or with, or
|
||||||
|
specifically for use in, a User Product, and the conveying occurs as
|
||||||
|
part of a transaction in which the right of possession and use of the
|
||||||
|
User Product is transferred to the recipient in perpetuity or for a
|
||||||
|
fixed term (regardless of how the transaction is characterized), the
|
||||||
|
Corresponding Source conveyed under this section must be accompanied
|
||||||
|
by the Installation Information. But this requirement does not apply
|
||||||
|
if neither you nor any third party retains the ability to install
|
||||||
|
modified object code on the User Product (for example, the work has
|
||||||
|
been installed in ROM).
|
||||||
|
|
||||||
|
The requirement to provide Installation Information does not include a
|
||||||
|
requirement to continue to provide support service, warranty, or updates
|
||||||
|
for a work that has been modified or installed by the recipient, or for
|
||||||
|
the User Product in which it has been modified or installed. Access to a
|
||||||
|
network may be denied when the modification itself materially and
|
||||||
|
adversely affects the operation of the network or violates the rules and
|
||||||
|
protocols for communication across the network.
|
||||||
|
|
||||||
|
Corresponding Source conveyed, and Installation Information provided,
|
||||||
|
in accord with this section must be in a format that is publicly
|
||||||
|
documented (and with an implementation available to the public in
|
||||||
|
source code form), and must require no special password or key for
|
||||||
|
unpacking, reading or copying.
|
||||||
|
|
||||||
|
7. Additional Terms.
|
||||||
|
|
||||||
|
"Additional permissions" are terms that supplement the terms of this
|
||||||
|
License by making exceptions from one or more of its conditions.
|
||||||
|
Additional permissions that are applicable to the entire Program shall
|
||||||
|
be treated as though they were included in this License, to the extent
|
||||||
|
that they are valid under applicable law. If additional permissions
|
||||||
|
apply only to part of the Program, that part may be used separately
|
||||||
|
under those permissions, but the entire Program remains governed by
|
||||||
|
this License without regard to the additional permissions.
|
||||||
|
|
||||||
|
When you convey a copy of a covered work, you may at your option
|
||||||
|
remove any additional permissions from that copy, or from any part of
|
||||||
|
it. (Additional permissions may be written to require their own
|
||||||
|
removal in certain cases when you modify the work.) You may place
|
||||||
|
additional permissions on material, added by you to a covered work,
|
||||||
|
for which you have or can give appropriate copyright permission.
|
||||||
|
|
||||||
|
Notwithstanding any other provision of this License, for material you
|
||||||
|
add to a covered work, you may (if authorized by the copyright holders of
|
||||||
|
that material) supplement the terms of this License with terms:
|
||||||
|
|
||||||
|
a) Disclaiming warranty or limiting liability differently from the
|
||||||
|
terms of sections 15 and 16 of this License; or
|
||||||
|
|
||||||
|
b) Requiring preservation of specified reasonable legal notices or
|
||||||
|
author attributions in that material or in the Appropriate Legal
|
||||||
|
Notices displayed by works containing it; or
|
||||||
|
|
||||||
|
c) Prohibiting misrepresentation of the origin of that material, or
|
||||||
|
requiring that modified versions of such material be marked in
|
||||||
|
reasonable ways as different from the original version; or
|
||||||
|
|
||||||
|
d) Limiting the use for publicity purposes of names of licensors or
|
||||||
|
authors of the material; or
|
||||||
|
|
||||||
|
e) Declining to grant rights under trademark law for use of some
|
||||||
|
trade names, trademarks, or service marks; or
|
||||||
|
|
||||||
|
f) Requiring indemnification of licensors and authors of that
|
||||||
|
material by anyone who conveys the material (or modified versions of
|
||||||
|
it) with contractual assumptions of liability to the recipient, for
|
||||||
|
any liability that these contractual assumptions directly impose on
|
||||||
|
those licensors and authors.
|
||||||
|
|
||||||
|
All other non-permissive additional terms are considered "further
|
||||||
|
restrictions" within the meaning of section 10. If the Program as you
|
||||||
|
received it, or any part of it, contains a notice stating that it is
|
||||||
|
governed by this License along with a term that is a further
|
||||||
|
restriction, you may remove that term. If a license document contains
|
||||||
|
a further restriction but permits relicensing or conveying under this
|
||||||
|
License, you may add to a covered work material governed by the terms
|
||||||
|
of that license document, provided that the further restriction does
|
||||||
|
not survive such relicensing or conveying.
|
||||||
|
|
||||||
|
If you add terms to a covered work in accord with this section, you
|
||||||
|
must place, in the relevant source files, a statement of the
|
||||||
|
additional terms that apply to those files, or a notice indicating
|
||||||
|
where to find the applicable terms.
|
||||||
|
|
||||||
|
Additional terms, permissive or non-permissive, may be stated in the
|
||||||
|
form of a separately written license, or stated as exceptions;
|
||||||
|
the above requirements apply either way.
|
||||||
|
|
||||||
|
8. Termination.
|
||||||
|
|
||||||
|
You may not propagate or modify a covered work except as expressly
|
||||||
|
provided under this License. Any attempt otherwise to propagate or
|
||||||
|
modify it is void, and will automatically terminate your rights under
|
||||||
|
this License (including any patent licenses granted under the third
|
||||||
|
paragraph of section 11).
|
||||||
|
|
||||||
|
However, if you cease all violation of this License, then your
|
||||||
|
license from a particular copyright holder is reinstated (a)
|
||||||
|
provisionally, unless and until the copyright holder explicitly and
|
||||||
|
finally terminates your license, and (b) permanently, if the copyright
|
||||||
|
holder fails to notify you of the violation by some reasonable means
|
||||||
|
prior to 60 days after the cessation.
|
||||||
|
|
||||||
|
Moreover, your license from a particular copyright holder is
|
||||||
|
reinstated permanently if the copyright holder notifies you of the
|
||||||
|
violation by some reasonable means, this is the first time you have
|
||||||
|
received notice of violation of this License (for any work) from that
|
||||||
|
copyright holder, and you cure the violation prior to 30 days after
|
||||||
|
your receipt of the notice.
|
||||||
|
|
||||||
|
Termination of your rights under this section does not terminate the
|
||||||
|
licenses of parties who have received copies or rights from you under
|
||||||
|
this License. If your rights have been terminated and not permanently
|
||||||
|
reinstated, you do not qualify to receive new licenses for the same
|
||||||
|
material under section 10.
|
||||||
|
|
||||||
|
9. Acceptance Not Required for Having Copies.
|
||||||
|
|
||||||
|
You are not required to accept this License in order to receive or
|
||||||
|
run a copy of the Program. Ancillary propagation of a covered work
|
||||||
|
occurring solely as a consequence of using peer-to-peer transmission
|
||||||
|
to receive a copy likewise does not require acceptance. However,
|
||||||
|
nothing other than this License grants you permission to propagate or
|
||||||
|
modify any covered work. These actions infringe copyright if you do
|
||||||
|
not accept this License. Therefore, by modifying or propagating a
|
||||||
|
covered work, you indicate your acceptance of this License to do so.
|
||||||
|
|
||||||
|
10. Automatic Licensing of Downstream Recipients.
|
||||||
|
|
||||||
|
Each time you convey a covered work, the recipient automatically
|
||||||
|
receives a license from the original licensors, to run, modify and
|
||||||
|
propagate that work, subject to this License. You are not responsible
|
||||||
|
for enforcing compliance by third parties with this License.
|
||||||
|
|
||||||
|
An "entity transaction" is a transaction transferring control of an
|
||||||
|
organization, or substantially all assets of one, or subdividing an
|
||||||
|
organization, or merging organizations. If propagation of a covered
|
||||||
|
work results from an entity transaction, each party to that
|
||||||
|
transaction who receives a copy of the work also receives whatever
|
||||||
|
licenses to the work the party's predecessor in interest had or could
|
||||||
|
give under the previous paragraph, plus a right to possession of the
|
||||||
|
Corresponding Source of the work from the predecessor in interest, if
|
||||||
|
the predecessor has it or can get it with reasonable efforts.
|
||||||
|
|
||||||
|
You may not impose any further restrictions on the exercise of the
|
||||||
|
rights granted or affirmed under this License. For example, you may
|
||||||
|
not impose a license fee, royalty, or other charge for exercise of
|
||||||
|
rights granted under this License, and you may not initiate litigation
|
||||||
|
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||||
|
any patent claim is infringed by making, using, selling, offering for
|
||||||
|
sale, or importing the Program or any portion of it.
|
||||||
|
|
||||||
|
11. Patents.
|
||||||
|
|
||||||
|
A "contributor" is a copyright holder who authorizes use under this
|
||||||
|
License of the Program or a work on which the Program is based. The
|
||||||
|
work thus licensed is called the contributor's "contributor version".
|
||||||
|
|
||||||
|
A contributor's "essential patent claims" are all patent claims
|
||||||
|
owned or controlled by the contributor, whether already acquired or
|
||||||
|
hereafter acquired, that would be infringed by some manner, permitted
|
||||||
|
by this License, of making, using, or selling its contributor version,
|
||||||
|
but do not include claims that would be infringed only as a
|
||||||
|
consequence of further modification of the contributor version. For
|
||||||
|
purposes of this definition, "control" includes the right to grant
|
||||||
|
patent sublicenses in a manner consistent with the requirements of
|
||||||
|
this License.
|
||||||
|
|
||||||
|
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||||
|
patent license under the contributor's essential patent claims, to
|
||||||
|
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||||
|
propagate the contents of its contributor version.
|
||||||
|
|
||||||
|
In the following three paragraphs, a "patent license" is any express
|
||||||
|
agreement or commitment, however denominated, not to enforce a patent
|
||||||
|
(such as an express permission to practice a patent or covenant not to
|
||||||
|
sue for patent infringement). To "grant" such a patent license to a
|
||||||
|
party means to make such an agreement or commitment not to enforce a
|
||||||
|
patent against the party.
|
||||||
|
|
||||||
|
If you convey a covered work, knowingly relying on a patent license,
|
||||||
|
and the Corresponding Source of the work is not available for anyone
|
||||||
|
to copy, free of charge and under the terms of this License, through a
|
||||||
|
publicly available network server or other readily accessible means,
|
||||||
|
then you must either (1) cause the Corresponding Source to be so
|
||||||
|
available, or (2) arrange to deprive yourself of the benefit of the
|
||||||
|
patent license for this particular work, or (3) arrange, in a manner
|
||||||
|
consistent with the requirements of this License, to extend the patent
|
||||||
|
license to downstream recipients. "Knowingly relying" means you have
|
||||||
|
actual knowledge that, but for the patent license, your conveying the
|
||||||
|
covered work in a country, or your recipient's use of the covered work
|
||||||
|
in a country, would infringe one or more identifiable patents in that
|
||||||
|
country that you have reason to believe are valid.
|
||||||
|
|
||||||
|
If, pursuant to or in connection with a single transaction or
|
||||||
|
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||||
|
covered work, and grant a patent license to some of the parties
|
||||||
|
receiving the covered work authorizing them to use, propagate, modify
|
||||||
|
or convey a specific copy of the covered work, then the patent license
|
||||||
|
you grant is automatically extended to all recipients of the covered
|
||||||
|
work and works based on it.
|
||||||
|
|
||||||
|
A patent license is "discriminatory" if it does not include within
|
||||||
|
the scope of its coverage, prohibits the exercise of, or is
|
||||||
|
conditioned on the non-exercise of one or more of the rights that are
|
||||||
|
specifically granted under this License. You may not convey a covered
|
||||||
|
work if you are a party to an arrangement with a third party that is
|
||||||
|
in the business of distributing software, under which you make payment
|
||||||
|
to the third party based on the extent of your activity of conveying
|
||||||
|
the work, and under which the third party grants, to any of the
|
||||||
|
parties who would receive the covered work from you, a discriminatory
|
||||||
|
patent license (a) in connection with copies of the covered work
|
||||||
|
conveyed by you (or copies made from those copies), or (b) primarily
|
||||||
|
for and in connection with specific products or compilations that
|
||||||
|
contain the covered work, unless you entered into that arrangement,
|
||||||
|
or that patent license was granted, prior to 28 March 2007.
|
||||||
|
|
||||||
|
Nothing in this License shall be construed as excluding or limiting
|
||||||
|
any implied license or other defenses to infringement that may
|
||||||
|
otherwise be available to you under applicable patent law.
|
||||||
|
|
||||||
|
12. No Surrender of Others' Freedom.
|
||||||
|
|
||||||
|
If conditions are imposed on you (whether by court order, agreement or
|
||||||
|
otherwise) that contradict the conditions of this License, they do not
|
||||||
|
excuse you from the conditions of this License. If you cannot convey a
|
||||||
|
covered work so as to satisfy simultaneously your obligations under this
|
||||||
|
License and any other pertinent obligations, then as a consequence you may
|
||||||
|
not convey it at all. For example, if you agree to terms that obligate you
|
||||||
|
to collect a royalty for further conveying from those to whom you convey
|
||||||
|
the Program, the only way you could satisfy both those terms and this
|
||||||
|
License would be to refrain entirely from conveying the Program.
|
||||||
|
|
||||||
|
13. Use with the GNU Affero General Public License.
|
||||||
|
|
||||||
|
Notwithstanding any other provision of this License, you have
|
||||||
|
permission to link or combine any covered work with a work licensed
|
||||||
|
under version 3 of the GNU Affero General Public License into a single
|
||||||
|
combined work, and to convey the resulting work. The terms of this
|
||||||
|
License will continue to apply to the part which is the covered work,
|
||||||
|
but the special requirements of the GNU Affero General Public License,
|
||||||
|
section 13, concerning interaction through a network will apply to the
|
||||||
|
combination as such.
|
||||||
|
|
||||||
|
14. Revised Versions of this License.
|
||||||
|
|
||||||
|
The Free Software Foundation may publish revised and/or new versions of
|
||||||
|
the GNU General Public License from time to time. Such new versions will
|
||||||
|
be similar in spirit to the present version, but may differ in detail to
|
||||||
|
address new problems or concerns.
|
||||||
|
|
||||||
|
Each version is given a distinguishing version number. If the
|
||||||
|
Program specifies that a certain numbered version of the GNU General
|
||||||
|
Public License "or any later version" applies to it, you have the
|
||||||
|
option of following the terms and conditions either of that numbered
|
||||||
|
version or of any later version published by the Free Software
|
||||||
|
Foundation. If the Program does not specify a version number of the
|
||||||
|
GNU General Public License, you may choose any version ever published
|
||||||
|
by the Free Software Foundation.
|
||||||
|
|
||||||
|
If the Program specifies that a proxy can decide which future
|
||||||
|
versions of the GNU General Public License can be used, that proxy's
|
||||||
|
public statement of acceptance of a version permanently authorizes you
|
||||||
|
to choose that version for the Program.
|
||||||
|
|
||||||
|
Later license versions may give you additional or different
|
||||||
|
permissions. However, no additional obligations are imposed on any
|
||||||
|
author or copyright holder as a result of your choosing to follow a
|
||||||
|
later version.
|
||||||
|
|
||||||
|
15. Disclaimer of Warranty.
|
||||||
|
|
||||||
|
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||||
|
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||||
|
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||||
|
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||||
|
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||||
|
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||||
|
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||||
|
|
||||||
|
16. Limitation of Liability.
|
||||||
|
|
||||||
|
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||||
|
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||||
|
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||||
|
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||||
|
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||||
|
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||||
|
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||||
|
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||||
|
SUCH DAMAGES.
|
||||||
|
|
||||||
|
17. Interpretation of Sections 15 and 16.
|
||||||
|
|
||||||
|
If the disclaimer of warranty and limitation of liability provided
|
||||||
|
above cannot be given local legal effect according to their terms,
|
||||||
|
reviewing courts shall apply local law that most closely approximates
|
||||||
|
an absolute waiver of all civil liability in connection with the
|
||||||
|
Program, unless a warranty or assumption of liability accompanies a
|
||||||
|
copy of the Program in return for a fee.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
How to Apply These Terms to Your New Programs
|
||||||
|
|
||||||
|
If you develop a new program, and you want it to be of the greatest
|
||||||
|
possible use to the public, the best way to achieve this is to make it
|
||||||
|
free software which everyone can redistribute and change under these terms.
|
||||||
|
|
||||||
|
To do so, attach the following notices to the program. It is safest
|
||||||
|
to attach them to the start of each source file to most effectively
|
||||||
|
state the exclusion of warranty; and each file should have at least
|
||||||
|
the "copyright" line and a pointer to where the full notice is found.
|
||||||
|
|
||||||
|
<one line to give the program's name and a brief idea of what it does.>
|
||||||
|
Copyright (C) <year> <name of author>
|
||||||
|
|
||||||
|
This program is free software: you can redistribute it and/or modify
|
||||||
|
it under the terms of the GNU General Public License as published by
|
||||||
|
the Free Software Foundation, either version 3 of the License, or
|
||||||
|
(at your option) any later version.
|
||||||
|
|
||||||
|
This program is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
GNU General Public License for more details.
|
||||||
|
|
||||||
|
You should have received a copy of the GNU General Public License
|
||||||
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
Also add information on how to contact you by electronic and paper mail.
|
||||||
|
|
||||||
|
If the program does terminal interaction, make it output a short
|
||||||
|
notice like this when it starts in an interactive mode:
|
||||||
|
|
||||||
|
<program> Copyright (C) <year> <name of author>
|
||||||
|
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||||
|
This is free software, and you are welcome to redistribute it
|
||||||
|
under certain conditions; type `show c' for details.
|
||||||
|
|
||||||
|
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||||
|
parts of the General Public License. Of course, your program's commands
|
||||||
|
might be different; for a GUI interface, you would use an "about box".
|
||||||
|
|
||||||
|
You should also get your employer (if you work as a programmer) or school,
|
||||||
|
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||||
|
For more information on this, and how to apply and follow the GNU GPL, see
|
||||||
|
<http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
The GNU General Public License does not permit incorporating your program
|
||||||
|
into proprietary programs. If your program is a subroutine library, you
|
||||||
|
may consider it more useful to permit linking proprietary applications with
|
||||||
|
the library. If this is what you want to do, use the GNU Lesser General
|
||||||
|
Public License instead of this License. But first, please read
|
||||||
|
<http://www.gnu.org/philosophy/why-not-lgpl.html>.
|
||||||
18
Makefile
Normal file
18
Makefile
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
#!/usr/bin/make -f
|
||||||
|
|
||||||
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## genmkfile - Makefile - version 1.5
|
||||||
|
|
||||||
|
## This is a copy.
|
||||||
|
## master location:
|
||||||
|
## https://github.com/Whonix/genmkfile/blob/master/usr/share/genmkfile/Makefile
|
||||||
|
|
||||||
|
GENMKFILE_PATH ?= /usr/share/genmkfile
|
||||||
|
GENMKFILE_ROOT_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
|
||||||
|
|
||||||
|
export GENMKFILE_PATH
|
||||||
|
export GENMKFILE_ROOT_DIR
|
||||||
|
|
||||||
|
include $(GENMKFILE_PATH)/makefile-full
|
||||||
@ -1,68 +0,0 @@
|
|||||||
# Enhances Miscellaneous Security Settings #
|
|
||||||
|
|
||||||
https://github.com/Kicksecure/security-misc/blob/master/README.md
|
|
||||||
|
|
||||||
https://www.kicksecure.com/wiki/Security-misc
|
|
||||||
|
|
||||||
Discussion:
|
|
||||||
|
|
||||||
Happening primarily in Whonix forums.
|
|
||||||
https://forums.whonix.org/t/kernel-hardening/7296
|
|
||||||
|
|
||||||
## How to install `security-misc` using apt-get ##
|
|
||||||
|
|
||||||
1\. Download the APT Signing Key.
|
|
||||||
|
|
||||||
```
|
|
||||||
wget https://www.kicksecure.com/keys/derivative.asc
|
|
||||||
```
|
|
||||||
|
|
||||||
Users can [check the Signing Key](https://www.kicksecure.com/wiki/Signing_Key) for better security.
|
|
||||||
|
|
||||||
2\. Add the APT Signing Key.
|
|
||||||
|
|
||||||
```
|
|
||||||
sudo cp ~/derivative.asc /usr/share/keyrings/derivative.asc
|
|
||||||
```
|
|
||||||
|
|
||||||
3\. Add the derivative repository.
|
|
||||||
|
|
||||||
```
|
|
||||||
echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
|
|
||||||
```
|
|
||||||
|
|
||||||
4\. Update your package lists.
|
|
||||||
|
|
||||||
```
|
|
||||||
sudo apt-get update
|
|
||||||
```
|
|
||||||
|
|
||||||
5\. Install `security-misc`.
|
|
||||||
|
|
||||||
```
|
|
||||||
sudo apt-get install security-misc
|
|
||||||
```
|
|
||||||
|
|
||||||
## How to Build deb Package from Source Code ##
|
|
||||||
|
|
||||||
Can be build using standard Debian package build tools such as:
|
|
||||||
|
|
||||||
```
|
|
||||||
dpkg-buildpackage -b
|
|
||||||
```
|
|
||||||
|
|
||||||
See instructions.
|
|
||||||
|
|
||||||
NOTE: Replace `generic-package` with the actual name of this package `security-misc`.
|
|
||||||
|
|
||||||
* **A)** [easy](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package/easy), _OR_
|
|
||||||
* **B)** [including verifying software signatures](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package)
|
|
||||||
|
|
||||||
## Contact ##
|
|
||||||
|
|
||||||
* [Free Forum Support](https://forums.kicksecure.com)
|
|
||||||
* [Premium Support](https://www.kicksecure.com/wiki/Premium_Support)
|
|
||||||
|
|
||||||
## Donate ##
|
|
||||||
|
|
||||||
`security-misc` requires [donations](https://www.kicksecure.com/wiki/Donate) to stay alive!
|
|
||||||
11335
changelog.upstream
11335
changelog.upstream
File diff suppressed because it is too large
Load Diff
2150
debian/changelog
vendored
2150
debian/changelog
vendored
File diff suppressed because it is too large
Load Diff
1
debian/compat
vendored
Normal file
1
debian/compat
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
12
|
||||||
342
debian/control
vendored
342
debian/control
vendored
@ -1,41 +1,325 @@
|
|||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@kicksecure.com>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
Source: security-misc
|
Source: security-misc
|
||||||
Section: misc
|
Section: misc
|
||||||
Priority: optional
|
Priority: optional
|
||||||
Maintainer: Patrick Schleizer <adrelanos@kicksecure.com>
|
Maintainer: Patrick Schleizer <adrelanos@riseup.net>
|
||||||
Build-Depends: config-package-dev,
|
Build-Depends: debhelper (>= 12), genmkfile, config-package-dev, dh-apparmor,
|
||||||
debhelper (>= 13),
|
ronn
|
||||||
debhelper-compat (= 13),
|
Homepage: https://github.com/Whonix/security-misc
|
||||||
dh-apparmor,
|
Vcs-Browser: https://github.com/Whonix/security-misc
|
||||||
po-debconf
|
Vcs-Git: https://github.com/Whonix/security-misc.git
|
||||||
Homepage: https://www.kicksecure.com/wiki/Security-misc
|
Standards-Version: 4.3.0
|
||||||
Vcs-Browser: https://github.com/Kicksecure/security-misc
|
|
||||||
Vcs-Git: https://github.com/Kicksecure/security-misc.git
|
|
||||||
Standards-Version: 4.6.2
|
|
||||||
Rules-Requires-Root: no
|
|
||||||
|
|
||||||
Package: security-misc
|
Package: security-misc
|
||||||
Architecture: all
|
Architecture: all
|
||||||
Depends: adduser,
|
Depends: python, libglib2.0-bin, libpam-runtime, sudo, adduser, libcap2-bin,
|
||||||
apparmor-profile-dist,
|
apparmor-profile-anondist, helper-scripts, ${misc:Depends}
|
||||||
dmsetup,
|
Replaces: tcp-timestamps-disable
|
||||||
helper-scripts,
|
Description: enhances misc security settings
|
||||||
libcap2-bin,
|
Inspired by Kernel Self Protection Project (KSPP)
|
||||||
libglib2.0-bin,
|
|
||||||
libpam-modules-bin,
|
|
||||||
libpam-runtime,
|
|
||||||
libpam-umask,
|
|
||||||
python3,
|
|
||||||
secure-delete,
|
|
||||||
sudo,
|
|
||||||
${misc:Depends}
|
|
||||||
Replaces: anon-gpg-tweaks, swappiness-lowest, tcp-timestamps-disable
|
|
||||||
Description: Enhances Miscellaneous Security Settings
|
|
||||||
https://github.com/Kicksecure/security-misc/blob/master/README.md
|
|
||||||
.
|
.
|
||||||
https://www.kicksecure.com/wiki/Security-misc
|
* Implements most if not all recommended Linux kernel settings (sysctl) and
|
||||||
|
kernel parameters by KSPP.
|
||||||
|
.
|
||||||
|
* https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
|
||||||
|
.
|
||||||
|
kernel hardening:
|
||||||
|
.
|
||||||
|
* deactivates Netfilter's connection tracking helper
|
||||||
|
Netfilter's connection tracking helper module increases kernel attack
|
||||||
|
surface by enabling superfluous functionality such as IRC parsing in
|
||||||
|
the kernel. (!) Hence, this package disables this feature by shipping the
|
||||||
|
/etc/modprobe.d/30_nf_conntrack_helper_disable.conf configuration file.
|
||||||
|
.
|
||||||
|
* Kernel symbols in various files in /proc are hidden as they can be
|
||||||
|
very useful for kernel exploits.
|
||||||
|
.
|
||||||
|
* Kexec is disabled as it can be used to load a malicious kernel.
|
||||||
|
/etc/sysctl.d/kexec.conf
|
||||||
|
.
|
||||||
|
* ASLR effectiveness for mmap is increased.
|
||||||
|
.
|
||||||
|
* The TCP/IP stack is hardened by disabling ICMP redirect acceptance,
|
||||||
|
ICMP redirect sending and source routing to prevent man-in-the-middle attacks,
|
||||||
|
ignoring all ICMP requests, enabling TCP syncookies to prevent SYN flood
|
||||||
|
attacks, enabling RFC1337 to protect against time-wait assassination
|
||||||
|
attacks and enabling reverse path filtering to prevent IP spoofing and
|
||||||
|
mitigate vulnerabilities such as CVE-2019-14899.
|
||||||
|
.
|
||||||
|
* Some data spoofing attacks are made harder.
|
||||||
|
.
|
||||||
|
* SACK can be disabled as it is commonly exploited and is rarely used by
|
||||||
|
uncommenting settings in file /etc/sysctl.d/tcp_sack.conf.
|
||||||
|
.
|
||||||
|
* Slab merging is disabled as sometimes a slab can be used in a vulnerable
|
||||||
|
way which an attacker can exploit.
|
||||||
|
.
|
||||||
|
* Sanity checks and redzoning are enabled.
|
||||||
|
.
|
||||||
|
* Memory zeroing at allocation and free time is enabled.
|
||||||
|
.
|
||||||
|
* Machine checks (MCE) are disabled which makes the kernel panic
|
||||||
|
on uncorrectable errors in ECC memory that could be exploited.
|
||||||
|
.
|
||||||
|
* Kernel Page Table Isolation is enabled to mitigate Meltdown and increase
|
||||||
|
KASLR effectiveness.
|
||||||
|
.
|
||||||
|
* SMT is disabled as it can be used to exploit the MDS and other
|
||||||
|
vulnerabilities.
|
||||||
|
.
|
||||||
|
* All mitigations for the MDS vulnerability are enabled.
|
||||||
|
.
|
||||||
|
* A systemd service clears System.map on boot as these contain kernel symbols
|
||||||
|
that could be useful to an attacker.
|
||||||
|
/etc/kernel/postinst.d/30_remove-system-map
|
||||||
|
/lib/systemd/system/remove-system-map.service
|
||||||
|
/usr/lib/security-misc/remove-system.map
|
||||||
|
.
|
||||||
|
* Coredumps are disabled as they may contain important information such as
|
||||||
|
encryption keys or passwords.
|
||||||
|
/etc/security/limits.d/disable-coredumps.conf
|
||||||
|
/etc/sysctl.d/coredumps.conf
|
||||||
|
/lib/systemd/coredump.conf.d/disable-coredumps.conf
|
||||||
|
.
|
||||||
|
* The thunderbolt and firewire kernel modules are blacklisted as they can be
|
||||||
|
used for DMA (Direct Memory Access) attacks.
|
||||||
|
.
|
||||||
|
* IOMMU is enabled with a boot parameter to prevent DMA attacks.
|
||||||
|
.
|
||||||
|
* The kernel now panics on oopses to prevent it from continuing running a
|
||||||
|
flawed process.
|
||||||
|
.
|
||||||
|
* Bluetooth is blacklisted to reduce attack surface. Bluetooth also has
|
||||||
|
a history of security concerns.
|
||||||
|
https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
|
||||||
|
.
|
||||||
|
* A systemd service restricts /proc/cpuinfo, /proc/bus, /proc/scsi and
|
||||||
|
/sys to the root user only. This hides a lot of hardware identifiers from
|
||||||
|
unprivileged users and increases security as /sys exposes a lot of information
|
||||||
|
that shouldn't be accessible to unprivileged users. As this will break many
|
||||||
|
things, it is disabled by default and can optionally be enabled by running
|
||||||
|
`systemctl enable hide-hardware-info.service` as root.
|
||||||
|
/usr/lib/security-misc/hide-hardware-info
|
||||||
|
/lib/systemd/system/hide-hardware-info.service
|
||||||
|
/lib/systemd/system/user@.service.d/sysfs.conf
|
||||||
|
/etc/hide-hardware-info.d/30_default.conf
|
||||||
|
.
|
||||||
|
* The MSR kernel module is blacklisted to prevent CPU MSRs from being
|
||||||
|
abused to write to arbitrary memory.
|
||||||
|
.
