mirror of
https://github.com/Kicksecure/security-misc.git
synced 2025-04-20 19:45:50 -04:00
Compare commits
No commits in common. "master" and "29.3-1" have entirely different histories.
723
COPYING
723
COPYING
@ -1,668 +1,73 @@
|
||||
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
||||
|
||||
Files: *
|
||||
Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
License: AGPL-3+
|
||||
|
||||
License: AGPL-3+
|
||||
GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
Version 3, 19 November 2007
|
||||
.
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
.
|
||||
Preamble
|
||||
.
|
||||
The GNU Affero General Public License is a free, copyleft license for
|
||||
software and other kinds of works, specifically designed to ensure
|
||||
cooperation with the community in the case of network server software.
|
||||
.
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
our General Public Licenses are intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users.
|
||||
.
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
.
|
||||
Developers that use our General Public Licenses protect your rights
|
||||
with two steps: (1) assert copyright on the software, and (2) offer
|
||||
you this License which gives you legal permission to copy, distribute
|
||||
and/or modify the software.
|
||||
.
|
||||
A secondary benefit of defending all users' freedom is that
|
||||
improvements made in alternate versions of the program, if they
|
||||
receive widespread use, become available for other developers to
|
||||
incorporate. Many developers of free software are heartened and
|
||||
encouraged by the resulting cooperation. However, in the case of
|
||||
software used on network servers, this result may fail to come about.
|
||||
The GNU General Public License permits making a modified version and
|
||||
letting the public access it on a server without ever releasing its
|
||||
source code to the public.
|
||||
.
|
||||
The GNU Affero General Public License is designed specifically to
|
||||
ensure that, in such cases, the modified source code becomes available
|
||||
to the community. It requires the operator of a network server to
|
||||
provide the source code of the modified version running there to the
|
||||
users of that server. Therefore, public use of a modified version, on
|
||||
a publicly accessible server, gives the public access to the source
|
||||
code of the modified version.
|
||||
.
|
||||
An older license, called the Affero General Public License and
|
||||
published by Affero, was designed to accomplish similar goals. This is
|
||||
a different license, not a version of the Affero GPL, but Affero has
|
||||
released a new version of the Affero GPL which permits relicensing under
|
||||
this license.
|
||||
.
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
.
|
||||
TERMS AND CONDITIONS
|
||||
.
|
||||
0. Definitions.
|
||||
.
|
||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
||||
.
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
.
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
.
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
.
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
.
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
.
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
.
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
.
|
||||
1. Source Code.
|
||||
.
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
.
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
.
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
.
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
.
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
.
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
.
|
||||
2. Basic Permissions.
|
||||
.
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
.
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
.
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
.
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
.
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
.
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
.
|
||||
4. Conveying Verbatim Copies.
|
||||
.
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
.
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
.
|
||||
5. Conveying Modified Source Versions.
|
||||
.
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
.
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
.
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
.
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
.
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
.
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
.
|
||||
6. Conveying Non-Source Forms.
|
||||
.
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
.
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
.
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
.
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
.
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
.
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
.
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
.
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
.
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
.
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
.
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
.
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
.
|
||||
7. Additional Terms.
|
||||
.
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
.
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
.
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
.
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
.
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
.
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
.
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
.
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
.
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
.
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
.
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
.
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
.
|
||||
8. Termination.
|
||||
.
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
.
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
.
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
.
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
.
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
.
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
.
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
.
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
.
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
.
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
.
|
||||
11. Patents.
|
||||
.
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
.
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
.
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
.
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
.
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
.
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
.
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
.
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
.
|
||||
12. No Surrender of Others' Freedom.
|
||||
.
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
.
|
||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
||||
.
|
||||
Notwithstanding any other provision of this License, if you modify the
|
||||
Program, your modified version must prominently offer all users
|
||||
interacting with it remotely through a computer network (if your version
|
||||
supports such interaction) an opportunity to receive the Corresponding
|
||||
Source of your version by providing access to the Corresponding Source
|
||||
from a network server at no charge, through some standard or customary
|
||||
means of facilitating copying of software. This Corresponding Source
|
||||
shall include the Corresponding Source for any work covered by version 3
|
||||
of the GNU General Public License that is incorporated pursuant to the
|
||||
following paragraph.
|
||||
.
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the work with which it is combined will remain governed by version
|
||||
3 of the GNU General Public License.
|
||||
.
|
||||
14. Revised Versions of this License.
|
||||
.
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU Affero General Public License from time to time. Such new versions
|
||||
will be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
.
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU Affero General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU Affero General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
.
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU Affero General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
.
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
.
|
||||
15. Disclaimer of Warranty.
|
||||
.
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
Copyright: 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
License: GPL-3+-with-additional-terms-1
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
.
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
.
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
.
|
||||
On Debian systems, the full text of the GNU General Public
|
||||
License version 3 can be found in the file
|
||||
`/usr/share/common-licenses/GPL-3'.
|
||||
.
|
||||
ADDITIONAL TERMS APPLICABLE per GNU GPL version 3 section 7
|
||||
.
|
||||
1. Replacement of Section 15. Section 15 of the GPL shall be deleted in its
|
||||
entirety and replaced with the following:
|
||||
.
|
||||
15. Disclaimer of Warranty.
|
||||
.
|
||||
THE PROGRAM IS PROVIDED WITHOUT ANY WARRANTIES, WHETHER EXPRESSED OR IMPLIED,
|
||||
INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR
|
||||
PURPOSE, NON-INFRINGEMENT, TITLE AND MERCHANTABILITY. THE PROGRAM IS BEING
|
||||
DELIVERED OR MADE AVAILABLE 'AS IS', 'WITH ALL FAULTS' AND WITHOUT WARRANTY OR
|
||||
REPRESENTATION. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||
PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
.
|
||||
16. Limitation of Liability.
|
||||
2. Replacement of Section 16. Section 16 of the GPL shall be deleted in its
|
||||
entirety and replaced with the following:
|
||||
.
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
16. LIMITATION OF LIABILITY.
|
||||
.
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
UNDER NO CIRCUMSTANCES SHALL ANY COPYRIGHT HOLDER OR ITS AFFILIATES, OR ANY
|
||||
OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE
|
||||
LIABLE TO YOU, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, FOR ANY
|
||||
DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, DIRECT, INDIRECT, SPECIAL,
|
||||
INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES ARISING FROM, OUT OF OR IN
|
||||
CONNECTION WITH THE USE OR INABILITY TO USE THE PROGRAM OR OTHER DEALINGS WITH
|
||||
THE PROGRAM(INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED
|
||||
INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE
|
||||
PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), WHETHER OR NOT ANY COPYRIGHT HOLDER
|
||||
OR SUCH OTHER PARTY RECEIVES NOTICE OF ANY SUCH DAMAGES AND WHETHER OR NOT SUCH
|
||||
DAMAGES COULD HAVE BEEN FORESEEN.
|
||||
.
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
3. LEGAL NOTICES; NO TRADEMARK LICENSE; ORIGIN. You must reproduce faithfully
|
||||
all trademark, copyright and other proprietary and legal notices on any copies
|
||||
of the Program or any other required author attributions. This license does not
|
||||
grant you rights to use any copyright holder or any other party's name, logo, or
|
||||
trademarks. Neither the name of the copyright holder or its affiliates, or any
|
||||
other party who modifies and/or conveys the Program may be used to endorse or
|
||||
promote products derived from this software without specific prior written
|
||||
permission. The origin of the Program must not be misrepresented; you must not
|
||||
claim that you wrote the original Program. Altered source versions must be
|
||||
plainly marked as such, and must not be misrepresented as being the original
|
||||
Program.
|
||||
.
|
||||
END OF TERMS AND CONDITIONS
|
||||
.
|
||||
How to Apply These Terms to Your New Programs
|
||||
.
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
.
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
.
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
.
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
.
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
.
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
.
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
.
|
||||
If your software can interact with users remotely through a computer
|
||||
network, you should also make sure that it provides a way for users to
|
||||
get its source. For example, if your program is a web application, its
|
||||
interface could display a "Source" link that leads users to an archive
|
||||
of the code. There are many ways you could offer source, and different
|
||||
solutions will be better for different programs; see section 13 for the
|
||||
specific requirements.
|
||||
.
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU AGPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
4. INDEMNIFICATION. IF YOU CONVEY A COVERED WORK AND AGREE WITH ANY RECIPIENT
|
||||
OF THAT COVERED WORK THAT YOU WILL ASSUME ANY LIABILITY FOR THAT COVERED WORK,
|
||||
YOU HEREBY AGREE TO INDEMNIFY, DEFEND AND HOLD HARMLESS THE OTHER LICENSORS AND
|
||||
AUTHORS OF THAT COVERED WORK FOR ANY DAMAGES, DEMANDS, CLAIMS, LOSSES, CAUSES OF
|
||||
ACTION, LAWSUITS, JUDGMENTS EXPENSES (INCLUDING WITHOUT LIMITATION REASONABLE
|
||||
ATTORNEYS' FEES AND EXPENSES) OR ANY OTHER LIABILITY ARISING FROM, RELATED TO OR
|
||||
IN CONNECTION WITH YOUR ASSUMPTIONS OF LIABILITY.
|
||||
|
||||
674
GPLv3
Normal file
674
GPLv3
Normal file
@ -0,0 +1,674 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 3, 29 June 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU General Public License is a free, copyleft license for
|
||||
software and other kinds of works.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
the GNU General Public License is intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users. We, the Free Software Foundation, use the
|
||||
GNU General Public License for most of our software; it applies also to
|
||||
any other work released this way by its authors. You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to prevent others from denying you
|
||||
these rights or asking you to surrender the rights. Therefore, you have
|
||||
certain responsibilities if you distribute copies of the software, or if
|
||||
you modify it: responsibilities to respect the freedom of others.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must pass on to the recipients the same
|
||||
freedoms that you received. You must make sure that they, too, receive
|
||||
or can get the source code. And you must show them these terms so they
|
||||
know their rights.
|
||||
|
||||
Developers that use the GNU GPL protect your rights with two steps:
|
||||
(1) assert copyright on the software, and (2) offer you this License
|
||||
giving you legal permission to copy, distribute and/or modify it.
|
||||
|
||||
For the developers' and authors' protection, the GPL clearly explains
|
||||
that there is no warranty for this free software. For both users' and
|
||||
authors' sake, the GPL requires that modified versions be marked as
|
||||
changed, so that their problems will not be attributed erroneously to
|
||||
authors of previous versions.
|
||||
|
||||
Some devices are designed to deny users access to install or run
|
||||
modified versions of the software inside them, although the manufacturer
|
||||
can do so. This is fundamentally incompatible with the aim of
|
||||
protecting users' freedom to change the software. The systematic
|
||||
pattern of such abuse occurs in the area of products for individuals to
|
||||
use, which is precisely where it is most unacceptable. Therefore, we
|
||||
have designed this version of the GPL to prohibit the practice for those
|
||||
products. If such problems arise substantially in other domains, we
|
||||
stand ready to extend this provision to those domains in future versions
|
||||
of the GPL, as needed to protect the freedom of users.
|
||||
|
||||
Finally, every program is threatened constantly by software patents.
|
||||
States should not allow patents to restrict development and use of
|
||||
software on general-purpose computers, but in those that do, we wish to
|
||||
avoid the special danger that patents applied to a free program could
|
||||
make it effectively proprietary. To prevent this, the GPL assures that
|
||||
patents cannot be used to render the program non-free.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Use with the GNU Affero General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU Affero General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the special requirements of the GNU Affero General Public License,
|
||||
section 13, concerning interaction through a network will apply to the
|
||||
combination as such.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program does terminal interaction, make it output a short
|
||||
notice like this when it starts in an interactive mode:
|
||||
|
||||
<program> Copyright (C) <year> <name of author>
|
||||
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, your program's commands
|
||||
might be different; for a GUI interface, you would use an "about box".
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU GPL, see
|
||||
<http://www.gnu.org/licenses/>.
|
||||
|
||||
The GNU General Public License does not permit incorporating your program
|
||||
into proprietary programs. If your program is a subroutine library, you
|
||||
may consider it more useful to permit linking proprietary applications with
|
||||
the library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License. But first, please read
|
||||
<http://www.gnu.org/philosophy/why-not-lgpl.html>.
|
||||
@ -1,8 +1,8 @@
|
||||
# Enhances Miscellaneous Security Settings #
|
||||
|
||||
https://github.com/Kicksecure/security-misc/blob/master/README.md
|
||||
https://github.com/Whonix/security-misc/blob/master/README.md
|
||||
|
||||
https://www.kicksecure.com/wiki/Security-misc
|
||||
https://www.whonix.org/wiki/Security-misc
|
||||
|
||||
Discussion:
|
||||
|
||||
|
||||
10
bin/disabled-bluetooth-by-security-misc
Executable file
10
bin/disabled-bluetooth-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This bluetooth kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
10
bin/disabled-cdrom-by-security-misc
Executable file
10
bin/disabled-cdrom-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This CD-ROM kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
10
bin/disabled-filesys-by-security-misc
Executable file
10
bin/disabled-filesys-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This file system kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
10
bin/disabled-firewire-by-security-misc
Executable file
10
bin/disabled-firewire-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This firewire kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
10
bin/disabled-intelme-by-security-misc
Executable file
10
bin/disabled-intelme-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This Intel Management Engine (ME) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
10
bin/disabled-msr-by-security-misc
Executable file
10
bin/disabled-msr-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This CPU MSR kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
10
bin/disabled-netfilesys-by-security-misc
Executable file
10
bin/disabled-netfilesys-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This network file system kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
10
bin/disabled-network-by-security-misc
Executable file
10
bin/disabled-network-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This network protocol kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
10
bin/disabled-thunderbolt-by-security-misc
Executable file
10
bin/disabled-thunderbolt-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This thunderbolt kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
10
bin/disabled-vivid-by-security-misc
Executable file
10
bin/disabled-vivid-by-security-misc
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
|
||||
|
||||
echo "$0: ERROR: This vivid kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
|
||||
|
||||
exit 1
|
||||
6650
changelog.upstream
6650
changelog.upstream
File diff suppressed because it is too large
Load Diff
936
debian/changelog
vendored
936
debian/changelog
vendored
@ -1,939 +1,3 @@
|
||||
security-misc (3:44.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 19 Apr 2025 17:33:56 +0000
|
||||
|
||||
security-misc (3:44.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 15 Apr 2025 20:59:37 +0000
|
||||
|
||||
security-misc (3:44.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 10 Apr 2025 11:38:17 +0000
|
||||
|
||||
security-misc (3:44.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 09 Apr 2025 15:15:59 +0000
|
||||
|
||||
security-misc (3:44.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 08 Apr 2025 14:08:24 +0000
|
||||
|
||||
security-misc (3:44.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 03 Mar 2025 11:00:37 +0000
|
||||
|
||||
security-misc (3:44.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 09 Feb 2025 23:04:36 +0000
|
||||
|
||||
security-misc (3:44.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 31 Jan 2025 19:38:41 +0000
|
||||
|
||||
security-misc (3:44.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 30 Jan 2025 12:58:48 +0000
|
||||
|
||||
security-misc (3:44.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 29 Jan 2025 14:36:41 +0000
|
||||
|
||||
security-misc (3:43.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 23 Jan 2025 16:28:58 +0000
|
||||
|
||||
security-misc (3:43.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 22 Jan 2025 14:11:21 +0000
|
||||
|
||||
security-misc (3:43.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 22 Jan 2025 13:52:29 +0000
|
||||
|
||||
security-misc (3:43.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 20 Jan 2025 11:35:08 +0000
|
||||
|
||||
security-misc (3:43.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 20 Jan 2025 10:11:42 +0000
|
||||
|
||||
security-misc (3:43.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 17 Jan 2025 13:35:27 +0000
|
||||
|
||||
security-misc (3:43.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 15 Jan 2025 15:02:43 +0000
|
||||
|
||||
security-misc (3:43.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 14 Jan 2025 14:32:12 +0000
|
||||
|
||||
security-misc (3:43.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 14 Jan 2025 14:30:58 +0000
|
||||
|
||||
security-misc (3:43.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 14 Jan 2025 14:16:45 +0000
|
||||
|
||||
security-misc (3:42.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 14 Jan 2025 14:07:50 +0000
|
||||
|
||||
security-misc (3:42.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 14 Jan 2025 14:06:50 +0000
|
||||
|
||||
security-misc (3:42.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 14 Jan 2025 13:53:49 +0000
|
||||
|
||||
security-misc (3:42.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 14 Jan 2025 09:26:05 +0000
|
||||
|
||||
security-misc (3:42.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 14 Jan 2025 08:24:05 +0000
|
||||
|
||||
security-misc (3:42.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 12 Jan 2025 11:47:17 +0000
|
||||
|
||||
security-misc (3:42.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 10 Jan 2025 15:34:20 +0000
|
||||
|
||||
security-misc (3:42.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 06 Jan 2025 10:31:40 +0000
|
||||
|
||||
security-misc (3:42.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 31 Dec 2024 18:42:01 +0000
|
||||
|
||||
security-misc (3:42.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 31 Dec 2024 14:09:34 +0000
|
||||
|
||||
security-misc (3:41.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 26 Dec 2024 04:12:02 +0000
|
||||
|
||||
security-misc (3:41.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 24 Dec 2024 05:16:21 +0000
|
||||
|
||||
security-misc (3:41.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 20 Dec 2024 06:01:27 +0000
|
||||
|
||||
security-misc (3:41.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 20 Dec 2024 05:58:24 +0000
|
||||
|
||||
security-misc (3:41.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 20 Dec 2024 05:48:48 +0000
|
||||
|
||||
security-misc (3:41.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 19 Dec 2024 10:58:50 +0000
|
||||
|
||||
security-misc (3:41.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 19 Dec 2024 09:43:26 +0000
|
||||
|
||||
security-misc (3:41.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 19 Dec 2024 06:57:42 +0000
|
||||
|
||||
security-misc (3:41.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 10 Dec 2024 19:19:10 +0000
|
||||
|
||||
security-misc (3:41.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 10 Dec 2024 19:17:10 +0000
|
||||
|
||||
security-misc (3:40.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 25 Nov 2024 21:07:41 +0000
|
||||
|
||||
security-misc (3:40.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 14 Nov 2024 22:24:50 +0000
|
||||
|
||||
security-misc (3:40.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 14 Nov 2024 20:46:26 +0000
|
||||
|
||||
security-misc (3:40.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 12 Nov 2024 09:11:57 +0000
|
||||
|
||||
security-misc (3:40.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 11 Nov 2024 11:07:57 +0000
|
||||
|
||||
security-misc (3:40.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 10 Nov 2024 11:52:42 +0000
|
||||
|
||||
security-misc (3:40.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 30 Oct 2024 09:43:05 +0000
|
||||
|
||||
security-misc (3:40.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 23 Oct 2024 09:56:05 +0000
|
||||
|
||||
security-misc (3:40.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 16 Oct 2024 10:57:20 +0000
|
||||
|
||||
security-misc (3:40.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 08 Oct 2024 11:24:55 +0000
|
||||
|
||||
security-misc (3:39.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 03 Oct 2024 07:22:23 +0000
|
||||
|
||||
security-misc (3:39.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 25 Sep 2024 01:03:42 +0000
|
||||
|
||||
security-misc (3:39.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 14 Sep 2024 02:56:08 +0000
|
||||
|
||||
