Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

Author: adrelanos

debian/security-misc-shared.install

@@ -106,7 +106,6 @@ usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-sh
 usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared => /usr/lib/systemd/system/user@.service.d/sysfs.conf
 usr/lib/systemd/user/fm-shim.service#security-misc-shared => /usr/lib/systemd/user/fm-shim.service
 usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf
-usr/lib/udev/rules.d/70-udisks-ignore-optical.rules#security-misc-shared => /usr/lib/udev/rules.d/70-udisks-ignore-optical.rules
 usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared => /usr/lib/udev/rules.d/95-emerg-shutdown.rules
 usr/libexec/security-misc/askpass#security-misc-shared => /usr/libexec/security-misc/askpass
 usr/libexec/security-misc/block-unsafe-logins#security-misc-shared => /usr/libexec/security-misc/block-unsafe-logins

usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared

@@ -1,14 +1,18 @@
 ## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
 ## See the file COPYING for copying conditions.
 
+## WARNING: Do not add ANY "Requires" dependencies to this unit. If a required
+## dependency terminates, systemd will terminate emerg-shutdown, and many
+## services crash when the boot drive is removed. Use "Wants" instead.
+
 [Unit]
 Description=Emergency shutdown when boot media is removed
 Documentation=https://github.com/Kicksecure/security-misc
 DefaultDependencies=no
 Before=sysinit.target
-Requires=systemd-udevd.service
+Wants=systemd-udevd.service
 After=systemd-udevd.service
-Requires=local-fs.target
+Wants=local-fs.target
 After=local-fs.target
 ConditionPathExists=!/usr/share/qubes/marker-vm
 ## Do not run emerg-shutdown.service in case 'rd.live.ram' or 'rd.live.ram=1'

usr/lib/udev/rules.d/70-udisks-ignore-optical.rules#security-misc-shared

@@ -10,16 +10,16 @@ set -o pipefail
 shopt -s nullglob
 
 run_cmd() {
-  echo "INFO: normal executing   : $@"
+  printf '%s\n' "INFO: normal executing   : $@"
   "$@"
 }
 
 run_cmd_whitelist() {
-  echo "INFO: whitelist executing: $@"
+  printf '%s\n' "INFO: whitelist executing: $@"
   "$@"
 }
 
-echo "$0: INFO: START"
+printf '%s\n' "$0: INFO: START"
 
 default_variables_set() {
   sysfs_whitelist=1
@@ -33,7 +33,7 @@ parse_configuration() {
   ## Allows for disabling the whitelist.
   local i
   for i in /usr/local/etc/hide-hardware-info.d/*.conf /etc/hide-hardware-info.d/*.conf ; do
-    bash -n "${i}"
+    bash -n -- "${i}"
     source "${i}"
   done
 }
@@ -44,19 +44,19 @@ create_whitelist() {
   elif [ "${1}" = "cpuinfo" ]; then
     whitelist_path="/proc/cpuinfo"
   else
-    echo "ERROR: ${1} is not a correct parameter."
+    printf '%s\n' "ERROR: ${1} is not a correct parameter."
     exit 1
   fi
 
-  if grep -q "${1}" /etc/group; then
+  if getent group -- "${1}" >/dev/null; then
     ## Changing the permissions of /sys recursively
     ## causes errors as the permissions of /sys/kernel/debug
     ## and /sys/fs/cgroup cannot be changed.
-    run_cmd_whitelist chgrp --quiet --recursive "${1}" "${whitelist_path}" || true
+    run_cmd_whitelist chgrp --quiet --recursive -- "${1}" "${whitelist_path}" || true
 
-    run_cmd_whitelist chmod o-rwx "${whitelist_path}"
+    run_cmd_whitelist chmod -- o-rwx "${whitelist_path}"
   else
-    echo "ERROR: The ${1} group does not exist, the ${1} whitelist was not created."
+    printf '%s\n' "ERROR: The ${1} group does not exist, the ${1} whitelist was not created."
   fi
 }
 
