diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..1996d78e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,24 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows / pkg_install_dependabot_yml. +## Byte-identical across consumers; do not hand-edit. +## See agents/github-actions-consumer-templates.md. + +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 1 + commit-message: + prefix: "ci(deps)" + include: scope + groups: + github-actions: + patterns: + - "*" diff --git a/.github/dm-consumer.yml b/.github/dm-consumer.yml new file mode 100644 index 00000000..b61f2810 --- /dev/null +++ b/.github/dm-consumer.yml @@ -0,0 +1,44 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Per-repo parameter overrides. Read at workflow runtime by the +## reusable workflows in developer-meta-files. Top-level keys +## mirror the consumer-template basename without the +## 'consumer-' prefix. +## +## Spec: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +coverity: + ## scan.coverity.com project name (org-ai-assisted-owned; the "/" is + ## rejected in manual registration so the name is slash-free). + project-name: "org-ai-assisted-security-misc" + canonical-repos: "org-ai-assisted/security-misc" + +cppcheck: + paths: "usr/src/security-misc" + ## genmkfile names the C sources '*.c#security-misc-shared' + ## (cppcheck discovers files by extension; would otherwise miss + ## them). The codeql-prepare.sh script symlinks them to clean + ## '*.c' names. + prepare-command: "ci/codeql-prepare.sh" + +codeql-python: + ## Same prep as cppcheck: codeql-prepare.sh symlinks + ## '*.py#security-misc-shared' to clean '*.py' names so the + ## CodeQL python extractor discovers them. + prepare-command: "ci/codeql-prepare.sh" + +codeql-cpp: + ## codeql-prepare.sh handles both python and c-cpp source + ## symlinks; codeql-build.sh wraps the make invocation under + ## CodeQL's manual build-mode tracing. + prepare-command: "ci/codeql-prepare.sh" + build-command: "ci/codeql-build.sh" + +dist-ai-tests: + ## The ssh-audit config suite (security-misc-tests) stands up a + ## throwaway sshd and drives ssh-audit; python3-pytest is baseline. + apt-packages: "openssh-server openssh-client ssh-audit" diff --git a/.github/workflows/consumer-bandit.yml b/.github/workflows/consumer-bandit.yml new file mode 100644 index 00000000..ed41ac3f --- /dev/null +++ b/.github/workflows/consumer-bandit.yml @@ -0,0 +1,42 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-bandit.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Universal wrapper - no per-repo state required. The reusable +## does its own Python discovery (`.py` extension + shebang +## scan) so consumers don't need a `paths:` or `prepare-command` +## entry. Per-repo suppressions use bandit's `# nosec` inline +## comments. Install only in repos that contain Python (opt-in +## by file presence). +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-bandit.yml + +name: bandit + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + bandit: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-bandit.yml@master + permissions: + contents: read diff --git a/.github/workflows/consumer-codeql-actions.yml b/.github/workflows/consumer-codeql-actions.yml new file mode 100644 index 00000000..8391ed4b --- /dev/null +++ b/.github/workflows/consumer-codeql-actions.yml @@ -0,0 +1,48 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-actions.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Consumer wrapper for the 'actions' CodeQL language - workflow +## YAML security analysis (missing-permissions, script-injection, +## unversioned-immutable-actions, etc.). +## +## Cronless on purpose: byte-identical propagation forbids +## per-repo cron rewrites at propagation time. Push / PR / +## workflow_dispatch triggers cover the scan-on-change cases; +## rule-refresh re-scans can be kicked manually from the Actions +## tab. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml + +name: CodeQL Actions + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + actions: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master + with: + language: actions + permissions: + security-events: write + contents: read diff --git a/.github/workflows/consumer-codeql-cpp.yml b/.github/workflows/consumer-codeql-cpp.yml new file mode 100644 index 00000000..5855781d --- /dev/null +++ b/.github/workflows/consumer-codeql-cpp.yml @@ -0,0 +1,55 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-cpp.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Consumer wrapper for the 'c-cpp' CodeQL language. Cronless on +## purpose: byte-identical propagation forbids per-repo cron +## rewrites. Push / PR / workflow_dispatch triggers cover the +## scan-on-change cases. +## +## Required per-repo state in .github/dm-consumer.yml: +## +## codeql-cpp: +## build-command: "" # required +## prepare-command: "" # optional +## +## build-mode is hardcoded to 'manual' in the wrapper. The +## reusable hard-fails at workflow start if codeql-cpp.build-command +## is missing or empty. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml + +name: CodeQL c-cpp + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + c-cpp: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master + with: + language: c-cpp + build-mode: manual + dm-consumer-section: codeql-cpp + permissions: + security-events: write + contents: read diff --git a/.github/workflows/consumer-codeql-python.yml b/.github/workflows/consumer-codeql-python.yml new file mode 100644 index 00000000..9e038a3c --- /dev/null +++ b/.github/workflows/consumer-codeql-python.yml @@ -0,0 +1,61 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-python.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Consumer wrapper for the 'python' CodeQL language. Cronless +## on purpose (same rationale as consumer-codeql-actions.yml): +## byte-identical propagation forbids per-repo cron rewrites. +## Push / PR / workflow_dispatch triggers cover the +## scan-on-change cases. +## +## Also clears a flaky GHAS behavior: github-advanced-security +## speculatively creates a queued 'CodeQL' check-run when it +## detects Python in the repo. Without a workflow that submits +## Python SARIF, that check-run can stay queued forever and keep +## the PR's mergeable_state as 'unstable'. Installing this +## wrapper gives GHAS the Python analysis it expects. +## +## Install only in repos that contain Python (opt-in by file +## presence). Repos with no Python should not install this; the +## reusable would scan nothing and the GHAS speculative stub +## would not be created in the first place. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml + +name: CodeQL Python + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + python: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master + with: + language: python + ## Read .github/dm-consumer.yml `codeql-python:` section for + ## optional prepare-command (e.g. ci/codeql-prepare.sh for + ## genmkfile-tagged source-tree symlinks). Soft-skip if the + ## file or section is absent. + dm-consumer-section: codeql-python + permissions: + security-events: write + contents: read diff --git a/.github/workflows/consumer-coverity.yml b/.github/workflows/consumer-coverity.yml new file mode 100644 index 00000000..d5679b4f --- /dev/null +++ b/.github/workflows/consumer-coverity.yml @@ -0,0 +1,46 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-coverity.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Per-repo values are read by the reusable from +## .github/dm-consumer.yml at workflow runtime. Required keys: +## coverity.project-name, coverity.canonical-repos. Optional: +## coverity.apt-packages, coverity.build-command. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-coverity.yml + +name: Coverity + +on: + push: + tags: + - '*' + schedule: + - cron: '0 4 * * 5' + workflow_dispatch: + +permissions: + contents: read + +## Coverity singleton policy: G-A-006 in github-actions.md. +## Cancelling mid-flight wastes the daily free-tier slot. +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: false + +jobs: + coverity: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-coverity.yml@master + secrets: + COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }} + COVERITY_SCAN_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }} + permissions: + contents: read diff --git a/.github/workflows/consumer-cppcheck.yml b/.github/workflows/consumer-cppcheck.yml new file mode 100644 index 00000000..134945c4 --- /dev/null +++ b/.github/workflows/consumer-cppcheck.yml @@ -0,0 +1,39 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-cppcheck.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Per-repo values are read by the reusable from +## .github/dm-consumer.yml at workflow runtime. Required keys: +## cppcheck.paths. Optional: cppcheck.prepare-command. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-cppcheck.yml + +name: cppcheck + +on: + pull_request: + branches: [master] + push: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + cppcheck: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-cppcheck.yml@master + permissions: + contents: read diff --git a/.github/workflows/consumer-dist-ai-tests.yml b/.github/workflows/consumer-dist-ai-tests.yml new file mode 100644 index 00000000..f9894d7e --- /dev/null +++ b/.github/workflows/consumer-dist-ai-tests.yml @@ -0,0 +1,38 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-dist-ai-tests.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Runs this package's comprehensive dist-ai regression suites (which +## live in org-ai-assisted/dist-ai, not in-tree) on each PR and on push +## to master. The component is derived from the repo name by the +## reusable, so this wrapper carries no per-repo state. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-dist-ai-tests.yml + +name: dist-ai tests + +on: + pull_request: + branches: [master] + push: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + dist-ai-tests: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-dist-ai-tests.yml@master diff --git a/.github/workflows/local-dbus-fuzz.yml b/.github/workflows/local-dbus-fuzz.yml new file mode 100644 index 00000000..911720ba --- /dev/null +++ b/.github/workflows/local-dbus-fuzz.yml @@ -0,0 +1,93 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Coverage-guided D-Bus surface fuzzing for fm-shim-backend. +## +## fm-shim-backend implements org.freedesktop.FileManager1 on the +## session bus. dfuzzer (Debian-archive-shipped) walks every method +## / signal the service exposes and sends type-correct adversarial +## payloads. Catches the integration surface (D-Bus marshaling +## glue, sd_notify path, signal handlers, leaks across method +## calls) that an in-process libFuzzer harness on the parser alone +## would not catch. +## +## Trigger shape mirrors helper-scripts' local-python-fuzz.yml: +## workflow_dispatch + path-filtered pull_request. PRs that don't +## touch the shim backend, its compile script, the dfuzzer build / +## runner, or this workflow itself are skipped to keep cost bounded. +## +## Workflow body lives in ci/dfuzzer-run.sh (R-100); this file +## carries only the trigger schedule + apt install + invocation. + +name: dfuzzer (D-Bus) + +on: + workflow_dispatch: + inputs: + seconds: + description: 'Per-method dfuzzer time budget (seconds)' + required: false + default: '60' + pull_request: + branches: [master] + paths: + - 'usr/src/security-misc/fm-shim-backend.c#security-misc-shared' + - 'usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared' + - 'ci/dfuzzer-build.sh' + - 'ci/dfuzzer-run.sh' + - 'ci/codeql-prepare.sh' + - '.github/workflows/local-dbus-fuzz.yml' + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + dfuzzer: + name: dfuzzer (org.freedesktop.FileManager1) + runs-on: ubuntu-latest + timeout-minutes: 20 + + ## CI runs only where we enabled it; ANDed with the existing guard. + ## Unset variable -> skipped, no runner, run stays green. + if: >- + vars.CI_ENABLED_ORG_AI_ASSISTED == 'true' + && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') + + permissions: + contents: read + + env: + DFUZZER_SECONDS: ${{ inputs.seconds || '60' }} + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + ## install-deps composite action: apt deps for dfuzzer-build.sh + ## (build + runtime + fm-shim backend compile) plus genmkfile + + ## helper-scripts (org-standard install path; see + ## ci/dfuzzer-build.sh header for per-package rationale). + - name: Install apt deps + genmkfile + helper-scripts + uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master + with: + apt-packages: 'meson ninja-build xsltproc docbook-xsl libglib2.0-dev dbus dbus-x11 libdbus-1-dev libsystemd-dev pkg-config gcc' + + - name: Build dfuzzer from source + ## dfuzzer is not packaged for Ubuntu 24.04; build from + ## pinned upstream tag. See ci/dfuzzer-build.sh. + run: ci/dfuzzer-build.sh + + - name: Prepare extension-clean source paths + run: ci/codeql-prepare.sh + + - name: Run dfuzzer + run: ci/dfuzzer-run.sh diff --git a/.github/workflows/local-dist-ai-ssh-prod.yml b/.github/workflows/local-dist-ai-ssh-prod.yml new file mode 100644 index 00000000..901fd493 --- /dev/null +++ b/.github/workflows/local-dist-ai-ssh-prod.yml @@ -0,0 +1,41 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Hard-gating scan of the live production SSH servers (kicksecure.com, +## whonix.org) against security-misc's shipped ssh-audit server policy, via the +## dist-ai --e2e suite security-misc-tests-e2e (which lives in +## org-ai-assisted/dist-ai, not in-tree). This is NOT the managed +## consumer-dist-ai-tests.yml (--core) template. +## +## It runs on push to master, on a daily schedule, and on demand -- NOT on +## every pull request: a feature PR cannot change the production servers, so +## gating unrelated PRs on live external state would only wedge them. A failure +## here means a production server dropped (or never had) the security-misc SSH +## hardening; fix is on the host. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-dist-ai-tests.yml + +name: dist-ai ssh prod + +on: + push: + branches: [master] + schedule: + - cron: '17 6 * * *' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + dist-ai-ssh-prod: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-dist-ai-tests.yml@master + with: + categories: '--e2e' diff --git a/.github/workflows/local-permission-hardener-test.yml b/.github/workflows/local-permission-hardener-test.yml new file mode 100644 index 00000000..e1d7e320 --- /dev/null +++ b/.github/workflows/local-permission-hardener-test.yml @@ -0,0 +1,64 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Regression test for the permission-hardener config parser. +## +## Scope is intentionally narrow: it exercises load_state()'s +## right-anchored option parsing so a config filename containing a +## space is parsed as one entry instead of being split and silently +## dropped. See ci/tests/permission_hardener/test_whitespace_filename.sh. + +## FIXME: The actual scripts run here should be in dist-ai. + +## WARNING: The new test scripts will not be reviewed by humans as they are +## slated to be moved to dist-ai. This workflow file has been reviewed. + +name: Test permission-hardener + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + test: + name: Test permission-hardener + runs-on: ubuntu-latest + timeout-minutes: 10 + + ## CI runs only where we enabled it; ANDed with the existing guard. + ## Unset variable -> skipped, no runner, run stays green. + if: >- + vars.CI_ENABLED_ORG_AI_ASSISTED == 'true' + && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + ## permission-hardener sources helper-scripts (log_run_die.sh, + ## safe_echo.sh, strings.bsh) at startup; install-deps provides + ## them under /usr/libexec/helper-scripts/. + - name: Install genmkfile + helper-scripts + safe-rm + uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master + with: + apt-packages: 'safe-rm' + + - name: Whitespace-in-filename parser regression test + ## Root: the test writes a temp config under + ## /etc/permission-hardener.d/ and runs 'print-policy'. + run: sudo -E ci/tests/permission_hardener/test_whitespace_filename.sh diff --git a/.github/workflows/local-python-lint.yml b/.github/workflows/local-python-lint.yml new file mode 100644 index 00000000..6ef773d2 --- /dev/null +++ b/.github/workflows/local-python-lint.yml @@ -0,0 +1,107 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Simple Python lint for fm_shim_frontend. +## +## Scope is intentionally narrow: +## - usr/lib/python3/dist-packages/fm_shim_frontend/ (the only +## Python in this repo) +## +## Tools: +## flake8 --select=F Pyflakes-class checks only (F-codes: +## undefined names, unused imports, unused +## local variables, etc.). Skips PEP8 style +## (E/W codes) - the codebase uses '##' block +## comments which would trigger E266 noise. +## flake8 over plain pyflakes because pyflakes +## does not honor '# noqa' (the standard +## escape-hatch for intentional violations); +## flake8 wraps pyflakes and adds that +## support. Pylint was deliberately not +## enabled here because pylint's interaction +## with PyQt5 produces a flood of +## 'no-name-in-module' false positives (PyQt5 +## generates its symbols dynamically; pylint +## cannot see them statically without a +## per-symbol --extension-pkg-allow-list that +## defeats the simplicity of this workflow). +## +## Source files in this repo carry a '#' suffix per +## the genmkfile convention. pyflakes discovers sources by file +## extension; ci/codeql-prepare.sh creates extension-clean symlinks +## that re-use that fix. + +name: Lint Python + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + lint: + name: Lint Python + runs-on: ubuntu-latest + timeout-minutes: 10 + + ## CI runs only where we enabled it; ANDed with the existing guard. + ## Unset variable -> skipped, no runner, run stays green. + if: >- + vars.CI_ENABLED_ORG_AI_ASSISTED == 'true' + && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + ## install-deps composite action installs apt deps + genmkfile + ## + helper-scripts. helper-scripts provides the stdisplay + ## Python module that fm_shim_frontend imports at module top + ## level; with the real package present we run the tests + ## against production modules instead of conftest.py stubs. + ## + ## python3-pyqt5 + python3-pyqt5.sip: runtime deps of + ## fm_shim_frontend's Qt UI; flake8 / python3-pytest / + ## python3-hypothesis: the lint + property-test toolchain. + - name: Install apt deps + genmkfile + helper-scripts + uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master + with: + apt-packages: 'flake8 python3-pytest python3-hypothesis python3-pyqt5 python3-pyqt5.sip' + + - name: Prepare extension-clean Python source paths + run: ci/codeql-prepare.sh + + - name: flake8 (pyflakes checks only) + ## Pass the symlinked clean-name files explicitly. Without + ## the explicit list, flake8 walks the directory and would + ## see each source twice (once via the symlink, once via + ## the original '*.py#tag') - causing duplicate findings. + run: | + flake8 --select=F -- \ + usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py \ + usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py + + - name: Hypothesis property tests + ## Coverage-based property fuzzing of the URI-validation + ## chokepoint (get_path_list_from_uris). Already caught one + ## real ENAMETOOLONG-on-long-path crash bug at introduction + ## (see ci/tests/fm_shim_frontend/test_property.py header). + env: + PYTHONPATH: usr/lib/python3/dist-packages + run: | + python3 -m pytest --import-mode=importlib -q \ + ci/tests/fm_shim_frontend/test_property.py diff --git a/.gitignore b/.gitignore index ef58a2f7..fb2e7236 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ pkgs +**/__pycache__/ diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 00000000..81bfc6b8 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,26 @@ +# Agent Guidelines for security-misc + +## General Guidelines + +- Check `./agents/` for component-specific notes before reviewing or commenting. +- Upstream repository: Kicksecure/security-misc +- No need to mention accepted/fixed/done things unless there is a specific + reason why it is needed in memory. + +## Component Notes + +- [fm-shim](./agents/fm-shim.md) - FileManager1 D-Bus shim (backend + frontend) +- [fuzzing](./agents/fuzzing.md) - Hypothesis property tests under + `ci/tests//`; ClusterFuzzLite / libFuzzer not yet wired up. + +## pkg-config quoting in build script + +`pkg-config` output is designed to be word-split by shells. Quoting it via bash +arrays just reimplements word splitting manually. The unquoted +`$(pkg-config ...)` is intentional. Upstream has a NOTE comment explaining this. +Do not re-propose this change. + +## Accepted Threat Model + +- systemd user manager environment is trusted. +- Python >= 3.13.5 required. diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 00000000..a263c705 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,3 @@ +# CLAUDE.md + +See [AGENTS.md](AGENTS.md). diff --git a/COPYING b/COPYING index 2a78337c..829d9096 100644 --- a/COPYING +++ b/COPYING @@ -1,14 +1,14 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Files: * -Copyright: 2012 - 2023 ENCRYPTED SUPPORT LP +Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC License: AGPL-3+ License: AGPL-3+ GNU AFFERO GENERAL PUBLIC LICENSE Version 3, 19 November 2007 . - Copyright (C) 2007 Free Software Foundation, Inc. + Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. . @@ -650,7 +650,7 @@ License: AGPL-3+ GNU Affero General Public License for more details. . You should have received a copy of the GNU Affero General Public License - along with this program. If not, see . + along with this program. If not, see . . Also add information on how to contact you by electronic and paper mail. . @@ -665,4 +665,4 @@ License: AGPL-3+ You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see - . + . diff --git a/README.md b/README.md index e47754fe..c92ada13 100644 --- a/README.md +++ b/README.md @@ -1,281 +1,607 @@ # Enhances miscellaneous security settings +Note that all the security features seen in this repository may not yet be incorporated into a public Kicksecure/Whonix release. Refer to the [forums](https://forums.kicksecure.com/c/news/5) with accompanying dates to see what is actually included in the most recent release. + ## Kernel hardening This section is inspired by the Kernel Self Protection Project (KSPP). It -implements all recommended Linux kernel settings by the KSPP and many more. +attempts to implement all recommended Linux kernel settings by the KSPP and +many more sources. -- https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project +- https://kspp.github.io/Recommended_Settings +- https://github.com/KSPP/kspp.github.io ### sysctl -sysctl settings are configured via the `/etc/sysctl.d/30_security-misc.conf` +sysctl settings are configured via the `/usr/lib/sysctl.d/990-security-misc.conf` +configuration file and significant hardening is applied to a myriad of components. + +#### Kernel space + +- Restrict access to kernel addresses through the use of kernel pointers regardless + of user privileges. + +- Restrict access to the kernel logs to `CAP_SYSLOG` as they often contain + sensitive information. + +- Prevent kernel information leaks in the console during boot. + +- Restrict usage of `bpf()` to `CAP_BPF` to prevent the loading of BPF programs + by unprivileged users. + +- Restrict loading TTY line disciplines to `CAP_SYS_MODULE`. + +- Restrict the `userfaultfd()` syscall to `CAP_SYS_PTRACE`, which reduces the + likelihood of use-after-free exploits. + +- Disable `kexec` as it can be used to replace the running kernel. + +- Entirely disable the SysRq key so that the Secure Attention Key (SAK) + can no longer be utilized. See [documentation](https://www.kicksecure.com/wiki/SysRq). + +- Optional - Disable all use of user namespaces. + +- Optional - Restrict user namespaces to `CAP_SYS_ADMIN` as they can lead to substantial + privilege escalation. + +- Restrict kernel profiling and the performance events system to `CAP_PERFMON`. + +- Force immediate system reboot on the occurrence of a single kernel panic, reducing the + risk and impact of denial-of-service attacks and both cold and warm boot attacks. + +- Force the kernel to immediately panic on both "oopses" (which can potentially indicate + and thwart certain kernel exploitation attempts) and kernel warnings in the `WARN()` path. + +- Optional - Force immediate kernel panic on OOM (out of memory) which with the above setting + will force an immediate system reboot as opposed to placing any reliance on the oom_killer + to avoid arbitrarily terminating security features based on their OOM score. Note this + creates the risk of userspace-based denial-of-service attacks that maliciously fill memory. + +- Optional - Force immediate kernel panics upon receiving NMIs (Non-Maskable Interrupts) + triggered by serious hardware-level I/O issues, uncorrectable memory and hardware errors, + and undefined or unknown sources in order to prevent data corruption. + +- Disable the use of legacy TIOCSTI operations which can be used to inject keypresses. + +- Disable asynchronous I/O as `io_uring` has been the source of numerous kernel exploits. + +- Disable 32-bit vDSO mappings as they are a legacy compatibility feature. + +#### User space + +- Disable the usage of `ptrace()` by all processes as it enables programs to inspect + and modify other active processes. + +- Maximize the bits of entropy used for mmap ASLR across all CPU architectures. + +- Prevent hardlink and symlink TOCTOU races in world-writable directories. + +- Disallow unintentional writes to files in world-writable directories unless + they are owned by the directory owner to mitigate some data spoofing attacks. + +- Randomize the addresses (ASLR) for mmap base, stack, VDSO pages, and heap. + +- Raise the minimum address a process can request for memory mapping to 64KB to + protect against kernel null pointer dereference vulnerabilities. + +- Increase the maximum number of memory map areas a process is able to utilize to 1,048,576. + +- Optional - Disallow registering interpreters for various (miscellaneous) binary formats based + on a magic number or their file extension to prevent unintended code execution. + See issue: https://github.com/Kicksecure/security-misc/issues/267 + +#### Core dumps + +- Disable core dump files and prevent their creation. If core dump files are + enabled, they will be named based on `core.PID` instead of the default `core`. + +#### Swap space + +- Limit the copying of potentially sensitive content in memory to the swap device. + +#### Networking + +- Enable hardening of the BPF JIT compiler to protect against JIT spraying. + +- Enable TCP SYN cookie protection to assist against SYN flood attacks. + +- Protect against TCP time-wait assassination hazards. + +- Enable reverse path filtering (source validation) of packets received + from all interfaces to prevent IP spoofing. + +- Disable ICMP redirect acceptance and redirect sending messages to prevent + man-in-the-middle attacks and minimize information disclosure. + +- Deny sending and receiving shared media redirects to reduce the risk of IP + spoofing attacks. + +- Enable ARP filtering to mitigate some ARP spoofing and ARP cache poisoning attacks. + +- Respond to ARP requests only if the target IP address is on-link, + preventing some IP spoofing attacks. + +- Drop gratuitous ARP packets to prevent ARP cache poisoning via + man-in-the-middle and denial-of-service attacks. + +- Ignore ICMP echo requests to prevent clock fingerprinting and Smurf attacks. + +- Ignore bogus ICMP error responses. + +- Disable source routing which allows users to redirect network traffic that + can result in man-in-the-middle attacks. + +- Do not accept IPv6 router advertisements (RAs) and solicitations which can result + in both man-in-the-middle and denial-of-service attacks. + +- Optional - Disable SACK and DSACK as they have historically been a known + vector for exploitation. + +- Disable TCP timestamps as they can allow detecting the system time. + +- Disable reuse of `TIME_WAIT` sockets for new outgoing connections as the above + setting disables TCP timestamps. + +- Log packets with impossible source or destination addresses to enable further + inspection and analysis. + +- Optional - Enable IPv6 Privacy Extensions. + +- Documentation: https://www.kicksecure.com/wiki/Networking + +#### CD-ROM/DVD + +- Disable CD-ROM/DVD drive automatic tray closure and ejection functionality to + prevent scripted tray cycling attacks. + +- Disable all CD-ROM/DVD drive debug messages to limit information disclosure. + +- Optional - Restrict CD-ROM/DVD drives by disabling kernel checking and hardware access. + +### Boot parameters + +Mitigations for known CPU vulnerabilities are enabled in their strictest form +and simultaneous multithreading (SMT) is disabled. See the +`/etc/default/grub.d/40_cpu_mitigations.cfg` configuration file. + +Importantly, we do not rely on the use of the already enabled-by-default `mitigations=auto` +kernel boot parameter to perform CPU mitigations like many other distributions. This is +because its use is both totally redundant and it does not apply all hardening settings +to their strictest possible levels. See issue: +https://github.com/Kicksecure/security-misc/issues/199#issuecomment-3327391859. + +Note, to achieve complete protection for known CPU vulnerabilities, the latest +security microcode (BIOS/UEFI) updates must be installed on the system. Furthermore, +if using Secure Boot, the Secure Boot Forbidden Signature Database (DBX) must be kept +up to date through [UEFI Revocation List](https://github.com/microsoft/secureboot_objects) updates. + +CPU mitigations: + +- Disable Simultaneous Multithreading (SMT) + +- Spectre Side Channels (BTI and BHI) + +- Enable Kernel Page Table Isolation (PTI) + +- Meltdown + +- Speculative Store Bypass (SSB) + +- L1 Terminal Fault (L1TF) + +- Microarchitectural Data Sampling (MDS) + +- TSX Asynchronous Abort (TAA) + +- iTLB Multihit + +- Special Register Buffer Data Sampling (SRBDS) + +- L1D Flushing + +- Processor MMIO Stale Data + +- Arbitrary Speculative Code Execution with Return Instructions (Retbleed) + +- Cross-Thread Return Address Predictions + +- Optional - Speculative Return Stack Overflow (SRSO) + +- Gather Data Sampling (GDS) + +- Register File Data Sampling (RFDS) + +- Indirect Target Selection (ITS) + +- VMScape + +Boot parameters relating to kernel hardening, DMA mitigations, and entropy +generation are outlined in the `/etc/default/grub.d/40_kernel_hardening.cfg` configuration file. -- A kernel pointer points to a specific location in kernel memory. These can - be very useful in exploiting the kernel so they are restricted to - `CAP_SYSLOG`. +Kernel space: + +- Disable merging of slabs with similar size, which reduces the risk of + triggering heap overflows and limits influencing slab cache layout. + +- Enable sanity checks and red zoning via slab debugging. This will implicitly + disable kernel pointer hashing, leaking very sensitive information to root. + Re-enabling hashed pointers will be possible when using Linux kernel >= 6.17. + https://github.com/Kicksecure/security-misc/issues/253 + +- Enable memory zeroing at both allocation and free time, which mitigates some + use-after-free vulnerabilities by erasing sensitive information in memory. + +- Enable the kernel page allocator to randomize free lists to limit some data + exfiltration and ROP attacks, especially during the early boot process. + +- Enable randomization of the kernel stack offset on syscall entries to harden + against memory corruption attacks. + +- Disable vsyscalls as they are vulnerable to ROP attacks and have now been + replaced by vDSO. + +- Restrict access to debugfs by not registering the file system since it can + contain sensitive information. + +- Force immediate system reboot on the occurrence of a single kernel panic, reducing the + risk and impact of denial-of-service attacks and both cold and warm boot attacks. + +- Force the kernel to immediately panic on both "oopses" (which can potentially indicate + and thwart certain kernel exploitation attempts) and kernel warnings in the `WARN()` path. + +- Optional - Force the kernel to immediately panic if it becomes tainted. Some reasons include + upon using out of specification hardware, bad page states, ACPI tables being overridden, + severe firmware bugs, in-kernel tests run, or mutating `fwctl` debug operations. It can also + include the loading of proprietary or out-of-tree modules. + +- Prevent sensitive kernel information leaks in the console during boot. + +- Enable the kernel Electric-Fence sampling-based memory safety error detector + which can identify heap out-of-bounds access, use-after-free, and invalid-free errors. + +- Disable 32-bit vDSO mappings as they are a legacy compatibility feature. -- The kernel logs are restricted to `CAP_SYSLOG` as they can often leak - sensitive information such as kernel pointers. +- Use kCFI as the default CFI implementation as it is more resilient to attacks that are + able to write arbitrary executables into memory omitting the necessary hash validation. -- The `ptrace()` system call is restricted to `CAP_SYS_PTRACE`. +- Disable support for all 32-bit x86 processes and syscalls to reduce attack surface. -- eBPF is restricted to `CAP_BPF` (`CAP_SYS_ADMIN` on kernel versions prior to - 5.8) and JIT hardening techniques such as constant blinding are enabled. +- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs + and other persistent data to either the UEFI variable storage or ACPI ERST backends. -- Restricts performance events to `CAP_PERFMON` (`CAP_SYS_ADMIN` on kernel - versions prior to 5.8). +- Restrict processes from modifying their own memory mappings unless actively done via + `ptrace()` for debugging in order to limit self-modification which can trigger exploits. -- Restricts loading line disciplines to `CAP_SYS_MODULE` to prevent - unprivileged attackers from loading vulnerable line disciplines with the - `TIOCSETD` ioctl which has been abused in a number of exploits before. +- Optional - Prevent runaway privileged processes from writing to block devices that are mounted by + filesystems to protect against filesystem corruption and kernel crashes. May cause breakages with + disk management operations such as disk resizing and VDI compaction in virtual machines. -- Restricts the `userfaultfd()` syscall to `CAP_SYS_PTRACE` as `userfaultfd()` - is often abused to exploit use-after-free flaws. +- Optional - On compatible AMD CPUs enable Secure Memory Encryption (SME) to protect against + cold boot attacks and Secure Encrypted Virtualization (SEV) for further guest memory isolation. -- Kexec is disabled as it can be used to load a malicious kernel and gain - arbitrary code execution in kernel mode. +Direct memory access: -- Randomises the addresses for mmap base, heap, stack, and VDSO pages. +- Enable strict IOMMU translation to protect against some DMA attacks via the use + of both CPU manufacturer-specific drivers and kernel settings. -- Prevents unintentional writes to attacker-controlled files. +- Clear the busmaster bit on all PCI bridges during the EFI hand-off, which disables + DMA before the IOMMU is configured. May cause boot failure on certain hardware. -- Prevents common symlink and hardlink TOCTOU races. +Entropy: -- Disables SysRq key completely. - * Therefore Secure Attention Key (SAK) cannot be used. - * https://www.kicksecure.com/wiki/SysRq +- Do not credit the CPU seeds as an entropy source at boot in order to maximize the + absolute quantity of entropy in the combined pool. This is desirable for all + cryptographic operations to avoid reliance on proprietary RDRAND and RDSEED CPU + instructions for random number generation that have long history of being defective. -- The kernel is only allowed to swap if it is absolutely necessary. This - prevents writing potentially sensitive contents of memory to disk. +- Do not credit the bootloader seeds as an entropy source at boot to maximize the + absolute quantity of entropy in the combined pool. This is desirable for all + cryptographic operations as seeds passed by the bootloader could be tampered. -- TCP timestamps are disabled as it can allow detecting the system time. +- Obtain more entropy at boot from RAM as the runtime memory allocator is being + initialized to maximize the absolute quantity of entropy in the combined pool. -- Enforces the logging of martian packets, those with a source address which - is blatantly wrong. +Networking: -- Set coredump file name based on core_pattern value instead of the default of - naming it 'core'. +- Optional - Disable the entire IPv6 stack to reduce attack surface. ### mmap ASLR -- The bits of entropy used for mmap ASLR are maxed out via - `/usr/libexec/security-misc/mmap-rnd-bits` (set to the values of - `CONFIG_ARCH_MMAP_RND_BITS_MAX` and `CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX` - that the kernel was built with), therefore improving its effectiveness. +- The bits of entropy used for mmap ASLR for all CPU architectures are maxed + out via `/usr/libexec/security-misc/mmap-rnd-bits` (set to the values of + `CONFIG_ARCH_MMAP_RND_BITS_MAX` and `CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX` + that the kernel was built with), therefore improving its effectiveness. -### Boot parameters +### Kernel Self Protection Project (KSPP) compliance status + +**Summary:** + +`security-misc` is in full compliance with KSPP recommendations wherever feasible. However, +there are a few cases of partial or non-compliance due to technical limitations. + +- [KSPP Recommended Settings](https://kspp.github.io/Recommended_Settings) + +**Full compliance:** + +More than 30 kernel boot parameters and over 30 sysctl settings are fully aligned with +the KSPP's recommendations. -Boot parameters are outlined in configuration files located in the -`etc/default/grub.d/` directory. +**Partial compliance:** -- Slab merging is disabled which significantly increases the difficulty of - heap exploitation by preventing overwriting objects from merged caches and - by making it harder to