|
||||||
|
* Vsyscalls are disabled as they are obsolete, are at fixed addresses and are
|
||||||
|
a target for ROP.
|
||||||
|
.
|
||||||
|
* Page allocator freelist randomization is enabled.
|
||||||
|
.
|
||||||
|
Improve Entropy Collection
|
||||||
|
.
|
||||||
|
* Load jitterentropy_rng kernel module.
|
||||||
|
/usr/lib/modules-load.d/30_security-misc.conf
|
||||||
|
.
|
||||||
|
* Distrusts the CPU for initial entropy at boot as it is not possible to
|
||||||
|
audit, may contain weaknesses or a backdoor.
|
||||||
|
* https://en.wikipedia.org/wiki/RDRAND#Reception
|
||||||
|
* https://twitter.com/pid_eins/status/1149649806056280069
|
||||||
|
* For more references, see:
|
||||||
|
* /etc/default/grub.d/40_distrust_cpu.cfg
|
||||||
|
.
|
||||||
|
Uncommon network protocols are blacklisted:
|
||||||
|
These are rarely used and may have unknown vulnerabilities.
|
||||||
|
/etc/modprobe.d/uncommon-network-protocols.conf
|
||||||
|
The network protocols that are blacklisted are:
|
||||||
|
.
|
||||||
|
* DCCP - Datagram Congestion Control Protocol
|
||||||
|
* SCTP - Stream Control Transmission Protocol
|
||||||
|
* RDS - Reliable Datagram Sockets
|
||||||
|
* TIPC - Transparent Inter-process Communication
|
||||||
|
* HDLC - High-Level Data Link Control
|
||||||
|
* AX25 - Amateur X.25
|
||||||
|
* NetRom
|
||||||
|
* X25
|
||||||
|
* ROSE
|
||||||
|
* DECnet
|
||||||
|
* Econet
|
||||||
|
* af_802154 - IEEE 802.15.4
|
||||||
|
* IPX - Internetwork Packet Exchange
|
||||||
|
* AppleTalk
|
||||||
|
* PSNAP - Subnetwork Access Protocol
|
||||||
|
* p8023 - Novell raw IEEE 802.3
|
||||||
|
* p8022 - IEEE 802.2
|
||||||
|
.
|
||||||
|
user restrictions:
|
||||||
|
.
|
||||||
|
* remount /home, /tmp, /dev/shm and /run with nosuid,nodev (default) and
|
||||||
|
noexec (opt-in). To disable this, run "sudo touch /etc/remount-disable". To
|
||||||
|
opt-in noexec, run "sudo touch /etc/noexec" and reboot (easiest).
|
||||||
|
Alternatively file /usr/local/etc/remount-disable or file
|
||||||
|
/usr/local/etc/noexec could be used.
|
||||||
|
/lib/systemd/system/remount-secure.service
|
||||||
|
/usr/lib/security-misc/remount-secure
|
||||||
|
.
|
||||||
|
* A systemd service mounts /proc with hidepid=2 at boot to prevent users from
|
||||||
|
seeing each other's processes.
|
||||||
|
.
|
||||||
|
* The kernel logs are restricted to root only.
|
||||||
|
.
|
||||||
|
* The BPF JIT compiler is restricted to the root user and is hardened.
|
||||||
|
.
|
||||||
|
* The ptrace system call is restricted to the root user only.
|
||||||
|
.
|
||||||
|
restricts access to the root account:
|
||||||
|
.
|
||||||
|
* `su` is restricted to only users within the group `sudo` which prevents
|
||||||
|
users from using `su` to gain root access or to switch user accounts.
|
||||||
|
/usr/share/pam-configs/wheel-security-misc
|
||||||
|
(Which results in a change in file `/etc/pam.d/common-auth`.)
|
||||||
|
.
|
||||||
|
* Add user `root` to group `sudo`. This is required to make above work so
|
||||||
|
login as a user in a virtual console is still possible.
|
||||||
|
debian/security-misc.postinst
|
||||||
|
.
|
||||||
|
* Abort login for users with locked passwords.
|
||||||
|
/usr/lib/security-misc/pam-abort-on-locked-password
|
||||||
|
.
|
||||||
|
* Logging into the root account from a virtual, serial, whatnot console is
|
||||||
|
prevented by shipping an existing and empty /etc/securetty.
|
||||||
|
(Deletion of /etc/securetty has a different effect.)
|
||||||
|
/etc/securetty.security-misc
|
||||||
|
.
|
||||||
|
* Console Lockdown.
|
||||||
|
Allow members of group 'console' to use console.
|
||||||
|
Everyone else except members of group
|
||||||
|
'console-unrestricted' are restricted from using console using ancient,
|
||||||
|
unpopular login methods such as using /bin/login over networks, which might
|
||||||
|
be exploitable. (CVE-2001-0797) Using pam_access.
|
||||||
|
Not enabled by default in this package since this package does not know which
|
||||||
|
users shall be added to group 'console' and would break console.
|
||||||
|
/usr/share/pam-configs/console-lockdown-security-misc
|
||||||
|
/etc/security/access-security-misc.conf
|
||||||
|
.
|
||||||
|
Protect Linux user accounts against brute force attacks.
|
||||||
|
Lock user accounts after 50 failed login attempts using pam_tally2.
|
||||||
|
/usr/share/pam-configs/tally2-security-misc
|
||||||
|
.
|
||||||
|
informational output during Linux PAM:
|
||||||
|
.
|
||||||
|
* Show failed and remaining password attempts.
|
||||||
|
* Document unlock procedure if Linux user account got locked.
|
||||||
|
* Point out, that there is no password feedback for `su`.
|
||||||
|
* Explain locked (root) account if locked.
|
||||||
|
* /usr/share/pam-configs/tally2-security-misc
|
||||||
|
* /usr/lib/security-misc/pam_tally2-info
|
||||||
|
* /usr/lib/security-misc/pam-abort-on-locked-password
|
||||||
|
.
|
||||||
|
access rights restrictions:
|
||||||
|
.
|
||||||
|
* Strong Linux User Account Separation.
|
||||||
|
Removes read, write and execute access for others for all users who have
|
||||||
|
home folders under folder /home by running for example
|
||||||
|
"chmod o-rwx /home/user"
|
||||||
|
during package installation, upgrade or pam mkhomedir. This will be done only
|
||||||
|
once per
|
||||||
|
folder in folder /home so users who wish to relax file permissions are free to
|
||||||
|
do so. This is to protect previously created files in user home folder which
|
||||||
|
were previously created with lax file permissions prior installation of this
|
||||||
|
package.
|
||||||
|
debian/security-misc.postinst
|
||||||
|
/usr/lib/security-misc/permission-lockdown
|
||||||
|
/usr/share/pam-configs/mkhomedir-security-misc
|
||||||
|
.
|
||||||
|
* SUID / GUID removal and permission hardening.
|
||||||
|
A systemd service removed SUID / GUID from non-essential binaries as these are
|
||||||
|
often used in privilege escalation attacks.
|
||||||
|
It is disabled by default for now during testing and can optionally be enabled
|
||||||
|
by running `systemctl enable permission-hardening.service` as root.
|
||||||
|
https://forums.whonix.org/t/disable-suid-binaries/7706
|
||||||
|
/usr/lib/security-misc/permission-hardening
|
||||||
|
/lib/systemd/system/permission-hardening.service
|
||||||
|
/etc/permission-hardening.d/30_default.conf
|
||||||
|
.
|
||||||
|
access rights relaxations:
|
||||||
|
.
|
||||||
|
Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with
|
||||||
|
hidepid.
|
||||||
|
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040
|
||||||
|
https://forums.whonix.org/t/cannot-use-pkexec/8129
|
||||||
|
/usr/bin/pkexec.security-misc
|
||||||
|
.
|
||||||
|
This package does (not yet) automatically lock the root account password.
|
||||||
|
It is not clear that would be sane in such a package.
|
||||||
|
It is recommended to lock and expire the root account.
|
||||||
|
In new Whonix builds, root account will be locked by package
|
||||||
|
anon-base-files.
|
||||||
|
https://www.whonix.org/wiki/Root
|
||||||
|
https://www.whonix.org/wiki/Dev/Permissions
|
||||||
|
https://forums.whonix.org/t/restrict-root-access/7658
|
||||||
|
However, a locked root password will break rescue and emergency shell.
|
||||||
|
Therefore this package enables passwordless resuce and emergency shell.
|
||||||
|
This is the same solution that Debian will likely addapt for Debian
|
||||||
|
installer.
|
||||||
|
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
|
||||||
|
Adverse security effects can be prevented by setting up BIOS password
|
||||||
|
protection, grub password protection and/or full disk encryption.
|
||||||
|
/etc/systemd/system/emergency.service.d/override.conf
|
||||||
|
/etc/systemd/system/rescue.service.d/override.conf
|
||||||
|
.
|
||||||
|
Disables TCP Time Stamps:
|
||||||
|
.
|
||||||
|
TCP time stamps (RFC 1323) allow for tracking clock
|
||||||
|
information with millisecond resolution. This may or may not allow an
|
||||||
|
attacker to learn information about the system clock at such
|
||||||
|
a resolution, depending on various issues such as network lag.
|
||||||
|
This information is available to anyone who monitors the network
|
||||||
|
somewhere between the attacked system and the destination server.
|
||||||
|
It may allow an attacker to find out how long a given
|
||||||
|
system has been running, and to distinguish several
|
||||||
|
systems running behind NAT and using the same IP address. It might
|
||||||
|
also allow one to look for clocks that match an expected value to find the
|
||||||
|
public IP used by a user.
|
||||||
|
.
|
||||||
|
Hence, this package disables this feature by shipping the
|
||||||
|
/etc/sysctl.d/tcp_timestamps.conf configuration file.
|
||||||
|
.
|
||||||
|
Note that TCP time stamps normally have some usefulness. They are
|
||||||
|
needed for:
|
||||||
|
.
|
||||||
|
* the TCP protection against wrapped sequence numbers; however, to
|
||||||
|
trigger a wrap, one needs to send roughly 2^32 packets in one
|
||||||
|
minute: as said in RFC 1700, "The current recommended default
|
||||||
|
time to live (TTL) for the Internet Protocol (IP) [45,105] is 64".
|
||||||
|
So, this probably won't be a practical problem in the context
|
||||||
|
of Anonymity Distributions.
|
||||||
|
* "Round-Trip Time Measurement", which is only useful when the user
|
||||||
|
manages to saturate their connection. When using Anonymity Distributions,
|
||||||
|
probably the limiting factor for transmission speed is rarely the capacity
|
||||||
|
of the user connection.
|
||||||
|
.
|
||||||
|
Application specific hardening:
|
||||||
|
.
|
||||||
|
* Enables APT seccomp-BPF sandboxing. /etc/apt/apt.conf.d/40sandbox
|
||||||
|
* Deactivates previews in Dolphin.
|
||||||
|
* Deactivates previews in Nautilus.
|
||||||
|
/usr/share/glib-2.0/schemas/30_security-misc.gschema.override
|
||||||
|
* Deactivates thumbnails in Thunar.
|
||||||
|
* Enables punycode (`network.IDN_show_punycode`) by default in Thunderbird
|
||||||
|
to make phising attacks more difficult. Fixing URL not showing real Domain
|
||||||
|
Name (Homograph attack).
|
||||||
|
.
|
||||||
|
Want more? Look into these:
|
||||||
|
.
|
||||||
|
* Linux Kernel Runtime Guard (LKRG). Kills whole Classes of Kernel Exploits.
|
||||||
|
* tirdad - TCP ISN CPU Information Leak Protection.
|
||||||
|
* Whonix ™ - Anonymous Operating System
|
||||||
|
* Kicksecure ™ - A Security-hardened, Non-anonymous Linux Distribution
|
||||||
|
* SecBrowser ™ - A Security-hardened, Non-anonymous Browser
|
||||||
|
* And more.
|
||||||
|
* https://www.whonix.org/wiki/Linux_Kernel_Runtime_Guard_LKRG
|
||||||
|
* https://github.com/Whonix/tirdad
|
||||||
|
* https://www.whonix.org
|
||||||
|
* https://www.whonix.org/wiki/Kicksecure
|
||||||
|
* https://www.whonix.org/wiki/SecBrowser
|
||||||
|
* https://github.com/Whonix
|
||||||
.
|
.
|
||||||
Discussion:
|
Discussion:
|
||||||
.
|
.
|
||||||
|
|||||||
723
debian/copyright
vendored
723
debian/copyright
vendored
@ -1,668 +1,73 @@
|
|||||||
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
||||||
|
|
||||||
Files: *
|
Files: *
|
||||||
Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
Copyright: 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
License: AGPL-3+
|
License: GPL-3+-with-additional-terms-1
|
||||||
|
This program is free software: you can redistribute it and/or modify
|
||||||
License: AGPL-3+
|
it under the terms of the GNU General Public License as published by
|
||||||
GNU AFFERO GENERAL PUBLIC LICENSE
|
the Free Software Foundation, either version 3 of the License, or
|
||||||
Version 3, 19 November 2007
|
(at your option) any later version.
|
||||||
.
|
.
|
||||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
This program is distributed in the hope that it will be useful,
|
||||||
Everyone is permitted to copy and distribute verbatim copies
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
of this license document, but changing it is not allowed.
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
.
|
GNU General Public License for more details.
|
||||||
Preamble
|
.
|
||||||
.
|
You should have received a copy of the GNU General Public License
|
||||||
The GNU Affero General Public License is a free, copyleft license for
|
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||||
software and other kinds of works, specifically designed to ensure
|
.
|
||||||
cooperation with the community in the case of network server software.
|
On Debian systems, the full text of the GNU General Public
|
||||||
.
|
License version 3 can be found in the file
|
||||||
The licenses for most software and other practical works are designed
|
`/usr/share/common-licenses/GPL-3'.
|
||||||
to take away your freedom to share and change the works. By contrast,
|
.
|
||||||
our General Public Licenses are intended to guarantee your freedom to
|
ADDITIONAL TERMS APPLICABLE per GNU GPL version 3 section 7
|
||||||
share and change all versions of a program--to make sure it remains free
|
.
|
||||||
software for all its users.
|
1. Replacement of Section 15. Section 15 of the GPL shall be deleted in its
|
||||||
.
|
entirety and replaced with the following:
|
||||||
When we speak of free software, we are referring to freedom, not
|
.
|
||||||
price. Our General Public Licenses are designed to make sure that you
|
15. Disclaimer of Warranty.
|
||||||
have the freedom to distribute copies of free software (and charge for
|
.
|
||||||
them if you wish), that you receive source code or can get it if you
|
THE PROGRAM IS PROVIDED WITHOUT ANY WARRANTIES, WHETHER EXPRESSED OR IMPLIED,
|
||||||
want it, that you can change the software or use pieces of it in new
|
INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR
|
||||||
free programs, and that you know you can do these things.
|
PURPOSE, NON-INFRINGEMENT, TITLE AND MERCHANTABILITY. THE PROGRAM IS BEING
|
||||||
.
|
DELIVERED OR MADE AVAILABLE 'AS IS', 'WITH ALL FAULTS' AND WITHOUT WARRANTY OR
|
||||||
Developers that use our General Public Licenses protect your rights
|
REPRESENTATION. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||||
with two steps: (1) assert copyright on the software, and (2) offer
|
PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||||
you this License which gives you legal permission to copy, distribute
|
|
||||||
and/or modify the software.
|
|
||||||
.
|
|
||||||
A secondary benefit of defending all users' freedom is that
|
|
||||||
improvements made in alternate versions of the program, if they
|
|
||||||
receive widespread use, become available for other developers to
|
|
||||||
incorporate. Many developers of free software are heartened and
|
|
||||||
encouraged by the resulting cooperation. However, in the case of
|
|
||||||
software used on network servers, this result may fail to come about.
|
|
||||||
The GNU General Public License permits making a modified version and
|
|
||||||
letting the public access it on a server without ever releasing its
|
|
||||||
source code to the public.
|
|
||||||
.
|
|
||||||
The GNU Affero General Public License is designed specifically to
|
|
||||||
ensure that, in such cases, the modified source code becomes available
|
|
||||||
to the community. It requires the operator of a network server to
|
|
||||||
provide the source code of the modified version running there to the
|
|
||||||
users of that server. Therefore, public use of a modified version, on
|
|
||||||
a publicly accessible server, gives the public access to the source
|
|
||||||
code of the modified version.
|
|
||||||
.
|
|
||||||
An older license, called the Affero General Public License and
|
|
||||||
published by Affero, was designed to accomplish similar goals. This is
|
|
||||||
a different license, not a version of the Affero GPL, but Affero has
|
|
||||||
released a new version of the Affero GPL which permits relicensing under
|
|
||||||
this license.
|
|
||||||
.
|
|
||||||
The precise terms and conditions for copying, distribution and
|
|
||||||
modification follow.
|
|
||||||
.
|
|
||||||
TERMS AND CONDITIONS
|
|
||||||
.
|
|
||||||
0. Definitions.
|
|
||||||
.
|
|
||||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
|
||||||
.
|
|
||||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
|
||||||
works, such as semiconductor masks.
|
|
||||||
.
|
|
||||||
"The Program" refers to any copyrightable work licensed under this
|
|
||||||
License. Each licensee is addressed as "you". "Licensees" and
|
|
||||||
"recipients" may be individuals or organizations.
|
|
||||||
.
|
|
||||||
To "modify" a work means to copy from or adapt all or part of the work
|
|
||||||
in a fashion requiring copyright permission, other than the making of an
|
|
||||||
exact copy. The resulting work is called a "modified version" of the
|
|
||||||
earlier work or a work "based on" the earlier work.
|
|
||||||
.
|
|
||||||
A "covered work" means either the unmodified Program or a work based
|
|
||||||
on the Program.
|
|
||||||
.
|
|
||||||
To "propagate" a work means to do anything with it that, without
|
|
||||||
permission, would make you directly or secondarily liable for
|
|
||||||
infringement under applicable copyright law, except executing it on a
|
|
||||||
computer or modifying a private copy. Propagation includes copying,
|
|
||||||
distribution (with or without modification), making available to the
|
|
||||||
public, and in some countries other activities as well.
|
|
||||||
.
|
|
||||||
To "convey" a work means any kind of propagation that enables other
|
|
||||||
parties to make or receive copies. Mere interaction with a user through
|
|
||||||
a computer network, with no transfer of a copy, is not conveying.
|
|
||||||
.
|
|
||||||
An interactive user interface displays "Appropriate Legal Notices"
|
|
||||||
to the extent that it includes a convenient and prominently visible
|
|
||||||
feature that (1) displays an appropriate copyright notice, and (2)
|
|
||||||
tells the user that there is no warranty for the work (except to the
|
|
||||||
extent that warranties are provided), that licensees may convey the
|
|
||||||
work under this License, and how to view a copy of this License. If
|
|
||||||
the interface presents a list of user commands or options, such as a
|
|
||||||
menu, a prominent item in the list meets this criterion.
|
|
||||||
.
|
|
||||||
1. Source Code.
|
|
||||||
.
|
|
||||||
The "source code" for a work means the preferred form of the work
|
|
||||||
for making modifications to it. "Object code" means any non-source
|
|
||||||
form of a work.
|
|
||||||
.
|
|
||||||
A "Standard Interface" means an interface that either is an official
|
|
||||||
standard defined by a recognized standards body, or, in the case of
|
|
||||||
interfaces specified for a particular programming language, one that
|
|
||||||
is widely used among developers working in that language.
|
|
||||||
.
|
|
||||||
The "System Libraries" of an executable work include anything, other
|
|
||||||
than the work as a whole, that (a) is included in the normal form of
|
|
||||||
packaging a Major Component, but which is not part of that Major
|
|
||||||
Component, and (b) serves only to enable use of the work with that
|
|
||||||
Major Component, or to implement a Standard Interface for which an
|
|
||||||
implementation is available to the public in source code form. A
|
|
||||||
"Major Component", in this context, means a major essential component
|
|
||||||
(kernel, window system, and so on) of the specific operating system
|
|
||||||
(if any) on which the executable work runs, or a compiler used to
|
|
||||||
produce the work, or an object code interpreter used to run it.
|
|
||||||
.
|
|
||||||
The "Corresponding Source" for a work in object code form means all
|
|
||||||
the source code needed to generate, install, and (for an executable
|
|
||||||
work) run the object code and to modify the work, including scripts to
|
|
||||||
control those activities. However, it does not include the work's
|
|
||||||
System Libraries, or general-purpose tools or generally available free
|
|
||||||
programs which are used unmodified in performing those activities but
|
|
||||||
which are not part of the work. For example, Corresponding Source
|
|
||||||
includes interface definition files associated with source files for
|
|
||||||
the work, and the source code for shared libraries and dynamically
|
|
||||||
linked subprograms that the work is specifically designed to require,
|
|
||||||
such as by intimate data communication or control flow between those
|
|
||||||
subprograms and other parts of the work.
|
|
||||||
.
|
|
||||||
The Corresponding Source need not include anything that users
|
|
||||||
can regenerate automatically from other parts of the Corresponding
|
|
||||||
Source.
|
|
||||||
.
|
|
||||||
The Corresponding Source for a work in source code form is that
|
|
||||||
same work.
|
|
||||||
.
|
|
||||||
2. Basic Permissions.
|
|
||||||
.
|
|
||||||
All rights granted under this License are granted for the term of
|
|
||||||
copyright on the Program, and are irrevocable provided the stated
|
|
||||||
conditions are met. This License explicitly affirms your unlimited
|
|
||||||
permission to run the unmodified Program. The output from running a
|
|
||||||
covered work is covered by this License only if the output, given its
|
|
||||||
content, constitutes a covered work. This License acknowledges your
|
|
||||||
rights of fair use or other equivalent, as provided by copyright law.
|
|
||||||
.
|
|
||||||
You may make, run and propagate covered works that you do not
|
|
||||||
convey, without conditions so long as your license otherwise remains
|
|
||||||
in force. You may convey covered works to others for the sole purpose
|
|
||||||
of having them make modifications exclusively for you, or provide you
|
|
||||||
with facilities for running those works, provided that you comply with
|
|
||||||
the terms of this License in conveying all material for which you do
|
|
||||||
not control copyright. Those thus making or running the covered works
|
|
||||||
for you must do so exclusively on your behalf, under your direction
|
|
||||||
and control, on terms that prohibit them from making any copies of
|
|
||||||
your copyrighted material outside their relationship with you.
|
|
||||||
.
|
|
||||||
Conveying under any other circumstances is permitted solely under
|
|
||||||
the conditions stated below. Sublicensing is not allowed; section 10
|
|
||||||
makes it unnecessary.
|
|
||||||
.
|
|
||||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
|
||||||
.
|
|
||||||
No covered work shall be deemed part of an effective technological
|
|
||||||
measure under any applicable law fulfilling obligations under article
|
|
||||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
|
||||||
similar laws prohibiting or restricting circumvention of such
|
|
||||||
measures.
|
|
||||||
.
|
|
||||||
When you convey a covered work, you waive any legal power to forbid
|
|
||||||
circumvention of technological measures to the extent such circumvention
|
|
||||||
is effected by exercising rights under this License with respect to
|
|
||||||
the covered work, and you disclaim any intention to limit operation or
|
|
||||||
modification of the work as a means of enforcing, against the work's
|
|
||||||
users, your or third parties' legal rights to forbid circumvention of
|
|
||||||
technological measures.
|
|
||||||
.
|
|
||||||
4. Conveying Verbatim Copies.
|
|
||||||
.
|
|
||||||
You may convey verbatim copies of the Program's source code as you
|
|
||||||
receive it, in any medium, provided that you conspicuously and
|
|
||||||
appropriately publish on each copy an appropriate copyright notice;
|
|
||||||
keep intact all notices stating that this License and any
|
|
||||||
non-permissive terms added in accord with section 7 apply to the code;
|
|
||||||
keep intact all notices of the absence of any warranty; and give all
|
|
||||||
recipients a copy of this License along with the Program.
|
|
||||||
.
|
|
||||||
You may charge any price or no price for each copy that you convey,
|
|
||||||
and you may offer support or warranty protection for a fee.
|
|
||||||
.
|
|
||||||
5. Conveying Modified Source Versions.
|
|
||||||
.
|
|
||||||
You may convey a work based on the Program, or the modifications to
|
|
||||||
produce it from the Program, in the form of source code under the
|
|
||||||
terms of section 4, provided that you also meet all of these conditions:
|
|
||||||
.
|
|
||||||
a) The work must carry prominent notices stating that you modified
|
|
||||||
it, and giving a relevant date.
|
|
||||||
.
|
|
||||||
b) The work must carry prominent notices stating that it is
|
|
||||||
released under this License and any conditions added under section
|
|
||||||
7. This requirement modifies the requirement in section 4 to
|
|
||||||
"keep intact all notices".
|
|
||||||
.
|
|
||||||
c) You must license the entire work, as a whole, under this
|
|
||||||
License to anyone who comes into possession of a copy. This
|
|
||||||
License will therefore apply, along with any applicable section 7
|
|
||||||
additional terms, to the whole of the work, and all its parts,
|
|
||||||
regardless of how they are packaged. This License gives no
|
|
||||||
permission to license the work in any other way, but it does not
|
|
||||||
invalidate such permission if you have separately received it.
|
|
||||||
.
|
|
||||||
d) If the work has interactive user interfaces, each must display
|
|
||||||
Appropriate Legal Notices; however, if the Program has interactive
|
|
||||||
interfaces that do not display Appropriate Legal Notices, your
|
|
||||||
work need not make them do so.
|
|
||||||
.
|
|
||||||
A compilation of a covered work with other separate and independent
|
|
||||||
works, which are not by their nature extensions of the covered work,
|
|
||||||
and which are not combined with it such as to form a larger program,
|
|
||||||
in or on a volume of a storage or distribution medium, is called an
|
|
||||||
"aggregate" if the compilation and its resulting copyright are not
|
|
||||||
used to limit the access or legal rights of the compilation's users
|
|
||||||
beyond what the individual works permit. Inclusion of a covered work
|
|
||||||
in an aggregate does not cause this License to apply to the other
|
|
||||||
parts of the aggregate.
|
|
||||||
.
|
|
||||||
6. Conveying Non-Source Forms.
|
|
||||||
.
|
|
||||||
You may convey a covered work in object code form under the terms
|
|
||||||
of sections 4 and 5, provided that you also convey the
|
|
||||||
machine-readable Corresponding Source under the terms of this License,
|
|
||||||
in one of these ways:
|
|
||||||
.
|
|
||||||
a) Convey the object code in, or embodied in, a physical product
|
|
||||||
(including a physical distribution medium), accompanied by the
|
|
||||||
Corresponding Source fixed on a durable physical medium
|
|
||||||
customarily used for software interchange.
|
|
||||||
.
|
|
||||||
b) Convey the object code in, or embodied in, a physical product
|
|
||||||
(including a physical distribution medium), accompanied by a
|
|
||||||
written offer, valid for at least three years and valid for as
|
|
||||||
long as you offer spare parts or customer support for that product
|
|
||||||
model, to give anyone who possesses the object code either (1) a
|
|
||||||
copy of the Corresponding Source for all the software in the
|
|
||||||
product that is covered by this License, on a durable physical
|
|
||||||
medium customarily used for software interchange, for a price no
|
|
||||||
more than your reasonable cost of physically performing this
|
|
||||||
conveying of source, or (2) access to copy the
|
|
||||||
Corresponding Source from a network server at no charge.
|
|
||||||
.
|
|
||||||
c) Convey individual copies of the object code with a copy of the
|
|
||||||
written offer to provide the Corresponding Source. This
|
|
||||||
alternative is allowed only occasionally and noncommercially, and
|
|
||||||
only if you received the object code with such an offer, in accord
|
|
||||||
with subsection 6b.
|
|
||||||
.
|
|
||||||
d) Convey the object code by offering access from a designated
|
|
||||||
place (gratis or for a charge), and offer equivalent access to the
|
|
||||||
Corresponding Source in the same way through the same place at no
|
|
||||||
further charge. You need not require recipients to copy the
|
|
||||||
Corresponding Source along with the object code. If the place to
|
|
||||||
copy the object code is a network server, the Corresponding Source
|
|
||||||
may be on a different server (operated by you or a third party)
|
|
||||||
that supports equivalent copying facilities, provided you maintain
|
|
||||||
clear directions next to the object code saying where to find the
|
|
||||||
Corresponding Source. Regardless of what server hosts the
|
|
||||||
Corresponding Source, you remain obligated to ensure that it is
|
|
||||||
available for as long as needed to satisfy these requirements.
|
|
||||||
.
|
|
||||||
e) Convey the object code using peer-to-peer transmission, provided
|
|
||||||
you inform other peers where the object code and Corresponding
|
|
||||||
Source of the work are being offered to the general public at no
|
|
||||||
charge under subsection 6d.
|
|
||||||
.
|
|
||||||
A separable portion of the object code, whose source code is excluded
|
|
||||||
from the Corresponding Source as a System Library, need not be
|
|
||||||
included in conveying the object code work.
|
|
||||||
.
|
|
||||||
A "User Product" is either (1) a "consumer product", which means any
|
|
||||||
tangible personal property which is normally used for personal, family,
|
|
||||||
or household purposes, or (2) anything designed or sold for incorporation
|
|
||||||
into a dwelling. In determining whether a product is a consumer product,
|
|
||||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
|
||||||
product received by a particular user, "normally used" refers to a
|
|
||||||
typical or common use of that class of product, regardless of the status
|
|
||||||
of the particular user or of the way in which the particular user
|
|
||||||
actually uses, or expects or is expected to use, the product. A product
|
|
||||||
is a consumer product regardless of whether the product has substantial
|
|
||||||
commercial, industrial or non-consumer uses, unless such uses represent
|
|
||||||
the only significant mode of use of the product.
|
|
||||||
.
|
|
||||||
"Installation Information" for a User Product means any methods,
|
|
||||||
procedures, authorization keys, or other information required to install
|
|
||||||
and execute modified versions of a covered work in that User Product from
|
|
||||||
a modified version of its Corresponding Source. The information must
|
|
||||||
suffice to ensure that the continued functioning of the modified object
|
|
||||||
code is in no case prevented or interfered with solely because
|
|
||||||
modification has been made.