security-misc (3:39.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 08 Sep 2024 17:41:30 +0000
|
||||
|
||||
security-misc (3:39.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 04 Sep 2024 14:13:15 +0000
|
||||
|
||||
security-misc (3:39.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 29 Aug 2024 09:49:51 +0000
|
||||
|
||||
security-misc (3:39.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 28 Aug 2024 11:01:36 +0000
|
||||
|
||||
security-misc (3:39.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 25 Aug 2024 15:34:54 +0000
|
||||
|
||||
security-misc (3:39.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 25 Aug 2024 14:33:39 +0000
|
||||
|
||||
security-misc (3:39.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 16 Aug 2024 08:38:11 +0000
|
||||
|
||||
security-misc (3:38.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 15 Aug 2024 17:51:18 +0000
|
||||
|
||||
security-misc (3:38.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 06 Aug 2024 14:01:38 +0000
|
||||
|
||||
security-misc (3:38.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 28 Jul 2024 20:50:21 +0000
|
||||
|
||||
security-misc (3:38.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 27 Jul 2024 16:13:34 +0000
|
||||
|
||||
security-misc (3:38.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 26 Jul 2024 15:40:23 +0000
|
||||
|
||||
security-misc (3:38.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 26 Jul 2024 09:40:58 +0000
|
||||
|
||||
security-misc (3:38.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 21 Jul 2024 10:40:13 +0000
|
||||
|
||||
security-misc (3:38.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 20 Jul 2024 17:02:04 +0000
|
||||
|
||||
security-misc (3:38.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 18 Jul 2024 18:05:06 +0000
|
||||
|
||||
security-misc (3:38.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 18 Jul 2024 14:11:35 +0000
|
||||
|
||||
security-misc (3:37.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 18 Jul 2024 14:05:22 +0000
|
||||
|
||||
security-misc (3:37.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 15 Jul 2024 21:18:54 +0000
|
||||
|
||||
security-misc (3:37.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 13 Jul 2024 15:01:15 +0000
|
||||
|
||||
security-misc (3:37.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 11 Jun 2024 12:56:56 +0000
|
||||
|
||||
security-misc (3:37.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 01 Jun 2024 18:13:08 +0000
|
||||
|
||||
security-misc (3:37.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 01 Jun 2024 17:35:04 +0000
|
||||
|
||||
security-misc (3:37.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 28 May 2024 12:04:52 +0000
|
||||
|
||||
security-misc (3:37.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 18 May 2024 20:45:11 +0000
|
||||
|
||||
security-misc (3:37.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 10 May 2024 11:20:36 +0000
|
||||
|
||||
security-misc (3:37.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 12 Apr 2024 06:56:38 +0000
|
||||
|
||||
security-misc (3:36.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 01 Apr 2024 06:56:44 +0000
|
||||
|
||||
security-misc (3:36.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 18 Mar 2024 15:10:10 +0000
|
||||
|
||||
security-misc (3:36.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 11 Mar 2024 15:07:50 +0000
|
||||
|
||||
security-misc (3:36.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 10 Mar 2024 13:19:26 +0000
|
||||
|
||||
security-misc (3:36.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 04 Mar 2024 11:48:30 +0000
|
||||
|
||||
security-misc (3:36.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 26 Feb 2024 13:32:44 +0000
|
||||
|
||||
security-misc (3:36.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 22 Feb 2024 20:08:17 +0000
|
||||
|
||||
security-misc (3:36.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 22 Feb 2024 19:58:00 +0000
|
||||
|
||||
security-misc (3:36.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 22 Feb 2024 16:07:16 +0000
|
||||
|
||||
security-misc (3:36.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 22 Feb 2024 14:52:54 +0000
|
||||
|
||||
security-misc (3:35.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 22 Feb 2024 14:50:05 +0000
|
||||
|
||||
security-misc (3:35.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 03 Feb 2024 18:28:26 +0000
|
||||
|
||||
security-misc (3:35.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 25 Jan 2024 13:59:29 +0000
|
||||
|
||||
security-misc (3:35.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 18 Jan 2024 14:10:50 +0000
|
||||
|
||||
security-misc (3:35.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 17 Jan 2024 19:18:24 +0000
|
||||
|
||||
security-misc (3:35.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 16 Jan 2024 14:26:34 +0000
|
||||
|
||||
security-misc (3:35.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 16 Jan 2024 14:14:18 +0000
|
||||
|
||||
security-misc (3:35.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 16 Jan 2024 13:58:54 +0000
|
||||
|
||||
security-misc (3:35.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 09 Jan 2024 05:52:48 +0000
|
||||
|
||||
security-misc (3:35.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 04 Jan 2024 02:03:26 +0000
|
||||
|
||||
security-misc (3:34.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 02 Jan 2024 14:55:13 +0000
|
||||
|
||||
security-misc (3:34.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 29 Dec 2023 20:15:50 +0000
|
||||
|
||||
security-misc (3:34.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 25 Dec 2023 16:28:09 +0000
|
||||
|
||||
security-misc (3:34.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 22 Dec 2023 16:31:57 +0000
|
||||
|
||||
security-misc (3:34.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 12 Dec 2023 16:51:21 +0000
|
||||
|
||||
security-misc (3:34.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 04 Dec 2023 17:06:45 +0000
|
||||
|
||||
security-misc (3:34.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 20 Nov 2023 13:13:10 +0000
|
||||
|
||||
security-misc (3:34.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 11 Nov 2023 22:29:57 +0000
|
||||
|
||||
security-misc (3:34.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 11 Nov 2023 20:22:34 +0000
|
||||
|
||||
security-misc (3:34.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 06 Nov 2023 22:28:21 +0000
|
||||
|
||||
security-misc (3:33.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 06 Nov 2023 02:13:14 +0000
|
||||
|
||||
security-misc (3:33.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 06 Nov 2023 01:14:33 +0000
|
||||
|
||||
security-misc (3:33.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 05 Nov 2023 23:17:59 +0000
|
||||
|
||||
security-misc (3:33.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 05 Nov 2023 22:43:33 +0000
|
||||
|
||||
security-misc (3:33.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 05 Nov 2023 21:46:18 +0000
|
||||
|
||||
security-misc (3:33.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 05 Nov 2023 21:04:02 +0000
|
||||
|
||||
security-misc (3:33.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 05 Nov 2023 20:58:21 +0000
|
||||
|
||||
security-misc (3:33.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 05 Nov 2023 20:29:38 +0000
|
||||
|
||||
security-misc (3:33.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 05 Nov 2023 20:14:43 +0000
|
||||
|
||||
security-misc (3:33.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 05 Nov 2023 19:56:06 +0000
|
||||
|
||||
security-misc (3:32.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 03 Nov 2023 16:17:24 +0000
|
||||
|
||||
security-misc (3:32.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 03 Nov 2023 16:10:48 +0000
|
||||
|
||||
security-misc (3:32.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 03 Nov 2023 16:06:43 +0000
|
||||
|
||||
security-misc (3:32.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 03 Nov 2023 14:33:02 +0000
|
||||
|
||||
security-misc (3:32.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 03 Nov 2023 13:28:08 +0000
|
||||
|
||||
security-misc (3:32.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 01 Nov 2023 16:26:21 +0000
|
||||
|
||||
security-misc (3:32.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 01 Nov 2023 15:10:36 +0000
|
||||
|
||||
security-misc (3:32.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 27 Oct 2023 00:08:41 +0000
|
||||
|
||||
security-misc (3:32.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 26 Oct 2023 16:23:48 +0000
|
||||
|
||||
security-misc (3:32.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Wed, 25 Oct 2023 21:55:37 +0000
|
||||
|
||||
security-misc (3:31.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Tue, 24 Oct 2023 09:51:11 +0000
|
||||
|
||||
security-misc (3:31.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 23:23:22 +0000
|
||||
|
||||
security-misc (3:31.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 20:54:58 +0000
|
||||
|
||||
security-misc (3:31.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 20:29:08 +0000
|
||||
|
||||
security-misc (3:31.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 20:16:40 +0000
|
||||
|
||||
security-misc (3:31.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 19:44:47 +0000
|
||||
|
||||
security-misc (3:31.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 19:40:59 +0000
|
||||
|
||||
security-misc (3:31.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 19:33:21 +0000
|
||||
|
||||
security-misc (3:31.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 19:28:04 +0000
|
||||
|
||||
security-misc (3:31.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 18:46:42 +0000
|
||||
|
||||
security-misc (3:30.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 18:30:28 +0000
|
||||
|
||||
security-misc (3:30.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 17:31:55 +0000
|
||||
|
||||
security-misc (3:30.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 16:55:41 +0000
|
||||
|
||||
security-misc (3:30.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 15:28:18 +0000
|
||||
|
||||
security-misc (3:30.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 15:13:05 +0000
|
||||
|
||||
security-misc (3:30.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 14:50:30 +0000
|
||||
|
||||
security-misc (3:30.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 14:16:53 +0000
|
||||
|
||||
security-misc (3:30.2-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 14:01:54 +0000
|
||||
|
||||
security-misc (3:30.1-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 12:12:30 +0000
|
||||
|
||||
security-misc (3:30.0-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sun, 22 Oct 2023 11:06:00 +0000
|
||||
|
||||
security-misc (3:29.9-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 21 Oct 2023 18:19:24 +0000
|
||||
|
||||
security-misc (3:29.8-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Sat, 21 Oct 2023 16:34:59 +0000
|
||||
|
||||
security-misc (3:29.7-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Fri, 13 Oct 2023 19:22:58 +0000
|
||||
|
||||
security-misc (3:29.6-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 12 Oct 2023 16:51:37 +0000
|
||||
|
||||
security-misc (3:29.5-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Thu, 12 Oct 2023 14:43:40 +0000
|
||||
|
||||
security-misc (3:29.4-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
-- Patrick Schleizer <adrelanos@whonix.org> Mon, 17 Jul 2023 15:48:35 +0000
|
||||
|
||||
security-misc (3:29.3-1) unstable; urgency=medium
|
||||
|
||||
* New upstream version (local package).
|
||||
|
||||
38
debian/control
vendored
38
debian/control
vendored
@ -1,41 +1,27 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@kicksecure.com>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
Source: security-misc
|
||||
Section: misc
|
||||
Priority: optional
|
||||
Maintainer: Patrick Schleizer <adrelanos@kicksecure.com>
|
||||
Build-Depends: config-package-dev,
|
||||
debhelper (>= 13),
|
||||
debhelper-compat (= 13),
|
||||
dh-apparmor,
|
||||
po-debconf
|
||||
Homepage: https://www.kicksecure.com/wiki/Security-misc
|
||||
Vcs-Browser: https://github.com/Kicksecure/security-misc
|
||||
Vcs-Git: https://github.com/Kicksecure/security-misc.git
|
||||
Maintainer: Patrick Schleizer <adrelanos@whonix.org>
|
||||
Build-Depends: debhelper (>= 13), debhelper-compat (= 13), config-package-dev, dh-apparmor
|
||||
Homepage: https://github.com/Whonix/security-misc
|
||||
Vcs-Browser: https://github.com/Whonix/security-misc
|
||||
Vcs-Git: https://github.com/Whonix/security-misc.git
|
||||
Standards-Version: 4.6.2
|
||||
Rules-Requires-Root: no
|
||||
|
||||
Package: security-misc
|
||||
Architecture: all
|
||||
Depends: adduser,
|
||||
apparmor-profile-dist,
|
||||
dmsetup,
|
||||
helper-scripts,
|
||||
libcap2-bin,
|
||||
libglib2.0-bin,
|
||||
libpam-modules-bin,
|
||||
libpam-runtime,
|
||||
libpam-umask,
|
||||
python3,
|
||||
secure-delete,
|
||||
sudo,
|
||||
${misc:Depends}
|
||||
Replaces: anon-gpg-tweaks, swappiness-lowest, tcp-timestamps-disable
|
||||
Depends: python3, libglib2.0-bin, libpam-runtime, sudo, adduser, libcap2-bin,
|
||||
apparmor-profile-dist, helper-scripts, libpam-modules-bin,
|
||||
secure-delete, dmsetup, ${misc:Depends}
|
||||
Replaces: tcp-timestamps-disable, anon-gpg-tweaks, swappiness-lowest
|
||||
Description: Enhances Miscellaneous Security Settings
|
||||
https://github.com/Kicksecure/security-misc/blob/master/README.md
|
||||
https://github.com/Whonix/security-misc/blob/master/README.md
|
||||
.
|
||||
https://www.kicksecure.com/wiki/Security-misc
|
||||
https://www.whonix.org/wiki/Security-misc
|
||||
.
|
||||
Discussion:
|
||||
.
|
||||
|
||||
723
debian/copyright
vendored
723
debian/copyright
vendored
@ -1,668 +1,73 @@
|
||||
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
||||
|
||||
Files: *
|
||||
Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
License: AGPL-3+
|
||||
|
||||
License: AGPL-3+
|
||||
GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
Version 3, 19 November 2007
|
||||
.
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
.
|
||||
Preamble
|
||||
.
|
||||
The GNU Affero General Public License is a free, copyleft license for
|
||||
software and other kinds of works, specifically designed to ensure
|
||||
cooperation with the community in the case of network server software.
|
||||
.
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
our General Public Licenses are intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users.
|
||||
.
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
.
|
||||
Developers that use our General Public Licenses protect your rights
|
||||
with two steps: (1) assert copyright on the software, and (2) offer
|
||||
you this License which gives you legal permission to copy, distribute
|
||||
and/or modify the software.
|
||||
.
|
||||
A secondary benefit of defending all users' freedom is that
|
||||
improvements made in alternate versions of the program, if they
|
||||
receive widespread use, become available for other developers to
|
||||
incorporate. Many developers of free software are heartened and
|
||||
encouraged by the resulting cooperation. However, in the case of
|
||||
software used on network servers, this result may fail to come about.
|
||||
The GNU General Public License permits making a modified version and
|
||||
letting the public access it on a server without ever releasing its
|
||||
source code to the public.
|
||||
.
|
||||
The GNU Affero General Public License is designed specifically to
|
||||
ensure that, in such cases, the modified source code becomes available
|
||||
to the community. It requires the operator of a network server to
|
||||
provide the source code of the modified version running there to the
|
||||
users of that server. Therefore, public use of a modified version, on
|
||||
a publicly accessible server, gives the public access to the source
|
||||
code of the modified version.
|
||||
.
|
||||
An older license, called the Affero General Public License and
|
||||
published by Affero, was designed to accomplish similar goals. This is
|
||||
a different license, not a version of the Affero GPL, but Affero has
|
||||
released a new version of the Affero GPL which permits relicensing under
|
||||
this license.
|
||||
.
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
.
|
||||
TERMS AND CONDITIONS
|
||||
.
|
||||
0. Definitions.
|
||||
.
|
||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
||||
.
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
.
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
.
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
.
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
.
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
.
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
.
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
.
|
||||
1. Source Code.
|
||||
.
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
.
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
.
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
.
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
.
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
.
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
.
|
||||
2. Basic Permissions.
|
||||
.
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
.
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
.
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
.
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
.
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
.
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
.
|
||||
4. Conveying Verbatim Copies.
|
||||
.
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
.
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
.
|
||||
5. Conveying Modified Source Versions.
|
||||
.
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
.
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
.
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
.
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
.
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
.
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
.
|
||||
6. Conveying Non-Source Forms.
|
||||
.
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
.
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
.
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
.
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
.
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
.
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
.
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
.
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
.
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
.
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
.
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
.
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
.
|
||||
7. Additional Terms.
|
||||
.
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
.
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
.
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
.
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
.
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
.
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
.
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
.
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
.
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
.
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
.
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
.
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
.
|
||||
8. Termination.
|
||||
.
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
.
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
.
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
.
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
.
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
.
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
.
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
.
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
.
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
.
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
.
|
||||
11. Patents.
|
||||
.
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
.
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
.
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
.
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
.
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
.
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
.
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
.
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
.
|
||||
12. No Surrender of Others' Freedom.
|
||||
.
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
.
|
||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
||||
.
|
||||
Notwithstanding any other provision of this License, if you modify the
|
||||
Program, your modified version must prominently offer all users
|
||||
interacting with it remotely through a computer network (if your version
|
||||
supports such interaction) an opportunity to receive the Corresponding
|
||||
Source of your version by providing access to the Corresponding Source
|
||||
from a network server at no charge, through some standard or customary
|
||||
means of facilitating copying of software. This Corresponding Source
|
||||
shall include the Corresponding Source for any work covered by version 3
|
||||
of the GNU General Public License that is incorporated pursuant to the
|
||||
following paragraph.
|
||||
.
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the work with which it is combined will remain governed by version
|
||||
3 of the GNU General Public License.
|
||||
.
|
||||
14. Revised Versions of this License.
|
||||
.
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU Affero General Public License from time to time. Such new versions
|
||||
will be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
.
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU Affero General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU Affero General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
.
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU Affero General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
.
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
.
|
||||
15. Disclaimer of Warranty.
|
||||
.
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
Copyright: 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
License: GPL-3+-with-additional-terms-1
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
.
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
.
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
.
|
||||
On Debian systems, the full text of the GNU General Public
|
||||
License version 3 can be found in the file
|
||||
`/usr/share/common-licenses/GPL-3'.
|
||||
.
|
||||
ADDITIONAL TERMS APPLICABLE per GNU GPL version 3 section 7
|
||||
.
|
||||
1. Replacement of Section 15. Section 15 of the GPL shall be deleted in its
|
||||
entirety and replaced with the following:
|
||||
.
|
||||
15. Disclaimer of Warranty.
|
||||
.
|
||||
THE PROGRAM IS PROVIDED WITHOUT ANY WARRANTIES, WHETHER EXPRESSED OR IMPLIED,
|
||||
INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR
|
||||
PURPOSE, NON-INFRINGEMENT, TITLE AND MERCHANTABILITY. THE PROGRAM IS BEING
|
||||
DELIVERED OR MADE AVAILABLE 'AS IS', 'WITH ALL FAULTS' AND WITHOUT WARRANTY OR
|
||||
REPRESENTATION. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||
PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
.
|
||||
16. Limitation of Liability.
|
||||
2. Replacement of Section 16. Section 16 of the GPL shall be deleted in its
|
||||
entirety and replaced with the following:
|
||||
.
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
16. LIMITATION OF LIABILITY.
|
||||
.
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
UNDER NO CIRCUMSTANCES SHALL ANY COPYRIGHT HOLDER OR ITS AFFILIATES, OR ANY
|
||||
OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE
|
||||
LIABLE TO YOU, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, FOR ANY
|
||||
DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, DIRECT, INDIRECT, SPECIAL,
|
||||
INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES ARISING FROM, OUT OF OR IN
|
||||
CONNECTION WITH THE USE OR INABILITY TO USE THE PROGRAM OR OTHER DEALINGS WITH
|
||||
THE PROGRAM(INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED
|
||||
INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE
|
||||
PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), WHETHER OR NOT ANY COPYRIGHT HOLDER
|
||||
OR SUCH OTHER PARTY RECEIVES NOTICE OF ANY SUCH DAMAGES AND WHETHER OR NOT SUCH
|
||||
DAMAGES COULD HAVE BEEN FORESEEN.
|
||||
.
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
3. LEGAL NOTICES; NO TRADEMARK LICENSE; ORIGIN. You must reproduce faithfully
|
||||
all trademark, copyright and other proprietary and legal notices on any copies
|
||||
of the Program or any other required author attributions. This license does not
|
||||
grant you rights to use any copyright holder or any other party's name, logo, or
|
||||
trademarks. Neither the name of the copyright holder or its affiliates, or any
|
||||
other party who modifies and/or conveys the Program may be used to endorse or
|
||||
promote products derived from this software without specific prior written
|
||||
permission. The origin of the Program must not be misrepresented; you must not
|
||||
claim that you wrote the original Program. Altered source versions must be
|
||||
plainly marked as such, and must not be misrepresented as being the original
|
||||
Program.
|
||||
.
|
||||
END OF TERMS AND CONDITIONS
|
||||
.
|
||||
How to Apply These Terms to Your New Programs
|
||||
.
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
.
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
.
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
.
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
.
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
.
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
.
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
.
|
||||
If your software can interact with users remotely through a computer
|
||||
network, you should also make sure that it provides a way for users to
|
||||
get its source. For example, if your program is a web application, its
|
||||
interface could display a "Source" link that leads users to an archive
|
||||
of the code. There are many ways you could offer source, and different
|
||||
solutions will be better for different programs; see section 13 for the
|
||||
specific requirements.
|
||||
.
