Git-Mirrors/tommytran732-QubesOS-Scripts
1
0
Fork 0
mirror of https://github.com/tommytran732/QubesOS-Scripts.git synced 2025-12-18 01:24:08 -05:00
Code Issues Projects Releases Packages Wiki Activity

Replace 'sudo' with 'run0' in the Debian GNOME script

Browse source 
Signed-off-by: Ganwtrs <morga.nwinters-99@aliasvault.net>
This commit is contained in:
Ganwtrs 2025-12-08 17:27:54 -08:00 • committed by GitHub
parent fd68ee2f01
commit 7bf610dc48
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 43 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

84
debian-gnome/debian-gnome.sh
View file

@ -17,37 +17,37 @@
set -eu set -eu
unpriv(){ unpriv(){
sudo -u nobody "${@}" run0 -u nobody "${@}"
} }
download() { download() {
unpriv curl -s --proxy http://127.0.0.1:8082 "${1}" | sudo tee "${2}" > /dev/null unpriv curl -s --proxy http://127.0.0.1:8082 "${1}" | run0 tee "${2}" > /dev/null
} }
# Compliance # Compliance
sudo systemctl mask debug-shell.service run0 systemctl mask debug-shell.service
# Setting umask to 077 # Setting umask to 077
# Kicksecure defaults to zsh - I need to set it for zsh later. # Kicksecure defaults to zsh - I need to set it for zsh later.
umask 077 umask 077
sudo sed -i 's/^UMASK.*/UMASK 077/g' /etc/login.defs run0 sed -i 's/^UMASK.*/UMASK 077/g' /etc/login.defs
sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /etc/login.defs run0 sed -i 's/^HOME_MODE/#HOME_MODE/g' /etc/login.defs
echo 'umask 077' | sudo tee -a /etc/bash.bashrc echo 'umask 077' | run0 tee -a /etc/bash.bashrc
# Make home directory private # Make home directory private
sudo chmod 700 /home/* run0 chmod 700 /home/*
# Harden SSH # Harden SSH
download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/ssh/ssh_config.d/10-custom.conf /etc/ssh/ssh_config.d/10-custom.conf download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/ssh/ssh_config.d/10-custom.conf /etc/ssh/ssh_config.d/10-custom.conf
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf run0 chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
# Disable coredump # Disable coredump
download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/security/limits.d/30-disable-coredump.conf /etc/security/limits.d/30-disable-coredump.conf download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/security/limits.d/30-disable-coredump.conf /etc/security/limits.d/30-disable-coredump.conf
# Setup dconf # Setup dconf
umask 022 umask 022
sudo mkdir -p /etc/dconf/db/local.d/locks run0 mkdir -p /etc/dconf/db/local.d/locks
download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/dconf/db/local.d/locks/automount-disable /etc/dconf/db/local.d/locks/automount-disable download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/dconf/db/local.d/locks/automount-disable /etc/dconf/db/local.d/locks/automount-disable
download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/dconf/db/local.d/locks/privacy /etc/dconf/db/local.d/locks/privacy download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/dconf/db/local.d/locks/privacy /etc/dconf/db/local.d/locks/privacy
@ -56,87 +56,87 @@ download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/et
download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/dconf/db/local.d/prefer-dark /etc/dconf/db/local.d/prefer-dark download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/dconf/db/local.d/prefer-dark /etc/dconf/db/local.d/prefer-dark
download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/dconf/db/local.d/privacy /etc/dconf/db/local.d/privacy download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/dconf/db/local.d/privacy /etc/dconf/db/local.d/privacy
sudo dconf update run0 dconf update
umask 077 umask 077
# Fix portals # Fix portals
sudo mkdir -p /etc/xdg-desktop-portal run0 mkdir -p /etc/xdg-desktop-portal
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/xdg-desktop-portal/portals.conf /etc/xdg-desktop-portal/portals.conf download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/xdg-desktop-portal/portals.conf /etc/xdg-desktop-portal/portals.conf
# Avoid phased updates # Avoid phased updates
download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/apt/apt.conf.d/99sane-upgrades /etc/apt/apt.conf.d/99sane-upgrades download https://raw.githubusercontent.com/Metropolis-Nexus/Common-Files/main/etc/apt/apt.conf.d/99sane-upgrades /etc/apt/apt.conf.d/99sane-upgrades
sudo chmod 644 /etc/apt/apt.conf.d/99sane-upgrades run0 chmod 644 /etc/apt/apt.conf.d/99sane-upgrades
sudo apt-get update -y run0 apt-get update -y
sudo apt-get full-upgrade -y run0 apt-get full-upgrade -y
sudo apt-get autoremove -y run0 apt-get autoremove -y