|
|
||||||
.
|
|
||||||
If you convey an object code work under this section in, or with, or
|
|
||||||
specifically for use in, a User Product, and the conveying occurs as
|
|
||||||
part of a transaction in which the right of possession and use of the
|
|
||||||
User Product is transferred to the recipient in perpetuity or for a
|
|
||||||
fixed term (regardless of how the transaction is characterized), the
|
|
||||||
Corresponding Source conveyed under this section must be accompanied
|
|
||||||
by the Installation Information. But this requirement does not apply
|
|
||||||
if neither you nor any third party retains the ability to install
|
|
||||||
modified object code on the User Product (for example, the work has
|
|
||||||
been installed in ROM).
|
|
||||||
.
|
|
||||||
The requirement to provide Installation Information does not include a
|
|
||||||
requirement to continue to provide support service, warranty, or updates
|
|
||||||
for a work that has been modified or installed by the recipient, or for
|
|
||||||
the User Product in which it has been modified or installed. Access to a
|
|
||||||
network may be denied when the modification itself materially and
|
|
||||||
adversely affects the operation of the network or violates the rules and
|
|
||||||
protocols for communication across the network.
|
|
||||||
.
|
|
||||||
Corresponding Source conveyed, and Installation Information provided,
|
|
||||||
in accord with this section must be in a format that is publicly
|
|
||||||
documented (and with an implementation available to the public in
|
|
||||||
source code form), and must require no special password or key for
|
|
||||||
unpacking, reading or copying.
|
|
||||||
.
|
|
||||||
7. Additional Terms.
|
|
||||||
.
|
|
||||||
"Additional permissions" are terms that supplement the terms of this
|
|
||||||
License by making exceptions from one or more of its conditions.
|
|
||||||
Additional permissions that are applicable to the entire Program shall
|
|
||||||
be treated as though they were included in this License, to the extent
|
|
||||||
that they are valid under applicable law. If additional permissions
|
|
||||||
apply only to part of the Program, that part may be used separately
|
|
||||||
under those permissions, but the entire Program remains governed by
|
|
||||||
this License without regard to the additional permissions.
|
|
||||||
.
|
|
||||||
When you convey a copy of a covered work, you may at your option
|
|
||||||
remove any additional permissions from that copy, or from any part of
|
|
||||||
it. (Additional permissions may be written to require their own
|
|
||||||
removal in certain cases when you modify the work.) You may place
|
|
||||||
additional permissions on material, added by you to a covered work,
|
|
||||||
for which you have or can give appropriate copyright permission.
|
|
||||||
.
|
|
||||||
Notwithstanding any other provision of this License, for material you
|
|
||||||
add to a covered work, you may (if authorized by the copyright holders of
|
|
||||||
that material) supplement the terms of this License with terms:
|
|
||||||
.
|
|
||||||
a) Disclaiming warranty or limiting liability differently from the
|
|
||||||
terms of sections 15 and 16 of this License; or
|
|
||||||
.
|
|
||||||
b) Requiring preservation of specified reasonable legal notices or
|
|
||||||
author attributions in that material or in the Appropriate Legal
|
|
||||||
Notices displayed by works containing it; or
|
|
||||||
.
|
|
||||||
c) Prohibiting misrepresentation of the origin of that material, or
|
|
||||||
requiring that modified versions of such material be marked in
|
|
||||||
reasonable ways as different from the original version; or
|
|
||||||
.
|
|
||||||
d) Limiting the use for publicity purposes of names of licensors or
|
|
||||||
authors of the material; or
|
|
||||||
.
|
|
||||||
e) Declining to grant rights under trademark law for use of some
|
|
||||||
trade names, trademarks, or service marks; or
|
|
||||||
.
|
|
||||||
f) Requiring indemnification of licensors and authors of that
|
|
||||||
material by anyone who conveys the material (or modified versions of
|
|
||||||
it) with contractual assumptions of liability to the recipient, for
|
|
||||||
any liability that these contractual assumptions directly impose on
|
|
||||||
those licensors and authors.
|
|
||||||
.
|
|
||||||
All other non-permissive additional terms are considered "further
|
|
||||||
restrictions" within the meaning of section 10. If the Program as you
|
|
||||||
received it, or any part of it, contains a notice stating that it is
|
|
||||||
governed by this License along with a term that is a further
|
|
||||||
restriction, you may remove that term. If a license document contains
|
|
||||||
a further restriction but permits relicensing or conveying under this
|
|
||||||
License, you may add to a covered work material governed by the terms
|
|
||||||
of that license document, provided that the further restriction does
|
|
||||||
not survive such relicensing or conveying.
|
|
||||||
.
|
|
||||||
If you add terms to a covered work in accord with this section, you
|
|
||||||
must place, in the relevant source files, a statement of the
|
|
||||||
additional terms that apply to those files, or a notice indicating
|
|
||||||
where to find the applicable terms.
|
|
||||||
.
|
|
||||||
Additional terms, permissive or non-permissive, may be stated in the
|
|
||||||
form of a separately written license, or stated as exceptions;
|
|
||||||
the above requirements apply either way.
|
|
||||||
.
|
|
||||||
8. Termination.
|
|
||||||
.
|
|
||||||
You may not propagate or modify a covered work except as expressly
|
|
||||||
provided under this License. Any attempt otherwise to propagate or
|
|
||||||
modify it is void, and will automatically terminate your rights under
|
|
||||||
this License (including any patent licenses granted under the third
|
|
||||||
paragraph of section 11).
|
|
||||||
.
|
|
||||||
However, if you cease all violation of this License, then your
|
|
||||||
license from a particular copyright holder is reinstated (a)
|
|
||||||
provisionally, unless and until the copyright holder explicitly and
|
|
||||||
finally terminates your license, and (b) permanently, if the copyright
|
|
||||||
holder fails to notify you of the violation by some reasonable means
|
|
||||||
prior to 60 days after the cessation.
|
|
||||||
.
|
|
||||||
Moreover, your license from a particular copyright holder is
|
|
||||||
reinstated permanently if the copyright holder notifies you of the
|
|
||||||
violation by some reasonable means, this is the first time you have
|
|
||||||
received notice of violation of this License (for any work) from that
|
|
||||||
copyright holder, and you cure the violation prior to 30 days after
|
|
||||||
your receipt of the notice.
|
|
||||||
.
|
|
||||||
Termination of your rights under this section does not terminate the
|
|
||||||
licenses of parties who have received copies or rights from you under
|
|
||||||
this License. If your rights have been terminated and not permanently
|
|
||||||
reinstated, you do not qualify to receive new licenses for the same
|
|
||||||
material under section 10.
|
|
||||||
.
|
|
||||||
9. Acceptance Not Required for Having Copies.
|
|
||||||
.
|
|
||||||
You are not required to accept this License in order to receive or
|
|
||||||
run a copy of the Program. Ancillary propagation of a covered work
|
|
||||||
occurring solely as a consequence of using peer-to-peer transmission
|
|
||||||
to receive a copy likewise does not require acceptance. However,
|
|
||||||
nothing other than this License grants you permission to propagate or
|
|
||||||
modify any covered work. These actions infringe copyright if you do
|
|
||||||
not accept this License. Therefore, by modifying or propagating a
|
|
||||||
covered work, you indicate your acceptance of this License to do so.
|
|
||||||
.
|
|
||||||
10. Automatic Licensing of Downstream Recipients.
|
|
||||||
.
|
|
||||||
Each time you convey a covered work, the recipient automatically
|
|
||||||
receives a license from the original licensors, to run, modify and
|
|
||||||
propagate that work, subject to this License. You are not responsible
|
|
||||||
for enforcing compliance by third parties with this License.
|
|
||||||
.
|
|
||||||
An "entity transaction" is a transaction transferring control of an
|
|
||||||
organization, or substantially all assets of one, or subdividing an
|
|
||||||
organization, or merging organizations. If propagation of a covered
|
|
||||||
work results from an entity transaction, each party to that
|
|
||||||
transaction who receives a copy of the work also receives whatever
|
|
||||||
licenses to the work the party's predecessor in interest had or could
|
|
||||||
give under the previous paragraph, plus a right to possession of the
|
|
||||||
Corresponding Source of the work from the predecessor in interest, if
|
|
||||||
the predecessor has it or can get it with reasonable efforts.
|
|
||||||
.
|
|
||||||
You may not impose any further restrictions on the exercise of the
|
|
||||||
rights granted or affirmed under this License. For example, you may
|
|
||||||
not impose a license fee, royalty, or other charge for exercise of
|
|
||||||
rights granted under this License, and you may not initiate litigation
|
|
||||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
|
||||||
any patent claim is infringed by making, using, selling, offering for
|
|
||||||
sale, or importing the Program or any portion of it.
|
|
||||||
.
|
|
||||||
11. Patents.
|
|
||||||
.
|
|
||||||
A "contributor" is a copyright holder who authorizes use under this
|
|
||||||
License of the Program or a work on which the Program is based. The
|
|
||||||
work thus licensed is called the contributor's "contributor version".
|
|
||||||
.
|
|
||||||
A contributor's "essential patent claims" are all patent claims
|
|
||||||
owned or controlled by the contributor, whether already acquired or
|
|
||||||
hereafter acquired, that would be infringed by some manner, permitted
|
|
||||||
by this License, of making, using, or selling its contributor version,
|
|
||||||
but do not include claims that would be infringed only as a
|
|
||||||
consequence of further modification of the contributor version. For
|
|
||||||
purposes of this definition, "control" includes the right to grant
|
|
||||||
patent sublicenses in a manner consistent with the requirements of
|
|
||||||
this License.
|
|
||||||
.
|
|
||||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
|
||||||
patent license under the contributor's essential patent claims, to
|
|
||||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
|
||||||
propagate the contents of its contributor version.
|
|
||||||
.
|
|
||||||
In the following three paragraphs, a "patent license" is any express
|
|
||||||
agreement or commitment, however denominated, not to enforce a patent
|
|
||||||
(such as an express permission to practice a patent or covenant not to
|
|
||||||
sue for patent infringement). To "grant" such a patent license to a
|
|
||||||
party means to make such an agreement or commitment not to enforce a
|
|
||||||
patent against the party.
|
|
||||||
.
|
|
||||||
If you convey a covered work, knowingly relying on a patent license,
|
|
||||||
and the Corresponding Source of the work is not available for anyone
|
|
||||||
to copy, free of charge and under the terms of this License, through a
|
|
||||||
publicly available network server or other readily accessible means,
|
|
||||||
then you must either (1) cause the Corresponding Source to be so
|
|
||||||
available, or (2) arrange to deprive yourself of the benefit of the
|
|
||||||
patent license for this particular work, or (3) arrange, in a manner
|
|
||||||
consistent with the requirements of this License, to extend the patent
|
|
||||||
license to downstream recipients. "Knowingly relying" means you have
|
|
||||||
actual knowledge that, but for the patent license, your conveying the
|
|
||||||
covered work in a country, or your recipient's use of the covered work
|
|
||||||
in a country, would infringe one or more identifiable patents in that
|
|
||||||
country that you have reason to believe are valid.
|
|
||||||
.
|
|
||||||
If, pursuant to or in connection with a single transaction or
|
|
||||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
|
||||||
covered work, and grant a patent license to some of the parties
|
|
||||||
receiving the covered work authorizing them to use, propagate, modify
|
|
||||||
or convey a specific copy of the covered work, then the patent license
|
|
||||||
you grant is automatically extended to all recipients of the covered
|
|
||||||
work and works based on it.
|
|
||||||
.
|
|
||||||
A patent license is "discriminatory" if it does not include within
|
|
||||||
the scope of its coverage, prohibits the exercise of, or is
|
|
||||||
conditioned on the non-exercise of one or more of the rights that are
|
|
||||||
specifically granted under this License. You may not convey a covered
|
|
||||||
work if you are a party to an arrangement with a third party that is
|
|
||||||
in the business of distributing software, under which you make payment
|
|
||||||
to the third party based on the extent of your activity of conveying
|
|
||||||
the work, and under which the third party grants, to any of the
|
|
||||||
parties who would receive the covered work from you, a discriminatory
|
|
||||||
patent license (a) in connection with copies of the covered work
|
|
||||||
conveyed by you (or copies made from those copies), or (b) primarily
|
|
||||||
for and in connection with specific products or compilations that
|
|
||||||
contain the covered work, unless you entered into that arrangement,
|
|
||||||
or that patent license was granted, prior to 28 March 2007.
|
|
||||||
.
|
|
||||||
Nothing in this License shall be construed as excluding or limiting
|
|
||||||
any implied license or other defenses to infringement that may
|
|
||||||
otherwise be available to you under applicable patent law.
|
|
||||||
.
|
|
||||||
12. No Surrender of Others' Freedom.
|
|
||||||
.
|
|
||||||
If conditions are imposed on you (whether by court order, agreement or
|
|
||||||
otherwise) that contradict the conditions of this License, they do not
|
|
||||||
excuse you from the conditions of this License. If you cannot convey a
|
|
||||||
covered work so as to satisfy simultaneously your obligations under this
|
|
||||||
License and any other pertinent obligations, then as a consequence you may
|
|
||||||
not convey it at all. For example, if you agree to terms that obligate you
|
|
||||||
to collect a royalty for further conveying from those to whom you convey
|
|
||||||
the Program, the only way you could satisfy both those terms and this
|
|
||||||
License would be to refrain entirely from conveying the Program.
|
|
||||||
.
|
|
||||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
|
||||||
.
|
|
||||||
Notwithstanding any other provision of this License, if you modify the
|
|
||||||
Program, your modified version must prominently offer all users
|
|
||||||
interacting with it remotely through a computer network (if your version
|
|
||||||
supports such interaction) an opportunity to receive the Corresponding
|
|
||||||
Source of your version by providing access to the Corresponding Source
|
|
||||||
from a network server at no charge, through some standard or customary
|
|
||||||
means of facilitating copying of software. This Corresponding Source
|
|
||||||
shall include the Corresponding Source for any work covered by version 3
|
|
||||||
of the GNU General Public License that is incorporated pursuant to the
|
|
||||||
following paragraph.
|
|
||||||
.
|
|
||||||
Notwithstanding any other provision of this License, you have
|
|
||||||
permission to link or combine any covered work with a work licensed
|
|
||||||
under version 3 of the GNU General Public License into a single
|
|
||||||
combined work, and to convey the resulting work. The terms of this
|
|
||||||
License will continue to apply to the part which is the covered work,
|
|
||||||
but the work with which it is combined will remain governed by version
|
|
||||||
3 of the GNU General Public License.
|
|
||||||
.
|
|
||||||
14. Revised Versions of this License.
|
|
||||||
.
|
|
||||||
The Free Software Foundation may publish revised and/or new versions of
|
|
||||||
the GNU Affero General Public License from time to time. Such new versions
|
|
||||||
will be similar in spirit to the present version, but may differ in detail to
|
|
||||||
address new problems or concerns.
|
|
||||||
.
|
|
||||||
Each version is given a distinguishing version number. If the
|
|
||||||
Program specifies that a certain numbered version of the GNU Affero General
|
|
||||||
Public License "or any later version" applies to it, you have the
|
|
||||||
option of following the terms and conditions either of that numbered
|
|
||||||
version or of any later version published by the Free Software
|
|
||||||
Foundation. If the Program does not specify a version number of the
|
|
||||||
GNU Affero General Public License, you may choose any version ever published
|
|
||||||
by the Free Software Foundation.
|
|
||||||
.
|
|
||||||
If the Program specifies that a proxy can decide which future
|
|
||||||
versions of the GNU Affero General Public License can be used, that proxy's
|
|
||||||
public statement of acceptance of a version permanently authorizes you
|
|
||||||
to choose that version for the Program.
|
|
||||||
.
|
|
||||||
Later license versions may give you additional or different
|
|
||||||
permissions. However, no additional obligations are imposed on any
|
|
||||||
author or copyright holder as a result of your choosing to follow a
|
|
||||||
later version.
|
|
||||||
.
|
|
||||||
15. Disclaimer of Warranty.
|
|
||||||
.
|
|
||||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
|
||||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
|
||||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
|
||||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
|
||||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
||||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
|
||||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
|
||||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||||
.
|
.
|
||||||
16. Limitation of Liability.
|
2. Replacement of Section 16. Section 16 of the GPL shall be deleted in its
|
||||||
|
entirety and replaced with the following:
|
||||||
.
|
.
|
||||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
16. LIMITATION OF LIABILITY.
|
||||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
|
||||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
|
||||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
|
||||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
|
||||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
|
||||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
|
||||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
|
||||||
SUCH DAMAGES.
|
|
||||||
.
|
.
|
||||||
17. Interpretation of Sections 15 and 16.
|
UNDER NO CIRCUMSTANCES SHALL ANY COPYRIGHT HOLDER OR ITS AFFILIATES, OR ANY
|
||||||
|
OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE
|
||||||
|
LIABLE TO YOU, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, FOR ANY
|
||||||
|
DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, DIRECT, INDIRECT, SPECIAL,
|
||||||
|
INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES ARISING FROM, OUT OF OR IN
|
||||||
|
CONNECTION WITH THE USE OR INABILITY TO USE THE PROGRAM OR OTHER DEALINGS WITH
|
||||||
|
THE PROGRAM(INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED
|
||||||
|
INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE
|
||||||
|
PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), WHETHER OR NOT ANY COPYRIGHT HOLDER
|
||||||
|
OR SUCH OTHER PARTY RECEIVES NOTICE OF ANY SUCH DAMAGES AND WHETHER OR NOT SUCH
|
||||||
|
DAMAGES COULD HAVE BEEN FORESEEN.
|
||||||
.
|
.
|
||||||
If the disclaimer of warranty and limitation of liability provided
|
3. LEGAL NOTICES; NO TRADEMARK LICENSE; ORIGIN. You must reproduce faithfully
|
||||||
above cannot be given local legal effect according to their terms,
|
all trademark, copyright and other proprietary and legal notices on any copies
|
||||||
reviewing courts shall apply local law that most closely approximates
|
of the Program or any other required author attributions. This license does not
|
||||||
an absolute waiver of all civil liability in connection with the
|
grant you rights to use any copyright holder or any other party's name, logo, or
|
||||||
Program, unless a warranty or assumption of liability accompanies a
|
trademarks. Neither the name of the copyright holder or its affiliates, or any
|
||||||
copy of the Program in return for a fee.
|
other party who modifies and/or conveys the Program may be used to endorse or
|
||||||
|
promote products derived from this software without specific prior written
|
||||||
|
permission. The origin of the Program must not be misrepresented; you must not
|
||||||
|
claim that you wrote the original Program. Altered source versions must be
|
||||||
|
plainly marked as such, and must not be misrepresented as being the original
|
||||||
|
Program.
|
||||||
.
|
.
|
||||||
END OF TERMS AND CONDITIONS
|
4. INDEMNIFICATION. IF YOU CONVEY A COVERED WORK AND AGREE WITH ANY RECIPIENT
|
||||||
.
|
OF THAT COVERED WORK THAT YOU WILL ASSUME ANY LIABILITY FOR THAT COVERED WORK,
|
||||||
How to Apply These Terms to Your New Programs
|
YOU HEREBY AGREE TO INDEMNIFY, DEFEND AND HOLD HARMLESS THE OTHER LICENSORS AND
|
||||||
.
|
AUTHORS OF THAT COVERED WORK FOR ANY DAMAGES, DEMANDS, CLAIMS, LOSSES, CAUSES OF
|
||||||
If you develop a new program, and you want it to be of the greatest
|
ACTION, LAWSUITS, JUDGMENTS EXPENSES (INCLUDING WITHOUT LIMITATION REASONABLE
|
||||||
possible use to the public, the best way to achieve this is to make it
|
ATTORNEYS' FEES AND EXPENSES) OR ANY OTHER LIABILITY ARISING FROM, RELATED TO OR
|
||||||
free software which everyone can redistribute and change under these terms.
|
IN CONNECTION WITH YOUR ASSUMPTIONS OF LIABILITY.
|
||||||
.
|
|
||||||
To do so, attach the following notices to the program. It is safest
|
|
||||||
to attach them to the start of each source file to most effectively
|
|
||||||
state the exclusion of warranty; and each file should have at least
|
|
||||||
the "copyright" line and a pointer to where the full notice is found.
|
|
||||||
.
|
|
||||||
<one line to give the program's name and a brief idea of what it does.>
|
|
||||||
Copyright (C) <year> <name of author>
|
|
||||||
.
|
|
||||||
This program is free software: you can redistribute it and/or modify
|
|
||||||
it under the terms of the GNU Affero General Public License as published by
|
|
||||||
the Free Software Foundation, either version 3 of the License, or
|
|
||||||
(at your option) any later version.
|
|
||||||
.
|
|
||||||
This program is distributed in the hope that it will be useful,
|
|
||||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
GNU Affero General Public License for more details.
|
|
||||||
.
|
|
||||||
You should have received a copy of the GNU Affero General Public License
|
|
||||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
||||||
.
|
|
||||||
Also add information on how to contact you by electronic and paper mail.
|
|
||||||
.
|
|
||||||
If your software can interact with users remotely through a computer
|
|
||||||
network, you should also make sure that it provides a way for users to
|
|
||||||
get its source. For example, if your program is a web application, its
|
|
||||||
interface could display a "Source" link that leads users to an archive
|
|
||||||
of the code. There are many ways you could offer source, and different
|
|
||||||
solutions will be better for different programs; see section 13 for the
|
|
||||||
specific requirements.
|
|
||||||
.
|
|
||||||
You should also get your employer (if you work as a programmer) or school,
|
|
||||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
|
||||||
For more information on this, and how to apply and follow the GNU AGPL, see
|
|
||||||
<https://www.gnu.org/licenses/>.
|
|
||||||
|
|||||||
7
debian/make-helper-overrides.bsh
vendored
7
debian/make-helper-overrides.bsh
vendored
@ -1,7 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/24
|
|
||||||
genmkfile_lintian_post_opts+=" --suppress-tags obsolete-command-in-modprobe.d-file --suppress-tags no-complete-debconf-translation"
|
|
||||||
1
debian/po/POTFILES.in
vendored
1
debian/po/POTFILES.in
vendored
@ -1 +0,0 @@
|
|||||||
[type: gettext/rfc822deb] security-misc.templates
|
|
||||||
36
debian/po/templates.pot
vendored
36
debian/po/templates.pot
vendored
@ -1,36 +0,0 @@
|
|||||||
# SOME DESCRIPTIVE TITLE.
|
|
||||||
# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
|
|
||||||
# This file is distributed under the same license as the security-misc package.
|
|
||||||
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
|
|
||||||
#
|
|
||||||
#, fuzzy
|
|
||||||
msgid ""
|
|
||||||
msgstr ""
|
|
||||||
"Project-Id-Version: security-misc\n"
|
|
||||||
"Report-Msgid-Bugs-To: security-misc@packages.debian.org\n"
|
|
||||||
"POT-Creation-Date: 2025-01-14 09:31-0500\n"
|
|
||||||
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
|
|
||||||
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
|
|
||||||
"Language-Team: LANGUAGE <LL@li.org>\n"
|
|
||||||
"Language: \n"
|
|
||||||
"MIME-Version: 1.0\n"
|
|
||||||
"Content-Type: text/plain; charset=CHARSET\n"
|
|
||||||
"Content-Transfer-Encoding: 8bit\n"
|
|
||||||
|
|
||||||
#. Type: note
|
|
||||||
#. Description
|
|
||||||
#: ../security-misc.templates:1001
|
|
||||||
msgid "Manual intervention may be required for permission-hardener update"
|
|
||||||
msgstr ""
|
|
||||||
|
|
||||||
#. Type: note
|
|
||||||
#. Description
|
|
||||||
#: ../security-misc.templates:1001
|
|
||||||
msgid ""
|
|
||||||
"No need to panic. Nothing is broken. A rare condition has been encountered. "
|
|
||||||
"permission-hardener is being updated to fix a minor bug that caused "
|
|
||||||
"corruption in the permission-hardener state file. If you installed your own "
|
|
||||||
"custom permission-hardener configuration, some manual intervention may be "
|
|
||||||
"required. See: https://www.kicksecure.com/wiki/"
|
|
||||||
"SUID_Disabler_and_Permission_Hardener#fixing_state_files"
|
|
||||||
msgstr ""
|
|
||||||
7
debian/rules
vendored
7
debian/rules
vendored
@ -1,6 +1,6 @@
|
|||||||
#!/usr/bin/make -f
|
#!/usr/bin/make -f
|
||||||
|
|
||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
#export DH_VERBOSE=1
|
#export DH_VERBOSE=1
|
||||||
@ -10,3 +10,8 @@
|
|||||||
|
|
||||||
override_dh_installchangelogs:
|
override_dh_installchangelogs:
|
||||||
dh_installchangelogs changelog.upstream upstream
|
dh_installchangelogs changelog.upstream upstream
|
||||||
|
|
||||||
|
override_dh_install:
|
||||||
|
dh_apparmor --profile-name='usr.lib.security-misc.pam_tally2-info'
|
||||||
|
dh_apparmor --profile-name='usr.lib.security-misc.permission-lockdown'
|
||||||
|
dh_install
|
||||||
|
|||||||
190
debian/security-misc.config
vendored
190
debian/security-misc.config
vendored
@ -1,190 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
|
||||||
source /usr/libexec/helper-scripts/pre.bsh
|
|
||||||
fi
|
|
||||||
|
|
||||||
source /usr/share/debconf/confmodule
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
## Not set by DPKG for '.config' script.
|
|
||||||
DPKG_MAINTSCRIPT_PACKAGE="security-misc"
|
|
||||||
DPKG_MAINTSCRIPT_NAME="config"
|
|
||||||
|
|
||||||
true "
|
|
||||||
#####################################################################
|
|
||||||
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
|
|
||||||
#####################################################################
|
|
||||||
"
|
|
||||||
|
|
||||||
## NOTE: Code duplication.
|
|
||||||
## Copied from: helper-scripts /usr/libexec/helper-scripts/package_installed_check.bsh
|
|
||||||
##
|
|
||||||
## '.config' scripts are run very early. Even 'Pre-Depends: helper-scripts' would be insufficient.
|
|
||||||
## Therefore the code is duplicated here.
|
|
||||||
pkg_installed() {
|
|
||||||
local package_name dpkg_query_output
|
|
||||||
local requested_action status error_state
|
|
||||||
|
|
||||||
package_name="$1"
|
|
||||||
## Cannot use '&>' because it is a bashism.
|
|
||||||
dpkg_query_output="$(dpkg-query --show --showformat='${Status}' "$package_name" 2>/dev/null)" || true
|
|
||||||
## dpkg_query_output Examples:
|
|
||||||
## install ok half-configured
|
|
||||||
## install ok installed
|
|
||||||
|
|
||||||
requested_action=$(printf '%s' "$dpkg_query_output" | awk '{print $1}')
|
|
||||||
status=$(printf '%s' "$dpkg_query_output" | awk '{print $2}')
|
|
||||||
error_state=$(printf '%s' "$dpkg_query_output" | awk '{print $3}')
|
|
||||||
|
|
||||||
if [ "$requested_action" = 'install' ]; then
|
|
||||||
true "$0: INFO: $package_name is installed, ok."