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU AGPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
4. INDEMNIFICATION. IF YOU CONVEY A COVERED WORK AND AGREE WITH ANY RECIPIENT
|
||||
OF THAT COVERED WORK THAT YOU WILL ASSUME ANY LIABILITY FOR THAT COVERED WORK,
|
||||
YOU HEREBY AGREE TO INDEMNIFY, DEFEND AND HOLD HARMLESS THE OTHER LICENSORS AND
|
||||
AUTHORS OF THAT COVERED WORK FOR ANY DAMAGES, DEMANDS, CLAIMS, LOSSES, CAUSES OF
|
||||
ACTION, LAWSUITS, JUDGMENTS EXPENSES (INCLUDING WITHOUT LIMITATION REASONABLE
|
||||
ATTORNEYS' FEES AND EXPENSES) OR ANY OTHER LIABILITY ARISING FROM, RELATED TO OR
|
||||
IN CONNECTION WITH YOUR ASSUMPTIONS OF LIABILITY.
|
||||
|
||||
4
debian/make-helper-overrides.bsh
vendored
4
debian/make-helper-overrides.bsh
vendored
@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/24
|
||||
genmkfile_lintian_post_opts+=" --suppress-tags obsolete-command-in-modprobe.d-file --suppress-tags no-complete-debconf-translation"
|
||||
genmkfile_lintian_post_opts+=" --suppress-tags obsolete-command-in-modprobe.d-file"
|
||||
|
||||
1
debian/po/POTFILES.in
vendored
1
debian/po/POTFILES.in
vendored
@ -1 +0,0 @@
|
||||
[type: gettext/rfc822deb] security-misc.templates
|
||||
36
debian/po/templates.pot
vendored
36
debian/po/templates.pot
vendored
@ -1,36 +0,0 @@
|
||||
# SOME DESCRIPTIVE TITLE.
|
||||
# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
|
||||
# This file is distributed under the same license as the security-misc package.
|
||||
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
|
||||
#
|
||||
#, fuzzy
|
||||
msgid ""
|
||||
msgstr ""
|
||||
"Project-Id-Version: security-misc\n"
|
||||
"Report-Msgid-Bugs-To: security-misc@packages.debian.org\n"
|
||||
"POT-Creation-Date: 2025-01-14 09:31-0500\n"
|
||||
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
|
||||
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
|
||||
"Language-Team: LANGUAGE <LL@li.org>\n"
|
||||
"Language: \n"
|
||||
"MIME-Version: 1.0\n"
|
||||
"Content-Type: text/plain; charset=CHARSET\n"
|
||||
"Content-Transfer-Encoding: 8bit\n"
|
||||
|
||||
#. Type: note
|
||||
#. Description
|
||||
#: ../security-misc.templates:1001
|
||||
msgid "Manual intervention may be required for permission-hardener update"
|
||||
msgstr ""
|
||||
|
||||
#. Type: note
|
||||
#. Description
|
||||
#: ../security-misc.templates:1001
|
||||
msgid ""
|
||||
"No need to panic. Nothing is broken. A rare condition has been encountered. "
|
||||
"permission-hardener is being updated to fix a minor bug that caused "
|
||||
"corruption in the permission-hardener state file. If you installed your own "
|
||||
"custom permission-hardener configuration, some manual intervention may be "
|
||||
"required. See: https://www.kicksecure.com/wiki/"
|
||||
"SUID_Disabler_and_Permission_Hardener#fixing_state_files"
|
||||
msgstr ""
|
||||
2
debian/rules
vendored
2
debian/rules
vendored
@ -1,6 +1,6 @@
|
||||
#!/usr/bin/make -f
|
||||
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
#export DH_VERBOSE=1
|
||||
|
||||
190
debian/security-misc.config
vendored
190
debian/security-misc.config
vendored
@ -1,190 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
||||
source /usr/libexec/helper-scripts/pre.bsh
|
||||
fi
|
||||
|
||||
source /usr/share/debconf/confmodule
|
||||
|
||||
set -e
|
||||
|
||||
## Not set by DPKG for '.config' script.
|
||||
DPKG_MAINTSCRIPT_PACKAGE="security-misc"
|
||||
DPKG_MAINTSCRIPT_NAME="config"
|
||||
|
||||
true "
|
||||
#####################################################################
|
||||
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
|
||||
#####################################################################
|
||||
"
|
||||
|
||||
## NOTE: Code duplication.
|
||||
## Copied from: helper-scripts /usr/libexec/helper-scripts/package_installed_check.bsh
|
||||
##
|
||||
## '.config' scripts are run very early. Even 'Pre-Depends: helper-scripts' would be insufficient.
|
||||
## Therefore the code is duplicated here.
|
||||
pkg_installed() {
|
||||
local package_name dpkg_query_output
|
||||
local requested_action status error_state
|
||||
|
||||
package_name="$1"
|
||||
## Cannot use '&>' because it is a bashism.
|
||||
dpkg_query_output="$(dpkg-query --show --showformat='${Status}' "$package_name" 2>/dev/null)" || true
|
||||
## dpkg_query_output Examples:
|
||||
## install ok half-configured
|
||||
## install ok installed
|
||||
|
||||
requested_action=$(printf '%s' "$dpkg_query_output" | awk '{print $1}')
|
||||
status=$(printf '%s' "$dpkg_query_output" | awk '{print $2}')
|
||||
error_state=$(printf '%s' "$dpkg_query_output" | awk '{print $3}')
|
||||
|
||||
if [ "$requested_action" = 'install' ]; then
|
||||
true "$0: INFO: $package_name is installed, ok."
|
||||
return 0
|
||||
fi
|
||||
|
||||
true "$0: INFO: $package_name is not installed, ok."
|
||||
return 1
|
||||
}
|
||||
|
||||
check_migrate_permission_hardener_state() {
|
||||
local pkg_list modified_pkg_data_str custom_hardening_arr config_file
|
||||
|
||||
## If folder /var/lib/permission-hardener (version 1) does not exist, this migration is unneeded.
|
||||
if [ ! -d '/var/lib/permission-hardener' ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
local orig_hardening_arr custom_hardening_arr config_file custom_config_file
|
||||
if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" ]; then
|
||||
return 0
|
||||
fi
|
||||
mkdir --parents '/var/lib/security-misc/do_once'
|
||||
|
||||
orig_hardening_arr=(
|
||||
'/usr/lib/permission-hardener.d/25_default_passwd.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_sudo.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_selinux.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf'
|
||||
'/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf'
|
||||
'/usr/lib/permission-hardener.d/20_user-sysmaint-split.conf'
|
||||
'/usr/lib/permission-hardener.d/30_ping.conf'
|
||||
'/usr/lib/permission-hardener.d/30_default.conf'
|
||||
'/etc/permission-hardener.d/25_default_passwd.conf'
|
||||
'/etc/permission-hardener.d/25_default_sudo.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_chromium.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_dbus.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_firejail.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_fuse.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_mount.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_pam.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_passwd.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_policykit.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_postfix.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_qubes.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_selinux.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_spice.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_ssh.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_sudo.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf'
|
||||
'/etc/permission-hardener.d/25_default_whitelist_virtualbox.conf'
|
||||
'/etc/permission-hardener.d/20_user-sysmaint-split.conf'
|
||||
'/etc/permission-hardener.d/30_ping.conf'
|
||||
'/etc/permission-hardener.d/30_default.conf'
|
||||
)
|
||||
|
||||
pkg_list=( "security-misc" )
|
||||
if pkg_installed user-sysmaint-split ; then
|
||||
pkg_list+=( "user-sysmaint-split" )
|
||||
fi
|
||||
if pkg_installed anon-apps-config ; then
|
||||
pkg_list+=( "anon-apps-config" )
|
||||
fi
|
||||
|
||||
## This will exit non-zero if some of the packages don't exist, but we
|
||||
## don't care. The packages that *are* installed will still be scanned.
|
||||
modified_pkg_data_str="$(dpkg --verify "${pkg_list[@]}")" || true
|
||||
|
||||
## Example modified_pkg_data_str:
|
||||
#modified_pkg_data_str='missing /usr/lib/permission-hardener.d/20_user-sysmaint-split.conf'
|
||||
|
||||
readarray -t custom_hardening_arr < <(awk '/permission-hardener.d/{ print $NF }' <<< "${modified_pkg_data_str}")
|
||||
|
||||
## If the above `dpkg --verify` command doesn't return any permission-hardener
|
||||
## related lines, the array will contain no meaningful info, just a single
|
||||
## blank element at the start. Set the array to be explicitly empty in
|
||||
## this scenario.
|
||||
if [ -z "${custom_hardening_arr[0]}" ]; then
|
||||
custom_hardening_arr=()
|
||||
fi
|
||||
|
||||
for config_file in \
|
||||
/usr/lib/permission-hardener.d/*.conf \
|
||||
/etc/permission-hardener.d/*.conf \
|
||||
/usr/local/etc/permission-hardener.d/*.conf \
|
||||
/etc/permission-hardening.d/*.conf \
|
||||
/usr/local/etc/permission-hardening.d/*.conf
|
||||
do
|
||||
# shellcheck disable=SC2076
|
||||
if ! [[ " ${orig_hardening_arr[*]} " =~ " ${config_file} " ]]; then
|
||||
if [ -f "${config_file}" ]; then
|
||||
custom_hardening_arr+=( "${config_file}" )
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "${#custom_hardening_arr[@]}" != '0' ]; then
|
||||
for custom_config_file in "${custom_hardening_arr[@]}"; do
|
||||
if ! test -e "${custom_config_file}" ; then
|
||||
echo "$0: INFO: Possible missing configuration file found: '${custom_config_file}'"
|
||||
else
|
||||
echo "$0: INFO: Possible custom configuration file found: '${custom_config_file}'"
|
||||
fi
|
||||
done
|
||||
## db_input will return code 30 if the message won't be displayed, which
|
||||
## causes a non-interactive install to error out if you don't use || true
|
||||
db_input critical security-misc/alert-on-permission-hardener-v2-upgrade || true
|
||||
## db_go can return code 30 too in some instances, we don't care here
|
||||
# shellcheck disable=SC2119
|
||||
db_go || true
|
||||
fi
|
||||
|
||||
touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2"
|
||||
}
|
||||
|
||||
check_migrate_permission_hardener_state
|
||||
|
||||
true "INFO: debhelper beginning here."
|
||||
|
||||
#DEBHELPER#
|
||||
|
||||
true "INFO: Done with debhelper."
|
||||
|
||||
true "
|
||||
#####################################################################
|
||||
## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
|
||||
#####################################################################
|
||||
"
|
||||
|
||||
## Explicitly "exit 0", so eventually trapped errors can be ignored.
|
||||
exit 0
|
||||
3
debian/security-misc.displace
vendored
3
debian/security-misc.displace
vendored
@ -1,5 +1,6 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
/etc/securetty.security-misc
|
||||
/etc/security/faillock.conf.security-misc
|
||||
/etc/dkms/framework.conf.security-misc
|
||||
|
||||
3
debian/security-misc.gconf-defaults
vendored
3
debian/security-misc.gconf-defaults
vendored
@ -1,6 +1,3 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
/apps/nautilus/preview_sound never
|
||||
/apps/nautilus/show_icon_text never
|
||||
/apps/nautilus/show-image-thumbnails never
|
||||
|
||||
4
debian/security-misc.install
vendored
4
debian/security-misc.install
vendored
@ -1,8 +1,10 @@
|
||||
## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2020 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## This file was generated using 'genmkfile debinstfile'.
|
||||
|
||||
bin/*
|
||||
etc/*
|
||||
lib/*
|
||||
usr/*
|
||||
var/*
|
||||
|
||||
5
debian/security-misc.links
vendored
5
debian/security-misc.links
vendored
@ -1,5 +0,0 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
/etc/profile.d/30_security-misc.sh /etc/zprofile.d/30_security-misc.zsh
|
||||
/etc/profile.d/30_security-misc.sh /etc/X11/Xsession.d/30_security-misc
|
||||
81
debian/security-misc.maintscript
vendored
81
debian/security-misc.maintscript
vendored
@ -1,8 +1,11 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
rm_conffile /etc/sudoers.d/umask-security-misc
|
||||
|
||||
## https://forums.whonix.org/t/allow-loading-signed-kernel-modules-by-default-disallow-kernel-module-loading-by-default/7880/23
|
||||
rm_conffile /etc/default/grub.d/40_only_allow_signed_modules.cfg
|
||||
|
||||
## https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079
|
||||
rm_conffile /etc/sysctl.d/sysrq.conf
|
||||
|
||||
@ -10,7 +13,7 @@ rm_conffile /etc/sysctl.d/sysrq.conf
|
||||
rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info
|
||||
rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown
|
||||
|
||||
## merged into 3 files /usr/lib/sysctl.d/30_security-misc_kexec-disable.conf, /usr/lib/sysctl.d/30_silent-kernel-printk.conf, and /usr/lib/sysctl.d/990-security-misc.conf
|
||||
## merged into 1 file /etc/sysctl.d/30_security-misc.conf
|
||||
rm_conffile /etc/sysctl.d/fs_protected.conf
|
||||
rm_conffile /etc/sysctl.d/kptr_restrict.conf
|
||||
rm_conffile /etc/sysctl.d/suid_dumpable.conf
|
||||
@ -24,88 +27,16 @@ rm_conffile /etc/sysctl.d/kexec.conf
|
||||
rm_conffile /etc/sysctl.d/tcp_hardening.conf
|
||||
rm_conffile /etc/sysctl.d/tcp_sack.conf
|
||||
|
||||
## merged into 3 files /etc/modprobe.d/30_security-misc_blacklist.conf, 30_security-misc_conntrack.conf, and /etc/modprobe.d/30_security-misc_disable.conf
|
||||
## merged into 1 file /etc/modprobe.d/30_security-misc.conf
|
||||
rm_conffile /etc/modprobe.d/uncommon-network-protocols.conf
|
||||
rm_conffile /etc/modprobe.d/blacklist-bluetooth.conf
|
||||
rm_conffile /etc/modprobe.d/vivid.conf
|
||||
rm_conffile /etc/modprobe.d/blacklist-dma.conf
|
||||
rm_conffile /etc/modprobe.d/msr.conf
|
||||
rm_conffile /etc/modprobe.d/30_nf_conntrack_helper_disable.conf
|
||||
rm_conffile /etc/modprobe.d/30_security-misc.conf
|
||||
|
||||
## renamed to /etc/security/limits.d/30_security-misc.conf
|
||||
rm_conffile /etc/security/limits.d/disable-coredumps.conf
|
||||
|
||||
## moved to separate package ram-wipe
|
||||
rm_conffile /etc/default/grub.d/40_cold_boot_attack_defense.cfg
|
||||
|
||||
rm_conffile /etc/X11/Xsession.d/50panic_on_oops
|
||||
rm_conffile /etc/X11/Xsession.d/50security-misc
|
||||
|
||||
## moved to /usr/lib/sysctl.d
|
||||
rm_conffile /etc/sysctl.d/30_security-misc.conf
|
||||
rm_conffile /etc/sysctl.d/30_silent-kernel-printk.conf
|
||||
rm_conffile /etc/sysctl.d/30_security-misc_kexec-disable.conf
|
||||
|
||||
## moved to /etc/permission-hardener.d
|
||||
rm_conffile /etc/permission-hardening.d/25_default_passwd.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_sudo.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_bubblewrap.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_chromium.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_dbus.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_firejail.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_fuse.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_hardened_malloc.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_mount.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_pam.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_policykit.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_qubes.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_selinux.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_spice.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_ssh.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_sudo.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_unix_chkpwd.conf
|
||||
rm_conffile /etc/permission-hardening.d/25_default_whitelist_virtualbox.conf
|
||||
rm_conffile /etc/permission-hardening.d/30_default.conf
|
||||
|
||||
## moved to /usr/lib/permission-hardener.d
|
||||
rm_conffile /etc/permission-hardener.d/25_default_passwd.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_sudo.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_chromium.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_dbus.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_firejail.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_fuse.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_mount.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_pam.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_policykit.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_postfix.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_qubes.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_selinux.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_spice.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_ssh.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_sudo.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf
|
||||
rm_conffile /etc/permission-hardener.d/25_default_whitelist_virtualbox.conf
|
||||
rm_conffile /etc/permission-hardener.d/30_default.conf
|
||||
|
||||
## merged into 1 file /etc/default/grub.d/40_kernel_hardening.cfg
|
||||
rm_conffile /etc/default/grub.d/40_distrust_bootloader.cfg
|
||||
rm_conffile /etc/default/grub.d/40_distrust_cpu.cfg
|
||||
rm_conffile /etc/default/grub.d/40_enable_iommu.cfg
|
||||
|
||||
## renamed to /etc/default/grub.d/40_remount_secure.cfg
|
||||
rm_conffile /etc/default/grub.d/40_remmount-secure.cfg
|
||||
|
||||
## renamed to /etc/default/grub.d/40_signed_modules.cfg
|
||||
rm_conffile /etc/default/grub.d/40_only_allow_signed_modules.cfg
|
||||
|
||||
## renamed to /etc/default/grub.d/41_quiet_boot.cfg
|
||||
rm_conffile /etc/default/grub.d/41_quiet.cfg
|
||||
|
||||
## moved to usability-misc
|
||||
rm_conffile /etc/dkms/framework.conf.d/30_security-misc.conf
|
||||
|
||||
## renamed to reflect the fact that this uses a whitelist
|
||||
rm_conffile /usr/lib/permission-hardener.d/25_default_passwd.conf
|
||||
|
||||
78
debian/security-misc.postinst
vendored
78
debian/security-misc.postinst
vendored
@ -1,79 +1,20 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
||||
source /usr/libexec/helper-scripts/pre.bsh
|
||||
fi
|
||||
|
||||
## Required since this package uses debconf - this is mandatory even though
|
||||
## the postinst itself does not use debconf commands.
|
||||
source /usr/share/debconf/confmodule
|
||||
|
||||
set -e
|
||||
|
||||
true "
|
||||
#####################################################################
|
||||
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
|
||||
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@
|
||||
#####################################################################
|
||||
"
|
||||
|
||||
permission_hardening_legacy_config_folder() {
|
||||
if ! test -d /etc/permission-hardening.d ; then
|
||||
return 0
|
||||
fi
|
||||
rmdir --verbose --ignore-fail-on-non-empty /etc/permission-hardening.d || true
|
||||
}
|
||||
|
||||
permission_hardening() {
|
||||
echo "Running SUID Disabler and Permission Hardener... See also:"
|
||||
echo "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener"
|
||||
echo "$0: INFO: running: permission-hardener enable"
|
||||
if ! permission-hardener enable ; then
|
||||
echo "$0: ERROR: Permission hardening failed." >&2
|
||||
return 0
|
||||
fi
|
||||
echo "$0: INFO: Permission hardening success."
|
||||
}
|
||||
|
||||
migrate_permission_hardener_state() {
|
||||
local existing_mode_dir new_mode_dir dpkg_statoverride_list
|
||||
## If folder /var/lib/permission-hardener (version 1) does not exist, this migration is unneeded.
|
||||
if [ ! -d '/var/lib/permission-hardener' ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" ]; then
|
||||
return 0
|
||||
fi
|
||||
mkdir --parents '/var/lib/security-misc/do_once'
|
||||
|
||||
existing_mode_dir='/var/lib/permission-hardener-v2/existing_mode'
|
||||
new_mode_dir='/var/lib/permission-hardener-v2/new_mode'
|
||||
|
||||
mkdir --parents "${existing_mode_dir}";
|
||||
mkdir --parents "${new_mode_dir}";
|
||||
|
||||
cp --verbose '/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded' "${existing_mode_dir}/statoverride"
|
||||
cp --verbose '/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded' "${new_mode_dir}/statoverride"
|
||||
|
||||
dpkg_statoverride_list="$(dpkg-statoverride --admindir "${new_mode_dir}" --list)"
|
||||
|
||||
if [ "$(stat --format '%G' /usr/bin/sudo)" = 'sysmaint' ]; then
|
||||
if ! [[ "${dpkg_statoverride_list}" =~ '/usr/bin/sudo' ]]; then
|
||||
dpkg-statoverride --admindir "${new_mode_dir}" --add 'root' 'sysmaint' '4750' '/usr/bin/sudo'
|
||||
fi
|
||||
fi
|
||||
if [ "$(stat --format '%G' /usr/bin/pkexec)" = 'sysmaint' ]; then
|
||||
if ! [[ "${dpkg_statoverride_list}" =~ '/usr/bin/pkexec' ]]; then
|
||||
dpkg-statoverride --admindir "${new_mode_dir}" --add 'root' 'sysmaint' '4750' '/usr/bin/pkexec'
|
||||
fi
|
||||
fi
|
||||
|
||||
touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2"
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
configure)
|
||||
if [ -d /etc/skel/.gnupg ]; then
|
||||
@ -83,22 +24,15 @@ case "$1" in
|
||||
|
||||
## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override
|
||||
glib-compile-schemas /usr/share/glib-2.0/schemas || true
|
||||
|
||||
## state dir for faillock
|
||||
mkdir -p /var/lib/security-misc/faillock
|
||||
|
||||
## migrate permission_hardener state to v2 if applicable
|
||||
migrate_permission_hardener_state
|
||||
;;
|
||||
|
||||
abort-upgrade|abort-remove|abort-deconfigure)
|
||||
;;
|
||||
|
||||
triggered)
|
||||
echo "INFO: triggered $DPKG_MAINTSCRIPT_PACKAGE: '$DPKG_MAINTSCRIPT_PACKAGE' $DPKG_MAINTSCRIPT_PACKAGE DPKG_MAINTSCRIPT_NAME: '$DPKG_MAINTSCRIPT_NAME' $\*: '$*' 2: '$2'"
|
||||
echo "INFO: triggered $DPKG_MAINTSCRIPT_PACKAGE: '$DPKG_MAINTSCRIPT_PACKAGE' $DPKG_MAINTSCRIPT_PACKAGE DPKG_MAINTSCRIPT_NAME: '$DPKG_MAINTSCRIPT_NAME' $\@: '$@' 2: '$2'"
|
||||
/usr/share/security-misc/lkrg/lkrg-virtualbox || true
|
||||
/usr/libexec/security-misc/mmap-rnd-bits || true
|
||||
permission_hardening
|
||||
exit 0
|
||||
;;
|
||||
|
||||
@ -112,8 +46,6 @@ pam-auth-update --package
|
||||
|
||||
/usr/libexec/security-misc/permission-lockdown
|
||||
|
||||
permission_hardening
|
||||
|
||||
## https://phabricator.whonix.org/T377
|
||||
## Debian has no update-grub trigger yet:
|
||||
## https://bugs.debian.org/481542
|
||||
@ -134,11 +66,9 @@ true "INFO: debhelper beginning here."
