mirror of
https://github.com/Kicksecure/security-misc.git
synced 2024-10-01 08:25:45 -04:00
141 lines
4.2 KiB
Plaintext
141 lines
4.2 KiB
Plaintext
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
|
## See the file COPYING for copying conditions.
|
|
|
|
## Please use "/etc/permission-hardener.d/20_user.conf" or
|
|
## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
|
|
## configuration. When security-misc is updated, this file may be overwritten.
|
|
|
|
## File permission hardening.
|
|
##
|
|
## Syntax:
|
|
## [filename] [mode] [owner] [group] [capability]
|
|
## [filename] [exactwhitelist|matchwhitelist|disablewhitelist|nosuid]
|
|
##
|
|
## TODO: white spaces inside file name untested and probably will not work.
|
|
|
|
######################################################################
|
|
# Global Settings
|
|
######################################################################
|
|
|
|
#whitelists_disable_all=true
|
|
|
|
######################################################################
|
|
# SUID disables below (or in lexically higher) files: disablewhitelist
|
|
######################################################################
|
|
|
|
## For example, if you are not using SELinux the following might make sense to
|
|
## enable. TODO: research
|
|
#/utempter/utempter disablewhitelist
|
|
|
|
## If you are not going to use AppImages such as electrum Bitcoin wallet.
|
|
#/fusermount disablewhitelist
|
|
|
|
######################################################################
|
|
# SUID whitelist matches full path: exactwhitelist
|
|
######################################################################
|
|
|
|
## In case you need to use 'su'. See also:
|
|
## https://www.kicksecure.com/wiki/root#su
|
|
#/bin/su exactwhitelist
|
|
#/usr/bin/su exactwhitelist
|
|
|
|
## https://manpages.debian.org/xserver-xorg-legacy/Xorg.wrap.1.en.html
|
|
## https://lwn.net/Articles/590315/
|
|
## http://forums.whonix.org/t/permission-hardening/8655/25
|
|
#/usr/lib/xorg/Xorg.wrap whitelist
|
|
#/lib/xorg/Xorg.wrap whitelist
|
|
|
|
######################################################################
|
|
# SUID whitelist matches in any section of the path: matchwhitelist
|
|
######################################################################
|
|
|
|
## Examples below are already configured:
|
|
#ssh-agent matchwhitelist
|
|
#/lib/openssh matchwhitelist
|
|
|
|
######################################################################
|
|
# Permission Hardening
|
|
######################################################################
|
|
|
|
/home/ 0755 root root
|
|
/root/ 0700 root root
|
|
/boot/ 0700 root root
|
|
/etc/permission-hardener.d 0600 root root
|
|
/usr/local/etc/permission-hardener.d 0600 root root
|
|
/lib/modules/ 0700 root root
|
|
/usr/src 0700 root root
|
|
/etc/cups/cupsd.conf 0400 root root
|
|
/etc/syslog.conf 0600 root root
|
|
/etc/ssh/sshd_config 0600 root root
|
|
/etc/crontab 0600 root root
|
|
/etc/cron.d 0700 root root
|
|
/etc/cron.daily 0700 root root
|
|
/etc/sudoers.d 0700 root root
|
|
/etc/cron.hourly 0700 root root
|
|
/etc/cron.weekly 0700 root root
|
|
/etc/cron.monthly 0700 root root
|
|
/etc/group 0644 root root
|
|
/etc/group- 0644 root root
|
|
/etc/hosts.allow 0644 root root
|
|
/etc/hosts.deny 0644 root root
|
|
/etc/issue 0644 root root
|
|
/etc/issue.net 0644 root root
|
|
/etc/motd 0644 root root
|
|
/etc/passwd 0644 root root
|
|
/etc/passwd- 0644 root root
|
|
|
|
######################################################################
|
|
# SUID/SGID Removal: nosuid
|
|
######################################################################
|
|
|
|
## To remove all SUID/SGID binaries in a directory, you can use the "nosuid"
|
|
## argument.
|
|
##
|
|
## Remove all SUID/SGID binaries/libraries.
|
|
|
|
/bin/ nosuid
|
|
/usr/local/bin/ nosuid
|
|
|
|
/usr/bin/ nosuid
|
|
/usr/local/usr/bin/ nosuid
|
|
|
|
/sbin/ nosuid
|
|
/usr/local/sbin/ nosuid
|
|
|
|
/usr/sbin/ nosuid
|
|
/usr/local/usr/sbin/ nosuid
|
|
|
|
/lib/ nosuid
|
|
/usr/local/lib/ nosuid
|
|
|
|
/lib32/ nosuid
|
|
/usr/local/lib32/ nosuid
|
|
|
|
/lib64/ nosuid
|
|
/usr/local/lib64/ nosuid
|
|
|
|
/usr/lib/ nosuid
|
|
/usr/local/usr/lib/ nosuid
|
|
|
|
/usr/lib32/ nosuid
|
|
/usr/local/usr/lib32/ nosuid
|
|
|
|
/usr/lib64/ nosuid
|
|
/usr/local/usr/lib64/ nosuid
|
|
|
|
## https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706/68
|
|
/opt/ nosuid
|
|
/usr/local/opt/ nosuid
|
|
|
|
######################################################################
|
|
# Capability Removal
|
|
######################################################################
|
|
|
|
## Ping doesn't work with Tor anyway so its capabilities are removed to
|
|
## reduce attack surface.
|
|
## anon-apps-config does this.
|
|
#/bin/ping 0744 root root none
|
|
|
|
## TODO: research
|
|
#/usr/lib/x86_64-linux-gnu/gstreamer1.0/grstreamer-1.0/gst-ptp-helper 0744 root root none
|