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
true "$0: INFO: $package_name is not installed, ok."
|
|
||||||
return 1
|
|
||||||
}
|
|
||||||
|
|
||||||
check_migrate_permission_hardener_state() {
|
|
||||||
local pkg_list modified_pkg_data_str custom_hardening_arr config_file
|
|
||||||
|
|
||||||
## If folder /var/lib/permission-hardener (version 1) does not exist, this migration is unneeded.
|
|
||||||
if [ ! -d '/var/lib/permission-hardener' ]; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
local orig_hardening_arr custom_hardening_arr config_file custom_config_file
|
|
||||||
if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" ]; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
mkdir --parents '/var/lib/security-misc/do_once'
|
|
||||||
|
|
||||||
orig_hardening_arr=(
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_passwd.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_sudo.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_selinux.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/20_user-sysmaint-split.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/30_ping.conf'
|
|
||||||
'/usr/lib/permission-hardener.d/30_default.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_passwd.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_sudo.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_chromium.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_dbus.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_firejail.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_fuse.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_mount.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_pam.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_passwd.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_policykit.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_postfix.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_qubes.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_selinux.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_spice.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_ssh.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_sudo.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf'
|
|
||||||
'/etc/permission-hardener.d/25_default_whitelist_virtualbox.conf'
|
|
||||||
'/etc/permission-hardener.d/20_user-sysmaint-split.conf'
|
|
||||||
'/etc/permission-hardener.d/30_ping.conf'
|
|
||||||
'/etc/permission-hardener.d/30_default.conf'
|
|
||||||
)
|
|
||||||
|
|
||||||
pkg_list=( "security-misc" )
|
|
||||||
if pkg_installed user-sysmaint-split ; then
|
|
||||||
pkg_list+=( "user-sysmaint-split" )
|
|
||||||
fi
|
|
||||||
if pkg_installed anon-apps-config ; then
|
|
||||||
pkg_list+=( "anon-apps-config" )
|
|
||||||
fi
|
|
||||||
|
|
||||||
## This will exit non-zero if some of the packages don't exist, but we
|
|
||||||
## don't care. The packages that *are* installed will still be scanned.
|
|
||||||
modified_pkg_data_str="$(dpkg --verify "${pkg_list[@]}")" || true
|
|
||||||
|
|
||||||
## Example modified_pkg_data_str:
|
|
||||||
#modified_pkg_data_str='missing /usr/lib/permission-hardener.d/20_user-sysmaint-split.conf'
|
|
||||||
|
|
||||||
readarray -t custom_hardening_arr < <(awk '/permission-hardener.d/{ print $NF }' <<< "${modified_pkg_data_str}")
|
|
||||||
|
|
||||||
## If the above `dpkg --verify` command doesn't return any permission-hardener
|
|
||||||
## related lines, the array will contain no meaningful info, just a single
|
|
||||||
## blank element at the start. Set the array to be explicitly empty in
|
|
||||||
## this scenario.
|
|
||||||
if [ -z "${custom_hardening_arr[0]}" ]; then
|
|
||||||
custom_hardening_arr=()
|
|
||||||
fi
|
|
||||||
|
|
||||||
for config_file in \
|
|
||||||
/usr/lib/permission-hardener.d/*.conf \
|
|
||||||
/etc/permission-hardener.d/*.conf \
|
|
||||||
/usr/local/etc/permission-hardener.d/*.conf \
|
|
||||||
/etc/permission-hardening.d/*.conf \
|
|
||||||
/usr/local/etc/permission-hardening.d/*.conf
|
|
||||||
do
|
|
||||||
# shellcheck disable=SC2076
|
|
||||||
if ! [[ " ${orig_hardening_arr[*]} " =~ " ${config_file} " ]]; then
|
|
||||||
if [ -f "${config_file}" ]; then
|
|
||||||
custom_hardening_arr+=( "${config_file}" )
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ "${#custom_hardening_arr[@]}" != '0' ]; then
|
|
||||||
for custom_config_file in "${custom_hardening_arr[@]}"; do
|
|
||||||
if ! test -e "${custom_config_file}" ; then
|
|
||||||
echo "$0: INFO: Possible missing configuration file found: '${custom_config_file}'"
|
|
||||||
else
|
|
||||||
echo "$0: INFO: Possible custom configuration file found: '${custom_config_file}'"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
## db_input will return code 30 if the message won't be displayed, which
|
|
||||||
## causes a non-interactive install to error out if you don't use || true
|
|
||||||
db_input critical security-misc/alert-on-permission-hardener-v2-upgrade || true
|
|
||||||
## db_go can return code 30 too in some instances, we don't care here
|
|
||||||
# shellcheck disable=SC2119
|
|
||||||
db_go || true
|
|
||||||
fi
|
|
||||||
|
|
||||||
touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2"
|
|
||||||
}
|
|
||||||
|
|
||||||
check_migrate_permission_hardener_state
|
|
||||||
|
|
||||||
true "INFO: debhelper beginning here."
|
|
||||||
|
|
||||||
#DEBHELPER#
|
|
||||||
|
|
||||||
true "INFO: Done with debhelper."
|
|
||||||
|
|
||||||
true "
|
|
||||||
#####################################################################
|
|
||||||
## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
|
|
||||||
#####################################################################
|
|
||||||
"
|
|
||||||
|
|
||||||
## Explicitly "exit 0", so eventually trapped errors can be ignored.
|
|
||||||
exit 0
|
|
||||||
4
debian/security-misc.displace
vendored
4
debian/security-misc.displace
vendored
@ -1,5 +1,5 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
/usr/bin/pkexec.security-misc
|
||||||
/etc/securetty.security-misc
|
/etc/securetty.security-misc
|
||||||
/etc/security/faillock.conf.security-misc
|
|
||||||
|
|||||||
3
debian/security-misc.gconf-defaults
vendored
3
debian/security-misc.gconf-defaults
vendored
@ -1,6 +1,3 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
/apps/nautilus/preview_sound never
|
/apps/nautilus/preview_sound never
|
||||||
/apps/nautilus/show_icon_text never
|
/apps/nautilus/show_icon_text never
|
||||||
/apps/nautilus/show-image-thumbnails never
|
/apps/nautilus/show-image-thumbnails never
|
||||||
|
|||||||
8
debian/security-misc.install
vendored
8
debian/security-misc.install
vendored
@ -1,8 +0,0 @@
|
|||||||
## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## This file was generated using 'genmkfile debinstfile'.
|
|
||||||
|
|
||||||
etc/*
|
|
||||||
usr/*
|
|
||||||
var/*
|
|
||||||
5
debian/security-misc.links
vendored
5
debian/security-misc.links
vendored
@ -1,5 +0,0 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
/etc/profile.d/30_security-misc.sh /etc/zprofile.d/30_security-misc.zsh
|
|
||||||
/etc/profile.d/30_security-misc.sh /etc/X11/Xsession.d/30_security-misc
|
|
||||||
105
debian/security-misc.maintscript
vendored
105
debian/security-misc.maintscript
vendored
@ -1,111 +1,14 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
rm_conffile /etc/sudoers.d/umask-security-misc
|
rm_conffile /etc/sudoers.d/umask-security-misc
|
||||||
|
|
||||||
|
## https://forums.whonix.org/t/allow-loading-signed-kernel-modules-by-default-disallow-kernel-module-loading-by-default/7880/23
|
||||||
|
rm_conffile /etc/default/grub.d/40_only_allow_signed_modules.cfg
|
||||||
|
|
||||||
## https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079
|
## https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079
|
||||||
rm_conffile /etc/sysctl.d/sysrq.conf
|
rm_conffile /etc/sysctl.d/sysrq.conf
|
||||||
|
|
||||||
## https://github.com/Whonix/security-misc/pull/45
|
## https://github.com/Whonix/security-misc/pull/45
|
||||||
rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info
|
rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info
|
||||||
rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown
|
rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown
|
||||||
|
|
||||||
## merged into 3 files /usr/lib/sysctl.d/30_security-misc_kexec-disable.conf, /usr/lib/sysctl.d/30_silent-kernel-printk.conf, and /usr/lib/sysctl.d/990-security-misc.conf
|
|
||||||
rm_conffile /etc/sysctl.d/fs_protected.conf
|
|
||||||
rm_conffile /etc/sysctl.d/kptr_restrict.conf
|
|
||||||
rm_conffile /etc/sysctl.d/suid_dumpable.conf
|
|
||||||
rm_conffile /etc/sysctl.d/harden_bpf.conf
|
|
||||||
rm_conffile /etc/sysctl.d/ptrace_scope.conf
|
|
||||||
rm_conffile /etc/sysctl.d/tcp_timestamps.conf
|
|
||||||
rm_conffile /etc/sysctl.d/mmap_aslr.conf
|
|
||||||
rm_conffile /etc/sysctl.d/dmesg_restrict.conf
|
|
||||||
rm_conffile /etc/sysctl.d/coredumps.conf
|
|
||||||
rm_conffile /etc/sysctl.d/kexec.conf
|
|
||||||
rm_conffile /etc/sysctl.d/tcp_hardening.conf
|
|
||||||
rm_conffile /etc/sysctl.d/tcp_sack.conf
|
|
||||||
|
|
||||||
## merged into 3 files /etc/modprobe.d/30_security-misc_blacklist.conf, 30_security-misc_conntrack.conf, and /etc/modprobe.d/30_security-misc_disable.conf
|
|
||||||
rm_conffile /etc/modprobe.d/uncommon-network-protocols.conf
|
|
||||||
rm_conffile /etc/modprobe.d/blacklist-bluetooth.conf
|
|
||||||
rm_conffile /etc/modprobe.d/vivid.conf
|
|
||||||
rm_conffile /etc/modprobe.d/blacklist-dma.conf
|
|
||||||
rm_conffile /etc/modprobe.d/msr.conf
|
|
||||||
rm_conffile /etc/modprobe.d/30_nf_conntrack_helper_disable.conf
|
|
||||||
rm_conffile /etc/modprobe.d/30_security-misc.conf
|
|
||||||
|
|
||||||
## renamed to /etc/security/limits.d/30_security-misc.conf
|
|
||||||
rm_conffile /etc/security/limits.d/disable-coredumps.conf
|
|
||||||
|
|
||||||
## moved to separate package ram-wipe
|
|
||||||
rm_conffile /etc/default/grub.d/40_cold_boot_attack_defense.cfg
|
|
||||||
|
|
||||||
rm_conffile /etc/X11/Xsession.d/50panic_on_oops
|
|
||||||
rm_conffile /etc/X11/Xsession.d/50security-misc
|
|
||||||
|
|
||||||
## moved to /usr/lib/sysctl.d
|
|
||||||
rm_conffile /etc/sysctl.d/30_security-misc.conf
|
|
||||||
rm_conffile /etc/sysctl.d/30_silent-kernel-printk.conf
|
|
||||||
rm_conffile /etc/sysctl.d/30_security-misc_kexec-disable.conf
|
|
||||||
|
|
||||||
## moved to /etc/permission-hardener.d
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_passwd.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_sudo.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_bubblewrap.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_chromium.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_dbus.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_firejail.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_fuse.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_hardened_malloc.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_mount.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_pam.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_policykit.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_qubes.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_selinux.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_spice.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_ssh.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_sudo.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_unix_chkpwd.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_virtualbox.conf
|
|
||||||
rm_conffile /etc/permission-hardening.d/30_default.conf
|
|
||||||
|
|
||||||
## moved to /usr/lib/permission-hardener.d
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_passwd.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_sudo.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_chromium.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_dbus.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_firejail.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_fuse.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_mount.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_pam.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_policykit.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_postfix.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_qubes.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_selinux.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_spice.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_ssh.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_sudo.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_virtualbox.conf
|
|
||||||
rm_conffile /etc/permission-hardener.d/30_default.conf
|
|
||||||
|
|
||||||
## merged into 1 file /etc/default/grub.d/40_kernel_hardening.cfg
|
|
||||||
rm_conffile /etc/default/grub.d/40_distrust_bootloader.cfg
|
|
||||||
rm_conffile /etc/default/grub.d/40_distrust_cpu.cfg
|
|
||||||
rm_conffile /etc/default/grub.d/40_enable_iommu.cfg
|
|
||||||
|
|
||||||
## renamed to /etc/default/grub.d/40_remount_secure.cfg
|
|
||||||
rm_conffile /etc/default/grub.d/40_remmount-secure.cfg
|
|
||||||
|
|
||||||
## renamed to /etc/default/grub.d/40_signed_modules.cfg
|
|
||||||
rm_conffile /etc/default/grub.d/40_only_allow_signed_modules.cfg
|
|
||||||
|
|
||||||
## renamed to /etc/default/grub.d/41_quiet_boot.cfg
|
|
||||||
rm_conffile /etc/default/grub.d/41_quiet.cfg
|
|
||||||
|
|
||||||
## moved to usability-misc
|
|
||||||
rm_conffile /etc/dkms/framework.conf.d/30_security-misc.conf
|
|
||||||
|
|
||||||
## renamed to reflect the fact that this uses a whitelist
|
|
||||||
rm_conffile /usr/lib/permission-hardener.d/25_default_passwd.conf
|
|
||||||
|
|||||||
96
debian/security-misc.postinst
vendored
96
debian/security-misc.postinst
vendored
@ -1,107 +1,29 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
if [ -f /usr/lib/helper-scripts/pre.bsh ]; then
|
||||||
source /usr/libexec/helper-scripts/pre.bsh
|
source /usr/lib/helper-scripts/pre.bsh
|
||||||
fi
|
fi
|
||||||
|
|
||||||
## Required since this package uses debconf - this is mandatory even though
|
|
||||||
## the postinst itself does not use debconf commands.
|
|
||||||
source /usr/share/debconf/confmodule
|
|
||||||
|
|
||||||
set -e
|
set -e
|
||||||
|
|
||||||
true "
|
true "
|
||||||
#####################################################################
|
#####################################################################
|
||||||
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
|
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@
|
||||||
#####################################################################
|
#####################################################################
|
||||||
"
|
"
|
||||||
|
|
||||||
permission_hardening_legacy_config_folder() {
|
|
||||||
if ! test -d /etc/permission-hardening.d ; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
rmdir --verbose --ignore-fail-on-non-empty /etc/permission-hardening.d || true
|
|
||||||
}
|
|
||||||
|
|
||||||
permission_hardening() {
|
|
||||||
echo "Running SUID Disabler and Permission Hardener... See also:"
|
|
||||||
echo "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener"
|
|
||||||
echo "$0: INFO: running: permission-hardener enable"
|
|
||||||
if ! permission-hardener enable ; then
|
|
||||||
echo "$0: ERROR: Permission hardening failed." >&2
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
echo "$0: INFO: Permission hardening success."
|
|
||||||
}
|
|
||||||
|
|
||||||
migrate_permission_hardener_state() {
|
|
||||||
local existing_mode_dir new_mode_dir dpkg_statoverride_list
|
|
||||||
## If folder /var/lib/permission-hardener (version 1) does not exist, this migration is unneeded.
|
|
||||||
if [ ! -d '/var/lib/permission-hardener' ]; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" ]; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
mkdir --parents '/var/lib/security-misc/do_once'
|
|
||||||
|
|
||||||
existing_mode_dir='/var/lib/permission-hardener-v2/existing_mode'
|
|
||||||
new_mode_dir='/var/lib/permission-hardener-v2/new_mode'
|
|
||||||
|
|
||||||
mkdir --parents "${existing_mode_dir}";
|
|
||||||
mkdir --parents "${new_mode_dir}";
|
|
||||||
|
|
||||||
cp --verbose '/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded' "${existing_mode_dir}/statoverride"
|
|
||||||
cp --verbose '/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded' "${new_mode_dir}/statoverride"
|
|
||||||
|
|
||||||
dpkg_statoverride_list="$(dpkg-statoverride --admindir "${new_mode_dir}" --list)"
|
|
||||||
|
|
||||||
if [ "$(stat --format '%G' /usr/bin/sudo)" = 'sysmaint' ]; then
|
|
||||||
if ! [[ "${dpkg_statoverride_list}" =~ '/usr/bin/sudo' ]]; then
|
|
||||||
dpkg-statoverride --admindir "${new_mode_dir}" --add 'root' 'sysmaint' '4750' '/usr/bin/sudo'
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
if [ "$(stat --format '%G' /usr/bin/pkexec)" = 'sysmaint' ]; then
|
|
||||||
if ! [[ "${dpkg_statoverride_list}" =~ '/usr/bin/pkexec' ]]; then
|
|
||||||
dpkg-statoverride --admindir "${new_mode_dir}" --add 'root' 'sysmaint' '4750' '/usr/bin/pkexec'
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2"
|
|
||||||
}
|
|
||||||
|
|
||||||
case "$1" in
|
case "$1" in
|
||||||
configure)
|
configure)
|
||||||
if [ -d /etc/skel/.gnupg ]; then
|
|
||||||
## Lintian warns against use of chmod --recursive.
|
|
||||||
chmod 700 /etc/skel/.gnupg
|
|
||||||
fi
|
|
||||||
|
|
||||||
## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override
|
## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override
|
||||||
glib-compile-schemas /usr/share/glib-2.0/schemas || true
|
glib-compile-schemas /usr/share/glib-2.0/schemas || true
|
||||||
|
|
||||||
## state dir for faillock
|
|
||||||
mkdir -p /var/lib/security-misc/faillock
|
|
||||||
|
|
||||||
## migrate permission_hardener state to v2 if applicable
|
|
||||||
migrate_permission_hardener_state
|
|
||||||
;;
|
;;
|
||||||
|
|
||||||
abort-upgrade|abort-remove|abort-deconfigure)
|
abort-upgrade|abort-remove|abort-deconfigure)
|
||||||
;;
|
;;
|
||||||
|
|
||||||
triggered)
|
|
||||||
echo "INFO: triggered $DPKG_MAINTSCRIPT_PACKAGE: '$DPKG_MAINTSCRIPT_PACKAGE' $DPKG_MAINTSCRIPT_PACKAGE DPKG_MAINTSCRIPT_NAME: '$DPKG_MAINTSCRIPT_NAME' $\*: '$*' 2: '$2'"
|
|
||||||
/usr/share/security-misc/lkrg/lkrg-virtualbox || true
|
|
||||||
/usr/libexec/security-misc/mmap-rnd-bits || true
|
|
||||||
permission_hardening
|
|
||||||
exit 0
|
|
||||||
;;
|
|
||||||
|
|
||||||
*)
|
*)
|
||||||
echo "$DPKG_MAINTSCRIPT_NAME called with unknown argument \`$1'" >&2
|
echo "$DPKG_MAINTSCRIPT_NAME called with unknown argument \`$1'" >&2
|
||||||
exit 1
|
exit 1
|
||||||
@ -110,9 +32,7 @@ esac
|
|||||||
|
|
||||||
pam-auth-update --package
|
pam-auth-update --package
|
||||||
|
|
||||||
/usr/libexec/security-misc/permission-lockdown
|
/usr/lib/security-misc/permission-lockdown
|
||||||
|
|
||||||
permission_hardening
|
|
||||||
|
|
||||||
## https://phabricator.whonix.org/T377
|
## https://phabricator.whonix.org/T377
|
||||||
## Debian has no update-grub trigger yet:
|
## Debian has no update-grub trigger yet:
|
||||||
@ -126,19 +46,15 @@ you should fix running 'update-grub', otherwise your system might no longer \
|
|||||||
boot." >&2
|
boot." >&2
|
||||||
fi
|
fi
|
||||||
|
|
||||||
/usr/libexec/security-misc/mmap-rnd-bits || true
|
|
||||||
|
|
||||||
true "INFO: debhelper beginning here."
|
true "INFO: debhelper beginning here."
|
||||||
|
|
||||||
#DEBHELPER#
|
#DEBHELPER#
|
||||||
|
|
||||||
true "INFO: Done with debhelper."
|
true "INFO: Done with debhelper."
|
||||||
|
|
||||||
permission_hardening_legacy_config_folder
|
|
||||||
|
|
||||||
true "
|
true "
|
||||||
#####################################################################
|
#####################################################################
|
||||||
## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
|
## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@
|
||||||
#####################################################################
|
#####################################################################
|
||||||
"
|
"
|
||||||
|
|
||||||
|
|||||||
8
debian/security-misc.postrm
vendored
8
debian/security-misc.postrm
vendored
@ -1,10 +1,10 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
if [ -f /usr/lib/helper-scripts/pre.bsh ]; then
|
||||||
source /usr/libexec/helper-scripts/pre.bsh
|
source /usr/lib/helper-scripts/pre.bsh
|
||||||
fi
|
fi
|
||||||
|
|
||||||
set -e
|
set -e
|
||||||
@ -18,8 +18,6 @@ true "
|
|||||||
## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/11
|
## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/11
|
||||||
pam-auth-update --package --remove "$DPKG_MAINTSCRIPT_PACKAGE"
|
pam-auth-update --package --remove "$DPKG_MAINTSCRIPT_PACKAGE"
|
||||||
|
|
||||||
rm -f /etc/sysctl.d/30_security-misc_aslr-mmap.conf
|
|
||||||
|
|
||||||
true "INFO: debhelper beginning here."
|
true "INFO: debhelper beginning here."
|
||||||
|
|
||||||
#DEBHELPER#
|
#DEBHELPER#
|
||||||
|
|||||||
110
debian/security-misc.preinst
vendored
110
debian/security-misc.preinst
vendored
@ -1,10 +1,10 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
if [ -f /usr/lib/helper-scripts/pre.bsh ]; then
|
||||||
source /usr/libexec/helper-scripts/pre.bsh
|
source /usr/lib/helper-scripts/pre.bsh
|
||||||
fi
|
fi
|
||||||
|
|
||||||
set -e
|
set -e
|
||||||
@ -16,16 +16,13 @@ true "
|
|||||||
"
|
"
|
||||||
|
|
||||||
user_groups_modifications() {
|
user_groups_modifications() {
|
||||||
## /usr/libexec/security-misc/hide-hardware-info
|
## /usr/lib/security-misc/hide-hardware-info
|
||||||
addgroup --system sysfs
|
addgroup --system sysfs
|
||||||
addgroup --system cpuinfo
|
addgroup --system cpuinfo
|
||||||
|
|
||||||
## /usr/lib/systemd/system/proc-hidepid.service
|
|
||||||
addgroup --system proc
|
|
||||||
|
|
||||||
## group 'sudo' membership required to use 'su'
|
## group 'sudo' membership required to use 'su'
|
||||||
## /usr/share/pam-configs/wheel-security-misc
|
## /usr/share/pam-configs/wheel-security-misc
|
||||||
adduser root sudo
|
addgroup root sudo
|
||||||
|
|
||||||
## Useful to create groups in preinst rather than postinst.
|
## Useful to create groups in preinst rather than postinst.
|
||||||
## Otherwise if a user saw an error message such as this:
|
## Otherwise if a user saw an error message such as this:
|
||||||
@ -47,15 +44,8 @@ user_groups_modifications() {
|
|||||||
## an "empty" /etc/securetty.
|
## an "empty" /etc/securetty.
|
||||||
## In case a system administrator edits /etc/securetty, there is no need to
|
## In case a system administrator edits /etc/securetty, there is no need to
|
||||||
## block for this to be still blocked by console lockdown. See also:
|
## block for this to be still blocked by console lockdown. See also:
|
||||||
## https://www.kicksecure.com/wiki/Root#Root_Login
|
## https://www.whonix.org/wiki/Root#Root_Login
|
||||||
adduser root console
|
addgroup root console
|
||||||
}
|
|
||||||
|
|
||||||
output_skip_checks() {
|
|
||||||
echo "security-misc '$0' INFO: Allow installation of security-misc anyway." >&2
|
|
||||||
echo "security-misc '$0' INFO: (technical reason: $@)" >&2
|
|
||||||
echo "security-misc '$0' INFO: If this is a chroot this is probably OK." >&2
|
|
||||||
echo "security-misc '$0' INFO: Otherwise you might not be able to login." >&2
|
|
||||||
}
|
}
|
||||||
|
|
||||||
sudo_users_check () {
|
sudo_users_check () {
|
||||||
@ -66,8 +56,6 @@ sudo_users_check () {
|
|||||||
return 0
|
return 0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
local sudo_users user_with_sudo are_there_any_sudo_users OLD_IFS
|
|
||||||
|
|
||||||
sudo_users="$(getent group sudo | cut -d: -f4)"
|
sudo_users="$(getent group sudo | cut -d: -f4)"
|
||||||
## example sudo_users:
|
## example sudo_users:
|
||||||
## user,root
|
## user,root
|
||||||
@ -90,41 +78,22 @@ sudo_users_check () {
|
|||||||
IFS="$OLD_IFS"
|
IFS="$OLD_IFS"
|
||||||
export IFS
|
export IFS
|
||||||
|
|
||||||
if [ "$are_there_any_sudo_users" = "yes" ]; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
## Prevent users from locking themselves out.
|
## Prevent users from locking themselves out.
|
||||||
## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4
|
## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4
|
||||||
echo "$0: ERROR: No user is a member of group 'sudo'. Installation aborted." >&2
|
if [ ! "$are_there_any_sudo_users" = "yes" ]; then
|
||||||
echo "$0: ERROR: You probably want to run:" >&2
|
echo "$0: ERROR: No user is a member of group 'sudo'. Installation aborted." >&2
|
||||||
echo "$0: NOTE: Replace user 'user' with your actual Linux user account name." >&2
|
echo "$0: ERROR: You probably want to run:" >&2
|
||||||
echo "" >&2
|
echo "" >&2
|
||||||
echo "sudo adduser user sudo" >&2
|
echo "sudo adduser user sudo" >&2
|
||||||
echo "sudo adduser user console" >&2
|
echo "sudo adduser user console" >&2
|
||||||
echo "" >&2
|
echo "" >&2
|
||||||
echo "$0: ERROR: See also installation instructions:" >&2
|
echo "$0: ERROR: See also installation instructions:" >&2
|
||||||
echo "https://www.kicksecure.com/wiki/security-misc#install" >&2
|
echo "https://www.whonix.org/wiki/security-misc#install" >&2
|
||||||
|
exit 200
|
||||||
if [ "$SECURITY_MISC_INSTALL" = "force" ]; then
|
|
||||||
output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'."
|
|
||||||
return 0
|
|
||||||
fi
|
fi
|
||||||
if test -f "/var/lib/security-misc/skip_install_check" ; then
|
|
||||||
output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists."
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
exit 200
|
|
||||||
}
|
}
|
||||||
|
|
||||||
console_users_check() {
|
console_users_check() {
|
||||||
if [ "$SECURITY_MISC_INSTALL" = "force" ]; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
if test -f "/var/lib/security-misc/skip_install_check" ; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
if command -v "qubesdb-read" &>/dev/null; then
|
if command -v "qubesdb-read" &>/dev/null; then
|
||||||
## Qubes users can use dom0 to get a root terminal emulator.
|
## Qubes users can use dom0 to get a root terminal emulator.
|
||||||
## For example:
|
## For example:
|
||||||
@ -132,10 +101,8 @@ console_users_check() {
|
|||||||
return 0
|
return 0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
local console_users console_unrestricted_users user_with_console are_there_any_console_users OLD_IFS
|
|
||||||
|
|
||||||
console_users="$(getent group console | cut -d: -f4)"
|
console_users="$(getent group console | cut -d: -f4)"
|
||||||
## example console_users:
|
## example ssh_users:
|
||||||
## user
|
## user
|
||||||
console_unrestricted_users="$(getent group console-unrestricted | cut -d: -f4)"
|
console_unrestricted_users="$(getent group console-unrestricted | cut -d: -f4)"
|
||||||
|
|
||||||
@ -159,28 +126,16 @@ console_users_check() {
|
|||||||
|
|
||||||
## Prevent users from locking themselves out.
|
## Prevent users from locking themselves out.
|
||||||
## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4
|
## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4
|
||||||
if [ "$are_there_any_console_users" = "yes" ]; then
|
if [ ! "$are_there_any_console_users" = "yes" ]; then
|
||||||
return 0
|
echo "$0: ERROR: No user is a member of group 'console'. Installation aborted." >&2
|
||||||
|
echo "$0: ERROR: You probably want to run:" >&2
|
||||||
|
echo "" >&2
|
||||||
|
echo "sudo adduser user console" >&2
|
||||||
|
echo "" >&2
|
||||||
|
echo "$0: ERROR: See also installation instructions:" >&2
|
||||||
|
echo "https://www.whonix.org/wiki/security-misc#install" >&2
|
||||||
|
exit 201
|
||||||
fi
|
fi
|
||||||
|
|
||||||
echo "$0: ERROR: No user is a member of group 'console'. Installation aborted." >&2
|
|
||||||
echo "$0: ERROR: You probably want to run:" >&2
|
|
||||||
echo "" >&2
|
|
||||||
echo "sudo adduser user console" >&2
|
|
||||||
echo "" >&2
|
|
||||||
echo "$0: ERROR: See also installation instructions:" >&2
|
|
||||||
echo "https://www.whonix.org/wiki/security-misc#install" >&2
|
|
||||||
|
|
||||||
if [ "$SECURITY_MISC_INSTALL" = "force" ]; then
|
|
||||||
output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'."
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
if test -f "/var/lib/security-misc/skip_install_check" ; then
|
|
||||||
output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists."
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
exit 201
|
|
||||||
}
|
}
|
||||||
|
|
||||||
legacy() {
|
legacy() {
|
||||||
@ -188,8 +143,6 @@ legacy() {
|
|||||||
return 0
|
return 0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
local continue_yes user_to_be_created
|
|
||||||
|
|
||||||
if [ -f "/usr/share/whonix/marker" ]; then
|
if [ -f "/usr/share/whonix/marker" ]; then
|
||||||
continue_yes=true
|
continue_yes=true
|
||||||
fi
|
fi
|
||||||
@ -197,7 +150,7 @@ legacy() {
|
|||||||
continue_yes=true
|
continue_yes=true
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [ ! "$continue_yes" = "true" ]; then
|
if [ "$continue_yes" = "yes" ]; then
|
||||||
return 0
|
return 0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
@ -212,12 +165,7 @@ legacy() {
|
|||||||
|
|
||||||
user_to_be_created=user
|
user_to_be_created=user
|
||||||
|
|
||||||
if ! id "$user_to_be_created" &>/dev/null ; then
|
addgroup "$user_to_be_created" console
|
||||||
true "INFO: user '$user_to_be_created' does not exist. Skipping adduser console and pam-auth-update."