|
||||
|
||||
true "INFO: Done with debhelper."
|
||||
|
||||
permission_hardening_legacy_config_folder
|
||||
|
||||
true "
|
||||
#####################################################################
|
||||
## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
|
||||
## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@
|
||||
#####################################################################
|
||||
"
|
||||
|
||||
|
||||
2
debian/security-misc.postrm
vendored
2
debian/security-misc.postrm
vendored
@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
||||
|
||||
10
debian/security-misc.preinst
vendored
10
debian/security-misc.preinst
vendored
@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
||||
@ -20,9 +20,6 @@ user_groups_modifications() {
|
||||
addgroup --system sysfs
|
||||
addgroup --system cpuinfo
|
||||
|
||||
## /usr/lib/systemd/system/proc-hidepid.service
|
||||
addgroup --system proc
|
||||
|
||||
## group 'sudo' membership required to use 'su'
|
||||
## /usr/share/pam-configs/wheel-security-misc
|
||||
adduser root sudo
|
||||
@ -47,7 +44,7 @@ user_groups_modifications() {
|
||||
## an "empty" /etc/securetty.
|
||||
## In case a system administrator edits /etc/securetty, there is no need to
|
||||
## block for this to be still blocked by console lockdown. See also:
|
||||
## https://www.kicksecure.com/wiki/Root#Root_Login
|
||||
## https://www.whonix.org/wiki/Root#Root_Login
|
||||
adduser root console
|
||||
}
|
||||
|
||||
@ -98,13 +95,12 @@ sudo_users_check () {
|
||||
## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4
|
||||
echo "$0: ERROR: No user is a member of group 'sudo'. Installation aborted." >&2
|
||||
echo "$0: ERROR: You probably want to run:" >&2
|
||||
echo "$0: NOTE: Replace user 'user' with your actual Linux user account name." >&2
|
||||
echo "" >&2
|
||||
echo "sudo adduser user sudo" >&2
|
||||
echo "sudo adduser user console" >&2
|
||||
echo "" >&2
|
||||
echo "$0: ERROR: See also installation instructions:" >&2
|
||||
echo "https://www.kicksecure.com/wiki/security-misc#install" >&2
|
||||
echo "https://www.whonix.org/wiki/security-misc#install" >&2
|
||||
|
||||
if [ "$SECURITY_MISC_INSTALL" = "force" ]; then
|
||||
output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'."
|
||||
|
||||
2
debian/security-misc.prerm
vendored
2
debian/security-misc.prerm
vendored
@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
|
||||
|
||||
9
debian/security-misc.templates
vendored
9
debian/security-misc.templates
vendored
@ -1,9 +0,0 @@
|
||||
Template: security-misc/alert-on-permission-hardener-v2-upgrade
|
||||
Type: note
|
||||
_Description: Manual intervention may be required for permission-hardener update
|
||||
No need to panic. Nothing is broken. A rare condition has been encountered.
|
||||
permission-hardener is being updated to fix a minor bug that caused
|
||||
corruption in the permission-hardener state file. If you installed your own
|
||||
custom permission-hardener configuration, some manual intervention may be
|
||||
required. See:
|
||||
https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#fixing_state_files
|
||||
33
debian/security-misc.triggers
vendored
33
debian/security-misc.triggers
vendored
@ -1,16 +1,25 @@
|
||||
## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## use noawait
|
||||
## https://github.com/Kicksecure/security-misc/issues/196
|
||||
#### meta start
|
||||
#### project Whonix
|
||||
#### category security
|
||||
#### description
|
||||
|
||||
## Trigger permission hardener when new binaries are being installed.
|
||||
interest-noawait /usr
|
||||
interest-noawait /opt
|
||||
## Trigger 'activate-noawait update-initramfs' also works with both,
|
||||
## initramfs-tools as well as dracut.
|
||||
## - Activate initramfs hook that sets the sysctl values before init is executed.
|
||||
## - dracut module 40sdmem-security-misc
|
||||
activate-noawait update-initramfs
|
||||
|
||||
## Trigger permission hardener when new configuration files are being installed.
|
||||
interest-noawait /usr/lib/permission-hardener.d
|
||||
interest-noawait /etc/permission-hardener.d
|
||||
interest-noawait /usr/local/etc/permission-hardener.d
|
||||
interest-noawait /etc/permission-hardening.d
|
||||
interest-noawait /usr/local/etc/permission-hardening.d
|
||||
## LKRG /usr/share/security-misc/lkrg/lkrg-virtualbox
|
||||
interest-noawait /usr/bin/vboxmanage
|
||||
|
||||
## /usr/libexec/security-misc/mmap-rnd-bits
|
||||
## auto generates:
|
||||
## /etc/sysctl.d/30_security-misc_aslr-mmap.conf
|
||||
## sets:
|
||||
## vm.mmap_rnd_bits
|
||||
interest-noawait /boot
|
||||
|
||||
#### meta end
|
||||
|
||||
3
debian/security-misc.undisplace
vendored
3
debian/security-misc.undisplace
vendored
@ -1,6 +1,5 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
/etc/login.defs.security-misc
|
||||
/usr/bin/pkexec.security-misc
|
||||
/etc/dkms/framework.conf.security-misc
|
||||
|
||||
2
debian/watch
vendored
2
debian/watch
vendored
@ -1,4 +1,4 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
version=4
|
||||
|
||||
8
etc/X11/Xsession.d/50panic_on_oops
Executable file
8
etc/X11/Xsession.d/50panic_on_oops
Executable file
@ -0,0 +1,8 @@
|
||||
#!/bin/sh
|
||||
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
if [ -x /usr/libexec/security-misc/panic-on-oops ]; then
|
||||
sudo --non-interactive /usr/libexec/security-misc/panic-on-oops
|
||||
fi
|
||||
9
etc/X11/Xsession.d/50security-misc
Executable file
9
etc/X11/Xsession.d/50security-misc
Executable file
@ -0,0 +1,9 @@
|
||||
#!/bin/sh
|
||||
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
if [ -z "$XDG_CONFIG_DIRS" ]; then
|
||||
XDG_CONFIG_DIRS=/etc/xdg
|
||||
fi
|
||||
export XDG_CONFIG_DIRS=/usr/share/security-misc/:$XDG_CONFIG_DIRS
|
||||
@ -1,7 +1,7 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
alias /etc/pam.d/common-session -> /etc/pam.d/common-session.security-misc,
|
||||
alias /etc/pam.d/common-session -> /etc/pam.d//etc/pam.d/common-session.security-misc,
|
||||
alias /etc/pam.d/common-session-noninteractive -> /etc/pam.d/common-session-noninteractive.security-misc,
|
||||
alias /etc/login.defs -> /etc/login.defs.security-misc,
|
||||
alias /etc/securetty -> /etc/securetty.security-misc,
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Make "sudo apt-get update" exit non-zero for transient failures.
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702
|
||||
|
||||
@ -1,33 +0,0 @@
|
||||
## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
[General]
|
||||
# How long to stay in pairable mode before going back to non-discoverable
|
||||
# The value is in seconds. Default is 0.
|
||||
# 0 = disable timer, i.e. stay pairable forever
|
||||
PairableTimeout = 30
|
||||
|
||||
# How long to stay in discoverable mode before going back to non-discoverable
|
||||
# The value is in seconds. Default is 180, i.e. 3 minutes.
|
||||
# 0 = disable timer, i.e. stay discoverable forever
|
||||
DiscoverableTimeout = 30
|
||||
|
||||
# Maximum number of controllers allowed to be exposed to the system.
|
||||
# Default=0 (unlimited)
|
||||
MaxControllers=1
|
||||
|
||||
# How long to keep temporary devices around
|
||||
# The value is in seconds. Default is 30.
|
||||
# 0 = disable timer, i.e. never keep temporary devices
|
||||
TemporaryTimeout = 0
|
||||
|
||||
[Policy]
|
||||
# AutoEnable defines option to enable all controllers when they are found.
|
||||
# This includes adapters present on start as well as adapters that are plugged
|
||||
# in later on. Defaults to 'true'.
|
||||
AutoEnable=false
|
||||
|
||||
# network/on: A device will only accept advertising packets from peer
|
||||
# devices that contain private addresses. It may not be compatible with some
|
||||
# legacy devices since it requires the use of RPA(s) all the time.
|
||||
Privacy=network/on
|
||||
@ -1,188 +1,61 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Definitions:
|
||||
## KSPP=yes: compliant with recommendations by the KSPP
|
||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
||||
|
||||
## Enable known mitigations for CPU vulnerabilities.
|
||||
## Note, the mitigations for SSB and Retbleed are not currently mentioned in the first link.
|
||||
## Enables all known mitigations for CPU vulnerabilities.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
|
||||
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647
|
||||
|
||||
## Check for potential updates directly from AMD and Intel.
|
||||
## https://www.amd.com/en/resources/product-security.html
|
||||
## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html
|
||||
## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html
|
||||
|
||||
## Tabular comparison between the utility and functionality of various mitigations.
|
||||
## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/587
|
||||
|
||||
## For complete protection, users must install the latest relevant security microcode update.
|
||||
## BIOS/UEFI updates should only be obtained directly from OEMs and/or motherboard manufacturers.
|
||||
## Note that incorrectly performing system BIOS/UEFI updates can potentially lead to serious functionality issues.
|
||||
## The parameters below only provide (partial) protection at both the kernel and user space level.
|
||||
|
||||
## If using Secure Boot, users must also ensure the Secure Boot Forbidden Signature Database (DBX) is up to date.
|
||||
## The UEFI Revocation List contains signatures of now revoked firmware and software used in booting systems.
|
||||
## If using compatible hardware, the database can be updated directly in user space using fwupd.
|
||||
## Note that incorrectly performing DBX updates can potentially lead to serious functionality issues.
|
||||
## https://uefi.org/revocationlistfile
|
||||
## https://github.com/fwupd/fwupd
|
||||
|
||||
## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT.
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameters.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"
|
||||
|
||||
## Disable SMT as it has been the cause of and amplified numerous CPU exploits.
|
||||
## The only full mitigation of cross-HT attacks is to disable SMT.
|
||||
## Disabling will significantly decrease system performance on multi-threaded tasks.
|
||||
## Note, this setting will prevent re-enabling SMT via the sysfs interface.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
|
||||
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
|
||||
## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter.
|
||||
##
|
||||
## To re-enable SMT:
|
||||
## - Remove "nosmt=force".
|
||||
## - Remove all occurrences of ",nosmt" in this file (note the comma ",").
|
||||
## - Downgrade "l1tf=full,force" protection to "l1tf=flush".
|
||||
## - Regenerate the dracut initramfs and then reboot system.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force"
|
||||
|
||||
## Spectre Side Channels (BTI and BHI):
|
||||
## Unconditionally enable mitigation for Spectre Variant 2 (branch target injection).
|
||||
## Enable mitigation for the Intel branch history injection vulnerability.
|
||||
## Currently affects both AMD and Intel CPUs.
|
||||
## Enable mitigations for Spectre variant 2 (indirect branch speculation).
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on"
|
||||
|
||||
## Speculative Store Bypass (SSB):
|
||||
## Mitigate Spectre Variant 4 by disabling speculative store bypass system-wide.
|
||||
## Unconditionally enable the mitigation for both kernel and userspace.
|
||||
## Currently affects both AMD and Intel CPUs.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/Speculative_Store_Bypass
|
||||
## https://www.suse.com/support/kb/doc/?id=000019189
|
||||
##
|
||||
## Disable Speculative Store Bypass.
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ssbd=force-on"
|
||||
|
||||
## L1 Terminal Fault (L1TF):
|
||||
## Mitigate the vulnerability by disabling L1D flush runtime control and SMT.
|
||||
## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations.
|
||||
## Currently affects Intel CPUs.
|
||||
## Enable mitigations for the L1TF vulnerability through disabling SMT
|
||||
## and L1D flush runtime control.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always"
|
||||
|
||||
## Microarchitectural Data Sampling (MDS):
|
||||
## Mitigate the vulnerability by clearing the CPU buffer cache and disabling SMT.
|
||||
## Currently affects Intel CPUs.
|
||||
## Enable mitigations for the MDS vulnerability through clearing buffer cache
|
||||
## and disabling SMT.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt"
|
||||
|
||||
## TSX Asynchronous Abort (TAA):
|
||||
## Mitigate the vulnerability by disabling TSX.
|
||||
## If TSX is enabled, clear CPU buffer rings on transitions and disable SMT.
|
||||
## Currently affects Intel CPUs.
|
||||
## Patches the TAA vulnerability by disabling TSX and enables mitigations using
|
||||
## TSX Async Abort along with disabling SMT.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off tsx_async_abort=full,nosmt"
|
||||
|
||||
## iTLB Multihit:
|
||||
## Mitigate the vulnerability by marking all huge pages in the EPT as non-executable.
|
||||
## Currently affects Intel CPUs.
|
||||
## Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force"
|
||||
|
||||
## Special Register Buffer Data Sampling (SRBDS):
|
||||
## Mitigation of the vulnerability is only possible via microcode update from Intel.
|
||||
## Currently affects Intel CPUs.
|
||||
## Enables mitigations for SRBDS to prevent MDS attacks on RDRAND and RDSEED instructions.
|
||||
## Only mitigated through microcode updates from Intel.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/special-register-buffer-data-sampling.html
|
||||
## https://access.redhat.com/solutions/5142691
|
||||
|
||||
## L1D Flushing:
|
||||
## Mitigate leaks from the L1D cache on context switches by enabling the prctl() interface.
|
||||
## Currently affects Intel CPUs.
|
||||
## Force disable SMT as it has caused numerous CPU vulnerabilities.
|
||||
## The only full mitigation of cross-HT attacks is to disable SMT.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
|
||||
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force"
|
||||
|
||||
## Enables the prctl interface to prevent leaks from L1D on context switches.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on"
|
||||
|
||||
## Processor MMIO Stale Data:
|
||||
## Mitigate the vulnerabilities by appropriately clearing the CPU buffer and disabling SMT.
|
||||
## Currently affects Intel CPUs.
|
||||
## Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt"
|
||||
|
||||
## Arbitrary Speculative Code Execution with Return Instructions (Retbleed):
|
||||
## Mitigate the vulnerability through CPU-dependent implementation and disable SMT.
|
||||
## Currently affects both AMD Zen 1-2 and Intel CPUs.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/Retbleed
|
||||
## https://comsec.ethz.ch/research/microarch/retbleed/
|
||||
## https://www.suse.com/support/kb/doc/?id=000020693
|
||||
## https://access.redhat.com/solutions/retbleed
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"
|
||||
|
||||
## Cross-Thread Return Address Predictions:
|
||||
## Mitigate the vulnerability for certain KVM hypervisor configurations.
|
||||
## Currently affects AMD Zen 1-2 CPUs.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/cross-thread-rsb.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.mitigate_smt_rsb=1"
|
||||
|
||||
## Speculative Return Stack Overflow (SRSO):
|
||||
## Mitigate the vulnerability by ensuring all RET instructions speculate to a controlled location.
|
||||
## Currently affects AMD Zen 1-4 CPUs.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html
|
||||
##
|
||||
## The default kernel setting will be utilized until provided sufficient evidence to modify.
|
||||
## Using "spec_rstack_overflow=ipbp" may provide stronger security at a greater performance impact.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_rstack_overflow=safe-ret"
|
||||
|
||||
## Gather Data Sampling (GDS):
|
||||
## Mitigate the vulnerability either via microcode update or by disabling AVX.
|
||||
## Note, without a suitable microcode update, this will entirely disable use of the AVX instructions set.
|
||||
## Currently affects Intel CPUs.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/gather_data_sampling.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX gather_data_sampling=force"
|
||||
|
||||
## Register File Data Sampling (RFDS):
|
||||
## Mitigate the vulnerability by appropriately clearing the CPU buffer.
|
||||
## Currently affects Intel Atom CPUs (which encompasses E-cores on hybrid architectures).
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/reg-file-data-sampling.html
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX reg_file_data_sampling=on"
|
||||
|
||||
7
etc/default/grub.d/40_distrust_bootloader.cfg
Normal file
7
etc/default/grub.d/40_distrust_bootloader.cfg
Normal file
@ -0,0 +1,7 @@
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Distrusts the bootloader for initial entropy at boot.
|
||||
##
|
||||
## https://lkml.org/lkml/2022/6/5/271
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_bootloader=off"
|
||||
12
etc/default/grub.d/40_distrust_cpu.cfg
Normal file
12
etc/default/grub.d/40_distrust_cpu.cfg
Normal file
@ -0,0 +1,12 @@
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Distrusts the CPU for initial entropy at boot as it is not possible to
|
||||
## audit, may contain weaknesses or a backdoor.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/RDRAND#Reception
|
||||
## https://twitter.com/pid_eins/status/1149649806056280069
|
||||
## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
||||
## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
||||
## https://lkml.org/lkml/2022/6/5/271
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off"
|
||||
17
etc/default/grub.d/40_enable_iommu.cfg
Normal file
17
etc/default/grub.d/40_enable_iommu.cfg
Normal file
@ -0,0 +1,17 @@
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Enables IOMMU to prevent DMA attacks.