influence slab cache layout. +1. Kernel boot parameter `proc_mem.force_override=never` -- Memory zeroing at allocation and free time is enabled to mitigate some - use-after-free vulnerabilities and erase sensitive information in memory. +Restrict processes from modifying their own memory mappings by completely disables use of +`/proc/PID/mem` to write to protected pages. Can be enabled easily if required. -- Page allocator freelist randomization is enabled. +- [security-misc pull request #332](https://github.com/Kicksecure/security-misc/pull/332) -- Kernel Page Table Isolation is enabled to mitigate Meltdown and increase - KASLR effectiveness. +**Non-compliance:** -- vsyscalls are disabled as they are obsolete, are at fixed addresses and - thus, are a potential target for ROP. +2. `sysctl user.max_user_namespaces=0` -- The kernel panics on oopses to thwart certain kernel exploits. +Disables user namespaces entirely. Not recommended due to the potential for widespread breakages. -- Enables randomisation of the kernel stack offset on syscall entries. +- [security-misc pull request #263](https://github.com/Kicksecure/security-misc/pull/263) -- All mitigations for known CPU vulnerabilities are enabled and SMT is - disabled. +3. `sysctl fs.binfmt_misc.status=0` -- IOMMU is enabled to prevent DMA attacks along with strict enforcement of - IOMMU TLB invalidation so devices will never be able to access stale data - contents. +Disables the registration of interpreters for miscellaneous binary formats. Currently not +feasible due to compatibility issues with Firefox. -- Distrust the 'randomly' generated CPU and bootloader seeds. +- [security-misc pull request #249](https://github.com/Kicksecure/security-misc/pull/249) +- [security-misc issue #267](https://github.com/Kicksecure/security-misc/issues/267) + +4. Kernel boot parameter `hash_pointers=always` + +Force all exposed pointers to be hashed and must be used in combination with the already enabled +`slab_debug=FZ` kernel boot parameter. Currently is not possible as requires Linux kernel >= 6.17. + +- [security-misc issue #253](https://github.com/Kicksecure/security-misc/issues/253) +- [security-misc pull request #325](https://github.com/Kicksecure/security-misc/pull/325) ### Kernel Modules #### Kernel Module Signature Verification -Not yet due to issues: +Not yet implemented due to issues: -- https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/64 -- https://github.com/dell/dkms/issues/359 +- https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/64 +- https://github.com/dell/dkms/issues/359 See: -- `/etc/default/grub.d/40_only_allow_signed_modules.cfg` +- `/etc/default/grub.d/40_signed_modules.cfg` #### Disables the loading of new modules to the kernel after the fact -Not yet due to issues: +Not yet implemented due to issues: -- https://github.com/Kicksecure/security-misc/pull/152 +- https://github.com/Kicksecure/security-misc/pull/152 A systemd service dynamically sets the kernel parameter `modules_disabled` to 1, preventing new modules from being loaded. Since this isn't configured directly within systemctl, it does not break the loading of legitimate and necessary modules for the user, like drivers etc., given they are plugged in on startup. -#### Disables and blacklists kernel modules - -Certain kernel modules are disabled and blacklisted by default to reduce attack -surface via the `/etc/modprobe.d/30_security-misc.conf` configuration file. - -- Deactivates Netfilter's connection tracking helper - this module increases - kernel attack surface by enabling superfluous functionality such as IRC - parsing in the kernel. Hence, this feature is disabled. - -- Thunderbolt and numerous FireWire kernel modules are also disabled as they - are often vulnerable to DMA attacks. - -- The MSR kernel module is disabled to prevent CPU MSRs from being abused to - write to arbitrary memory. - -- Uncommon network protocols are blacklisted. This includes: - - - DCCP - Datagram Congestion Control Protocol - - SCTP - Stream Control Transmission Protocol - - RDS - Reliable Datagram Sockets - - TIPC - Transparent Inter-process Communication - - HDLC - High-Level Data Link Control - - AX25 - Amateur X.25 - - NetRom - - X25 - - ROSE - - DECnet - - Econet - - af_802154 - IEEE 802.15.4 - - IPX - Internetwork Packet Exchange - - AppleTalk - - PSNAP - Subnetwork Access Protocol - - p8023 - Novell raw IEEE 802.3 - - p8022 - IEEE 802.2 - - CAN - Controller Area Network - - ATM - -- Disables a large array of uncommon file systems and network file systems - that reduces the attack surface especially against legacy approaches. - -- The vivid kernel module is only required for testing and has been the cause - of multiple vulnerabilities so it is disabled. - -- Provides some disabling of the interface between the [Intel Management - Engine (ME)](https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html) - and the OS. - -- Incorporates much of - [Ubuntu's](https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d?h=ubuntu/disco) - default blacklist of modules to be blocked from automatically loading. - However, they are still permitted to load. - -- Blocks automatic loading of the modules needed to use of CD-ROM devices by - default. Not completely disabled yet. +#### Blacklist and disable kernel modules + +Conntrack: Deactivates Netfilter's connection tracking helper module which +increases kernel attack surface by enabling superfluous functionality such +as IRC parsing in the kernel. See `/etc/modprobe.d/30_security-misc_conntrack.conf`. + +Certain kernel modules are blacklisted by default to reduce attack surface via +`/etc/modprobe.d/30_security-misc_blacklist.conf`. Blacklisting prevents kernel +modules from automatically starting. + +- CD-ROM/DVD: Blacklist modules required for CD-ROM/DVD devices. + +- Miscellaneous: Blacklist an assortment of other modules to prevent them from + automatically loading. + +Specific kernel modules are entirely disabled to reduce attack surface via +`/etc/modprobe.d/30_security-misc_disable.conf`. Disabling prohibits kernel +modules from starting. This approach should not be considered comprehensive; +rather, it is a form of badness enumeration. Any potential candidates for future +disabling should first be blacklisted for a suitable amount of time. + +Hardware modules: + +- Optional - Bluetooth: Disabled to reduce attack surface. + +- Optional - CPU MSRs: Disabled as can be abused to access other trust domains + and write to arbitrary memory. + +- FireWire (IEEE 1394): Disabled as they are often vulnerable to DMA attacks. + +- GPS: Disable GPS-related modules such as those required for Global Navigation + Satellite Systems (GNSS). + +- Optional - Intel Management Engine (ME): Provides some disabling of the interface + between the Intel ME and the OS. May lead to breakages in places such as firmware + updates, security, power management, display, and DRM. See discussion: https://github.com/Kicksecure/security-misc/issues/239 + +- Intel Platform Monitoring Technology (PMT) Telemetry: Disable some functionality + of the Intel PMT components. + +- Thunderbolt: Disabled as they are often vulnerable to DMA attacks. + +File system modules: + +- File Systems: Disable uncommon and legacy file systems. + +- Network File Systems: Disable uncommon and legacy network file systems. + +Networking modules: + +- Network Protocols: A wide array of uncommon and legacy network protocols and drivers + are disabled. + +Miscellaneous modules: + +- Amateur Radios: Disabled to reduce attack surface. + +- Floppy Disks: Disabled to reduce attack surface. + +- Framebuffer (fbdev): Disabled as these drivers are well-known to be buggy, cause + kernel panics, and are generally only used by legacy devices. + +- Joysticks: Disabled to reduce attack surface. + +- Replaced Modules: Disabled legacy drivers that have been entirely replaced and + superseded by newer drivers. + +- RNDIS - Disabled as believed to have unfixable buffer overflow issues. + +- Optional - USB Video Device Class: Disables the USB-based video streaming driver for + devices like some webcams and digital camcorders. + +- Optional - Vivid: Disabled to reduce attack surface given previous vulnerabilities. ### Other -- A systemd service clears the System.map file on boot as these contain kernel - pointers. The file is completely overwritten with zeroes to ensure it cannot - be recovered. See: +- A systemd service clears the System.map file on boot as these contain kernel + pointers. The file is completely overwritten with zeroes to ensure it cannot + be recovered. See: `/etc/kernel/postinst.d/30_remove-system-map` -`/lib/systemd/system/remove-system-map.service` +`/usr/lib/systemd/system/remove-system-map.service` `/usr/libexec/security-misc/remove-system.map` -- Coredumps are disabled as they may contain important information such as - encryption keys or passwords. See: +- Coredumps are disabled as they may contain important information such as + encryption keys or passwords. See: `/etc/security/limits.d/30_security-misc.conf` -`/etc/sysctl.d/30_security-misc.conf` +`/usr/lib/sysctl.d/30_security-misc.conf` -`/lib/systemd/coredump.conf.d/30_security-misc.conf` +`/usr/lib/systemd/coredump.conf.d/30_security-misc.conf` -- An initramfs hook sets the sysctl values in `/etc/sysctl.conf` and - `/etc/sysctl.d` before init is executed so sysctl hardening is enabled as - early as possible. This is implemented for `initramfs-tools` only because - this is not needed for `dracut` because `dracut` does that by default, at - least on `systemd` enabled systems. Not researched for non-`systemd` systems - by the author of this part of the readme. +- PStore is disabled as crash logs can contain sensitive system data such as + kernel version, hostname, and users. See: -## Network hardening + `/usr/lib/systemd/pstore.conf.d/30_security-misc.conf` + +- An initramfs hook used to set the sysctl values in `/etc/sysctl.conf` and + `/etc/sysctl.d` before init is executed so sysctl hardening is enabled as + early as possible. This was implemented for `initramfs-tools` only because + this is not needed for `dracut` as `dracut` does that by default, at + least on `systemd` enabled systems. Not researched for non-`systemd` systems + by the author of this part of the readme. This is no longer implemented for + `initramfs-tools` as `initramfs-tools` support has been deprecated. + +- Kernel console output is suppressed during boot by setting `loglevel=0` and + `quiet` boot parameters to prevent sensitive kernel information from being + visible to physical observers. Must be paired with the `kernel.printk` sysctl + for complete effect. See: -- TCP syncookies are enabled to prevent SYN flood attacks. + `/etc/default/grub.d/41_quiet_boot.cfg` -- ICMP redirect acceptance, ICMP redirect sending, source routing and IPv6 - router advertisements are disabled to prevent man-in-the-middle attacks. + `/usr/lib/sysctl.d/30_silent-kernel-printk.conf` + +- Recovery mode is restricted by removing GRUB recovery entries, halting + instead of dropping to an emergency shell during initramfs failures, and + disabling the dracut recovery shell entirely. This prevents physical attackers + from booting into a root shell via recovery options. See: + - `/etc/default/grub.d/41_recovery_restrict.cfg` + - [Recovery Mode](https://www.kicksecure.com/wiki/Recovery#Recovery_Mode) + - [Emergency Recovery Console](https://www.kicksecure.com/wiki/Recovery#Emergency_Recovery_Console) + - Is not an implementation of [Protecting the Kernel Command Line](https://www.kicksecure.com/wiki/Verified_Boot#Protecting_the_Kernel_Command_Line). + +## Network hardening -- The kernel is configured to ignore all ICMP requests to avoid Smurf attacks, - make the device more difficult to enumerate on the network and prevent clock - fingerprinting through ICMP timestamps. +Not yet implemented due to issues: -- RFC1337 is enabled to protect against time-wait assassination attacks by - dropping RST packets for sockets in the time-wait state. +- https://github.com/Kicksecure/security-misc/pull/145 -- Reverse path filtering is enabled to prevent IP spoofing and mitigate - vulnerabilities such as CVE-2019-14899. +- https://github.com/Kicksecure/security-misc/issues/184 -- Unlike version 4, IPv6 addresses can provide information not only about the - originating network, but also the originating device. We prevent this from - happening by enabling the respective privacy extensions for IPv6. +- Unlike version 4, IPv6 addresses can provide information not only about the + originating network but also the originating device. We prevent this from + happening by enabling the respective privacy extensions for IPv6. -- In addition, we deny the capability to track the originating device in the - network at all, by using randomized MAC addresses per connection per - default. +- In addition, we deny the capability to track the originating device in the + network at all, by using randomized MAC addresses per connection by + default. See: -- `/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf` -- `/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf` -- `/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf` +- `/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf` +- `/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf` +- `/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf` ## Bluetooth Hardening ### Bluetooth Status: Enabled but Defaulted to Off -- **Default Behavior**: Although Bluetooth capability is 'enabled' in the kernel, security-misc deviates from the usual behavior by starting with Bluetooth turned off at system start. This setting remains until the user explicitly opts to activate Bluetooth. +- **Default Behavior**: Although Bluetooth capability is 'enabled' in the kernel, + security-misc-desktop deviates from the usual behavior by starting with + Bluetooth turned off at system start. This setting remains until the user + explicitly opts to activate Bluetooth. -- **User Control**: Users have the freedom to easily switch Bluetooth on and off in the usual way, exercising their own discretion. This can be done via the Bluetooth toggle through the usual way, that is either through GUI settings application or command line commands. +- **User Control**: Users have the freedom to easily switch Bluetooth on and off + in the usual way, exercising their own discretion. This can be done via the + Bluetooth toggle through the usual way, that is either through GUI settings + application or command line commands. -- **Enhanced Privacy Settings**: We enforce more private defaults for Bluetooth connections. This includes the use of private addresses and strict timeout settings for discoverability and visibility. +- **Enhanced Privacy Settings**: We enforce more private defaults for Bluetooth + connections. This includes the use of private addresses and strict timeout + settings for discoverability and visibility. -- **Security Considerations**: Despite these measures, it's important to note that Bluetooth technology, by its nature, may still be prone to exploits due to its history of security vulnerabilities. Thus, we recommend users to opt-out of using Bluetooth when possible. +- **Security Considerations**: Despite these measures, it's important to note that + Bluetooth technology, by its nature, may still be prone to exploits due to its + history of security vulnerabilities. Thus, we recommend users to opt-out of + using Bluetooth when possible. ### Configuration Details -- See configuration: `/etc/bluetooth/30_security-misc.conf` +- Bluetooth controllers are not automatically enabled at boot (`AutoEnable=false`). +- Pairable and discoverable modes time out after 30 seconds of inactivity. +- Only one Bluetooth controller is exposed to the system (`MaxControllers=1`). +- Resolvable Private Addresses (RPAs) are enforced (`Privacy=network/on`), + preventing MAC-based tracking. + +See: + +- `/etc/bluetooth/30_security-misc.conf` - For more information and discussion: [GitHub Pull Request](https://github.com/Kicksecure/security-misc/pull/145) ### Understanding Bluetooth Terms -- **Disabling Bluetooth**: This means the absence of the Bluetooth kernel module. When disabled, Bluetooth is non-existent in the system - it cannot be seen, set, configured, or interacted with in any way. +- **Disabling Bluetooth**: This means the absence of the Bluetooth kernel module. + When disabled, Bluetooth is non-existent in the system - it cannot be seen, set, + configured, or interacted with in any way. -- **Turning Bluetooth On/Off**: This refers to a software toggle. Normally, on Debian systems, Bluetooth is 'on' when the system boots up. It actively searches for known devices to auto-connect and may be discoverable or visible under certain conditions. Our default ensures that Bluetooth is off on startup. However, it remains 'enabled' in the kernel, meaning the kernel can use the Bluetooth protocol and has the necessary modules. +- **Turning Bluetooth On/Off**: This refers to a software toggle. Normally, on + Debian systems, Bluetooth is 'on' when the system boots up. It actively searches + for known devices to auto-connect and may be discoverable or visible under certain + conditions. Our default ensures that Bluetooth is off on startup. However, it + remains 'enabled' in the kernel, meaning the kernel can use the Bluetooth protocol + and has the necessary modules. ### Quick Toggle Guide -- **Turning Bluetooth On**: Simply click the Bluetooth button in the settings application or on the tray, and switch the toggle. It's a straightforward action that can be completed in less than a second. +- **Turning Bluetooth On**: Simply click the Bluetooth button in the settings + application or on the tray, and switch the toggle. It's a straightforward action + that can be completed in less than a second. -- **Turning Bluetooth Off**: Follow the same procedure as turning it on but switch the toggle to the off position. +- **Turning Bluetooth Off**: Follow the same procedure as turning it on but switch + the toggle to the off position. ## Entropy collection improvements -- The `jitterentropy_rng` kernel module is loaded as early as possible during - boot to gather more entropy via the - `/usr/lib/modules-load.d/30_security-misc.conf` configuration file. +- The `jitterentropy_rng` kernel module is loaded as early as possible during + boot to gather more entropy via the + `/usr/lib/modules-load.d/30_security-misc.conf` configuration file. -- Distrusts the CPU for initial entropy at boot as it is not possible to - audit, may contain weaknesses or a backdoor. For references, see: - `/etc/default/grub.d/40_distrust_cpu.cfg` +- Distrusts the CPU for initial entropy at boot as it is not possible to + audit, may contain weaknesses or a backdoor. Similarly, do not credit the + bootloader seed for initial entropy. For references, see: + `/etc/default/grub.d/40_kernel_hardening.cfg` -- Gathers more entropy during boot if using the linux-hardened kernel patch. +- Gathers more entropy during boot if using the linux-hardened kernel patch. ## Restrictive mount options @@ -283,89 +609,99 @@ A systemd service is triggered on boot to remount all sensitive partitions and directories with significantly more secure hardened mount options. Since this would require manual tuning for a given specific system, we handle it by creating a very solid configuration file for that very system on package -install. +installation. Not enabled by default yet. In development. Help welcome. -- https://www.kicksecure.com/wiki/Dev/remount-secure -- https://github.com/Kicksecure/security-misc/issues/157 -- https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/ +- https://www.kicksecure.com/wiki/Dev/remount-secure +- https://github.com/Kicksecure/security-misc/issues/157 +- https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/ ## Root access restrictions -- `su` is restricted to only users within the group `sudo` which prevents - users from using `su` to gain root access or to switch user accounts - - `/usr/share/pam-configs/wheel-security-misc` (which results in a change in - file `/etc/pam.d/common-auth`). +- `su` is restricted to only users within the group `sudo` which prevents + users from using `su` to gain root access or to switch user accounts - + `/usr/share/pam-configs/wheel-security-misc` (which results in a change in + file `/etc/pam.d/common-auth`). -- Add user `root` to group `sudo`. This is required due to the above - restriction so that logging in from a virtual console is still possible - - `debian/security-misc.postinst` +- Add user `root` to group `sudo`. This is required due to the above + restriction so that logging in from a virtual console is still possible - + `debian/security-misc-shared.preinst` -- Abort login for users with locked passwords - - `/usr/libexec/security-misc/pam-abort-on-locked-password`. +- Abort login for users with locked passwords - + `/usr/libexec/security-misc/pam-abort-on-locked-password`. -- Logging into the root account from a virtual, serial, whatnot console is - prevented by shipping an existing and empty `/etc/securetty` file (deletion - of `/etc/securetty` has a different effect). +- Logging into the root account from a virtual, serial, or other console is + prevented by shipping an existing and empty `/etc/securetty` file (deletion + of `/etc/securetty` has a different effect). This package does not yet automatically lock the root account password. It is -not clear if this would be sane in such a package although, it is recommended to +not clear if this would be sane in such a package, although it is recommended to lock and expire the root account. -In new Kicksecure builds, root account will be locked by package +In new Kicksecure builds, the root account will be locked by package dist-base-files. See: -- https://www.kicksecure.com/wiki/Root -- https://www.kicksecure.com/wiki/Dev/Permissions -- https://forums.whonix.org/t/restrict-root-access/7658 +- https://www.kicksecure.com/wiki/Root +- https://www.kicksecure.com/wiki/Dev/Permissions +- https://forums.whonix.org/t/restrict-root-access/7658 However, a locked root password will break rescue and emergency shell. Therefore, this package enables passwordless rescue and emergency shell. This is -the same solution that Debian will likely adapt for Debian installer: +the same solution that Debian will likely adopt for the Debian installer: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 See: -- `/etc/systemd/system/emergency.service.d/override.conf` -- `/etc/systemd/system/rescue.service.d/override.conf` +- `/etc/systemd/system/emergency.service.d/override.conf` +- `/etc/systemd/system/rescue.service.d/override.conf` -Adverse security effects can be prevented by setting up BIOS password -protection, GRUB password protection and/or full disk encryption. +Adverse security effects can be prevented by setting up [BIOS Password](https://www.kicksecure.com/wiki/Protection_Against_Physical_Attacks#BIOS_Password) +protection, [Bootloader Password](https://www.kicksecure.com/wiki/Protection_Against_Physical_Attacks#Bootloader_Password) protection, and/or [Full Disk Encryption (FDE)](https://www.kicksecure.com/wiki/Full_Disk_Encryption). ## Console lockdown -This uses pam_access to allow members of group `console` to use console but +This uses pam_access to allow members of group `console` to use the console but restrict everyone else (except members of group `console-unrestricted`) from -using console with ancient, unpopular login methods such as `/bin/login` over +using the console with ancient, unpopular login methods such as `/bin/login` over networks as this might be exploitable. (CVE-2001-0797) This is not enabled by default in this package since this package does not know -which users shall be added to group 'console' and thus, would break console. +which users should be added to group 'console' and thus, would break console access. See: -- `/usr/share/pam-configs/console-lockdown-security-misc` -- `/etc/security/access-security-misc.conf` +- `/usr/share/pam-configs/console-lockdown-security-misc` +- `/etc/security/access-security-misc.conf` ## Brute force attack protection User accounts are locked after 50 failed login attempts using `pam_faillock`. +- The failure tracking window is 7 days (`fail_interval=604800`). +- Locked accounts never auto-unlock (`unlock_time=never`) and require manual + administrator intervention via the `faillock` command. +- The root account can also be locked (`even_deny_root`). +- Faillock is skipped for certain remote services (e.g. `sshd`, `dovecot`) to + prevent remote lockout attacks. + Informational output during Linux PAM: -- Show failed and remaining password attempts. -- Document unlock procedure if Linux user account got locked. -- Point out that there is no password feedback for `su`. -- Explain locked root account if locked. +- Show failed and remaining password attempts. +- Document unlock procedure if Linux user account got locked. +- Point out that there is no password feedback for `su`. +- Explain locked root account if locked. See: -- `/usr/share/pam-configs/tally2-security-misc` -- `/usr/libexec/security-misc/pam-info` -- `/usr/libexec/security-misc/pam-abort-on-locked-password` +- `/usr/share/pam-configs/faillock-preauth-security-misc` +- `/usr/share/pam-configs/unix-faillock-security-misc` +- `/etc/security/faillock.conf.security-misc` +- `/usr/libexec/security-misc/pam-info` +- `/usr/libexec/security-misc/pam-abort-on-locked-password` +- `/usr/libexec/security-misc/pam_faillock_not_if_x` ## Access rights restrictions @@ -373,11 +709,13 @@ See: #### Permission Lockdown -Read, write and execute access for "others" are removed during package -installation, upgrade or PAM `mkhomedir` for all users who have home folders in +Read, write, and execute access for "others" are removed during package +installation, upgrade, or PAM `mkhomedir` for all users who have home folders in `/home` by running, for example: - chmod o-rwx /home/user +``` +chmod o-rwx /home/user +``` This will be done only once per folder in `/home` so users who wish to relax file permissions are free to do so. This is to protect files in a home folder @@ -386,34 +724,40 @@ of this package. See: -- `debian/security-misc.postinst` -- `/usr/libexec/security-misc/permission-lockdown` -- `/usr/share/pam-configs/mkhomedir-security-misc` +- `debian/security-misc-shared.postinst` +- `/usr/libexec/security-misc/permission-lockdown` +- `/usr/share/pam-configs/mkhomedir-security-misc` #### umask -Default `umask` is set to `027` for files created by non-root users such as for -example user `user`. Broken. Disabled. See: - -* https://github.com/Kicksecure/security-misc/issues/184 +The default `umask` is set to `027` for files created by non-root users, such +as the account `user`. -This is doing using pam module `pam_mkhomedir.so umask=027`. +This is done using the PAM module `pam_mkhomedir.so umask=027`. -This means, files created by non-root users cannot be read by other non-root -users by default. While Permission Lockdown already protects the `/home` folder, -this protects other folders such as `/tmp`. +This configuration ensures that files created by non-root users cannot be read +by other non-root users by default. While Permission Lockdown already protects +the `/home` folder, this setting extends protection to other folders such as +`/tmp`. `group` read permissions are not removed. This is unnecessary due to Debian's use of User Private Groups (UPGs). See also: https://wiki.debian.org/UserPrivateGroups -Default `umask` is unchanged for root, because then configuration files created -in `/etc` by the system administrator would be unreadable by "others" and break -applications. Examples include `/etc/firefox-esr` and `/etc/thunderbird`. +The default `umask` is unchanged for root because configuration files created +in `/etc` by the system administrator would otherwise be unreadable by +"others," potentially breaking applications. Examples include `/etc/firefox-esr` +and `/etc/thunderbird`. Additionally, the `umask` is set to `022` via `sudoers` +configuration, ensuring that files created as root are world-readable, even +when using commands such as `sudo vi /etc/file` or `sudo -i; touch /etc/file`. + +When using `sudo`, the `umask` is set to `022` rather than `027` to ensure +compatibility with commands such as `sudo vi /etc/configfile` and +`sudo -i; touch /etc/file`. See: -- `/usr/share/pam-configs/umask-security-misc` +- `/usr/share/pam-configs/umask-security-misc` ### SUID / SGID removal and permission hardening @@ -427,13 +771,13 @@ are often used in privilege escalation attacks. Various file permissions are reset with more secure and hardened defaults. These include but are not limited to: -- Limiting `/home` and `/root` to the root only. -- Limiting crontab to root as well as all the configuration files for cron. -- Limiting the configuration for cups and ssh. -- Protecting the information of sudoers from others. -- Protecting various system relevant files and modules. +- Limiting `/home` and `/root` to the root only. +- Limiting crontab to root as well as all the configuration files for cron. +- Limiting the configuration for cups and ssh. +- Protecting the information of sudoers from others. +- Protecting various system-relevant files and modules. -##### permission-hardener ##### +##### permission-hardener `permission-hardener` removes SUID / SGID bits from non-essential binaries as these are often used in privilege escalation attacks. It is enabled by default @@ -442,16 +786,16 @@ and applied at security-misc package installation and upgrade time. There is also an optional systemd unit which does the same at boot time that can be enabled by running `systemctl enable permission-hardener.service` as root. The hardening at boot time is not the default because this slows down -the boot too much. +the boot process too much. See: -* `/usr/bin/permission-hardener` -* `debian/security-misc.postinst` -* `/lib/systemd/system/permission-hardener.service` -* `/etc/permission-hardener.d` -* https://forums.whonix.org/t/disable-suid-binaries/7706 -* https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener +- `/usr/bin/permission-hardener` +- `debian/security-misc-shared.postinst` +- `/usr/lib/systemd/system/permission-hardener.service` +- `/usr/lib/permission-hardener.d` +- https://forums.whonix.org/t/disable-suid-binaries/7706 +- https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener ### Access rights relaxations @@ -462,47 +806,101 @@ incompatible with `hidepid=2`. See: -* `/usr/bin/pkexec.security-misc` -* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 -* https://forums.whonix.org/t/cannot-use-pkexec/8129 +- `/usr/bin/pkexec.security-misc` +- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 +- https://forums.whonix.org/t/cannot-use-pkexec/8129 + +## Emergency shutdown + +- Forcibly powers off the system if the drive the system booted from is + removed from the system. +- Forcibly powers off the system if a user-configurable "panic key sequence" + is pressed (Ctrl+Alt+End by default). +- Forcibly powers off the system if + `sudo /run/emerg-shutdown --instant-shutdown` is called. +- Optional - Forcibly powers off the system if shutdown gets stuck for longer + than a user-configurable number of seconds (30 by default). Requires tuning + by the user to function properly, see notes in + `/etc/security-misc/emerg-shutdown/30_security_misc.conf`. + +A dracut module bundles the emergency shutdown binary, its systemd service, +and configuration files into the initramfs so the panic key sequence is +available even during early boot. A udev rule restarts the service whenever +a keyboard is added or removed. See: + +- `/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh` +- `/usr/lib/udev/rules.d/95-emerg-shutdown.rules` + +## File Manager D-Bus shim + +To prevent malicious applications from opening malicious content using D-Bus, +a shim is present that listens for `org.freedesktop.FileManager1` D-Bus method +calls. This shim displays a confirmation window for every request an +application makes to open one or more directories, while also ensuring +applications can only try to open directories (not files), and cannot try to +open directories that the user cannot access. + +See: + +- `/usr/src/security-misc/fm-shim-backend.c` +- `/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py` +- `/usr/bin/fm-shim-frontend` +- `/usr/libexec/security-misc/build-fm-shim-backend` +- `/usr/lib/systemd/user/fm-shim.service` ## Application-specific hardening -- Enables "`apt-get --error-on=any`" which makes apt exit non-zero for - transient failures. - `/etc/apt/apt.conf.d/40error-on-any`. -- Enables APT seccomp-BPF sandboxing - `/etc/apt/apt.conf.d/40sandbox`. -- Deactivates previews in Dolphin. -- Deactivates previews in Nautilus - - `/usr/share/glib-2.0/schemas/30_security-misc.gschema.override`. -- Deactivates thumbnails in Thunar. -- Thunderbird is hardened with the following options: - - Displays domain names in punycode to prevent IDN homograph attacks (a - form of phishing). - - Strips email client information for sent email headers. - - Stripts user time information from sent email headers by replacing the - originating time zone with UTC and rounding the timestamp to the nearest - minute. - - Disables scripting when viewing pdf files. - - Disables implicit outgoing connections. - - Disables all and any kind of telemetry. -- Security and privacy enhancements for gnupg's config file - `/etc/skel/.gnupg/gpg.conf`. See also: - - https://raw.github.com/ioerror/torbirdy/master/gpg.conf - - https://github.com/ioerror/torbirdy/pull/11 - -### project scope of application-specific hardening +- `sudo`: Enables "`Defaults !fqdn`", which disables attempts to + determine the local machine's FQDN via DNS as this can leak the machine's + hostname in cleartext to the configured DNS server and cause + `sudo unable to resolve host` errors. `security-misc-desktop` only. Not + enabled on `security-misc-server` since there has been no research yet if + this can break server use cases. +- `apt`: Enables "`apt-get --error-on=any`" which makes apt exit non-zero for + transient failures. - `/etc/apt/apt.conf.d/40error-on-any`. +- `apt`: Enables APT seccomp-BPF sandboxing - `/etc/apt/apt.conf.d/40sandbox`. +- `Dolphin`: Deactivates previews in Dolphin. +- `Nautilus`: Deactivates previews in Nautilus - + `/usr/share/glib-2.0/schemas/30_security-misc.gschema.override`. +- `Thunar`: Deactivates thumbnails, disables automatic volume management, + hides the network bookmark, and sets the date format to ISO in Thunar. + - Rationale: lower attack surface when using the file manager + - https://forums.whonix.org/t/disable-preview-in-file-manager-by-default/18904 +- `gnupg`: Security and privacy enhancements for gnupg's config file + `/etc/skel/.gnupg/gpg.conf`. See also: + - https://raw.github.com/ioerror/torbirdy/master/gpg.conf + - https://github.com/ioerror/torbirdy/pull/11 +- `SSH client`: Hardens the SSH client by restricting key exchange to + post-quantum-hybrid and modern algorithms, limiting host and public key + authentication to Ed25519 only, requiring the use of strong ciphers, and + enforcing encrypt-then-MAC. + `/etc/ssh/ssh_config.d/30_security-misc.conf` +- `SSH server`: Hardens the SSH server with the same cryptographic restrictions + as the client. Additionally disables password and keyboard-interactive + authentication, disables agent/TCP/X11 forwarding, limits authentication + attempts to 3, and suppresses the Debian version banner. + `/etc/ssh/sshd_config.d/30_security-misc.conf` +- `flatpak`: Configures flatpak to require authentication for all software installation + and management tasks including updates. Ships + `/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc`, + diverts/hides `/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules`. +- `git`: Disables symlinks to protect against known CVEs and enables object + integrity checking (`fsckObjects`) on transfer, fetch, and receive operations. + `/etc/gitconfig` + +### Project scope of application-specific hardening Added in December 2023. Before sending pull requests to harden arbitrary applications, please note the scope of security-misc is limited to default installed applications in -Kicksecure, Whonix. This includes: +Kicksecure and Whonix. This includes: -- Thunderbird, VLC Media Player, KeepassXC -- Debian Specific System Components (APT, DPKG) -- System Services (NetworkManager IPv6 privacy options, MAC address - randomization) -- Actually used development utilities such as `git`. +- VLC Media Player, KeePassXC +- Debian Specific System Components (APT, DPKG) +- System Services (NetworkManager IPv6 privacy options, MAC address + randomization) +- Actually used development utilities such as `git`. It will not be possible to review and merge "1500" settings profiles for arbitrary applications outside of this context. @@ -513,26 +911,26 @@ compatible with Debian, reflecting a commitment to clean implementation and sound design principles. However, it's important to note that security-misc is a component of Kicksecure, not a substitute for it. The intention isn't to recreate Kicksecure within security-misc. Instead, specific security -enhancements, like for example recommending a curated list of security-focused +enhancements, like recommending a curated list of security-focused default packages (e.g., `libpam-tmpdir`), should be integrated directly into -those appropriate areas of Kicksecure (e.g.