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
adduser "$user_to_be_created" console
|
|
||||||
|
|
||||||
pam-auth-update --enable console-lockdown-security-misc
|
pam-auth-update --enable console-lockdown-security-misc
|
||||||
|
|
||||||
|
|||||||
6
debian/security-misc.prerm
vendored
6
debian/security-misc.prerm
vendored
@ -1,10 +1,10 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
if [ -f /usr/lib/helper-scripts/pre.bsh ]; then
|
||||||
source /usr/libexec/helper-scripts/pre.bsh
|
source /usr/lib/helper-scripts/pre.bsh
|
||||||
fi
|
fi
|
||||||
|
|
||||||
set -e
|
set -e
|
||||||
|
|||||||
9
debian/security-misc.templates
vendored
9
debian/security-misc.templates
vendored
@ -1,9 +0,0 @@
|
|||||||
Template: security-misc/alert-on-permission-hardener-v2-upgrade
|
|
||||||
Type: note
|
|
||||||
_Description: Manual intervention may be required for permission-hardener update
|
|
||||||
No need to panic. Nothing is broken. A rare condition has been encountered.
|
|
||||||
permission-hardener is being updated to fix a minor bug that caused
|
|
||||||
corruption in the permission-hardener state file. If you installed your own
|
|
||||||
custom permission-hardener configuration, some manual intervention may be
|
|
||||||
required. See:
|
|
||||||
https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#fixing_state_files
|
|
||||||
16
debian/security-misc.triggers
vendored
16
debian/security-misc.triggers
vendored
@ -1,16 +0,0 @@
|
|||||||
## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## use noawait
|
|
||||||
## https://github.com/Kicksecure/security-misc/issues/196
|
|
||||||
|
|
||||||
## Trigger permission hardener when new binaries are being installed.
|
|
||||||
interest-noawait /usr
|
|
||||||
interest-noawait /opt
|
|
||||||
|
|
||||||
## Trigger permission hardener when new configuration files are being installed.
|
|
||||||
interest-noawait /usr/lib/permission-hardener.d
|
|
||||||
interest-noawait /etc/permission-hardener.d
|
|
||||||
interest-noawait /usr/local/etc/permission-hardener.d
|
|
||||||
interest-noawait /etc/permission-hardening.d
|
|
||||||
interest-noawait /usr/local/etc/permission-hardening.d
|
|
||||||
4
debian/security-misc.undisplace
vendored
4
debian/security-misc.undisplace
vendored
@ -1,6 +1,4 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
/etc/login.defs.security-misc
|
/etc/login.defs.security-misc
|
||||||
/usr/bin/pkexec.security-misc
|
|
||||||
/etc/dkms/framework.conf.security-misc
|
|
||||||
|
|||||||
2
debian/source/lintian-overrides
vendored
2
debian/source/lintian-overrides
vendored
@ -1,2 +1,2 @@
|
|||||||
## https://phabricator.whonix.org/T277
|
## https://phabricator.whonix.org/T277
|
||||||
debian-watch-does-not-check-openpgp-signature
|
debian-watch-does-not-check-gpg-signature
|
||||||
|
|||||||
2
debian/watch
vendored
2
debian/watch
vendored
@ -1,4 +1,4 @@
|
|||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
version=4
|
version=4
|
||||||
|
|||||||
8
etc/X11/Xsession.d/50panic_on_oops
Normal file
8
etc/X11/Xsession.d/50panic_on_oops
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
if [ -x /usr/lib/security-misc/panic-on-oops ]; then
|
||||||
|
sudo --non-interactive /usr/lib/security-misc/panic-on-oops
|
||||||
|
fi
|
||||||
7
etc/X11/Xsession.d/50security-misc
Normal file
7
etc/X11/Xsession.d/50security-misc
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
if [ -z "$XDG_CONFIG_DIRS" ]; then
|
||||||
|
XDG_CONFIG_DIRS=/etc/xdg
|
||||||
|
fi
|
||||||
|
export XDG_CONFIG_DIRS=/usr/share/security-misc/:$XDG_CONFIG_DIRS
|
||||||
@ -1,7 +1,7 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
alias /etc/pam.d/common-session -> /etc/pam.d/common-session.security-misc,
|
alias /etc/pam.d/common-session -> /etc/pam.d//etc/pam.d/common-session.security-misc,
|
||||||
alias /etc/pam.d/common-session-noninteractive -> /etc/pam.d/common-session-noninteractive.security-misc,
|
alias /etc/pam.d/common-session-noninteractive -> /etc/pam.d/common-session-noninteractive.security-misc,
|
||||||
alias /etc/login.defs -> /etc/login.defs.security-misc,
|
alias /etc/login.defs -> /etc/login.defs.security-misc,
|
||||||
alias /etc/securetty -> /etc/securetty.security-misc,
|
alias /etc/securetty -> /etc/securetty.security-misc,
|
||||||
|
|||||||
@ -1,9 +0,0 @@
|
|||||||
## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Make "sudo apt-get update" exit non-zero for transient failures.
|
|
||||||
## Same as "apt-get --error-on=any".
|
|
||||||
## https://forums.whonix.org/t/debian-bullseye-apt-get-error-on-any/12068
|
|
||||||
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=594813
|
|
||||||
## https://salsa.debian.org/apt-team/apt/-/commit/c7123bea6a8dc2c9e327ce41ddfc25e29f1bb145
|
|
||||||
APT::Update::Error-Mode any;
|
|
||||||
@ -1,4 +1,4 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
## https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702
|
## https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702
|
||||||
|
|||||||
@ -1,33 +0,0 @@
|
|||||||
## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
[General]
|
|
||||||
# How long to stay in pairable mode before going back to non-discoverable
|
|
||||||
# The value is in seconds. Default is 0.
|
|
||||||
# 0 = disable timer, i.e. stay pairable forever
|
|
||||||
PairableTimeout = 30
|
|
||||||
|
|
||||||
# How long to stay in discoverable mode before going back to non-discoverable
|
|
||||||
# The value is in seconds. Default is 180, i.e. 3 minutes.
|
|
||||||
# 0 = disable timer, i.e. stay discoverable forever
|
|
||||||
DiscoverableTimeout = 30
|
|
||||||
|
|
||||||
# Maximum number of controllers allowed to be exposed to the system.
|
|
||||||
# Default=0 (unlimited)
|
|
||||||
MaxControllers=1
|
|
||||||
|
|
||||||
# How long to keep temporary devices around
|
|
||||||
# The value is in seconds. Default is 30.
|
|
||||||
# 0 = disable timer, i.e. never keep temporary devices
|
|
||||||
TemporaryTimeout = 0
|
|
||||||
|
|
||||||
[Policy]
|
|
||||||
# AutoEnable defines option to enable all controllers when they are found.
|
|
||||||
# This includes adapters present on start as well as adapters that are plugged
|
|
||||||
# in later on. Defaults to 'true'.
|
|
||||||
AutoEnable=false
|
|
||||||
|
|
||||||
# network/on: A device will only accept advertising packets from peer
|
|
||||||
# devices that contain private addresses. It may not be compatible with some
|
|
||||||
# legacy devices since it requires the use of RPA(s) all the time.
|
|
||||||
Privacy=network/on
|
|
||||||
@ -1,188 +0,0 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Definitions:
|
|
||||||
## KSPP=yes: compliant with recommendations by the KSPP
|
|
||||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
|
||||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
|
||||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
|
||||||
|
|
||||||
## Enable known mitigations for CPU vulnerabilities.
|
|
||||||
## Note, the mitigations for SSB and Retbleed are not currently mentioned in the first link.
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
|
|
||||||
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647
|
|
||||||
|
|
||||||
## Check for potential updates directly from AMD and Intel.
|
|
||||||
## https://www.amd.com/en/resources/product-security.html
|
|
||||||
## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html
|
|
||||||
## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html
|
|
||||||
|
|
||||||
## Tabular comparison between the utility and functionality of various mitigations.
|
|
||||||
## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/587
|
|
||||||
|
|
||||||
## For complete protection, users must install the latest relevant security microcode update.
|
|
||||||
## BIOS/UEFI updates should only be obtained directly from OEMs and/or motherboard manufacturers.
|
|
||||||
## Note that incorrectly performing system BIOS/UEFI updates can potentially lead to serious functionality issues.
|
|
||||||
## The parameters below only provide (partial) protection at both the kernel and user space level.
|
|
||||||
|
|
||||||
## If using Secure Boot, users must also ensure the Secure Boot Forbidden Signature Database (DBX) is up to date.
|
|
||||||
## The UEFI Revocation List contains signatures of now revoked firmware and software used in booting systems.
|
|
||||||
## If using compatible hardware, the database can be updated directly in user space using fwupd.
|
|
||||||
## Note that incorrectly performing DBX updates can potentially lead to serious functionality issues.
|
|
||||||
## https://uefi.org/revocationlistfile
|
|
||||||
## https://github.com/fwupd/fwupd
|
|
||||||
|
|
||||||
## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT.
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameters.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"
|
|
||||||
|
|
||||||
## Disable SMT as it has been the cause of and amplified numerous CPU exploits.
|
|
||||||
## The only full mitigation of cross-HT attacks is to disable SMT.
|
|
||||||
## Disabling will significantly decrease system performance on multi-threaded tasks.
|
|
||||||
## Note, this setting will prevent re-enabling SMT via the sysfs interface.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
|
|
||||||
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
|
|
||||||
## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameter.
|
|
||||||
##
|
|
||||||
## To re-enable SMT:
|
|
||||||
## - Remove "nosmt=force".
|
|
||||||
## - Remove all occurrences of ",nosmt" in this file (note the comma ",").
|
|
||||||
## - Downgrade "l1tf=full,force" protection to "l1tf=flush".
|
|
||||||
## - Regenerate the dracut initramfs and then reboot system.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force"
|
|
||||||
|
|
||||||
## Spectre Side Channels (BTI and BHI):
|
|
||||||
## Unconditionally enable mitigation for Spectre Variant 2 (branch target injection).
|
|
||||||
## Enable mitigation for the Intel branch history injection vulnerability.
|
|
||||||
## Currently affects both AMD and Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on"
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on"
|
|
||||||
|
|
||||||
## Speculative Store Bypass (SSB):
|
|
||||||
## Mitigate Spectre Variant 4 by disabling speculative store bypass system-wide.
|
|
||||||
## Unconditionally enable the mitigation for both kernel and userspace.
|
|
||||||
## Currently affects both AMD and Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://en.wikipedia.org/wiki/Speculative_Store_Bypass
|
|
||||||
## https://www.suse.com/support/kb/doc/?id=000019189
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on"
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ssbd=force-on"
|
|
||||||
|
|
||||||
## L1 Terminal Fault (L1TF):
|
|
||||||
## Mitigate the vulnerability by disabling L1D flush runtime control and SMT.
|
|
||||||
## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations.
|
|
||||||
## Currently affects Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force"
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always"
|
|
||||||
|
|
||||||
## Microarchitectural Data Sampling (MDS):
|
|
||||||
## Mitigate the vulnerability by clearing the CPU buffer cache and disabling SMT.
|
|
||||||
## Currently affects Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt"
|
|
||||||
|
|
||||||
## TSX Asynchronous Abort (TAA):
|
|
||||||
## Mitigate the vulnerability by disabling TSX.
|
|
||||||
## If TSX is enabled, clear CPU buffer rings on transitions and disable SMT.
|
|
||||||
## Currently affects Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off"
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt"
|
|
||||||
|
|
||||||
## iTLB Multihit:
|
|
||||||
## Mitigate the vulnerability by marking all huge pages in the EPT as non-executable.
|
|
||||||
## Currently affects Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force"
|
|
||||||
|
|
||||||
## Special Register Buffer Data Sampling (SRBDS):
|
|
||||||
## Mitigation of the vulnerability is only possible via microcode update from Intel.
|
|
||||||
## Currently affects Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/special-register-buffer-data-sampling.html
|
|
||||||
## https://access.redhat.com/solutions/5142691
|
|
||||||
|
|
||||||
## L1D Flushing:
|
|
||||||
## Mitigate leaks from the L1D cache on context switches by enabling the prctl() interface.
|
|
||||||
## Currently affects Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on"
|
|
||||||
|
|
||||||
## Processor MMIO Stale Data:
|
|
||||||
## Mitigate the vulnerabilities by appropriately clearing the CPU buffer and disabling SMT.
|
|
||||||
## Currently affects Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt"
|
|
||||||
|
|
||||||
## Arbitrary Speculative Code Execution with Return Instructions (Retbleed):
|
|
||||||
## Mitigate the vulnerability through CPU-dependent implementation and disable SMT.
|
|
||||||
## Currently affects both AMD Zen 1-2 and Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://en.wikipedia.org/wiki/Retbleed
|
|
||||||
## https://comsec.ethz.ch/research/microarch/retbleed/
|
|
||||||
## https://www.suse.com/support/kb/doc/?id=000020693
|
|
||||||
## https://access.redhat.com/solutions/retbleed
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"
|
|
||||||
|
|
||||||
## Cross-Thread Return Address Predictions:
|
|
||||||
## Mitigate the vulnerability for certain KVM hypervisor configurations.
|
|
||||||
## Currently affects AMD Zen 1-2 CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/cross-thread-rsb.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.mitigate_smt_rsb=1"
|
|
||||||
|
|
||||||
## Speculative Return Stack Overflow (SRSO):
|
|
||||||
## Mitigate the vulnerability by ensuring all RET instructions speculate to a controlled location.
|
|
||||||
## Currently affects AMD Zen 1-4 CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html
|
|
||||||
##
|
|
||||||
## The default kernel setting will be utilized until provided sufficient evidence to modify.
|
|
||||||
## Using "spec_rstack_overflow=ipbp" may provide stronger security at a greater performance impact.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_rstack_overflow=safe-ret"
|
|
||||||
|
|
||||||
## Gather Data Sampling (GDS):
|
|
||||||
## Mitigate the vulnerability either via microcode update or by disabling AVX.
|
|
||||||
## Note, without a suitable microcode update, this will entirely disable use of the AVX instructions set.
|
|
||||||
## Currently affects Intel CPUs.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/gather_data_sampling.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX gather_data_sampling=force"
|
|
||||||
|
|
||||||
## Register File Data Sampling (RFDS):
|
|
||||||
## Mitigate the vulnerability by appropriately clearing the CPU buffer.
|
|
||||||
## Currently affects Intel Atom CPUs (which encompasses E-cores on hybrid architectures).
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/reg-file-data-sampling.html
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX reg_file_data_sampling=on"
|
|
||||||
11
etc/default/grub.d/40_distrust_cpu.cfg
Normal file
11
etc/default/grub.d/40_distrust_cpu.cfg
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Distrusts the CPU for initial entropy at boot as it is not possible to
|
||||||
|
## audit, may contain weaknesses or a backdoor.
|
||||||
|
##
|
||||||
|
## https://en.wikipedia.org/wiki/RDRAND#Reception
|
||||||
|
## https://twitter.com/pid_eins/status/1149649806056280069
|
||||||
|
## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
||||||
|
## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
||||||
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off"
|
||||||
5
etc/default/grub.d/40_enable_iommu.cfg
Normal file
5
etc/default/grub.d/40_enable_iommu.cfg
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Enables IOMMU to prevent DMA attacks.
|
||||||
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on amd_iommu=on"
|
||||||
@ -1,329 +1,59 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
kpkg="linux-image-$(dpkg --print-architecture)" || true
|
kpkg="linux-image-$(dpkg --print-architecture)"
|
||||||
kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || true
|
kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")"
|
||||||
#echo "## kver: $kver"
|
#echo "## kver: $kver"
|
||||||
|
|
||||||
## Definitions:
|
## Disables the merging of slabs of similar sizes.
|
||||||
## KSPP=yes: compliant with recommendations by the KSPP
|
## Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
|
||||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
|
||||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
|
||||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
|
||||||
|
|
||||||
## This configuration file is split into 4 sections:
|
|
||||||
## 1. Kernel Space
|
|
||||||
## 2. Direct Memory Access
|
|
||||||
## 3. Entropy
|
|
||||||
## 4. Networking
|
|
||||||
|
|
||||||
## See the documentation below for details on the majority of the selected commands:
|
|
||||||
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
|
|
||||||
## https://wiki.archlinux.org/title/Kernel_parameters#GRUB
|
|
||||||
|
|
||||||
## 1. Kernel Space:
|
|
||||||
##
|
|
||||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#boot-parameters
|
|
||||||
## https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
|
||||||
|
|
||||||
## Disable merging of slabs with similar size.
|
|
||||||
## Reduces the risk of triggering heap overflows.
|
|
||||||
## Prevents overwriting objects from merged caches and limits influencing slab cache layout.
|
|
||||||
##
|
|
||||||
## https://www.openwall.com/lists/kernel-hardening/2017/06/19/33
|
|
||||||
## https://www.openwall.com/lists/kernel-hardening/2017/06/20/10
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameter and does not set CONFIG_SLAB_MERGE_DEFAULT.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
|
||||||
|
|
||||||
## Enable sanity checks and red zoning of slabs via debugging options to detect corruption.
|
if dpkg --compare-versions "$kver" ge "5.3"; then
|
||||||
## As a by product of debugging, this will implicitly disabling kernel pointer hashing.
|
## Enables sanity checks (F) and redzoning (Z).
|
||||||
## Enabling will therefore leak exact and all kernel memory addresses to root.
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ"
|
||||||
## Has the potential to cause a noticeable performance decrease.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/mm/slub.html
|
|
||||||
## https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u
|
|
||||||
## https://gitlab.tails.boum.org/tails/tails/-/issues/19613
|
|
||||||
## https://github.com/Kicksecure/security-misc/issues/253
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameters and CONFIG_SLUB_DEBUG.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ"
|
|
||||||
|
|
||||||
## Zero memory at allocation time and free time.
|
#echo "## $kver grater or equal 5.3: yes"
|
||||||
## Fills newly allocated pages, freed pages, and heap objects with zeros.
|
## Zero memory at allocation and free time.
|
||||||
## Mitigates use-after-free exploits by erasing sensitive information in memory.
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1"
|
||||||
##
|
else
|
||||||
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6471384af2a6530696fc0203bafe4de41a23c9ef
|
#echo "## $kver grater or equal 5.3: no"
|
||||||
##
|
## SLUB poisoning and page poisoning is used if the kernel
|
||||||
## KSPP=yes
|
## does not yet support init_on_{,alloc,free}.
|
||||||
## KSPP sets the kernel parameters, CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y, and CONFIG_INIT_ON_FREE_DEFAULT_ON=y.
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZP"
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1"
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_free=1"
|
|
||||||
|
|
||||||
## Enable the kernel page allocator to randomize free lists.
|
if command -v "qubesdb-read" >/dev/null 2>&1 ; then
|
||||||
## During early boot, the page allocator has predictable FIFO behavior for physical pages.
|
## https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012
|
||||||
## Limits some data exfiltration and ROP attacks that rely on inferring sensitive data location.
|
true "skip adding page_poison=1 in Qubes"
|
||||||
## Also improves performance by optimizing memory-side cache utilization.
|
else
|
||||||
##
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_poison=1"
|
||||||
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e900a918b0984ec8f2eb150b8477a47b75d17692
|
fi
|
||||||
## https://en.wikipedia.org/wiki/Return-oriented_programming#Attacks
|
fi
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameter and CONFIG_SHUFFLE_PAGE_ALLOCATOR=y.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1"
|
|
||||||
|
|
||||||
## Enable kernel page table isolation to harden against kernel ASLR (KASLR) bypasses.
|
## Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit.
|
||||||
## Mitigates the Meltdown CPU vulnerability.
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
|
||||||
##
|
|
||||||
## https://en.wikipedia.org/wiki/Kernel_page-table_isolation
|
## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR.
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameter and CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"
|
||||||
|
|
||||||
## Enable randomization of the kernel stack offset on syscall entries.
|
## Enables all mitigations for the MDS vulnerability.
|
||||||
## Hardens against memory corruption attacks due to increased entropy.
|
## Disables smt which can be used to exploit the MDS vulnerability.
|
||||||
## Limits attacks relying on deterministic stack addresses or cross-syscall address exposure.
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt"
|
||||||
##
|
|
||||||
## https://lkml.org/lkml/2019/3/18/246
|
|
||||||
## https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameter and CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX randomize_kstack_offset=on"
|
|
||||||
|
|
||||||
## Disable vsyscalls to reduce attack surface as they have been replaced by vDSO.
|
## Vsyscalls are obsolete, are at fixed addresses and are a target for ROP.
|
||||||
## Vulnerable to ROP attacks as vsyscalls are located at fixed addresses in memory.
|
|
||||||
##
|
|
||||||
## https://lwn.net/Articles/446528/
|
|
||||||
## https://en.wikipedia.org/wiki/VDSO
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameter, CONFIG_LEGACY_VSYSCALL_NONE=y and does not set CONFIG_X86_VSYSCALL_EMULATION.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none"
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none"
|
||||||
|
|
||||||
## Restrict access to debugfs by not registering the file system.
|
## Enables page allocator freelist randomization.
|
||||||
## Deactivated since the file system can contain sensitive information.
|
if dpkg --compare-versions "${kver}" ge "5.2"; then
|
||||||
##
|
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1"
|
||||||
## https://lkml.org/lkml/2020/7/16/122
|
fi
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off"
|
|
||||||
|
|
||||||
## Force the kernel to panic on "oopses".
|
## Enables kernel lockdown.
|
||||||
## Can sometimes potentially indicate and thwart certain kernel exploitation attempts.
|
|
||||||
## Panics may be due to false-positives such as bad drivers.
|
|
||||||
##
|
##
|
||||||
## https://en.wikipedia.org/wiki/Kernel_panic#Linux
|
## Disabled for now as it enforces module signature verification which breaks
|
||||||
## https://en.wikipedia.org/wiki/Linux_kernel_oops
|
## too many things.
|
||||||
## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713
|
## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880
|
||||||
##
|
##
|
||||||
## KSPP=partial
|
#if dpkg --compare-versions "${kver}" ge "5.4"; then
|
||||||
## KSPP sets CONFIG_PANIC_ON_OOPS=y, but also requires CONFIG_PANIC_TIMEOUT=-1.
|
# GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality"
|
||||||
##
|
#fi
|
||||||
## See /usr/libexec/security-misc/panic-on-oops for implementation.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX oops=panic"
|
|
||||||
|
|
||||||
## Modify machine check exception handler.
|
|
||||||
## Can decide whether the system should panic or not based on the occurrence of an exception.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/arch/x86/x86_64/machinecheck.html
|
|
||||||
## https://www.kernel.org/doc/html/latest/arch/x86/x86_64/boot-options.html#machine-check
|
|
||||||
## https://forums.whonix.org/t/kernel-hardening/7296/494
|
|
||||||
##
|
|
||||||
## The default kernel setting will be utilized until provided sufficient evidence to modify.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
|
|
||||||
|
|
||||||
## Prevent sensitive kernel information leaks in the console during boot.
|
|
||||||
## Must be used in combination with the kernel.printk sysctl.
|
|
||||||
## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/core-api/printk-basics.html
|
|
||||||
## https://wiki.archlinux.org/title/silent_boot
|
|
||||||
##
|
|
||||||
## See /etc/default/grub.d/41_quiet_boot.cfg for implementation.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX loglevel=0"
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet"
|
|
||||||
|
|
||||||
## Enable the kernel "Electric-Fence" sampling-based memory safety error detector.
|
|
||||||
## KFENCE detects heap out-of-bounds access, use-after-free, and invalid-free errors.
|
|
||||||
## Aims to have very low processing overhead at each sampling interval.
|
|
||||||
## Sampling interval is set to occur every 100 milliseconds as per KSPP recommendation.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/dev-tools/kfence.html
|
|
||||||
## https://google.github.io/kernel-sanitizers/KFENCE.html
|
|
||||||
## https://blogs.oracle.com/linux/post/linux-slub-allocator-internals-and-debugging-4
|
|
||||||
## https://lwn.net/Articles/835542/
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameter, CONFIG_KFENCE=y, and CONFIG_KFENCE_SAMPLE_INTERVAL=100.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kfence.sample_interval=100"
|
|
||||||
|
|
||||||
## Disable 32-bit Virtual Dynamic Shared Object (vDSO) mappings.
|
|
||||||
## Legacy compatibility feature for superseded glibc versions.
|
|
||||||
##
|
|
||||||
## https://lore.kernel.org/lkml/20080409082927.BD59E26F992@magilla.localdomain/T/
|
|
||||||
## https://lists.openwall.net/linux-kernel/2014/03/11/3
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameter and does not set CONFIG_COMPAT_VDSO.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0"
|
|
||||||
|
|
||||||
## Switch (back) to using kCFI as the default Control Flow Integrity (CFI) implementation.
|
|
||||||
## The default implementation is FineIBT as of Linux kernel 6.2.
|
|
||||||
## The Intel-developed IBT (Indirect Branch Tracking) is only used if supported by the CPU.
|
|
||||||
## kCFI is software-only while FineIBT is a hybrid software/hardware implementation.
|
|
||||||
## FineIBT may result in some performance benefits as it only performs checking at destinations.
|
|
||||||
## FineIBT is considered weaker against attacks that can write arbitrary executables into memory.
|
|
||||||
## Upstream hardening work has provided users the ability to disable FineIBT based on requests.
|
|
||||||
## Choice of CFI implementation is highly dependent on user threat model as there are pros/cons to both.
|
|
||||||
## Do not modify from the default setting if unsure of implications.
|
|
||||||
##
|
|
||||||
## https://lore.kernel.org/all/20221027092842.699804264@infradead.org/
|
|
||||||
## https://lore.kernel.org/lkml/202210010918.4918F847C4@keescook/T/#u
|
|
||||||
## https://lore.kernel.org/lkml/202210182217.486CBA50@keescook/T/
|
|
||||||
## https://lore.kernel.org/lkml/202407150933.E1871BE@keescook/
|
|
||||||
## https://isopenbsdsecu.re/mitigations/forward_edge_cfi/
|
|
||||||
## https://docs.kernel.org/next/x86/shstk.html
|
|
||||||
## https://source.android.com/docs/security/test/kcfi
|
|
||||||
## https://lpc.events/event/16/contributions/1315/attachments/1067/2169/cfi.pdf
|
|
||||||
## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/561
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameter.
|
|
||||||
##
|
|
||||||
## TODO: Debian 13 Trixie
|
|
||||||
## Applicable when using Linux kernel >= 6.2 (retained here for future-proofing and completeness).
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cfi=kcfi"
|
|
||||||
|
|
||||||
## Disable support for x86 processes and syscalls.
|
|
||||||
## Unconditionally disables IA32 emulation to substantially reduce attack surface.
|
|
||||||
##
|
|
||||||
## https://lore.kernel.org/all/20230623111409.3047467-7-nik.borisov@suse.com/
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP does not set CONFIG_COMPAT, CONFIG_IA32_EMULATION, CONFIG_X86_X32, CONFIG_X86_X32_ABI, and CONFIG_MODIFY_LDT_SYSCALL.
|
|
||||||
##
|
|
||||||
## TODO: Debian 13 Trixie
|
|
||||||
## Applicable when using Linux kernel >= 6.7 (retained here for future-proofing and completeness).
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0"
|
|
||||||
|
|
||||||
## Disable EFI persistent storage feature.
|
|
||||||
## Prevents the kernel from writing crash logs and other persistent data to the EFI variable store.
|
|
||||||
##
|
|
||||||
## https://blogs.oracle.com/linux/post/pstore-linux-kernel-persistent-storage-file-system
|
|
||||||
## https://www.ais.com/understanding-pstore-linux-kernel-persistent-storage-file-system/
|
|
||||||
## https://lwn.net/Articles/434821/
|
|
||||||
## https://manpages.debian.org/testing/systemd/systemd-pstore.service.8.en.html
|
|
||||||
## https://gitlab.tails.boum.org/tails/tails/-/issues/20813
|
|
||||||
## https://github.com/Kicksecure/security-misc/issues/299
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1"
|
|
||||||
|
|
||||||
## 2. Direct Memory Access:
|
|
||||||
##
|
|
||||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks
|
|
||||||
|
|
||||||
## Enable CPU manufacturer-specific IOMMU drivers to mitigate some DMA attacks.
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets CONFIG_INTEL_IOMMU=y, CONFIG_INTEL_IOMMU_DEFAULT_ON=y, CONFIG_INTEL_IOMMU_SVM=y, CONFIG_AMD_IOMMU=y, and CONFIG_AMD_IOMMU_V2=y.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX amd_iommu=force_isolation"
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on"
|
|
||||||
|
|
||||||
## Enable and force use of IOMMU translation to protect against some DMA attacks.
|
|
||||||
## Strictly force DMA unmap operations to synchronously invalidate IOMMU hardware TLBs.
|
|
||||||
## Ensures devices will never be able to access stale data contents.
|
|
||||||
##
|
|
||||||
## https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit
|
|
||||||
## https://en.wikipedia.org/wiki/DMA_attack
|
|
||||||
## https://lenovopress.lenovo.com/lp1467.pdf
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets the kernel parameters, CONFIG_IOMMU_SUPPORT=y, CONFIG_IOMMU_DEFAULT_DMA_STRICT=y, and does not set CONFIG_IOMMU_DEFAULT_PASSTHROUGH.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu=force"
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu.passthrough=0"
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu.strict=1"
|
|
||||||
|
|
||||||
## Clear the busmaster bit on all PCI bridges during the EFI hand-off.
|
|
||||||
## Terminates all existing DMA transactions prior to the kernel's IOMMU setup.
|
|
||||||
## Forces third party PCI devices to then re-set their busmaster bit in order to perform DMA.
|
|
||||||
## Assumes that the motherboard chipset and firmware are not malicious.
|
|
||||||
## May cause complete boot failure on certain hardware with incompatible firmware.
|
|
||||||
##
|
|
||||||
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
|
||||||
## https://mjg59.dreamwidth.org/54433.html
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets CONFIG_EFI_DISABLE_PCI_DMA=y.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma"
|
|
||||||
|
|
||||||
## 3. Entropy:
|
|
||||||
##
|
|
||||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#rdrand
|
|
||||||
|
|
||||||
## Do not credit the CPU or bootloader seeds as entropy sources at boot.
|
|
||||||
## The RDRAND CPU (RNG) instructions are proprietary and closed-source.
|
|
||||||
## Numerous implementations of RDRAND have a long history of being defective.
|
|
||||||
## The RNG seed passed by the bootloader could also potentially be tampered.
|
|
||||||
## Maximizing the entropy pool at boot is desirable for all cryptographic operations.
|
|
||||||
## These settings ensure additional entropy is obtained from other sources to initialize the RNG.
|
|
||||||
## Note that distrusting these (relatively fast) sources of entropy will increase boot time.
|
|
||||||
##
|
|
||||||
## https://en.wikipedia.org/wiki/RDRAND#Reception
|
|
||||||
## https://systemd.io/RANDOM_SEEDS/
|
|
||||||
## https://www.kicksecure.com/wiki/Dev/Entropy#RDRAND
|
|
||||||
## https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/
|
|
||||||
## https://x.com/pid_eins/status/1149649806056280069
|
|
||||||
## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
|
||||||
## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
|
||||||
## https://github.com/NixOS/nixpkgs/pull/165355
|
|
||||||
## https://lkml.org/lkml/2022/6/5/271
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets CONFIG_RANDOM_TRUST_BOOTLOADER=y and CONFIG_RANDOM_TRUST_CPU=y.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_bootloader=off"
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off"
|
|
||||||
|
|
||||||
## Obtain more entropy during boot as the runtime memory allocator is being initialized.
|
|
||||||
## Entropy will be extracted from up to the first 4GB of RAM.
|
|
||||||
## Requires the linux-hardened kernel patch.
|
|
||||||
##
|
|
||||||
## https://www.kicksecure.com/wiki/Hardened-kernel#linux-hardened
|
|
||||||
## https://github.com/anthraxx/linux-hardened/commit/c3e7df1dba1eb8105d6d5143079a6a0ad9e9ebc7
|
|
||||||
## https://github.com/anthraxx/linux-hardened/commit/a04458f97fe1f7e95888c77c0165b646375db9c4
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy"
|
|
||||||
|
|
||||||
## 4. Networking
|
|
||||||
##
|
|
||||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-boot-parameters
|
|
||||||
|
|
||||||
## Disable the entire IPv6 stack functionality.
|
|
||||||
## Removes attack surface associated with the IPv6 module.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/networking/ipv6.html
|
|
||||||
## https://wiki.archlinux.org/title/IPv6#Disable_IPv6
|
|
||||||
##
|
|
||||||
## Enabling makes redundant many network hardening sysctl's in /usr/lib/sysctl.d/990-security-misc.conf.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ipv6.disable=1"
|
|
||||||
|
|||||||
@ -1,31 +0,0 @@
|
|||||||
## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Definitions:
|
|
||||||
## KSPP=yes: compliant with recommendations by the KSPP
|
|
||||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
|
||||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
|
||||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
|
||||||
|
|
||||||
## Remount Secure provides enhanced security via mount options:
|
|
||||||
## https://www.kicksecure.com/wiki/Security-misc#Remount_Secure
|
|
||||||
|
|
||||||
## Option A (No Security):
|
|
||||||
## Disable Remount Secure.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=0"
|
|
||||||
|
|
||||||
## Option B (Low Security):
|
|
||||||
## Re-mount with nodev and nosuid only.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1"
|
|
||||||
|
|
||||||
## Option C (Medium Security):
|
|
||||||
## Re-mount with nodev, nosuid, and noexec for most mount points, excluding /home.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=2"
|
|
||||||
|
|
||||||
## Option D (Highest Security):
|
|
||||||
## Re-mount with nodev, nosuid, and noexec for all mount points including /home.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=3"
|
|
||||||
@ -1,37 +0,0 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Definitions:
|
|
||||||
## KSPP=yes: compliant with recommendations by the KSPP
|
|
||||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
|
||||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
|
||||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
|
||||||
|
|
||||||
## Require every kernel module to be signed before being loaded.
|
|
||||||
## Any module that is unsigned or signed with an invalid key cannot be loaded.
|
|
||||||
## This prevents all out-of-tree kernel modules unless signed.
|
|
||||||
## This makes it harder to load a malicious module.
|
|
||||||
##
|
|
||||||
## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/61
|
|
||||||
## https://github.com/dell/dkms/issues/359
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets CONFIG_MODULE_SIG=y, CONFIG_MODULE_SIG_FORCE=y, and CONFIG_MODULE_SIG_ALL=y.