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on amd_iommu=on"
|
||||
|
||||
## Disable the busmaster bit on all PCI bridges during very
|
||||
## early boot to avoid holes in IOMMU.
|
||||
##
|
||||
## https://mjg59.dreamwidth.org/54433.html
|
||||
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma"
|
||||
|
||||
## Enables strict enforcement of IOMMU TLB invalidation so devices will never be able to access stale data contents
|
||||
## https://github.com/torvalds/linux/blob/master/drivers/iommu/Kconfig#L97
|
||||
## Page 11 of https://lenovopress.lenovo.com/lp1467.pdf
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu.passthrough=0 iommu.strict=1"
|
||||
@ -1,329 +1,64 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
kpkg="linux-image-$(dpkg --print-architecture)" || true
|
||||
kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || true
|
||||
#echo "## kver: $kver"
|
||||
|
||||
## Definitions:
|
||||
## KSPP=yes: compliant with recommendations by the KSPP
|
||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
||||
|
||||
## This configuration file is split into 4 sections:
|
||||
## 1. Kernel Space
|
||||
## 2. Direct Memory Access
|
||||
## 3. Entropy
|
||||
## 4. Networking
|
||||
|
||||
## See the documentation below for details on the majority of the selected commands:
|
||||
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
|
||||
## https://wiki.archlinux.org/title/Kernel_parameters#GRUB
|
||||
|
||||
## 1. Kernel Space:
|
||||
##
|
||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#boot-parameters
|
||||
## https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||||
|
||||
## Disable merging of slabs with similar size.
|
||||
## Reduces the risk of triggering heap overflows.
|
||||
## Prevents overwriting objects from merged caches and limits influencing slab cache layout.
|
||||
##
|
||||
## https://www.openwall.com/lists/kernel-hardening/2017/06/19/33
|
||||
## https://www.openwall.com/lists/kernel-hardening/2017/06/20/10
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter and does not set CONFIG_SLAB_MERGE_DEFAULT.
|
||||
##
|
||||
## Disables the merging of slabs of similar sizes.
|
||||
## Sometimes a slab can be used in a vulnerable way which an attacker can exploit.
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge"
|
||||
|
||||
## Enable sanity checks and red zoning of slabs via debugging options to detect corruption.
|
||||
## As a by product of debugging, this will implicitly disabling kernel pointer hashing.
|
||||
## Enabling will therefore leak exact and all kernel memory addresses to root.
|
||||
## Has the potential to cause a noticeable performance decrease.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/mm/slub.html
|
||||
## https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u
|
||||
## https://gitlab.tails.boum.org/tails/tails/-/issues/19613
|
||||
## https://github.com/Kicksecure/security-misc/issues/253
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameters and CONFIG_SLUB_DEBUG.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ"
|
||||
## Enables sanity checks (F) and redzoning (Z).
|
||||
## Disabled due to kernel deciding to implicitly disable kernel pointer hashing
|
||||
## https://github.com/torvalds/linux/commit/792702911f581f7793962fbeb99d5c3a1b28f4c3
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ"
|
||||
|
||||
## Zero memory at allocation time and free time.
|
||||
## Fills newly allocated pages, freed pages, and heap objects with zeros.
|
||||
## Mitigates use-after-free exploits by erasing sensitive information in memory.
|
||||
##
|
||||
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6471384af2a6530696fc0203bafe4de41a23c9ef
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameters, CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y, and CONFIG_INIT_ON_FREE_DEFAULT_ON=y.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_free=1"
|
||||
## Zero memory at allocation and free time.
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1"
|
||||
|
||||
## Enable the kernel page allocator to randomize free lists.
|
||||
## During early boot, the page allocator has predictable FIFO behavior for physical pages.
|
||||
## Limits some data exfiltration and ROP attacks that rely on inferring sensitive data location.
|
||||
## Also improves performance by optimizing memory-side cache utilization.
|
||||
##
|
||||
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e900a918b0984ec8f2eb150b8477a47b75d17692
|
||||
## https://en.wikipedia.org/wiki/Return-oriented_programming#Attacks
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter and CONFIG_SHUFFLE_PAGE_ALLOCATOR=y.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1"
|
||||
|
||||
## Enable kernel page table isolation to harden against kernel ASLR (KASLR) bypasses.
|
||||
## Mitigates the Meltdown CPU vulnerability.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/Kernel_page-table_isolation
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter and CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"
|
||||
|
||||
## Enable randomization of the kernel stack offset on syscall entries.
|
||||
## Hardens against memory corruption attacks due to increased entropy.
|
||||
## Limits attacks relying on deterministic stack addresses or cross-syscall address exposure.
|
||||
##
|
||||
## https://lkml.org/lkml/2019/3/18/246
|
||||
## https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter and CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX randomize_kstack_offset=on"
|
||||
|
||||
## Disable vsyscalls to reduce attack surface as they have been replaced by vDSO.
|
||||
## Vulnerable to ROP attacks as vsyscalls are located at fixed addresses in memory.
|
||||
##
|
||||
## https://lwn.net/Articles/446528/
|
||||
## https://en.wikipedia.org/wiki/VDSO
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter, CONFIG_LEGACY_VSYSCALL_NONE=y and does not set CONFIG_X86_VSYSCALL_EMULATION.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none"
|
||||
|
||||
## Restrict access to debugfs by not registering the file system.
|
||||
## Deactivated since the file system can contain sensitive information.
|
||||
##
|
||||
## https://lkml.org/lkml/2020/7/16/122
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off"
|
||||
|
||||
## Force the kernel to panic on "oopses".
|
||||
## Can sometimes potentially indicate and thwart certain kernel exploitation attempts.
|
||||
## Panics may be due to false-positives such as bad drivers.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/Kernel_panic#Linux
|
||||
## https://en.wikipedia.org/wiki/Linux_kernel_oops
|
||||
## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713
|
||||
##
|
||||
## KSPP=partial
|
||||
## KSPP sets CONFIG_PANIC_ON_OOPS=y, but also requires CONFIG_PANIC_TIMEOUT=-1.
|
||||
##
|
||||
## See /usr/libexec/security-misc/panic-on-oops for implementation.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX oops=panic"
|
||||
|
||||
## Modify machine check exception handler.
|
||||
## Can decide whether the system should panic or not based on the occurrence of an exception.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/arch/x86/x86_64/machinecheck.html
|
||||
## https://www.kernel.org/doc/html/latest/arch/x86/x86_64/boot-options.html#machine-check
|
||||
## Machine check exception handler decides whether the system should panic or not based on the exception that happened.
|
||||
## https://forums.whonix.org/t/kernel-hardening/7296/494
|
||||
##
|
||||
## The default kernel setting will be utilized until provided sufficient evidence to modify.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0"
|
||||
|
||||
## Prevent sensitive kernel information leaks in the console during boot.
|
||||
## Must be used in combination with the kernel.printk sysctl.
|
||||
## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/core-api/printk-basics.html
|
||||
## https://wiki.archlinux.org/title/silent_boot
|
||||
##
|
||||
## See /etc/default/grub.d/41_quiet_boot.cfg for implementation.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX loglevel=0"
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet"
|
||||
## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR.
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on"
|
||||
|
||||
## Enable the kernel "Electric-Fence" sampling-based memory safety error detector.
|
||||
## KFENCE detects heap out-of-bounds access, use-after-free, and invalid-free errors.
|
||||
## Aims to have very low processing overhead at each sampling interval.
|
||||
## Sampling interval is set to occur every 100 milliseconds as per KSPP recommendation.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/dev-tools/kfence.html
|
||||
## https://google.github.io/kernel-sanitizers/KFENCE.html
|
||||
## https://blogs.oracle.com/linux/post/linux-slub-allocator-internals-and-debugging-4
|
||||
## https://lwn.net/Articles/835542/
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter, CONFIG_KFENCE=y, and CONFIG_KFENCE_SAMPLE_INTERVAL=100.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kfence.sample_interval=100"
|
||||
## Vsyscalls are obsolete, are at fixed addresses and are a target for ROP.
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none"
|
||||
|
||||
## Disable 32-bit Virtual Dynamic Shared Object (vDSO) mappings.
|
||||
## Legacy compatibility feature for superseded glibc versions.
|
||||
##
|
||||
## https://lore.kernel.org/lkml/20080409082927.BD59E26F992@magilla.localdomain/T/
|
||||
## https://lists.openwall.net/linux-kernel/2014/03/11/3
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter and does not set CONFIG_COMPAT_VDSO.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0"
|
||||
## Enables page allocator freelist randomization.
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1"
|
||||
|
||||
## Switch (back) to using kCFI as the default Control Flow Integrity (CFI) implementation.
|
||||
## The default implementation is FineIBT as of Linux kernel 6.2.
|
||||
## The Intel-developed IBT (Indirect Branch Tracking) is only used if supported by the CPU.
|
||||
## kCFI is software-only while FineIBT is a hybrid software/hardware implementation.
|
||||
## FineIBT may result in some performance benefits as it only performs checking at destinations.
|
||||
## FineIBT is considered weaker against attacks that can write arbitrary executables into memory.
|
||||
## Upstream hardening work has provided users the ability to disable FineIBT based on requests.
|
||||
## Choice of CFI implementation is highly dependent on user threat model as there are pros/cons to both.
|
||||
## Do not modify from the default setting if unsure of implications.
|
||||
##
|
||||
## https://lore.kernel.org/all/20221027092842.699804264@infradead.org/
|
||||
## https://lore.kernel.org/lkml/202210010918.4918F847C4@keescook/T/#u
|
||||
## https://lore.kernel.org/lkml/202210182217.486CBA50@keescook/T/
|
||||
## https://lore.kernel.org/lkml/202407150933.E1871BE@keescook/
|
||||
## https://isopenbsdsecu.re/mitigations/forward_edge_cfi/
|
||||
## https://docs.kernel.org/next/x86/shstk.html
|
||||
## https://source.android.com/docs/security/test/kcfi
|
||||
## https://lpc.events/event/16/contributions/1315/attachments/1067/2169/cfi.pdf
|
||||
## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/561
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameter.
|
||||
##
|
||||
## TODO: Debian 13 Trixie
|
||||
## Applicable when using Linux kernel >= 6.2 (retained here for future-proofing and completeness).
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cfi=kcfi"
|
||||
## Enables randomisation of the kernel stack offset on syscall entries (introduced in kernel 5.13).
|
||||
## https://lkml.org/lkml/2019/3/18/246
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX randomize_kstack_offset=on"
|
||||
|
||||
## Disable support for x86 processes and syscalls.
|
||||
## Unconditionally disables IA32 emulation to substantially reduce attack surface.
|
||||
## Enables kernel lockdown.
|
||||
##
|
||||
## https://lore.kernel.org/all/20230623111409.3047467-7-nik.borisov@suse.com/
|
||||
## Disabled for now as it enforces module signature verification which breaks
|
||||
## too many things.
|
||||
## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP does not set CONFIG_COMPAT, CONFIG_IA32_EMULATION, CONFIG_X86_X32, CONFIG_X86_X32_ABI, and CONFIG_MODIFY_LDT_SYSCALL.
|
||||
##
|
||||
## TODO: Debian 13 Trixie
|
||||
## Applicable when using Linux kernel >= 6.7 (retained here for future-proofing and completeness).
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0"
|
||||
#if dpkg --compare-versions "${kver}" ge "5.4"; then
|
||||
# GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality"
|
||||
#fi
|
||||
|
||||
## Disable EFI persistent storage feature.
|
||||
## Prevents the kernel from writing crash logs and other persistent data to the EFI variable store.
|
||||
##
|
||||
## https://blogs.oracle.com/linux/post/pstore-linux-kernel-persistent-storage-file-system
|
||||
## https://www.ais.com/understanding-pstore-linux-kernel-persistent-storage-file-system/
|
||||
## https://lwn.net/Articles/434821/
|
||||
## https://manpages.debian.org/testing/systemd/systemd-pstore.service.8.en.html
|
||||
## https://gitlab.tails.boum.org/tails/tails/-/issues/20813
|
||||
## https://github.com/Kicksecure/security-misc/issues/299
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1"
|
||||
|
||||
## 2. Direct Memory Access:
|
||||
##
|
||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks
|
||||
|
||||
## Enable CPU manufacturer-specific IOMMU drivers to mitigate some DMA attacks.
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets CONFIG_INTEL_IOMMU=y, CONFIG_INTEL_IOMMU_DEFAULT_ON=y, CONFIG_INTEL_IOMMU_SVM=y, CONFIG_AMD_IOMMU=y, and CONFIG_AMD_IOMMU_V2=y.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX amd_iommu=force_isolation"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on"
|
||||
|
||||
## Enable and force use of IOMMU translation to protect against some DMA attacks.
|
||||
## Strictly force DMA unmap operations to synchronously invalidate IOMMU hardware TLBs.
|
||||
## Ensures devices will never be able to access stale data contents.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit
|
||||
## https://en.wikipedia.org/wiki/DMA_attack
|
||||
## https://lenovopress.lenovo.com/lp1467.pdf
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets the kernel parameters, CONFIG_IOMMU_SUPPORT=y, CONFIG_IOMMU_DEFAULT_DMA_STRICT=y, and does not set CONFIG_IOMMU_DEFAULT_PASSTHROUGH.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu=force"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu.passthrough=0"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu.strict=1"
|
||||
|
||||
## Clear the busmaster bit on all PCI bridges during the EFI hand-off.
|
||||
## Terminates all existing DMA transactions prior to the kernel's IOMMU setup.
|
||||
## Forces third party PCI devices to then re-set their busmaster bit in order to perform DMA.
|
||||
## Assumes that the motherboard chipset and firmware are not malicious.
|
||||
## May cause complete boot failure on certain hardware with incompatible firmware.
|
||||
##
|
||||
## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
||||
## https://mjg59.dreamwidth.org/54433.html
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets CONFIG_EFI_DISABLE_PCI_DMA=y.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma"
|
||||
|
||||
## 3. Entropy:
|
||||
##
|
||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#rdrand
|
||||
|
||||
## Do not credit the CPU or bootloader seeds as entropy sources at boot.
|
||||
## The RDRAND CPU (RNG) instructions are proprietary and closed-source.
|
||||
## Numerous implementations of RDRAND have a long history of being defective.
|
||||
## The RNG seed passed by the bootloader could also potentially be tampered.
|
||||
## Maximizing the entropy pool at boot is desirable for all cryptographic operations.
|
||||
## These settings ensure additional entropy is obtained from other sources to initialize the RNG.
|
||||
## Note that distrusting these (relatively fast) sources of entropy will increase boot time.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/RDRAND#Reception
|
||||
## https://systemd.io/RANDOM_SEEDS/
|
||||
## https://www.kicksecure.com/wiki/Dev/Entropy#RDRAND
|
||||
## https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/
|
||||
## https://x.com/pid_eins/status/1149649806056280069
|
||||
## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
||||
## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
||||
## https://github.com/NixOS/nixpkgs/pull/165355
|
||||
## https://lkml.org/lkml/2022/6/5/271
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets CONFIG_RANDOM_TRUST_BOOTLOADER=y and CONFIG_RANDOM_TRUST_CPU=y.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_bootloader=off"
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off"
|
||||
|
||||
## Obtain more entropy during boot as the runtime memory allocator is being initialized.
|
||||
## Entropy will be extracted from up to the first 4GB of RAM.
|
||||
## Requires the linux-hardened kernel patch.
|
||||
##
|
||||
## https://www.kicksecure.com/wiki/Hardened-kernel#linux-hardened
|
||||
## https://github.com/anthraxx/linux-hardened/commit/c3e7df1dba1eb8105d6d5143079a6a0ad9e9ebc7
|
||||
## https://github.com/anthraxx/linux-hardened/commit/a04458f97fe1f7e95888c77c0165b646375db9c4
|
||||
## Gather more entropy during boot.
|
||||
##
|
||||
## Requires linux-hardened kernel patch.
|
||||
## https://github.com/anthraxx/linux-hardened
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy"
|
||||
|
||||
## 4. Networking
|
||||
##
|
||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-boot-parameters
|
||||
## Restrict access to debugfs since it can contain a lot of sensitive information.
|
||||
## https://lkml.org/lkml/2020/7/16/122
|
||||
## https://github.com/torvalds/linux/blob/fb1201aececc59990b75ef59fca93ae4aa1e1444/Documentation/admin-guide/kernel-parameters.txt#L835-L848
|
||||
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off"
|
||||
|
||||
## Disable the entire IPv6 stack functionality.
|
||||
## Removes attack surface associated with the IPv6 module.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/networking/ipv6.html
|
||||
## https://wiki.archlinux.org/title/IPv6#Disable_IPv6
|
||||
##
|
||||
## Enabling makes redundant many network hardening sysctl's in /usr/lib/sysctl.d/990-security-misc.conf.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ipv6.disable=1"
|
||||
## Force the kernel to panic on "oopses" (which may be due to false positives)
|
||||
## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713
|
||||
## Implemented differently:
|
||||
## /usr/libexec/security-misc/panic-on-oops
|
||||
## /etc/X11/Xsession.d/50panic_on_oops
|
||||
## /etc/sudoers.d/security-misc
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX oops=panic"
|
||||
|
||||
@ -1,31 +0,0 @@
|
||||
## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Definitions:
|
||||
## KSPP=yes: compliant with recommendations by the KSPP
|
||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
||||
|
||||
## Remount Secure provides enhanced security via mount options:
|
||||
## https://www.kicksecure.com/wiki/Security-misc#Remount_Secure
|
||||
|
||||
## Option A (No Security):
|
||||
## Disable Remount Secure.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=0"
|
||||
|
||||
## Option B (Low Security):
|
||||
## Re-mount with nodev and nosuid only.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1"
|
||||
|
||||
## Option C (Medium Security):
|
||||
## Re-mount with nodev, nosuid, and noexec for most mount points, excluding /home.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=2"
|
||||
|
||||
## Option D (Highest Security):
|
||||
## Re-mount with nodev, nosuid, and noexec for all mount points including /home.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=3"
|
||||
@ -1,37 +0,0 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Definitions:
|
||||
## KSPP=yes: compliant with recommendations by the KSPP
|
||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
||||
|
||||
## Require every kernel module to be signed before being loaded.
|
||||
## Any module that is unsigned or signed with an invalid key cannot be loaded.
|
||||
## This prevents all out-of-tree kernel modules unless signed.
|
||||
## This makes it harder to load a malicious module.
|
||||
##
|
||||
## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/61
|
||||
## https://github.com/dell/dkms/issues/359
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets CONFIG_MODULE_SIG=y, CONFIG_MODULE_SIG_FORCE=y, and CONFIG_MODULE_SIG_ALL=y.
|
||||
##
|
||||
## Not enabled by default yet due to several issues.
|
||||
##
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX module.sig_enforce=1"
|
||||
|
||||
## Enable kernel lockdown to enforce security boundary between user and kernel space.
|
||||
## Confidentiality mode enforces module signature verification.
|
||||
##
|
||||
## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880
|
||||
##
|
||||
## KSPP=yes
|
||||
## KSPP sets CONFIG_SECURITY_LOCKDOWN_LSM=y, CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y, and CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y.
|
||||
##
|
||||
## Not enabled by default yet due to several issues.
|
||||
##
|
||||
#if dpkg --compare-versions "${kver}" ge "5.4"; then
|
||||
# GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality"
|
||||
#fi
|
||||
27
etc/default/grub.d/41_quiet.cfg
Normal file
27
etc/default/grub.d/41_quiet.cfg
Normal file
@ -0,0 +1,27 @@
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Prevent kernel info leaks in console during boot.
|
||||
## https://phabricator.whonix.org/T950
|
||||
|
||||
## LANG=C str_replace is provided by package helper-scripts.
|
||||
|
||||
## The following command actually removed "quiet" from the kernel command line.
|
||||
## If verbosity is desired, the user might want to keep this line.
|
||||
## Remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT because "quiet" must be first.
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | LANG=C str_replace "quiet" "")"
|
||||
|
||||
## If verbosity is desired, the user might want to out-comment the following line.
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT quiet loglevel=0"
|
||||
|
||||
## NOTE:
|
||||
## After editing this file, running:
|
||||
## sudo update-grub
|
||||
## is required.
|
||||
##
|
||||
## If higher verbosity is desired, the user might also want to delete file
|
||||
## /etc/sysctl.d/30_silent-kernel-printk.conf
|
||||
## (or out-comment its settings).
|
||||
##
|
||||
## Alternatively, the user could consider to install the debug-misc package,
|
||||
## which will undo the settings found here.
|
||||
@ -1,35 +0,0 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Definitions:
|
||||
## KSPP=yes: compliant with recommendations by the KSPP
|
||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
||||
|
||||
## Some default configuration files automatically include the "quiet" parameter.
|
||||
## Therefore, first remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT since "quiet" must be first.
|
||||
## str_replace is provided by package helper-scripts.
|
||||
##
|
||||
## https://github.com/Kicksecure/security-misc/pull/233#issuecomment-2228792461
|
||||
##
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | str_replace "quiet" "")"
|
||||
|
||||
## Prevent sensitive kernel information leaks in the console during boot.
|
||||
## Must be used in combination with the kernel.printk sysctl.
|
||||
## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/core-api/printk-basics.html
|
||||
## https://wiki.archlinux.org/title/silent_boot
|
||||
##
|
||||
## For easier debugging, these are not applied to the recovery boot option.
|
||||
## Switch the pair of commands to universally apply parameters to all boot options.
|
||||
##
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT loglevel=0"
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT quiet"
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX loglevel=0"
|
||||
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet"
|
||||
|
||||
## For Increased Log Verbosity:
|
||||
## Adjust (or comment out) the kernel.printk sysctl in /usr/lib/sysctl.d/30_silent-kernel-printk.conf.
|
||||
## Alternatively, installing the debug-misc package will undo these settings.
|
||||
@ -1,21 +0,0 @@
|
||||
## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Definitions:
|
||||
## KSPP=yes: compliant with recommendations by the KSPP
|
||||
## KSPP=partial: partially compliant with recommendations by the KSPP
|
||||
## KSPP=no: not (currently) compliant with recommendations by the KSPP
|
||||
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
|
||||
|
||||
## Disable access to single-user (recovery) mode.
|
||||
##
|
||||
## https://forums.kicksecure.com/t/remove-linux-recovery-mode-boot-option-from-default-grub-boot-menu/727
|
||||
##
|
||||
GRUB_DISABLE_RECOVERY="true"
|
||||
|
||||
## Disable access to Dracut's recovery console.
|
||||
##
|
||||
## https://forums.kicksecure.com/t/harden-dracut-initramfs-generator-by-disabling-recovery-console/724
|
||||
##
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.emergency=halt"
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.shell=0"
|
||||
64
etc/dkms/framework.conf.security-misc
Normal file
64
etc/dkms/framework.conf.security-misc
Normal file
@ -0,0 +1,64 @@
|
||||
## This configuration file modifies the behavior of
|
||||
## DKMS (Dynamic Kernel Module Support) and is sourced
|
||||
## in by DKMS every time it is run.
|
||||
|
||||
## Source Tree Location (default: /usr/src)
|
||||
# source_tree="/usr/src"
|
||||
|
||||
## DKMS Tree Location (default: /var/lib/dkms)
|
||||
# dkms_tree="/var/lib/dkms"
|
||||
|
||||
## Install Tree Location (default: /lib/modules)
|
||||
# install_tree="/lib/modules"
|
||||
|
||||
## tmp Location (default: /tmp)
|
||||
# tmp_location="/tmp"
|
||||
|
||||
## verbosity setting (verbose will be active if you set it to a non-null value)
|
||||
# verbose=""
|
||||
|
||||
## symlink kernel modules (will be active if you set it to a non-null value)
|
||||
## This creates symlinks from the install_tree into the dkms_tree instead of
|
||||
## copying the modules. This preserves some space on the costs of being less
|
||||
## safe.
|
||||
# symlink_modules=""
|
||||
|
||||
## Automatic installation and upgrade for all installed kernels (if set to a
|
||||
## non-null value)
|
||||
# autoinstall_all_kernels=""
|
||||
|
||||
## Script to sign modules during build, script is called with kernel version
|
||||
## and module name
|
||||
# sign_tool="/etc/dkms/sign_helper.sh"
|
||||
|
||||
### BEGIN modifications by package security-misc ###
|
||||
|
||||
## original:
|
||||
## https://github.com/dell/dkms/blob/master/dkms_framework.conf
|
||||
|
||||
## DKMS feature request:
|
||||
## add /etc/dkms/framework.conf.d configuration file drop-in folder
|
||||
## https://github.com/dell/dkms/issues/116
|
||||
|
||||
## Lower parallel compilation jobs to 1 if less than 2 GB RAM to avoid freezing
|
||||
## of virtual machines.
|
||||
##
|
||||
## This does not necessarily belong into security-misc, however likely
|
||||
## security-misc will need to modify /etc/dkms/framework.conf in the future to
|
||||
## enable kernel module signing. See below.
|
||||
##
|
||||
## https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/26
|
||||
ENOUGH_RAM="1950"
|
||||
total_ram="$(free -m | sed -n -e '/^Mem:/s/^[^0-9]*\([0-9]*\) .*/\1/p')"
|
||||
if [ "$total_ram" -ge "$ENOUGH_RAM" ]; then
|
||||
true "INFO: Enough RAM available. Not lowering compilation cores."