`kicksecure-meta-packages`). +those appropriate areas of Kicksecure (e.g. `kicksecure-meta-packages`). Discussion: https://github.com/Kicksecure/security-misc/issues/154 -### development philosophy +### Development philosophy Added in December 2023. -"Maintainability is a key priority \[1\]. Before modifying settings in the +Maintainability is a key priority \[1\]. Before modifying settings in the downstream security-misc, it's essential to first engage with upstream developers to propose these changes as defaults. This step should only be bypassed if there's a clear, prior indication from upstream that such changes won't be accepted. Additionally, before implementing any workarounds, consulting -with upstream is necessary to future unmaintainable complexity. +with upstream is necessary to avoid future unmaintainable complexity. If debugging features are disabled, pull requests won't be merged until there is a corresponding pull request for the debug-misc package to re-enable these. This -is to avoid configuring the system into a corner where it can be no longer +is to avoid configuring the system into a corner where it can no longer be debugged. \[1\] https://www.kicksecure.com/wiki/Dev/maintainability @@ -542,40 +940,180 @@ debugged. Some hardening is opt-in as it causes too much breakage to be enabled by default. -- An optional systemd service mounts `/proc` with `hidepid=2` at boot to - prevent users from seeing another user's processes. This is disabled by - default because it is incompatible with `pkexec`. It can be enabled by - executing `systemctl enable proc-hidepid.service` as root. +- An optional systemd service mounts `/proc` with `hidepid=2` at boot to + prevent users from seeing another user's processes. This is disabled by + default because it is incompatible with `pkexec`. It can be enabled by + executing `systemctl enable proc-hidepid.service` as root. + +- A systemd service restricts `/proc/cpuinfo`, `/proc/bus`, `/proc/scsi`, and + `/sys` to the root user. This hides a lot of hardware identifiers from + unprivileged users and increases security as `/sys` exposes a lot of + information that shouldn't be accessible to unprivileged users. As this will + break many things, it is disabled by default and can optionally be enabled + by executing `systemctl enable hide-hardware-info.service` as root. + +## USBGuard + +USB device authorization rules are shipped for USBGuard. All unrecognized USB +devices plugged in at runtime are blocked by default +(`ImplicitPolicyTarget=block`), while devices connected at boot time and some +likely-safe devices are allowed. The service is suppressed if the system lacks +a USB controller. + +- Reject USB devices with undefined or non-standard interface classes. +- Reject devices that combine a keyboard/mouse (HID) interface with + non-HID interfaces, which is a common indicator of a BadUSB attack. +- Reject devices with RNDIS interfaces due to suspected protocol-level + buffer overflow vulnerabilities. +- Allow only one keyboard and one mouse at a time. +- Allow USB audio, video, mass storage, and hub devices. +- IPC access is granted to members of the `sudo` and `qubes` groups. + +See: + +- `/etc/usbguard/usbguard-daemon.conf.security-misc` +- `/etc/usbguard/rules.d/30_security-misc.conf` +- `/etc/usbguard/IPCAccessControl.d/` +- `/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf` + +## Systemd preset defaults + +The following services are explicitly disabled by default in the systemd +preset because these are work-in-progress or can severely break functionality. +These can be opted-in by the user: + +- `hide-hardware-info.service` - Restricts `/sys` and `/proc` hardware info. + Testers-only. See [hide-hardware-info.service](https://www.kicksecure.com/wiki/Security-misc#hide-hardware-info.service). + +- `permission-hardener.service` - Applies permission hardening at boot. + See [permission-hardener.service](https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#permission-hardener.service). + +- `remount-secure.service` - Remounts filesystems with hardened options. + In development. See [Remount Secure](https://www.kicksecure.com/wiki/Dev/remount-secure). + +- `proc-hidepid.service` - Mounts `/proc` with `hidepid=2`. + See [hidepid](https://www.kicksecure.com/wiki/Security-misc#hidepid). + +- `harden-module-loading.service` - Disables kernel module loading after boot. + [Harden Module Loading](https://www.kicksecure.com/wiki/Security-misc#Harden_Module_Loading) can cause major breakage. + +- `ensure-shutdown.service` - Forced shutdown watchdog. + In development. + +- `ensure-shutdown-trigger.service` - Companion trigger for forced shutdown. + In development. + +- `memlockd.service` - Memory locking daemon (used internally by `emerg-shutdown`). + Can be enabled if the user intents to use `memlockd.service`. + +See: `/usr/lib/systemd/system-preset/50-security-misc.preset` + +## Miscellaneous -- A systemd service restricts `/proc/cpuinfo`, `/proc/bus`, `/proc/scsi` and - `/sys` to the root user. This hides a lot of hardware identifiers from - unprivileged users and increases security as `/sys` exposes a lot of - information that shouldn't be accessible to unprivileged users. As this will - break many things, it is disabled by default and can optionally be enabled - by executing `systemctl enable hide-hardware-info.service` as root. +- Hardened malloc compatibility for haveged workaround + `/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf` -## miscellaneous +- Set `dracut` `reproducible=yes` setting. + `/etc/dracut.conf.d/30-security-misc.conf` -- hardened malloc compatibility for haveged workaround - `/lib/systemd/system/haveged.service.d/30_security-misc.conf` +- A `virusforget` script detects unauthorized changes to a set of sensitive + files by comparing them against a stored baseline. Work in progress - the + implementation will likely change significantly. + `/usr/libexec/security-misc/virusforget` -- set `dracut` `reproducible=yes` setting +- A custom `askpass` helper provides a GUI password prompt via `yad` for + superuser actions. + `/usr/libexec/security-misc/askpass` -## legal +- A helper script checks whether a USB controller is present on the system, + used as a conditional for USBGuard services. + `/usr/libexec/security-misc/check-for-usb-controller` + +- A VirtualBox-specific workaround kills the `VBoxDRMClient` process during + shutdown to prevent it from blocking a clean unmount of `/tmp`. Only + activates inside VirtualBox VMs. + `/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service` + +- PAM conditional helpers (`pam_only_if_login`, `pam_only_if_su`) allow + specific PAM rules to apply only to certain services. + `/usr/libexec/security-misc/pam_only_if_login` + `/usr/libexec/security-misc/pam_only_if_su` + +- Unsafe logins (such as logging into non-sysmaint accounts while booted in + sysmaint mode, or elevating privileges from an unprivileged account to a + passwordless privileged account) are blocked. Enforces account/session + separation between `sysmaint` and regular user accounts. + `/usr/libexec/security-misc/block-unsafe-logins` + `/usr/share/pam-configs/block-unsafe-logins-security-misc` + +- `/usr/share/security-misc/` is added to `XDG_CONFIG_DIRS` at login via + `/etc/profile.d/30_security-misc.sh` so that security-misc XDG + configuration overrides (e.g. Dolphin, Thunar) are available system-wide. + +- An AppArmor tunable creates aliases for security-misc's config-package-dev + displaced files (e.g. `common-session`, `login.defs`, `securetty`) so that + AppArmor policies continue to work with the diverted paths. + `/etc/apparmor.d/tunables/home.d/security-misc` + +- A custom `sysinit-post.target` provides a synchronization point between + `sysinit.target` and `basic.target` for services that must run after + early-boot initialization but before general services. + `/usr/lib/systemd/system/sysinit-post.target` + +- A systemd drop-in adds the `sysfs` supplementary group to all user session + managers (`user@.service`), granting users group-based read access to `/sys` + entries restricted by `hide-hardware-info.service`. + `/usr/lib/systemd/system/user@.service.d/sysfs.conf` + +- LKRG (Linux Kernel Runtime Guard) VirtualBox compatibility: automatically + manages LKRG sysctl settings when VirtualBox host software is detected. + `/usr/share/security-misc/lkrg/lkrg-virtualbox` + +## Legal `/usr/lib/issue.d/20_security-misc.issue` https://github.com/Kicksecure/security-misc/pull/167 +## Package split + +The `security-misc` source code repository builds three different software packages: + +- `security-misc-shared` +- `security-misc-desktop` +- `security-misc-server` + +The guiding principle has been: if there are no adverse effects, or if it is unclear whether a file belongs in the `desktop` or `server` package, then it will be placed in the `shared` package. + +The hash symbol ("`#`") is used as a separator character. + +Some clear examples where files belong only in `security-misc-desktop`: + +- `/usr/lib/NetworkManager/conf.d/80_ipv6-privacy#security-misc-desktop.conf` +- `/usr/lib/NetworkManager/conf.d/80_randomize-mac#security-misc-desktop.conf` +- `./usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop` + +This is because enabling IPv6 privacy extensions or MAC randomization on a server will not increase privacy but instead carries a high risk of breaking connectivity. + +A less clear example is `/etc/bluetooth/30_security-misc.conf#security-misc-desktop`. Also refer to the above chapter "Bluetooth Hardening". A server usually doesn't have Bluetooth, so on a server it may instead be useful to fully disable Bluetooth. + +Some clear examples where files belong only in `security-misc-shared`: + +`/etc/profile.d/30_security-misc.sh#security-misc-shared` indeed belongs in `security-misc-shared` and not `security-misc-desktop`. For the reason, see below. + +Other considerations have been: + +- Just because it's a server, it does not follow that there is no GUI (graphical user interface) desktop environment. +- Just because it's a desktop computer, it doesn't mean it's a GUI and not a CLI (command line interface). +- Therefore, the split is between `security-misc-desktop` and `security-misc-server`. +- Therefore, the split is not between `security-misc-gui` and `security-misc-cli`. + +\[1\] https://github.com/Kicksecure/security-misc/issues/187 + ## Related -- Linux Kernel Runtime Guard (LKRG) -- tirdad - TCP ISN CPU Information Leak Protection. -- Kicksecure (TM) - a security-hardened Linux Distribution -- And more. -- https://www.kicksecure.com/wiki/Linux_Kernel_Runtime_Guard_LKRG -- https://github.com/Kicksecure/tirdad -- https://www.kicksecure.com +- [`tirdad` - TCP ISN CPU Information Leak Protection.](https://www.kicksecure.com/wiki/Tirdad) +- [Kicksecure (TM) - a security-hardened Linux Distribution](https://www.kicksecure.com) - https://github.com/Kicksecure ## Discussion @@ -590,7 +1128,7 @@ See https://www.kicksecure.com/wiki/Security-misc#install ## How to Build deb Package from Source Code -Can be build using standard Debian package build tools such as: +Can be built using standard Debian package build tools such as: dpkg-buildpackage -b diff --git a/README_generic.md b/README_generic.md index 787af723..70edaf08 100644 --- a/README_generic.md +++ b/README_generic.md @@ -4,10 +4,12 @@ https://github.com/Kicksecure/security-misc/blob/master/README.md https://www.kicksecure.com/wiki/Security-misc +Package security-misc-desktop and/or security-misc-server may also be useful. + Discussion: Happening primarily in Whonix forums. -https://forums.whonix.org/t/kernel-hardening/7296 +https://forums.whonix.org/t/kernel-hardening-security-misc/7296 ## How to install `security-misc` using apt-get ## @@ -28,7 +30,7 @@ sudo cp ~/derivative.asc /usr/share/keyrings/derivative.asc 3\. Add the derivative repository. ``` -echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list +echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com trixie main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list ``` 4\. Update your package lists. diff --git a/agents/fm-shim.md b/agents/fm-shim.md new file mode 100644 index 00000000..3ce7cc59 --- /dev/null +++ b/agents/fm-shim.md @@ -0,0 +1,53 @@ +# fm-shim Notes + +## Accepted Threat Model + +- Local DoS is out of scope. +- Directory replacement / symlink swaps are out of scope (frontend documents this). +- Success replies are returned even on frontend failure (spec safety). + +## Architecture + +- **Backend** (`fm-shim-backend.c`): C daemon that claims `org.freedesktop.FileManager1` + D-Bus name, receives ShowFolders/ShowItems/ShowItemProperties calls, forks a + Python frontend with the URI arguments and systemd's user environment. +- **Frontend** (`fm_shim_frontend.py`): PyQt5 dialog that validates URIs, resolves + paths, shows a confirmation prompt, then opens directories via `gio launch`. +- **Build script** (`build-fm-shim-backend`): Compiles the C backend with + extensive GCC hardening flags. +- **Service** (`fm-shim.service`): systemd user service, Type=notify. + +## D-Bus name acquisition + +The fm-shim-backend intentionally uses `DBUS_NAME_FLAG_REPLACE_EXISTING` +**without** `DBUS_NAME_FLAG_DO_NOT_QUEUE`. When the name cannot be acquired, +the process warns and omits `READY=1` so that systemcheck alerts the user. +Hard-failing (via `errx`) removes the service entirely, which is worse than +running in a degraded-but-monitored state. Do not change this to a fatal error. + +### DBUS_NAME_FLAG_DO_NOT_QUEUE + +The D-Bus name queueing behavior is intentional. The IN_QUEUE case withholds +`READY=1` (triggering a `systemcheck` warning) while remaining in the queue to +reclaim the name ASAP. Exiting immediately would leave the name permanently +unprotected - a worse outcome. Do not re-propose this change. + +## Systemd sandboxing on services that spawn user-facing apps + +Do not add restrictive systemd sandboxing directives (`ProtectHome`, +`MemoryDenyWriteExecute`, `ProtectSystem=strict`, etc.) to the fm-shim +service. These restrictions are inherited by child processes - the file +manager and anything it launches. `MemoryDenyWriteExecute` may break JIT, +`ProtectHome=read-only` breaks normal file manager operations, etc. + +## Closing inherited file descriptors in forked children + +Use the `close_range(3, ~0U, CLOSE_RANGE_UNSHARE)` syscall (requires +`#define _GNU_SOURCE` and `#include `). Do not iterate +`/proc/self/fd` manually. + +## D-Bus error replies + +When sending D-Bus error replies in multiple places, use the shared helper +function `send_error_message_maybe()` rather than duplicating the pattern +inline. diff --git a/agents/fuzzing.md b/agents/fuzzing.md new file mode 100644 index 00000000..56125099 --- /dev/null +++ b/agents/fuzzing.md @@ -0,0 +1,74 @@ + + +# Fuzzing + +## Hypothesis property tests + +Property tests live at `ci/tests//test_property.py` (mirroring +the helper-scripts layout). **Outside** the Python package tree on +purpose: `debian/security-misc-shared.install` ships +`usr/lib/python3/dist-packages/fm_shim_frontend/...`, so keeping the +property tests under `ci/tests/` means they don't end up in the +installed `.deb`. + +Currently covered: + +- `ci/tests/fm_shim_frontend/test_property.py` - Hypothesis + property tests over `get_path_list_from_uris`, the URI-validation + chokepoint between the FileManager1 D-Bus surface and the user- + facing dialog. Six properties (`never_raises`, + `output_paths_absolute`, `output_no_dangerous_chars`, + `output_unique_and_sorted`, `idempotent`, plus a deterministic + regression-suite of nine adversarial inputs). + + At introduction this suite found an exploitable bug: an attacker + who can deliver a URI with a single path component longer than + NAME_MAX (255 bytes on Linux) crashed the process via an + uncaught `OSError(ENAMETOOLONG)` from `Path.exists()`. Fixed in + the same commit that added the suite. + +Test runner: `.github/workflows/lint-python.yml` runs flake8 +followed by `python3 -m pytest` against `ci/tests//`. apt- +installs `python3-pytest`, `python3-hypothesis`, plus PyQt5 +runtime deps required for the source under test to import. + +`ci/tests//conftest.py` stubs out `stdisplay` (helper-scripts +package, not on PyPI / not in apt for the runner) with an identity +function, and stubs PyQt5.QtCore/Gui/Widgets so that the Qt class +inheritance at module level (`class FmShimWindow(QDialog)`) works +without a real display. + +Local run (single package): + +``` +PYTHONPATH=usr/lib/python3/dist-packages python3 -m pytest \ + --import-mode=importlib -q \ + ci/tests/fm_shim_frontend/test_property.py +``` + +When adding a new package, mirror the same structure: +`ci/tests//{test_property.py,conftest.py}`. Keep at least +two properties: `test_never_raises` and one domain-specific +invariant. + +## ClusterFuzzLite (Atheris / libFuzzer) + +Not yet wired up. Helper-scripts has the full +`.clusterfuzzlite/{Dockerfile,build.sh,project.yaml}` + +`fuzz/fuzz_.py` setup; mirror that here when the property- +test suite has been running long enough to catch the easy wins +and the harder, coverage-guided layer is justified. + +## Trust footprint + +- Hypothesis: Debian apt (`python3-hypothesis`). +- pytest: Debian apt (`python3-pytest`). +- PyQt5 + sip: Debian apt (`python3-pyqt5` + `python3-pyqt5.sip`). +- ClusterFuzzLite + Atheris (when added): Google. Per-pin + provenance will live in the future + `.clusterfuzzlite/Dockerfile`. diff --git a/changelog.upstream b/changelog.upstream index 96f74e9e..7d8ff45c 100644 --- a/changelog.upstream +++ b/changelog.upstream @@ -1,17 +1,10693 @@ +commit 7f60beb8bffa344453bd6794f92ff72b6098edf3 +Merge: d80e26de cbba86cb +Author: Patrick Schleizer +Date: Wed Sep 30 04:20:30 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit cbba86cb06d7acd46aaf780f9cd1e5ab4ac97d8d +Author: Aaron Rainbolt +Date: Tue Sep 29 22:57:46 2026 -0400 + + Polish, reintroduce removed ciphers again but keep the requirement to use post-quantum key exchange + +commit 5202e7564b9133ae267c6064c88e69d23d45cd87 +Merge: d80e26de c3b4e219 +Author: Aaron Rainbolt +Date: Tue Sep 29 22:33:57 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit c3b4e219acaf5b853c8a3d71f32360ae5db3aa32 +Merge: 96c0366c d217e28d +Author: assisted-by-ai +Date: Tue Sep 29 04:28:20 2026 -0400 + + Merge arraybolt3/trixie into ai (remaster) + +commit d80e26defda7271a513cb6ba8ddee7c3e9ae83cf +Author: Patrick Schleizer +Date: Tue Sep 29 08:08:57 2026 +0000 + + bumped changelog version + +commit 96c0366cdc53005b5a06104d6c9c325c12c87882 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Mon Sep 28 02:58:45 2026 -0400 + + ssh: fix override advice; sync interop comments + + - OpenSSH is first-wins: a lower-numbered drop-in (or ~/.ssh/config) overrides, not a higher-numbered one + + - server comment no longer claims the client stays broad; the client config is equally strict + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit aba02ec3634c006ea993c4609cf9a31c2e65a2b4 +Merge: 9cb4efa8 d217e28d +Author: Patrick Schleizer +Date: Mon Sep 28 02:40:50 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 802205a4b8e9519ebd04eda34f5428ec8719ed59 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Mon Sep 28 01:19:07 2026 -0400 + + ssh client: post-quantum-only kex + aes256-gcm (match server) + + - The client default now uses the same strictest set as the server: PQ-only + key exchange and the aes256-gcm cipher only (drop curve25519, chacha20, + aes256-ctr). Outbound SSH therefore only reaches post-quantum-capable + servers; override per-host in ~/.ssh/config or a 50_user.conf drop-in for a + server with a narrower algorithm set. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit d217e28daaaa3ef05d3f489180ec920eb2a4e18a +Author: Aaron Rainbolt +Date: Sun Sep 27 21:11:28 2026 -0400 + + Undo dangerous SSH settings changes applied by AI + +commit 6cee7b5659c60bd6e2f995786c178cb575f8c980 +Merge: 9cb4efa8 0a35d857 +Author: Aaron Rainbolt +Date: Sun Sep 27 20:49:32 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit 0a35d857cf38f02e99389bbfc0e299619b4105da +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sun Sep 27 08:22:31 2026 -0400 + + sshd: post-quantum-only kex + aes256-gcm (sshaudit.com A+/100) + + - Server default now offers PQ-only key exchange (drop classical curve25519) + and an AEAD, Terrapin-immune cipher (aes256-gcm, drop chacha20). This is the + A+ / 100-of-100 sshaudit.com profile (verified equivalent to grapheneos.org): + resists harvest-now-decrypt-later and removes chacha20's residual Terrapin + exposure for unpatched peers. + - Interop: requires an OpenSSH 9.0+ (post-quantum) peer. Client config stays + broad so outbound SSH to older servers is unaffected. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit fcbf940c25f57af3ddf2ec8dda1e2f8e95847bda +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sun Sep 27 04:21:49 2026 -0400 + + Move ssh-audit test tool + policies out to dist-ai + + - The ssh-audit-test driver and the server/client ssh-audit policies are test + artifacts, not runtime hardening; they now live in the dist-ai + security-misc-tests suite. security-misc's shipped package stays lean. + - Kept here: only the CI wiring (dm-consumer.yml + the dist-ai-tests / + ssh-prod workflows), which is inherently per-consumer-repo. The dist-ai + drift-guard test keeps the moved policies in sync with the ssh config drop-ins + that remain the source of truth. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 6d70b404e1812ade14912840263bf4671890dcc6 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sat Sep 26 02:54:03 2026 -0400 + + ssh-audit-test: clean error on missing option operand + + - --policy / --port with no value crashed on shift (shift count out of range) + instead of reporting the missing operand; validate and die cleanly. + - Document that the ssh-audit policy check is server-to-client; OpenSSH sets + both directions symmetrically, so it is complete for our OpenSSH targets. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 3ce6b81d5f7f9f1561d33ae0f474d11de8021195 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sat Sep 26 01:46:37 2026 -0400 + + Add ssh-audit hardening policies, test tool and CI wiring + + - ssh-audit-test + server/client policies pin the exact hardened algorithm + set (allow_algorithm_subset_and_reordering = false); a regression that + loosens the ssh config, or a server missing the hardening, now fails loud. + - dist-ai consumer wiring runs the config suite per PR and scans production + SSH on a schedule. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 2bf04eee21a66fed4f3c45556ebd362cfc6f810f +Merge: 00bad984 9cb4efa8 +Author: assisted-by-ai +Date: Thu Sep 24 22:51:46 2026 -0400 + + Merge master into ai (remaster) + +commit 9cb4efa8a716343271e3339fb7e13408146b7943 +Author: Patrick Schleizer +Date: Sat Sep 19 14:09:18 2026 +0000 + + bumped changelog version + +commit f7e4aa5ed2dbf0cd0d9155695ad4fdf315a1181f +Merge: a70c168d 87ff42a1 +Author: Patrick Schleizer +Date: Sat Sep 19 10:00:10 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 87ff42a19c786050471b5350e228a26a82bd61eb +Author: Aaron Rainbolt +Date: Wed Sep 16 00:01:44 2026 -0400 + + Comments, revert an unreliable feature addition in permission-hardener's state file parsing + +commit 3bc6ec2a046f20d292273095c40352ec6d914a52 +Merge: a70c168d 00bad984 +Author: Aaron Rainbolt +Date: Tue Sep 15 23:26:46 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit 00bad98497794d461fe4923e4ff182a61b918df7 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 10:56:10 2026 -0400 + + security-misc: source has.bsh explicitly in preinst + +commit 57a6530574d21307d77a371a1fb53259bfbe22fa +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 10:52:46 2026 -0400 + + security-misc: simplify preinst helper-scripts sourcing + + - helper-scripts is a Pre-Depends, configured before this preinst; strict + options first, then plain source -- errexit turns any load failure into a + hard stop, so the bespoke fail-closed handling + type -t check are redundant + +commit f0ea22f6b0f631485fb8f405eb352d35a3d33d84 +Merge: 888a5f67 a70c168d +Author: assisted-by-ai +Date: Tue Sep 15 10:45:48 2026 -0400 + + Merge master into ai (remaster) + +commit a70c168da6730ce86d1ea12f29bff2448734a8a9 +Author: Patrick Schleizer +Date: Tue Sep 15 14:32:35 2026 +0000 + + bumped changelog version + +commit 0a004b6675d22e4e54f79f07b086cebe78177280 +Author: Patrick Schleizer +Date: Tue Sep 15 10:27:21 2026 -0400 + + output + +commit edbaf1c198cb727ab00ff57ef573edc8c7974fd6 +Author: Patrick Schleizer +Date: Tue Sep 15 12:00:55 2026 +0000 + + bumped changelog version + +commit 888a5f679d816aeb8c50fc14ab604d27d158863d +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 04:27:13 2026 -0400 + + permission-hardener: restore octal-owner filename disambiguation + + - the right-to-left octal scan mis-anchors on a numeric octal-looking owner + (e.g. 0755), folding the real mode into the filename; the nonexistent path is + then silently dropped, leaving a SUID binary un-hardened. + - restore fixed-width tail anchoring + disambiguation by on-disk existence; + test_whitespace_filename.sh (numowner, 'x y') parses again. + +commit c894bbcf75bbe3c63f17b75f0ffc8a0ae2f98ef3 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 02:37:02 2026 -0400 + + preinst: fail closed loudly if helper-scripts library missing + + - source failures were swallowed (errexit not set yet); abort with the real + cause instead. + - a missing group_has_nonroot_member now aborts with the true reason rather + than degrading the lockout check into a misleading 'no account is a member of + sudo' abort. + +commit 239532762966b9fc57f158bb02fb19b04bf1e1bc +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 02:16:06 2026 -0400 + + Pre-Depend on helper-scripts; source accountctl.sh, drop vendored copy + + - helper-scripts moved from Depends to Pre-Depends: it is configured before this + package is unpacked, so the preinst can source its libraries. Reuse the real + group_has_nonroot_member from accountctl.sh instead of a vendored copy (and its + drift guard). + - accountctl.sh pulls in has.bsh, so 'has' is available: use it, drop the + no-has waiver and the command -v fallbacks. + +commit 497a23fbb31e2550fc858e6139e84b595be49d20 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Mon Sep 14 12:49:30 2026 -0400 + + Sync vendored group_has_nonroot_member (reject numeric arg) + +commit 88abbcaa436a86dcd15a37c8ba4f4351b565c050 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Mon Sep 14 11:13:01 2026 -0400 + + Detect primary-GID members in the install checks + + - sudo_users_check / console_users_check now count a non-root account + whose PRIMARY group is sudo/console (via a vendored + group_has_nonroot_member), not only supplementary members; a + supplementary-only scan falsely aborted install for such an admin. + - Revert the qubesdb-read probe to 'command -v' (no-has waiver): a + preinst runs at unpack time, before helper-scripts is guaranteed + configured, so it must not source has.bsh. + - group_has_nonroot_member is VENDORED from helper-scripts accountctl.sh + (same reason it cannot be sourced); a dist-ai drift guard keeps them + in sync. + +commit dc103b260b2dfd8b94ccdd23aaaaa54000d8d56c +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Mon Sep 14 09:35:22 2026 -0400 + + Also skip install checks on dist_build_iso; house-style + + - Skip the sudo/console-user install checks when dist_build_iso=true (an + ISO/live build) in addition to the existing skip_install_check file, so + the derivative-maker build no longer needs to write that marker file. + The manual file-based bypass is kept for non-derivative-maker users. + - Modernize to dist-ai house style: strict-mode block, printf not echo, + has not command -v, braced + nounset-guarded variables. + +commit 4db7b41bda5f7f2a1d0c1f163a070c998a5a284e +Merge: 81d6905a 827e5ee1 +Author: Patrick Schleizer +Date: Mon Sep 14 02:29:46 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 827e5ee1f8a250ba8b04e08c91892b1887e83d61 +Author: Aaron Rainbolt +Date: Sun Sep 13 17:50:16 2026 -0400 + + comments + +commit a85c5b57045e95a840c4059e66d8296b8e51c155 +Merge: d108f60a 28d05b0c +Author: Aaron Rainbolt +Date: Sun Sep 13 17:40:14 2026 -0400 + + Merge branch 'arraybolt3/maybebyte-pam-auth-update' into arraybolt3/trixie + +commit 28d05b0cd17c9f3d77786cf14798c1cdec912d0c +Merge: 86780917 d108f60a +Author: Aaron Rainbolt +Date: Sun Sep 13 17:39:32 2026 -0400 + + Merge branch 'arraybolt3/trixie' into arraybolt3/maybebyte-pam-auth-update + +commit d108f60a20cfc51cbe3d98f6200e8387a47f7488 +Author: Aaron Rainbolt +Date: Sun Sep 13 17:25:53 2026 -0400 + + comment + +commit ac4b5023ae7c0ca034b8e85dda91d34de4e2e920 +Author: Aaron Rainbolt +Date: Sun Sep 13 17:21:40 2026 -0400 + + Polish + +commit 81ed36c2e3e5777ca81e33f8a40edd1cd952e001 +Merge: 439ddce5 db8f36fd +Author: Aaron Rainbolt +Date: Sun Sep 13 17:11:40 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit db8f36fd5ab660ad1c2dd02fffa998a2b3f1ee58 +Merge: e64a2c7d b8e218c6 +Author: claude +Date: Sun Sep 13 06:07:26 2026 -0400 + + Merge branch 'master' into ai + +commit b8e218c6438b862acd881eac9599ff40224fe862 +Merge: c77beac7 b9cf5081 +Author: claude +Date: Sun Sep 13 06:07:25 2026 -0400 + + Merge remote-tracking branch 'upstream/master' + +commit e64a2c7d0481dfd38c8a575a49ddf55248e6230d +Author: claude (dev541 abd2cdfa-632f-4eda-bd69-14b67be2017e) +Date: Sun Sep 13 05:28:23 2026 -0400 + + Python -Bsu shebangs; grep --quiet in tests + +commit 81d6905af8bd14a21163a1ab308c996e38869f74 +Merge: b9cf5081 439ddce5 +Author: Patrick Schleizer +Date: Sat Sep 12 09:49:38 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 439ddce5bf08465710b81bd2353ac105b1e522c4 +Author: Aaron Rainbolt +Date: Fri Sep 11 17:06:29 2026 -0400 + + Revert some faulty changes to style-ok comments (uglier style, excessive verbosity, allow-echo in a script that did not use echo) + +commit d4e50dc6d74b6cf13c3dff2ef2b7d16a2b682ec2 +Merge: b9cf5081 409e0483 +Author: Aaron Rainbolt +Date: Fri Sep 11 16:58:09 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit b9cf508116757b7fff13c199a142742246162877 +Author: Patrick Schleizer +Date: Wed Sep 9 11:05:44 2026 +0000 + + bumped changelog version + +commit 0ba912995c461446bf527cf0c6a9db47e8aaab08 +Merge: fc2afb15 dd05179e +Author: Patrick Schleizer +Date: Wed Sep 9 06:56:30 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 409e0483071c2ca6a313272ec1957aab80a8cc3f +Merge: 24b39b0c c77beac7 +Author: claude (dev490 427cd1a1-bb80-4a36-9e14-2b6cec600780) +Date: Tue Sep 8 23:45:54 2026 -0400 + + Merge branch 'master' into ai + + # Conflicts: + # debian/security-misc-shared.postinst + # usr/bin/remount-secure#security-misc-shared + # usr/libexec/security-misc/check-for-usb-controller#security-misc-shared + # usr/share/lintian/overrides/security-misc-shared#security-misc-shared + # usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared + +commit c77beac7b4db560cd6d58abbc8943b77ee0ae62c +Merge: 6355b72c dd05179e +Author: claude (dev490 427cd1a1-bb80-4a36-9e14-2b6cec600780) +Date: Tue Sep 8 23:43:07 2026 -0400 + + Merge remote-tracking branch 'ab/trixie' + +commit 6355b72c6d9de2002506a3ab797b153f83c92a9d +Merge: 78491468 fc2afb15 +Author: claude (dev490 427cd1a1-bb80-4a36-9e14-2b6cec600780) +Date: Tue Sep 8 23:43:06 2026 -0400 + + Merge remote-tracking branch 'up/master' + +commit dd05179ea3310d0cac4d2de9db220ebbd5224fbf +Author: Aaron Rainbolt +Date: Tue Sep 8 21:24:00 2026 -0400 + + fix + +commit fc2afb158592f8a8ad7270dcb5ee5abb33e1824d +Author: Patrick Schleizer +Date: Tue Sep 8 15:30:04 2026 +0000 + + bumped changelog version + +commit 24b39b0ca1b6c5a0fd35036703f56a2a1f5b9225 +Author: claude (dev474 c7439536-fad8-4884-b71a-d2f3c4c23905) +Date: Mon Sep 7 11:49:54 2026 -0400 + + rename has.sh to has.bsh (bashism convention) + + Sourced helper-scripts lib uses bashisms; .bsh marks it. Scoped to has.sh consumers (repo carries unrelated concurrent WIP). + +commit 24a55b78fe94ef69bb866f71b86d54e3a659b83c +Merge: 94ea3994 aa458bac +Author: Patrick Schleizer +Date: Mon Sep 7 01:11:01 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit aa458bac395d6fd450c749d0934f4a63d4a76c17 +Author: Aaron Rainbolt +Date: Sun Sep 6 23:11:56 2026 -0400 + + Fix coding style, shorten comments + +commit 97f78d8262aeea854cef3d654ab6aeb57e1f08ec +Merge: 94ea3994 077d41a6 +Author: Aaron Rainbolt +Date: Sun Sep 6 22:38:54 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/remove-system-map-readonly-continue' into arraybolt3/trixie + +commit 94ea3994027115b02bdcc8d8246c4c5b5c40a776 +Author: Patrick Schleizer +Date: Sun Sep 6 16:58:23 2026 +0000 + + bumped changelog version + +commit 0088727e4a9ca17d07916a30544ffa6e13890bfc +Author: Patrick Schleizer +Date: Sun Sep 6 12:56:41 2026 -0400 + + cleanup + +commit ebd72d593c81fad95d09a055d4e839b6eecca332 +Merge: 78491468 87506b1e +Author: Patrick Schleizer +Date: Sun Aug 30 10:02:32 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 3e3d7453e3318ac79ea36ae14ed90442ded0c165 +Author: claude (dev371 3fff1819-b77d-4dde-be19-8c01e09d3394) +Date: Fri Aug 28 01:23:45 2026 -0400 + + lintian: drop redundant maintainer-script-ignores-errors override + + Now suppressed globally in genmkfile; the false positive is the same errexit long-form case. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 87506b1eaf45fa7501d54cf83b9be13578f86ecb +Author: Aaron Rainbolt +Date: Fri Aug 28 01:03:22 2026 -0400 + + Polish, add TODOs + +commit 0f1f701b5c413b1ab2229577261fe6e0187d84ca +Merge: eb5b301d bb399ba7 +Author: Aaron Rainbolt +Date: Thu Aug 27 21:02:55 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit bb399ba73704e4c20fbc6965d13bee4f2c63626c +Author: claude (dev352 385b930f-4313-4883-93d5-e6857c3f7ea7) +Date: Thu Aug 27 12:07:58 2026 -0400 + + lintian: override maintainer-script-ignores-errors in the shipped file + + The postinst uses long-form 'set -o errexit' (style R-013); lintian's + scripts check only matches short 'set -e'. Add the false-positive + override to the package's own usr/share/lintian/overrides file -- a + separate debian/*.lintian-overrides displaces it (dh_lintian installs to + the same path), losing the etc-skel and other overrides it carries. + +commit d1b9f4c0517f03936af556445fedd2ee22d14e98 +Merge: cc7a93d1 908cadc6 +Author: claude (dev352 385b930f-4313-4883-93d5-e6857c3f7ea7) +Date: Thu Aug 27 11:22:32 2026 -0400 + + Merge branch 'ai' of ssh://github.com/org-ai-assisted/security-misc into ai + +commit cc7a93d10a30e19631c64437b5c6078ba5d74f77 +Author: claude (dev352 385b930f-4313-4883-93d5-e6857c3f7ea7) +Date: Thu Aug 27 11:21:51 2026 -0400 + + lintian: override false-positive maintainer-script-ignores-errors + + The postinst enables errexit via long-form 'set -o errexit' (project + style, R-013); lintian's check only matches short 'set -e'. Same + override tb-updater already carries. + +commit 908cadc6177c00d4ff3465b33b20b3c971ce246a +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Aug 24 23:31:21 2026 -0400 + + ci: drop orphaned consumer-secrets-audit.yml (reusable decommissioned) + +commit a6d7a3585f8905bc3f898d8dd83c3b07cb04cba9 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Aug 24 23:31:19 2026 -0400 + + ci: drop orphaned consumer-codex-review.yml (reusable decommissioned) + +commit e6a81266555130673dc7d8bcb85ea50bbad9e852 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Aug 24 23:31:16 2026 -0400 + + ci: drop orphaned consumer-claude-code.yml (reusable decommissioned) + +commit 1c9f144b9ebe58daa174de05f5b0c0e42038bfc1 +Author: claude (dev272 e8b76afb-795c-4739-8ebd-023de854021e) +Date: Fri Aug 21 04:41:27 2026 -0400 + + security-misc: source helper-scripts via HELPER_SCRIPTS_PATH, drop SC1091 disable + + - check-for-usb-controller, permission-hardener, lkrg-virtualbox: use + source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/; + drop the dead '# shellcheck disable=SC1091' and the stale sibling note. + - completed pre-existing whole-file style debt: R-010 export LC_ALL=C in + the strict-mode block (dropping the duplicate single-quoted mid-file one). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 78491468a7c209f423f48f74de015f1df2b9a980 +Author: Patrick Schleizer +Date: Sun Aug 16 08:24:20 2026 +0000 + + bumped changelog version + +commit f1e9da8fb911b1e3962f219290df14753794aee8 +Merge: 52e18f72 1fcf4967 +Author: Patrick Schleizer +Date: Sat Aug 15 12:55:45 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit f2c1e7517cf8a8017db91ef7cf42784e93e14ae8 +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 13:28:37 2026 -0400 + + permission-hardener: read spaced paths back from the state DB + + Fresh-claude review of the whitespace feature found the write/read sides + disagree: parsing now accepts space-containing filenames into the policy, but + load_state_without_policy split the dpkg-statoverride DB line on whitespace and + required exactly 4 fields, silently dropping any spaced path. A spaced SUID file + then got hardened but could never be un-hardened ('disable' never found it), and + repeated 'enable' failed with exit 203. + + - Read the three fixed fields (owner group mode) and take the remainder as the + path, matching the DB's 'owner group mode path' format. + - Regression test test_state_spaced_filename.sh: seed a spaced entry, disable, + assert the mode is restored (fails on the old reader: file stays un-restored). + - Test hygiene: print-policy captures modes into the state DB, so the two + print-policy tests now remove the entries they create instead of leaving stale + root-owned overrides for deleted temp files. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 6dcffee4bf717bfac9a4c13153dcaa1a25cdc89f +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 13:12:25 2026 -0400 + + permission-hardener: unify mode anchoring across all field widths + + Fresh-claude follow-up: the field_count==4/5 existence override did not cover a + 6-field line (spaced filename + numeric octal-looking owner + capability), which + anchored the mode on the owner and silently dropped the entry. No hardening + bypass -- numeric owners are rejected later against passwd names -- but a silent + drop instead of a loud rejection, and the ==4 disjunct was dead code. + + Replace the special-case override with one existence-based loop: among the octal + candidates at field_count-3 and field_count-4, pick the one whose recovered + filename exists; a mode at field 1 means no-space (no recovery); fall back to + the rightmost octal candidate when neither name exists. Handles the 3-field, + 4-field, spaced, numeric-owner and 6-field cases uniformly. + + - Regression test: 6-field spaced numeric-owner case; the suite now + distinguishes this fix from all three prior parser iterations. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 73cc7889b271e2f3733daed276ba235dde04dc20 +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 13:00:51 2026 -0400 + + permission-hardener: disambiguate octal-ambiguous entries by file existence + + Fresh-claude review found the earlier field-1 guard reintroduced a symmetric + misparse: a spaced filename whose second component is a bare octal (e.g. + '/srv/a 744 0644 root root') got dropped because the guard mistook the octal + component for the mode. + + The 5-field reading is genuinely ambiguous lexically -- '/a 744 0644 root root' + (spaced name) vs '/foo 0744 1000 root cap' (numeric owner). Resolve by which + candidate filename exists on disk, consistent with the tool skipping + nonexistent targets. Keep the no-recovery reading only when field 1 is an octal + mode and only the un-recovered name exists. + + - Replace the lexical guard with the existence check inside the right-anchor + branch; the whitelist-keyword branch is no longer gated (it was wrongly + skipped for '/x 744 y matchwhitelist'). + - Regression test: spaced octal-second-component case; the assertion now matches + the whole first column (trailing TAB) so '/a 744' cannot substring-match the + '/a 744 name' entry. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 780561e61a6bf1c8d110d1105a5102b59ceb14ea +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 12:49:10 2026 -0400 + + permission-hardener: fix disable-all directive + numeric-owner misparse + + Both surfaced by a fresh-claude review of the right-anchor change. + + - whitelists_disable_all=true was unreachable: the character-class check (which + excludes '=') ran before the directive check, so the documented line tripped + "invalid characters" and aborted the whole run (exit 200). Recognize the + directive first. + - Numeric octal-looking owner in a capability entry (e.g. ' 0744 0755 root + cap'): right-anchoring folded the owner into the mode position, the folded + path did not exist, and the entry was silently dropped -- file left + un-hardened. Skip recovery when the line is already a well-formed no-space + entry (octal mode at field 1, count 4 or 5). + - Correct the stale field-order comment: the tail is + 'filemode user_owner group_owner [capability]', mode first (per add_to_policy). + - Regression tests: numeric-owner case in the whitespace test; new + test_whitelists_disable_all.sh. Both fail on the pre-fix code. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit fca4984733e4aff6b90e8dd248d38b8cbb3889cc +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 12:40:52 2026 -0400 + + permission-hardener confs: correct gst-ptp-helper path/pkg and #8633 fix credit + + - 30_default.conf: gst-ptp-helper ships in libgstreamer1.0-0, not + gstreamer1.0-plugins-base; fix the disabled entry's path to + .../gstreamer1.0/gstreamer-1.0/... (first component was gstreamer-1.0, + which does not exist). Verified via dpkg -S. + - 25_default_whitelist_qubes.conf: the #8633 EoP fix is qfile-unpacker + (qubes-core-agent-linux) refusing a UID change other than the caller's; + libqubes-pure path/symlink sanitization (qubes-linux-utils PR #87) is a + separate layer. The comment credited only PR #87. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 37ad483b25c43b93bb350983c2534f9d775e977a +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 12:34:17 2026 -0400 + + permission-hardener: anchor mode tail from the right for spaced filenames + + - Space filenames are recovered from the option tail; the mode/owner/group + [/capability] tail has a fixed width (3 or 4 fields). + - Old left-to-right octal scan misanchored when a space-delimited filename + chunk was itself a bare octal (e.g. '/path/a 744 name 0744 root root'): the + field-count check then failed and the WHOLE hardener aborted (exit 200), + contradicting the comment that claimed such a line was skipped. + - Anchor the mode from the right (field_count-3, else field_count-4); prefer + the 3-field reading so a filename ending in an octal chunk is not mistaken + for a 4-field capability tail. + - Regression test: config line with a bare-octal filename chunk must parse via + print-policy; fails on the old code (exit 200 / entry missing). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit c2fcb2d893bf26a59c1b25415333fafcad8682dc +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 05:15:00 2026 -0400 + + security-misc: drop versioned bash dependency + + - Revert the bash (>= 4.4) Depends. Supported Debian (trixie+) always + ships bash >= 4.4 and earlier is unsupported, so the inherit_errexit + builtin is always present; the dependency adds nothing. Policy bans it + (bash-style-guide R-010b). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit a66fa50019f95326fef372ec5b3d1cde3b59b4a9 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:55:18 2026 -0400 + + security-misc: fix undo chown empty-arg + emerg fallback (ai-review) + + - undo_policy_for_file: the strict-mode brace pass quoted "${verbose}", + so 'permission-hardener disable all' ran 'chown "" -- ...' (invalid + empty owner) and 'chmod "" ...'. Make verbose an array so an empty + value expands to zero arguments. Canary-verified. + - emerg-shutdown fallback: when the prebuilt binary is absent, compile + straight into /run (tmpfs, writable even if /usr is read-only) rather + than via build-emerg-shutdown into /usr/bin. + - Document the space-filename parser limitations (consecutive spaces + collapse; an octal-looking path chunk can misanchor -> entry skipped). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit c4bf5403d0dbda87b2e1fe165ade7c81bf4e1b30 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:44:07 2026 -0400 + + security-misc: declare bash (>= 4.4) for inherit_errexit + + - Many scripts use 'shopt -s inherit_errexit' (bash 4.4+) in their + strict-mode preamble; ${misc:Depends} does not supply the baseline, so + an older /bin/bash would die in the preamble before the script's logic. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 5b34c9406198a47ce0c8d78a143606056e9d51b0 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:49 2026 -0400 + + security-misc: dfuzzer commit pin, marker rewords, remount-secure cleanup + + - ci/dfuzzer-build.sh: pin dfuzzer to the exact upstream commit and + verify the tag resolves to it (a moved tag now fails loudly). + - grub 40_kernel_hardening + remount-secure hidepid: reword standing + 'TODO' notes to 'REMINDER' (tracking, not pending work). + - remount-secure: replace the echo/true toggle with a printf-array + output helper; bring the file to strict-mode / shellcheck compliance + (6-directive block, braces) as required to touch it. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 9f12941585d5b18ae79f5d8dfd9f94cc0cd2507d +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:35 2026 -0400 + + security-misc: document whitelisted SUID/SGID helpers, flag human-only + + - Replace the bare 'TODO: research' markers on the permission-hardener + whitelist entries (postfix, selinux/utempter, spice, virtualbox, + qubes/qfile-unpacker, pam-tmpdir-helper, gst-ptp-helper) with concise + documentation: what each helper is, why it is SUID/SGID, what breaks if + stripped, and relevant CVE/hardening notes. + - Retag the keep-vs-strip decisions TODO-HUMAN-DEVELOPER-ONLY -- a + security-trust call for a human maintainer, not AI-resolvable. + - 30_default.conf: fix the commented gst-ptp-helper path typo + (gstreamer1.0/grstreamer-1.0 -> gstreamer-1.0/gstreamer-1.0); note that + filenames with spaces are now parsed. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 8aef705e63595beaa90f70e9c8a4f297fd7a08ee +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:20 2026 -0400 + + security-misc: fm-shim frontend calls xdg-mime/gio by absolute path + + - fm-shim-frontend invoked xdg-mime and gio by bare name, depending on + the systemd --user manager's PATH (minimal, profile-derived entries + absent) that fm-shim-backend hands it. Use /usr/bin/xdg-mime and + /usr/bin/gio, matching the existing /usr/bin/unicode-show call. + - Reword the backend TODO: the whole-session PATH fix belongs in + desktop-config-dist's start-lxqt-session (out of this repo); the + frontend absolute-path change is the in-repo mitigation. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 8ba6ca134e52411ce18f29b553dbfedb42b8ed3e +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:08 2026 -0400 + + security-misc: silence expected pam_exec journal noise via quiet_log + + - The [success=1 default=ignore] pam_exec lines run helper scripts that + exit 1 on their expected control-flow path, emitting an alarming + 'pam_exec(...): ... failed: exit code 1' journal line. Plain 'quiet' + suppresses only the user-facing message, not the log. + - Add 'quiet_log' (linux-pam >= 1.5.2, present on bookworm+) to every + skip-logic pam_exec line (console-lockdown, unix-faillock, + faillock-preauth, wheel), leaving the control flow byte-identical. + - Update the scripts' comments to point at the resolution. + + Note: not verified on a live login journal (needs a real PAM stack); + the change is additive and semantics-preserving regardless. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 8c991dd34247e7cc43843a1dff6d5300330646f1 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:39:52 2026 -0400 + + security-misc: compile emerg-shutdown once at postinst, not every boot + + - emerg-shutdown.c was recompiled into /run on every boot. Move the + compile to a standalone build-emerg-shutdown run from postinst, which + installs /usr/bin/emerg-shutdown. Compiling on-target keeps the package + Architecture: all while still producing a correct per-arch static binary. + - Boot-time emerg-shutdown now just copies /usr/bin/emerg-shutdown into + /run (memlockd-resident), with a fallback build if the binary is absent. + - dracut module ships /usr/bin/emerg-shutdown (exists right after install, + fixing the require_binaries /run chicken-and-egg). + - Sandbox-verified: build-emerg-shutdown produces a static ELF in /usr/bin. + - Strict/style compliance on the touched scripts (waivers for the debconf + maintainer script and the dracut-sourced module). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 942ba8a1902c2c8a0d6cd1921f2b540eb413a217 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:39:33 2026 -0400 + + security-misc: permission-hardener parse filenames with spaces + + - load_state() split config lines on every space, so any entry whose + filename contains a space was mis-fielded: silently skipped (a SUID + binary left un-hardened) or mapped to a corrupted policy entry. + - Recover the filename by parsing options from the right -- a trailing + whitelist keyword, or the mode/owner/group[/capability] tail anchored + by the octal mode. Space-free lines unchanged. + - Add regression test (drives the real script via print-policy) plus its + CI workflow. Canary-verified: fails on the pre-fix parser, passes now. + - Bring the file to strict-mode / shellcheck compliance as required to + touch it (6-directive block, printf, braces). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit ec78b99bb1be3be87fb07b3c269d54dc4f1db113 +Merge: a8f26061 1fcf4967 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 03:30:39 2026 -0400 + + Merge branch 'master' into ai + + Absorb upstream + fork-trunk work (merged PRs #23/#26, CI-workflow + propagation, changelog bump) so the PR diff carries only our own commits. + +commit 52e18f723e37b5e5616ae6681f9e3cd28369e88c +Merge: 2da1f21c eb5b301d +Author: Patrick Schleizer +Date: Wed Aug 12 03:02:01 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit a8f26061e0e199b95077aa20696257bddc3db73d +Author: claude (dev182 e09ec5cf-4ebf-4e1b-88e5-55fbac6ef1d3) +Date: Mon Aug 10 13:56:04 2026 -0400 + + Drain input in USB-controller and config-file lookups + + check-for-usb-controller: grep --quiet exits on the first match and closes + the pipe, sending SIGPIPE to lspci. Under pipefail the pipeline then reports + 141, so the guarding if takes the false branch even when a USB controller is + present. Let grep read the whole stream and redirect to /dev/null instead. + + mmap-rnd-bits: head -n 1 has the same early-close hazard against ls; use + sed -n '1p', which consumes all input, for consistency. Drop the redundant + duplicate set -euo pipefail line already covered by the long-form preamble. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit eb5b301db6069a5ccabf327745a000053ece1475 +Merge: a5655e63 2da1f21c +Author: Aaron Rainbolt +Date: Sun Aug 9 12:06:37 2026 -0400 + + Merge branch 'master' into arraybolt3/trixie + +commit a5655e632e2d67a1ef9ff1c1b998d179fc9c71d8 +Author: Aaron Rainbolt +Date: Sun Aug 9 01:46:03 2026 -0400 + + Fixes and TODOs + +commit 21048819c7b1c06c3f7ebee845e2332fa7c93ba8 +Merge: dc1a17c2 1ec153c3 +Author: Aaron Rainbolt +Date: Sun Aug 9 01:04:49 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit 1ec153c3f0db147e82f9d6c4c82b5a1026eada7b +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Fri Aug 7 07:17:03 2026 -0400 + + fix shellcheck directives for an isolated CI checkout + + The gate passed locally but failed (or would fail) in CI. Cause: CI checks + each repo out ALONE, while locally they sit side by side as submodules + under derivative-maker/packages. A '# shellcheck source=' climbing out of + the repo ('../../../../helper-scripts/...') therefore resolves here and + not there, so shellcheck reports SC1091 and the gate fails on a commit + that looked clean. + + The source= paths are kept -- they document where the file actually lives + -- and each is paired with a 'disable=SC1091' so an absent sibling is + tolerated. Same shape already used in security-misc master. + + Follow-on findings from the same isolated run, each with a stated reason + rather than a blanket waiver: + - SC2154 on systemd_notify: assigned by the sourced systemd-notify.bsh, + which shellcheck can no longer follow. + - SC2034 on SCRIPTNAME and output_cmd: genuinely unused. suspend-pre's + output_cmd toggle is vestigial -- unlike suspend-post the script prints + directly -- flagged rather than removed, since wiring it up or dropping + it is a maintainer call. + - SC1090 on the uwt.d conf glob: a dynamic source, which R-081 prescribes + SC1090 for. + + Verified with a new reproducer, ~/strict-pass-tests/ci-repro.sh, which + clones the repo on its own and runs the real gate there -- the condition + CI actually sees. All six repos: gate exit 0. + + Co-Authored-By: Claude Opus 5 (1M context) + +commit 9d6c4634a056c0711d3a42b8c3e4c876b93ec001 +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Wed Aug 5 13:57:59 2026 -0400 + + security-misc: R-010 strict for the remaining standalone scripts + + Covers the eleven remaining standalones, plus the whole-file debt the gate + surfaces on each: echo -> printf (R-034), 'has' instead of 'command -v' + (R-090, sourcing has.sh -- security-misc-shared already Depends on + helper-scripts), safe-rm (R-120), SC2250 braces. + + permission-lockdown needed care. Its loop chmods every home directory and + records a state file per user, and it tolerated per-user failures: a + directory it could not chmod did not stop the ones after it. Under errexit + the first failure aborted the whole loop, so every remaining home directory + silently stayed un-locked-down -- observed in the sandbox as 1 user + processed instead of 11, and the script exiting 1 rather than 0. The two + per-user operations are now explicitly best-effort, restoring the original + behaviour (including that a failed chmod still records the state file -- + arguably wrong, but changing it is not this pass's business). + + mmap-rnd-bits keeps its 'ls -1 -t /boot/config-* | head -n 1' with a + reasoned SC2012 disable: kernel config filenames carry no spaces or + newlines, so the parsing hazard is unreachable, and rewriting newest-file + detection in a security package is risk without gain. + + Not touched, deliberately: the dracut modules under + usr/lib/dracut/modules.d*. 'module-setup.sh' is SOURCED by dracut at + initramfs build time, and remount-secure.sh is installed with 'inst_hook' + and SOURCED by dracut-lib at BOOT. A strict-mode block in either runs in + dracut's own shell; in the boot case that risks an unbootable system. + + Sandbox differential vs the pre-change scripts, comparing output AND exit + code: 36 cases identical. The only two remaining deltas are 'set -x' traces + of the preamble and of echo -> printf, both at unchanged exit codes. + + Co-Authored-By: Claude Opus 5 (1M context) + +commit 59b3e60b2627a9eeda0f4e7cbd4804958cabedd3 +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Wed Aug 5 13:57:39 2026 -0400 + + security-misc: R-010 strict for the PAM helpers, preserving exit codes + + These four scripts are invoked by pam_exec and their EXIT CODE is the + security decision: the PAM stacks use '[success=1 default=ignore]', so the + code selects whether the next module runs. Strict mode must not perturb it. + + PAM_SERVICE and PAM_USER come from pam_exec's environment. Read bare under + nounset they abort the script with a NONZERO status, which PAM then reads + as a control-flow decision. Each is now read as '${VAR:-}', which + reproduces today's semantics exactly (an unset value falls through to the + same branch it already took). + + pam-abort-on-locked-password was the sharp case. It documents "identifiable + exit codes in case stdout / stderr is not logged in journal"; with PAM_USER + absent it returned 3 ("user does not exist"), and a bare read turned that + into 1. Verified restored. + + Exit-code matrix, old vs new, all matching: + PAM_SERVICE=login -> pam_only_if_login 1, pam_only_if_su 0 + PAM_SERVICE=su -> pam_only_if_login 0, pam_only_if_su 1 + PAM_SERVICE=sshd -> both 0 + PAM_SERVICE empty -> both 0 + PAM_SERVICE absent -> pam_only_if_login 0, pam_only_if_su 0, + pam_faillock_not_if_x 1 + PAM_USER root / nonexistent / absent -> pam-abort 3 in every case + + Co-Authored-By: Claude Opus 5 (1M context) + +commit a2b13848b6a2189c0bda2b478f5ac1b0f9c88819 +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Wed Aug 5 13:57:22 2026 -0400 + + security-misc: R-010 strict for the module-disabled alert scripts + + The thirteen disabled-*-by-security-misc scripts are near-identical: they + warn that a kernel module was blocked and exit 1. Add the strict preamble + and convert echo -> printf (R-034). + + The '$@' inside the message becomes '$*' deliberately. Under printf, + "...$@" expands to one argument per positional parameter, so a multi-word + invocation would print one word per line; '$*' joins with spaces, which is + what echo did. + + Sandbox differential vs the pre-change scripts: all thirteen byte-identical + in output and still exit 1. + + Co-Authored-By: Claude Opus 5 (1M context) + +commit 1fcf496705dd9b44ca62d01f737ffb9c6355e715 +Merge: e59019a5 e8e9fd4f +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat Aug 1 05:01:13 2026 -0400 + + Merge pull request #23 from org-ai-assisted/ai-claude-review-mention-only + + consumer-claude-code: mention-only triggers (propagated from template) + +commit e59019a54fb525d7cf884f10d26226efb1d8ab21 +Merge: 2da1f21c 32cb7a2f +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat Aug 1 05:01:08 2026 -0400 + + Merge pull request #26 from org-ai-assisted/ai + + CI: add codeql-actions + secrets-audit scanner workflows + +commit 2da1f21cb66cd52b04c7d25b7053524cd6cd6611 +Author: Patrick Schleizer +Date: Sat Aug 1 08:12:04 2026 +0000 + + bumped changelog version + +commit 32cb7a2f36105a23bed0562293901e3799cd7892 +Author: claude (dev142 b93fb2c6-e15f-4d45-8566-f3ded893b70e) +Date: Fri Jul 31 16:23:30 2026 -0400 + + CI: propagate codeql-actions + secrets-audit consumer workflows + + Byte-identical propagation from developer-meta-files + consumer-templates. Closes scanner-coverage gaps + (bandit already present): + + - consumer-codeql-actions.yml: CodeQL 'actions' language -- + workflow-YAML security analysis (script-injection, missing + permissions, unpinned actions). + - consumer-secrets-audit.yml: manual-dispatch secrets surface + audit (presence flags only, values never emitted). + + Managed files -- do not hand-edit; regenerated on the next + propagation pass. + + ## AI-Assisted + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 83b8f6650bae86e75258e4643ec7c8a273993919 +Merge: f8c82a87 f0478e7b +Author: Patrick Schleizer +Date: Fri Jul 31 13:16:34 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit f0478e7b7cff57d8002501d17c8196889de66a27 +Merge: f8c82a87 4b410ccd +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Fri Jul 31 10:22:34 2026 -0400 + + Merge pull request from org-ai-assisted/ai + + ci: gate the local workflows on CI_ENABLED_ORG_AI_ASSISTED + +commit 4b410ccda527cf1f28d9d5eb8a4ea2a0ad7965ee +Author: claude (dev138 9b889944-0a22-45e7-8fd6-c189113e33b9) +Date: Fri Jul 31 09:38:10 2026 -0400 + + ci: gate the local workflows on CI_ENABLED_ORG_AI_ASSISTED + + Our workflows ran wherever the branch landed. Merged upstream they burn + Kicksecure/Whonix runner quota and post our CI into repos that never + asked for it; on a contributor fork they run the whole suite unbidden. + Only 5 of 136 workflow files across the fleet carried any owner gate. + + Gate: a job-level `vars.CI_ENABLED_ORG_AI_ASSISTED == 'true'`, set once + as an organization variable on org-ai-assisted. Zero runner cost -- a job + whose `if:` is false never allocates one -- and the run still reports + green, so upstream and forks are not handed a red X for a lane they did + not opt into. A fork that WANTS the lane sets the same variable in its + own repo; no patch to these files, no fork of our workflows. + + ANDed in front of any existing fork-PR guard rather than replacing it. + + Verified: the workflow-yaml validator reports 0 findings for this repo. + + Generated with assistance from Claude Code. + +commit e8e9fd4fae34474d5d1a96c516ddfd1913b7fd82 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Thu Jul 30 11:59:15 2026 -0400 + + consumer-claude-code: propagate the corrected template + + Byte-identical to developer-meta-files consumer-templates. + + The github.ref comment was wrong for one of the two events it described: + issue_comment fires with the default branch ref, pull_request_review_comment + with the PR merge ref (refs/pull//merge). No behaviour change -- the + concurrency group reaches github.ref only if neither number field is set, and + one always is for the events this workflow accepts. + + Generated with assistance from Claude Code. + +commit 867809170a265b269a34f6d704c97ec53744cd4d +Author: Ashlen +Date: Wed Jul 15 19:06:42 2026 -0600 + + fix(pam): pass profile names to pam-auth-update --remove + + 'pam-auth-update --remove' matches pam-config filenames under + /usr/share/pam-configs/, but prerm and postrm passed + $DPKG_MAINTSCRIPT_PACKAGE -- the package name security-misc-shared -- + which matches no profile. An unknown target is stored without + validation and simply never matches, so the --remove was inert in + both calls: the prerm call was an effective no-op, while the postrm + call still performed a plain reconciliation. + + The prerm early-disable was therefore dead. On removal + /etc/pam.d/common-* kept referencing helper scripts under + /usr/libexec/security-misc/ that dpkg then deleted; + block-unsafe-logins is a Priority 1100 'requisite' entry, so a + dangling reference fails all authentication until postrm's + reconciliation regenerates common-* -- permanently, if postrm fails + before that point. + + prerm now passes the eight profile filenames explicitly. postrm + drops the ineffective '--remove ' for a plain + reconciliation and guards it with 'command -v': Debian Policy 7.2 + gives no guarantee that dependencies are available when postrm runs + and requires postrm to gracefully skip such actions, and an absent + pam-auth-update would abort the script under 'set -e'. prerm stays + unguarded: Policy names Depends (here libpam-runtime) as the + mechanism prerm scripts rely on, dependencies there normally being + at least unpacked. + + One consequence of a '--remove' that now takes effect: it also drops + the eight names from /var/lib/pam/seen. If a removal is aborted, + postinst's 'pam-auth-update --package' re-enables the seven + 'Default: yes' profiles among them, including any of them an + administrator had deliberately disabled (other packages' profiles + remain in seen and are unaffected), while + console-lockdown-security-misc ('Default: no') stays off until an + administrator re-enables it -- reinstalling does not restore it, + since preinst's enable is behind a do_once stamp. Both are new + relative to the previous inert behavior. + +commit 077d41a6b193787dc31718370c1532d6638569bc +Author: Ashlen +Date: Wed Jul 15 12:54:05 2026 -0600 + + fix(remove-system.map): continue past undeletable files + + The deletion loop called `exit 0` on the first System.map that `[ -w ]` + rejected, so copies in later locations were never shredded. Where + `[ -w ]` passed but shred failed anyway, shred ran as a bare command and + tripped the ERR trap that pre.bsh installs, aborting with a "## Please + report this bug!" banner and exit 1. + + Branch on shred's exit status instead of `[ -w ]`, which does not + predict removability. Unlinking depends on write permission on the + parent directory rather than on the file itself, and an append-only file + passes the test yet cannot be unlinked at all. For a full-capability + root process the check is also true on a mode 444 file, so it only ever + failed on read-only file systems and on files carrying the immutable + attribute. + + Clear the immutable and append-only attributes before each attempt. Per + review, a System.map should never be immutable and `chattr +i` would + possibly complicate kernel package removal; append-only is cleared on + the same grounds, since it blocks removal without affecting `[ -w ]`. + + Report the files that remain once at the end, under a single wiki link + rather than repeating it on every line, and withhold "Done. Success." + when anything failed. A file reachable under two names, such as + /lib/modules//build and the source symlink beside it, is listed + under each, since both matched and both failed. + + Iterate an array rather than word-splitting a string with IFS, which a + /etc/remove-system.map_pre.d drop-in can set; under `IFS=:` the globs + matched nothing, so the script deleted nothing and still exited 0. + + The removal loop no longer exits early on failure and the script ends in + an explicit `exit 0`; a non-zero status would fail the kernel package's + postinst hook and the oneshot unit on every boot. + +commit 5daefde4e8cb4705d8fbe7886f2e003e61e0b974 +Author: claude (dev118 bd22decd-3027-4ab5-9e48-11adfe39b279) +Date: Tue Jul 28 13:50:24 2026 -0400 + + consumer-claude-code: mention-only triggers (propagated from template) + + Byte-identical cp from developer-meta-files/consumer-templates. + + pull_request and workflow_dispatch resolve to claude-code-action's + agent mode, whose trigger is a non-empty 'prompt' input that this + workflow does not pass, so those events could only spin up a runner + and exit without calling the model - a green "Claude Code Review" + check that reviewed nothing. + + Co-Authored-By: Claude + +commit f8c82a87f207eee40dad64e0d090be5cd2858b76 +Author: Patrick Schleizer +Date: Tue Jul 28 13:20:23 2026 +0000 + + bumped changelog version + +commit ec941913e9bf1ad4e33a8146812cfe3c07cde956 +Merge: d1381a0c a5420ffb +Author: Patrick Schleizer +Date: Tue Jul 28 08:12:04 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit d1381a0c16ca62d8ac61fa00dcc5d760b8f5d106 +Merge: 2ac7df95 dc1a17c2 +Author: Patrick Schleizer +Date: Tue Jul 28 07:44:23 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit a5420ffb35edf92c0c953b09cd31580cd74c1d27 +Author: claude +Date: Tue Jul 28 06:17:17 2026 -0400 + + consumer-codex-review: drop OPENAI_API_KEY forward to the disabled reusable + + Propagates org-ai-assisted/developer-meta-files#167. The reusable is a no-op + stub (job 'if: false') and no longer declares an OPENAI_API_KEY secret; + forwarding an undeclared secret is rejected by GitHub at workflow startup + (startup_failure). Dropping the forward lets the no-op run green; Codex review + stays cleanly disabled. + + Co-Authored-By: Claude Opus 4.8 + +commit dc1a17c2c3047cc985a121275792460f1dbb5730 +Merge: 7f55b21b da942f8b +Author: Aaron Rainbolt +Date: Mon Jul 27 21:04:57 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/pam-info-empty-deny-fallback' into arraybolt3/trixie + +commit da942f8b9dcbbc9fd62777181b99d3b6e97b41a0 +Author: Ashlen +Date: Wed Jul 15 13:23:54 2026 -0600 + + fix(pam-info): restore deny default when faillock.conf lacks it + + When /etc/security/faillock.conf has no uncommented "deny =" line + (commented out, or written without spaces), the parse overwrites the + deny=3 default with an empty string. The empty value slips past the + [[ "$deny" == *[!0-9]* ]] numeric guard, then evaluates to 0 in the + remaining-attempts arithmetic, producing a false "Login blocked, boot + into recovery mode" message for users still well below the threshold. + + Fall back to the documented default of 3 when the parse yields empty. + +commit 2ac7df95d287e98bccae5c583f4d3ac33575da36 +Merge: 7f55b21b e645c7c1 +Author: Patrick Schleizer +Date: Thu Jul 23 08:18:02 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit e645c7c17913ca72ed1a4c593d9c6edc95c0457c +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Wed Jul 22 10:21:24 2026 -0400 + + consumer-claude-code: forward CLAUDE_CODE_OAUTH_TOKEN (claude review OAuth port) + +commit b684685bd03755c79b823076d111b29541469491 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue Jul 21 09:05:41 2026 -0400 + + Coverity: point CI at the org-ai-assisted-security-misc project (#22) + + project-name -> org-ai-assisted-security-misc; canonical-repos -> org-ai-assisted/security-misc. Project registered + repo COVERITY_SCAN_TOKEN set. + + AI-Assisted + + Co-Authored-By: Claude Opus 4.8 + +commit 7f55b21b018a8133a2ab5cc82bc5145caa8f0174 +Author: Patrick Schleizer +Date: Tue Jul 21 09:23:19 2026 +0000 + + bumped changelog version + +commit 2b0422a2dab93fd29393b7e400a07dc5b75a8da4 +Merge: f5e6783a 545c9430 +Author: Patrick Schleizer +Date: Tue Jul 21 04:18:24 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 545c94307bd7dcdcefe67c8061b8dd18caf17b79 +Author: Aaron Rainbolt +Date: Sun Jul 19 20:14:13 2026 -0400 + + printf + +commit 46e87db6d5d7d7071d3766a5f9b20b880cd54b10 +Author: Aaron Rainbolt +Date: Sun Jul 19 20:12:46 2026 -0400 + + end-of-options + +commit e9b3374a305ace3d6c40cc5143627e31c38602b2 +Merge: b9a492bb 90b514c7 +Author: Aaron Rainbolt +Date: Sun Jul 19 20:09:33 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/hide-hardware-info-getent' into arraybolt3/trixie + +commit b9a492bb071a4726672f0b0c14a7586c60536e21 +Author: Aaron Rainbolt +Date: Sun Jul 19 19:46:33 2026 -0400 + + Revert "udev: mark optical drives UDISKS_IGNORE (quiet + harden)" + + This reverts commit 41638e64911a7f019b32cacd5a368ec480fcc21a. The change + was made to avoid a spurious error in CI, and the underlying issue has + been fixed in a different way now, so this is no longer needed. + +commit aab24f84e4677d9447d339c5f6ee0699f8e0b97b +Author: Aaron Rainbolt +Date: Sun Jul 19 19:23:52 2026 -0400 + + Don't use required dependencies in emerg-shutdown to keep systemd from terminating it when the boot drive is removed + +commit 097880e26749bc874ba266cadaa84a8a3925dc4a +Merge: 0a4386b1 81096c4b +Author: Aaron Rainbolt +Date: Sun Jul 19 18:03:32 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/emerg-shutdown-fd-leak-sigsys' into arraybolt3/trixie + +commit 0a4386b1927a76f0d3d6010d33bd9f1b5b23af89 +Author: Aaron Rainbolt +Date: Sun Jul 19 18:03:01 2026 -0400 + + Swallow signals in emerg-shutdown's hardware monitor mode too + +commit 7d1553c5136942c38c59d4d5c8cec673e2ba1f06 +Merge: f5e6783a 6dc96859 +Author: Aaron Rainbolt +Date: Sun Jul 19 11:47:42 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/virusforget-error-handling' into arraybolt3/trixie + +commit f5e6783afe645a9bded31e63241d2b76f9945807 +Merge: f9853503 57b0072b +Author: Patrick Schleizer +Date: Sun Jul 19 03:40:40 2026 -0400 + + Merge remote-tracking branch 'org-ai-assisted/master' + +commit f9853503c5847d960d83499c6d8ef02ce8e045fd +Merge: b39215e4 f3a060ed +Author: Patrick Schleizer +Date: Sun Jul 19 03:39:58 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit f3a060ed528a66f3524206a22108b59e3de67ef2 +Merge: 89745aab 6f3f6425 +Author: Aaron Rainbolt +Date: Sun Jul 19 01:28:06 2026 -0400 + + Merge remote-tracking branch 'maybebyte/docs/config-section-numbering' into arraybolt3/trixie + +commit 89745aabf7931aad32ea437b6e644146a63d46a3 +Merge: 27009709 b39215e4 +Author: Aaron Rainbolt +Date: Sun Jul 19 01:19:36 2026 -0400 + + Merge branch 'master' into arraybolt3/trixie + +commit 2700970971f97a732ef1d53c407c8e2e6d2b575d +Author: Aaron Rainbolt +Date: Sun Jul 19 01:08:29 2026 -0400 + + Fix messaging when a file with multiple hardlinks is skipped over + +commit 7a603055bf11f7d0d4162d4c437aa95f034ebb89 +Author: Aaron Rainbolt +Date: Sun Jul 19 00:55:13 2026 -0400 + + Fix output when permission-hardener encounters a file with multiple hardlinks + +commit 9a3e8851404f6e6a1fa1fcfefebe68b17dd6dbb7 +Merge: 98c27d90 1625a3db +Author: Aaron Rainbolt +Date: Sun Jul 19 00:48:40 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/permission-hardener-whitelist-and-errexit' into arraybolt3/trixie + +commit 57b0072b0194848b5bc3816efb4b243bba343141 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat Jul 18 20:00:25 2026 -0400 + + Coverity: point CI at the org-ai-assisted-security-misc project + +commit b39215e47fc127ef41951b7d686237c1e48dc9ba +Merge: 4ed85e1f 26ef321b +Author: Patrick Schleizer +Date: Sat Jul 18 16:26:00 2026 -0400 + + Merge remote-tracking branch 'org-ai-assisted/master' + +commit 4ed85e1f6114fa74debc17b88eeb165c4f8afc15 +Merge: 59decfa2 98c27d90 +Author: Patrick Schleizer +Date: Sat Jul 18 16:24:30 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 98c27d9074f31cfeb006ecce1aef10a90e06a8c7 +Merge: c3ec2119 b076e2c0 +Author: Aaron Rainbolt +Date: Fri Jul 17 21:12:46 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/ensure-shutdown-nounset-default' into arraybolt3/trixie + +commit c3ec2119b2fa7e8c172fe7a63686b98e66b3c35e +Merge: 59decfa2 1a71a3e9 +Author: Aaron Rainbolt +Date: Fri Jul 17 21:02:54 2026 -0400 + + Merge remote-tracking branch 'assisted-by-ai/claude/comment-bdev-allow-write-aYEla' into arraybolt3/trixie + +commit 26ef321b73377254da64007362fdadfa602fb384 +Merge: 55c087cc 41638e64 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Wed Jul 15 23:46:34 2026 -0400 + + Merge pull request #20 from org-ai-assisted/udisks-ignore-optical + + udev: UDISKS_IGNORE optical drives + +commit 41638e64911a7f019b32cacd5a368ec480fcc21a +Author: assisted-by-ai +Date: Wed Jul 15 23:34:07 2026 -0400 + + udev: mark optical drives UDISKS_IGNORE (quiet + harden) + + udisks auto-probing removable optical media (sr*) is noisy -- on a drive with no + or inert media (e.g. a VM CD-ROM) it errors repeatedly ('udisksd: Error probing + device: Error sending ATA command IDENTIFY PACKET DEVICE to /dev/sr0') -- and is + avoidable attack surface: inserted media should not be auto-processed without + user action. Add a udev rule marking optical drives UDISKS_IGNORE. This does NOT + affect booting the live ISO from optical media: rd.live mounts the medium in the + initramfs, not via userspace udisks. (AI-Assisted.) + +commit 90b514c7cdc33fa8237cf19b8e7a49827290de44 +Author: Ashlen +Date: Wed Jul 15 16:43:40 2026 -0600 + + fix(hide-hardware-info): look up group with getent + + The sysfs/cpuinfo whitelist gated its chgrp/chmod on + `grep -q "${1}" /etc/group`, an unanchored substring match over the + whole file. A group whose name merely contains the string, or a user + listed as a member of any group, produced a false positive: the branch + ran chgrp against a group that does not exist (silently swallowed by + `|| true`) and suppressed the "group does not exist" warning, so an + admin who never created the group was told nothing. + + Use `getent group "${1}"` instead. It matches by exact group name or + GID and consults NSS, so groups from non-file sources are recognized + as well. + + Co-Authored-By: Claude Opus 4.8 + +commit 6f3f6425eed69a50fe747262ce8d62d365432273 +Author: Ashlen +Date: Wed Jul 15 12:28:01 2026 -0600 + + docs: correct section numbering in config comments + + The sysctl config header claimed 5 sections while its list + enumerates 6 (through CD-ROM/DVD); update the count to 6. + + The modprobe config's Networking section header read "2.", + duplicating the File Systems section, while its own table of + contents and the following "4. Miscellaneous" section imply 3; + correct it to "3.". + +commit 1625a3db8fbb94da8c5558c52d9b7b481ce031cd +Author: Ashlen +Date: Wed Jul 15 12:15:57 2026 -0600 + + fix(permission-hardener): skip hardlinked files instead of aborting + + output_stat returned 1 for a non-directory SUID/SGID file with a + hardlink count > 1. The four call sites invoke output_stat as a bare + command under `set -o errexit`, so that return propagated and + terminated the whole run instead of skipping the file. The following + `if [ -z "${file_name_from_stat}" ]` guard never caught this case + because file_name_from_stat was already populated. + + The surrounding comment states hardlinked files are meant to be + skipped (scanning a hardlink pool is too costly). Blank the output + vars and return 0, matching the existing nonexistent-file skip path, + so the caller's empty-name check continues past the file. Genuine + error paths (stat failure, parse corruption) still return 1 and fail + loud. + +commit 4af4392bc3f2c37784d11a6b49cb1b9eb7d9c3d9 +Author: Ashlen +Date: Wed Jul 15 12:15:22 2026 -0600 + + fix(permission-hardener): prevent fail-open on empty matchwhitelist + + check_nosuid_whitelist iterated with + "${policy_match_white_list[@]:-}". Under `set -o nounset` the `:-` + default expands an empty array to a single empty-string element, so + the loop ran once with an empty entry. The body test + `[[ "${target_file}" == *""* ]]` matches every string, so the + function returned 1 (whitelisted) for every file. Both callers use + `|| continue`, so