@@ -78,25 +78,25 @@ for i in /proc/cpuinfo /proc/bus /proc/scsi /sys ; do
         if [ "${sysfs_whitelist}" = "1" ]; then
           create_whitelist sysfs
         else
-          echo "INFO: The sysfs whitelist is not enabled. Some things may not work properly. Full sysfs hardening..."
-          run_cmd chmod og-rwx /sys
+          printf '%s\n' "INFO: The sysfs whitelist is not enabled. Some things may not work properly. Full sysfs hardening..."
+          run_cmd chmod -- og-rwx /sys
         fi
       fi
     elif [ "${i}" = "/proc/cpuinfo" ]; then
       if [ "${cpuinfo_whitelist}" = "1" ]; then
         create_whitelist cpuinfo
       else
-        echo "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly. Full cpuinfo hardening..."
-        run_cmd chmod og-rwx /proc/cpuinfo
+        printf '%s\n' "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly. Full cpuinfo hardening..."
+        run_cmd chmod -- og-rwx /proc/cpuinfo
       fi
     else
-      run_cmd chmod og-rwx "${i}"
+      run_cmd chmod -- og-rwx "${i}"
     fi
   else
     ## /proc/scsi doesn't exist on Debian so errors
     ## are expected here.
     if ! [ "${i}" = "/proc/scsi" ]; then
-      echo "ERROR: ${i} could not be found."
+      printf '%s\n' "ERROR: ${i} could not be found."
     fi
   fi
 done
@@ -109,30 +109,30 @@ if [ "${sysfs}" = "1" ]; then
     ## Using '|| true':
     ## https://github.com/Kicksecure/security-misc/pull/108
     if [ "${sysfs_whitelist}" = "1" ]; then
-      run_cmd chmod o-rwx "${i}" || true
+      run_cmd chmod -- o-rwx "${i}" || true
     else
-      run_cmd chmod og-rwx "${i}" || true
+      run_cmd chmod -- og-rwx "${i}" || true
     fi
   done
 
   ## polkit needs stat access to /sys/fs/cgroup
   ## to function properly
-  run_cmd chmod o+rx /sys /sys/fs
+  run_cmd chmod -- o+rx /sys /sys/fs
 
   ## on SELinux systems, at least /sys/fs/selinux
   ## must be visible to unprivileged users, else
   ## SELinux userspace utilities will not function
   ## properly
   if [ -d /sys/fs/selinux ]; then
-    echo "INFO: SELinux detected because folder /sys/fs/selinux exists. See also:"
-    echo "https://www.kicksecure.com/wiki/Security-misc#selinux"
+    printf '%s\n' "INFO: SELinux detected because folder /sys/fs/selinux exists. See also:"
+    printf '%s\n' "https://www.kicksecure.com/wiki/Security-misc#selinux"
     if [ "${selinux}" = "1" ]; then
-      run_cmd chmod o+rx /sys /sys/fs /sys/fs/selinux
-      echo "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function."
+      run_cmd chmod -- o+rx /sys /sys/fs /sys/fs/selinux
+      printf '%s\n' "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function."
     else
-      echo "INFO: SELinux detected, but SELinux mode is not enabled. Some userspace utilities may not work properly."
+      printf '%s\n' "INFO: SELinux detected, but SELinux mode is not enabled. Some userspace utilities may not work properly."
     fi
   fi
 fi
 
-echo "$0: INFO: END"
+printf '%s\n' "$0: INFO: END"

usr/libexec/security-misc/hide-hardware-info#security-misc-shared

@@ -86,7 +86,8 @@ parse_cmd_options() {
       exit 1
    fi
    if ! id -u "$user_name" >/dev/null 2>&1; then
-     echo "ERROR: User '$user_name' does not appear to exist!"
+      echo "ERROR: User '$user_name' does not appear to exist!" >&2
+      exit 1
    fi
 }
 