|
||||
else
|
||||
true "INFO: Not enough RAM available. Lowering compilation cores to 1."
|
||||
parallel_jobs=1
|
||||
fi
|
||||
|
||||
## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58
|
||||
## https://github.com/dell/dkms/blob/master/sign_helper.sh
|
||||
#sign_tool="/etc/dkms/sign_helper.sh"
|
||||
|
||||
### END modifications by package security-misc ###
|
||||
@ -1,6 +1,3 @@
|
||||
## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
reproducible=yes
|
||||
|
||||
## Debugging.
|
||||
|
||||
@ -1,38 +0,0 @@
|
||||
## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Lines starting with a hash symbol ('#') are comments.
|
||||
## https://github.com/Kicksecure/security-misc/issues/225
|
||||
|
||||
[core]
|
||||
## https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm
|
||||
symlinks = false
|
||||
|
||||
## https://forums.whonix.org/t/git-users-enable-fsck-by-default-for-better-security/2066
|
||||
[transfer]
|
||||
fsckobjects = true
|
||||
[fetch]
|
||||
fsckobjects = true
|
||||
[receive]
|
||||
fsckobjects = true
|
||||
|
||||
## Generally a good idea but too intrusive to enable by default.
|
||||
## Listed here as suggestions what users should put into their ~/.gitconfig
|
||||
## file.
|
||||
|
||||
## Not enabled by default because it requires essential knowledge about OpenPG
|
||||
## and an already existing local signing key. Otherwise would prevent all new
|
||||
## commits.
|
||||
#[commit]
|
||||
# gpgsign = true
|
||||
|
||||
## Not enabled by default because it would break the 'git merge' command for
|
||||
## unsigned commits and require the '--no-verify-signature' command line
|
||||
## option.
|
||||
#[merge]
|
||||
# verifySignatures = true
|
||||
|
||||
## Not enabled by default because it would break for users who are not having
|
||||
## an account at the git server and having added a SSH public key.
|
||||
#[url "ssh://git@github.com/"]
|
||||
# insteadOf = https://github.com/
|
||||
@ -1,4 +1,4 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Disable the /sys whitelist.
|
||||
@ -7,9 +7,6 @@
|
||||
## Disable the /proc/cpuinfo whitelist.
|
||||
#cpuinfo_whitelist=0
|
||||
|
||||
## Disable /sys hardening.
|
||||
#sysfs=0
|
||||
|
||||
## Disable selinux mode.
|
||||
## https://www.kicksecure.com/wiki/Security-misc#selinux
|
||||
## https://www.whonix.org/wiki/Security-misc#selinux
|
||||
#selinux=0
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
set -e
|
||||
@ -18,4 +18,4 @@ prereqs)
|
||||
esac
|
||||
|
||||
. /usr/share/initramfs-tools/hook-functions
|
||||
copy_exec /usr/sbin/sysctl /usr/sbin
|
||||
copy_exec /sbin/sysctl /sbin
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
PREREQ=""
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
if test -x /usr/libexec/security-misc/remove-system.map ; then
|
||||
|
||||
146
etc/modprobe.d/30_security-misc.conf
Normal file
146
etc/modprobe.d/30_security-misc.conf
Normal file
@ -0,0 +1,146 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## See the following links for a community discussion and overview regarding the selections
|
||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989
|
||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules
|
||||
|
||||
## Disable automatic conntrack helper assignment
|
||||
## https://phabricator.whonix.org/T486
|
||||
options nf_conntrack nf_conntrack_helper=0
|
||||
|
||||
## Disable bluetooth to reduce attack surface due to extended history of security vulnerabilities
|
||||
## https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
|
||||
install bluetooth /bin/disabled-bluetooth-by-security-misc
|
||||
install btusb /bin/disabled-bluetooth-by-security-misc
|
||||
|
||||
## Disable thunderbolt and firewire modules to prevent some DMA attacks
|
||||
install thunderbolt /bin/disabled-thunderbolt-by-security-misc
|
||||
install firewire-core /bin/disabled-firewire-by-security-misc
|
||||
install firewire_core /bin/disabled-firewire-by-security-misc
|
||||
install firewire-ohci /bin/disabled-firewire-by-security-misc
|
||||
install firewire_ohci /bin/disabled-firewire-by-security-misc
|
||||
install firewire_sbp2 /bin/disabled-firewire-by-security-misc
|
||||
install firewire-sbp2 /bin/disabled-firewire-by-security-misc
|
||||
install ohci1394 /bin/disabled-firewire-by-security-misc
|
||||
install sbp2 /bin/disabled-firewire-by-security-misc
|
||||
install dv1394 /bin/disabled-firewire-by-security-misc
|
||||
install raw1394 /bin/disabled-firewire-by-security-misc
|
||||
install video1394 /bin/disabled-firewire-by-security-misc
|
||||
|
||||
## Disable CPU MSRs as they can be abused to write to arbitrary memory.
|
||||
## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode
|
||||
install msr /bin/disabled-msr-by-security-misc
|
||||
|
||||
## Disables unneeded network protocols that will likely not be used as these may have unknown vulnerabilties.
|
||||
## Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these.
|
||||
## > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users.
|
||||
## > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record.
|
||||
install dccp /bin/disabled-network-by-security-misc
|
||||
install sctp /bin/disabled-network-by-security-misc
|
||||
install rds /bin/disabled-network-by-security-misc
|
||||
install tipc /bin/disabled-network-by-security-misc
|
||||
install n-hdlc /bin/disabled-network-by-security-misc
|
||||
install ax25 /bin/disabled-network-by-security-misc
|
||||
install netrom /bin/disabled-network-by-security-misc
|
||||
install x25 /bin/disabled-network-by-security-misc
|
||||
install rose /bin/disabled-network-by-security-misc
|
||||
install decnet /bin/disabled-network-by-security-misc
|
||||
install econet /bin/disabled-network-by-security-misc
|
||||
install af_802154 /bin/disabled-network-by-security-misc
|
||||
install ipx /bin/disabled-network-by-security-misc
|
||||
install appletalk /bin/disabled-network-by-security-misc
|
||||
install psnap /bin/disabled-network-by-security-misc
|
||||
install p8023 /bin/disabled-network-by-security-misc
|
||||
install p8022 /bin/disabled-network-by-security-misc
|
||||
install can /bin/disabled-network-by-security-misc
|
||||
install atm /bin/disabled-network-by-security-misc
|
||||
|
||||
## Disable uncommon file systems to reduce attack surface
|
||||
## HFS and HFS+ are legacy Apple filesystems that may be required depending on the EFI parition format
|
||||
install cramfs /bin/disabled-filesys-by-security-misc
|
||||
install freevxfs /bin/disabled-filesys-by-security-misc
|
||||
install jffs2 /bin/disabled-filesys-by-security-misc
|
||||
install hfs /bin/disabled-filesys-by-security-misc
|
||||
install hfsplus /bin/disabled-filesys-by-security-misc
|
||||
install udf /bin/disabled-filesys-by-security-misc
|
||||
|
||||
## Disable uncommon network file systems to reduce attack surface
|
||||
install cifs /bin/disabled-netfilesys-by-security-misc
|
||||
install nfs /bin/disabled-netfilesys-by-security-misc
|
||||
install nfsv3 /bin/disabled-netfilesys-by-security-misc
|
||||
install nfsv4 /bin/disabled-netfilesys-by-security-misc
|
||||
install ksmbd /bin/disabled-netfilesys-by-security-misc
|
||||
install gfs2 /bin/disabled-netfilesys-by-security-misc
|
||||
|
||||
## Disables the vivid kernel module as it's only required for testing and has been the cause of multiple vulnerabilities
|
||||
## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233
|
||||
## https://www.openwall.com/lists/oss-security/2019/11/02/1
|
||||
## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475
|
||||
install vivid /bin/disabled-vivid-by-security-misc
|
||||
|
||||
## Disable Intel Management Engine (ME) interface with the OS
|
||||
## https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html
|
||||
install mei /bin/disabled-intelme-by-security-misc
|
||||
install mei-me /bin/disabled-intelme-by-security-misc
|
||||
|
||||
## Blacklist automatic loading of the Atheros 5K RF MACs madwifi driver
|
||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-ath_pci.conf?h=ubuntu/disco
|
||||
blacklist ath_pci
|
||||
|
||||
## Blacklist automatic loading of miscellaneous modules
|
||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco
|
||||
blacklist evbug
|
||||
blacklist usbmouse
|
||||
blacklist usbkbd
|
||||
blacklist eepro100
|
||||
blacklist de4x5
|
||||
blacklist eth1394
|
||||
blacklist snd_intel8x0m
|
||||
blacklist snd_aw2
|
||||
blacklist prism54
|
||||
blacklist bcm43xx
|
||||
blacklist garmin_gps
|
||||
blacklist asus_acpi
|
||||
blacklist snd_pcsp
|
||||
blacklist pcspkr
|
||||
blacklist amd76x_edac
|
||||
|
||||
## Blacklist automatic loading of framebuffer drivers
|
||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco
|
||||
blacklist aty128fb
|
||||
blacklist atyfb
|
||||
blacklist radeonfb
|
||||
blacklist cirrusfb
|
||||
blacklist cyber2000fb
|
||||
blacklist cyblafb
|
||||
blacklist gx1fb
|
||||
blacklist hgafb
|
||||
blacklist i810fb
|
||||
blacklist intelfb
|
||||
blacklist kyrofb
|
||||
blacklist lxfb
|
||||
blacklist matroxfb_bases
|
||||
blacklist neofb
|
||||
blacklist nvidiafb
|
||||
blacklist pm2fb
|
||||
blacklist rivafb
|
||||
blacklist s1d13xxxfb
|
||||
blacklist savagefb
|
||||
blacklist sisfb
|
||||
blacklist sstfb
|
||||
blacklist tdfxfb
|
||||
blacklist tridentfb
|
||||
blacklist vesafb
|
||||
blacklist vfb
|
||||
blacklist viafb
|
||||
blacklist vt8623fb
|
||||
blacklist udlfb
|
||||
|
||||
## Disable CD-ROM devices
|
||||
## https://nvd.nist.gov/vuln/detail/CVE-2018-11506
|
||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31
|
||||
#install cdrom /bin/disabled-cdrom-by-security-misc
|
||||
#install sr_mod /bin/disabled-cdrom-by-security-misc
|
||||
blacklist cdrom
|
||||
blacklist sr_mod
|
||||
@ -1,63 +0,0 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## See the following links for a community discussion and overview regarding the selections.
|
||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989
|
||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules
|
||||
|
||||
## Blacklisting prevents kernel modules from automatically starting.
|
||||
## Disabling prohibits kernel modules from starting.
|
||||
|
||||
## CD-ROM/DVD:
|
||||
## Blacklist CD-ROM and DVD modules.
|
||||
## Do not disable by default for potential future ISO plans.
|
||||
##
|
||||
## https://nvd.nist.gov/vuln/detail/CVE-2018-11506
|
||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31
|
||||
##
|
||||
blacklist cdrom
|
||||
blacklist sr_mod
|
||||
##
|
||||
#install cdrom /usr/bin/disabled-cdrom-by-security-misc
|
||||
#install sr_mod /usr/bin/disabled-cdrom-by-security-misc
|
||||
|
||||
## Miscellaneous:
|
||||
|
||||
## GrapheneOS:
|
||||
## Partial selection of their infrastructure blacklist.
|
||||
## Duplicate and already disabled modules have been omitted.
|
||||
##
|
||||
## https://github.com/GrapheneOS/infrastructure/blob/main/modprobe.d/local.conf
|
||||
##
|
||||
#blacklist cfg80211
|
||||
#blacklist intel_agp
|
||||
#blacklist ip_tables
|
||||
blacklist joydev
|
||||
#blacklist mousedev
|
||||
#blacklist psmouse
|
||||
## TODO: Re-check in Debian trixie
|
||||
## In GrapheneOS list, yes, "should" be out-commented here.
|
||||
## But not actually out-commented.
|
||||
## Breaks VirtualBox audio device ICH AC97, which is unfortunately still required by some users.
|
||||
## https://www.kicksecure.com/wiki/Dev/audio
|
||||
## https://github.com/Kicksecure/security-misc/issues/271
|
||||
#blacklist snd_intel8x0
|
||||
#blacklist tls
|
||||
#blacklist virtio_balloon
|
||||
#blacklist virtio_console
|
||||
|
||||
## Ubuntu:
|
||||
## Already disabled modules have been omitted.
|
||||
##
|
||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco
|
||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-ath_pci.conf?h=ubuntu/disco
|
||||
##
|
||||
blacklist amd76x_edac
|
||||
blacklist ath_pci
|
||||
blacklist evbug
|
||||
blacklist pcspkr
|
||||
blacklist snd_aw2
|
||||
blacklist snd_intel8x0m
|
||||
blacklist snd_pcsp
|
||||
blacklist usbkbd
|
||||
blacklist usbmouse
|
||||
@ -1,11 +0,0 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Conntrack:
|
||||
## Disable Netfilter's automatic connection tracking helper assignment.
|
||||
## Increases kernel attack surface by enabling superfluous functionality such as IRC parsing in the kernel.
|
||||
##
|
||||
## https://conntrack-tools.netfilter.org/manual.html
|
||||
## https://forums.whonix.org/t/disable-conntrack-helper/18917
|
||||
##
|
||||
options nf_conntrack nf_conntrack_helper=0
|
||||
@ -1,310 +0,0 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## See the following links for a community discussion and overview regarding the selections.
|
||||
## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989
|
||||
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules
|
||||
|
||||
## Blacklisting prevents kernel modules from automatically starting.
|
||||
## Disabling prohibits kernel modules from starting.
|
||||
|
||||
## This configuration file is split into 4 sections:
|
||||
## 1. Hardware
|
||||
## 2. File Systems
|
||||
## 3. Networking
|
||||
## 4. Miscellaneous
|
||||
|
||||
## 1. Hardware:
|
||||
|
||||
## Bluetooth:
|
||||
## Disable Bluetooth to reduce attack surface due to extended history of security vulnerabilities.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
|
||||
##
|
||||
## Now replaced by a privacy and security preserving default Bluetooth configuration for better usability.
|
||||
## https://github.com/Kicksecure/security-misc/pull/145
|
||||
##
|
||||
#install bluetooth /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install bluetooth_6lowpan /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install bt3c_cs /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btbcm /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btintel /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btmrvl /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btmrvl_sdio /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btmtk /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btmtksdio /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btmtkuart /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btnxpuart /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btqca /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btrsi /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btrtl /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btsdio /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install btusb /usr/bin/disabled-bluetooth-by-security-misc
|
||||
#install virtio_bt /usr/bin/disabled-bluetooth-by-security-misc
|
||||
|
||||
## FireWire (IEEE 1394):
|
||||
## Disable IEEE 1394 (FireWire/i.LINK/Lynx) modules to prevent some DMA attacks.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/IEEE_1394#Security_issues
|
||||
##
|
||||
install dv1394 /usr/bin/disabled-firewire-by-security-misc
|
||||
install firewire-core /usr/bin/disabled-firewire-by-security-misc
|
||||
install firewire-ohci /usr/bin/disabled-firewire-by-security-misc
|
||||
install firewire-net /usr/bin/disabled-firewire-by-security-misc
|
||||
install firewire-sbp2 /usr/bin/disabled-firewire-by-security-misc
|
||||
install ohci1394 /usr/bin/disabled-firewire-by-security-misc
|
||||
install raw1394 /usr/bin/disabled-firewire-by-security-misc
|
||||
install sbp2 /usr/bin/disabled-firewire-by-security-misc
|
||||
install video1394 /usr/bin/disabled-firewire-by-security-misc
|
||||
|
||||
## Global Positioning Systems (GPS):
|
||||
## Disable GPS-related modules like GNSS (Global Navigation Satellite System).
|
||||
##
|
||||
install garmin_gps /usr/bin/disabled-gps-by-security-misc
|
||||
install gnss /usr/bin/disabled-gps-by-security-misc
|
||||
install gnss-mtk /usr/bin/disabled-gps-by-security-misc
|
||||
install gnss-serial /usr/bin/disabled-gps-by-security-misc
|
||||
install gnss-sirf /usr/bin/disabled-gps-by-security-misc
|
||||
install gnss-ubx /usr/bin/disabled-gps-by-security-misc
|
||||
install gnss-usb /usr/bin/disabled-gps-by-security-misc
|
||||
|
||||
## Intel Management Engine (ME):
|
||||
## Partially disable the Intel ME interface with the OS.
|
||||
## ME functionality has increasing become more intertwined with basic Intel system operation.
|
||||
## Disabling may lead to breakages in numerous places without clear debugging/error messages.
|
||||
## May cause issues with firmware updates, security, power management, display, and DRM.
|
||||
##
|
||||
## https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html
|
||||
## https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities
|
||||
## https://www.kicksecure.com/wiki/Out-of-band_Management_Technology#Intel_ME_Disabling_Disadvantages
|
||||
## https://github.com/Kicksecure/security-misc/pull/236#issuecomment-2229092813
|
||||
## https://github.com/Kicksecure/security-misc/issues/239
|
||||
##
|
||||
#install mei /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei-gsc /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei_gsc_proxy /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei_hdcp /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei-me /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei_phy /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei_pxp /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei-txe /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei-vsc /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei-vsc-hw /usr/bin/disabled-intelme-by-security-misc