|
|
||||||
##
|
|
||||||
## Not enabled by default yet due to several issues.
|
|
||||||
##
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX module.sig_enforce=1"
|
|
||||||
|
|
||||||
## Enable kernel lockdown to enforce security boundary between user and kernel space.
|
|
||||||
## Confidentiality mode enforces module signature verification.
|
|
||||||
##
|
|
||||||
## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880
|
|
||||||
##
|
|
||||||
## KSPP=yes
|
|
||||||
## KSPP sets CONFIG_SECURITY_LOCKDOWN_LSM=y, CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y, and CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y.
|
|
||||||
##
|
|
||||||
## Not enabled by default yet due to several issues.
|
|
||||||
##
|
|
||||||
#if dpkg --compare-versions "${kver}" ge "5.4"; then
|
|
||||||
# GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality"
|
|
||||||
#fi
|
|
||||||
@ -1,35 +0,0 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Definitions:
|
|
||||||
## KSPP=yes: compliant with recommendations by the KSPP
|
|
||||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
|
||||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
|
||||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
|
||||||
|
|
||||||
## Some default configuration files automatically include the "quiet" parameter.
|
|
||||||
## Therefore, first remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT since "quiet" must be first.
|
|
||||||
## str_replace is provided by package helper-scripts.
|
|
||||||
##
|
|
||||||
## https://github.com/Kicksecure/security-misc/pull/233#issuecomment-2228792461
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | str_replace "quiet" "")"
|
|
||||||
|
|
||||||
## Prevent sensitive kernel information leaks in the console during boot.
|
|
||||||
## Must be used in combination with the kernel.printk sysctl.
|
|
||||||
## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/core-api/printk-basics.html
|
|
||||||
## https://wiki.archlinux.org/title/silent_boot
|
|
||||||
##
|
|
||||||
## For easier debugging, these are not applied to the recovery boot option.
|
|
||||||
## Switch the pair of commands to universally apply parameters to all boot options.
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT loglevel=0"
|
|
||||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT quiet"
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX loglevel=0"
|
|
||||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet"
|
|
||||||
|
|
||||||
## For Increased Log Verbosity:
|
|
||||||
## Adjust (or comment out) the kernel.printk sysctl in /usr/lib/sysctl.d/30_silent-kernel-printk.conf.
|
|
||||||
## Alternatively, installing the debug-misc package will undo these settings.
|
|
||||||
@ -1,21 +0,0 @@
|
|||||||
## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Definitions:
|
|
||||||
## KSPP=yes: compliant with recommendations by the KSPP
|
|
||||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
|
||||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
|
||||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
|
||||||
|
|
||||||
## Disable access to single-user (recovery) mode.
|
|
||||||
##
|
|
||||||
## https://forums.kicksecure.com/t/remove-linux-recovery-mode-boot-option-from-default-grub-boot-menu/727
|
|
||||||
##
|
|
||||||
GRUB_DISABLE_RECOVERY="true"
|
|
||||||
|
|
||||||
## Disable access to Dracut's recovery console.
|
|
||||||
##
|
|
||||||
## https://forums.kicksecure.com/t/harden-dracut-initramfs-generator-by-disabling-recovery-console/724
|
|
||||||
##
|
|
||||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.emergency=halt"
|
|
||||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.shell=0"
|
|
||||||
@ -1,7 +0,0 @@
|
|||||||
## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
reproducible=yes
|
|
||||||
|
|
||||||
## Debugging.
|
|
||||||
#show_modules=yes
|
|
||||||
@ -1,38 +0,0 @@
|
|||||||
## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Lines starting with a hash symbol ('#') are comments.
|
|
||||||
## https://github.com/Kicksecure/security-misc/issues/225
|
|
||||||
|
|
||||||
[core]
|
|
||||||
## https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm
|
|
||||||
symlinks = false
|
|
||||||
|
|
||||||
## https://forums.whonix.org/t/git-users-enable-fsck-by-default-for-better-security/2066
|
|
||||||
[transfer]
|
|
||||||
fsckobjects = true
|
|
||||||
[fetch]
|
|
||||||
fsckobjects = true
|
|
||||||
[receive]
|
|
||||||
fsckobjects = true
|
|
||||||
|
|
||||||
## Generally a good idea but too intrusive to enable by default.
|
|
||||||
## Listed here as suggestions what users should put into their ~/.gitconfig
|
|
||||||
## file.
|
|
||||||
|
|
||||||
## Not enabled by default because it requires essential knowledge about OpenPG
|
|
||||||
## and an already existing local signing key. Otherwise would prevent all new
|
|
||||||
## commits.
|
|
||||||
#[commit]
|
|
||||||
# gpgsign = true
|
|
||||||
|
|
||||||
## Not enabled by default because it would break the 'git merge' command for
|
|
||||||
## unsigned commits and require the '--no-verify-signature' command line
|
|
||||||
## option.
|
|
||||||
#[merge]
|
|
||||||
# verifySignatures = true
|
|
||||||
|
|
||||||
## Not enabled by default because it would break for users who are not having
|
|
||||||
## an account at the git server and having added a SSH public key.
|
|
||||||
#[url "ssh://git@github.com/"]
|
|
||||||
# insteadOf = https://github.com/
|
|
||||||
@ -1,4 +1,4 @@
|
|||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
## Disable the /sys whitelist.
|
## Disable the /sys whitelist.
|
||||||
@ -6,10 +6,3 @@
|
|||||||
|
|
||||||
## Disable the /proc/cpuinfo whitelist.
|
## Disable the /proc/cpuinfo whitelist.
|
||||||
#cpuinfo_whitelist=0
|
#cpuinfo_whitelist=0
|
||||||
|
|
||||||
## Disable /sys hardening.
|
|
||||||
#sysfs=0
|
|
||||||
|
|
||||||
## Disable selinux mode.
|
|
||||||
## https://www.kicksecure.com/wiki/Security-misc#selinux
|
|
||||||
#selinux=0
|
|
||||||
|
|||||||
@ -1,21 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
PREREQ=""
|
|
||||||
prereqs()
|
|
||||||
{
|
|
||||||
echo "$PREREQ"
|
|
||||||
}
|
|
||||||
case $1 in
|
|
||||||
prereqs)
|
|
||||||
prereqs
|
|
||||||
exit 0
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
. /usr/share/initramfs-tools/hook-functions
|
|
||||||
copy_exec /usr/sbin/sysctl /usr/sbin
|
|
||||||
@ -1,26 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
PREREQ=""
|
|
||||||
prereqs()
|
|
||||||
{
|
|
||||||
echo "$PREREQ"
|
|
||||||
}
|
|
||||||
case $1 in
|
|
||||||
prereqs)
|
|
||||||
prereqs
|
|
||||||
exit 0
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
## Write to '/run/initramfs' folder.
|
|
||||||
## https://forums.whonix.org/t/kernel-hardening/7296/435
|
|
||||||
|
|
||||||
sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null 2> "/run/initramfs/sysctl-initramfs-error.log"
|
|
||||||
sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null 2>> "/run/initramfs/sysctl-initramfs-error.log"
|
|
||||||
|
|
||||||
grep -v "unprivileged_userfaultfd" "/run/initramfs/sysctl-initramfs-error.log"
|
|
||||||
|
|
||||||
true
|
|
||||||
@ -1,8 +1,5 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
if test -x /usr/lib/security-misc/remove-system.map ; then
|
||||||
## See the file COPYING for copying conditions.
|
/usr/lib/security-misc/remove-system.map
|
||||||
|
|
||||||
if test -x /usr/libexec/security-misc/remove-system.map ; then
|
|
||||||
/usr/libexec/security-misc/remove-system.map
|
|
||||||
fi
|
fi
|
||||||
|
|||||||
2
etc/modprobe.d/30_nf_conntrack_helper_disable.conf
Normal file
2
etc/modprobe.d/30_nf_conntrack_helper_disable.conf
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
## https://phabricator.whonix.org/T486
|
||||||
|
options nf_conntrack nf_conntrack_helper=0
|
||||||
@ -1,63 +0,0 @@
|
|||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## See the following links for a community discussion and overview regarding the selections.
|
|
||||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989
|
|
||||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules
|
|
||||||
|
|
||||||
## Blacklisting prevents kernel modules from automatically starting.
|
|
||||||
## Disabling prohibits kernel modules from starting.
|
|
||||||
|
|
||||||
## CD-ROM/DVD:
|
|
||||||
## Blacklist CD-ROM and DVD modules.
|
|
||||||
## Not disabled by default due to potential future ISO plans.
|
|
||||||
##
|
|
||||||
## https://nvd.nist.gov/vuln/detail/CVE-2018-11506
|
|
||||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31
|
|
||||||
##
|
|
||||||
blacklist cdrom
|
|
||||||
blacklist sr_mod
|
|
||||||
##
|
|
||||||
#install cdrom /usr/bin/disabled-cdrom-by-security-misc
|
|
||||||
#install sr_mod /usr/bin/disabled-cdrom-by-security-misc
|
|
||||||
|
|
||||||
## Miscellaneous:
|
|
||||||
|
|
||||||
## GrapheneOS:
|
|
||||||
## Partial selection of their infrastructure blacklist.
|
|
||||||
## Duplicate and already disabled modules have been omitted.
|
|
||||||
##
|
|
||||||
## https://github.com/GrapheneOS/infrastructure/blob/main/modprobe.d/local.conf
|
|
||||||
##
|
|
||||||
#blacklist cfg80211
|
|
||||||
#blacklist intel_agp
|
|
||||||
#blacklist ip_tables
|
|
||||||
blacklist joydev
|
|
||||||
#blacklist mousedev
|
|
||||||
#blacklist psmouse
|
|
||||||
## TODO: Re-check in Debian trixie
|
|
||||||
## In GrapheneOS list, yes, "should" be out-commented here.
|
|
||||||
## But not actually out-commented.
|
|
||||||
## Breaks VirtualBox audio device ICH AC97, which is unfortunately still required by some users.
|
|
||||||
## https://www.kicksecure.com/wiki/Dev/audio
|
|
||||||
## https://github.com/Kicksecure/security-misc/issues/271
|
|
||||||
#blacklist snd_intel8x0
|
|
||||||
#blacklist tls
|
|
||||||
#blacklist virtio_balloon
|
|
||||||
#blacklist virtio_console
|
|
||||||
|
|
||||||
## Ubuntu:
|
|
||||||
## Already disabled modules have been omitted.
|
|
||||||
##
|
|
||||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco
|
|
||||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-ath_pci.conf?h=ubuntu/disco
|
|
||||||
##
|
|
||||||
blacklist amd76x_edac
|
|
||||||
blacklist ath_pci
|
|
||||||
blacklist evbug
|
|
||||||
blacklist pcspkr
|
|
||||||
blacklist snd_aw2
|
|
||||||
blacklist snd_intel8x0m
|
|
||||||
blacklist snd_pcsp
|
|
||||||
blacklist usbkbd
|
|
||||||
blacklist usbmouse
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Conntrack:
|
|
||||||
## Disable Netfilter's automatic connection tracking helper assignment.
|
|
||||||
## This functionality adds unnecessary features, such as IRC protocol parsing, into the kernel.
|
|
||||||
## Disabling it reduces the kernel attack surface and improves security.
|
|
||||||
##
|
|
||||||
## https://conntrack-tools.netfilter.org/manual.html
|
|
||||||
## https://forums.whonix.org/t/disable-conntrack-helper/18917
|
|
||||||
##
|
|
||||||
options nf_conntrack nf_conntrack_helper=0
|
|
||||||
@ -1,310 +0,0 @@
|
|||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## See the following links for a community discussion and overview regarding the selections:
|
|
||||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989
|
|
||||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules
|
|
||||||
|
|
||||||
## Blacklisting prevents kernel modules from automatically starting.
|
|
||||||
## Disabling prohibits kernel modules from starting.
|
|
||||||
|
|
||||||
## This configuration file is split into 4 sections:
|
|
||||||
## 1. Hardware
|
|
||||||
## 2. File Systems
|
|
||||||
## 3. Networking
|
|
||||||
## 4. Miscellaneous
|
|
||||||
|
|
||||||
## 1. Hardware:
|
|
||||||
|
|
||||||
## Bluetooth:
|
|
||||||
## Disable Bluetooth to reduce the attack surface due to its long history of security vulnerabilities.
|
|
||||||
##
|
|
||||||
## https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
|
|
||||||
##
|
|
||||||
## Now replaced with a privacy- and security-preserving default Bluetooth configuration for better usability.
|
|
||||||
## https://github.com/Kicksecure/security-misc/pull/145
|
|
||||||
##
|
|
||||||
#install bluetooth /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install bluetooth_6lowpan /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install bt3c_cs /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btbcm /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btintel /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btmrvl /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btmrvl_sdio /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btmtk /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btmtksdio /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btmtkuart /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btnxpuart /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btqca /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btrsi /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btrtl /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btsdio /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install btusb /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
#install virtio_bt /usr/bin/disabled-bluetooth-by-security-misc
|
|
||||||
|
|
||||||
## FireWire (IEEE 1394):
|
|
||||||
## Disable IEEE 1394 (FireWire/i.LINK/Lynx) modules to prevent certain DMA attacks.
|
|
||||||
##
|
|
||||||
## https://en.wikipedia.org/wiki/IEEE_1394#Security_issues
|
|
||||||
##
|
|
||||||
install dv1394 /usr/bin/disabled-firewire-by-security-misc
|
|
||||||
install firewire-core /usr/bin/disabled-firewire-by-security-misc
|
|
||||||
install firewire-ohci /usr/bin/disabled-firewire-by-security-misc
|
|
||||||
install firewire-net /usr/bin/disabled-firewire-by-security-misc
|
|
||||||
install firewire-sbp2 /usr/bin/disabled-firewire-by-security-misc
|
|
||||||
install ohci1394 /usr/bin/disabled-firewire-by-security-misc
|
|
||||||
install raw1394 /usr/bin/disabled-firewire-by-security-misc
|
|
||||||
install sbp2 /usr/bin/disabled-firewire-by-security-misc
|
|
||||||
install video1394 /usr/bin/disabled-firewire-by-security-misc
|
|
||||||
|
|
||||||
## Global Positioning Systems (GPS):
|
|
||||||
## Disable GPS-related modules like GNSS (Global Navigation Satellite System).
|
|
||||||
##
|
|
||||||
install garmin_gps /usr/bin/disabled-gps-by-security-misc
|
|
||||||
install gnss /usr/bin/disabled-gps-by-security-misc
|
|
||||||
install gnss-mtk /usr/bin/disabled-gps-by-security-misc
|
|
||||||
install gnss-serial /usr/bin/disabled-gps-by-security-misc
|
|
||||||
install gnss-sirf /usr/bin/disabled-gps-by-security-misc
|
|
||||||
install gnss-ubx /usr/bin/disabled-gps-by-security-misc
|
|
||||||
install gnss-usb /usr/bin/disabled-gps-by-security-misc
|
|
||||||
|
|
||||||
## Intel Management Engine (ME):
|
|
||||||
## Partially disable the Intel ME interface with the OS.
|
|
||||||
## ME functionality has increasingly become intertwined with basic Intel system operation.
|
|
||||||
## Disabling it may lead to breakages in various components without clear debugging/error messages.
|
|
||||||
## It may affect firmware updates, security, power management, display, and DRM.
|
|
||||||
##
|
|
||||||
## https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html
|
|
||||||
## https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities
|
|
||||||
## https://www.kicksecure.com/wiki/Out-of-band_Management_Technology#Intel_ME_Disabling_Disadvantages
|
|
||||||
## https://github.com/Kicksecure/security-misc/pull/236#issuecomment-2229092813
|
|
||||||
## https://github.com/Kicksecure/security-misc/issues/239
|
|
||||||
##
|
|
||||||
#install mei /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei-gsc /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei_gsc_proxy /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei_hdcp /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei-me /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei_phy /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei_pxp /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei-txe /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei-vsc /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei-vsc-hw /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install mei_wdt /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
#install microread_mei /usr/bin/disabled-intelme-by-security-misc
|
|
||||||
|
|
||||||
## Intel Platform Monitoring Technology (PMT) Telemetry:
|
|
||||||
## Disable certain functionalities of the Intel PMT components.
|
|
||||||
##
|
|
||||||
## https://github.com/intel/Intel-PMT
|
|
||||||
##
|
|
||||||
install pmt_class /usr/bin/disabled-intelpmt-by-security-misc
|
|
||||||
install pmt_crashlog /usr/bin/disabled-intelpmt-by-security-misc
|
|
||||||
install pmt_telemetry /usr/bin/disabled-intelpmt-by-security-misc
|
|
||||||
|
|
||||||
## Thunderbolt:
|
|
||||||
## Disable Thunderbolt modules to prevent certain DMA attacks.
|
|
||||||
##
|
|
||||||
## https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Security_vulnerabilities
|
|
||||||
##
|
|
||||||
install intel-wmi-thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc
|
|
||||||
install thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc
|
|
||||||
install thunderbolt_net /usr/bin/disabled-thunderbolt-by-security-misc
|
|
||||||
|
|
||||||
## 2. File Systems:
|
|
||||||
|
|
||||||
## File Systems:
|
|
||||||
## Disable uncommon file systems to reduce attack surface.
|
|
||||||
## HFS/HFS+ are legacy Apple file systems that may be required depending on the EFI partition format.
|
|
||||||
##
|
|
||||||
install cramfs /usr/bin/disabled-filesys-by-security-misc
|
|
||||||
install freevxfs /usr/bin/disabled-filesys-by-security-misc
|
|
||||||
install hfs /usr/bin/disabled-filesys-by-security-misc
|
|
||||||
install hfsplus /usr/bin/disabled-filesys-by-security-misc
|
|
||||||
install jffs2 /usr/bin/disabled-filesys-by-security-misc
|
|
||||||
install jfs /usr/bin/disabled-filesys-by-security-misc
|
|
||||||
install reiserfs /usr/bin/disabled-filesys-by-security-misc
|
|
||||||
install udf /usr/bin/disabled-filesys-by-security-misc
|
|
||||||
|
|
||||||
## Network File Systems:
|
|
||||||
## Disable uncommon network file systems to reduce attack surface.
|
|
||||||
##
|
|
||||||
install gfs2 /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install ksmbd /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
##
|
|
||||||
## Common Internet File System (CIFS):
|
|
||||||
##
|
|
||||||
install cifs /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install cifs_arc4 /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install cifs_md4 /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
##
|
|
||||||
## Network File System (NFS):
|
|
||||||
##
|
|
||||||
install nfs /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install nfs_acl /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install nfs_layout_nfsv41_files /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install nfs_layout_flexfiles /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install nfsd /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install nfsv2 /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install nfsv3 /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc
|
|
||||||
|
|
||||||
## 2. Networking:
|
|
||||||
|
|
||||||
## Network Protocols:
|
|
||||||
## Disables rare and unneeded network protocols that are a common source of unknown vulnerabilities.
|
|
||||||
## Previously had blacklisted eepro100 and eth1394.
|
|
||||||
##
|
|
||||||
## https://tails.boum.org/blueprint/blacklist_modules/
|
|
||||||
## https://fedoraproject.org/wiki/Security_Features_Matrix#Blacklist_Rare_Protocols
|
|
||||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-rare-network.conf?h=ubuntu/disco
|
|
||||||
## https://github.com/Kicksecure/security-misc/pull/234#issuecomment-2230732015
|
|
||||||
##
|
|
||||||
install af_802154 /usr/bin/disabled-network-by-security-misc
|
|
||||||
install appletalk /usr/bin/disabled-network-by-security-misc
|
|
||||||
install ax25 /usr/bin/disabled-network-by-security-misc
|
|
||||||
#install brcm80211 /usr/bin/disabled-network-by-security-misc
|
|
||||||
install decnet /usr/bin/disabled-network-by-security-misc
|
|
||||||
install dccp /usr/bin/disabled-network-by-security-misc
|
|
||||||
install econet /usr/bin/disabled-network-by-security-misc
|
|
||||||
install eepro100 /usr/bin/disabled-network-by-security-misc
|
|
||||||
install eth1394 /usr/bin/disabled-network-by-security-misc
|
|
||||||
install ipx /usr/bin/disabled-network-by-security-misc
|
|
||||||
install n-hdlc /usr/bin/disabled-network-by-security-misc
|
|
||||||
install netrom /usr/bin/disabled-network-by-security-misc
|
|
||||||
install p8022 /usr/bin/disabled-network-by-security-misc
|
|
||||||
install p8023 /usr/bin/disabled-network-by-security-misc
|
|
||||||
install psnap /usr/bin/disabled-network-by-security-misc
|
|
||||||
install rose /usr/bin/disabled-network-by-security-misc
|
|
||||||
install x25 /usr/bin/disabled-network-by-security-misc
|
|
||||||
##
|
|
||||||
## Asynchronous Transfer Mode (ATM):
|
|
||||||
##
|
|
||||||
install atm /usr/bin/disabled-network-by-security-misc
|
|
||||||
install ueagle-atm /usr/bin/disabled-network-by-security-misc
|
|
||||||
install usbatm /usr/bin/disabled-network-by-security-misc
|
|
||||||
install xusbatm /usr/bin/disabled-network-by-security-misc
|
|
||||||
##
|
|
||||||
## Controller Area Network (CAN) Protocol:
|
|
||||||
##
|
|
||||||
install c_can /usr/bin/disabled-network-by-security-misc
|
|
||||||
install c_can_pci /usr/bin/disabled-network-by-security-misc
|
|
||||||
install c_can_platform /usr/bin/disabled-network-by-security-misc
|
|
||||||
install can /usr/bin/disabled-network-by-security-misc
|
|
||||||
install can-bcm /usr/bin/disabled-network-by-security-misc
|
|
||||||
install can-dev /usr/bin/disabled-network-by-security-misc
|
|
||||||
install can-gw /usr/bin/disabled-network-by-security-misc
|
|
||||||
install can-isotp /usr/bin/disabled-network-by-security-misc
|
|
||||||
install can-raw /usr/bin/disabled-network-by-security-misc
|
|
||||||
install can-j1939 /usr/bin/disabled-network-by-security-misc
|
|
||||||
install can327 /usr/bin/disabled-network-by-security-misc
|
|
||||||
install ifi_canfd /usr/bin/disabled-network-by-security-misc
|
|
||||||
install janz-ican3 /usr/bin/disabled-network-by-security-misc
|
|
||||||
install m_can /usr/bin/disabled-network-by-security-misc
|
|
||||||
install m_can_pci /usr/bin/disabled-network-by-security-misc
|
|
||||||
install m_can_platform /usr/bin/disabled-network-by-security-misc
|
|
||||||
install phy-can-transceiver /usr/bin/disabled-network-by-security-misc
|
|
||||||
install slcan /usr/bin/disabled-network-by-security-misc
|
|
||||||
install ucan /usr/bin/disabled-network-by-security-misc
|
|
||||||
install vxcan /usr/bin/disabled-network-by-security-misc
|
|
||||||
install vcan /usr/bin/disabled-network-by-security-misc
|
|
||||||
##
|
|
||||||
## Transparent Inter Process Communication (TIPC):
|
|
||||||
##
|
|
||||||
install tipc /usr/bin/disabled-network-by-security-misc
|
|
||||||
install tipc_diag /usr/bin/disabled-network-by-security-misc
|
|
||||||
##
|
|
||||||
## Reliable Datagram Sockets (RDS):
|
|
||||||
##
|
|
||||||
install rds /usr/bin/disabled-network-by-security-misc
|
|
||||||
install rds_rdma /usr/bin/disabled-network-by-security-misc
|
|
||||||
install rds_tcp /usr/bin/disabled-network-by-security-misc
|
|
||||||
##
|
|
||||||
## Stream Control Transmission Protocol (SCTP):
|
|
||||||
##
|
|
||||||
install sctp /usr/bin/disabled-network-by-security-misc
|
|
||||||
install sctp_diag /usr/bin/disabled-network-by-security-misc
|
|
||||||
|
|
||||||
## 4. Miscellaneous:
|
|
||||||
|
|
||||||
## Amateur Radios:
|
|
||||||
##
|
|
||||||
install hamradio /usr/bin/disabled-miscellaneous-by-security-misc
|
|
||||||
|
|
||||||
## CPU Model-Specific Registers (MSRs):
|
|
||||||
## Disable CPU MSRs as they can be abused to write to arbitrary memory.
|
|
||||||
##
|
|
||||||
## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode
|
|
||||||
## https://github.com/Kicksecure/security-misc/issues/215
|
|
||||||
##
|
|
||||||
#install msr /usr/bin/disabled-miscellaneous-by-security-misc
|
|
||||||
|
|
||||||
## Floppy Disks:
|
|
||||||
##
|
|
||||||
install floppy /usr/bin/disabled-miscellaneous-by-security-misc
|
|
||||||
|
|
||||||
## Framebuffer (fbdev):
|
|
||||||
## Video drivers are known to be buggy, cause kernel panics, and are generally only used by legacy devices.
|
|
||||||
## These were all previously blacklisted.
|
|
||||||
##
|
|
||||||
## https://docs.kernel.org/fb/index.html
|
|
||||||
## https://en.wikipedia.org/wiki/Linux_framebuffer
|
|
||||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco
|
|
||||||
##
|
|
||||||
install aty128fb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install atyfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install cirrusfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install cyber2000fb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install cyblafb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install gx1fb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install hgafb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install i810fb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install intelfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install kyrofb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install lxfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install matroxfb_base /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install neofb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install nvidiafb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install pm2fb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install radeonfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install rivafb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install s1d13xxxfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install savagefb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install sisfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install sstfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install tdfxfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install tridentfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install vesafb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install vfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install viafb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install vt8623fb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
install udlfb /usr/bin/disabled-framebuffer-by-security-misc
|
|
||||||
|
|
||||||
## Replaced Modules:
|
|
||||||
## These legacy drivers have all been entirely replaced and superseded by newer drivers.
|
|
||||||
## These were all previously blacklisted.
|
|
||||||
##
|
|
||||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco
|
|
||||||
##
|
|
||||||
install asus_acpi /usr/bin/disabled-miscellaneous-by-security-misc
|
|
||||||
install bcm43xx /usr/bin/disabled-miscellaneous-by-security-misc
|
|
||||||
install de4x5 /usr/bin/disabled-miscellaneous-by-security-misc
|
|
||||||
install prism54 /usr/bin/disabled-miscellaneous-by-security-misc
|
|
||||||
|
|
||||||
## USB Video Device Class:
|
|
||||||
## Disables the USB-based video streaming driver for devices like some webcams and digital camcorders.
|
|
||||||
##
|
|
||||||
#install uvcvideo /usr/bin/disabled-miscellaneous-by-security-misc
|
|
||||||
|
|
||||||
## Vivid:
|
|
||||||
## Disables the vivid kernel module since it has been the cause of multiple vulnerabilities.
|
|
||||||
##
|
|
||||||
## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233
|
|
||||||
## https://www.openwall.com/lists/oss-security/2019/11/02/1
|
|
||||||
## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475
|
|
||||||
##
|
|
||||||
## No longer disabled by default:
|
|
||||||
## https://forums.whonix.org/t/testing-qubes-video-companion-on-whonix/21393
|
|
||||||
## https://github.com/Kicksecure/security-misc/issues/298
|
|
||||||
##
|
|
||||||
#install vivid /usr/bin/disabled-miscellaneous-by-security-misc
|
|
||||||
6
etc/modprobe.d/blacklist-bluetooth.conf
Normal file
6
etc/modprobe.d/blacklist-bluetooth.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
# Blacklists bluetooth to reduce attack surface.
|
||||||
|
# Bluetooth also has a history of security vulnerabilities:
|
||||||
|
#
|
||||||
|
# https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
|
||||||
|
install bluetooth /bin/false
|
||||||
|
install btusb /bin/false
|
||||||
3
etc/modprobe.d/blacklist-dma.conf
Normal file
3
etc/modprobe.d/blacklist-dma.conf
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
# Blacklist thunderbolt and firewire to prevent some DMA attacks.
|
||||||
|
install firewire-core /bin/false
|
||||||
|
install thunderbolt /bin/false
|
||||||
3
etc/modprobe.d/msr.conf
Normal file
3
etc/modprobe.d/msr.conf
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
# Blacklist CPU MSRs as they can be abused to write to
|
||||||
|
# arbitrary memory.
|
||||||
|
install msr /bin/false
|
||||||
25
etc/modprobe.d/uncommon-network-protocols.conf
Normal file
25
etc/modprobe.d/uncommon-network-protocols.conf
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
# Disables unneeded network protocols that will likely not be used as these may have unknown vulnerabilties.
|
||||||
|
#
|
||||||
|
# Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these.