an effective config with no `matchwhitelist` line + silently skipped all SUID/SGID hardening with exit 0 -- a fail-open. + + Expand with ${arr[@]+"${arr[@]}"} instead, which yields no elements + when the array is empty and does not trip nounset. + +commit 81096c4b8fd58b42c04c486e89b1ff016365f62a +Author: Ashlen +Date: Wed Jul 15 11:45:21 2026 -0600 + + fix(emerg-shutdown): swallow SIGSYS in signal-ignore loop + + max_sig_num is 31, but the SIG_IGN loop used a strict "<" bound, so it + covered signals 1..30 and never touched signal 31 (SIGSYS on Linux). + The real-time loop starts at SIGRTMIN, leaving SIGSYS covered by neither + loop, so it kept its default terminate disposition despite the "Swallow + all signals that we can." intent. + + Use "<=" so the loop reaches 31; SIGSYS is ignorable, and the bound + still stops before the glibc-reserved signals 32 and 33. This is a + robustness fix, not a hardening gain: SIGKILL and SIGSTOP are unblockable + anyway, so an actor able to send SIGSYS can already kill the monitor -- + the value is surviving an internally generated SIGSYS (e.g. a bad + syscall). + +commit 5bb3f0114bc6941506d432018487c35c3c19032d +Author: Ashlen +Date: Wed Jul 15 11:44:40 2026 -0600 + + fix(emerg-shutdown): close fds for non-panic input devices + + The input-device enumeration loop opens a descriptor for every + /dev/input/eventN but only stores it for devices that support the + panic-key combo. The two early-continue paths -- non-key devices and + keyboards lacking the panic keys -- returned without closing tmp_fd, + leaking one descriptor per non-qualifying device. + + The leak is bounded and one-time (the loop runs once at startup, not in + the poll loop) so impact is low, but the descriptors are held for the + whole process lifetime and never reclaimed -- the daemon never execs, + so O_CLOEXEC does not cover them. Close tmp_fd before both continues. + +commit b076e2c0b3a8a83fe2b11dc1b09b1c9f72301db6 +Author: Ashlen +Date: Wed Jul 15 11:25:07 2026 -0600 + + fix(ensure-shutdown): apply timeout default under nounset + + The script runs under 'set -o nounset'. When no config file assigns + ENSURE_SHUTDOWN_TIMEOUT, the bare "${ENSURE_SHUTDOWN_TIMEOUT}" in the + fallback guard raises an unbound-variable error and aborts before the + guard can apply the default, so ExecStart never starts the shutdown + monitor. Add the ':-' default in the -z test so the guard runs and + falls back to 30. The sibling emerg-shutdown wrapper avoids this by + pre-initializing its config variables before sourcing. + +commit 6dc96859dd7f350673cc917a8c41da8144357e62 +Author: Ashlen +Date: Wed Jul 15 10:59:09 2026 -0600 + + fix(virusforget): exit when --user does not exist + + The nonexistent-user branch printed a warning but, unlike every sibling + validation branch, neither exited nor wrote to stderr, so a mistyped + --user proceeded to operate on a bogus /home/ path. Send the error + to stderr and exit 1. + +commit a39b03ac2e18a83f73e4e320481323fc8ef8a795 +Author: Ashlen +Date: Wed Jul 15 10:58:42 2026 -0600 + + fix(virusforget): skip restore when backup is absent + + An extraneous file (present in the home directory but absent from the + committed backup) is deleted and then unconditionally passed to + restore_file, which runs `cp` from a backup path that does not exist. + Under `set -e` this aborts the entire `--clean` run on the first such + file, leaving the system partially cleaned -- the exact + malware-persistence scenario the tool exists to handle. + + Return early from restore_file when no backup exists. Deleting the + extraneous file is the correct action and is already done by the caller + (which keeps a forensic copy under the dangerous/ folder). The guard is + transparent to the missing-file and modified-file callers, which always + have a backup present. + +commit 55c087cc9bda321db860541f9030207a59505cb7 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Jul 13 11:48:30 2026 -0400 + + codeql-prepare: multi-line case arms (R-070) + complete strict-mode block (#19) + + Expand the two compact case arms to the fully multi-line form per R-070. + The touched file was 4/6 on the R-010 strict-mode block; add the missing + 'shopt -s inherit_errexit' and 'shopt -s shift_verbose' so it is fully green. + No behavior change. + + Co-authored-by: claude (dev71 31548627-e7c1-43cd-bd41-8b0900c72576) + +commit 59decfa257b7a560691183945e9c4ec1830d7241 +Author: Patrick Schleizer +Date: Wed May 20 22:20:10 2026 +0000 + + bumped changelog version + +commit be771dea0be5bf34c13bb4ab0054199934eb4dc8 +Author: Patrick Schleizer +Date: Wed May 20 16:57:12 2026 -0400 + + genmkfile uch + +commit f4d078d00a6e5c34a8c1e066ebd381604e8c0986 +Author: Patrick Schleizer +Date: Mon May 18 10:14:14 2026 +0000 + + bumped changelog version + +commit a93dca3366d99a5088ca9f03080be2c016c2d5bc +Merge: 8da4e1ef 8276e4e2 +Author: Patrick Schleizer +Date: Sun May 17 16:22:55 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 8276e4e2238fb6c8770189f20cbc9aee22e67c87 +Merge: 8da4e1ef 9ebe7128 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 17 14:02:54 2026 -0400 + + Merge pull request #18 from org-ai-assisted/claude/fix-dependabot-action-UnL7w + + dependabot.yml: drop docker block (sync to new canonical) + +commit 9ebe71282f7b4394e87e6db45f7f9219cd322007 +Author: Claude +Date: Sun May 17 17:59:44 2026 +0000 + + trim file commentary + +commit c67f2ea60336a6819b4724836cec426f12b7f5ed +Author: Claude +Date: Sun May 17 17:43:21 2026 +0000 + + dependabot.yml: drop docker block (sync to new canonical) + + The previous canonical at + developer-meta-files/consumer-templates/.github/dependabot.yml + carried a docker package-ecosystem block on the documented theory + that the block was a "harmless no-op" in repos without a + /Dockerfile. That theory was wrong: the dependabot-action errors + with `dependency_file_not_found` and aborts the whole job - + including the github-actions ecosystem run that shares it - so + this repo lost its github-actions Dependabot coverage too. + + Sync to the new canonical, which carries github-actions only. + + See org-ai-assisted/developer-meta-files PR #105 for the + canonical change and the docker-bearing-repo opt-out mechanism. + +commit 8da4e1ef7b5e1dd3c217d9ae59c3d56ab6b052da +Merge: 2b3e644c 493de5e4 +Author: Patrick Schleizer +Date: Sat May 16 17:15:01 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 493de5e4741a5cf6f1adb20a6c9354760b208678 +Merge: 2b3e644c 6627cff0 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat May 16 16:03:37 2026 -0400 + + Merge pull request #17 from org-ai-assisted/claude/security-misc-real-stdisplay-pyqt-and-install-deps + + ci: real stdisplay + PyQt5 + install-deps composite action; drop conftest stubs + +commit 6627cff0563b4f17b49e36bd5dc768e9de0f69ab +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat May 16 13:54:45 2026 -0400 + + ci: real stdisplay + PyQt5 + install-deps composite action; drop conftest stubs + + ci/tests/fm_shim_frontend/conftest.py stubbed two heavy module-level + imports in fm_shim_frontend.fm_shim_frontend to let the property + tests import the URI-validation function without bringing up Qt or + installing the helper-scripts Debian package: + + - stdisplay (helper-scripts Debian package) - identity stub + - PyQt5.{QtCore,QtGui,QtWidgets,sip} - fake module whose + __getattr__ synthesizes a fresh type() per name + + The file already carried a TODO to remove both: "We can install + helper-scripts before running the tests to get stdisplay, and as + long as the test code paths don't call QApplication(), the crash + during test issue should be avoidable." + + This commit does that: + + - local-python-lint.yml switches from apt-install-with-cache to + the developer-meta-files install-deps composite action, which + installs apt deps + genmkfile + helper-scripts (the latter + provides stdisplay). PyQt5 was already in the apt list + (python3-pyqt5 + python3-pyqt5.sip), so the real Qt classes + are available now too. + + - conftest.py is deleted. Property tests now run against the + production modules end-to-end (the QApplication() call only + fires inside fm_shim_frontend's main(), which the test never + invokes - it imports get_path_list_from_uris directly). + + - local-dbus-fuzz.yml also switches to install-deps for + consistency (same composite-action pattern); ci/dfuzzer-build.sh + header comment updated to point at install-deps instead of + apt-install-with-cache. + + Same shape as the recent msgcollector simplification (PR #21): + let install-deps handle apt + genmkfile + helper-scripts in one + step. + +commit 2b3e644c750962592ad87d0c95cdd7bdd8ecbb77 +Author: Patrick Schleizer +Date: Sat May 16 06:08:34 2026 -0400 + + add .github/dependabot.yml + +commit 86ef7582223b9a3a622bc1b9dd5bedc576776c89 +Author: Patrick Schleizer +Date: Sat May 16 06:01:50 2026 -0400 + + update .github/workflows/consumer-bandit.yml + +commit 873ba695c7e74bcef4efbc93a13557adfd01d658 +Merge: 79a9fb9b a4465cd7 +Author: Patrick Schleizer +Date: Sat May 16 05:27:53 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit a4465cd76fc9c05cb75b7d4f4c8ba0cbbcb6a7c6 +Merge: 79a9fb9b e0ed0b33 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat May 16 04:42:50 2026 -0400 + + Merge pull request #16 from org-ai-assisted/claude/fix-cppcheck-tar-error-0qNYv + + ci: use apt-install-with-cache composite action; drop broad restore-keys + +commit e0ed0b331aa8bd983fd0ec6624a6bf4481223682 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Fri May 15 20:02:27 2026 -0400 + + ci: use apt-install-with-cache composite action; drop broad restore-keys + + Both local-dbus-fuzz.yml and local-python-lint.yml used + `path: /var/cache/apt/archives` with `sudo chown -R` on the system + dir + a broad `restore-keys:` prefix. Three problems: + + 1. Same `tar: partial/: Permission denied` cache-save warning as + the developer-meta-files reusables (apt\'s _apt:root 0700 + partial/ subdir is unreadable by the runner; chown doesn\'t + help because apt-get install recreates partial/ 0700 every + run). + + 2. `restore-keys:` violates agents/github-actions.md G-A-007 + ("no broad restore-keys, no pull_request_target + cache" - + cache-poisoning risk). The cache-key already includes + hashFiles() so a config change naturally invalidates; + restore-keys would defeat that. + + 3. Duplicated `Prepare apt cache directory` + `Cache apt packages` + YAML across two workflows. + + Fix: replace those steps with one composite-action call: + + - uses: org-ai-assisted/developer-meta-files/.github/actions/apt-install-with-cache@master + with: + packages: \'\' + cache-key: ${{ runner.os }}-apt--${{ hashFiles(...) }} + + The composite action caches `~/.apt-deb-cache` (runner-owned, no + system-dir permission gymnastics) and sudo-copies .debs in/out of + /var/cache/apt/archives around apt-get install. apt\'s normal + permission model is preserved. + + local-dbus-fuzz.yml additionally: + + - ci/dfuzzer-build.sh is refactored to drop its `Phase 1` apt + install. The package list moves into the workflow (passed to + the composite action), where it lives alongside the cache key + that invalidates on changes. dfuzzer-build.sh now only + does the `Phase 2` build from upstream source. + + Depends on org-ai-assisted/developer-meta-files#92 (which adds + the composite action). This PR\'s CI will pass once #92 merges. + +commit 79a9fb9b7b9640e5a56f798ca3c4057ce8e4accb +Author: Patrick Schleizer +Date: Fri May 15 18:40:53 2026 +0000 + + bumped changelog version + +commit 323f4610b6fbdd0b011aef2d2b42228046d1f0eb +Merge: 899959ae 1c732f20 +Author: Patrick Schleizer +Date: Fri May 15 13:14:54 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 1c732f20949a9e5153b42acbafd925db4853daea +Merge: be8ca04a 91184edd +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 19:56:15 2026 -0400 + + Merge pull request #15 from org-ai-assisted/claude/review-github-actions-IQwcy + + local-python-lint: drop paths filter, always run lint + +commit 91184edd4b6604b005e540cef3d8cb0ca9bf45a4 +Author: Claude +Date: Tue May 12 20:19:31 2026 +0000 + + local-python-lint: drop paths filter, always run lint + + The 3-entry paths filter went stale - the workflow filename + reference and the apt cache key both still pointed at + '.github/workflows/lint-python.yml' from before the G-A-005 + three-prefix rename to 'local-python-lint.yml'. Filter-going- + stale silently skips lint on PRs it should cover. + + Drop the filter so push(master) and pull_request(master) always + run lint. Repo is mixed C/AppArmor/scripts but the lint job is + fast (10-min timeout, ~1 min real). Update the cache hashFiles() + to match the new workflow filename so apt cache invalidates + correctly when this workflow is edited. + +commit be8ca04a9ec12753f5ecf65fe345c7e694535e12 +Merge: fb7ad509 d6b44928 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 16:15:08 2026 -0400 + + local-dbus-fuzz: enable path-filtered pull_request trigger (#14) + + local-dbus-fuzz: enable path-filtered pull_request trigger + +commit d6b4492893bc3032d310db54f5415a2d3cb51e63 +Author: Claude +Date: Tue May 12 20:07:40 2026 +0000 + + local-dbus-fuzz: enable path-filtered pull_request trigger + + dfuzzer (D-Bus) workflow has been verified green via workflow_dispatch + on master. Enable the previously commented-out pull_request trigger + so PRs that touch the fm-shim-backend C source, its compile script, + the dfuzzer build/runner, or this workflow itself get fuzz coverage. + + Also: + - fix stale workflow filename reference (.github/workflows/dfuzzer.yml + -> .github/workflows/local-dbus-fuzz.yml; renamed under G-A-005) + - add ci/dfuzzer-build.sh to the paths filter (it builds the dfuzzer + binary from source - changes here invalidate prior runs) + - rewrite the header comment that described the now-historic + workflow_dispatch-only state. + +commit fb7ad5094fa6b27125c5ea741e0596a235baa50a +Merge: c1139823 d6fc7cff +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 15:28:58 2026 -0400 + + Merge pull request #13 from org-ai-assisted/claude/review-github-actions-IQwcy + + workflow triggers: normalize pull_request to branches: [master] + +commit d6fc7cffb26321ff458dd3980a112448e1bbfe38 +Author: Claude +Date: Tue May 12 19:25:57 2026 +0000 + + workflow triggers: normalize pull_request to branches: [master] + + Propagate dmf canonical updates for consumer-claude-code.yml and + consumer-codex-review.yml: bare `pull_request:` -> + `pull_request: branches: [master]`. Matches the byte-identical + canonical in + developer-meta-files/consumer-templates/.github/workflows/. + + Practical impact: PRs targeting feature branches no longer fire + the AI reviews. The org's typical workflow (feature-branch -> + master PR) is unaffected. + +commit c11398236615009bdad1b039f28073a69a06a4b3 +Merge: 00b6339a 2d503860 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 13:48:31 2026 -0400 + + Merge pull request #12 from org-ai-assisted/claude/review-github-actions-IQwcy + + scorecard: remove consumer-scorecard.yml (org-wide opt-out) + +commit 2d50386036b1db6f074604f4078bf01f1d71daff +Author: Claude +Date: Tue May 12 17:46:00 2026 +0000 + + scorecard: remove consumer-scorecard.yml (org-wide opt-out) + + Per the consumer-template architecture's opt-in-by-file-presence + rule, deleting a consumer-*.yml is the opt-out signal: + pkg_update_consumer_workflows refreshes only files that already + exist on the consumer side; the next propagation pass will not + re-create this. + + Org-wide policy: Scorecard's value-to-noise ratio is low (many + false positives, non-actionable signals). Keeping it only in + derivative-maker (the canonical baseline) where the org-wide + supply-chain signal is most useful. + + Spec: + https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +commit 00b6339a01392db4e0f62143ab0fa08b9177386c +Merge: b128c2b5 bc75ea7d +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 12:47:13 2026 -0400 + + Merge pull request #11 from org-ai-assisted/claude/review-github-actions-IQwcy + + workflows: rename legacy unprefixed to consumer- prefix + +commit bc75ea7d6f0918e89032fa65dcc715217e0a0c5e +Author: Claude +Date: Tue May 12 16:44:41 2026 +0000 + + workflows: align consumer-*.yml byte-identical to dmf canonicals + + Follow-up to the rename commit: in addition to renaming the + files, content must be byte-identical to the canonical wrappers + in developer-meta-files/consumer-templates/.github/workflows/. + + Differences absorbed by this commit: + + - scorecard.yml cron slot: per-repo allocation -> uniform + org-wide '0 6 * * 0' (the canonical's slot). + - Header comments: switched to the standard "Managed by + pkg_update_consumer_workflows" template so contributors see + the propagation contract. + + User-facing `name:` fields unchanged. + + Spec: + https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +commit 2dbf8ade8aa5491b0521a1ed693abc4bca5c7cda +Author: Claude +Date: Tue May 12 16:42:53 2026 +0000 + + workflows: rename legacy unprefixed to consumer- prefix + + Per consumer-template architecture (G-A-005, three-prefix + convention): wrappers around developer-meta-files reusables + carry the `consumer-` prefix. This is the bulk rollout of the + prefix to this repo's universal wrappers. + + Each file is byte-identical to its corresponding canonical in + developer-meta-files/consumer-templates/.github/workflows/. + + User-facing `name:` fields unchanged. cron slots converge on + the org-wide singleton (`0 6 * * 0` for Scorecard) per spec + "Scheduling in byte-identical templates" - GitHub queue + serializes; Scorecard's low value-to-noise ratio makes that + contention acceptable. + + Spec: + https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +commit b128c2b5eabcec49f6de27fa78bc95147505f674 +Merge: d9025962 1abdf11d +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 12:33:30 2026 -0400 + + Merge pull request #10 from org-ai-assisted/claude/review-github-actions-IQwcy + + codeql: migrate to split consumer-codeql-{python,cpp} wrappers + +commit 1abdf11d05d376c716b6114b71702369f398aa53 +Author: Claude +Date: Tue May 12 16:19:47 2026 +0000 + + workflows: rename dfuzzer+lint-python to local- prefix + + Per consumer-template architecture: workflows that live only in + one repo carry the `local-` prefix. Two renames: + + - dfuzzer.yml -> local-dbus-fuzz.yml + (tool name -> surface name; says what's being fuzzed) + - lint-python.yml -> local-python-lint.yml + (reorder to match local-- pattern used in other + repos, e.g. helper-scripts local-python-checks) + + User-facing `name:` fields unchanged. + +commit f6d6f000617268b1c7a0b81c7a859ac900af99e9 +Author: Claude +Date: Tue May 12 16:06:52 2026 +0000 + + bandit: migrate to consumer-bandit wrapper + + Per dmf #69 (reusable-bandit.yml refactor to shebang-aware + discovery). The old bandit.yml passed + `with: paths: usr/lib/python3/dist-packages/fm_shim_frontend` + and `with: prepare-command: ci/codeql-prepare.sh` to symlink + genmkfile-tagged '*.py#tag' files. Both are no longer needed - + the reusable now discovers Python by extension OR by shebang + on its own. + + Changes: + + - Renamed: .github/workflows/bandit.yml -> consumer-bandit.yml, + byte-identical to dmf canonical (no `with:`). + + Behavior change: bandit now scans the whole repo via shebang + discovery (including any Python outside + `usr/lib/python3/dist-packages/fm_shim_frontend`). If new false + positives surface, suppress per-line with `# nosec`. + + ci/codeql-prepare.sh remains in the repo - it's still used by + codeql-python and codeql-cpp jobs (per .github/dm-consumer.yml). + +commit 51cd4202dd5320bcdd71a2db26eb8d5ef0273725 +Author: Claude +Date: Tue May 12 15:59:23 2026 +0000 + + codeql: migrate to split consumer-codeql-{python,cpp} wrappers + + Per dmf #69 (reusable-codeql.yml hard refactor + single-job + per-language wrappers per design decision 3). The old + codeql.yml had two jobs (python + c-cpp) in one workflow; the + new architecture splits these into two separate workflow files. + + Changes: + + - Deleted: .github/workflows/codeql.yml (old multi-job). + - New: .github/workflows/consumer-codeql-python.yml + (byte-identical to dmf canonical). + - New: .github/workflows/consumer-codeql-cpp.yml + (byte-identical to dmf canonical). + - .github/dm-consumer.yml: add + codeql-python.prepare-command: "ci/codeql-prepare.sh" + codeql-cpp.prepare-command: "ci/codeql-prepare.sh" + codeql-cpp.build-command: "ci/codeql-build.sh" + (the values the old codeql.yml passed via `with:` for each + language job). + + Behavior change: python scan and c-cpp scan now run as separate + Actions UI entries (CodeQL Python / CodeQL c-cpp). A failure in + one no longer fails the other. + +commit d9025962aac47ee531e26f31994ae4d98703150c +Merge: 899959ae 83fc14a9 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 11:45:17 2026 -0400 + + Merge pull request #9 from org-ai-assisted/claude/review-github-actions-IQwcy + + coverity: migrate to consumer-template architecture + +commit 83fc14a99ed7ea91672042d832e9363c0ae12185 +Author: Claude +Date: Tue May 12 15:34:15 2026 +0000 + + cppcheck: migrate to consumer-template architecture + + Per dmf #68 (reusable-cppcheck.yml hard refactor). The old + cppcheck.yml wrapper passed inputs (paths, prepare-command) that + no longer exist on the reusable. Without this migration the + next cppcheck run (PR / master push) would fail because the + reusable's runtime config-load step would not find the cppcheck + section in .github/dm-consumer.yml. + + Changes: + + - .github/dm-consumer.yml: add cppcheck.paths + + cppcheck.prepare-command (the values the old wrapper passed + via `with:`). + - Renamed: .github/workflows/cppcheck.yml -> + consumer-cppcheck.yml, byte-identical to dmf canonical (no + `with:`, just the reusable call). + +commit 74eb7cafbd2b9aee63abd2cfcbbb507bc5c770a7 +Author: Claude +Date: Tue May 12 15:21:30 2026 +0000 + + coverity: migrate to consumer-template architecture + + Per dmf #67 (reusable refactor) + #68 (deadlock hotfix): + + - New: .github/dm-consumer.yml with coverity.project-name + + canonical-repos. + - Renamed: .github/workflows/coverity.yml -> consumer-coverity.yml, + byte-identical to dmf canonical (no `with:`, secrets-only). + + Behavior change: + + - Cron slot moves from '30 6 * * 0' (Sunday 06:30) to + '0 4 * * 5' (Friday 04:00) - the org-wide singleton slot in + the canonical template. + +commit 899959ae8831657f5af884ebba3243e5f1858707 +Author: Patrick Schleizer +Date: Mon May 11 20:28:53 2026 +0000 + + bumped changelog version + +commit 02c34b80ccf838436258991e967a026ff718850d +Merge: 4191b49a c2fa29c0 +Author: Patrick Schleizer +Date: Mon May 11 15:14:00 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 4191b49a073728192a0fdd76f640b27cc0d4a00b +Merge: 82a56984 9a701e10 +Author: Patrick Schleizer +Date: Mon May 11 13:20:43 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 9a701e10e877b9eb60c4a59c74e8798cc1221df5 +Author: Aaron Rainbolt +Date: Sun May 10 21:50:35 2026 -0400 + + Misc fixes and TODOs + +commit c2fa29c067a24a81a19ec568f2676aa8b6fc877b +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 20:18:59 2026 -0400 + + workflows: add concurrency blocks (#7) + + 5 cancellable + 1 singleton (coverity). + +commit d0bf18601b3b9158292e1a904e39eaaaba717d57 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 17:59:39 2026 -0400 + + codex-review: forward only OPENAI_API_KEY explicitly (#6) + + Replace secrets: inherit with explicit single-secret map. + +commit 2d46c0027ef104526577ab3e22b25f3c43ae02b7 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 17:22:37 2026 -0400 + + workflows: drop "bash" prefix on ci/ scripts; rely on shebang (#5) + + Apply helper-scripts #19 pattern across 5 security-misc workflows (8 invocations). + +commit 82a56984a6a4270ab4d77199abcbe5b1fa24e6ae +Merge: b4fa999c c2513d3b +Author: Patrick Schleizer +Date: Sun May 10 15:31:44 2026 -0400 + + Merge remote-tracking branch 'org-ai-assisted/master' + +commit c2513d3be3adc9e8079aae91895b4818ae4d4d0b +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 15:29:47 2026 -0400 + + coverity: project-name slash form + explicit secrets map (#4) + + Fix Coverity scan: API requires Kicksecure/security-misc (slash) not Kicksecure-security-misc (dash). Explicit COVERITY_SCAN_{TOKEN,EMAIL} secrets map. + +commit f24b820efae19cd6197757a007af976a2a300eb6 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 15:29:45 2026 -0400 + + re-apply secrets + apt-cache hardening on top of upstream rebase (#3) + + Re-applied PR#2 hardening on top of upstream Kicksecure/security-misc master b4fa999c. + +commit b4fa999cb5f35276e0fc494806a9f7fdbc876145 +Merge: c21437fd ee1b8549 +Author: Patrick Schleizer +Date: Sun May 10 14:46:07 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit ee1b85491e883f6c5ea431e9a3eeb42a39b36ca1 +Author: Claude +Date: Fri May 8 18:48:08 2026 +0000 + + codeql: drop packages: read + + None of our CodeQL builds pull from ghcr.io (kloak runs + 'bash build.sh', security-misc runs 'bash ci/codeql-build.sh', + helper-scripts and msgcollector are pure-Python). Drop the + defensive 'packages: read' grant in favor of least-privilege. + + A future consumer that genuinely authenticates to GitHub + Packages from a CodeQL build step can re-add it locally. + + Reusable docblock notes the rationale so a future maintainer + doesn't reflexively re-add it. + +commit c864386870b0fd5366441d8e62e6e41869eb06ef +Author: Claude +Date: Fri May 8 15:49:01 2026 +0000 + + claude-code: restore id-token: write + + Reverts the earlier 'drop id-token' commit. Verified against a live + workflow log that the action DOES use OIDC federation: + + Requesting OIDC token... + OIDC token successfully obtained + Exchanging OIDC token for app token... + Using GITHUB_TOKEN from OIDC + + The action federates the runner's id-token to an Anthropic-controlled + GitHub App which mints a higher-privilege GITHUB_TOKEN used to post + review comments. Without id-token: write the next run would have + failed with 'Could not fetch an OIDC token'. + +commit 318322481575fcee29a05a693f47e6a4f4e4fa29 +Author: Claude +Date: Fri May 8 15:33:25 2026 +0000 + + dfuzzer-run.sh: bash style guide compliance + + - R-010 strict-mode quintet: add 'shopt -s inherit_errexit' and + 'shopt -s shift_verbose' to outer script and to the inner + heredoc. + - R-030 printf format: drop embedded format strings (e.g. + 'printf 'foo=%s\n' "${x}"'); pass the entire message in the + data string of 'printf '%s\n' ...'. + - R-051 traps as named functions: extract inline EXIT trap + command-strings into named cleanup functions + (dfuzzer_run_cleanup, dfuzzer_inner_cleanup) registered after + the variables they reference are initialized. + - R-061 split combined short flags: 'rm -rf' -> 'rm -r -f'. + - shellcheck SC2317 (unreachable trap-callback) suppressed + inline. + +commit fb9ac8ecb248b3f4777a9ac80da9f01c09fd4200 +Author: Claude +Date: Fri May 8 15:24:19 2026 +0000 + + scorecard: drop inline cron allocation table + + The org-wide allocation table is single-source-of-truth in + developer-meta-files/.github/workflows/reusable-scorecard.yml. Each + consumer should carry only its own cron line with no commentary. + +commit cff945d545ab6d4513b2e4541e74c26bdd9e6df6 +Author: Claude +Date: Fri May 8 15:21:18 2026 +0000 + + claude-code: drop id-token: write + + The reusable workflow no longer needs id-token: write (the action + authenticates to api.anthropic.com via a static ANTHROPIC_API_KEY; + OIDC federation is unused). Drop the permission to honor + least-privilege - an OIDC token, if forged or leaked, can + authenticate to cloud-provider integrations. + +commit b0c55cb8dc406b5e9019d89d7e75b71f3ff565b8 +Author: Claude +Date: Fri May 8 14:28:16 2026 +0000 + + dfuzzer-run.sh: pass --no-suppressions + + dfuzzer 2.6 treats 'no suppression file found at any of the + 3 candidate paths (./dfuzzer.conf, ~/.dfuzzer.conf, + /etc/dfuzzer.conf)' as a fatal error and exits 1 before fuzzing + anything (verified in upstream src/dfuzzer.c main() - the + df_suppression_load() call returns -1, which prints the literal + 'Exit status: 1' and goto cleanup). On a fresh GitHub runner + none of those paths exist, so the workflow always failed + immediately. We don't want suppressions anyway: we want every + crash / unexpected exit reported. + +commit 167222754f61bd7c7908c74d94e8fb7e762f9f25 +Author: Claude +Date: Fri May 8 14:13:34 2026 +0000 + + dfuzzer-run.sh: pass explicit object path + + dfuzzer defaults to object path '/' which has no methods registered + on fm-shim-backend (its methods are at /org/freedesktop/FileManager1). + Without -o the previous runs exited in milliseconds with no fuzzing + performed. + +commit d8dac7a1a2a8ccd01bddff4d405ca195befd489d +Author: Claude +Date: Fri May 8 14:08:24 2026 +0000 + + dfuzzer-run.sh: diagnostic logging + busctl introspect probe + + After two iterations where dfuzzer exits 1 with no usable + diagnostic ('Cannot open suppression file ... Exit status: 1' + - which is dfuzzer's normal idle output, not the actual error), + add three probes that surface the real state of the world: + + 1. fm-shim-backend stdout/stderr captured to a tmpdir log file + and dumped via ::group::. Without a tty its output is block- + buffered and gets lost when the kill-on-EXIT trap fires; + redirecting to a file flushes on close. + + 2. NameHasOwner poll loop (up to 5 attempts at 1s each) that + confirms the well-known name is registered before dfuzzer + tries to talk to it. Fails fast and surfaces the backend's + stdout if the backend dies during startup. + + 3. 'busctl --user introspect' before dfuzzer to verify the + Introspectable wiring (the just-added handle_introspect() + in fm-shim-backend.c). If busctl can't introspect, dfuzzer + won't be able to either - and we'll see exactly where the + chain breaks. + + This is exactly the diagnostic loop helper-scripts' fuzz.yml + went through during its initial Atheris/CFL bring-up; document + the pattern in agents/fuzzing.md once the dust settles. + +commit 0d3a8a120e5c3c7f1f7919c033b52fcc060db81e +Author: Claude +Date: Fri May 8 14:05:50 2026 +0000 + + fm-shim-backend: implement org.freedesktop.DBus.Introspectable.Introspect + + Real bug found while wiring up the dfuzzer workflow: fm-shim- + backend's hardcoded interface filter rejects every method call + that isn't on org.freedesktop.FileManager1, including the + standard org.freedesktop.DBus.Introspectable.Introspect that + every introspection-aware D-Bus client expects. + + Symptoms before this fix: + - 'busctl introspect --user org.freedesktop.FileManager1 + /org/freedesktop/FileManager1' fails with 'Unknown interface'. + - 'd-feet' / 'qdbusviewer' don't enumerate the service's + methods. + - dfuzzer exits 1 with no usable output (can't introspect -> + doesn't know what to fuzz). + + Fix is conventional: implement Introspect to return a static XML + description of the FileManager1 surface plus the standard + Introspectable interface itself. Argument signatures ('as' for + the URI list, 's' for the startup ID) match the freedesktop.org + file-manager-interface spec. Static string + one extra branch + in dispatch; no runtime cost. + + Discovered by: ci/dfuzzer-run.sh first integration run on + master 6ed21ea (2026-05-08). With this patch dfuzzer can + introspect, enumerate the three methods (ShowFolders, + ShowItems, ShowItemProperties), and proceed to fuzz them. + +commit 6ed21ea68d8b8f5eaa6077e9a171d1bb996bebf5 +Author: Claude +Date: Fri May 8 14:02:06 2026 +0000 + + dfuzzer-run.sh: manual backend launch instead of dbus auto-activation + + XDG-local .service file auto-activation isn't reliable inside + dbus-run-session's transient bus (the dbus-daemon spawned there + seems not to read $XDG_DATA_HOME/dbus-1/services/ - dfuzzer + exits 1 with no meaningful error before any fuzzing happens). + + Switched approach: + 1. Inside dbus-run-session, start fm-shim-backend in the + background. It registers the org.freedesktop.FileManager1 + well-known name on the session bus and enters its dispatch + loop. + 2. sleep 1 + kill -0 check to surface 'backend died during + startup' before dfuzzer's misleading 'name not found' error. + 3. Run dfuzzer against the now-registered name. + 4. EXIT-trap kills the backend at the end. + + Also restructured to avoid multi-level shell quoting: the inner + script lives in a tempfile and gets the binary path + seconds + budget as positional args. Easier to read; bug-class found while + debugging. + + dfuzzer flag now '-I 50' (50 iterations per method, default per- + method coverage on the small FileManager1 surface). Total wall- + clock still bounded by 'timeout --preserve-status' wrapper. + +commit 80089f9e7a452dead2fe5b6c2217e2f02426ed8d +Author: Claude +Date: Fri May 8 13:59:36 2026 +0000 + + dfuzzer-run.sh: fix dfuzzer flag set + use shell timeout + + Three corrections after the v2.6 source-code check: + + 1. dfuzzer 2.6 takes '-n BUS_NAME' (long form '--bus' - misnamed + in upstream; semantically a bus-NAME value). The previous + '--name' / '--bus session' invocation produced + 'unrecognized option' and dfuzzer exited 1 before fuzzing + anything. + + 2. dfuzzer has NO time-bounded flag - only iteration counts. + Wrap with shell 'timeout --preserve-status' to enforce a + per-job time budget. Exit code 124 (budget reached) is + treated as success since hitting the budget means we got + the configured amount of fuzzing. + + 3. Removed '--bus session' - dfuzzer auto-detects the bus from + DBUS_SESSION_BUS_ADDRESS (set by dbus-run-session above), + which is what we want. + + The 'set -o errexit' inside the inner bash -c was also dropped + because we now want the wrapper script (not errexit) to drive + the exit-code interpretation; dfuzzer's real exit code reaches + us via 'rc=$?' and is mapped to a friendly outcome string. + +commit 19f88613f2d0b881614615daf4e24e99025e0b34 +Author: Claude +Date: Fri May 8 13:56:47 2026 +0000 + + dfuzzer.yml: fix binary path (build/dfuzzer not build/src/dfuzzer) + +commit e54cf73996fec5a7737ee19bf2701a5385054d87 +Author: Claude +Date: Fri May 8 13:55:13 2026 +0000 + + dfuzzer.yml: bump tag pin v1.7 -> v2.6 (real latest) + +commit 487a08d1caa42bed0f3b821f2bacfcb09fc990f6 +Author: Claude +Date: Fri May 8 13:53:27 2026 +0000 + + dfuzzer.yml: build dfuzzer from source + + dfuzzer is not in the Ubuntu 24.04 (noble) archive (verified + via packages.ubuntu.com - 'No such package'). Switch from + apt-install to a from-source build pinned at the upstream + v1.7 tag. Build deps (meson/ninja/glib/xsltproc/docbook) + added; runtime apt deps (dbus, libdbus-1-dev, libsystemd-dev, + pkg-config, gcc) kept. + +commit 16a684b4a5fddbdd29bda5ddc01ea1f233f98316 +Author: Claude +Date: Fri May 8 13:51:01 2026 +0000 + + fuzzing: add dfuzzer workflow for fm-shim-backend D-Bus surface + + Wires up dfuzzer (Debian-archive-shipped D-Bus service fuzzer) + against the fm-shim-backend binary's org.freedesktop.FileManager1 + surface. Process-level fuzzing complementing the in-process + Hypothesis suite already covering fm_shim_frontend. + + What gets exercised: + - D-Bus marshaling glue (libdbus-1 path). + - Method dispatch in main()'s message loop. + - sd_notify error path under transient session bus. + - Signal handler interactions. + - Resource lifecycle across method calls (fd leaks etc). + + What's NOT exercised here: + - The frontend prompt logic (covered by Hypothesis tests). + - The in-process parser (libFuzzer harness deferred per + AGENTS.md fuzzing notes). + + Workflow body in ci/dfuzzer-run.sh (R-100): + 1. compile-fm-shim-backend -> tmpdir binary + 2. Write XDG-local D-Bus session service file pointing at + the tmpdir binary so dbus auto-activates it on first + method call. + 3. dbus-run-session boots a transient session bus and runs + dfuzzer --bus session --name org.freedesktop.FileManager1 + --max-time $DFUZZER_SECONDS --verbose. + + Trigger: workflow_dispatch only initially (mirrors helper- + scripts/fuzz.yml). Once a green-baseline run lands, the + commented-out path-filtered pull_request trigger can be + enabled. Default per-method budget 60s; overridable via + workflow_dispatch input. + + Note: dfuzzer is in the Ubuntu universe pocket (apt-installable + on ubuntu-latest by default). No third-party action. + +commit e1ff1f8e1a7c3741ee1d6464a16544069fbda822 +Author: Claude +Date: Fri May 8 13:34:19 2026 +0000 + + ci: switch reusable refs to 'reusable-.yml' + + Seven 'uses:' lines (codeql, scorecard, claude-code-review, + codex-review, coverity, cppcheck, bandit) repointed at the + renamed reusable files in developer-meta-files. + +commit 30d58b0fc48797bf6e9269b0d755792b3ebb6b7c +Author: Claude +Date: Fri May 8 13:27:50 2026 +0000 + + ci: gitignore __pycache__; remove the two stray files just committed + + The Hypothesis test commit accidentally checked in two .pyc + files under ci/tests/fm_shim_frontend/__pycache__/ from the + local validation run. Drop them, add **/__pycache__/ to + .gitignore so the next 'git add -A' does not re-include them. + +commit 3f8233b18d05b7d90c137cf1f49e780a2cc0be6c +Author: Claude +Date: Fri May 8 13:27:31 2026 +0000 + + fuzzing: add Hypothesis property tests; fix ENAMETOOLONG crash + + Adds ci/tests/fm_shim_frontend/test_property.py (six property + tests over get_path_list_from_uris, plus a deterministic + regression suite of nine adversarial inputs) wired into + .github/workflows/lint-python.yml. + + The fuzz suite immediately found a real exploitable bug at + introduction: an attacker who can deliver a URI with a single + path component longer than NAME_MAX (255 bytes on Linux) crashed + the process via an uncaught OSError(ENAMETOOLONG=36) from + Path.exists(). Fixed by wrapping the exists() call in + try/except OSError - any OSError is treated as 'non-existent, + skip' (same path the False branch was already handling). + + The bug is reachable from an attacker process via the + FileManager1 D-Bus surface (other desktop apps can pass URI + lists). Severity: local DoS of the fm-shim-frontend prompt. + + Other infrastructure: + + - ci/tests/fm_shim_frontend/conftest.py stubs out 'stdisplay' + (helper-scripts package, not in the runner's apt) and the + PyQt5 Qt* submodules (a real pyqt5 install would still be + needed for live use, but isn't required for