|
||||
#install mei_wdt /usr/bin/disabled-intelme-by-security-misc
|
||||
#install microread_mei /usr/bin/disabled-intelme-by-security-misc
|
||||
|
||||
## Intel Platform Monitoring Technology (PMT) Telemetry:
|
||||
## Disable some functionality of the Intel PMT components.
|
||||
##
|
||||
## https://github.com/intel/Intel-PMT
|
||||
##
|
||||
install pmt_class /usr/bin/disabled-intelpmt-by-security-misc
|
||||
install pmt_crashlog /usr/bin/disabled-intelpmt-by-security-misc
|
||||
install pmt_telemetry /usr/bin/disabled-intelpmt-by-security-misc
|
||||
|
||||
## Thunderbolt:
|
||||
## Disables Thunderbolt modules to prevent some DMA attacks.
|
||||
##
|
||||
## https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Security_vulnerabilities
|
||||
##
|
||||
install intel-wmi-thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc
|
||||
install thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc
|
||||
install thunderbolt_net /usr/bin/disabled-thunderbolt-by-security-misc
|
||||
|
||||
## 2. File Systems:
|
||||
|
||||
## File Systems:
|
||||
## Disable uncommon file systems to reduce attack surface.
|
||||
## HFS/HFS+ are legacy Apple file systems that may be required depending on the EFI partition format.
|
||||
##
|
||||
install cramfs /usr/bin/disabled-filesys-by-security-misc
|
||||
install freevxfs /usr/bin/disabled-filesys-by-security-misc
|
||||
install hfs /usr/bin/disabled-filesys-by-security-misc
|
||||
install hfsplus /usr/bin/disabled-filesys-by-security-misc
|
||||
install jffs2 /usr/bin/disabled-filesys-by-security-misc
|
||||
install jfs /usr/bin/disabled-filesys-by-security-misc
|
||||
install reiserfs /usr/bin/disabled-filesys-by-security-misc
|
||||
install udf /usr/bin/disabled-filesys-by-security-misc
|
||||
|
||||
## Network File Systems:
|
||||
## Disable uncommon network file systems to reduce attack surface.
|
||||
##
|
||||
install gfs2 /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install ksmbd /usr/bin/disabled-netfilesys-by-security-misc
|
||||
##
|
||||
## Common Internet File System (CIFS):
|
||||
##
|
||||
install cifs /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install cifs_arc4 /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install cifs_md4 /usr/bin/disabled-netfilesys-by-security-misc
|
||||
##
|
||||
## Network File System (NFS):
|
||||
##
|
||||
install nfs /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install nfs_acl /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install nfs_layout_nfsv41_files /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install nfs_layout_flexfiles /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install nfsd /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install nfsv2 /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install nfsv3 /usr/bin/disabled-netfilesys-by-security-misc
|
||||
install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc
|
||||
|
||||
## 2. Networking:
|
||||
|
||||
## Network Protocols:
|
||||
## Disables rare and unneeded network protocols that are a common source of unknown vulnerabilities.
|
||||
## Previously had blacklisted eepro100 and eth1394.
|
||||
##
|
||||
## https://tails.boum.org/blueprint/blacklist_modules/
|
||||
## https://fedoraproject.org/wiki/Security_Features_Matrix#Blacklist_Rare_Protocols
|
||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-rare-network.conf?h=ubuntu/disco
|
||||
## https://github.com/Kicksecure/security-misc/pull/234#issuecomment-2230732015
|
||||
##
|
||||
install af_802154 /usr/bin/disabled-network-by-security-misc
|
||||
install appletalk /usr/bin/disabled-network-by-security-misc
|
||||
install ax25 /usr/bin/disabled-network-by-security-misc
|
||||
#install brcm80211 /usr/bin/disabled-network-by-security-misc
|
||||
install decnet /usr/bin/disabled-network-by-security-misc
|
||||
install dccp /usr/bin/disabled-network-by-security-misc
|
||||
install econet /usr/bin/disabled-network-by-security-misc
|
||||
install eepro100 /usr/bin/disabled-network-by-security-misc
|
||||
install eth1394 /usr/bin/disabled-network-by-security-misc
|
||||
install ipx /usr/bin/disabled-network-by-security-misc
|
||||
install n-hdlc /usr/bin/disabled-network-by-security-misc
|
||||
install netrom /usr/bin/disabled-network-by-security-misc
|
||||
install p8022 /usr/bin/disabled-network-by-security-misc
|
||||
install p8023 /usr/bin/disabled-network-by-security-misc
|
||||
install psnap /usr/bin/disabled-network-by-security-misc
|
||||
install rose /usr/bin/disabled-network-by-security-misc
|
||||
install x25 /usr/bin/disabled-network-by-security-misc
|
||||
##
|
||||
## Asynchronous Transfer Mode (ATM):
|
||||
##
|
||||
install atm /usr/bin/disabled-network-by-security-misc
|
||||
install ueagle-atm /usr/bin/disabled-network-by-security-misc
|
||||
install usbatm /usr/bin/disabled-network-by-security-misc
|
||||
install xusbatm /usr/bin/disabled-network-by-security-misc
|
||||
##
|
||||
## Controller Area Network (CAN) Protocol:
|
||||
##
|
||||
install c_can /usr/bin/disabled-network-by-security-misc
|
||||
install c_can_pci /usr/bin/disabled-network-by-security-misc
|
||||
install c_can_platform /usr/bin/disabled-network-by-security-misc
|
||||
install can /usr/bin/disabled-network-by-security-misc
|
||||
install can-bcm /usr/bin/disabled-network-by-security-misc
|
||||
install can-dev /usr/bin/disabled-network-by-security-misc
|
||||
install can-gw /usr/bin/disabled-network-by-security-misc
|
||||
install can-isotp /usr/bin/disabled-network-by-security-misc
|
||||
install can-raw /usr/bin/disabled-network-by-security-misc
|
||||
install can-j1939 /usr/bin/disabled-network-by-security-misc
|
||||
install can327 /usr/bin/disabled-network-by-security-misc
|
||||
install ifi_canfd /usr/bin/disabled-network-by-security-misc
|
||||
install janz-ican3 /usr/bin/disabled-network-by-security-misc
|
||||
install m_can /usr/bin/disabled-network-by-security-misc
|
||||
install m_can_pci /usr/bin/disabled-network-by-security-misc
|
||||
install m_can_platform /usr/bin/disabled-network-by-security-misc
|
||||
install phy-can-transceiver /usr/bin/disabled-network-by-security-misc
|
||||
install slcan /usr/bin/disabled-network-by-security-misc
|
||||
install ucan /usr/bin/disabled-network-by-security-misc
|
||||
install vxcan /usr/bin/disabled-network-by-security-misc
|
||||
install vcan /usr/bin/disabled-network-by-security-misc
|
||||
##
|
||||
## Transparent Inter Process Communication (TIPC):
|
||||
##
|
||||
install tipc /usr/bin/disabled-network-by-security-misc
|
||||
install tipc_diag /usr/bin/disabled-network-by-security-misc
|
||||
##
|
||||
## Reliable Datagram Sockets (RDS):
|
||||
##
|
||||
install rds /usr/bin/disabled-network-by-security-misc
|
||||
install rds_rdma /usr/bin/disabled-network-by-security-misc
|
||||
install rds_tcp /usr/bin/disabled-network-by-security-misc
|
||||
##
|
||||
## Stream Control Transmission Protocol (SCTP):
|
||||
##
|
||||
install sctp /usr/bin/disabled-network-by-security-misc
|
||||
install sctp_diag /usr/bin/disabled-network-by-security-misc
|
||||
|
||||
## 4. Miscellaneous:
|
||||
|
||||
## Amateur Radios:
|
||||
##
|
||||
install hamradio /usr/bin/disabled-miscellaneous-by-security-misc
|
||||
|
||||
## CPU Model-Specific Registers (MSRs):
|
||||
## Disable CPU MSRs as they can be abused to write to arbitrary memory.
|
||||
##
|
||||
## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode
|
||||
## https://github.com/Kicksecure/security-misc/issues/215
|
||||
##
|
||||
#install msr /usr/bin/disabled-miscellaneous-by-security-misc
|
||||
|
||||
## Floppy Disks:
|
||||
##
|
||||
install floppy /usr/bin/disabled-miscellaneous-by-security-misc
|
||||
|
||||
## Framebuffer (fbdev):
|
||||
## Video drivers are known to be buggy, cause kernel panics, and are generally only used by legacy devices.
|
||||
## These were all previously blacklisted.
|
||||
##
|
||||
## https://docs.kernel.org/fb/index.html
|
||||
## https://en.wikipedia.org/wiki/Linux_framebuffer
|
||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco
|
||||
##
|
||||
install aty128fb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install atyfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install cirrusfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install cyber2000fb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install cyblafb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install gx1fb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install hgafb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install i810fb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install intelfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install kyrofb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install lxfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install matroxfb_base /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install neofb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install nvidiafb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install pm2fb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install radeonfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install rivafb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install s1d13xxxfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install savagefb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install sisfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install sstfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install tdfxfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install tridentfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install vesafb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install vfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install viafb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install vt8623fb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
install udlfb /usr/bin/disabled-framebuffer-by-security-misc
|
||||
|
||||
## Replaced Modules:
|
||||
## These legacy drivers have all been entirely replaced and superseded by newer drivers.
|
||||
## These were all previously blacklisted.
|
||||
##
|
||||
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco
|
||||
##
|
||||
install asus_acpi /usr/bin/disabled-miscellaneous-by-security-misc
|
||||
install bcm43xx /usr/bin/disabled-miscellaneous-by-security-misc
|
||||
install de4x5 /usr/bin/disabled-miscellaneous-by-security-misc
|
||||
install prism54 /usr/bin/disabled-miscellaneous-by-security-misc
|
||||
|
||||
## USB Video Device Class:
|
||||
## Disables the USB-based video streaming driver for devices like some webcams and digital camcorders.
|
||||
##
|
||||
#install uvcvideo /usr/bin/disabled-miscellaneous-by-security-misc
|
||||
|
||||
## Vivid:
|
||||
## Disables the vivid kernel module since it has been the cause of multiple vulnerabilities.
|
||||
##
|
||||
## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233
|
||||
## https://www.openwall.com/lists/oss-security/2019/11/02/1
|
||||
## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475
|
||||
##
|
||||
## No longer disabled by default:
|
||||
## https://forums.whonix.org/t/testing-qubes-video-companion-on-whonix/21393
|
||||
## https://github.com/Kicksecure/security-misc/issues/298
|
||||
##
|
||||
#install vivid /usr/bin/disabled-miscellaneous-by-security-misc
|
||||
@ -1,15 +1,14 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardener.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
# Keep the `passwd` utility executable to prevent issues with the
|
||||
# /usr/libexec/security-misc/pam-abort-on-locked-password script blocking
|
||||
# user logins with `su` and KScreenLocker. exactwhitelist is needed to keep
|
||||
# the nosuid rule on /usr/bin from fighting with these rules.
|
||||
# user logins with `su` and KScreenLocker
|
||||
#
|
||||
# See also: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#passwd
|
||||
/usr/bin/passwd exactwhitelist
|
||||
/usr/bin/passwd 0755 root root
|
||||
/bin/passwd 0755 root root
|
||||
20
etc/permission-hardening.d/25_default_sudo.conf
Normal file
20
etc/permission-hardening.d/25_default_sudo.conf
Normal file
@ -0,0 +1,20 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## https://forums.whonix.org/t/restrict-root-access/7658/116
|
||||
## This restricts the file permissions of the sudo executable so that a vulnerability
|
||||
## in the program will not be exploitable by any users not in the "sudo" group. sudo
|
||||
## is a very complex program and is setuid so vulnerabilities in it can allow privilege
|
||||
## escalation, regardless of other root access restrictions. For example, the following
|
||||
## buffer overflow vulnerability could have been exploited by any user on the system:
|
||||
## https://www.openwall.com/lists/oss-security/2021/01/26/3
|
||||
## With this restriction, only users explicitly permitted to use sudo by being added to
|
||||
## the "sudo" group could exploit such vulnerabilities. For example, this would prevent a
|
||||
## compromised network-facing daemon (such as web servers, time synchronization daemons,
|
||||
## etc.) running as its own user from exploiting sudo to escalate privileges.
|
||||
#/usr/bin/sudo 4750 root sudo
|
||||
#/bin/sudo 4750 root sudo
|
||||
@ -0,0 +1,9 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/bin/bwrap exactwhitelist
|
||||
/bin/bwrap exactwhitelist
|
||||
@ -0,0 +1,8 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/lib/chromium/chrome-sandbox exactwhitelist
|
||||
@ -0,0 +1,8 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
dbus-daemon-launch-helper matchwhitelist
|
||||
@ -1,11 +1,11 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardener.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## There is a controversy about firejail but those who choose to install it
|
||||
## should be able to use it.
|
||||
## https://www.kicksecure.com/wiki/Dev/Firejail#Security
|
||||
## https://www.whonix.org/wiki/Dev/Firejail#Security
|
||||
/usr/bin/firejail exactwhitelist
|
||||
10
etc/permission-hardening.d/25_default_whitelist_fuse.conf
Normal file
10
etc/permission-hardening.d/25_default_whitelist_fuse.conf
Normal file
@ -0,0 +1,10 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## required for AppImages such as electrum Bitcoin wallet
|
||||
## https://forums.whonix.org/t/disable-suid-binaries/7706/57
|
||||
/fusermount matchwhitelist
|
||||
@ -1,17 +1,17 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardener.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
|
||||
## Protect from 'chmod -x' (and SUID removal).
|
||||
## SUID will be removed below in separate step.
|
||||
/bin/mount exactwhitelist
|
||||
/usr/bin/mount exactwhitelist
|
||||
/usr/bin/umount exactwhitelist
|
||||
|
||||
## Remove SUID from 'mount' but keep executable.
|
||||
## https://forums.whonix.org/t/disable-suid-binaries/7706/61
|
||||
/usr/bin/mount 755 root root
|
||||
/usr/bin/umount 755 root root
|
||||
/bin/mount 745 root root
|
||||
/usr/bin/mount 745 root root
|
||||
@ -0,0 +1,17 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/bin/pkexec exactwhitelist
|
||||
/bin/pkexec exactwhitelist
|
||||
/usr/bin/pkexec.security-misc-orig exactwhitelist
|
||||
/bin/pkexec.security-misc-orig exactwhitelist
|
||||
|
||||
## TODO: research
|
||||
## match both:
|
||||
#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist
|
||||
#/lib/policykit-1/polkit-agent-helper-1
|
||||
polkit-agent-helper-1 matchwhitelist
|
||||
13
etc/permission-hardening.d/25_default_whitelist_qubes.conf
Normal file
13
etc/permission-hardening.d/25_default_whitelist_qubes.conf
Normal file
@ -0,0 +1,13 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## TODO: research
|
||||
## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c
|
||||
## match both:
|
||||
#/usr/lib/qubes/qfile-unpacker whitelist
|
||||
#/lib/qubes/qfile-unpacker
|
||||
/qubes/qfile-unpacker matchwhitelist
|
||||
@ -0,0 +1,8 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/utempter/utempter matchwhitelist
|
||||
@ -0,0 +1,8 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper exactwhitelist
|
||||
@ -0,0 +1,9 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
/usr/bin/sudo exactwhitelist
|
||||
/bin/sudo exactwhitelist
|
||||
@ -1,10 +1,11 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardener.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## required for performing password validation from unprivileged user
|
||||
## processes such as KScreenLocker's unlock prompt
|
||||
/usr/sbin/unix_chkpwd exactwhitelist
|
||||
/sbin/unix_chkpwd exactwhitelist
|
||||
@ -0,0 +1,9 @@
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## TODO: research
|
||||
/usr/lib/virtualbox/ matchwhitelist
|
||||
@ -1,16 +1,18 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Please use "/etc/permission-hardener.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
|
||||
## Please use "/etc/permission-hardening.d/20_user.conf" or
|
||||
## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
|
||||
## configuration. When security-misc is updated, this file may be overwritten.
|
||||
|
||||
## File permission hardening.
|
||||
##
|
||||
## Syntax:
|
||||
## [filename] [mode] [owner] [group] [capability]
|
||||
## [filename] [exactwhitelist|matchwhitelist|disablewhitelist|nosuid]
|
||||
##
|
||||
## To remove all SUID/SGID binaries in a directory, you can use the "nosuid"
|
||||
## argument.
|
||||
|
||||
## TODO: white spaces inside file name untested and probably will not work.
|
||||
|
||||
######################################################################
|
||||
@ -20,9 +22,13 @@
|
||||
#whitelists_disable_all=true
|
||||
|
||||
######################################################################
|
||||
# SUID disables below (or in lexically higher) files: disablewhitelist
|
||||
# SUID disablewhitelist
|
||||
######################################################################
|
||||
|
||||
## disablewhitelist disables below (or in lexically higher) files
|
||||
## exactwhitelist and matchwhitelist. Add these here (discouraged) or better
|
||||
## in file "/etc/permission-hardening.d/20_user.conf".
|
||||
|
||||
## For example, if you are not using SELinux the following might make sense to
|
||||
## enable. TODO: research
|
||||
#/utempter/utempter disablewhitelist
|
||||
@ -31,83 +37,82 @@
|
||||
#/fusermount disablewhitelist
|
||||
|
||||
######################################################################
|
||||
# SUID whitelist matches full path: exactwhitelist
|
||||
# SUID exact match whitelist
|
||||
######################################################################
|
||||
|
||||
## In case you need to use 'su'. See also:
|
||||
## https://www.kicksecure.com/wiki/root#su
|
||||
#/bin/su exactwhitelist
|
||||
#/usr/bin/su exactwhitelist
|
||||
|
||||
######################################################################
|
||||
# SUID exact match whitelist
|
||||
######################################################################
|
||||
|
||||
## https://manpages.debian.org/xserver-xorg-legacy/Xorg.wrap.1.en.html
|
||||
## https://lwn.net/Articles/590315/
|
||||
## https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706/35
|
||||
## http://forums.whonix.org/t/permission-hardening/8655/25
|
||||
#/usr/lib/xorg/Xorg.wrap whitelist
|
||||
|
||||
######################################################################
|
||||
# SUID whitelist matches in any section of the path: matchwhitelist
|
||||
# SUID regex match whitelist
|
||||
######################################################################
|
||||
|
||||
## Examples below are already configured:
|
||||
#ssh-agent matchwhitelist
|
||||
#/usr/lib/openssh matchwhitelist
|
||||
######################################################################
|
||||
# SUID regex match whitelist
|
||||
######################################################################
|
||||
|
||||
######################################################################
|
||||
# Permission Hardening
|
||||
######################################################################
|
||||
|
||||
/home/ 0755 root root
|
||||
/home/user/ 0700 user user
|
||||
/root/ 0700 root root
|
||||
/boot/ 0700 root root
|
||||
/etc/permission-hardener.d 0600 root root
|
||||
/usr/local/etc/permission-hardener.d 0600 root root
|
||||
/usr/lib/modules/ 0700 root root
|
||||
/usr/src 0700 root root
|
||||
/etc/cups/cupsd.conf 0400 root root
|
||||
/etc/syslog.conf 0600 root root
|
||||
/etc/ssh/sshd_config 0600 root root
|
||||
/etc/crontab 0600 root root
|
||||
/etc/cron.d 0700 root root
|
||||
/etc/cron.daily 0700 root root
|
||||
/etc/sudoers.d 0700 root root
|
||||
/etc/cron.hourly 0700 root root
|
||||
/etc/cron.weekly 0700 root root
|
||||
/etc/cron.monthly 0700 root root
|
||||
/etc/group 0644 root root
|
||||
/etc/group- 0644 root root
|
||||
/etc/hosts.allow 0644 root root
|
||||
/etc/hosts.deny 0644 root root
|
||||
/etc/issue 0644 root root
|
||||
/etc/issue.net 0644 root root
|
||||
/etc/motd 0644 root root
|
||||
/etc/passwd 0644 root root
|
||||
/etc/passwd- 0644 root root
|
||||
/etc/permission-hardening.d 0600 root root
|
||||
/usr/local/etc/permission-hardening.d 0600 root root
|
||||
/lib/modules/ 0700 root root
|
||||
|
||||
######################################################################
|
||||
# SUID/SGID Removal: nosuid
|
||||
# SUID/SGID Removal
|
||||
######################################################################
|
||||
|
||||
## To remove all SUID/SGID binaries in a directory, you can use the "nosuid"
|
||||
## argument.
|
||||
##
|
||||
## Remove all SUID/SGID binaries/libraries.
|
||||
|
||||
/opt/ nosuid
|
||||
/usr/bin/ nosuid
|
||||
/usr/lib32/ nosuid
|
||||
/usr/lib64/ nosuid
|
||||
/usr/lib/ nosuid
|
||||
/bin/ nosuid
|
||||
/usr/local/bin/ nosuid
|
||||
/usr/local/lib32/ nosuid
|
||||
/usr/local/lib64/ nosuid
|
||||
/usr/local/lib/ nosuid
|
||||
/usr/local/opt/ nosuid
|
||||
/usr/local/sbin/ nosuid
|
||||
|
||||
/usr/bin/ nosuid
|
||||
/usr/local/usr/bin/ nosuid
|
||||
/usr/local/usr/lib32/ nosuid
|
||||
/usr/local/usr/lib64/ nosuid
|
||||
/usr/local/usr/lib/ nosuid
|
||||
/usr/local/usr/sbin/ nosuid
|
||||
|
||||
/sbin/ nosuid
|
||||
/usr/local/sbin/ nosuid
|
||||
|
||||
/usr/sbin/ nosuid
|
||||
/usr/local/usr/sbin/ nosuid
|
||||
|
||||
/lib/ nosuid
|
||||
/usr/local/lib/ nosuid
|
||||
|
||||
/lib32/ nosuid
|
||||
/usr/local/lib32/ nosuid
|
||||
|
||||
/lib64/ nosuid
|
||||
/usr/local/lib64/ nosuid
|
||||
|
||||
/usr/lib/ nosuid
|
||||
/usr/local/usr/lib/ nosuid
|
||||
|
||||
/usr/lib32/ nosuid
|
||||
/usr/local/usr/lib32/ nosuid
|
||||
|
||||
/usr/lib64/ nosuid
|
||||
/usr/local/usr/lib64/ nosuid
|
||||
|
||||
## https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706/68
|
||||
/opt/ nosuid
|
||||
/usr/local/opt/ nosuid
|
||||
|
||||
######################################################################
|
||||
# Capability Removal
|
||||
@ -116,7 +121,7 @@
|
||||
## Ping doesn't work with Tor anyway so its capabilities are removed to
|
||||
## reduce attack surface.
|
||||
## anon-apps-config does this.
|
||||
#/usr/bin/ping 0744 root root none
|
||||
#/bin/ping 0744 root root none
|
||||
|
||||
## TODO: research
|
||||
#/usr/lib/x86_64-linux-gnu/gstreamer1.0/grstreamer-1.0/gst-ptp-helper 0744 root root none