|
||||||
|
#
|
||||||
|
# > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users.
|
||||||
|
#
|
||||||
|
# > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record.
|
||||||
|
#
|
||||||
|
install dccp /bin/false
|
||||||
|
install sctp /bin/false
|
||||||
|
install rds /bin/false
|
||||||
|
install tipc /bin/false
|
||||||
|
install n-hdlc /bin/false
|
||||||
|
install ax25 /bin/false
|
||||||
|
install netrom /bin/false
|
||||||
|
install x25 /bin/false
|
||||||
|
install rose /bin/false
|
||||||
|
install decnet /bin/false
|
||||||
|
install econet /bin/false
|
||||||
|
install af_802154 /bin/false
|
||||||
|
install ipx /bin/false
|
||||||
|
install appletalk /bin/false
|
||||||
|
install psnap /bin/false
|
||||||
|
install p8023 /bin/false
|
||||||
|
install p8022 /bin/false
|
||||||
146
etc/permission-hardening.d/30_default.conf
Normal file
146
etc/permission-hardening.d/30_default.conf
Normal file
@ -0,0 +1,146 @@
|
|||||||
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||||
|
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||||
|
## configuration. When security-misc is updated, this file may be overwritten.
|
||||||
|
|
||||||
|
## File permission hardening.
|
||||||
|
##
|
||||||
|
## Syntax:
|
||||||
|
## [filename] [mode] [owner] [group] [capability]
|
||||||
|
##
|
||||||
|
## To remove all SUID/SGID binaries in a directory, you can use the "nosuid"
|
||||||
|
## argument.
|
||||||
|
|
||||||
|
## TODO: white spaces inside file name untested and probably will not work.
|
||||||
|
|
||||||
|
######################################################################
|
||||||
|
# SUID disablewhitelist
|
||||||
|
######################################################################
|
||||||
|
|
||||||
|
## disablewhitelist disables below (or in lexically higher) files
|
||||||
|
## exactwhitelist and matchwhitelist. Add these here (discouraged) or better
|
||||||
|
## in file "/etc/permission-hardening.d/20_user.conf".
|
||||||
|
|
||||||
|
## For example, if you are not using SELinux the following might make sense to
|
||||||
|
## enable. TODO: research
|
||||||
|
#/utempter/utempter disablewhitelist
|
||||||
|
|
||||||
|
## If you are not going to use AppImages such as electrum Bitcoin wallet.
|
||||||
|
#/fusermount disablewhitelist
|
||||||
|
|
||||||
|
######################################################################
|
||||||
|
# SUID exact match whitelist
|
||||||
|
######################################################################
|
||||||
|
|
||||||
|
/usr/bin/sudo exactwhitelist
|
||||||
|
/bin/sudo exactwhitelist
|
||||||
|
/usr/bin/bwrap exactwhitelist
|
||||||
|
/bin/bwrap exactwhitelist
|
||||||
|
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper exactwhitelist
|
||||||
|
/usr/lib/chromium/chrome-sandbox exactwhitelist
|
||||||
|
|
||||||
|
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
|
||||||
|
## Protect from 'chmod -x' (and SUID removal).
|
||||||
|
## SUID will be removed below in separate step.
|
||||||
|
/bin/mount exactwhitelist
|
||||||
|
/usr/bin/mount exactwhitelist
|
||||||
|
|
||||||
|
## There is a controversy about firejail but those who choose to install it
|
||||||
|
## should be able to use it.
|
||||||
|
## https://www.whonix.org/wiki/Dev/Firejail#Security
|
||||||
|
/usr/bin/firejail exactwhitelist
|
||||||
|
|
||||||
|
## In case you need to use 'su'. See also:
|
||||||
|
## https://www.whonix.org/wiki/root#su
|
||||||
|
#/bin/su exactwhitelist
|
||||||
|
#/usr/bin/su exactwhitelist
|
||||||
|
|
||||||
|
######################################################################
|
||||||
|
# SUID exact match whitelist
|
||||||
|
######################################################################
|
||||||
|
|
||||||
|
## https://manpages.debian.org/buster/xserver-xorg-legacy/Xorg.wrap.1.en.html
|
||||||
|
## https://lwn.net/Articles/590315/
|
||||||
|
## http://forums.whonix.org/t/permission-hardening/8655/25
|
||||||
|
#/usr/lib/xorg/Xorg.wrap whitelist
|
||||||
|
|
||||||
|
######################################################################
|
||||||
|
# SUID regex match whitelist - research required
|
||||||
|
######################################################################
|
||||||
|
|
||||||
|
/usr/lib/virtualbox/ matchwhitelist
|
||||||
|
|
||||||
|
## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c
|
||||||
|
## match both:
|
||||||
|
#/usr/lib/qubes/qfile-unpacker whitelist
|
||||||
|
#/lib/qubes/qfile-unpacker
|
||||||
|
/qubes/qfile-unpacker matchwhitelist
|
||||||
|
|
||||||
|
## match both:
|
||||||
|
#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
|
||||||
|
#/lib/policykit-1/polkit-agent-helper-1
|
||||||
|
polkit-agent-helper-1 matchwhitelist
|
||||||
|
|
||||||
|
######################################################################
|
||||||
|
# SUID regex match whitelist
|
||||||
|
######################################################################
|
||||||
|
|
||||||
|
dbus-daemon-launch-helper matchwhitelist
|
||||||
|
/utempter/utempter matchwhitelist
|
||||||
|
|
||||||
|
## required for AppImages such as electrum Bitcoin wallet
|
||||||
|
## https://forums.whonix.org/t/disable-suid-binaries/7706/57
|
||||||
|
/fusermount matchwhitelist
|
||||||
|
|
||||||
|
######################################################################
|
||||||
|
# Permission Hardening
|
||||||
|
######################################################################
|
||||||
|
|
||||||
|
## Remove SUID from 'mount' but keep executable.
|
||||||
|
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
|
||||||
|
/bin/mount 745 root root
|
||||||
|
/usr/bin/mount 745 root root
|
||||||
|
|
||||||
|
/home/ 0755 root root
|
||||||
|
/home/user/ 0700 user user
|
||||||
|
/root/ 0700 root root
|
||||||
|
/boot/ 0700 root root
|
||||||
|
/etc/permission-hardening.d 0600 root root
|
||||||
|
/usr/local/etc/permission-hardening.d 0600 root root
|
||||||
|
/lib/modules/ 0700 root root
|
||||||
|
|
||||||
|
######################################################################
|
||||||
|
# SUID/SGID Removal
|
||||||
|
######################################################################
|
||||||
|
|
||||||
|
## Remove all SUID/SGID binaries/libraries.
|
||||||
|
|
||||||
|
/bin/ nosuid
|
||||||
|
/usr/bin/ nosuid
|
||||||
|
/usr/local/bin/ nosuid
|
||||||
|
/sbin/ nosuid
|
||||||
|
/usr/sbin/ nosuid
|
||||||
|
/usr/local/sbin/ nosuid
|
||||||
|
/lib/ nosuid
|
||||||
|
/lib32/ nosuid
|
||||||
|
/lib64/ nosuid
|
||||||
|
/usr/lib/ nosuid
|
||||||
|
/usr/lib32/ nosuid
|
||||||
|
/usr/lib64/ nosuid
|
||||||
|
/usr/local/lib/ nosuid
|
||||||
|
/usr/local/lib32/ nosuid
|
||||||
|
/usr/local/lib64/ nosuid
|
||||||
|
|
||||||
|
######################################################################
|
||||||
|
# Capability Removal
|
||||||
|
######################################################################
|
||||||
|
|
||||||
|
## Ping doesn't work with Tor anyway so its capabilities are removed to
|
||||||
|
## reduce attack surface.
|
||||||
|
## anon-apps-config does this.
|
||||||
|
#/bin/ping 0744 root root none
|
||||||
|
|
||||||
|
## TODO: research
|
||||||
|
#/usr/lib/x86_64-linux-gnu/gstreamer1.0/grstreamer-1.0/gst-ptp-helper 0744 root root none
|
||||||
@ -1,11 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
if [ -z "$XDG_CONFIG_DIRS" ]; then
|
|
||||||
XDG_CONFIG_DIRS=/etc/xdg
|
|
||||||
fi
|
|
||||||
if ! echo "$XDG_CONFIG_DIRS" | grep --quiet /usr/share/security-misc/ ; then
|
|
||||||
export XDG_CONFIG_DIRS=/usr/share/security-misc/:$XDG_CONFIG_DIRS
|
|
||||||
fi
|
|
||||||
@ -1,5 +1,2 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
# /etc/securetty: list of terminals on which root is allowed to login.
|
# /etc/securetty: list of terminals on which root is allowed to login.
|
||||||
# See securetty(5) and login(1).
|
# See securetty(5) and login(1).
|
||||||
|
|||||||
@ -1,9 +1,6 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
## To enable root login, see:
|
|
||||||
## https://www.kicksecure.com/wiki/Root#Root_Login
|
|
||||||
|
|
||||||
## Console Lockdown
|
## Console Lockdown
|
||||||
## https://forums.whonix.org/t/etc-security-hardening/8592
|
## https://forums.whonix.org/t/etc-security-hardening/8592
|
||||||
|
|
||||||
@ -18,24 +15,11 @@
|
|||||||
## Usually tty7 is for X.
|
## Usually tty7 is for X.
|
||||||
## Qubes uses tty1 for X.
|
## Qubes uses tty1 for X.
|
||||||
|
|
||||||
|
## Allow members of group 'console' to use tty1 to tty7 and pts/0 to pts/9 and hvc0 to hvc9.
|
||||||
## Qubes has 'pts/0' when for example running "sudo" from a terminal emulator.
|
## Qubes has 'pts/0' when for example running "sudo" from a terminal emulator.
|
||||||
## Qubes uses 'hvc0' when using in dom0 "sudo xl console vm-name".
|
## Qubes uses 'hvc0' when using in dom0 "sudo xl console vm-name".
|
||||||
## When using systemd-nspawn (chroot) then `login` requires console 'console' to be permitted.
|
+:console:tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9
|
||||||
|
|
||||||
## Allow members of group `console` to use:
|
|
||||||
## - 'console'
|
|
||||||
## - 'tty1' to 'tty7'
|
|
||||||
## - 'pts/0' to 'pts/9'
|
|
||||||
## - 'hvc0' to 'hvc9'
|
|
||||||
## serial console
|
|
||||||
## https://forums.whonix.org/t/how-do-i-enter-the-whonix-shell-from-cli/7271/43
|
|
||||||
## - 'ttyS0' to 'ttyS9'
|
|
||||||
+:(console):console tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9
|
|
||||||
|
|
||||||
## Same as above also for members of group `sudo`.
|
|
||||||
## https://github.com/Whonix/security-misc/pull/74#issuecomment-607748407
|
|
||||||
+:(sudo):console tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9
|
|
||||||
|
|
||||||
## Everyone else except members of group 'console-unrestricted'
|
## Everyone else except members of group 'console-unrestricted'
|
||||||
## are restricted from everything else.
|
## are restricted from everything else.
|
||||||
-:ALL EXCEPT (console-unrestricted):ALL
|
-:ALL EXCEPT console-unrestricted :ALL
|
||||||
|
|||||||
@ -1,70 +0,0 @@
|
|||||||
## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
# Configuration for locking the user after multiple failed
|
|
||||||
# authentication attempts.
|
|
||||||
#
|
|
||||||
# The directory where the user files with the failure records are kept.
|
|
||||||
# The default is /var/run/faillock.
|
|
||||||
dir = /var/lib/security-misc/faillock
|
|
||||||
#
|
|
||||||
# Will log the user name into the system log if the user is not found.
|
|
||||||
# Enabled if option is present.
|
|
||||||
audit
|
|
||||||
#
|
|
||||||
# Don't print informative messages.
|
|
||||||
# Enabled if option is present.
|
|
||||||
# silent
|
|
||||||
#
|
|
||||||
# Don't log informative messages via syslog.
|
|
||||||
# Enabled if option is present.
|
|
||||||
# no_log_info
|
|
||||||
#
|
|
||||||
# Only track failed user authentications attempts for local users
|
|
||||||
# in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users.
|
|
||||||
# The `faillock` command will also no longer track user failed
|
|
||||||
# authentication attempts. Enabling this option will prevent a
|
|
||||||
# double-lockout scenario where a user is locked out locally and
|
|
||||||
# in the centralized mechanism.
|
|
||||||
# Enabled if option is present.
|
|
||||||
# local_users_only
|
|
||||||
#
|
|
||||||
# Deny access if the number of consecutive authentication failures
|
|
||||||
# for this user during the recent interval exceeds n tries.
|
|
||||||
# The default is 3.
|
|
||||||
deny = 50
|
|
||||||
#
|
|
||||||
# The length of the interval during which the consecutive
|
|
||||||
# authentication failures must happen for the user account
|
|
||||||
# lock out is <replaceable>n</replaceable> seconds.
|
|
||||||
# The default is 900 (15 minutes).
|
|
||||||
# security-misc note: the interval should be set to infinity if possible,
|
|
||||||
# however pam_faillock arbitrarily limits this variable to a maximum of 604800
|
|
||||||
# seconds (7 days). See
|
|
||||||
# https://github.com/linux-pam/linux-pam/blob/539816e4a0a277dbb632412be91e482fff9d9d09/modules/pam_faillock/faillock_config.h#L59
|
|
||||||
# for details. Therefore we set this to the maximum allowable value of 7 days.
|
|
||||||
fail_interval = 604800
|
|
||||||
#
|
|
||||||
# The access will be re-enabled after n seconds after the lock out.
|
|
||||||
# The value 0 has the same meaning as value `never` - the access
|
|
||||||
# will not be re-enabled without resetting the faillock
|
|
||||||
# entries by the `faillock` command.
|
|
||||||
# The default is 600 (10 minutes).
|
|
||||||
unlock_time = never
|
|
||||||
#
|
|
||||||
# Root account can become locked as well as regular accounts.
|
|
||||||
# Enabled if option is present.
|
|
||||||
even_deny_root
|
|
||||||
#
|
|
||||||
# This option implies the `even_deny_root` option.
|
|
||||||
# Allow access after n seconds to root account after the
|
|
||||||
# account is locked. In case the option is not specified
|
|
||||||
# the value is the same as of the `unlock_time` option.
|
|
||||||
# root_unlock_time = 900
|
|
||||||
#
|
|
||||||
# If a group name is specified with this option, members
|
|
||||||
# of the group will be handled by this module the same as
|
|
||||||
# the root account (the options `even_deny_root>` and
|
|
||||||
# `root_unlock_time` will apply to them.
|
|
||||||
# By default, the option is not set.
|
|
||||||
# admin_group = <admin_group_name>
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Disable coredumps.