# Debloat # Debloat
# Remove unnecessary stuff from the Qubes template # Remove unnecessary stuff from the Qubes template
sudo apt-get purge -y gnome-software gnome-system-monitor thunderbird keepassxc run0 apt-get purge -y gnome-software gnome-system-monitor thunderbird keepassxc
# Remove Network + hardware tools packages # Remove Network + hardware tools packages
sudo apt-get purge -y avahi* cups* '*nfs*' rygel '*smtp*' system-config-printer* '*telnet*' run0 apt-get purge -y avahi* cups* '*nfs*' rygel '*smtp*' system-config-printer* '*telnet*'
# Remove support for some languages and spelling # Remove support for some languages and spelling
sudo apt-get purge -y '*speech*' run0 apt-get purge -y '*speech*'
# Remove codec + image + printers # Remove codec + image + printers
sudo apt-get purge -y ImageMagick* sane* simple-scan run0 apt-get purge -y ImageMagick* sane* simple-scan
# Remove Active Directory + Sysadmin + reporting tools # Remove Active Directory + Sysadmin + reporting tools
sudo apt-get purge -y realmd run0 apt-get purge -y realmd
# Remove unnecessary network tools # Remove unnecessary network tools
sudo apt-get purge -y ifupdown mobile-broadband-provider-info modemmanager run0 apt-get purge -y ifupdown mobile-broadband-provider-info modemmanager
# Remove Gnome apps # Remove Gnome apps
sudo apt-get purge -y baobab chrome-gnome-shell eog gnome-calculator gnome-calendar gnome-characters gnome-clocks gnome-color-manager \ run0 apt-get purge -y baobab chrome-gnome-shell eog gnome-calculator gnome-calendar gnome-characters gnome-clocks gnome-color-manager \
gnome-contacts gnome-disk-utility gnome-font-viewer gnome-logs gnome-maps gnome-music gnome-remote-desktop gnome-shell-extensions \ gnome-contacts gnome-disk-utility gnome-font-viewer gnome-logs gnome-maps gnome-music gnome-remote-desktop gnome-shell-extensions \
gnome-sound-recorder gnome-tweaks gnome-user-share gnome-weather totem gnome-sound-recorder gnome-tweaks gnome-user-share gnome-weather totem
# Remove apps # Remove apps
sudo apt-get purge -y cheese evince evolution file-roller* firefox* libreoffice* seahorse shotwell synaptic* rhythmbox yelp run0 apt-get purge -y cheese evince evolution file-roller* firefox* libreoffice* seahorse shotwell synaptic* rhythmbox yelp
# Remove other packages # Remove other packages
sudo apt-get purge -y cron lvm2 lynx '*vmware*' xserver-xephyr xsettingsd run0 apt-get purge -y cron lvm2 lynx '*vmware*' xserver-xephyr xsettingsd sudo su runuser
sudo apt-get autoremove -y run0 apt-get autoremove -y
sudo apt-get autoclean run0 apt-get autoclean
# Add console group # Add console group
sudo groupadd --system console run0 groupadd --system console
sudo usermod -aG console user run0 usermod -aG console user
# Add extrepo # Add extrepo
sudo apt-get install -y extrepo run0 apt-get install -y extrepo
# Adding KickSecure's repo # Adding KickSecure's repo
sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 extrepo enable kicksecure run0 http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 extrepo enable kicksecure
# Distribution morphing # Distribution morphing
sudo apt-get update run0 apt-get update
sudo apt-get full-upgrade -y run0 apt-get full-upgrade -y
sudo apt-get install --no-install-recommends kicksecure-qubes-cli -y run0 apt-get install --no-install-recommends kicksecure-qubes-cli -y
sudo apt-get autoremove -y run0 apt-get autoremove -y
sudo repository-dist --enable --repository stable-proposed-updates run0 repository-dist --enable --repository stable-proposed-updates
sudo extrepo disable kicksecure run0 extrepo disable kicksecure
sudo mv /etc/apt/sources.list ~/ run0 mv /etc/apt/sources.list ~/
sudo touch /etc/apt/sources.list run0 touch /etc/apt/sources.list
# Restrict /proc and access # Restrict /proc and access
sudo systemctl enable --now proc-hidepid.service run0 systemctl enable --now proc-hidepid.service
# Reduce kernel information leaks # Reduce kernel information leaks
# Will break a lot of applications. The apps I use on KickSecure work fine with it so I am enabling it. # Will break a lot of applications. The apps I use on KickSecure work fine with it so I am enabling it.
sudo systemctl enable --now hide-hardware-info.service run0 systemctl enable --now hide-hardware-info.service
# Install packages # Install packages
sudo apt-get update run0 apt-get update
sudo apt-get install --no-install-recommends gnome-console flatpak qubes-ctap qubes-gpg-split -y run0 apt-get install --no-install-recommends gnome-console flatpak qubes-ctap qubes-gpg-split -y
# Flatpak update service # Flatpak update service
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/user/update-user-flatpaks.service /etc/systemd/user/update-user-flatpaks.service download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/user/update-user-flatpaks.service /etc/systemd/user/update-user-flatpaks.service