property-testing + the URI validator function in isolation). + - agents/fuzzing.md documents the layout and the local-run + invocation, mirroring helper-scripts' agents/fuzzing.md. + - AGENTS.md gains a Component Notes pointer to the new doc. + + ClusterFuzzLite (Atheris coverage-guided fuzzing) is NOT wired + yet; deferred until the property-test suite has been running + long enough to pick the easy wins. + +commit f4ab12218cef102b30a083f206380ba9e4dc1b76 +Author: Claude +Date: Fri May 8 12:38:25 2026 +0000 + + static-analysis: add cppcheck + bandit wrappers + + Free local-runnable extras complementing CodeQL and Coverity: + + cppcheck - C static analyzer over usr/src/security-misc/. + Re-uses ci/codeql-prepare.sh to symlink the + genmkfile-tagged '*.c#security-misc-shared' + files to clean '*.c' names cppcheck discovers + by extension. + + bandit - Python security-focused analyzer over + usr/lib/python3/dist-packages/fm_shim_frontend/. + Same prepare-command for the '*.py#tag' files. + +commit 767088d43fcb62d82c5a0e664ba46b4939632e2d +Author: Claude +Date: Fri May 8 12:07:44 2026 +0000 + + coverity: use real Coverity Scan project name + + The scan.coverity.com project for this repo is registered under + 'Kicksecure-security-misc' (verified at + https://scan.coverity.com/projects/Kicksecure-security-misc). + The reusable wrapper was passing the bare repo name + 'security-misc' which produced HTTP 401 on cov-build download + because the project+token pair did not match. + +commit cebe274c8bb2c82122ebfa88699ea410f55ca788 +Merge: c21437fd 16cc61e5 +Author: assisted-by-ai (Bot Account) +Date: Fri May 8 08:01:49 2026 -0400 + + Merge pull request #1 from org-ai-assisted/claude/test-github-token-access-HVDXY + + codeql: add static-analysis workflow (python + c-cpp) + +commit 16cc61e58fb990b8c78cb402c20161bacfcaea2f +Author: Claude +Date: Fri May 8 12:00:02 2026 +0000 + + lint-python: use flake8 --select=F; add suppressions to fsw line + + Two fixes for the just-added Python lint workflow. + + 1. Switch from plain pyflakes3 to 'flake8 --select=F'. + + pyflakes by design does not honor any suppression comment - not + '# noqa', not '# pylint: disable', nothing. There is no + escape hatch for intentional violations short of a code + rewrite. flake8 wraps pyflakes (same F-class checks) and adds + '# noqa' support, which is the standard pyflakes-aware + suppression. '--select=F' restricts to F-class rules only + (undefined names, unused imports, unused locals, ...) and + skips E/W PEP8 style noise that would clash with the + codebase's '##' block-comment convention (E266). + + 2. Apply '# noqa: F841 # pylint: disable=unused-variable' to the + intentionally-retained QWindow reference in main(). The binding + is required to keep the QWindow alive while app.exec_() is + running (Qt does not always retain Python wrappers for top- + level windows without a parent). Both pyflakes (F841) and + pylint (unused-variable) flagged it as unused; per-tool + pragmas are needed because the two tools do not share a + common 'intentionally unused local' marker. + + Locally verified: 'flake8 --select=F' returns rc=0 against the + prepared (symlinked) source paths after these changes. + +commit 7892d45da7147905dfe1831455a01f732d83ec38 +Author: Claude +Date: Fri May 8 11:55:32 2026 +0000 + + Revert "TEMP: point coverity wrapper at feature branch for end-to-end test" + + End-to-end test requires both this PR and developer-meta-files PR + to land on master first (workflow_dispatch needs the workflow file + on the default branch per G-A-003). The TEMP @feature-branch ref + becomes obsolete once dev-meta-files PR #7 merges and '@master' + resolves to the new reusable. Reverting now to keep the wrapper + clean for merging. + +commit 40cc7953c788bd61bae7abde24bda981fb9f407f +Author: Claude +Date: Fri May 8 11:54:45 2026 +0000 + + TEMP: point coverity wrapper at feature branch for end-to-end test + + Reverts to '@master' once developer-meta-files PR #7 merges. Used + to validate the reusable resolves and the orchestration scripts + (check-secrets, download, build-python, submit) execute cleanly + end-to-end on a real consumer before the reusable is published. + +commit 2950603574573403c2c82a233fe14f5bd32ba42f +Author: Claude +Date: Fri May 8 11:53:27 2026 +0000 + + lint-python: simple Python lint for fm_shim_frontend + + Two error-only checks (no style noise): + + pyflakes3 - undefined names, unused imports, etc. + pylint --errors - E*** rules only (skips C/W/R categories). + + Apt-installs python3-pyqt5 so the linters can resolve the PyQt5 + imports rather than emitting blanket import-error noise. Re-uses + ci/codeql-prepare.sh to symlink the genmkfile-tagged '*.py#' + sources to extension-clean paths the linters discover. + + Triggers are path-filtered to fm_shim_frontend/ + this workflow + + the prepare script, so unrelated changes do not run it. + +commit de73399046061640a48f630e3e8da7b22da90814 +Author: Claude +Date: Fri May 8 11:46:23 2026 +0000 + + coverity: add Python coverity scan via org-wide reusable + + Adds a Coverity Scan wrapper for the Python sources + (usr/lib/python3/dist-packages/fm_shim_frontend/...). C sources + under usr/src/security-misc/ stay covered by CodeQL only for now; + revisit if the C surface grows enough to justify a multi-language + cov-build. + + Cron slot '30 6 * * 0' offset from helper-scripts ('0 6 * * 0'). + +commit 54aec391d63eec0a73751c352f8684b4fb4ee75e +Author: Claude +Date: Fri May 8 11:35:22 2026 +0000 + + workflows: secrets:inherit + add scorecard wrapper + + - ai-review wrappers: replace explicit secret-mapping with + 'secrets: inherit'. Org-wide ANTHROPIC_API_KEY / + OPENAI_API_KEY propagate without per-repo boilerplate. + - scorecard wrapper added; calls the existing reusable in + developer-meta-files. Cron slot '30 5 * * 0' keeps it offset + from the org's other Scorecard slots. + + Note: this commit is unsigned because security-misc is not yet + registered with the org's commit-signing service. + +commit fc643aaa4603ff7e65706ade6b1edea9ba9eb735 +Author: Claude +Date: Fri May 8 11:27:48 2026 +0000 + + ai-reviews: add Claude + Codex review wrappers + + Two minimal consumer wrappers calling the org-wide reusables in + developer-meta-files: + + .github/workflows/claude-code.yml + .github/workflows/codex-review.yml + + Behavior matches the kloak/helper-scripts setup: pull_request + + comment-triggered Claude review; pull_request + workflow_dispatch + (fork-PR override) Codex review. Allow-lists inherit the + reusable's defaults. + + Requires repo secrets ANTHROPIC_API_KEY and OPENAI_API_KEY to be + set before these produce useful output. + + Note: this commit is unsigned because security-misc is not yet + registered with the org's commit-signing service. + +commit 7b5d353109a82246039de6c9c984f58385dccf9a +Author: Claude +Date: Thu May 7 23:09:37 2026 +0000 + + codeql wrapper: trim to minimal; link to centralized docs + + Drop the scope/#tag/cron-allocation prose - those notes belong in + the reusable's header on developer-meta-files master, not duplicated + here. One-line pointer at the URL is enough; readers needing to + understand the prepare-command + build-command shape follow the + link to the centralized doc. + +commit ad0d004561ce5ffc407f53282fd5d4eecac295ba +Author: Claude +Date: Thu May 7 23:07:20 2026 +0000 + + security-misc: extract C compile step into reusable helpers + + Resolves the TODO atop usr/libexec/security-misc/emerg-shutdown: + + > TODO: Move most of this to a build script that will compile + > and place under /usr/bin rather than /run. + + The motivating use case is also that CodeQL's CI compile path + (ci/codeql-build.sh) was duplicating the gcc command, including + ~70 hardening flags. With ~70 flags in two places, drift was a + matter of when, not if. + + New helpers (no '.sh' extension to match the rest of usr/libexec/ + security-misc/): + + usr/libexec/security-misc/compile-fm-shim-backend + usr/libexec/security-misc/compile-emerg-shutdown + + Each is a pure compile - takes (source, output) positionals, runs + gcc with the project's hardening flag set, exits non-zero on + failure. No chmod, no mv, no install - the caller decides what to + do with the binary. + + Consumers: + + build-fm-shim-backend - keeps mktemp/trap/chmod/mv lifecycle, + delegates the gcc invocation. + emerg-shutdown - keeps the dracut/config/memlockd/exec + logic, delegates the gcc invocation. + The hardening flag array and machine- + type branching go away from this file. + ci/codeql-build.sh - drops the inline gcc, calls both + compile- helpers. Single source of + truth: CI's hardening flags == runtime's. + + Also extends ci/codeql-prepare.sh to symlink '*.c#' to clean + '*.c' names (in addition to '*.py#'). gcc selects driver + behavior by file extension - a '*.c#' source is misclassified + as a linker script ('file format not recognized'). Verified + locally: with the symlinks in place, the helpers produce both + binaries (fm-shim-backend dynamic 49 KB, emerg-shutdown static + 875 KB) without warnings under x86_64-linux-gnu. + + Wires the c-cpp CodeQL job to run codeql-prepare.sh too via the + reusable workflow's prepare-command hook. + +commit f03270a46b476f354065f7b56dca523a50a1af8d +Author: Claude +Date: Thu May 7 22:55:39 2026 +0000 + + codeql: align ci helpers with bash-style-guide + + Per developer-meta-files agents/bash-style-guide.md and pre-push- + checklist: + + - R-002: add the 'AI-Assisted' header marker on the new bash + scripts and the workflow YAML. + - R-010: add 'set -o errtrace' to both ci/codeql-*.sh. + - pkg-config: keep the unquoted '\$(pkg-config ...)' subshells + matching the upstream pattern in build-fm-shim-backend; add a + NOTE comment and a 'shellcheck disable=SC2046' since the rule + fires on the intentional shape (AGENTS.md 'pkg-config quoting + in build script' rule). + +commit 80ce8c9e8d47ee0d27465e69db6425d3ff18ee4a +Author: Claude +Date: Thu May 7 22:50:17 2026 +0000 + + codeql: add static-analysis workflow (python + c-cpp) + + Adds .github/workflows/codeql.yml as a thin wrapper around the + org-wide reusable workflow in developer-meta-files. Two jobs - one + per language - matching the source mix actually present in the + repo: + + python: usr/lib/python3/dist-packages/fm_shim_frontend/ + c-cpp: usr/src/security-misc/{emerg-shutdown,fm-shim-backend}.c + + Source files in this repo carry a '#' suffix per the + genmkfile installable-routing convention; that suffix hides them + from CodeQL's Python extractor (which discovers by file extension). + Two helper scripts handle this: + + ci/codeql-prepare.sh - run via the reusable's pre-init hook; + creates extension-clean symlinks for each '*.py#tag' source. + ci/codeql-build.sh - manual build for c-cpp; installs build + deps and runs gcc -c on each .c file. The C extractor traces + compiler invocations rather than scanning by extension, so + the tagged paths can be passed to gcc verbatim. + + Cron slot picked to avoid collision with the org's existing + CodeQL slots (helper-scripts '17 4 * * 0', kloak '25 3 * * 5'). + + Note: this commit is unsigned because security-misc is not yet + registered with the org's commit-signing service. + +commit c21437fd83c5a86e6573ed76c2ecadcbfddacd45 +Author: Patrick Schleizer +Date: Sat May 2 08:48:24 2026 +0000 + + bumped changelog version + +commit 66d509f1995be49919c6f9d67cb25111678b1172 +Author: Patrick Schleizer +Date: Fri May 1 16:45:03 2026 -0400 + + add CLAUDE.md + +commit 48ba0017a14e3d3084aaf0ee42cc2542d7563cb1 +Author: Patrick Schleizer +Date: Sat Apr 25 09:26:49 2026 +0000 + + bumped changelog version + +commit e085afa9e56144feb1e5d80429341a464aa08d04 +Merge: 11a5c33a 1765046c +Author: Patrick Schleizer +Date: Sat Apr 25 05:13:22 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 1765046c7731cab90a320833763412b288e85930 +Author: Aaron Rainbolt +Date: Fri Apr 24 20:05:15 2026 -0400 + + Bash arithmetic hardening + +commit 11a5c33a566cc5280ee0b5984850ba05c716c106 +Author: Patrick Schleizer +Date: Wed Apr 22 13:16:46 2026 +0000 + + bumped changelog version + +commit 324ee4fdf63a8945af3f1125fab1403bdf87b5e4 +Merge: e5df9643 b43e11e5 +Author: Patrick Schleizer +Date: Wed Apr 22 06:35:15 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit b43e11e59e9f7b50fd1e84d5630c4c10a3f6cf69 +Author: Aaron Rainbolt +Date: Sun Apr 19 19:23:58 2026 -0400 + + Add better Unicode handling to fm-shim-frontend + +commit 9b058e0618062b345e9bd29e5c51f7b5e0df3191 +Author: Aaron Rainbolt +Date: Sun Apr 19 01:23:59 2026 -0400 + + Add better logging to fm_shim_frontend + +commit e5df9643ad2b060f74ed519dd7acc913692724d8 +Author: Patrick Schleizer +Date: Thu Apr 16 12:27:58 2026 +0000 + + bumped changelog version + +commit 36438ea84e610895c7bdd7de8a556f7c5a0c86aa +Author: Patrick Schleizer +Date: Thu Apr 16 01:53:02 2026 -0400 + + readme + +commit a0a6ef0ab92da68460b53b3c304f3c200ee2576e +Author: Patrick Schleizer +Date: Thu Apr 16 01:50:33 2026 -0400 + + readme + +commit 766710a05a83edf128c02041ce5a18a9a76cc9e1 +Author: Patrick Schleizer +Date: Thu Apr 16 01:43:35 2026 -0400 + + readme + +commit d44d9caac299a35d22d2240c2cfd42cefec22850 +Author: Patrick Schleizer +Date: Thu Apr 16 01:30:01 2026 -0400 + + agents + +commit ec3fd3bf2abd81f546b08c351b868218dbffcc68 +Merge: f511bb92 019e8415 +Author: Patrick Schleizer +Date: Thu Apr 16 01:22:03 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 019e84154a516e9a97bc284f2dc90ecf677e8531 +Author: Aaron Rainbolt +Date: Wed Apr 15 01:07:45 2026 -0400 + + Prevent using systemd-journald to write text to other user's terminals + +commit 187129cdebecae9c4906483f01f2d7341c1071f3 +Author: Aaron Rainbolt +Date: Wed Apr 15 00:47:52 2026 -0400 + + Add more compiler hardening flags + +commit b9d5480d9d7ee90c75523548bc69e9d467fda7b0 +Author: Aaron Rainbolt +Date: Mon Apr 13 18:51:43 2026 -0400 + + Remove unused AppArmor aliases + +commit f7a432f4e12407d920e787fcdd1937ae2100b3c9 +Author: Aaron Rainbolt +Date: Sun Apr 12 20:53:09 2026 -0400 + + Fix sysinit-post.target description + +commit fcefea6d468a7f4524c0f78e17bd9311692ce3bc +Author: Aaron Rainbolt +Date: Sun Apr 12 20:52:10 2026 -0400 + + Remove preset block on emerg-shutdown.service + + The block didn't actually work, and the bug that kept emerg-shutdown + from being usable with Calamares appears to no longer be a problem. + +commit 0e8f654d3af4613ca0346d8c9524fb1d116468b7 +Author: Aaron Rainbolt +Date: Sun Apr 12 20:48:24 2026 -0400 + + Documentation updates (mostly from Claude Code) + +commit 1baaaea4bc40e0e67d47ff904fea74f2b241dcdb +Author: Aaron Rainbolt +Date: Sun Apr 12 19:27:00 2026 -0400 + + Modified and squashed commit of the following: + + commit 518290c64b01d3890639b7b22cf90ababb163565 + Author: Claude + Date: Fri Apr 10 10:33:35 2026 +0000 + + Add agents docs for fm-shim security review notes + + Document fm-shim architecture, accepted threat model, and rejected + review suggestions to preserve context for future security reviews. + + https://claude.ai/code/session_01HJPNe7hjMrPvPtuJmPBhNa + +commit b6f5cf1787d2ab12832892ab38b79825a1748e9b +Author: Aaron Rainbolt +Date: Sun Apr 12 15:30:06 2026 -0400 + + Modified and squashed commit of the following: + + commit 63606cd8a818570143ea73211a74bbb5db38242a + Author: Claude + Date: Fri Apr 10 11:03:29 2026 +0000 + + Add AGENTS.md with fm-shim review guidelines + + Captures lessons from PR #358 review feedback to prevent repeating + rejected patterns in future contributions. + + https://claude.ai/code/session_01CgrrFhhVWtqtfhvJdEcBWm + +commit f511bb9218a68c2c027107f5b898eb795302e9c9 +Author: Patrick Schleizer +Date: Sun Apr 12 14:03:30 2026 +0000 + + bumped changelog version + +commit e9d672a5e6a2c76a3668aebd46dcb42c04b97fdc +Author: Patrick Schleizer +Date: Sun Apr 12 03:35:31 2026 -0400 + + comments + +commit 232b01e7df376225ed895bf04ebe02b0943b6074 +Author: Patrick Schleizer +Date: Fri Apr 10 09:21:40 2026 +0000 + + bumped changelog version + +commit 1e23d62307d17fc6ecc86ae923332c07bfc52d60 +Merge: f64fc3e1 972f4c95 +Author: Patrick Schleizer +Date: Fri Apr 10 04:21:34 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 972f4c95fb31d41140d3a30fbdba5c49dbd6bd73 +Author: Aaron Rainbolt +Date: Thu Apr 9 23:37:21 2026 -0400 + + Document fm-shim in README.md + +commit 61dd797310b257fd7614b1769b84d62ce62ef80b +Author: Aaron Rainbolt +Date: Thu Apr 9 23:29:26 2026 -0400 + + Standardize on one form of bullets in README.md + +commit 1a71a3e954060aaf06a3daf491168bdf31942dc5 +Author: Claude +Date: Thu Apr 9 12:06:54 2026 +0000 + + comment out bdev_allow_write_mounted=0 + + Causes breakages with disk management operations such as disk + resizing and VDI compaction in virtual machines. + + https://github.com/Kicksecure/security-misc/pull/334 + https://forums.whonix.org/t/kernel-hardening-security-misc/7296/609 + https://forums.whonix.org/t/how-to-compress-and-prevent-vdi-from-ballooning-after-each-update-deleting-large-files/22675/9 + https://forums.kicksecure.com/t/resizing-disk-for-guest-in-kvm/1657 + + https://claude.ai/code/session_01Cd9ka8sC7zLUvB31V4kxMk + +commit f64fc3e1645ec2661b518e64f4454dc9ef85cf49 +Author: Patrick Schleizer +Date: Thu Apr 9 11:57:57 2026 +0000 + + bumped changelog version + +commit 4c3d4267a19ef56c488779ad28d82eef87b967d9 +Merge: 46c171e4 e718203d +Author: Patrick Schleizer +Date: Thu Apr 9 07:53:33 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit e718203d075ba73ecb7a89e31db6ca4ac588cf78 +Author: Aaron Rainbolt +Date: Wed Apr 8 17:20:10 2026 -0400 + + Add additional compiler hardening flags for fm-shim-backend + +commit cf518cbabae41c6608006adcdf38128c902486c2 +Author: Aaron Rainbolt +Date: Wed Apr 8 17:19:19 2026 -0400 + + Add additional compiler hardening flags for emerg-shutdown + +commit 83b360edf6c3d8a0d1714a3f2d6e9865ae225b64 +Author: Aaron Rainbolt +Date: Wed Apr 8 17:06:00 2026 -0400 + + Fix dead code in emerg-shutdown.c + +commit 46c171e42ab66b0ec3bc10e715e6c54974966a8e +Author: Patrick Schleizer +Date: Wed Apr 8 17:51:28 2026 +0000 + + bumped changelog version + +commit 7b443582fe845d2a6c76c74f96df837bb56ef624 +Author: Patrick Schleizer +Date: Wed Apr 8 10:07:01 2026 -0400 + + remove trailing space + +commit cbcf722f5a895697364891f15d37349d68f8054e +Merge: 3949bf35 17a9da5b +Author: Patrick Schleizer +Date: Wed Apr 8 10:06:09 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 17a9da5bada135774ff71cf094e56d2557048540 +Author: Aaron Rainbolt +Date: Mon Apr 6 22:21:51 2026 -0400 + + More emerg-shutdown bugfixes (from Claude Code) + +commit 55e42610c2949c1f15bc6802dab1006f8d74159e +Author: Aaron Rainbolt +Date: Mon Apr 6 21:28:28 2026 -0400 + + Document reason for not quoting pkg-config subshells + +commit 5c0641795a33a9bd0a01dbbce66fa243978bb59a +Author: Aaron Rainbolt +Date: Mon Apr 6 20:29:12 2026 -0400 + + Minor fixes on fm-shim-backend + +commit af4f229046b8ff64eeea599bc72fe47bd35784fc +Author: Aaron Rainbolt +Date: Sun Apr 5 19:21:41 2026 -0400 + + Improve fm-shim-backend security and D-Bus error handling (mostly from Claude Code) + +commit 83fba23b6f95cda25c7839ac43ae2e02e52b59a1 +Author: Aaron Rainbolt +Date: Sun Apr 5 18:33:50 2026 -0400 + + Only allow the primary fm-shim-backend process to use sd_notify + +commit 3b3b5862cd168d75c768220408314040562cf020 +Author: Aaron Rainbolt +Date: Sun Apr 5 18:15:31 2026 -0400 + + Security hardening: fix buffer handling, input validation, misc bugs (mostly taken from Claude Code) + +commit 4d0ccf65acec9c2ee15608d8b6b601293b8f98da +Author: Aaron Rainbolt +Date: Sun Apr 5 15:45:06 2026 -0400 + + Add user existence check to virusforget (inspired by Claude Code) + +commit 3949bf35e90a50b8ebc534b71fd3ece834f23b8b +Author: Patrick Schleizer +Date: Sun Mar 22 11:13:50 2026 +0000 + + bumped changelog version + +commit 92f6f30f565b1b8598199ac7d1bc35e01bf5a082 +Author: Patrick Schleizer +Date: Sun Mar 22 05:45:45 2026 -0400 + + comment + +commit 140c9cbc8a487585a92eca7acbbdfe18b92e0da9 +Merge: c913e3be 8a81ab4a +Author: Patrick Schleizer +Date: Sun Mar 22 05:44:46 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 8a81ab4af5182a124686857104118c0701e93357 +Author: Aaron Rainbolt +Date: Thu Mar 19 22:17:47 2026 -0400 + + Comments, hardening on fm-shim frontend and backend + +commit 144d04cd84084508a7f1ce892ef1d00296f693de +Merge: 58192e68 c913e3be +Author: Aaron Rainbolt +Date: Thu Mar 19 20:39:37 2026 -0400 + + Merge branch 'master' into arraybolt3/trixie + +commit c913e3bead0dfffee0a46049d30dc8d91e47f5ca +Author: Patrick Schleizer +Date: Thu Mar 19 18:30:25 2026 +0000 + + bumped changelog version + +commit 89908e0938929c6ee6f39dbd510f4bc889ca31c1 +Author: Patrick Schleizer +Date: Thu Mar 19 11:24:36 2026 -0400 + + copyright + +commit 58192e688c0ea32bf6bb9806eb619413d26c2b12 +Author: Aaron Rainbolt +Date: Wed Mar 18 20:28:20 2026 -0400 + + Avoid unintentional HTML rendering in fm-shim-frontend, fix path resolution, fix wrong D-Bus protocol handling in backend, slightly harden backend + +commit 6c0b8dbc50840950756b4d28c5bb7622e035b11d +Author: Patrick Schleizer +Date: Tue Mar 17 13:57:12 2026 -0400 + + remove trailing spaces + +commit 58555692e771846548282dd55e696117d95abff4 +Merge: ce5034d9 b34ee621 +Author: Patrick Schleizer +Date: Tue Mar 17 13:55:43 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit b34ee6216809232cc09453f10437fd14e34ea318 +Author: Aaron Rainbolt +Date: Sun Mar 15 21:03:44 2026 -0400 + + Further fm-shim frontend and backend hardening and bugfixes following ChatGPT code review + +commit c96fb114c820625536a32be406b923055a073081 +Author: Aaron Rainbolt +Date: Sun Mar 15 13:54:30 2026 -0400 + + Integrate hardening suggestions from ChatGPT into fm-shim-backend.c + +commit ce5034d9612488728b3ed7b2a61e009762c33e63 +Author: Patrick Schleizer +Date: Sat Mar 14 12:08:52 2026 +0000 + + bumped changelog version + +commit a6c8ba2c5e348ebc419d8ae8148108fba36f6fed +Author: Patrick Schleizer +Date: Sat Mar 14 07:03:41 2026 -0400 + + remove superfluous file + +commit f9a182cb87d16a498e65fb9cb40a3c174683fe75 +Merge: 0da8cad9 76734023 +Author: Patrick Schleizer +Date: Sat Mar 14 07:03:11 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 767340233fa3b305ac53f56c843c348c44695bf3 +Author: Aaron Rainbolt +Date: Tue Mar 10 00:17:29 2026 -0400 + + Fix unused variable in fm-shim-backend.c + +commit 0bf666a87bcfb6f452a16a37d90c813e372fea89 +Author: Aaron Rainbolt +Date: Mon Mar 9 22:28:52 2026 -0400 + + Add work-in-progress D-Bus shim for org.freedesktop.FileManager1 + +commit 0da8cad962683701a77c29b6ba49a2f80e125690 +Author: Patrick Schleizer +Date: Mon Feb 23 13:34:15 2026 +0000 + + bumped changelog version + +commit ff99577a0aef5b52619fdccc9e933ce8af5aaf2b +Merge: 196ff190 df6ca04d +Author: Patrick Schleizer +Date: Mon Feb 23 06:31:32 2026 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit df6ca04de8c47b83e58f0c35b4736305e41f1645 +Merge: 196ff190 ad1d64fc +Author: Patrick Schleizer +Date: Mon Feb 23 06:30:40 2026 -0500 + + Merge pull request #351 from raja-grewal/cdrom + + Add CD-ROM/DVD hardening settings + +commit ad1d64fc4ffe53ffc0710b5d9654dfff5ff6f617 +Merge: f99e5c48 196ff190 +Author: raja-grewal +Date: Fri Feb 20 11:04:39 2026 +1100 + + Merge branch 'Kicksecure:master' into cdrom + +commit 196ff19056dcaf3bf31174d18be728e4a29159a0 +Merge: 7df34854 c17f2404 +Author: Patrick Schleizer +Date: Thu Feb 19 07:10:42 2026 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit f99e5c48c03b6b7e9e3995e5c61c996a05108e03 +Merge: fe1d9242 c17f2404 +Author: raja-grewal +Date: Wed Feb 18 09:15:23 2026 +1100 + + Merge branch 'Kicksecure:master' into cdrom + +commit c17f2404c4b690ba9315b396408b33c2b8eb449d +Merge: 7df34854 7477128e +Author: Patrick Schleizer +Date: Tue Feb 17 11:03:30 2026 -0500 + + Merge pull request #344 from raja-grewal/docs_update + + Update various docs + +commit fe1d92429d34f66cd9e2cdd085700e6a373bea5f +Author: raja-grewal +Date: Tue Feb 17 07:31:42 2026 +0000 + + sysctl: add cd-rom/dvd hardening settings + +commit 7477128e3e1255156b1e18bb5c049cd74468e9cf +Author: raja-grewal +Date: Mon Feb 16 21:52:39 2026 +0000 + + Simplify links + +commit 32513594d775ecb1817636cccd9b43b5f30d863c +Author: raja-grewal +Date: Mon Feb 16 06:33:58 2026 +0000 + + README: add line + +commit 5a6002d9580373408798511807941ec37ef4aa20 +Author: raja-grewal +Date: Mon Feb 16 04:09:01 2026 +0000 + + Update docs + +commit 369c14ab0231fe605a821d96b3f4ca80fe61854a +Merge: 73d3da10 7df34854 +Author: raja-grewal +Date: Mon Feb 16 14:26:59 2026 +1100 + + Merge branch 'Kicksecure:master' into docs_update + +commit 7df348544fc4bb484d2b955864ff0f598b1aca0b +Author: Patrick Schleizer +Date: Tue Feb 10 12:17:16 2026 +0000 + + bumped changelog version + +commit fb2d44fe2315aa467af733634c5c0bb59a5da65a +Author: Patrick Schleizer +Date: Sun Feb 8 05:14:38 2026 -0500 + + Do not run emerg-shutdown.service in case 'rd.live.ram' or 'rd.live.ram=1' is set. + + https://forums.kicksecure.com/t/how-to-run-iso-live-mode-from-ram/1542/9 + +commit 34440d7cdf662426b147ac8fde65573927b9bfe0 +Author: Patrick Schleizer +Date: Sun Jan 11 16:40:08 2026 +0000 + + bumped changelog version + +commit cbd91974b162cec0144804190f807976ee2788e5 +Author: Patrick Schleizer +Date: Sun Jan 11 10:51:46 2026 -0500 + + typo + +commit a0fd435751e666b72b59afb6658e41ba21e892b4 +Author: Patrick Schleizer +Date: Sun Jan 11 07:09:36 2026 -0500 + + readme + +commit 6c4e7458a10c3a262ecfc0c2f53d1b6181b80ddf +Author: Patrick Schleizer +Date: Mon Jan 5 10:28:53 2026 +0000 + + bumped changelog version + +commit 74533a7efab3f740028d04330752ce18b92dc8fa +Merge: 8a132749 84408cb1 +Author: Patrick Schleizer +Date: Mon Jan 5 03:09:53 2026 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 84408cb1a5228355526815814d2e01ce8d40a175 +Merge: 8a132749 52ef679c +Author: Patrick Schleizer +Date: Mon Jan 5 03:05:02 2026 -0500 + + Merge pull request #345 from Nurmagoz/patch-1 + + debian/control URL fix + +commit 8a132749e0976803173c416cd5f8d4879b7dee3f +Author: Patrick Schleizer +Date: Thu Jan 1 17:28:25 2026 +0000 + + bumped changelog version + +commit e2d31a5b818342037a54e5c3a71ef92df95b9a32 +Author: Patrick Schleizer +Date: Thu Jan 1 12:28:03 2026 -0500 + + genmkfile debinstfile + +commit 6e15c683ab4a682a8ed652559632d7d1e93963c4 +Merge: 97640a9b 436308ae +Author: Patrick Schleizer +Date: Thu Jan 1 12:01:19 2026 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 52ef679c2cd95548e1f0edf48283f0ea5e3a444c +Author: Nurmagoz <11895339+Nurmagoz@users.noreply.github.com> +Date: Wed Dec 31 20:51:34 2025 +0000 + + debian/control URL fix + +commit 436308ae4ec243c80262f3b43dcade0f9ca83859 +Author: Aaron Rainbolt +Date: Mon Dec 29 22:30:00 2025 -0600 + + Minor comment fixes + +commit f8ac896b87e6661704f9b13f775941ea8b4eda06 +Merge: 97640a9b ab98da95 +Author: Aaron Rainbolt +Date: Mon Dec 29 22:23:34 2025 -0600 + + Merge remote-tracking branch 'raja/log_martians' into arraybolt3/trixie-raja-merge + +commit 73d3da104b03c967c56d90d0905336caa802e416 +Author: raja-grewal +Date: Tue Dec 30 03:51:49 2025 +0000 + + Sort file + +commit d0512e4f25ed78d0b27a62e305812dec3e00873a +Author: raja-grewal +Date: Tue Dec 30 03:47:47 2025 +0000 + + Update links to kernel docs + +commit 56df8b624c88b56905d945a0b247714152321c9b +Author: raja-grewal +Date: Mon Dec 29 07:52:15 2025 +0000 + + Re-order boot params as introduced + The ordering was changed due to different merge times. + +commit 8fd95a0b97f339f2609de7e7614fa8a3e86e3157 +Author: raja-grewal +Date: Mon Dec 29 07:44:15 2025 +0000 + + Sort new split package install script for easier readability + +commit e3765131b067083c6a9a7f373cfb154a806e57ad +Author: raja-grewal +Date: Mon Dec 29 07:36:55 2025 +0000 + + Add reference on IOMMU vulnerabilities + +commit 31e268d6246a98d62c23a5bb9e7e4282d0fad282 +Author: raja-grewal +Date: Mon Dec 29 07:34:53 2025 +0000 + + README: typos + +commit cd0a59fd1495db21b8da4b3e8484df61858e7f80 +Author: raja-grewal +Date: Mon Dec 29 07:24:32 2025 +0000 + + Merge Meltdown mitigtions for ARM64 and X86_64 CPUs + +commit 61170e1c6a4869120413cf5236a2d995af26422d +Author: raja-grewal +Date: Mon Dec 29 07:16:54 2025 +0000 + + Reorder panic settings + +commit 6a92e956f3fd41fe416c1e41203687619c7011bc +Author: raja-grewal +Date: Mon Dec 29 07:02:24 2025 +0000 + + Add minor notices to panic on oopses and warnings + +commit 4d49ab56a4be29b03746b99cf6254ef15c93ed74 +Author: raja-grewal +Date: Mon Dec 29 06:52:35 2025 +0000 + + Update docs on `proc_mem.force_override` + +commit 1472d41f030d02aba6576ef481ace35554908e8d +Author: raja-grewal +Date: Mon Dec 29 06:41:33 2025 +0000 + + Add KSPP partial compliance notice for `proc_mem.force_override=ptrace` + +commit 97640a9b5768b7565daf153fbdc9a0655001b790 +Author: Patrick Schleizer +Date: Sun Dec 28 06:36:59 2025 +0000 + + bumped changelog version + +commit c54d6a2258a09867e5b72a8bc1b47df67de6497d +Author: Patrick Schleizer +Date: Sun Dec 28 01:30:43 2025 -0500 + + readme + +commit 7477a6711ad2020fc9a7af19fd98fb88da5b840f +Author: Patrick Schleizer +Date: Sun Dec 28 01:29:26 2025 -0500 + + readme + +commit 885358794f2f4f196e37e6c39b6d95f3b48e325f +Author: Patrick Schleizer +Date: Sun Dec 28 00:55:20 2025 -0500 + + readme + +commit 44837c12bbf63f7e0fd41afad11e19646fd53074 +Author: Patrick Schleizer +Date: Sun Dec 28 00:48:37 2025 -0500 + + genmkfile debinstfile + +commit 7b37965c5c6689533b10e0e592100ee5b94858ee +Merge: d2796afe dddf7979 +Author: Patrick Schleizer +Date: Sun Dec 28 00:47:49 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit dddf79798cb2f2f76bf4432aa90c8a3c61402db1 +Author: Aaron Rainbolt +Date: Sat Dec 27 19:46:55 2025 -0600 + + Document why we disable sudo DNS + +commit 5e45248eb63ecb4b7f924ff9fcba6b40f5bf1244 +Author: Aaron Rainbolt +Date: Sat Dec 27 19:38:19 2025 -0600 + + genmkfile debinstfile + +commit 1b07fd2e73fdfc0d83bd36919080442a14a5ffdf +Author: Aaron Rainbolt +Date: Sat Dec 27 19:38:02 2025 -0600 + + Disable sudo DNS lookups on desktop systems + +commit d2796afe8e4cf5dd55d549adf972e68f86903609 +Author: Patrick Schleizer +Date: Fri Dec 19 11:38:31 2025 +0000 + + bumped changelog version + +commit 68c89cced39a5d2138e22661f4132118628aba64 +Author: Patrick Schleizer +Date: Fri Dec 19 06:30:00 2025 -0500 + + comment + +commit 8aef71c2548807f39a104529e0b6cdf67c201185 +Author: Patrick Schleizer +Date: Fri Dec 19 06:27:14 2025 -0500 + + fix + +commit 55a9755d90d27325010ab19a35b611a9a1df82ae +Author: Patrick Schleizer +Date: Fri Dec 19 06:26:16 2025 -0500 + + refactoring + +commit 6927a5d1adb3dbb96d630e42679c01a6d589232e +Author: Patrick Schleizer +Date: Fri Dec 19 09:56:05 2025 +0000 + + bumped changelog version + +commit 29c12808682fbbd5bd63f1bb821821f5adbfdbc5 +Author: Patrick Schleizer +Date: Fri Dec 19 04:55:41 2025 -0500 + + genmkfile debinstfile + +commit 7ed2d25def0f143dc4cb3695f0e8c5b74682a743 +Merge: b366c5e6 0bf0a73e +Author: Patrick Schleizer +Date: Fri Dec 19 03:42:20 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 0bf0a73eb4683bd7205eaafa692237c57e7d18ae +Author: Aaron Rainbolt +Date: Mon Dec 15 20:18:14 2025 -0600 + + Add a missing quote mark for panic_on_taint + +commit 2106ed5aa651d9910df9965d68cb632808423e77 +Merge: b9d4f0aa 969d4d82 +Author: Aaron Rainbolt +Date: Mon Dec 15 19:41:36 2025 -0600 + + Merge remote-tracking branch 'raja/amd_encrypt_sev' into arraybolt3/trixie-raja-merge + +commit 969d4d82139b1c1793786b7a24c9eee3f4a1101c +Author: raja-grewal +Date: Tue Dec 16 11:49:21 2025 +1100 + + Add references for AMD SME + +commit b9d4f0aaa565ab478a8e0ef4cef27bc49457da42 +Author: Aaron Rainbolt +Date: Sun Dec 14 14:24:33 2025 -0600 + + Add minor clarifications + +commit 005b66c265654514b6450908a75615b71003f372 +Merge: 3f097a35 eaf0f814 +Author: Aaron Rainbolt +Date: Sun Dec 14 14:05:36 2025 -0600 + + Merge remote-tracking branch 'raja/panic_taint' into arraybolt3/trixie-raja-merge + +commit 3f097a35f21582300a87ddf7c70b2698df90e5ff +Author: Aaron Rainbolt +Date: Sun Dec 14 14:03:26 2025 -0600 + + Split up a line in README.md + +commit e7e6d6d3739bebfb8a92f6666e5f2f43ecbc2b52 +Merge: 8e56772c b8f78062 +Author: Aaron Rainbolt +Date: Sun Dec 14 14:01:54 2025 -0600 + + Merge remote-tracking branch 'raja/incomplete_cpu_mitigations' into arraybolt3/trixie-raja-merge + +commit b8f78062673ec3675ff31a0f7d34b853e9f97f04 +Author: raja-grewal +Date: Sun Dec 14 12:38:47 2025 +0000 + + Update usage of `mitigations=auto,nosmt` + +commit eaf0f814bdbe52739d3b3270bb2549bbdc2753f2 +Author: raja-grewal +Date: Sun Dec 14 11:18:08 2025 +0000 + + Update option to `panic_on_taint` + +commit 8e56772c2f0d26b7266403c0dfc5b7ef6d86d1fc +Author: Aaron Rainbolt +Date: Sat Dec 13 19:22:50 2025 -0600 + + README.md typo fix + +commit 4d0a126955e48d790c063b218540a63b514bbd24 +Merge: 39ce5919 8040ba75 +Author: Aaron Rainbolt +Date: Sat Dec 13 18:44:03 2025 -0600 + + Merge remote-tracking branch 'raja/modprobe_refresh' into arraybolt3/trixie-raja-merge + +commit 39ce5919765b7cadac07dfeadb6cbbd29261b81c +Merge: b366c5e6 7d901213 +Author: Aaron Rainbolt +Date: Sat Dec 13 18:27:22 2025 -0600 + + Merge remote-tracking branch 'raja/amd_encrypt_sev' into arraybolt3/trixie-raja-merge + +commit 650b923c7a88820d3a899596e32016e1c3f6cc57 +Author: raja-grewal +Date: Sat Dec 13 04:35:02 2025 +0000 + + Update option to `panic_on_taint` + +commit b366c5e62ad375cef608f5fc435d444de52b056d +Author: Patrick Schleizer +Date: Fri Dec 12 13:17:09 2025 +0000 + + bumped changelog version + +commit 68de32e43e5597c5bda5449cf78eeed94895a63c +Merge: 725565c4 135ee804 +Author: Patrick Schleizer +Date: Fri Dec 12 04:35:53 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 8040ba7579735cafee5fcd9ddf60ca4c88080f70 +Author: raja-grewal +Date: Fri Dec 12 02:04:38 2025 +0000 + + Minor fixes to docs + +commit fe1cfcd1a0f42b4e4938f7b327c33e89936aff76 +Author: raja-grewal +Date: Fri Dec 12 02:03:23 2025 +0000 + + Update docs on CPU MSRs + +commit ab2d44677a3198d6e421bb1c630a18fc4e85065c +Author: raja-grewal +Date: Fri Dec 12 02:01:20 2025 +0000 + + Correct script addition + +commit 5684a12d9db65474392dc9e1ebdc4646e34569eb +Author: raja-grewal +Date: Fri Dec 12 01:59:23 2025 +0000 + + Whitelist `9p` module + +commit 135ee80450c7f7e4c3d71be861fe1b5a6c135d02 +Author: Aaron Rainbolt +Date: Thu Dec 11 18:47:42 2025 -0600 + + Move kernel.panic=-1 setting to sysctl, allow turning panic-on-oops off with systemctl + +commit 7d901213029f17e7d0a4dccc671b3bfd476bab13 +Author: raja-grewal +Date: Thu Dec 11 14:12:18 2025 +0000 + + Add reference for AMD SEV + +commit 72f295a3f04e43307dea9af29657ee96fb1c47a5 +Author: raja-grewal +Date: Thu Dec 11 14:11:47 2025 +0000 + + Provide option to enable AMD SEV-SNP + +commit 6a17255307c1d3b397ad38ab8f3bb8a14a3c5ca5 +Author: raja-grewal +Date: Thu Dec 11 14:11:26 2025 +0000 + + Provide option to enable AMD SEV-ES + +commit 22b1e3dc92c8bffca20f5d70920b6b9be042658e +Merge: 30068ec8 725565c4 +Author: raja-grewal +Date: Thu Dec 11 18:15:35 2025 +1100 + + Merge branch 'master' into panic_taint + +commit 53c4fdbeea0a44ca9e7ab739d80393b9c655482c +Merge: f75e9873 725565c4 +Author: raja-grewal +Date: Thu Dec 11 12:52:14 2025 +1100 + + Merge branch 'Kicksecure:master' into modprobe_refresh + +commit 725565c42e7b3e1bb5036d160cc0388cc001901b +Author: Patrick Schleizer +Date: Tue Dec 9 14:06:55 2025 +0000 + + bumped changelog version + +commit b7b6b6e5fbeba0cfab141bf05d7fb657879ba8e9 +Author: Patrick Schleizer +Date: Mon Dec 8 09:42:59 2025 -0500 + + output + +commit 8f99672cb24242d6cb86d985384ab4ad7d1aca54 +Author: Patrick Schleizer +Date: Fri Dec 5 11:39:12 2025 +0000 + + bumped changelog version + +commit ac128dd873968b1815e4113b30ea69f34fa0b088 +Merge: 17dd7af7 85761a41 +Author: Patrick Schleizer +Date: Fri Dec 5 06:35:03 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 85761a4153a4f19e7b18e91062e97d3376451884 +Author: Aaron Rainbolt +Date: Thu Dec 4 23:27:18 2025 -0600 + + permission-hardener: Fix undo warning logic, minor improvements suggested by ChatGPT Codex + +commit 17dd7af7d1cf37ff30a17e2eaee06732d627ed34 +Author: Patrick Schleizer +Date: Wed Dec 3 08:31:22 2025 +0000 + + bumped changelog version + +commit c44678f92df924e4c10f08960426c526e0292aba +Merge: 6f9732be 0534a34e +Author: Patrick Schleizer +Date: Wed Dec 3 03:22:44 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 0534a34ed7246793db384518cfbecb3adfcb7f3e +Author: Aaron Rainbolt +Date: Tue Dec 2 19:06:30 2025 -0600 + + Fix block-unsafe-logins when running as non-root, add swaylock to list of safe auth services + +commit 6f9732be98cbc344076b89d57491c423368172d5 +Merge: 2089b3a9 b3eb739f +Author: Patrick Schleizer +Date: Tue Dec 2 06:04:07 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit b3eb739fe2662acfbd844de8d87af4720727fc7a +Author: Aaron Rainbolt +Date: Sun Nov 30 00:20:21 2025 -0600 + + Link fix, change some wording + +commit 5f34b4146e895bb935b719071ab2762278944995 +Merge: 2c253b13 29176d2e +Author: Aaron Rainbolt +Date: Sun Nov 30 00:12:18 2025 -0600 + + Merge remote-tracking branch 'raja/docs' into arraybolt3/trixie + +commit 2c253b1312c034cb8395039803380c1157967061 +Merge: 17ab1bb0 c5f91eb3 +Author: Aaron Rainbolt +Date: Sat Nov 29 21:01:51 2025 -0600 + + Merge remote-tracking branch 'raja/vsyscall32' into arraybolt3/trixie + +commit 17ab1bb00fe287c4c941d9cd3813ee3a3ae89ade +Author: Aaron Rainbolt +Date: Sat Nov 29 20:44:30 2025 -0600 + + Documentation fix + +commit 2b2d30afce3d40eb9c2177ad67fd7d89cd4602a0 +Merge: f0d069c7 3fdfebc4 +Author: Aaron Rainbolt +Date: Sat Nov 29 20:23:09 2025 -0600 + + Merge remote-tracking branch 'raja/limit_full_force' into arraybolt3/trixie + +commit f0d069c7968e2ee10d7104ce1ba502d3122b0ab2 +Author: Aaron Rainbolt +Date: Sat Nov 29 20:15:03 2025 -0600 + + Minor README.md corrections + +commit b73a830b0f62fe43b38cc89d56d997bed355570c +Merge: e54cb007 53d90b11 +Author: Aaron Rainbolt +Date: Sat Nov 29 19:59:35 2025 -0600 + + Merge remote-tracking branch 'raja/kpti' into arraybolt3/trixie + +commit e54cb007f9fc351c25c292ffd68abe974be56bb0 +Merge: 84e193c4 e43d4d7f +Author: Aaron Rainbolt +Date: Sat Nov 29 19:54:10 2025 -0600 + + Merge remote-tracking branch 'raja/limit_bdev_writes' into arraybolt3/trixie + +commit 84e193c44ec9ebf676d1fb4a32d6e2f68afd3d0d +Merge: 65c45fc3 5ac02d2d +Author: Aaron Rainbolt +Date: Fri Nov 28 14:21:59 2025 -0600 + + Merge remote-tracking branch 'raja/stop_tw_reuse' into arraybolt3/trixie + +commit 65c45fc3d799cdf6402328cc61cbdd1949a12945 +Author: Aaron Rainbolt +Date: Fri Nov 28 00:13:45 2025 -0600 + + Minor fixes to NMI panic docs + +commit 37b1d055f18c6335e96c41c06174b66e43e4a8ff +Merge: 7280d886 ebc011e6 +Author: Aaron Rainbolt +Date: Fri Nov 28 00:09:43 2025 -0600 + + Merge remote-tracking branch 'raja/panic_nmi' into arraybolt3/trixie + +commit 7280d8867da50e05dd7d3071123d49b15660051d +Merge: 2089b3a9 62dc2d44 +Author: Aaron Rainbolt +Date: Thu Nov 27 23:28:53 2025 -0600 + + Merge remote-tracking branch 'raja/amd_encrypt_ram' into arraybolt3/trixie + +commit 2089b3a9b8e9d10c06850f0329f7e2eb8a8a12cc +Author: Patrick Schleizer +Date: Mon Nov 24 08:44:10 2025 +0000 + + bumped changelog version + +commit cbd35502f19e74b6f95ff40bf03f02806eef3cdc +Author: Patrick Schleizer +Date: Mon Nov 24 03:18:25 2025 -0500 + + comment + +commit cac73c3154b3278ad71edc0fd159afc71d5dbc45 +Author: Patrick Schleizer +Date: Mon Nov 24 03:17:38 2025 -0500 + + minor + +commit d68988e76cda939ce200d970e19310cadba5d08e +Author: Patrick Schleizer +Date: Mon Nov 24 03:17:25 2025 -0500 + + comments + +commit c1ca36d75888b95835b953c3a8a122954c1e5929 +Merge: ec116795 a3417e99 +Author: Patrick Schleizer +Date: Mon Nov 24 03:11:19 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit a3417e997d26e9a88d30da408d470fab98f58d79 +Author: Aaron Rainbolt +Date: Sun Nov 23 16:27:59 2025 -0600 + + Add pkexec remembered permissions fix for permission-hardener, fix some postinst bugs + +commit edda37809fb186f6d85511e774957b701483ca66 +Author: Aaron Rainbolt +Date: Sun Nov 23 14:54:02 2025 -0600 + + Remove obsolete migration code for permission-hardener, add initial permission-hardener state installation code + +commit ec11679514d54c9a61e7c4e35ce81467b12333f4 +Author: Patrick Schleizer +Date: Sun Nov 23 10:26:13 2025 +0000 + + bumped changelog version + +commit 5c4d3162ab3c5178502c1f48e6288dc86cc45bb1 +Author: Patrick Schleizer +Date: Sun Nov 23 05:25:13 2025 -0500 + + fix + +commit 30068ec8cdaa7a6778f0ba0b423f7ab3c3391759 +Author: raja-grewal +Date: Sat Nov 22 15:01:47 2025 +1100 + + Correct bitmask + +commit f75e9873375d187fbbe4b5bfd135d0cd26a93fe6 +Author: raja-grewal +Date: Fri Nov 21 13:06:42 2025 +0000 + + Relabel some disabled module headings + +commit 79be87ec5f2cb22a98ada179b3aa97dfd58299e0 +Author: raja-grewal +Date: Fri Nov 21 13:05:13 2025 +0000 + + Move (optional) CPU MSR module disable list + +commit 1a7b0a9122cc6b6e755a540dd62fd018a1a7536d +Author: raja-grewal +Date: Fri Nov 21 12:43:05 2025 +0000 + + Disable more file systems + +commit 1865cafe446c6a525bc63caa7ce1097ce573b877 +Author: raja-grewal +Date: Fri Nov 21 12:42:10 2025 +0000 + + Move joydev from blacklist to disable + +commit 28476d3d53a0e4796b4396a925c44ccf32f4fe90 +Author: raja-grewal +Date: Fri Nov 21 12:40:12 2025 +0000 + + Update docs on GrapheneOS blacklisted modules + +commit 446d3771bf8c42aba61d248bccfe9fad4eacc88d +Author: raja-grewal +Date: Fri Nov 21 12:38:44 2025 +0000 + + Update docs on CD-ROM/DVD blacklisting + +commit 3646a2fefeaa774aea068d7c6e761c5b76479f55 +Author: raja-grewal +Date: Fri Nov 21 12:37:57 2025 +0000 + + Move superseded brcm80211 to disabled + Split and replaced by brcmsmac and brcmfmac in kernel 2.6.39 + +commit 66ba273d448ff92c249abe9dd0f83a64cc1ee823 +Author: raja-grewal +Date: Fri Nov 21 12:36:57 2025 +0000 + + Add CPU MSR modules + +commit e6aa648d54f076c5c75d45bcd7658d502b701982 +Author: raja-grewal +Date: Fri Nov 21 12:36:32 2025 +0000 + + Update docs on CPU MSR disabling + +commit 59869979bbc2fb16da6b3435276e4930b4088f59 +Author: raja-grewal +Date: Fri Nov 21 12:35:51 2025 +0000 + + Update docs on Vivid disabling + +commit 4597fd16a9b94ebd6b4fae152a64288b665d9c36 +Author: raja-grewal +Date: Fri Nov 21 12:35:03 2025 +0000 + + Sort RDNIS disabling and add docs + +commit 5adc007536578c1e70a8cc6784fbced2033b7a5c +Author: raja-grewal +Date: Fri Nov 21 12:33:15 2025 +0000 + + Update docs on Intel PMT disabling + +commit 31e3aa0c3add48ad26e43e4b83358571843f28de +Author: raja-grewal +Date: Fri Nov 21 12:32:30 2025 +0000 + + Update docs on Bluetooth disabling + +commit 9f85a78c9919d71c3e92099cac8525ac385aea5c +Author: Patrick Schleizer +Date: Wed Nov 19 07:02:14 2025 +0000 + + bumped changelog version + +commit 4e7cfb0d061810ec7c3139379a65db83abc39efc +Merge: d267cf67 936c799c +Author: Patrick Schleizer +Date: Wed Nov 19 01:55:10 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 936c799cb5f48376fa259bb3b92b653526a00509 +Author: Aaron Rainbolt +Date: Tue Nov 18 23:53:03 2025 -0600 + + Don't break passwordless sudo in unrestricted admin mode + +commit 68025d3624e7543deec2fbe43ea0f010344e4160 +Author: raja-grewal +Date: Wed Nov 19 01:16:46 2025 +0000 + + Provide option to `panic_on_taint` + +commit ebc011e67bff659778cbca2240c5e57d663f3f41 +Author: raja-grewal +Date: Wed Nov 19 11:35:04 2025 +1100 + + Typo + +commit 62dc2d448366d190812773ec9eeadd38e1223cbc +Author: raja-grewal +Date: Tue Nov 18 20:31:46 2025 +1100 + + Add note about Intel TME + +commit 29176d2ed29b07c4da9b9c0df1eefd2bda70b984 +Author: raja-grewal +Date: Sat Nov 15 06:30:11 2025 +0000 + + Remove the option to reduce the MCE tolerance level + +commit 9f897c5ccda781d010077446abb3d176cf929c94 +Author: raja-grewal +Date: Sat Nov 15 05:48:33 2025 +0000 + + Update docs on reducing the MCE tolerance level + +commit b6fe1a5a6e164c7a7505b5e27ece582a1b928d82 +Author: raja-grewal +Date: Sat Nov 15 04:51:01 2025 +0000 + + Make panic related settings consistent + Ensures the `sysctl` and boot parameters are equivalent in settings and in description. This should prevent future questions regarding having omitted boot parameters that were actually redundant. + +commit 99e993b885ca1fa30a871120b545f9334371cd5a +Author: raja-grewal +Date: Sat Nov 15 03:16:07 2025 +0000 + + Provide options to enable AMD SME and SEV + +commit d267cf6761076092c299508a0c356c05d0ee713d +Author: Patrick Schleizer +Date: Fri Nov 14 06:21:34 2025 +0000 + + bumped changelog version + +commit efa06a1eae52b15978eb84f6ab4153ae88eb8d6a +Author: Patrick Schleizer +Date: Fri Nov 14 00:44:50 2025 -0500 + + port to package-installed-check + +commit abf5852ebabec81d553a60139fe5a15972d14ab5 +Author: Patrick Schleizer +Date: Wed Nov 12 06:13:05 2025 +0000 + + bumped changelog version + +commit 3af891645503c62ff5510b78e5cbe73774ad72a2 +Merge: fb587f78 3070aa5d +Author: Patrick Schleizer +Date: Tue Nov 11 23:59:50 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit d891313d57b469c28c08993b05d355b29ea08397 +Author: raja-grewal +Date: Tue Nov 11 11:39:21 2025 +0000 + + Provide options to panic upon receiving NMIs + +commit 0b9b9ffb1e87850e3296d0420c305062b66868d5 +Author: raja-grewal +Date: Tue Nov 11 11:32:47 2025 +0000 + + Improve clarity for panic on OOM + +commit 3070aa5d1f988b199030b31baa2fabc2db7b289f +Author: Aaron Rainbolt +Date: Mon Nov 10 22:40:15 2025 -0600 + + Fix passwordless login for sensitive accounts, only deny passwordless privilege escalation + +commit ab98da957c732340ddb7bb43ed445835220c21d1 +Author: raja-grewal +Date: Tue Nov 11 04:28:56 2025 +0000 + + Re-set `net.ipv4.conf.*.log_martians=1` + +commit fb587f78fd11e471b3169f8c67c1772c1ba3729d +Author: Patrick Schleizer +Date: Mon Nov 10 08:00:06 2025 +0000 + + bumped changelog version + +commit fc1b865dd7a7663cbea8948c06ce45e69269a3b1 +Author: Patrick Schleizer +Date: Mon Nov 10 02:21:27 2025 -0500 + + debugging + +commit 45126cede6563a3bfe9c700543fdec09442f1cb3 +Author: Patrick Schleizer +Date: Mon Nov 10 02:19:29 2025 -0500 + + end-of-options + +commit 61637a5ff06b69210f293bed91735a2bf80e8946 +Author: Patrick Schleizer +Date: Mon Nov 10 02:15:30 2025 -0500 + + refactoring + +commit ddb59a3b01444762c7a9da68d2cc34d98f3d8f96 +Author: Patrick Schleizer +Date: Mon Nov 10 02:13:48 2025 -0500 + + comment + +commit ae1e2e3b52ea4c18ed1d4bb2e7cf3c2adf06711c +Author: Patrick Schleizer +Date: Mon Nov 10 02:10:25 2025 -0500 + + output + +commit f2b765854203cfb5be15ad63a260fec860ed0620 +Author: Patrick Schleizer +Date: Mon Nov 10 02:09:54 2025 -0500 + + use long option names + +commit 71ca68bd4aab5adad9a8c1dd20df4dc6990885e7 +Author: Patrick Schleizer +Date: Mon Nov 10 02:09:00 2025 -0500 + + end-of-options + +commit e9e6c12b03fd6f440232221cdf7f34e9bc7661a2 +Author: Patrick Schleizer +Date: Mon Nov 10 02:08:04 2025 -0500 + + output + +commit f5db916bf728f8d09ee48cec5cb0a0a3ee520e33 +Author: Patrick Schleizer +Date: Mon Nov 10 02:06:55 2025 -0500 + + fix + +commit bb0a23fcc80b7963e0fc80f6e7da6931aa88c300 +Author: Patrick Schleizer +Date: Mon Nov 10 02:05:47 2025 -0500 + + chmod +x + +commit 39a6ce002e9ff696104906be252afffce70dd959 +Author: Patrick Schleizer +Date: Mon Nov 10 02:05:03 2025 -0500 + + genmkfile debinstfile + +commit 94de949a4797be1706378a10324ec9c2522834a7 +Merge: 0939883f 5fbd42bb +Author: Patrick Schleizer +Date: Mon Nov 10 02:04:15 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 5ac02d2d528a37fe1c162c4808b3d874a8c53159 +Author: raja-grewal +Date: Mon Nov 10 06:13:35 2025 +0000 + + Set `net.ipv4.tcp_tw_reuse=0` + +commit b89aaea61e83aea6b23ea34a01dbb1e6bce1e2df +Author: raja-grewal +Date: Mon Nov 10 06:03:33 2025 +0000 + + Add docs on logging martian packets + +commit 5fbd42bbec55d66197b70789b10f7cb6705207fb +Author: Aaron Rainbolt +Date: Sun Nov 9 18:38:54 2025 -0600 + + Add kill-vboxdrmclient-on-shutdown.service + +commit 9d86379f5624a6c2b20645c34e1621977c1d4db9 +Author: Aaron Rainbolt +Date: Sun Nov 9 17:46:22 2025 -0600 + + Prevent non-sysmaint logins in sysmaint mode and unsafe passwordless logins in user mode + +commit a3830db09e3f567237caefb687ef2da877573b03 +Author: raja-grewal +Date: Sun Nov 9 13:42:31 2025 +0000 + + Update docs relating to panic on OOM + +commit 0aa0b67df6a33b84a656cfb7055c4af5ca583439 +Merge: a46f678c 0939883f +Author: raja-grewal +Date: Mon Nov 10 00:20:48 2025 +1100 + + Merge branch 'master' into docs + +commit 0939883f0b5e1232e9aa85e61c0cbef551a59357 +Author: Patrick Schleizer +Date: Sun Nov 9 10:47:45 2025 +0000 + + bumped changelog version + +commit 039141188558931b73a9b5897ea3422bbb201dad +Author: Patrick Schleizer +Date: Sun Nov 9 05:47:00 2025 -0500 + + revert Force immediate kernel panic on OOM. + + https://github.com/Kicksecure/security-misc/issues/324#issuecomment-3507949741 + +commit 26b96ce2800e794104e6d3c113c3c2c121795b39 +Author: Patrick Schleizer +Date: Sun Nov 9 08:12:42 2025 +0000 + + bumped changelog version + +commit 1ef974300a157235da6a6c4d1379b62acf0c4c61 +Author: Patrick Schleizer +Date: Sat Nov 8 04:00:47 2025 -0500 + + readme + +commit 48ce12eba38aec099b4afe42e4d42b1d41dcb97f +Author: Patrick Schleizer +Date: Sat Nov 8 07:44:43 2025 +0000 + + bumped changelog version + +commit 69419357e1bb2d0842ecd5db3e42bcaa011f5c11 +Author: Patrick Schleizer +Date: Sat Nov 8 02:42:25 2025 -0500 + + genmkfile debinstfile + +commit d50e6afc8fb0a925e07fc54b7ecc1f450d9aa176 +Author: Patrick Schleizer +Date: Sat Nov 8 01:34:32 2025 -0500 + + sanity test + +commit 12679608428e6927da480ca721b34bab75108687 +Author: Patrick Schleizer +Date: Sat Nov 8 01:32:45 2025 -0500 + + comments + +commit 1e48886c7e77fa7bccfdee3cca6f0fbdba74e4a1 +Author: Patrick Schleizer +Date: Sat Nov 8 01:31:02 2025 -0500 + + long option name + +commit d6c949c791bcc2c76b4f2e81eb0ffd370f8f1a37 +Merge: 5b97e7bd fa32ba6c +Author: Patrick Schleizer +Date: Sat Nov 8 01:29:48 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit fa32ba6c4fccf35111f85ec3819e718963359d7c +Author: Aaron Rainbolt +Date: Fri Nov 7 17:09:22 2025 -0600 + + Suppress usbguard startup unless a USB controller is visible to lspci + +commit 635c216d4e55eb0c6463c543202aea629c572f5e +Author: raja-grewal +Date: Wed Nov 5 01:44:36 2025 +0000 + + Update docs on CPU mitigations + +commit a46f678c7f8715fd1cedd1102f9815b9d845ccb3 +Author: raja-grewal +Date: Wed Nov 5 00:05:17 2025 +0000 + + Update docs on latent entropy + +commit 37b493826ec60397c6019959abb7e0631dd33ed4 +Author: raja-grewal +Date: Wed Nov 5 00:03:54 2025 +0000 + + Spit distrusting entropy settings for clarity + +commit 019a0cf72c99f9f10fd42afbfed96c283e17e458 +Author: raja-grewal +Date: Wed Nov 5 00:03:19 2025 +0000 + + Update docs on entropy + +commit 4c88b911415cbf57eecc93a22c6674322662db50 +Merge: d175d1be 5b97e7bd +Author: raja-grewal +Date: Wed Nov 5 10:10:10 2025 +1100 + + Merge branch 'Kicksecure:master' into docs + +commit e43d4d7f7110de0b23996373e9462aa900b314a6 +Author: raja-grewal +Date: Mon Nov 3 05:46:07 2025 +0000 + + Set `bdev_allow_write_mounted=0` + +commit 53d90b1128d55e352b3eef8ae680a07a825b1ecf +Author: raja-grewal +Date: Mon Nov 3 04:32:49 2025 +0000 + + Update docs on `ssbd=force-on` + +commit 322584db3346aaa1e3d1f9782b3d22ca2153c7da +Author: raja-grewal +Date: Mon Nov 3 04:31:59 2025 +0000 + + Update docs on `pti=on` + +commit 5e87c9bea49b5a06c1400cb8b632f344cccb6db6 +Author: raja-grewal +Date: Mon Nov 3 04:30:58 2025 +0000 + + Set `kpti=1` + +commit 3fdfebc4646d7c1f48806d02810de44fd53482bb +Author: raja-grewal +Date: Mon Nov 3 00:48:49 2025 +0000 + + Set `proc_mem.force_override=ptrace` + +commit 5b97e7bd277038b3b04c80a78ce05bb52277d4f6 +Author: Patrick Schleizer +Date: Sun Nov 2 11:41:51 2025 +0000 + + bumped changelog version + +commit 58d5f738e63d4c18048fab4e2fd134d68722d0fd +Merge: 5121f80f 7beb19b6 +Author: Patrick Schleizer +Date: Sun Nov 2 06:08:46 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 5121f80f28d374d78bb3897a46fe924d750f4643 +Author: Patrick Schleizer +Date: Sun Nov 2 06:00:24 2025 -0500 + + comment + +commit 29685938bdfd5c14828091342dbe21283ed45fd1 +Author: Patrick Schleizer +Date: Sun Nov 2 05:57:52 2025 -0500 + + move usbguard reject rules to the top + +commit c5f91eb33a2ad745af7a6278cf49419d0b366343 +Author: raja-grewal +Date: Sun Nov 2 06:15:06 2025 +0000 + + Add another method to disable 32-bit legacy vsyscalls + +commit d175d1be525edd8fb6140680c31425c8a89cc244 +Author: raja-grewal +Date: Sun Nov 2 15:54:34 2025 +1100 + + Add doc on entropy related failure on AMD Zen 5 CPUs + +commit 7beb19b64a33cb86771488ab558756fa86b577d3 +Author: Aaron Rainbolt +Date: Sat Nov 1 22:06:44 2025 -0500 + + Update README.md with info about flatpak auth hardening + +commit 5a6730450af6e3d1ab76d6e26d4fb1d7175be946 +Author: Patrick Schleizer +Date: Sat Nov 1 10:13:50 2025 +0000 + + bumped changelog version + +commit 7de05e88f57a343ac358ddbd6a8b3a5f0aa68a51 +Author: Patrick Schleizer +Date: Sat Nov 1 06:13:37 2025 -0400 + + fix + +commit fe8b7fda3d16195b7a7e7a6218e2bc12d808bcb8 +Author: Patrick Schleizer +Date: Sat Nov 1 06:08:20 2025 -0400 + + chmod +x + +commit ad0053d93797aaba2f242f8e7c142eee064c1bca +Author: Patrick Schleizer +Date: Sat Nov 1 09:41:23 2025 +0000 + + bumped changelog version + +commit 94918eeefbf962dbd66cbb052f2304496b1e2814 +Author: Patrick Schleizer +Date: Sat Nov 1 05:24:31 2025 -0400 + + lintian + +commit 6cc5eebe22d9af3591a0bd32e3ca7e9c0849fc44 +Author: Patrick Schleizer +Date: Sat Nov 1 09:18:12 2025 +0000 + + bumped changelog version + +commit 81a279ee1f23706c2309c02da536b68f00e3eff3 +Author: Patrick Schleizer +Date: Sat Nov 1 05:10:05 2025 -0400 + + genmkfile debinstfile + +commit e24eee361d1f810b2ba23b257903fe2824e7d703 +Author: Patrick Schleizer +Date: Sat Nov 1 04:10:17 2025 -0400 + + remove unicode + +commit 53d380989185b5040f94dbb628e2bae5556ed0e1 +Merge: dcccad92 8b766fc3 +Author: Patrick Schleizer +Date: Sat Nov 1 04:02:46 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit dcccad926679c10355aac53326f8fd1b79c735b7 +Author: Patrick Schleizer +Date: Sat Nov 1 03:58:33 2025 -0400 + + no longer depend on sudo + +commit cfaa953373f3bf8de1b51be723f210069655eb74 +Author: Patrick Schleizer +Date: Sat Nov 1 03:42:33 2025 -0400 + + output + +commit 8b766fc3ad6b0c9675670f38e886beb6b769494b +Author: Aaron Rainbolt +Date: Fri Oct 31 15:23:12 2025 -0500 + + Lock down flatpak software management + +commit 948c96afe93bcc87cea203dd7b45a741d46543d1 +Author: Patrick Schleizer +Date: Fri Oct 31 14:38:30 2025 +0000 + + bumped changelog version + +commit aae472d9cfb2f42a861af8a886c28acd640da545 +Author: Patrick Schleizer +Date: Fri Oct 31 10:24:31 2025 -0400 + + Revert "Move apparmor-info, apparmor-watch to security-misc, enable systemd-journald audit transport" + + This reverts commit d1e148eba72ff5a095e31842a70afec7f28c8724. + +commit 3b2092ee764fe3ab8d72b912f0dcc4726ba76f4e +Merge: b168c37e d1e148eb +Author: Patrick Schleizer +Date: Fri Oct 31 10:19:08 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit d1e148eba72ff5a095e31842a70afec7f28c8724 +Author: Aaron Rainbolt +Date: Thu Oct 30 23:05:19 2025 -0500 + + Move apparmor-info, apparmor-watch to security-misc, enable systemd-journald audit transport + +commit b168c37e841d971743a8f2fe2d64ab4187e4029b +Author: Patrick Schleizer +Date: Mon Oct 27 11:48:10 2025 +0000 + + bumped changelog version + +commit c9d48ef7fdd2b691a7abd880d5e695c6296332b6 +Author: Patrick Schleizer +Date: Mon Oct 27 07:07:25 2025 -0400 + + readme + +commit 2dda826e02a10a9cebabe3896fc4c850221cc423 +Author: Patrick Schleizer +Date: Sun Oct 26 12:30:29 2025 +0000 + + bumped changelog version + +commit cb70f198375c5b68058a3705258e78464786922b +Author: Patrick Schleizer +Date: Sun Oct 26 08:06:26 2025 -0400 + + more robust, standardized kernel_cmdline variable detection + +commit 53db63196432e3fdf8fc031f0e78b4666b0f1514 +Author: Patrick Schleizer +Date: Thu Oct 23 06:03:26 2025 +0000 + + bumped changelog version + +commit f2b33b1ad54ac94aca200c001311e0794634e6f9 +Author: Patrick Schleizer +Date: Thu Oct 23 01:08:38 2025 -0400 + + update + +commit 1f093f817527d168ede3a682651088a051f40cb9 +Author: Patrick Schleizer +Date: Wed Oct 22 00:37:36 2025 -0400 + + do not start usbguard-notifier if /sys/bus/usb does not exist + +commit 8f78269949217ac11163cc8b6f17147621fef6eb +Author: raja-grewal +Date: Mon Oct 20 05:36:54 2025 +0000 + + Add docs on slab_debug + +commit 7969ffd4a52786f4a92f74931fff85430906a629 +Author: Patrick Schleizer +Date: Sun Oct 19 08:43:36 2025 +0000 + + bumped changelog version + +commit f555c48c51dab3eefc99085eace277f15ef72c33 +Author: Patrick Schleizer +Date: Sun Oct 19 04:42:24 2025 -0400 + + fix USBGuard-notifier `accept` / `reject` buttons + + https://forums.kicksecure.com/t/usbguard-what-should-we-allow-or-disallow-by-default/1248/49 + +commit 9f7480e20adf148dcb7dbe80e704f3f79691b657 +Author: raja-grewal +Date: Sun Oct 19 01:41:58 2025 +0000 + + Make terminology consistent + +commit f2c3eba4f06c38fda7843427c352022a0f869f66 +Merge: 11d9b940 929421bd +Author: raja-grewal +Date: Sun Oct 19 12:23:13 2025 +1100 + + Merge branch 'Kicksecure:master' into docs + +commit 929421bd258a3c0c1f142f707aeff479f2ea3c49 +Author: Patrick Schleizer +Date: Sat Oct 18 09:19:07 2025 +0000 + + bumped changelog version + +commit f5b7aab87ec6640eb1969bb4be05bb5b0ff04a3c +Author: Patrick Schleizer +Date: Sat Oct 18 05:18:55 2025 -0400 + + update + +commit 806eec423a7a6acb0d5eabc5872c9a5d121a4dc3 +Merge: 6cc1c27f 70fbbc23 +Author: Patrick Schleizer +Date: Sat Oct 18 04:44:41 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 70fbbc230c0c5366b7a09d531012d18b1e88e07b +Author: Aaron Rainbolt +Date: Fri Oct 17 15:49:42 2025 -0500 + + Set USBGuard settings to permit USB hubs and Qubes USB passthrough + +commit 11d9b9403854ae7cd2638765e8350257580be35f +Author: raja-grewal +Date: Fri Oct 17 01:01:28 2025 +0000 + + Add docs on entropy + +commit 708e1358dfbc21444f2bf39dfa81ea5053f2bb10 +Author: raja-grewal +Date: Fri Oct 17 00:48:57 2025 +0000 + + Add docs relating `extra_latent_entropy` + +commit 3d5e659b78cf2588f95280c13b1ebdf24060fb6f +Author: Aaron Rainbolt +Date: Wed Oct 15 19:02:48 2025 -0500 + + Remove trailing spaces + +commit 29639fe69e12ff71ec422a0137b5dbaade9179c3 +Merge: 026d55ac 0c8f2f1b +Author: Aaron Rainbolt +Date: Wed Oct 15 19:01:08 2025 -0500 + + Merge remote-tracking branch 'raja/bad_ipv6_ra' into arraybolt3/trixie + +commit 026d55ac410bf747db03c0cf9475b3408bce7f8e +Author: Aaron Rainbolt +Date: Wed Oct 15 18:30:52 2025 -0500 + + Typo fixes + +commit 35fce26476b20eda81544f583bd2b2124b8e96b0 +Merge: 4f63af42 23041741 +Author: Aaron Rainbolt +Date: Wed Oct 15 18:18:33 2025 -0500 + + Merge remote-tracking branch 'raja/stop_ptrace' into arraybolt3/trixie + +commit 4f63af4200de23e2216be6d3e7f1055af02dbc3b +Author: Aaron Rainbolt +Date: Wed Oct 15 17:53:26 2025 -0500 + + Allow listing USB devices via usbguard + +commit f690b58870bd90582018cec51046f4ed67a414d4 +Author: raja-grewal +Date: Mon Oct 13 02:08:44 2025 +0000 + + Add docs relating to panic on OOM + +commit 9db63d97770e62749c0b602dd9e7d2d4d6a1128b +Author: raja-grewal +Date: Mon Oct 13 01:01:14 2025 +0000 + + README: Update KSSP compliance status + +commit 23041741715cc5f3d16378d6bb34719ceaa1642c +Author: raja-grewal +Date: Sun Oct 12 02:32:45 2025 +0000 + + Insert empty new line + +commit 7161430a6000c4ff5e15a9a8c9519529655a1444 +Author: raja-grewal +Date: Sun Oct 12 02:27:48 2025 +0000 + + Seperate `ptrace()` disabling into own file + +commit 6cc1c27fb376d02adc6c5cddf64b030e2e694711 +Author: Patrick Schleizer +Date: Fri Oct 10 12:08:28 2025 +0000 + + bumped changelog version + +commit 4d9c3dc357ae92b735cf96f121491f7eed1be9f5 +Author: Patrick Schleizer +Date: Fri Oct 10 08:08:10 2025 -0400 + + minor + +commit 968de33c659f971fc62b2a6a63cceb7462c3d0f8 +Author: Patrick Schleizer +Date: Fri Oct 10 08:03:03 2025 -0400 + + Force immediate kernel panic on OOM. + This is to avoid security features such as the screen locker, kloak, emerg-shutdown + from being arbitrarily terminated when the system starts running out of memory. + + https://forums.whonix.org/t/screen-locker-in-security-can-we-disable-these-at-least-4-backdoors/8128/14 + + https://github.com/Kicksecure/security-misc/issues/324 + + `vm.panic_on_oom=2` + + implements https://github.com/Kicksecure/security-misc/issues/324 + +commit 98f27c3b2e1420f6d29cabe7d0c60a92989d06e1 +Author: Patrick Schleizer +Date: Fri Oct 10 06:53:04 2025 -0400 + + comment + +commit 28a88c70914ac2ce8c4cfc5b9ed558e026a6d7a9 +Author: Patrick Schleizer +Date: Fri Oct 10 06:52:13 2025 -0400 + + comment + +commit f4a87e77488c9034611c750d018603326cb42067 +Merge: 685070bd 6cf8a623 +Author: Patrick Schleizer +Date: Fri Oct 10 06:51:31 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 6cf8a623feda09abc72a19b3e4c74c3f37b64d26 +Merge: 685070bd e89c7ae0 +Author: Patrick Schleizer +Date: Fri Oct 10 06:50:46 2025 -0400 + + Merge pull request #325 from raja-grewal/hash_pointers + + Docs detailing future improvements to `slab_debug` + +commit e89c7ae0254d41ac1696e23f8b2d4a425413d888 +Author: raja-grewal +Date: Wed Oct 8 02:39:20 2025 +0000 + + Update docs on `slab_debug` for future improvements + +commit 685070bd026e52f007e27428e5479e2f1c2413fe +Author: Patrick Schleizer +Date: Tue Oct 7 08:40:32 2025 +0000 + + bumped changelog version + +commit ba6ec919f0804bf8bbfaf057c86a067683cbb826 +Merge: dd961b84 718772ea +Author: Patrick Schleizer +Date: Tue Oct 7 04:34:51 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 718772ea7824cd879d36e5eeff8270457df9ad33 +Author: Aaron Rainbolt +Date: Mon Oct 6 15:03:31 2025 -0500 + + Remove unsafe sanitizer compiler flags from emerg-shutdown + +commit 0c8f2f1b44049b676251775d64e23651e9225d00 +Author: raja-grewal +Date: Thu Oct 2 07:05:00 2025 +0000 + + Add docs about the risks associated with IPv6 RAs + +commit 4340bf50b7bf9112703d78fae4e8ca4f5e458ab6 +Author: raja-grewal +Date: Mon Sep 29 15:46:06 2025 +1000 + + Warnings about using `mitigations=auto,nosmt` + +commit dd961b84272247f4e8f01d3042d8ca256ccf50d2 +Author: Patrick Schleizer +Date: Sun Sep 28 21:09:46 2025 +0000 + + bumped changelog version + +commit e6ba4dad46ba2e451fd586357913b68ad25d6004 +Merge: 22c98634 60f8153f +Author: Patrick Schleizer +Date: Sun Sep 28 17:00:24 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 60f8153f64667718edbf9c048d5fa1d3c2ca1980 +Author: Aaron Rainbolt +Date: Sun Sep 28 15:05:21 2025 -0500 + + Fix emerg-shutdown gcc build, remove AddressSanitizer from hardening options since it is incompatible with static builds + +commit 7e016b563239e31c650aece115bb19af0395ec52 +Author: Aaron Rainbolt +Date: Sun Sep 28 14:11:10 2025 -0500 + + Allow users in the qubes group to access USBGuard IPC + +commit 194b8fce4e5a8e9c642171853d7b0491debced55 +Author: raja-grewal +Date: Sun Sep 28 03:20:24 2025 +0000 + + Disable the usage of `ptrace()` by all processes + +commit 22c9863493b326d8ec730ecdf721593b836baf99 +Author: Patrick Schleizer +Date: Fri Sep 26 08:40:20 2025 +0000 + + bumped changelog version + +commit 08199dfe9471c5bff1af3e5f065810c47cfa7a12 +Merge: 590aaec7 58cc6731 +Author: Patrick Schleizer +Date: Fri Sep 26 04:31:02 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 58cc6731f27446c3bfbd5df1e669b625af922efe +Author: Aaron Rainbolt +Date: Thu Sep 25 23:55:03 2025 -0500 + + Additional hardening on emerg-shutdown + +commit 78492e0e5656990ecec7ad2641d5f7e46a264aab +Author: raja-grewal +Date: Thu Sep 25 15:35:34 2025 +1000 + + README: Do not rely on `mitigations=auto` + +commit b9deefed61b40127bbb7aaad8dd83f256b68f896 +Author: raja-grewal +Date: Thu Sep 25 15:34:54 2025 +1000 + + Incompleteness of `mitigations=auto,nosmt` + +commit 590aaec73d389ecfa2610cbf7931a2e380af3e8d +Author: Patrick Schleizer +Date: Wed Sep 24 14:32:35 2025 +0000 + + bumped changelog version + +commit 253688039447d69eb6eaf2d8d2e1c6ed04e2f839 +Merge: 275eecc4 17ee63ac +Author: Patrick Schleizer +Date: Wed Sep 24 10:32:12 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 17ee63aca445d0e41af05eb9807849fc3c0f62d3 +Merge: 275eecc4 d31f63fb +Author: Patrick Schleizer +Date: Wed Sep 24 10:31:31 2025 -0400 + + Merge pull request #319 from raja-grewal/release_notice + + Notice on public releases + +commit d31f63fb1052adb186c323349aa4e36fb6fc8551 +Author: raja-grewal +Date: Tue Sep 23 05:47:45 2025 +0000 + + README: Notice on public releases + +commit 275eecc4f8100fe62e64a382c0ba5e8503ad0482 +Author: Patrick Schleizer +Date: Mon Sep 22 17:25:48 2025 +0000 + + bumped changelog version + +commit c45a4ffdd221964cee5ee5e5b70a0e4ba02eec11 +Merge: 5738bb61 2a39d599 +Author: Patrick Schleizer +Date: Mon Sep 22 13:04:33 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 2a39d5997c410da2cf314f82826d1281879f8a6c +Author: Aaron Rainbolt +Date: Sun Sep 21 16:06:11 2025 -0500 + + security-misc split string changes + +commit 5738bb61045fb00d570c61cefd4c80fbc31d92e3 +Author: Patrick Schleizer +Date: Fri Sep 19 18:43:36 2025 +0000 + + bumped changelog version + +commit 9acdfc741b1b9da243d22ec6fed84f241c446b79 +Author: Patrick Schleizer +Date: Fri Sep 19 14:42:35 2025 -0400 + + description + +commit 62ea7e50410cb354d13600a26de27eaa3af8e309 +Author: Patrick Schleizer +Date: Fri Sep 19 14:41:05 2025 -0400 + + `security-misc` -> `security-misc-shared` package migration + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 02d0ba49bb187f46dbc5969fa00d26f668446a71 +Author: Patrick Schleizer +Date: Fri Sep 19 18:10:09 2025 +0000 + + bumped changelog version + +commit 0c7bee33a79dcd4c96cf374203418c83e1f7ca51 +Author: Patrick Schleizer +Date: Fri Sep 19 14:01:16 2025 -0400 + + comment + +commit 35830047961e2648add789bd44bd2f61cad0dc9a +Author: Patrick Schleizer +Date: Fri Sep 19 16:18:37 2025 +0000 + + bumped changelog version + +commit 67b1cb319ddcb94232ee385d5e67a9cec33b2567 +Author: Patrick Schleizer +Date: Fri Sep 19 12:05:29 2025 -0400 + + `Replaces: security-misc` + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 4bd08f8c818cc862ffb45cd47b7346f7cf89dd4f +Author: Patrick Schleizer +Date: Fri Sep 19 12:05:03 2025 -0400 + + wrap-and-sort + +commit 068750543aef8a74e7168cc58c667c940560a92a +Author: Patrick Schleizer +Date: Fri Sep 19 11:59:22 2025 -0400 + + update link + +commit ca90feb8d5cfa91e7ba3e13dd66d7df0c8343c58 +Author: Patrick Schleizer +Date: Fri Sep 19 11:54:04 2025 -0400 + + security-misc-server placeholder + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 4eb9ec15e11548bd472977c411fecd2bd1c527c0 +Author: Patrick Schleizer +Date: Fri Sep 19 11:51:14 2025 -0400 + + packaging + + https://github.com/Kicksecure/security-misc/issues/187 + +commit c2594a022e86c79a44e2023e518da3f1294346aa +Author: Patrick Schleizer +Date: Fri Sep 19 11:29:55 2025 -0400 + + rename + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 41ba668d23efb5f052394cfd9ab494e595058c17 +Author: Patrick Schleizer +Date: Fri Sep 19 11:23:10 2025 -0400 + + rename + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 1b194f9fd6de847b3450ea5b9b3cd51a3fbfb81f +Author: Patrick Schleizer +Date: Fri Sep 19 10:59:23 2025 -0400 + + adjust lintian overrides file + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 80562557ef5ac360aea2ea7c7a5c6faf76bdb2f0 +Author: Patrick Schleizer +Date: Fri Sep 19 10:53:25 2025 -0400 + + make install files executable + + https://github.com/Kicksecure/security-misc/issues/187 + +commit c99ea95410ef8fd8fd5d6134a914c344c8eea174 +Author: Patrick Schleizer +Date: Fri Sep 19 10:49:17 2025 -0400 + + genmkfile debinstfile + +commit 13e926207c606b0d009613fd41759d9f683cfea4 +Author: Patrick Schleizer +Date: Fri Sep 19 10:30:42 2025 -0400 + + packaging + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 55a8ec685d87a1327ac73d942370409b38e9ad3a +Author: Patrick Schleizer +Date: Thu Sep 18 10:53:21 2025 -0400 + + packaging split + + https://github.com/Kicksecure/security-misc/issues/187 + +commit b4a7d84bf507600cd181081fa85aaab26a3c7c59 +Author: Patrick Schleizer +Date: Thu Sep 18 10:53:10 2025 -0400 + + genmkfile debinstfile + +commit 43ed739479f0e764bf4ecc485094a926a1a4634e +Author: Patrick Schleizer +Date: Thu Sep 18 10:38:50 2025 -0400 + + genmkfile debinstfile + +commit ea878c351f73185411defa7e3f7980e85e8e91ae +Author: Patrick Schleizer +Date: Thu Sep 18 10:27:48 2025 -0400 + + genmkfile debinstfile + +commit 06c045f70ffc9b3c6a195dc900f3a6a16a39c4b1 +Author: Patrick Schleizer +Date: Thu Sep 18 10:00:33 2025 -0400 + + genmkfile debdistfile + +commit f70550d0150793874f8bf30e8aecb090b60fa8e5 +Author: Patrick Schleizer +Date: Wed Sep 17 14:49:28 2025 -0400 + + Split the `security-misc` into `security-misc-shared`, `security-misc-desktop` and `security-misc-server`: rename files + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 2de10d5b7b7589a6da03a6554b231ab55f7cc83c +Merge: ad367c0b 24424bcb +Author: Patrick Schleizer +Date: Wed Sep 17 13:32:44 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 24424bcbc072bbb7ad9c00371a3a2adc27432532 +Merge: 2d3b4ee1 21c605e2 +Author: Patrick Schleizer +Date: Wed Sep 17 13:31:27 2025 -0400 + + Merge pull request #318 from raja-grewal/vmscape + + Enable `vmscape=force` + +commit 2d3b4ee12425182c88f1bf7ac632f7672b25e00c +Merge: ad367c0b 7b32e933 +Author: Patrick Schleizer +Date: Wed Sep 17 13:27:13 2025 -0400 + + Merge pull request #317 from raja-grewal/srso_docs + + Update SRSO docs + +commit ad367c0bbc230357098d246f0fa88d19dad412a1 +Author: Patrick Schleizer +Date: Sat Sep 13 08:33:02 2025 +0000 + + bumped changelog version + +commit 95eeb579a6af3079b79a954351ab69646ec8ec09 +Merge: d262db2e 90b6486f +Author: Patrick Schleizer +Date: Sat Sep 13 04:04:10 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 21c605e27efaf10b3fd182e102c49135843ad21f +Author: raja-grewal +Date: Sat Sep 13 03:41:59 2025 +0000 + + Enable `vmscape=force` + +commit 90b6486ffe95bf50bbf1fa60964c80853917c3c8 +Author: Aaron Rainbolt +Date: Fri Sep 12 18:08:00 2025 -0500 + + Allow users in the sudo group to use usbguard-notifier + +commit 7b32e9339e1da769df38ff9afb849a975b1c1668 +Author: raja-grewal +Date: Fri Sep 12 23:10:34 2025 +1000 + + Update SRSO docs + +commit d262db2e6cc88cd58d73f5b53481ac43fa1ebee7 +Author: Patrick Schleizer +Date: Tue Sep 2 15:25:49 2025 +0000 + + bumped changelog version + +commit 75306a3f96038038958aa7e7adee3952e692ad91 +Author: Patrick Schleizer +Date: Sat Aug 30 14:19:31 2025 +0000 + + bumped changelog version + +commit ac6bc65e3c77f4bcbada69525e8cb1d4c273da8a +Merge: 78b66ba1 2319bd91 +Author: Patrick Schleizer +Date: Sat Aug 30 08:01:26 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 2319bd91648f30b85b49aed2ce7ee7864582495d +Author: Aaron Rainbolt +Date: Thu Aug 28 17:34:41 2025 -0500 + + Allow USB devices that are connected at USBGuard start time + +commit 85fd8ea52b6614cb416514e1c541c46da708f502 +Author: Aaron Rainbolt +Date: Thu Aug 28 16:42:16 2025 -0500 + + Enable USB video and audio devices, reject USB RNDIS devices + +commit b95598b6f7536da08026af37ab3c9fb2ba2f2bb3 +Author: Aaron Rainbolt +Date: Thu Aug 28 16:18:14 2025 -0500 + + Disable RNDIS due to unfixable security issues + +commit 78b66ba159d41dc0559a09c038002c702aaa43c2 +Author: Patrick Schleizer +Date: Wed Aug 27 19:31:06 2025 +0000 + + bumped changelog version + +commit 28d695fd2ddbf91b43dcbf8087c3a852f5ab86a9 +Author: Patrick Schleizer +Date: Wed Aug 27 04:29:48 2025 -0400 + + fix + +commit 0a61107b5adf053db71cad63c40b1c8362e9162b +Merge: ef458ce0 94ebb5c8 +Author: Patrick Schleizer +Date: Wed Aug 27 04:28:25 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 94ebb5c84ca278a840e2158a5d4207fbfed90a22 +Merge: 893faa98 ef458ce0 +Author: Aaron Rainbolt +Date: Tue Aug 26 19:20:41 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit ef458ce0d338009387999789259a3e644861b9d3 +Author: Patrick Schleizer +Date: Tue Aug 26 09:16:15 2025 +0000 + + bumped changelog version + +commit 893faa98223cee2f6c90f0224c94724e32f6e014 +Author: Aaron Rainbolt +Date: Fri Aug 22 19:48:47 2025 -0500 + + Remove initramfs-tools support + +commit cd44a7e1369cd798b06595fdb118e0c7bea52194 +Author: Aaron Rainbolt +Date: Fri Aug 22 16:00:25 2025 -0500 + + Disable memlockd service by default, fix systemd path + +commit 28f44d2e1d54da990cf203d2965431bc12a5d008 +Author: Aaron Rainbolt +Date: Fri Aug 22 15:50:28 2025 -0500 + + Disable emerg-shutdown and ensure-shutdown on Qubes OS + +commit 53e930b4cc30a8857348758ab65d1a5687ed94a1 +Merge: df8a323d 5898a645 +Author: Aaron Rainbolt +Date: Thu Aug 21 20:09:48 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit df8a323d03747858b55d905465c1f9415bbb8022 +Author: Aaron Rainbolt +Date: Thu Aug 21 18:39:28 2025 -0500 + + Fix XDG handling, replace Xfce with LXQt where appropriate, make USBGuard configuration work + +commit 5898a6457a99ab0036b3e62ded09eeb9cdd9522a +Author: Patrick Schleizer +Date: Thu Aug 21 06:45:04 2025 -0400 + + typo + +commit f713dceff42c6c79a5718ba69358d2fe66ad3245 +Merge: f6f4fd77 8cdbbf82 +Author: Patrick Schleizer +Date: Thu Aug 21 06:44:35 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 8cdbbf8292c354224e2d22fad9087d9f542687e2 +Merge: 2baf5cfc e48897cc +Author: Patrick Schleizer +Date: Thu Aug 21 06:43:07 2025 -0400 + + Merge pull request #313 from raja-grewal/panic_limits + + Upgrade `sysctl` settings and docs on kernel panics + +commit 2baf5cfc0bf061b2cc772dfceadaef84a36d9c1e +Merge: f6f4fd77 45fcd163 +Author: Patrick Schleizer +Date: Thu Aug 21 06:42:28 2025 -0400 + + Merge pull request #314 from raja-grewal/trixie_docs + + Update documentation + +commit f6f4fd77e5bd3a7a7d00c33543fc4ce5a685a3d1 +Merge: 81d437fe 7f211209 +Author: Patrick Schleizer +Date: Thu Aug 21 06:40:39 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 7f211209f7942a332e0568a60eba8a78f3a8a15b +Merge: 81d437fe 19b7e4b4 +Author: Patrick Schleizer +Date: Thu Aug 21 06:40:11 2025 -0400 + + Merge pull request #311 from nrz-21/master + + Set soft limit for core dumps to 0 + +commit 19b7e4b4d0b625b8505de122e790a14de63fafdf +Author: Patrick Schleizer +Date: Thu Aug 21 06:39:56 2025 -0400 + + newline + +commit 3229dd8967d15edc6066ab6148df4738774f36b0 +Merge: 8dcd3493 81d437fe +Author: Patrick Schleizer +Date: Thu Aug 21 06:39:13 2025 -0400 + + Merge branch 'master' into master + +commit 81d437fe3efca99b0d1a29b2a1a3e486e91716c1 +Author: Patrick Schleizer +Date: Wed Aug 20 21:40:39 2025 -0400 + + fix + +commit e48897cc44eef10779a28bdadc7e7bbfe007064a +Merge: add05493 c2d5bf38 +Author: raja-grewal +Date: Thu Aug 21 10:27:44 2025 +1000 + + Merge branch 'master' into panic_limits + +commit add054933b69e97e0f856d7cf04d88290d4b1b7c +Author: raja-grewal +Date: Thu Aug 21 00:24:28 2025 +0000 + + Update docs on instant reboot when kernel panic + +commit c2d5bf38f539703c4858818f29d73b21d5776c80 +Author: Patrick Schleizer +Date: Wed Aug 20 10:44:10 2025 -0400 + + comment + +commit 812f05f847de0f1cb5586ccfd4c5b684d507dd46 +Author: Patrick Schleizer +Date: Wed Aug 20 10:11:49 2025 -0400 + + comments + +commit 2b876c74a3ed9ec91954c8d4f776dc803d212fd0 +Author: Patrick Schleizer +Date: Wed Aug 20 10:09:10 2025 -0400 + + readme + +commit 0e4664daa0267fe62888a9559db2b14d5e1ae8ea +Author: Patrick Schleizer +Date: Wed Aug 20 10:07:58 2025 -0400 + + cleanup + +commit 31fd316e72a87323f83e7e63d6a3440bf77cb350 +Author: Patrick Schleizer +Date: Wed Aug 20 09:48:20 2025 -0400 + + comments + +commit 5d67277c9f27a54d373e683a1d4e1ddf8c16ac25 +Author: Patrick Schleizer +Date: Wed Aug 20 09:46:43 2025 -0400 + + comments + +commit f77c71dd15b38db6f1c33602dd0c5623e501c3eb +Merge: e15bdd2d 37c0bc0c +Author: Patrick Schleizer +Date: Wed Aug 20 09:44:37 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit e15bdd2de513fbdcdb3b0fed4c1c1c5f74652291 +Author: Patrick Schleizer +Date: Wed Aug 20 06:57:29 2025 -0400 + + bumped Standards-Version + +commit 312586307b2999d46e4673079fb1538f76ff329e +Author: Patrick Schleizer +Date: Wed Aug 20 06:25:35 2025 -0400 + + readme + +commit a4710693783b8817a6a5c9f17b4268b654c4c0c9 +Author: raja-grewal +Date: Tue Aug 19 11:03:05 2025 +1000 + + Remove link + +commit c0ad57779342c138ade0d6ddff0898f75411157a +Author: raja-grewal +Date: Tue Aug 19 11:01:06 2025 +1000 + + Update docs on oops boot parameter + +commit 45fcd163d1422b43ec033166c889a237301ad83d +Author: raja-grewal +Date: Mon Aug 18 20:23:50 2025 +1000 + + Add reference on conntrack helpers + +commit 37c0bc0c5ddfb901d016f8a4edae16840a58f1fa +Merge: b5a36e02 f175d196 +Author: Aaron Rainbolt +Date: Sun Aug 17 14:02:01 2025 -0500 + + Merge remote-tracking branch 'raja/block_32bit' into arraybolt3/trixie + +commit b5a36e02f1be901da1695056877471398deedf1e +Merge: 210aa976 6df3e3cd +Author: Aaron Rainbolt +Date: Sun Aug 17 13:52:01 2025 -0500 + + Merge remote-tracking branch 'raja/panic_limits' into arraybolt3/trixie + +commit 210aa97650b760acb207f29b1e99e1bb2e65e168 +Merge: 7a8dfa52 3de9cd56 +Author: Aaron Rainbolt +Date: Sun Aug 17 13:50:25 2025 -0500 + + Merge remote-tracking branch 'raja/trixie_docs' into arraybolt3/trixie + +commit