@@ -297,6 +298,13 @@ unexpected_file() {
 }
 
 restore_file() {
+   ## An extraneous file has no baseline backup to restore from; the caller
+   ## has already removed it, which is the correct action. Return early so the
+   ## 'cp' below does not fail on the missing backup and abort the entire
+   ## '--clean' run (via 'set -e') on the first extraneous file encountered.
+   if [ ! -e "$full_path_backup" ]; then
+      return 0
+   fi
    if [ "$test_mode" = "true" ]; then
       echo "Simulate restoring file... $full_path_original" >&2
       echo cp --no-dereference --archive "$full_path_backup" "$full_path_original"

usr/libexec/security-misc/virusforget#security-misc-shared

@@ -482,6 +482,39 @@ trykill:
   exit(0);
 }
 
+/* Ignore all signals, except SIGSEGV and (optionally) SIGTERM. */
+void ignore_signals(bool also_sigterm) {
+  struct sigaction sigact_swallow = { 0 };
+  int sig_idx = 0;
+
+  /* Swallow all signals that we can. */
+  sigact_swallow.sa_handler = SIG_IGN;
+  for (sig_idx = 1; sig_idx <= max_sig_num; sig_idx++) {
+    if (sig_idx == SIGSTOP) {
+      continue;
+    }
+    if (sig_idx == SIGKILL) {
+      continue;
+    }
+    if (sig_idx == SIGSEGV) {
+      continue;
+    }
+    if (sig_idx == SIGTERM && !also_sigterm) {
+      continue;
+    }
+    if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) {
+      print(fd_stderr, "Failed to set up signal ignores!\n");
+      exit(1);
+    }
+  }
+  for (sig_idx = SIGRTMIN; sig_idx <= SIGRTMAX; sig_idx++) {
+    if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) {
+      print(fd_stderr, "Failed to set up real-time signal ignores!\n");
+      exit(1);
+    }
+  }
+}
+
 /* Monitor for device removal and emergency shutdown key combos. */
 void hw_monitor(int argc, char **argv) {
   /* Working variables */
@@ -545,6 +578,8 @@ void hw_monitor(int argc, char **argv) {
     exit(1);
   }
 
+  ignore_signals(false); /* ignore all but SIGTERM */
+
   console_fd = open("/dev/console", O_RDWR);
   if (console_fd == -1) {
     print(fd_stderr, "Could not open /dev/console!\n");
@@ -684,6 +719,7 @@ void hw_monitor(int argc, char **argv) {
     }
 
     if (!bitset_get(key_flags, EV_KEY)) {
+      close(tmp_fd);
       continue;
     }
 
@@ -708,6 +744,7 @@ void hw_monitor(int argc, char **argv) {
       }
     }
     if (!supports_panic) {
+      close(tmp_fd);
       continue;
     }
 
@@ -950,8 +987,6 @@ void fifo_monitor(char **argv) {
   struct pollfd trigger_fifo_poll = { 0 };
   char trigger_fifo_charbuf = '\0';
   ssize_t trigger_fifo_readlen = 0;
-  int sig_idx = 0;
-  struct sigaction sigact_swallow = { 0 };
 
   if (strncmp(argv[2], "--timeout=", strlen("--timeout=")) != 0) {
     print(fd_stderr, "Timeout not passed for --monitor-fifo!\n");
@@ -1007,26 +1042,7 @@ void fifo_monitor(char **argv) {
   trigger_fifo_poll.fd = trigger_fifo_fd;
   trigger_fifo_poll.events = POLLIN;
 
-  /* Swallow all signals that we can. */
-  sigact_swallow.sa_handler = SIG_IGN;
-  for (sig_idx = 1; sig_idx < max_sig_num; sig_idx++) {
-    if (sig_idx == SIGSTOP) {
-      continue;
-    }
-    if (sig_idx == SIGKILL) {
-      continue;
-    }
-    if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) {
-      print(fd_stderr, "Failed to set up signal ignores!\n");
-      exit(1);
-    }
-  }
-  for (sig_idx = SIGRTMIN; sig_idx <= SIGRTMAX; sig_idx++) {
-    if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) {
-      print(fd_stderr, "Failed to set up real-time signal ignores!\n");
-      exit(1);
-    }
-  }
+  ignore_signals(true); /* ignore even SIGTERM */
 
   while (poll(&trigger_fifo_poll, 1, -1) != -1) {
     trigger_fifo_readlen = read(trigger_fifo_fd, &trigger_fifo_charbuf, 1);