|
|
||||||
* hard core 0
|
|
||||||
2
etc/security/limits.d/disable-coredumps.conf
Normal file
2
etc/security/limits.d/disable-coredumps.conf
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
# Disable coredumps.
|
||||||
|
* hard core 0
|
||||||
@ -1,8 +1,5 @@
|
|||||||
<?xml version="1.0" encoding="UTF-8"?>
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
|
||||||
<!-- ## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org> -->
|
|
||||||
<!-- ## See the file COPYING for copying conditions. -->
|
|
||||||
|
|
||||||
<!-- Configuration for Thunar. -->
|
<!-- Configuration for Thunar. -->
|
||||||
<!-- Changes date style to iso format. -->
|
<!-- Changes date style to iso format. -->
|
||||||
<!-- Disable thumbnails. -->
|
<!-- Disable thumbnails. -->
|
||||||
@ -16,5 +13,4 @@
|
|||||||
<value type="string" value="network:///"/>
|
<value type="string" value="network:///"/>
|
||||||
</property>
|
</property>
|
||||||
<property name="misc-volume-management" type="bool" value="false"/>
|
<property name="misc-volume-management" type="bool" value="false"/>
|
||||||
<property name="misc-show-delete-action" type="bool" value="true"/>
|
|
||||||
</channel>
|
</channel>
|
||||||
|
|||||||
@ -1,350 +0,0 @@
|
|||||||
# Options for GnuPG
|
|
||||||
# Copyright 1998, 1999, 2000, 2001, 2002, 2003,
|
|
||||||
# 2010 Free Software Foundation, Inc.
|
|
||||||
#
|
|
||||||
# This file is free software; as a special exception the author gives
|
|
||||||
# unlimited permission to copy and/or distribute it, with or without
|
|
||||||
# modifications, as long as this notice is preserved.
|
|
||||||
#
|
|
||||||
# This file is distributed in the hope that it will be useful, but
|
|
||||||
# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
|
|
||||||
# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
|
||||||
#
|
|
||||||
# Unless you specify which option file to use (with the command line
|
|
||||||
# option "--options filename"), GnuPG uses the file ~/.gnupg/gpg.conf
|
|
||||||
# by default.
|
|
||||||
#
|
|
||||||
# An options file can contain any long options which are available in
|
|
||||||
# GnuPG. If the first non white space character of a line is a '#',
|
|
||||||
# this line is ignored. Empty lines are also ignored.
|
|
||||||
#
|
|
||||||
# See the man page for a list of options.
|
|
||||||
|
|
||||||
# Uncomment the following option to get rid of the copyright notice
|
|
||||||
|
|
||||||
#no-greeting
|
|
||||||
|
|
||||||
# If you have more than 1 secret key in your keyring, you may want to
|
|
||||||
# uncomment the following option and set your preferred keyid.
|
|
||||||
|
|
||||||
#default-key 621CC013
|
|
||||||
|
|
||||||
# If you do not pass a recipient to gpg, it will ask for one. Using
|
|
||||||
# this option you can encrypt to a default key. Key validation will
|
|
||||||
# not be done in this case. The second form uses the default key as
|
|
||||||
# default recipient.
|
|
||||||
|
|
||||||
#default-recipient some-user-id
|
|
||||||
#default-recipient-self
|
|
||||||
|
|
||||||
# Use --encrypt-to to add the specified key as a recipient to all
|
|
||||||
# messages. This is useful, for example, when sending mail through a
|
|
||||||
# mail client that does not automatically encrypt mail to your key.
|
|
||||||
# In the example, this option allows you to read your local copy of
|
|
||||||
# encrypted mail that you've sent to others.
|
|
||||||
|
|
||||||
#encrypt-to some-key-id
|
|
||||||
|
|
||||||
# By default GnuPG creates version 4 signatures for data files as
|
|
||||||
# specified by OpenPGP. Some earlier (PGP 6, PGP 7) versions of PGP
|
|
||||||
# require the older version 3 signatures. Setting this option forces
|
|
||||||
# GnuPG to create version 3 signatures.
|
|
||||||
|
|
||||||
#force-v3-sigs
|
|
||||||
|
|
||||||
# Because some mailers change lines starting with "From " to ">From "
|
|
||||||
# it is good to handle such lines in a special way when creating
|
|
||||||
# cleartext signatures; all other PGP versions do it this way too.
|
|
||||||
|
|
||||||
#no-escape-from-lines
|
|
||||||
|
|
||||||
# If you do not use the Latin-1 (ISO-8859-1) charset, you should tell
|
|
||||||
# GnuPG which is the native character set. Please check the man page
|
|
||||||
# for supported character sets. This character set is only used for
|
|
||||||
# metadata and not for the actual message which does not undergo any
|
|
||||||
# translation. Note that future version of GnuPG will change to UTF-8
|
|
||||||
# as default character set. In most cases this option is not required
|
|
||||||
# as GnuPG is able to figure out the correct charset at runtime.
|
|
||||||
|
|
||||||
#charset utf-8
|
|
||||||
|
|
||||||
# Group names may be defined like this:
|
|
||||||
# group mynames = paige 0x12345678 joe patti
|
|
||||||
#
|
|
||||||
# Any time "mynames" is a recipient (-r or --recipient), it will be
|
|
||||||
# expanded to the names "paige", "joe", and "patti", and the key ID
|
|
||||||
# "0x12345678". Note that there is only one level of expansion - you
|
|
||||||
# cannot make a group that points to another group. Note also that
|
|
||||||
# if there are spaces in the recipient name, this will appear as two
|
|
||||||
# recipients. In these cases it is better to use the key ID.
|
|
||||||
|
|
||||||
#group mynames = paige 0x12345678 joe patti
|
|
||||||
|
|
||||||
# Lock the file only once for the lifetime of a process. If you do
|
|
||||||
# not define this, the lock will be obtained and released every time
|
|
||||||
# it is needed, which is usually preferable.
|
|
||||||
|
|
||||||
#lock-once
|
|
||||||
|
|
||||||
# GnuPG can send and receive keys to and from a keyserver. These
|
|
||||||
# servers can be HKP, email, or LDAP (if GnuPG is built with LDAP
|
|
||||||
# support).
|
|
||||||
#
|
|
||||||
# High-risk users should stop using the keyserver network immediately.
|
|
||||||
# https://forums.whonix.org/t/gpg-recv-keys-fails-no-longer-use-keyservers-for-anything/5607/8
|
|
||||||
#
|
|
||||||
# Example HKP keyserver:
|
|
||||||
# hkp://keys.gnupg.net
|
|
||||||
# hkp://subkeys.pgp.net
|
|
||||||
#
|
|
||||||
# Example email keyserver:
|
|
||||||
# mailto:pgp-public-keys@keys.pgp.net
|
|
||||||
#
|
|
||||||
# Example LDAP keyservers:
|
|
||||||
# ldap://keyserver.pgp.com
|
|
||||||
#
|
|
||||||
# Regular URL syntax applies, and you can set an alternate port
|
|
||||||
# through the usual method:
|
|
||||||
# hkp://keyserver.example.net:22742
|
|
||||||
#
|
|
||||||
# Most users just set the name and type of their preferred keyserver.
|
|
||||||
# Note that most servers (with the notable exception of
|
|
||||||
# ldap://keyserver.pgp.com) synchronize changes with each other. Note
|
|
||||||
# also that a single server name may actually point to multiple
|
|
||||||
# servers via DNS round-robin. hkp://keys.gnupg.net is an example of
|
|
||||||
# such a "server", which spreads the load over a number of physical
|
|
||||||
# servers. To see the IP address of the server actually used, you may use
|
|
||||||
# the "--keyserver-options debug".
|
|
||||||
#
|
|
||||||
#keyserver hkp://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.onion
|
|
||||||
#keyserver mailto:pgp-public-keys@keys.nl.pgp.net
|
|
||||||
#keyserver ldap://keyserver.pgp.com
|
|
||||||
|
|
||||||
# Common options for keyserver functions:
|
|
||||||
#
|
|
||||||
# include-disabled : when searching, include keys marked as "disabled"
|
|
||||||
# on the keyserver (not all keyservers support this).
|
|
||||||
#
|
|
||||||
# no-include-revoked : when searching, do not include keys marked as
|
|
||||||
# "revoked" on the keyserver.
|
|
||||||
#
|
|
||||||
# verbose : show more information as the keys are fetched.
|
|
||||||
# Can be used more than once to increase the amount
|
|
||||||
# of information shown.
|
|
||||||
#
|
|
||||||
# use-temp-files : use temporary files instead of a pipe to talk to the
|
|
||||||
# keyserver. Some platforms (Win32 for one) always
|
|
||||||
# have this on.
|
|
||||||
#
|
|
||||||
# keep-temp-files : do not delete temporary files after using them
|
|
||||||
# (really only useful for debugging)
|
|
||||||
#
|
|
||||||
# http-proxy="proxy" : set the proxy to use for HTTP and HKP keyservers.
|
|
||||||
# This overrides the "http_proxy" environment variable,
|
|
||||||
# if any.
|
|
||||||
#
|
|
||||||
# auto-key-retrieve : automatically fetch keys as needed from the keyserver
|
|
||||||
# when verifying signatures or when importing keys that
|
|
||||||
# have been revoked by a revocation key that is not
|
|
||||||
# present on the keyring.
|
|
||||||
#
|
|
||||||
# no-include-attributes : do not include attribute IDs (aka "photo IDs")
|
|
||||||
# when sending keys to the keyserver.
|
|
||||||
|
|
||||||
#keyserver-options auto-key-retrieve
|
|
||||||
|
|
||||||
# Display photo user IDs in key listings
|
|
||||||
|
|
||||||
# list-options show-photos
|
|
||||||
|
|
||||||
# Display photo user IDs when a signature from a key with a photo is
|
|
||||||
# verified
|
|
||||||
|
|
||||||
# verify-options show-photos
|
|
||||||
|
|
||||||
# Use this program to display photo user IDs
|
|
||||||
#
|
|
||||||
# %i is expanded to a temporary file that contains the photo.
|
|
||||||
# %I is the same as %i, but the file isn't deleted afterwards by GnuPG.
|
|
||||||
# %k is expanded to the key ID of the key.
|
|
||||||
# %K is expanded to the long OpenPGP key ID of the key.
|
|
||||||
# %t is expanded to the extension of the image (e.g. "jpg").
|
|
||||||
# %T is expanded to the MIME type of the image (e.g. "image/jpeg").
|
|
||||||
# %f is expanded to the fingerprint of the key.
|
|
||||||
# %% is %, of course.
|
|
||||||
#
|
|
||||||
# If %i or %I are not present, then the photo is supplied to the
|
|
||||||
# viewer on standard input. If your platform supports it, standard
|
|
||||||
# input is the best way to do this as it avoids the time and effort in
|
|
||||||
# generating and then cleaning up a secure temp file.
|
|
||||||
#
|
|
||||||
# If no photo-viewer is provided, GnuPG will look for xloadimage, eog,
|
|
||||||
# or display (ImageMagick). On Mac OS X and Windows, the default is
|
|
||||||
# to use your regular JPEG image viewer.
|
|
||||||
#
|
|
||||||
# Some other viewers:
|
|
||||||
# photo-viewer "qiv %i"
|
|
||||||
# photo-viewer "ee %i"
|
|
||||||
#
|
|
||||||
# This one saves a copy of the photo ID in your home directory:
|
|
||||||
# photo-viewer "cat > ~/photoid-for-key-%k.%t"
|
|
||||||
#
|
|
||||||
# Use your MIME handler to view photos:
|
|
||||||
# photo-viewer "metamail -q -d -b -c %T -s 'KeyID 0x%k' -f GnuPG"
|
|
||||||
|
|
||||||
# Passphrase agent
|
|
||||||
#
|
|
||||||
# We support the old experimental passphrase agent protocol as well as
|
|
||||||
# the new Assuan based one (currently available in the "newpg" package
|
|
||||||
# at ftp.gnupg.org/gcrypt/alpha/aegypten/). To make use of the agent,
|
|
||||||
# you have to run an agent as daemon and use the option
|
|
||||||
#
|
|
||||||
# For Ubuntu we now use-agent by default to support more automatic
|
|
||||||
# use of GPG and S/MIME encryption by GUI programs. Depending on the
|
|
||||||
# program, users may still have to manually decide to install gnupg-agent.
|
|
||||||
|
|
||||||
#use-agent
|
|
||||||
|
|
||||||
# which tries to use the agent but will fallback to the regular mode
|
|
||||||
# if there is a problem connecting to the agent. The normal way to
|
|
||||||
# locate the agent is by looking at the environment variable
|
|
||||||
# GPG_AGENT_INFO which should have been set during gpg-agent startup.
|
|
||||||
# In certain situations the use of this variable is not possible, thus
|
|
||||||
# the option
|
|
||||||
#
|
|
||||||
# --gpg-agent-info=<path>:<pid>:1
|
|
||||||
#
|
|
||||||
# may be used to override it.
|
|
||||||
|
|
||||||
# Automatic key location
|
|
||||||
#
|
|
||||||
# GnuPG can automatically locate and retrieve keys as needed using the
|
|
||||||
# auto-key-locate option. This happens when encrypting to an email
|
|
||||||
# address (in the "user@example.com" form), and there are no
|
|
||||||
# user@example.com keys on the local keyring. This option takes the
|
|
||||||
# following arguments, in the order they are to be tried:
|
|
||||||
#
|
|
||||||
# cert = locate a key using DNS CERT, as specified in RFC-4398.
|
|
||||||
# GnuPG can handle both the PGP (key) and IPGP (URL + fingerprint)
|
|
||||||
# CERT methods.
|
|
||||||
#
|
|
||||||
# pka = locate a key using DNS PKA.
|
|
||||||
#
|
|
||||||
# ldap = locate a key using the PGP Universal method of checking
|
|
||||||
# "ldap://keys.(thedomain)". For example, encrypting to
|
|
||||||
# user@example.com will check ldap://keys.example.com.
|
|
||||||
#
|
|
||||||
# keyserver = locate a key using whatever keyserver is defined using
|
|
||||||
# the keyserver option.
|
|
||||||
#
|
|
||||||
# You may also list arbitrary keyservers here by URL.
|
|
||||||
#
|
|
||||||
# Try CERT, then PKA, then LDAP, then hkp://subkeys.net:
|
|
||||||
#auto-key-locate cert pka ldap hkp://subkeys.pgp.net
|
|
||||||
|
|
||||||
## Begin Anonymity Distribution /home/user/.gnupg/gpg.conf changes.
|
|
||||||
|
|
||||||
#### meta start
|
|
||||||
#### project Whonix
|
|
||||||
#### category networking and apps
|
|
||||||
#### description GnuPG gpg configuration
|
|
||||||
#### meta end
|
|
||||||
|
|
||||||
## source:
|
|
||||||
## https://raw.github.com/ioerror/torbirdy/master/gpg.conf
|
|
||||||
## https://github.com/ioerror/torbirdy/commit/e6d7c9e6e103f0b3289675d04ed3f92e92d8d7b3
|
|
||||||
|
|
||||||
## Out commented proxy settings, because uwt wrapper keeps care of that.
|
|
||||||
|
|
||||||
## gpg.conf optimized for privacy
|
|
||||||
|
|
||||||
##################################################################
|
|
||||||
## BEGIN some suggestions from TorBirdy setting extensions.enigmail.agentAdditionalParam
|
|
||||||
|
|
||||||
## Don't disclose the version
|
|
||||||
no-emit-version
|
|
||||||
|
|
||||||
## Don't add additional comments (may leak language, etc)
|
|
||||||
no-comments
|
|
||||||
|
|
||||||
## We want to force UTF-8 everywhere
|
|
||||||
display-charset utf-8
|
|
||||||
|
|
||||||
## Proxy settings
|
|
||||||
#keyserver-options http-proxy=socks5://TORIP:TORPORT
|
|
||||||
|
|
||||||
## https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f
|
|
||||||
## https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html
|
|
||||||
## https://forums.whonix.org/t/gpg-recv-keys-fails-no-longer-use-keyservers-for-anything/5607
|
|
||||||
#keyserver hkps://keys.openpgp.org
|
|
||||||
|
|
||||||
## END some suggestions from TorBirdy TorBirdy setting extensions.enigmail.agentAdditionalParam
|
|
||||||
##################################################################
|
|
||||||
|
|
||||||
##################################################################
|
|
||||||
## BEGIN Some suggestions from Debian https://keyring.debian.org/creating-key.html
|
|
||||||
|
|
||||||
personal-digest-preferences SHA512
|
|
||||||
cert-digest-algo SHA512
|
|
||||||
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
|
|
||||||
|
|
||||||
## END Some suggestions from Debian https://keyring.debian.org/creating-key.html
|
|
||||||
##################################################################
|
|
||||||
|
|
||||||
##################################################################
|
|
||||||
## BEGIN Some suggestions added from riseup https://we.riseup.net/riseuplabs+paow/openpgp-best-practices
|
|
||||||
|
|
||||||
## When creating a key, individuals may designate a specific keyserver to use to pull their keys from.
|
|
||||||
## The above option will disregard this designation and use the pool, which is useful because (1) it
|
|
||||||
## prevents someone from designating an insecure method for pulling their key and (2) if the server
|
|
||||||
## designated uses hkps, the refresh will fail because the ca-cert will not match, so the keys will
|
|
||||||
## never be refreshed.
|
|
||||||
keyserver-options no-honor-keyserver-url
|
|
||||||
|
|
||||||
## when outputting certificates, view user IDs distinctly from keys:
|
|
||||||
fixed-list-mode
|
|
||||||
|
|
||||||
## long keyids are more collision-resistant than short keyids (it's trivial to make a key with any desired short keyid)
|
|
||||||
keyid-format 0xlong
|
|
||||||
|
|
||||||
## when multiple digests are supported by all recipients, choose the strongest one:
|
|
||||||
## already defined above
|
|
||||||
#personal-digest-preferences SHA512 SHA384 SHA256 SHA224
|
|
||||||
|
|
||||||
## preferences chosen for new keys should prioritize stronger algorithms:
|
|
||||||
## already defined above
|
|
||||||
#default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 BZIP2 ZLIB ZIP Uncompressed
|
|
||||||
|
|
||||||
## If you use a graphical environment (and even if you don't) you should be using an agent:
|
|
||||||
## (similar arguments as https://www.debian-administration.org/users/dkg/weblog/64)
|
|
||||||
use-agent
|
|
||||||
|
|
||||||
## You should always know at a glance which User IDs gpg thinks are legitimately bound to the keys in your keyring:
|
|
||||||
verify-options show-uid-validity
|
|
||||||
list-options show-uid-validity
|
|
||||||
|
|
||||||
## include an unambiguous indicator of which key made a signature:
|
|
||||||
## (see http://thread.gmane.org/gmane.mail.notmuch.general/3721/focus=7234)
|
|
||||||
sig-notation issuer-fpr@notations.openpgp.fifthhorseman.net=%g
|
|
||||||
|
|
||||||
## when making an OpenPGP certification, use a stronger digest than the default SHA1:
|
|
||||||
## already defined above
|
|
||||||
#cert-digest-algo SHA256
|
|
||||||
|
|
||||||
## END Some suggestions added from riseup https://we.riseup.net/riseuplabs+paow/openpgp-best-practices
|
|
||||||
##################################################################
|
|
||||||
|
|
||||||
##################################################################
|
|
||||||
## BEGIN Some suggestions from TorBirdy opt-in's
|
|
||||||
|
|
||||||
## Up to you whether you in comment it (remove the single # in front of
|
|
||||||
## it) or not. Disabled by default, because it causes too much complaints and
|
|
||||||
## confusion.
|
|
||||||
|
|
||||||
## Don't include keyids that may disclose the sender or any other non-obvious keyids
|
|
||||||
#throw-keyids
|
|
||||||
|
|
||||||
## END Some suggestions from TorBirdy opt-in's
|
|
||||||
##################################################################
|
|
||||||
|
|
||||||
## End of Anonymity Distribution /home/user/.gnupg/gpg.conf changes.
|
|
||||||
@ -1,12 +1,7 @@
|
|||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
## Neither of these are needed.
|
user ALL=NOPASSWD: /usr/lib/security-misc/panic-on-oops
|
||||||
#user ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops
|
%sudo ALL=NOPASSWD: /usr/lib/security-misc/panic-on-oops
|
||||||
#%sudo ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops
|
|
||||||
|
|
||||||
## Use a more open umask when executing commands with sudo
|
%sudo ALL=NOPASSWD: /usr/lib/security-misc/echo-path
|
||||||
## Can be overridden on a per-user basis using .[z]profile if desirable
|
|
||||||
## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#umask_hardening
|
|
||||||
Defaults umask_override
|
|
||||||
Defaults umask=0022
|
|
||||||
|
|||||||
6
etc/sysctl.d/coredumps.conf
Normal file
6
etc/sysctl.d/coredumps.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Disables coredumps. This setting may be overwritten by systemd so this may not be useful.
|
||||||
|
## security-misc also disables coredumps in other ways.
|
||||||
|
kernel.core_pattern=|/bin/false
|
||||||
5
etc/sysctl.d/dmesg_restrict.conf
Normal file
5
etc/sysctl.d/dmesg_restrict.conf
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Restricts the kernel log to root only.
|
||||||
|
kernel.dmesg_restrict=1
|
||||||
6
etc/sysctl.d/fs_protected.conf
Normal file
6
etc/sysctl.d/fs_protected.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Makes some data spoofing attacks harder.
|
||||||
|
fs.protected_fifos=2
|
||||||
|
fs.protected_regular=2
|
||||||
6
etc/sysctl.d/harden_bpf.conf
Normal file
6
etc/sysctl.d/harden_bpf.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Hardens the BPF JIT compiler and restricts it to root.
|
||||||
|
kernel.unprivileged_bpf_disabled=1
|
||||||
|
net.core.bpf_jit_harden=2
|
||||||
11
etc/sysctl.d/kexec.conf
Normal file
11
etc/sysctl.d/kexec.conf
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Quote https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html
|
||||||
|
##
|
||||||
|
## kexec_load_disabled:
|
||||||
|
##
|
||||||
|
## A toggle indicating if the kexec_load syscall has been disabled. This value defaults to 0 (false: kexec_load enabled), but can be set to 1 (true: kexec_load disabled). Once true, kexec can no longer be used, and the toggle cannot be set back to false. This allows a kexec image to be loaded before disabling the syscall, allowing a system to set up (and later use) an image without it being altered. Generally used together with the "modules_disabled" sysctl.
|
||||||
|
|
||||||
|
## Disables kexec which can be used to replace the running kernel.
|
||||||
|
kernel.kexec_load_disabled=1
|
||||||
8
etc/sysctl.d/kptr_restrict.conf
Normal file
8
etc/sysctl.d/kptr_restrict.conf
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Hides kernel addresses in various files in /proc.
|
||||||
|
## Kernel addresses can be very useful in certain exploits.
|
||||||
|
##
|
||||||
|
## https://kernsec.org/wiki/index.php/Bug_Classes/Kernel_pointer_leak
|
||||||
|
kernel.kptr_restrict=2
|
||||||
6
etc/sysctl.d/mmap_aslr.conf
Normal file
6
etc/sysctl.d/mmap_aslr.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Improves ASLR effectiveness for mmap.
|
||||||
|
vm.mmap_rnd_bits=32
|
||||||
|
vm.mmap_rnd_compat_bits=16
|
||||||
10
etc/sysctl.d/ptrace_scope.conf
Normal file
10
etc/sysctl.d/ptrace_scope.conf
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Restricts the use of ptrace to root. This might break some programs running under WINE.
|
||||||
|
## A workaround for WINE would be to give the wineserver and wine-preloader ptrace capabilities. This can be done by running:
|
||||||
|
##
|
||||||
|
## sudo apt-get install libcap2-bin
|
||||||
|
## sudo setcap cap_sys_ptrace=eip /usr/bin/wineserver
|
||||||
|
## sudo setcap cap_sys_ptrace=eip /usr/bin/wine-preloader
|
||||||
|
kernel.yama.ptrace_scope=2
|
||||||
5
etc/sysctl.d/suid_dumpable.conf
Normal file
5
etc/sysctl.d/suid_dumpable.conf
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Prevent setuid processes from creating coredumps.
|
||||||
|
fs.suid_dumpable=0
|
||||||
42
etc/sysctl.d/tcp_hardening.conf
Normal file
42
etc/sysctl.d/tcp_hardening.conf
Normal file
@ -0,0 +1,42 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
#### meta start
|
||||||
|
#### project Kicksecure
|
||||||
|
#### category networking and security
|
||||||
|
#### description
|
||||||
|
## TCP/IP stack hardening
|
||||||
|
|
||||||
|
## Protects against time-wait assassination.
|
||||||
|
## It drops RST packets for sockets in the time-wait state.
|
||||||
|
net.ipv4.tcp_rfc1337=1
|
||||||
|
|
||||||
|
## Disables ICMP redirect acceptance.
|
||||||
|
net.ipv4.conf.all.accept_redirects=0
|
||||||
|
net.ipv4.conf.default.accept_redirects=0
|
||||||
|
net.ipv4.conf.all.secure_redirects=0
|
||||||
|
net.ipv4.conf.default.secure_redirects=0
|
||||||
|
net.ipv6.conf.all.accept_redirects=0
|
||||||
|
net.ipv6.conf.default.accept_redirects=0
|
||||||
|
|
||||||
|
## Disables ICMP redirect sending.
|
||||||
|
net.ipv4.conf.all.send_redirects=0
|
||||||
|
net.ipv4.conf.default.send_redirects=0
|
||||||
|
|
||||||
|
## Ignores ICMP requests.
|
||||||
|
net.ipv4.icmp_echo_ignore_all=1
|
||||||
|
|
||||||
|
## Enables TCP syncookies.
|
||||||
|
net.ipv4.tcp_syncookies=1
|
||||||
|
|
||||||
|
## Disable source routing.
|
||||||
|
net.ipv4.conf.all.accept_source_route=0
|
||||||
|
net.ipv4.conf.default.accept_source_route=0
|
||||||
|
|
||||||
|
## Enable reverse path filtering to prevent IP spoofing and
|
||||||
|
## mitigate vulnerabilities such as CVE-2019-14899.
|
||||||
|
## https://forums.whonix.org/t/enable-reverse-path-filtering/8594
|
||||||
|
net.ipv4.conf.default.rp_filter=1
|
||||||
|
net.ipv4.conf.all.rp_filter=1
|
||||||
|
|
||||||
|
#### meta end
|
||||||
8
etc/sysctl.d/tcp_sack.conf
Normal file
8
etc/sysctl.d/tcp_sack.conf
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## Disables SACK as it is commonly exploited and likely not needed.
|
||||||
|
## https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109
|
||||||
|
#net.ipv4.tcp_sack=0
|
||||||
|
#net.ipv4.tcp_dsack=0
|
||||||
|
#net.ipv4.tcp_fack=0
|
||||||
12
etc/sysctl.d/tcp_timestamps.conf
Normal file
12
etc/sysctl.d/tcp_timestamps.conf
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
#### meta start
|
||||||
|
#### project Kicksecure
|
||||||
|
#### category networking and security
|
||||||
|
#### description
|
||||||
|
## disable IPv4 TCP Timestamps
|
||||||
|
|
||||||
|
net.ipv4.tcp_timestamps=0
|
||||||
|
|
||||||
|
#### meta end
|
||||||
@ -1,6 +1,3 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
|
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
|
||||||
## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d
|
## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d
|
||||||
|
|
||||||
|
|||||||
@ -1,6 +1,3 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
|
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
|
||||||
## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d
|
## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d
|
||||||
|
|
||||||
|
|||||||
8
etc/thunderbird/pref/40_security-mic.js
Normal file
8
etc/thunderbird/pref/40_security-mic.js
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
//#### meta start
|
||||||
|
//#### project Whonix and Kicksecure
|
||||||
|
//#### category security and apps
|
||||||
|
//#### description https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
||||||
|
//#### meta end
|
||||||
|
|
||||||
|
// https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
||||||
|
pref("network.IDN_show_punycode", true);
|
||||||
@ -1,59 +0,0 @@
|
|||||||
//#### Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
//#### See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
//#### meta start
|
|
||||||
//#### project Whonix and Kicksecure
|
|
||||||
//#### category security and apps
|
|
||||||
//#### description https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
|
||||||
//#### meta end
|
|
||||||
|
|
||||||
// https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
|
||||||
pref("network.IDN_show_punycode", true);
|
|
||||||
|
|
||||||
// Disable all and any kind of telemetry by default
|
|
||||||
pref("toolkit.telemetry.enabled", false);
|
|
||||||
pref("toolkit.telemetry.unified", false);
|
|
||||||
pref("toolkit.telemetry.shutdownPingSender.enabled", false);
|
|
||||||
pref("toolkit.telemetry.updatePing.enabled", false);
|
|
||||||
pref("toolkit.telemetry.archive.enabled", false);
|
|
||||||
pref("toolkit.telemetry.bhrPing.enabled", false);
|
|
||||||
pref("toolkit.telemetry.firstShutdownPing.enabled", false);
|
|
||||||
pref("toolkit.telemetry.newProfilePing.enabled", false);
|
|
||||||
pref("toolkit.telemetry.server", ""); // Defense in depth
|
|
||||||
pref("toolkit.telemetry.server_owner", ""); // Defense in depth
|
|
||||||
pref("datareporting.healthreport.uploadEnabled", false);
|
|
||||||
pref("datareporting.policy.dataSubmissionEnabled", false);
|
|
||||||
pref("toolkit.telemetry.coverage.opt-out", true); // from Firefox
|
|
||||||
pref("toolkit.coverage.opt-out", true); // from Firefox
|
|
||||||
|
|
||||||
// Disable implicit outbound traffic
|
|
||||||
pref("network.connectivity-service.enabled", false);
|
|
||||||
pref("network.prefetch-next", false);
|
|
||||||
pref("network.dns.disablePrefetch", true);
|
|
||||||
pref("network.predictor.enabled", false);
|
|
||||||
|
|
||||||
// No need to explain the problems with javascript
|
|
||||||
// If you want javascript, use your browser
|
|
||||||
// Thunderbird needs no javascript
|
|
||||||
// pref("javascript.enabled", false); // Will break setting up services that require redirecting to their javascripted webpage for login, like gmail etc. So commented out for now.
|
|
||||||
|
|
||||||
// Disable scripting when viewing pdf files
|
|
||||||
user_pref("pdfjs.enableScripting", false);
|
|
||||||
|
|
||||||
// If you want cookies, use your browser
|
|
||||||
pref("network.cookie.cookieBehavior", 2);
|
|
||||||
|
|
||||||
// Do not send user agent information
|
|
||||||
// For email clients, this is more like a relic of the past
|
|
||||||
// Completely not necessary and just exposes a lot of information about the client
|
|
||||||
// Since v115.0 Thunderbird already minimizes the user agent
|
|
||||||
// But we want it gone for good for no information leak at all
|
|
||||||
// https://hg.mozilla.org/comm-central/rev/cbbbc8d93cd7
|
|
||||||
pref("mailnews.headers.sendUserAgent", false);
|
|
||||||
|
|
||||||
// Normally we send emails after marking them with a time stamp
|
|
||||||
// That includes our local time zone
|
|
||||||
// This option makes our local time zone appear as UTC
|
|
||||||
// And rounds the time stamp to the closes minute
|
|
||||||
// https://hg.mozilla.org/comm-central/rev/98aa0bf2e719
|
|
||||||
pref("mail.sanitize_date_header", true);
|
|
||||||
2
lib/systemd/coredump.conf.d/disable-coredumps.conf
Normal file
2
lib/systemd/coredump.conf.d/disable-coredumps.conf
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
[Coredump]
|
||||||
|
Storage=none
|
||||||
11
lib/systemd/system-preset/50-security-misc.preset
Normal file
11
lib/systemd/system-preset/50-security-misc.preset
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
## https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618
|
||||||
|
disable hide-hardware-info.service
|
||||||
|
|
||||||
|
## Disable for now until development finished / tested.
|
||||||
|
disable permission-hardening.service
|
||||||
|
|
||||||
|
## Disable for now until development finished / tested.
|
||||||
|
disable remount-secure.service
|
||||||
@ -1,10 +1,9 @@
|
|||||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=Hide hardware information to unprivileged users
|
Description=Hide hardware information to unprivileged users
|
||||||
Documentation=https://github.com/Kicksecure/security-misc
|
Documentation=https://github.com/Whonix/security-misc
|
||||||
|
|
||||||
DefaultDependencies=no
|
DefaultDependencies=no
|
||||||
Before=sysinit.target
|
Before=sysinit.target
|
||||||
Requires=local-fs.target
|
Requires=local-fs.target
|
||||||
@ -12,8 +11,7 @@ After=local-fs.target
|
|||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
Type=oneshot
|
Type=oneshot
|
||||||
ExecStart=/usr/libexec/security-misc/hide-hardware-info
|
ExecStart=/usr/lib/security-misc/hide-hardware-info
|
||||||
RemainAfterExit=yes
|
|
||||||
|
|
||||||
[Install]
|
[Install]
|
||||||
WantedBy=sysinit.target
|
WantedBy=sysinit.target
|
||||||
19
lib/systemd/system/permission-hardening.service
Normal file
19
lib/systemd/system/permission-hardening.service
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
[Unit]
|
||||||
|
Description=SUID, SGID, Capability and File Permission Hardening
|
||||||
|
Documentation=https://github.com/Whonix/security-misc
|
||||||
|
|
||||||
|
DefaultDependencies=no
|
||||||
|
Before=sysinit.target
|
||||||
|
Requires=local-fs.target
|
||||||
|
After=local-fs.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
ExecStart=/usr/lib/security-misc/permission-hardening
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=sysinit.target
|
||||||
@ -1,10 +1,9 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=Mounts /proc with hidepid=2
|
Description=Mounts /proc with hidepid=2
|
||||||
Documentation=https://github.com/Kicksecure/security-misc
|
Documentation=https://github.com/Whonix/security-misc
|
||||||
|
|
||||||
DefaultDependencies=no
|
DefaultDependencies=no
|
||||||
Before=sysinit.target
|
Before=sysinit.target
|
||||||
Requires=local-fs.target
|
Requires=local-fs.target
|
||||||
@ -12,8 +11,7 @@ After=local-fs.target
|
|||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
Type=oneshot
|
Type=oneshot
|
||||||
ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2,gid=proc /proc
|
ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
|
||||||
RemainAfterExit=yes
|
|
||||||
|
|
||||||
[Install]
|
[Install]
|
||||||
WantedBy=sysinit.target
|
WantedBy=sysinit.target
|
||||||
21
lib/systemd/system/remount-secure.service
Normal file
21
lib/systemd/system/remount-secure.service
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
|
[Unit]
|
||||||
|
Description=remount /home /tmp /dev/shm /run with nosuid,nodev (default) and noexec (opt-in)
|
||||||
|
Documentation=https://github.com/Whonix/security-misc
|
||||||
|
|
||||||
|
DefaultDependencies=no
|
||||||
|
Before=sysinit.target
|
||||||
|
Requires=local-fs.target
|
||||||
|
After=local-fs.target
|
||||||
|
|
||||||
|
After=qubes-sysinit.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
ExecStart=/usr/lib/security-misc/remount-secure
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=sysinit.target
|
||||||
@ -1,10 +1,9 @@
|
|||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
||||||
## See the file COPYING for copying conditions.
|
## See the file COPYING for copying conditions.
|
||||||
|
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=Removes the System.map files
|
Description=Removes the System.map files
|
||||||
Documentation=https://github.com/Kicksecure/security-misc
|
Documentation=https://github.com/Whonix/security-misc
|
||||||
|
|
||||||
DefaultDependencies=no
|
DefaultDependencies=no
|
||||||
Before=sysinit.target
|
Before=sysinit.target
|
||||||
Requires=local-fs.target
|
Requires=local-fs.target
|
||||||
@ -12,8 +11,7 @@ After=local-fs.target
|
|||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
Type=oneshot
|
Type=oneshot
|
||||||
ExecStart=/usr/libexec/security-misc/remove-system.map
|
ExecStart=/usr/lib/security-misc/remove-system.map
|
||||||
RemainAfterExit=yes
|
|
||||||
|
|
||||||
[Install]
|
[Install]
|
||||||
WantedBy=sysinit.target
|
WantedBy=sysinit.target
|
||||||
2
lib/systemd/system/user@.service.d/sysfs.conf
Normal file
2
lib/systemd/system/user@.service.d/sysfs.conf
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
[Service]
|
||||||
|
SupplementaryGroups=sysfs
|
||||||
@ -3,8 +3,8 @@ Version: @VERSION@
|
|||||||
Release: 1%{?dist}
|
Release: 1%{?dist}
|
||||||
Summary: enhances misc security settings
|
Summary: enhances misc security settings
|
||||||
|
|
||||||
License: AGPL-3+
|
License: GPL-3+-with-additional-terms-1
|
||||||
URL: https://github.com/Kicksecure/security-misc
|
URL: https://github.com/Whonix/security-misc
|
||||||
Source0: %{name}-%{version}.tar.xz
|
Source0: %{name}-%{version}.tar.xz
|
||||||
|
|
||||||
BuildRequires: dpkg-dev
|
BuildRequires: dpkg-dev
|
||||||
@ -13,7 +13,50 @@ Requires: make
|
|||||||
BuildArch: noarch
|
BuildArch: noarch
|
||||||
|
|
||||||
%description
|
%description
|
||||||
See README.
|
The following settings are changed:
|
||||||
|
|
||||||
|
deactivates previews in Dolphin;
|
||||||
|
deactivates previews in Nautilus;
|
||||||
|
deactivates thumbnails in Thunar;
|
||||||
|
deactivates TCP timestamps;
|
||||||
|
deactivates Netfilter's connection tracking helper;
|
||||||
|
|
||||||
|
TCP time stamps (RFC 1323) allow for tracking clock
|
||||||
|
information with millisecond resolution. This may or may not allow an
|
||||||
|
attacker to learn information about the system clock at such
|
||||||
|
a resolution, depending on various issues such as network lag.
|
||||||
|
This information is available to anyone who monitors the network
|
||||||
|
somewhere between the attacked system and the destination server.
|
||||||
|
It may allow an attacker to find out how long a given
|
||||||
|
system has been running, and to distinguish several
|
||||||
|
systems running behind NAT and using the same IP address. It might
|
||||||
|
also allow one to look for clocks that match an expected value to find the
|
||||||
|
public IP used by a user.
|
||||||
|
|
||||||
|
Hence, this package disables this feature by shipping the
|
||||||
|
/etc/sysctl.d/tcp_timestamps.conf configuration file.
|
||||||
|
|
||||||
|
Note that TCP time stamps normally have some usefulness. They are
|
||||||
|
needed for:
|
||||||
|
|
||||||
|
* the TCP protection against wrapped sequence numbers; however, to
|
||||||
|
trigger a wrap, one needs to send roughly 2^32 packets in one
|
||||||
|
minute: as said in RFC 1700, "The current recommended default
|
||||||
|
time to live (TTL) for the Internet Protocol (IP) [45,105] is 64".
|
||||||
|
So, this probably won't be a practical problem in the context
|
||||||
|
of Anonymity Distributions.
|
||||||
|
|
||||||
|
* "Round-Trip Time Measurement", which is only useful when the user
|
||||||
|
manages to saturate their connection. When using Anonymity Distributions,
|
||||||
|
probably the limiting factor for transmission speed is rarely the capacity
|
||||||
|
of the user connection.
|
||||||
|
|
||||||
|
Netfilter's connection tracking helper module increases kernel attack
|
||||||
|
surface by enabling superfluous functionality such as IRC parsing in
|
||||||
|
the kernel. (!)
|
||||||
|
|
||||||
|
Hence, this package disables this feature by shipping the
|
||||||
|
/etc/sysctl.d/nf_conntrack_helper.conf configuration file.
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q
|
%setup -q
|
||||||
@ -29,9 +72,48 @@ make %{?_smp_mflags}
|
|||||||
|
|
||||||
%files
|
%files
|
||||||
%license debian/copyright
|
%license debian/copyright
|
||||||
/etc/*
|
/etc/X11/Xsession.d/50panic_on_oops
|
||||||
/lib/*
|
/etc/X11/Xsession.d/50security-misc
|
||||||
/usr/*
|
/etc/apparmor.d/tunables/home.d/security-misc
|
||||||
|
/etc/apt/apt.conf.d/40sandbox
|
||||||
|
/etc/default/grub.d/40_enable_iommu.cfg
|
||||||
|
/etc/default/grub.d/40_kernel_hardening.cfg
|
||||||
|
/etc/login.defs.security-misc
|
||||||
|
/etc/modprobe.d/30_nf_conntrack_helper_disable.conf
|
||||||
|
/etc/modprobe.d/blacklist-dma.conf
|
||||||
|
/etc/modprobe.d/uncommon-network-protocols.conf
|
||||||
|
/etc/securetty.security-misc
|
||||||
|
/etc/security/limits.d/disable-coredumps.conf
|
||||||
|
/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
|
||||||
|
/etc/sudoers.d/security-misc
|
||||||
|
/etc/sysctl.d/coredumps.conf
|
||||||
|
/etc/sysctl.d/dmesg_restrict.conf
|
||||||
|
/etc/sysctl.d/fs_protected.conf
|
||||||
|
/etc/sysctl.d/harden_bpf.conf
|
||||||
|
/etc/sysctl.d/kexec.conf
|
||||||
|
/etc/sysctl.d/kptr_restrict.conf
|
||||||
|
/etc/sysctl.d/mmap_aslr.conf
|
||||||
|
/etc/sysctl.d/ptrace_scope.conf
|
||||||
|
/etc/sysctl.d/suid_dumpable.conf
|
||||||
|
/etc/sysctl.d/sysrq.conf
|
||||||
|
/etc/sysctl.d/tcp_hardening.conf
|
||||||
|
/etc/sysctl.d/tcp_sack.conf
|
||||||
|
/etc/sysctl.d/tcp_timestamps.conf
|
||||||
|
/etc/systemd/system/emergency.service.d/override.conf
|
||||||
|
/etc/systemd/system/rescue.service.d/override.conf
|
||||||
|
/lib/systemd/coredump.conf.d/disable-coredumps.conf
|
||||||
|
/lib/systemd/system/proc-hidepid.service
|
||||||
|
/lib/systemd/system/remove-system-map.service
|
||||||
|
/usr/lib/security-misc/apt-get-update
|
||||||
|
/usr/lib/security-misc/apt-get-update-sanity-test
|
||||||
|
/usr/lib/security-misc/apt-get-wrapper
|
||||||
|
/usr/lib/security-misc/panic-on-oops
|
||||||
|
/usr/lib/security-misc/remove-system.map
|
||||||
|
/usr/share/glib-2.0/schemas/30_security-misc.gschema.override
|
||||||
|
/usr/share/lintian/overrides/security-misc
|
||||||
|
/usr/share/pam-configs/usergroups
|
||||||
|
/usr/share/pam-configs/wheel
|
||||||
|
/usr/share/security-misc/dolphinrc
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
@CHANGELOG@
|
@CHANGELOG@
|
||||||
|
|||||||
@ -1,10 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
|
|
||||||
|
|
||||||
echo "$0: ALERT: This Bluetooth kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
|
|
||||||
|
|
||||||
echo "$0: ALERT: This CD-ROM/DVD kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
|
|
||||||
|
|
||||||
echo "$0: ALERT: This file system kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
|
|
||||||
|
|
||||||
echo "$0: ALERT: This FireWire (IEEE 1394) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
|
|
||||||
|
|
||||||
echo "$0: ALERT: This framebuffer (fbdev) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
|
|
||||||
|
|
||||||
echo "$0: ALERT: This Global Positioning System (GPS) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
|
|
||||||
|
|
||||||
echo "$0: ALERT: This Intel Management Engine (ME) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
||||||
## See the file COPYING for copying conditions.
|
|
||||||
|
|
||||||
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
|
|
||||||
|
|
||||||
echo "$0: ALERT: This Intel Platform Monitoring Technology (PMT) Telemetry kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user