|
||||
@ -1,11 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
if [ -z "$XDG_CONFIG_DIRS" ]; then
|
||||
XDG_CONFIG_DIRS=/etc/xdg
|
||||
fi
|
||||
if ! echo "$XDG_CONFIG_DIRS" | grep --quiet /usr/share/security-misc/ ; then
|
||||
export XDG_CONFIG_DIRS=/usr/share/security-misc/:$XDG_CONFIG_DIRS
|
||||
fi
|
||||
@ -1,5 +1,2 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
# /etc/securetty: list of terminals on which root is allowed to login.
|
||||
# See securetty(5) and login(1).
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## To enable root login, see:
|
||||
## https://www.kicksecure.com/wiki/Root#Root_Login
|
||||
## https://www.whonix.org/wiki/Root#Root_Login
|
||||
|
||||
## Console Lockdown
|
||||
## https://forums.whonix.org/t/etc-security-hardening/8592
|
||||
|
||||
@ -1,12 +1,9 @@
|
||||
## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
# Configuration for locking the user after multiple failed
|
||||
# authentication attempts.
|
||||
#
|
||||
# The directory where the user files with the failure records are kept.
|
||||
# The default is /var/run/faillock.
|
||||
dir = /var/lib/security-misc/faillock
|
||||
# dir = /var/run/faillock
|
||||
#
|
||||
# Will log the user name into the system log if the user is not found.
|
||||
# Enabled if option is present.
|
||||
@ -38,19 +35,14 @@ deny = 50
|
||||
# authentication failures must happen for the user account
|
||||
# lock out is <replaceable>n</replaceable> seconds.
|
||||
# The default is 900 (15 minutes).
|
||||
# security-misc note: the interval should be set to infinity if possible,
|
||||
# however pam_faillock arbitrarily limits this variable to a maximum of 604800
|
||||
# seconds (7 days). See
|
||||
# https://github.com/linux-pam/linux-pam/blob/539816e4a0a277dbb632412be91e482fff9d9d09/modules/pam_faillock/faillock_config.h#L59
|
||||
# for details. Therefore we set this to the maximum allowable value of 7 days.
|
||||
fail_interval = 604800
|
||||
# fail_interval = 900
|
||||
#
|
||||
# The access will be re-enabled after n seconds after the lock out.
|
||||
# The value 0 has the same meaning as value `never` - the access
|
||||
# will not be re-enabled without resetting the faillock
|
||||
# entries by the `faillock` command.
|
||||
# The default is 600 (10 minutes).
|
||||
unlock_time = never
|
||||
# unlock_time = 600
|
||||
#
|
||||
# Root account can become locked as well as regular accounts.
|
||||
# Enabled if option is present.
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Disable coredumps.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
|
||||
<!-- ## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org> -->
|
||||
<!-- ## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> -->
|
||||
<!-- ## See the file COPYING for copying conditions. -->
|
||||
|
||||
<!-- Configuration for Thunar. -->
|
||||
|
||||
@ -282,13 +282,13 @@ display-charset utf-8
|
||||
##################################################################
|
||||
|
||||
##################################################################
|
||||
## BEGIN Some suggestions from Debian https://keyring.debian.org/creating-key.html
|
||||
## BEGIN Some suggestions from Debian http://keyring.debian.org/creating-key.html
|
||||
|
||||
personal-digest-preferences SHA512
|
||||
cert-digest-algo SHA512
|
||||
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
|
||||
|
||||
## END Some suggestions from Debian https://keyring.debian.org/creating-key.html
|
||||
## END Some suggestions from Debian http://keyring.debian.org/creating-key.html
|
||||
##################################################################
|
||||
|
||||
##################################################################
|
||||
|
||||
11
etc/sudoers.d/pkexec-security-misc
Normal file
11
etc/sudoers.d/pkexec-security-misc
Normal file
@ -0,0 +1,11 @@
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## REVIEW: is it ok that users can find out the PATH setting of root?
|
||||
#%sudo ALL=NOPASSWD: /usr/libexec/security-misc/echo-path
|
||||
|
||||
## xfpm-power-backlight-helper demands environment variable PKEXEC_UID to be
|
||||
## set. Would otherwise error out with the following error message:
|
||||
## "This program must only be run through pkexec"
|
||||
## REVIEW: Can bad things be done by spoofing PKEXEC_UID?
|
||||
#Defaults:ALL env_keep += "PKEXEC_UID"
|
||||
@ -1,12 +1,6 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Neither of these are needed.
|
||||
#user ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops
|
||||
#%sudo ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops
|
||||
user ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops
|
||||
%sudo ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops
|
||||
|
||||
## Use a more open umask when executing commands with sudo
|
||||
## Can be overridden on a per-user basis using .[z]profile if desirable
|
||||
## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#umask_hardening
|
||||
Defaults umask_override
|
||||
Defaults umask=0022
|
||||
|
||||
19
etc/sudoers.d/xfce-security-misc
Normal file
19
etc/sudoers.d/xfce-security-misc
Normal file
@ -0,0 +1,19 @@
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## https://forums.whonix.org/t/xfce4-power-manager-xfpm-power-backlight-helper-pkexec-lxsudo-popup/8764
|
||||
## /usr/share/polkit-1/actions/org.xfce.power.policy
|
||||
|
||||
## Feel free to out comment this if you are not using xfce4-power-manager or Xfce.
|
||||
|
||||
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]]
|
||||
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]]
|
||||
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]][[\:digit\:]]
|
||||
|
||||
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]]
|
||||
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]]
|
||||
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]][[\:digit\:]]
|
||||
|
||||
## XXX: Should we allow this?
|
||||
#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --suspend
|
||||
#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --hibernate
|
||||
158
etc/sysctl.d/30_security-misc.conf
Normal file
158
etc/sysctl.d/30_security-misc.conf
Normal file
@ -0,0 +1,158 @@
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Disables coredumps. This setting may be overwritten by systemd so this may not be useful.
|
||||
## security-misc also disables coredumps in other ways.
|
||||
kernel.core_pattern=|/bin/false
|
||||
|
||||
## Restricts the kernel log to root only.
|
||||
kernel.dmesg_restrict=1
|
||||
|
||||
## Don't allow writes to files that we don't own
|
||||
## in world writable sticky directories, unless
|
||||
## they are owned by the owner of the directory.
|
||||
fs.protected_fifos=2
|
||||
fs.protected_regular=2
|
||||
|
||||
## Only allow symlinks to be followed when outside of
|
||||
## a world-writable sticky directory, or when the owner
|
||||
## of the symlink and follower match, or when the directory
|
||||
## owner matches the symlink's owner.
|
||||
##
|
||||
## Prevent hardlinks from being created by users that do not
|
||||
## have read/write access to the source file.
|
||||
##
|
||||
## These prevent many TOCTOU races.
|
||||
fs.protected_symlinks=1
|
||||
fs.protected_hardlinks=1
|
||||
|
||||
## Hardens the BPF JIT compiler and restricts it to root.
|
||||
kernel.unprivileged_bpf_disabled=1
|
||||
net.core.bpf_jit_harden=2
|
||||
|
||||
## Hides kernel addresses in various files in /proc.
|
||||
## Kernel addresses can be very useful in certain exploits.
|
||||
##
|
||||
## https://kernsec.org/wiki/index.php/Bug_Classes/Kernel_pointer_leak
|
||||
kernel.kptr_restrict=2
|
||||
|
||||
## Improves ASLR effectiveness for mmap.
|
||||
## Both explicit sysctl are made redundant due to automation
|
||||
## https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514
|
||||
## Do NOT enable either - displaying only for clarity
|
||||
##
|
||||
#vm.mmap_rnd_bits=32
|
||||
#vm.mmap_rnd_compat_bits=16
|
||||
|
||||
## Restricts the use of ptrace to root. This might break some programs running under WINE.
|
||||
## A workaround for WINE would be to give the wineserver and wine-preloader ptrace capabilities. This can be done by running:
|
||||
##
|
||||
## sudo apt-get install libcap2-bin
|
||||
## sudo setcap cap_sys_ptrace=eip /usr/bin/wineserver
|
||||
## sudo setcap cap_sys_ptrace=eip /usr/bin/wine-preloader
|
||||
kernel.yama.ptrace_scope=2
|
||||
|
||||
## Prevent setuid processes from creating coredumps.
|
||||
fs.suid_dumpable=0
|
||||
|
||||
## Randomize the addresses for mmap base, heap, stack, and VDSO pages
|
||||
kernel.randomize_va_space=2
|
||||
|
||||
#### meta start
|
||||
#### project Kicksecure
|
||||
#### category networking and security
|
||||
#### description
|
||||
## TCP/IP stack hardening
|
||||
|
||||
## Protects against time-wait assassination.
|
||||
## It drops RST packets for sockets in the time-wait state.
|
||||
net.ipv4.tcp_rfc1337=1
|
||||
|
||||
## Disables ICMP redirect acceptance.
|
||||
net.ipv4.conf.all.accept_redirects=0
|
||||
net.ipv4.conf.default.accept_redirects=0
|
||||
net.ipv4.conf.all.secure_redirects=0
|
||||
net.ipv4.conf.default.secure_redirects=0
|
||||
net.ipv6.conf.all.accept_redirects=0
|
||||
net.ipv6.conf.default.accept_redirects=0
|
||||
|
||||
## Disables ICMP redirect sending.
|
||||
net.ipv4.conf.all.send_redirects=0
|
||||
net.ipv4.conf.default.send_redirects=0
|
||||
|
||||
## Ignores ICMP requests.
|
||||
net.ipv4.icmp_echo_ignore_all=1
|
||||
net.ipv6.icmp.echo_ignore_all=1
|
||||
|
||||
## Ignores bogus ICMP error responses
|
||||
net.ipv4.icmp_ignore_bogus_error_responses=1
|
||||
|
||||
## Enables TCP syncookies.
|
||||
net.ipv4.tcp_syncookies=1
|
||||
|
||||
## Disable source routing.
|
||||
net.ipv4.conf.all.accept_source_route=0
|
||||
net.ipv4.conf.default.accept_source_route=0
|
||||
net.ipv6.conf.all.accept_source_route=0
|
||||
net.ipv6.conf.default.accept_source_route=0
|
||||
|
||||
## Enable reverse path filtering to prevent IP spoofing and
|
||||
## mitigate vulnerabilities such as CVE-2019-14899.
|
||||
## https://forums.whonix.org/t/enable-reverse-path-filtering/8594
|
||||
net.ipv4.conf.default.rp_filter=1
|
||||
net.ipv4.conf.all.rp_filter=1
|
||||
|
||||
#### meta end
|
||||
|
||||
|
||||
## Previously disabled SACK, DSACK, and FACK.
|
||||
## https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109
|
||||
#net.ipv4.tcp_sack=0
|
||||
#net.ipv4.tcp_dsack=0
|
||||
#net.ipv4.tcp_fack=0
|
||||
|
||||
|
||||
#### meta start
|
||||
#### project Kicksecure
|
||||
#### category networking and security
|
||||
#### description
|
||||
## disable IPv4 TCP Timestamps
|
||||
|
||||
net.ipv4.tcp_timestamps=0
|
||||
|
||||
#### meta end
|
||||
|
||||
|
||||
## Only allow the SysRq key to be used for shutdowns and the
|
||||
## Secure Attention Key (SAK).
|
||||
##
|
||||
## https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079/
|
||||
kernel.sysrq=132
|
||||
|
||||
## Restrict loading TTY line disciplines to CAP_SYS_MODULE to prevent
|
||||
## unprivileged attackers from loading vulnerable line disciplines
|
||||
## with the TIOCSETD ioctl which has been used in exploits before
|
||||
## such as https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html
|
||||
##
|
||||
## https://lkml.org/lkml/2019/4/15/890
|
||||
dev.tty.ldisc_autoload=0
|
||||
|
||||
## Restrict the userfaultfd() syscall to root as it can make heap sprays
|
||||
## easier.
|
||||
##
|
||||
## https://duasynt.com/blog/linux-kernel-heap-spray
|
||||
vm.unprivileged_userfaultfd=0
|
||||
|
||||
## Let the kernel only swap if it is absolutely necessary.
|
||||
## Better not be set to zero:
|
||||
## - https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Performance_Tuning_Guide/s-memory-tunables.html
|
||||
## - https://en.wikipedia.org/wiki/Swappiness
|
||||
vm.swappiness=1
|
||||
|
||||
## Disallow kernel profiling by users without CAP_SYS_ADMIN
|
||||
## https://www.kernel.org/doc/Documentation/sysctl/kernel.txt
|
||||
kernel.perf_event_paranoid=3
|
||||
|
||||
# Do not accept router advertisments
|
||||
net.ipv6.conf.all.accept_ra=0
|
||||
net.ipv6.conf.default.accept_ra=0
|
||||
16
etc/sysctl.d/30_security-misc_kexec-disable.conf
Normal file
16
etc/sysctl.d/30_security-misc_kexec-disable.conf
Normal file
@ -0,0 +1,16 @@
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Quote https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html
|
||||
##
|
||||
## kexec_load_disabled:
|
||||
##
|
||||
## A toggle indicating if the kexec_load syscall has been disabled. This value defaults to 0 (false: kexec_load enabled), but can be set to 1 (true: kexec_load disabled). Once true, kexec can no longer be used, and the toggle cannot be set back to false. This allows a kexec image to be loaded before disabling the syscall, allowing a system to set up (and later use) an image without it being altered. Generally used together with the "modules_disabled" sysctl.
|
||||
## Disables kexec which can be used to replace the running kernel.
|
||||
kernel.kexec_load_disabled=1
|
||||
|
||||
## Why is this in a dedicated config file?
|
||||
## Package ram-wipe requires kexec. However, ram-wipe could not ship a config
|
||||
## file /etc/sysctl.d/40_ram-wipe.conf which sets 'kernel.kexec_load_disabled=0'.
|
||||
## This is because once systemd-sysctl.service has set 'kernel.kexec_load_disabled=1'
|
||||
## it cannot be undone without reboot. This is a upstream Linux security feature.
|
||||
14
etc/sysctl.d/30_silent-kernel-printk.conf
Normal file
14
etc/sysctl.d/30_silent-kernel-printk.conf
Normal file
@ -0,0 +1,14 @@
|
||||
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## Prevent kernel info leaks in console during boot.
|
||||
## https://phabricator.whonix.org/T950
|
||||
kernel.printk = 3 3 3 3
|
||||
|
||||
## NOTE:
|
||||
## For higher verbosity, the user might also want to delete file
|
||||
## /etc/default/grub.d/41_quiet.cfg
|
||||
## (or out-comment its settings).
|
||||
##
|
||||
## Alternatively, the user could consider to install the debug-misc package,
|
||||
## which will undo the settings found here.
|
||||
@ -1,6 +1,3 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
|
||||
## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d
|
||||
|
||||
|
||||
@ -1,6 +1,3 @@
|
||||
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211
|
||||
## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d
|
||||
|
||||
|
||||
11
etc/thunderbird/pref/40_security-mic.js
Normal file
11
etc/thunderbird/pref/40_security-mic.js
Normal file
@ -0,0 +1,11 @@
|
||||
//#### Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
//#### See the file COPYING for copying conditions.
|
||||
|
||||
//#### meta start
|
||||
//#### project Whonix and Kicksecure
|
||||
//#### category security and apps
|
||||
//#### description https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
||||
//#### meta end
|
||||
|
||||
// https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
||||
pref("network.IDN_show_punycode", true);
|
||||
@ -1,59 +0,0 @@
|
||||
//#### Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
//#### See the file COPYING for copying conditions.
|
||||
|
||||
//#### meta start
|
||||
//#### project Whonix and Kicksecure
|
||||
//#### category security and apps
|
||||
//#### description https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
||||
//#### meta end
|
||||
|
||||
// https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
|
||||
pref("network.IDN_show_punycode", true);
|
||||
|
||||
// Disable all and any kind of telemetry by default
|
||||
pref("toolkit.telemetry.enabled", false);
|
||||
pref("toolkit.telemetry.unified", false);
|
||||
pref("toolkit.telemetry.shutdownPingSender.enabled", false);
|
||||
pref("toolkit.telemetry.updatePing.enabled", false);
|
||||
pref("toolkit.telemetry.archive.enabled", false);
|
||||
pref("toolkit.telemetry.bhrPing.enabled", false);
|
||||
pref("toolkit.telemetry.firstShutdownPing.enabled", false);
|
||||
pref("toolkit.telemetry.newProfilePing.enabled", false);
|
||||
pref("toolkit.telemetry.server", ""); // Defense in depth
|
||||
pref("toolkit.telemetry.server_owner", ""); // Defense in depth
|
||||
pref("datareporting.healthreport.uploadEnabled", false);
|
||||
pref("datareporting.policy.dataSubmissionEnabled", false);
|
||||
pref("toolkit.telemetry.coverage.opt-out", true); // from Firefox
|
||||
pref("toolkit.coverage.opt-out", true); // from Firefox
|
||||
|
||||
// Disable implicit outbound traffic
|
||||
pref("network.connectivity-service.enabled", false);
|
||||
pref("network.prefetch-next", false);
|
||||
pref("network.dns.disablePrefetch", true);
|
||||
pref("network.predictor.enabled", false);
|
||||
|
||||
// No need to explain the problems with javascript
|
||||
// If you want javascript, use your browser
|
||||
// Thunderbird needs no javascript
|
||||
// pref("javascript.enabled", false); // Will break setting up services that require redirecting to their javascripted webpage for login, like gmail etc. So commented out for now.
|
||||
|
||||
// Disable scripting when viewing pdf files
|
||||
user_pref("pdfjs.enableScripting", false);
|
||||
|
||||
// If you want cookies, use your browser
|
||||
pref("network.cookie.cookieBehavior", 2);
|
||||
|
||||
// Do not send user agent information
|
||||
// For email clients, this is more like a relic of the past
|
||||
// Completely not necessary and just exposes a lot of information about the client
|
||||
// Since v115.0 Thunderbird already minimizes the user agent
|
||||
// But we want it gone for good for no information leak at all
|
||||
// https://hg.mozilla.org/comm-central/rev/cbbbc8d93cd7
|
||||
pref("mailnews.headers.sendUserAgent", false);
|
||||
|
||||
// Normally we send emails after marking them with a time stamp
|
||||
// That includes our local time zone
|
||||
// This option makes our local time zone appear as UTC
|
||||
// And rounds the time stamp to the closes minute
|
||||
// https://hg.mozilla.org/comm-central/rev/98aa0bf2e719
|
||||
pref("mail.sanitize_date_header", true);
|
||||
2
lib/systemd/coredump.conf.d/30_security-misc.conf
Normal file
2
lib/systemd/coredump.conf.d/30_security-misc.conf
Normal file
@ -0,0 +1,2 @@
|
||||
[Coredump]
|
||||
Storage=none
|
||||
@ -1,19 +1,14 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
## https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618
|
||||
disable hide-hardware-info.service
|
||||
|
||||
## Disable for now until development finished / tested.
|
||||
disable permission-hardener.service
|
||||
disable permission-hardening.service
|
||||
|
||||
## Disable for now until development finished / tested.
|
||||
## https://github.com/Kicksecure/security-misc/pull/152
|
||||
disable remount-secure.service
|
||||
|
||||
## Disable due to pkexec issues.
|
||||
disable proc-hidepid.service
|
||||
|
||||
## Disable due to issues. See:
|
||||
## https://github.com/Kicksecure/security-misc/issues/159
|
||||
disable harden-module-loading.service
|
||||
@ -1,4 +1,4 @@
|
||||
## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
[Service]
|
||||
@ -1,10 +1,9 @@
|
||||
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
||||
## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
[Unit]
|
||||
Description=Hide hardware information to unprivileged users
|
||||
Documentation=https://github.com/Kicksecure/security-misc
|
||||
|
||||
Documentation=https://github.com/Whonix/security-misc
|
||||
DefaultDependencies=no
|
||||
Before=sysinit.target
|
||||
Requires=local-fs.target
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user