f175d1961e4e028539f5a90c0db1fcd1f760cdba +Author: raja-grewal +Date: Sun Aug 17 07:08:08 2025 +0000 + + Enable `ia32_emulation=0` + +commit 3de9cd5646ad45fe745711b83f79f4d469fc8473 +Author: raja-grewal +Date: Sun Aug 17 07:06:55 2025 +0000 + + Remove whitespace + +commit e06b78a52225db02415aeafb833160c9ea0280d9 +Author: raja-grewal +Date: Sun Aug 17 07:05:32 2025 +0000 + + Temporarily revert IA32 doc updates + +commit 6df3e3cde8053d6b2771f510457da774336546bf +Author: raja-grewal +Date: Sun Aug 17 06:32:11 2025 +0000 + + Update kernel panic service description + +commit 247015bcc6e924e24874d16ed7ad78165ace58a3 +Author: raja-grewal +Date: Sun Aug 17 06:27:44 2025 +0000 + + Set `sysctl kernel.panic=-1` + +commit 7a8dfa528c629aa0023943dcd34025ef56a1b1e1 +Merge: cba16879 1f75426f +Author: Aaron Rainbolt +Date: Sat Aug 16 21:10:19 2025 -0500 + + Merge remote-tracking branch 'raja/trixie_docs' into arraybolt3/trixie + +commit 8dcd3493f851f78933f9dbf6d4e9f04f741bed5a +Author: nexus$ +Date: Sat Aug 16 09:39:42 2025 +0000 + + Update 30_security-misc.conf + +commit f1de0da69b46f91ea7fd34db601393d23599b3bb +Author: raja-grewal +Date: Sat Aug 16 04:01:12 2025 +0000 + + Clarify description on panics on oopses and warns + +commit c33f7d04e2cef477b675fbf6c2a91583ba3bf808 +Author: raja-grewal +Date: Sat Aug 16 03:32:48 2025 +0000 + + Remove duplicate comment + +commit 1f75426f079d6e0aecd8fac22088ad36a7c16398 +Author: raja-grewal +Date: Sat Aug 16 02:20:00 2025 +0000 + + Clarify docs for disabling 32-bit x86 support + +commit cba16879eff9d3d998c127e41c38d2067cdf04cc +Author: Aaron Rainbolt +Date: Fri Aug 15 17:16:42 2025 -0500 + + Polish USBGuard configuration + +commit b4086b8e779366127c22eb0a43d1b77fe534ef0e +Merge: 66ec5bda 4cae74d6 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:57:34 2025 -0500 + + Merge remote-tracking branch 'monsieuremre/patch-3' into arraybolt3/trixie + +commit 66ec5bda5872bbf51eb480836d3ffb3bb2f934cf +Author: Aaron Rainbolt +Date: Fri Aug 15 16:51:07 2025 -0500 + + Remove obsolete Thunderbird configuration hardening + +commit 94668b2e93c37a3879968f455575c631f9f8bcac +Author: Aaron Rainbolt +Date: Fri Aug 15 16:46:35 2025 -0500 + + Set hard and soft limits on core file size at the same time + +commit e2c65a2a6fcb246cb5925394f00ec2d8401c2dda +Merge: 65afc31b 28ce7064 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:45:18 2025 -0500 + + Merge remote-tracking branch 'nrz/master' into arraybolt3/trixie + +commit 65afc31ba7f8c5ee6dc14627de82a122b4992d21 +Merge: a2a9e844 00c660d4 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:31:50 2025 -0500 + + Merge branch 'kcfi' into arraybolt3/trixie + +commit a2a9e8440b812b07546722f5842e3ddb16ee5bc2 +Merge: c33ea7be 4166d6d1 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:06:35 2025 -0500 + + Merge branch 'trixie_docs' into arraybolt3/trixie + +commit 00c660d40dce06d979fc7b9dbf7a6e952a9e51cc +Author: raja-grewal +Date: Fri Aug 15 11:29:27 2025 +1000 + + Typo + +commit fce86dccb67db0a37601899bf3115bd9f4fa714a +Author: raja-grewal +Date: Wed Aug 13 10:44:40 2025 +1000 + + Typo + +commit c33ea7be6d2a82462042cf482a32bf259bf51bd5 +Author: Aaron Rainbolt +Date: Sun Aug 10 15:23:48 2025 -0500 + + Move security-misc/apt-get-update* to helper-scripts + +commit 51d5ba29df44d021cfeab1dea6f00919d246388e +Merge: 7aa38245 c7bdca32 +Author: Aaron Rainbolt +Date: Sun Aug 10 14:09:41 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit c7bdca32c05ddc70b785a28ebe5be13614407dc8 +Author: Patrick Schleizer +Date: Sun Aug 10 06:34:30 2025 +0000 + + bumped changelog version + +commit 3629f2c3a59d44e265f0c66389435de1b2414998 +Merge: 5dc251c5 c59a3b23 +Author: Patrick Schleizer +Date: Sun Aug 10 02:25:48 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 7aa38245dedab28cce4c96fd9f533a60c9d05ac4 +Merge: 4930703b c59a3b23 +Author: Aaron Rainbolt +Date: Sat Aug 9 23:31:55 2025 -0500 + + Merge branch 'arraybolt3/emerg-shutdown' into arraybolt3/trixie + +commit c59a3b233bd8893d466c020a2e2695ab545c6e60 +Author: Aaron Rainbolt +Date: Sat Aug 9 21:55:03 2025 -0500 + + Fix unexpected shutdowns when booting Kicksecure from optical media + +commit 4930703b8c90766304122e6e74ccd29e87800714 +Merge: 2ada07cf 5dc251c5 +Author: Aaron Rainbolt +Date: Sat Aug 9 21:30:45 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit 5dc251c5da724092d264481740e4f6ed347aa0a7 +Author: Patrick Schleizer +Date: Sat Aug 9 09:45:35 2025 +0000 + + bumped changelog version + +commit 046c932898290d250a7900e3c59973a698e5c55f +Author: Patrick Schleizer +Date: Sat Aug 9 05:40:11 2025 -0400 + + `disable emerg-shutdown.service`: + + Disabled due to bug: breaks ISO Live Mode Calamares installer + +commit 2ada07cf66727ea66283c55c0ba078489b3db94e +Author: Aaron Rainbolt +Date: Thu Aug 7 22:23:03 2025 -0500 + + Add SSH hardening config + +commit 0cc0a8310020afc10de6512095336e55559a84d9 +Author: Patrick Schleizer +Date: Thu Aug 7 07:08:19 2025 +0000 + + bumped changelog version + +commit 505a2b7d7995ad48a17add86513ced3499f64ee9 +Merge: 42941653 3a77abe5 +Author: Patrick Schleizer +Date: Thu Aug 7 03:08:02 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 5f2425ba6f747bf65b5beb4336d1e7bf6b8cdf71 +Merge: 86f44063 3a77abe5 +Author: Aaron Rainbolt +Date: Wed Aug 6 20:21:01 2025 -0500 + + Merge branch 'arraybolt3/emerg-shutdown' into arraybolt3/trixie + +commit 3a77abe5c9807caec530e69c41d5cf803b625e70 +Author: Aaron Rainbolt +Date: Wed Aug 6 20:05:57 2025 -0500 + + Port hardening options from kloak to emerg-shutdown, fix new compiler warnings + +commit 0c1af00aae50dba2983c3736744e0da320bb9330 +Author: Aaron Rainbolt +Date: Wed Aug 6 19:33:38 2025 -0500 + + Implement paranoid mode in emerg-shutdown + +commit 29480df770047c8ada3e993cf28f87ffbfd71dec +Author: Aaron Rainbolt +Date: Wed Aug 6 19:24:34 2025 -0500 + + Improve emerg-shutdown usage documentation + +commit 2a3bc39eba317d5f9b0e710dd3663c82d92add94 +Author: Aaron Rainbolt +Date: Wed Aug 6 19:10:37 2025 -0500 + + Use Ctrl+Alt+End as the default panic key rather than Ctrl+Alt+Delete + +commit 44e7d3059a5618991a1408f77707132bfea86fef +Author: Aaron Rainbolt +Date: Wed Aug 6 19:10:14 2025 -0500 + + Integrate emerg-shutdown into the initramfs + +commit 42941653621311187650f12e8d7aa39c45cb6984 +Author: Patrick Schleizer +Date: Wed Aug 6 08:27:15 2025 +0000 + + bumped changelog version + +commit 784ff8af3616765a9c22febf66b522376ecedf12 +Merge: c2690efc 5a17e67c +Author: Patrick Schleizer +Date: Wed Aug 6 04:26:37 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 4166d6d1e60d564be4c3fb2ad530e7a180638e6a +Author: raja-grewal +Date: Wed Aug 6 15:53:49 2025 +1000 + + Update docs on recovery restrictions + +commit 86f44063eb753fe1bbdd754ce104670d26aed6ca +Author: Aaron Rainbolt +Date: Tue Aug 5 22:58:06 2025 -0500 + + Port to Trixie. + +commit 498551536c71f1c1ac33f3c1992e18c9277e6618 +Author: raja-grewal +Date: Wed Aug 6 03:12:06 2025 +0000 + + Update docs + +commit 45d20dd972e6501237d35d1605c81d4e3fde43b1 +Author: raja-grewal +Date: Wed Aug 6 02:35:15 2025 +0000 + + Upgrade sysctls and docs on kernel panics + +commit 1f7525722e7027b5c3379460eee5f62669631dee +Author: raja-grewal +Date: Wed Aug 6 01:48:47 2025 +0000 + + Enable `cfi=kcfi` + +commit 5a17e67c0a7678300f6342d5c90ded5494ebc838 +Author: Aaron Rainbolt +Date: Tue Aug 5 20:14:07 2025 -0500 + + Fix local-fs.target dependency in emerg-shutdown.service + +commit c2690efcacbf7be7c57751ba1cee7f910d350cfc +Author: Patrick Schleizer +Date: Mon Aug 4 09:27:11 2025 +0000 + + bumped changelog version + +commit 166bc257b0b2eea87d684cc847bf6da1fba7c4b4 +Merge: d1bca020 63f29093 +Author: Patrick Schleizer +Date: Mon Aug 4 05:26:55 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 63f29093416a5f21ae14b398cf805c864b5541d7 +Author: Aaron Rainbolt +Date: Sun Aug 3 15:00:14 2025 -0500 + + Fix emerg-shutdown and ensure-shutdown libexec scripts, start emerg-shutdown and ensure-shutdown earlier + +commit d1bca0204fa1dac9ec3fb6e9b121af9526778181 +Author: Patrick Schleizer +Date: Sun Aug 3 11:33:03 2025 +0000 + + bumped changelog version + +commit 92bcd824e4af8a90a18a7726d4a5715c0b20e2ca +Author: Patrick Schleizer +Date: Sun Aug 3 07:17:25 2025 -0400 + + also parse /usr/local/etc + +commit 4da810c8fa4fd40b8701e7dfe217125d965ee03e +Author: Patrick Schleizer +Date: Sun Aug 3 07:16:00 2025 -0400 + + comment + +commit b9416fa77a1e8850c5f579314875671799a55c60 +Author: Patrick Schleizer +Date: Sun Aug 3 07:15:41 2025 -0400 + + validate configuration file + +commit 4ba029471e8c12d5691f7ee94897137fb3cbe15f +Merge: c1e76aa5 1a60da71 +Author: Patrick Schleizer +Date: Sun Aug 3 07:04:20 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 28ce70644147f637e91bd4941bcbc139d875e5e7 +Author: nexus$ +Date: Fri Aug 1 15:03:26 2025 +0000 + + Set soft limit for core dumps to 0 + +commit 1a60da71eddfcc6fb72a34596c770cd754146887 +Author: Aaron Rainbolt +Date: Tue Jul 29 21:16:51 2025 -0500 + + emerg-shutdown: Add shutdown timeout for preventing stuck shutdowns, briefly document feature set and usage + +commit e42078e90d7d7e5339a7c4682eb93c844fd38580 +Author: Aaron Rainbolt +Date: Mon Jul 28 20:42:14 2025 -0500 + + emerg-shutdown: fix the hang-on-shutdown bug, add autodetection of new keyboards, shutdown key configuration, and instant shutdown option + +commit a1d1c5603300106f06c1a798088521b77430ff95 +Merge: 5889d134 c1e76aa5 +Author: Aaron Rainbolt +Date: Sun Jul 27 21:43:43 2025 -0500 + + Merge branch 'master' into arraybolt3/emerg-shutdown + +commit c1e76aa52cd28f38c1ab6550e0f4de0010a9ea14 +Author: Patrick Schleizer +Date: Mon Jul 21 10:00:25 2025 +0000 + + bumped changelog version + +commit 36114e29a2ce1045b5f5d82372fcf0463efc5ca7 +Merge: e3ce9c38 f851886f +Author: Patrick Schleizer +Date: Mon Jul 21 06:00:11 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit f851886ffd0fc82ba0b0add501964d1c812c6c15 +Merge: e3ce9c38 6f9763f5 +Author: Patrick Schleizer +Date: Mon Jul 21 05:58:44 2025 -0400 + + Merge pull request #310 from raja-grewal/its + + Enable `indirect_target_selection=force` + +commit 5889d134a23b3d4f8db5d81171ea12907bb10d4d +Author: Aaron Rainbolt +Date: Sun Jul 20 14:14:09 2025 -0500 + + emerg-shutdow: Improve recvmsg handling, call reboot syscall directly + +commit 6f9763f525097b8f8ad5f9864c1694a2642e1bd6 +Author: raja-grewal +Date: Sat Jul 19 05:19:27 2025 +0000 + + Enable `indirect_target_selection=force` + +commit b745c8ddae74d5e1684919442fa74d64e95263b8 +Author: Aaron Rainbolt +Date: Mon Jul 14 21:51:52 2025 -0500 + + emerg-shutdown: Enable actual shutdown code, fix infinite loop when started too early + +commit e387086de4b6e6b90b23d4c32ddf8a566beb858c +Author: Aaron Rainbolt +Date: Mon Jul 14 21:05:16 2025 -0500 + + Allow specifying alternative keys in panic key combo, fix optical disk eject handling + +commit dfb6f143f0324d0903ae2dd106bc0fb6907c1cb0 +Author: Aaron Rainbolt +Date: Sun Jul 13 20:53:29 2025 -0500 + + Add panic key handling to emergency shutdown utility + +commit 2a7071055f94f984398fe2ec49c32b206913bea2 +Merge: f3d46ee5 e3ce9c38 +Author: Aaron Rainbolt +Date: Sun Jul 13 15:21:34 2025 -0500 + + Merge branch 'master' into arraybolt3/emerg-shutdown + +commit e3ce9c38c5b241f789945de7229c0ee15fa0a266 +Author: Patrick Schleizer +Date: Wed Jul 2 20:52:17 2025 +0000 + + bumped changelog version + +commit b06fb5428051518390439ce95c9d6894e6338951 +Merge: 115b6f6a 468cf40e +Author: Patrick Schleizer +Date: Wed Jul 2 13:47:12 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 468cf40e2a216625d02066b609b0991e37c50ebc +Merge: 865a052b bb208fb1 +Author: Patrick Schleizer +Date: Wed Jul 2 13:45:28 2025 -0400 + + Merge pull request #306 from raja-grewal/erst + + Set `erst_disable` + +commit 865a052bf47f28c0084b2bbd51e3c606df9eda96 +Merge: 115b6f6a e3c45191 +Author: Patrick Schleizer +Date: Wed Jul 2 13:44:17 2025 -0400 + + Merge pull request #309 from RebornRider/patch-1 + + remove TemporaryTimeout=0 in Bluetooth config + +commit bb208fb134fe25fc3539494f331072a851369064 +Merge: 4314b1e8 115b6f6a +Author: raja-grewal +Date: Wed Jul 2 11:35:50 2025 +1000 + + Merge branch 'Kicksecure:master' into erst + +commit 4314b1e85bd5495832b4398bdbd358c41703dcc9 +Author: raja-grewal +Date: Tue Jul 1 13:36:39 2025 +1000 + + Add comment + +commit e3c451917931aa4e63056fb03470c203694d399f +Author: Kevin Agwaze <7119346+RebornRider@users.noreply.github.com> +Date: Mon Jun 16 10:35:16 2025 +0100 + + remove misleading TemporaryTimeout=0 in Bluetooth config + +commit 115b6f6aa2a4d00ad5690c2c0889e142540c01ca +Author: Patrick Schleizer +Date: Sat Jun 14 11:51:44 2025 +0000 + + bumped changelog version + +commit 4639d1aab572bb4ad751bd1da5b936b9d73d3264 +Merge: 5159de63 109c0134 +Author: Patrick Schleizer +Date: Fri Jun 13 15:09:52 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/approx' + +commit 109c0134677d991c449aa009773cb22babeee8db +Author: Aaron Rainbolt +Date: Thu Jun 12 01:08:34 2025 -0500 + + Add comment related to approx package caching proxy + +commit 72613203b9692d1098b13ff98119499a5a30a6da +Author: raja-grewal +Date: Fri Jun 6 13:07:52 2025 +0000 + + Add reference + +commit dd0b55cc45f9ccd64d0075ba37ab6a4723d94a02 +Author: raja-grewal +Date: Tue Jun 3 12:32:17 2025 +1000 + + Add reference + +commit 5159de63438e8c1274658e7175a80fb693d6554a +Author: Patrick Schleizer +Date: Wed May 28 13:48:11 2025 +0000 + + bumped changelog version + +commit 3e102df76583a14b5efc18238aefbf539ab0d8a1 +Author: Patrick Schleizer +Date: Wed May 28 08:37:03 2025 -0400 + + fix + +commit d5edc243ac2db861f1600d3906a02494eaf9a824 +Author: Patrick Schleizer +Date: Wed May 28 12:12:00 2025 +0000 + + bumped changelog version + +commit eda1d0aef640af1ea73c72d6caa876733de4e5a0 +Merge: e9667748 5a10ad03 +Author: Patrick Schleizer +Date: Wed May 28 07:22:16 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 5a10ad031d67acc8fa4c16f9e2db191bde559caa +Merge: e9667748 3559bc86 +Author: Patrick Schleizer +Date: Wed May 28 07:21:31 2025 -0400 + + Merge pull request #307 from maybebyte/ssh-agent-to-allowlist + + fix(permission-hardener): ssh-agent gets 2755 perms + +commit 3559bc86b7aed8122ff7996ce0ab4a65bdaf05c0 +Author: Ashlen +Date: Tue May 27 15:32:41 2025 -0600 + + fix(permission-hardener): ssh-agent gets 2755 perms + + Change from exactwhitelist to matchwhitelist. Discussion revealed that + there's a good reason to leave setgid in here, which is essentially + defense-in-depth (sometimes users may want to revert Kicksecure's + default of kernel.yama.ptrace_scope=2, e.g. to debug a program, and + Kicksecure should not be less secure than vanilla Debian in that + situation). + +commit c59b2e4bc53cad4c9cc90ddd5abaca0705ccff90 +Merge: 017ee29e e9667748 +Author: maybebyte <99762926+maybebyte@users.noreply.github.com> +Date: Tue May 27 20:33:07 2025 +0000 + + Merge branch 'Kicksecure:master' into ssh-agent-to-allowlist + +commit e96677486201ebddc145af7962ad5e89f6fa253b +Author: Patrick Schleizer +Date: Tue May 27 19:41:25 2025 +0000 + + bumped changelog version + +commit 017ee29eb39d84edc89f128a633a619cad852241 +Merge: 7a079c3d abb22073 +Author: maybebyte <99762926+maybebyte@users.noreply.github.com> +Date: Tue May 27 18:25:47 2025 +0000 + + Merge branch 'Kicksecure:master' into ssh-agent-to-allowlist + +commit 5195977be474e29a29b6392306e909e9f2d05ada +Author: Patrick Schleizer +Date: Tue May 27 11:57:21 2025 -0400 + + protect against grep pipefail + +commit abb2207313810966dad381c3a9f637c445a5834d +Author: Patrick Schleizer +Date: Tue May 27 15:51:50 2025 +0000 + + bumped changelog version + +commit 45016146f7c77d383f2254d19dc66ba9b883b8f2 +Merge: ace45d7c 395169fb +Author: Patrick Schleizer +Date: Tue May 27 11:03:23 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 395169fbce1854bfed727d1784f4e5c0d8e7c6ff +Merge: ace45d7c e14b81b1 +Author: Patrick Schleizer +Date: Tue May 27 10:58:50 2025 -0400 + + Merge pull request #308 from maybebyte/permission-hardener-speedboost + + perf(permission-hardener): optimize string match + +commit 1c353032046f556bb11c32506019310c9f6d47c0 +Merge: 35fa32e4 ace45d7c +Author: raja-grewal +Date: Fri May 23 20:20:19 2025 +1000 + + Merge branch 'Kicksecure:master' into erst + +commit ace45d7c95ed6b83c1897f76da5af4a0c97cab10 +Author: Patrick Schleizer +Date: Wed May 21 22:06:02 2025 +0000 + + bumped changelog version + +commit 142ea2118989faddafa17db48efed379c4ac3f45 +Author: Patrick Schleizer +Date: Wed May 21 12:42:16 2025 -0400 + + fix + +commit a969fa350e28ca296966509821a7c62b68f09a5a +Author: Patrick Schleizer +Date: Wed May 21 12:40:27 2025 -0400 + + fix + +commit f023651c984c52a997bc241f99f118255cf60809 +Author: Patrick Schleizer +Date: Wed May 21 12:35:37 2025 -0400 + + nounset + +commit f086787464191a07e028dd92649c48b145023858 +Author: Patrick Schleizer +Date: Wed May 21 12:35:23 2025 -0400 + + fix + +commit d7643954d184846c8b7fb5eda7200779126274eb +Author: Patrick Schleizer +Date: Wed May 21 12:33:50 2025 -0400 + + minor + +commit aa905fc8875c5c56351f10f4e40e6d2a7dd6d918 +Author: Patrick Schleizer +Date: Wed May 21 12:32:16 2025 -0400 + + further validation of output of `faillock` + +commit 92d3a36a0f43615db622c6b0daa7064b8e8ebbbb +Author: Patrick Schleizer +Date: Wed May 21 12:29:01 2025 -0400 + + fix + +commit 2c1abb23e03cfe449347ba692d35f5ba1f33cff4 +Author: Patrick Schleizer +Date: Wed May 21 12:26:46 2025 -0400 + + output + +commit 0801b96ae74256f36dcf8757d0ba8abc66ea0b9b +Author: Patrick Schleizer +Date: Wed May 21 12:25:49 2025 -0400 + + output + +commit ef8515ba82996b137c386eeb91e6f853d58a515f +Author: Patrick Schleizer +Date: Wed May 21 12:23:45 2025 -0400 + + improve error handling + +commit 784867e24b4d6f2899fa9b215ec9e3c4e2fb9d84 +Author: Patrick Schleizer +Date: Wed May 21 12:21:45 2025 -0400 + + fix + +commit 0eea681ce893a259563f8e9d5a2ec9722fbc635d +Author: Patrick Schleizer +Date: Wed May 21 15:52:16 2025 +0000 + + bumped changelog version + +commit e1bae1c68aabc424924b6386fe4980d657dc2cdf +Author: Patrick Schleizer +Date: Wed May 21 11:50:59 2025 -0400 + + fix + +commit bd01a683054b1f7d5a5f6cc4848da73b1b1ef5ff +Author: Patrick Schleizer +Date: Wed May 21 13:58:18 2025 +0000 + + bumped changelog version + +commit 14cf205579ff65fa765d7574e5d0e301a30a1904 +Author: Patrick Schleizer +Date: Wed May 21 08:36:16 2025 -0400 + + fix + +commit ff6bc5d5b6097bcdddd8e66c2541106c2cbabbaf +Author: Patrick Schleizer +Date: Wed May 21 11:23:39 2025 +0000 + + bumped changelog version + +commit 353b6e83c55d52b47a2a35063406324cec7237c4 +Author: Patrick Schleizer +Date: Wed May 21 07:20:13 2025 -0400 + + test that `wc` is functional + + https://github.com/Kicksecure/security-misc/pull/305#issuecomment-2892378246 + +commit 5930e270521e0e5d6a0a3877c813accbf5253051 +Author: Patrick Schleizer +Date: Wed May 21 07:05:25 2025 -0400 + + pam-info: improve error handling + + https://github.com/Kicksecure/security-misc/pull/305#issuecomment-2892378246 + +commit 5c981e0891ef009c5c2355f5f6383aca22c45638 +Author: Patrick Schleizer +Date: Wed May 21 06:55:09 2025 -0400 + + pam-info: fix, consistently write errors and warnings to stderr + +commit e14b81b15e479afbc4820a2b9bb60f3cf65bfb12 +Author: Ashlen +Date: Tue May 20 21:34:03 2025 -0600 + + perf(permission-hardener): optimize string match + + Replace subprocess grep calls with bash substring matching in + check_nosuid_whitelist function. This eliminates ~10k unneeded + subprocess spawns that were causing significant performance + degradation. + + In testing, it improves overall script execution speed by an + order of magnitude: + + Before patch: + $ sudo hyperfine -- './permission-hardener enable' + Benchmark 1: ./permission-hardener enable + Time (mean _ _): 11.906 s _ 0.974 s [User: 3.639 s, System: 8.728 s] + Range (min _ max): 10.430 s _ 14.090 s 10 runs + + After patch: + $ sudo hyperfine -- './permission-hardener enable' + Benchmark 1: ./permission-hardener enable + Time (mean _ _): 802.8 ms _ 178.5 ms [User: 283.0 ms, System: 471.9 ms] + Range (min _ max): 639.4 ms _ 1092.3 ms 10 runs + +commit 7a079c3de8bd8b4e026a1bd1b932a04610a1e386 +Author: Ashlen +Date: Tue May 20 18:41:48 2025 -0600 + + fix(permission-hardener): add exactwhitelist here + + Without this, the permissions for ssh-agent won't be changed properly. + +commit 94dc9da4ab8fb93760dbb3b325bdeaa155e492cb +Author: Ashlen +Date: Tue May 20 17:07:51 2025 -0600 + + fix(permission-hardener): ssh-agent gets 755 perms + + Replace the commented-out matchwhitelist entry for ssh-agent with an + explicit permission entry (755) for /usr/bin/ssh-agent. + + When ssh-agent's matchwhitelist entry was commented out in commit + 7a5f8b87af, permission-hardener began resetting it to restrictive + defaults (744), preventing non-root users from executing ssh-agent. This + broke split SSH functionality in Qubes OS for me because I was using + Kicksecure in the vault qube, and ssh-agent runs under a non-root user in + that configuration (see https://forum.qubes-os.org/t/split-ssh/19060). + + As noted in the comment, Debian installs with 2755 permissions as a way + to mitigate ptrace attacks, but this rationale doesn't apply due to + kernel.yama.ptrace_scope=2 being set in Kicksecure. + +commit 19d7e1af5d7acf6eb3a20fe3ebf5f14cef041f92 +Author: Patrick Schleizer +Date: Tue May 20 11:40:27 2025 +0000 + + bumped changelog version + +commit 405880e63b92319626332d083a6c5ad5101dbf77 +Author: Patrick Schleizer +Date: Sun May 18 06:44:42 2025 -0400 + + handle case of non-existence of /proc/cmdline + +commit 88235cc97b8b54f3fe78d6ad76f64326e8b53f3e +Author: Patrick Schleizer +Date: Sun May 18 06:44:04 2025 -0400 + + refactoring + +commit 601ea77b005d18b57a85e0701f3981edd61b7881 +Author: Patrick Schleizer +Date: Sun May 18 06:42:39 2025 -0400 + + end-of-options + +commit d8feca12768441b0499ead7cc9f9bce4e89b1edf +Author: Patrick Schleizer +Date: Sun May 18 06:41:41 2025 -0400 + + printf + +commit 7f2ba0980d17360fc014c6a412fc4ee57e1032fd +Author: Patrick Schleizer +Date: Sun May 18 06:40:50 2025 -0400 + + refactoring + +commit 4d1f8c44d28895587abce586ed5b2fe354544f6a +Merge: 341dce33 e4787508 +Author: Patrick Schleizer +Date: Sun May 18 06:36:08 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e478750814798f3d9aa60354b6cecbb84769ed53 +Merge: 341dce33 91a76db6 +Author: Patrick Schleizer +Date: Sun May 18 06:35:23 2025 -0400 + + Merge pull request #305 from DMHalford/pam-info-failed_login_counter-fix + + Prevent erroneous "Login blocked after [negative number] attempts" errors + +commit 35fa32e4ed6333f3ab87d09828f13155aa1e7a72 +Author: raja-grewal +Date: Sat May 17 15:06:49 2025 +1000 + + Reword + +commit a1bde21ccb475fc21a084559dbe766f6315d9287 +Author: raja-grewal +Date: Sat May 17 04:41:06 2025 +0000 + + Set `erst_disable` + +commit 91a76db66bb496ba4650ada38df31636297738cf +Author: DMHalford <161769419+DMHalford@users.noreply.github.com> +Date: Thu May 15 15:42:50 2025 -0400 + + Prevent erroneous "Login blocked after [negative number] attempts" errors + + For root, faillock appears to always* return an empty string (i.e. no table headers are present), yielding a zero-initialized pam_faillock_output_count and thus resulting in the calculation of a negative failed_login_counter value. + + This can cause erroneous errors of the form "ERROR: Login blocked after [negative number] attempts" during sudo-ing and screen unlocking. + + This commit modifies the initialization of failed_login_counter such that it cannot be negative and prevents the display of these incorrect warnings. + + * Only rudimentary local tests were conducted + +commit 6c3be9ced071e73e78451c82e8def9c5a5b02598 +Author: DMHalford <161769419+DMHalford@users.noreply.github.com> +Date: Thu May 15 15:06:10 2025 -0400 + + Prevent erroneous "Login blocked after [negative number] attempts" errors + + For root, faillock appears to always* return an empty string (i.e. no table headers are present), yielding a zero-initialized pam_faillock_output_count and thus resulting in the calculation of a negative failed_login_counter value. + + This can cause erroneous errors of the form "ERROR: Login blocked after [negative number] attempts" during sudo-ing and screen unlocking. + + This commit modifies the initialization of failed_login_counter such that it cannot be negative and prevents the display of these incorrect warnings. + + * Only rudimentary tests were conducted + +commit f3d46ee56233c4ef0552c20304413d137e90acfe +Author: Aaron Rainbolt +Date: Fri May 9 18:46:41 2025 -0500 + + Add emergency shutdown feature, triggered by root device removal + +commit 341dce33fb806ab03822470e6af91604662c22dd +Author: Patrick Schleizer +Date: Fri Apr 25 09:54:23 2025 +0000 + + bumped changelog version + +commit 06e1e44b0039807baa862102b12fc5e199c3ccb3 +Author: Patrick Schleizer +Date: Fri Apr 25 05:51:21 2025 -0400 + + comments + +commit ba1012ca8767baf34ed762d80b25b03bb70e6765 +Author: Patrick Schleizer +Date: Fri Apr 25 08:19:35 2025 +0000 + + bumped changelog version + +commit a8f6132bec1a6f4a639d58295b3e50faf5494d98 +Author: Patrick Schleizer +Date: Fri Apr 25 03:11:27 2025 -0400 + + output + +commit 1d14a9f32435b8131c251e03bff2af5c929bbf49 +Merge: e154d0af 612f5f92 +Author: Patrick Schleizer +Date: Fri Apr 25 02:59:09 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/fix-pkexec-umask' + +commit 612f5f92fde236b86928428fd0247c8e971b0460 +Author: Aaron Rainbolt +Date: Thu Apr 24 20:01:35 2025 -0500 + + Fix umask for pkexec-run commands + +commit e154d0af6dd41e392122fbe3d09219734c5ad588 +Author: Patrick Schleizer +Date: Mon Apr 21 10:21:54 2025 +0000 + + bumped changelog version + +commit 4bf0e3a63667c284d053e5b8517440a884a42441 +Author: Patrick Schleizer +Date: Mon Apr 21 04:57:07 2025 -0400 + + comments + +commit 502f5953c734346edc680a0b898b435e6c6f6e27 +Author: Patrick Schleizer +Date: Mon Apr 21 04:55:19 2025 -0400 + + comments + +commit abb0c83619b820b7b66258efa9e141850eaa8b6c +Author: Patrick Schleizer +Date: Mon Apr 21 04:54:06 2025 -0400 + + comments + +commit efa2967fca36c776d43419dd5bf12696bc61c426 +Author: Patrick Schleizer +Date: Mon Apr 21 04:53:04 2025 -0400 + + comments + +commit dc7e8579040a96630ab1bbf7b4b901e3e3abe8c7 +Author: Patrick Schleizer +Date: Sat Apr 19 17:33:56 2025 +0000 + + bumped changelog version + +commit 9948ae114d4c6bbd650022c9985137c0fdea5675 +Author: Patrick Schleizer +Date: Sat Apr 19 13:24:17 2025 -0400 + + fix + +commit 4aca622706f33e85832e67650259a7751ba87a72 +Author: Patrick Schleizer +Date: Sat Apr 19 13:23:26 2025 -0400 + + fix + +commit 701f4a0e88a32e4c9312fd92b73cef5d4f755f0a +Author: Patrick Schleizer +Date: Sat Apr 19 13:20:04 2025 -0400 + + output + +commit a670c0d873eba8d84bde90ebbeecc7aecc22349e +Author: Patrick Schleizer +Date: Sat Apr 19 13:18:23 2025 -0400 + + comment + +commit 4799f3ce02e5683dad0fff13f5d7fe0aadb0a0db +Author: Patrick Schleizer +Date: Sat Apr 19 13:17:28 2025 -0400 + + make `/usr/libexec/security-misc/apt-get-update` more reliable + +commit c4f0e1d16f6999b055b0fa310456870f12a6dbea +Author: Patrick Schleizer +Date: Sat Apr 19 12:57:14 2025 -0400 + + refactoring + +commit 81634930fa13a240b9fff9a878dd84af1dccc6b3 +Author: Patrick Schleizer +Date: Sat Apr 19 12:55:32 2025 -0400 + + refactoring + +commit 90330a1ec958f82f9322ecc62bcfb7169d641af4 +Author: Patrick Schleizer +Date: Sat Apr 19 12:49:18 2025 -0400 + + refactoring + +commit ce2c9a21a357b3981335336eaf7ac8a6a3bcb052 +Author: Patrick Schleizer +Date: Sat Apr 19 12:47:40 2025 -0400 + + /usr/libexec/security-misc/apt-get-update: use `/run/helper-scripts` folder for pid file instead of `$TMP` + + to avoid permission issues + +commit 96ff7c8dc67809a3199d0b7f22d9e50483634a9c +Author: Patrick Schleizer +Date: Sat Apr 19 12:45:06 2025 -0400 + + refactoring + +commit 5a37790e6bd80ffd4f74d9596523ef72366d35d9 +Author: Patrick Schleizer +Date: Sat Apr 19 12:43:15 2025 -0400 + + cleanup + +commit 7512aa67572c97267fd176e63ae4862b6d37f8ae +Author: Patrick Schleizer +Date: Tue Apr 15 20:59:37 2025 +0000 + + bumped changelog version + +commit e0e2a9b61c61b34a6fe10782e294d58adff15cfe +Merge: 5e88dfe8 9f2836d2 +Author: Patrick Schleizer +Date: Tue Apr 15 15:27:10 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 9f2836d2baae900222cbae74d7a32bcdc69e589f +Merge: 5e88dfe8 aa0ffff4 +Author: Patrick Schleizer +Date: Tue Apr 15 15:17:25 2025 -0400 + + Merge pull request #304 from raja-grewal/stop_pstore + + Disable PStore + +commit 5e88dfe809a762aeebf62ea2de131cfbdea9ae32 +Author: Patrick Schleizer +Date: Thu Apr 10 11:38:17 2025 +0000 + + bumped changelog version + +commit c0a18c5a7122fe3c7b52d0e02ca5e8817efb3996 +Merge: da9dd3c3 74ca63d1 +Author: Patrick Schleizer +Date: Thu Apr 10 06:07:55 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/rename-boot-modes' + +commit 74ca63d12c716017d022f5dfc5348ae7b787e220 +Author: Aaron Rainbolt +Date: Wed Apr 9 21:01:41 2025 -0500 + + Mass-change "PERSISTENCE mode USERNAME" to "PERSISTENCE Mode - USERNAME Session" + +commit aa0ffff42753f68e67bc92680a22986a5b9ef9e0 +Author: raja-grewal +Date: Thu Apr 10 11:49:45 2025 +1000 + + README.md: Revert error + +commit da9dd3c3f14103701ad82af775b4fb547f5b3e2e +Author: Patrick Schleizer +Date: Wed Apr 9 15:16:00 2025 +0000 + + bumped changelog version + +commit 163d51f32a1888a52ea78ba32a4e4a2d72aea87d +Author: Patrick Schleizer +Date: Wed Apr 9 09:47:52 2025 -0400 + + newline at the end + +commit 4d2b2e65468522b1d1beda63b0b16cfa12b1d535 +Author: Patrick Schleizer +Date: Tue Apr 8 14:08:24 2025 +0000 + + bumped changelog version + +commit 39f4f5b60739c387f02970018e14f1ae93677e00 +Author: Patrick Schleizer +Date: Tue Apr 8 06:53:08 2025 -0400 + + comments + +commit 173606891ad0c064a22b4ec0aee772105d8be54a +Author: Patrick Schleizer +Date: Tue Apr 8 06:48:29 2025 -0400 + + output + +commit f0d17c7e4134d8a54ce7331c1e9d3ce932278987 +Author: raja-grewal +Date: Sun Mar 16 03:31:24 2025 +0000 + + README: Fix a few links + +commit df2fc2cf6b0437d23c7641118ebd24d2e3a670ce +Author: raja-grewal +Date: Sun Mar 16 03:30:04 2025 +0000 + + Set `efi_pstore.pstore_disable=1` + +commit f643ebc2f923ba4d7231e5aeaf1d91d1a9d1d0df +Author: raja-grewal +Date: Sun Mar 16 03:28:39 2025 +0000 + + Disable pstore processing by systemd-pstore service + +commit d927fe238cc5369f7fe1632a4173fe4bdf0ffdfb +Author: Patrick Schleizer +Date: Mon Mar 3 11:00:38 2025 +0000 + + bumped changelog version + +commit cd0ba94ac5e7e8360183ac6f440d941b4067025b +Author: Patrick Schleizer +Date: Mon Mar 3 05:57:59 2025 -0500 + + no longer disable `vivid` kernel module by default, + because it breaks Qubes Video Companion + + Thanks to @marmarek for the bug report! + + https://forums.whonix.org/t/testing-qubes-video-companion-on-whonix/21393 + + fixes https://github.com/Kicksecure/security-misc/issues/298 + +commit 3e7d1b4e23e1e8ef4ad138dbe4119eee7e72511c +Author: Patrick Schleizer +Date: Sun Feb 9 23:04:36 2025 +0000 + + bumped changelog version + +commit 0615e6e995eb25d8e1bff181ecc49ff51e4029cc +Merge: 2a4a228b 4d62ee3a +Author: Patrick Schleizer +Date: Sun Feb 9 18:01:43 2025 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 4d62ee3ab31bde80eebde265c2513233f10f751a +Merge: 2a4a228b ce4b57d1 +Author: Patrick Schleizer +Date: Sun Feb 9 18:00:59 2025 -0500 + + Merge pull request #297 from raja-grewal/warn_path + + Update docs on kernel panics + +commit ce4b57d1cb179f18c1ac41681626d01054355fe6 +Author: raja-grewal +Date: Mon Feb 3 00:31:45 2025 +0000 + + Update docs on kernel panics + +commit 2a4a228b150e06c7ff796315719d41e825dd8ad3 +Author: Patrick Schleizer +Date: Fri Jan 31 19:38:42 2025 +0000 + + bumped changelog version + +commit 041caf286b343268e6db69f2957f23c1dd20812a +Author: Patrick Schleizer +Date: Fri Jan 31 14:33:54 2025 -0500 + + update pkg_installed function + +commit ac1493fcfc194b8d1a680d7e8bf53a90caa984ac +Author: Patrick Schleizer +Date: Fri Jan 31 14:33:17 2025 -0500 + + comment + +commit c0f2f110146410428fc12815b30aaba67ff16126 +Author: Patrick Schleizer +Date: Thu Jan 30 12:58:48 2025 +0000 + + bumped changelog version + +commit 9f5e522b83ba969112abf6a9fba77c1eff31b14d +Author: Patrick Schleizer +Date: Thu Jan 30 07:53:04 2025 -0500 + + LC_ALL=C + +commit 7c150d116d1d1f95e2fb729934906eb4391a389a +Author: Patrick Schleizer +Date: Thu Jan 30 07:45:08 2025 -0500 + + LANG=C str_replace: no longer requires LANG=C, therefore removed + +commit 6aaf7082177fe4d02415aac4317cde74665f495c +Author: Patrick Schleizer +Date: Wed Jan 29 14:36:41 2025 +0000 + + bumped changelog version + +commit 10508cb5801c28f8fff306957e867a1626aa6489 +Merge: 6b4fa1ef b9dee263 +Author: Patrick Schleizer +Date: Wed Jan 29 09:36:28 2025 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit b9dee2633128577245763bad41cf3cb6b49751f3 +Merge: 6b4fa1ef 4b1e5306 +Author: Patrick Schleizer +Date: Wed Jan 29 09:35:50 2025 -0500 + + Merge pull request #296 from raja-grewal/cpu_details + + Hardware-related Documentation + +commit 6b4fa1ef0055d36a45d65481129dabfee77027e4 +Author: Patrick Schleizer +Date: Thu Jan 23 16:28:58 2025 +0000 + + bumped changelog version + +commit b10f5489a3e3317f01339ea34a0e5c7bfb850a01 +Author: Patrick Schleizer +Date: Thu Jan 23 11:12:26 2025 -0500 + + copyright + +commit 3c18734db32b2d19c3a30e282435f083d307d86e +Author: Patrick Schleizer +Date: Wed Jan 22 14:11:21 2025 +0000 + + bumped changelog version + +commit f90ffacac3d3c12f62f62106a69cb6caeca69041 +Author: Patrick Schleizer +Date: Wed Jan 22 09:09:56 2025 -0500 + + bump permission hardner migration code version + +commit 3a056c9d9c17ed3968f48ac332cee94f714320c7 +Author: Patrick Schleizer +Date: Wed Jan 22 09:05:50 2025 -0500 + + bump permission hardner migration code version + +commit d5ad29a7324dfbece3185026a3f4c58121c453b6 +Author: Patrick Schleizer +Date: Wed Jan 22 09:04:44 2025 -0500 + + add /usr/lib/polkit-1/polkit-agent-helper-1 to permission hardener hardcoded statoverride file + +commit c8a2483cf6735b29ef9b265cc09b58b00b14b6f0 +Author: Patrick Schleizer +Date: Wed Jan 22 13:52:29 2025 +0000 + + bumped changelog version + +commit 80bd314436b99b723359f25e52bbd14683929b56 +Author: Patrick Schleizer +Date: Wed Jan 22 08:25:14 2025 -0500 + + add `.whonix` files to hardcoded files + +commit 9b012bdeee03e73de537e7fe65c0bb8d16b38e79 +Merge: 507130a1 42f34f5a +Author: Patrick Schleizer +Date: Wed Jan 22 08:23:49 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-symlink-fix' + +commit 507130a1cc0592bd4a4b280da7496dade470e637 +Merge: f1b6bff3 ed767e00 +Author: Patrick Schleizer +Date: Wed Jan 22 08:21:39 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-diag' + +commit 42f34f5a4ccf95d504e28a26aeb0747fef4685ba +Author: Aaron Rainbolt +Date: Tue Jan 21 21:49:03 2025 -0600 + + Don't handle files with multiple hardlinks + +commit 5e60416c864a7d06f635161a185864fc36d5685c +Author: Aaron Rainbolt +Date: Tue Jan 21 21:05:03 2025 -0600 + + Make permission-hardener always apply changes to real files, not symlinks + +commit ed767e00b0260d29c18c710efe07d68a9beffb34 +Author: Aaron Rainbolt +Date: Tue Jan 21 16:41:30 2025 -0600 + + Add some local variable declarations + +commit 4b1e530674146d4d2b62ff4a87fe3add5667403c +Author: raja-grewal +Date: Tue Jan 21 12:39:06 2025 +0000 + + README.md: List CPU mitigations + +commit 15d13a8571d1f38b2bc36387f61bce24c86be97b +Author: raja-grewal +Date: Tue Jan 21 12:36:04 2025 +0000 + + Add info on DBX updates via the UEFI Revocation List + +commit a97620a2e491cc039adb15af94958f26b39319a2 +Author: Aaron Rainbolt +Date: Mon Jan 20 22:43:55 2025 -0600 + + Add print-diagnostics command to permission-hardener + +commit f1b6bff30b1891bfbe870de9edd78fa7dbd66e7c +Author: Patrick Schleizer +Date: Mon Jan 20 11:35:08 2025 +0000 + + bumped changelog version + +commit df9d058ed9635b168508ded20277c174a24cf3f5 +Author: Patrick Schleizer +Date: Mon Jan 20 06:28:16 2025 -0500 + + usrmerge + +commit 8ff5f3b22125488f64cd384ffbfcbd8f2ecd61a6 +Author: Patrick Schleizer +Date: Mon Jan 20 10:11:43 2025 +0000 + + bumped changelog version + +commit 4e0d5a196ccb8ef3fdf2b67d974f28d02a532f91 +Author: Patrick Schleizer +Date: Mon Jan 20 04:30:26 2025 -0500 + + delete comment only configuration file (moved to user-sysmaint-split) + +commit 1b4d1edfc316f125ff5039bf17897802205750e2 +Author: Patrick Schleizer +Date: Mon Jan 20 04:29:42 2025 -0500 + + comments + +commit 51c7010e8f47ce6e6a28e6267c735e897dcfb053 +Author: Patrick Schleizer +Date: Fri Jan 17 13:35:28 2025 +0000 + + bumped changelog version + +commit 876d596a071ac916f7d220ee2449358aedba7efe +Author: Patrick Schleizer +Date: Fri Jan 17 07:55:54 2025 -0500 + + comment + +commit c9e2f82bd01813682998c775f75bac0841239e5e +Merge: 59718697 bf73f1f2 +Author: Patrick Schleizer +Date: Fri Jan 17 07:53:59 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/master' + +commit bf73f1f2b5e429caaf01bfbcdc7d5d032e3c0efb +Author: Aaron Rainbolt +Date: Wed Jan 15 19:10:41 2025 -0600 + + Avoid impossible-to-satisfy dependency on helper-scripts, improve string handling robustness in postinst + +commit 597186972e463ce7a0b44662f7656f351ddf1030 +Author: Patrick Schleizer +Date: Wed Jan 15 15:02:44 2025 +0000 + + bumped changelog version + +commit ca257164105c4f66576024b64c52a42921455d16 +Author: Patrick Schleizer +Date: Wed Jan 15 09:44:48 2025 -0500 + + improve permission hardener migration code + +commit 2dfd30a44ae332faa50bc4920486cdd9480c7e5d +Merge: a84d3ba7 328f7471 +Author: Patrick Schleizer +Date: Wed Jan 15 09:33:57 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/more-permission-hardener' + +commit 328f747179ffb2e7705a73bc9a0c5133a17da829 +Author: Aaron Rainbolt +Date: Tue Jan 14 20:35:28 2025 -0600 + + Restore permission-hardener's notice about how to compare old and new states + +commit c6f09748f383fdf7c1b07441c73477b3f18d2768 +Author: Aaron Rainbolt +Date: Tue Jan 14 20:27:53 2025 -0600 + + Handle de-corruption of new_mode a bit better + +commit a0f81958dfb020d311d86cbd00d4f86f678d8be9 +Author: Aaron Rainbolt +Date: Tue Jan 14 19:25:15 2025 -0600 + + De-corrupt the new_mode permission-hardener statoverride database too + +commit 396372c1295e2a09d596f3e23fccc26794a26f05 +Author: Aaron Rainbolt +Date: Tue Jan 14 18:50:24 2025 -0600 + + Avoid scanning unnecessary packages for modified permission-hardener config + +commit a84d3ba732bcbd2fb93ea2bc145a0db0f33f1b77 +Author: Patrick Schleizer +Date: Tue Jan 14 14:32:13 2025 +0000 + + bumped changelog version + +commit 709036c79f8efc9fefa9e7709780a75f9f5004d2 +Author: Patrick Schleizer +Date: Tue Jan 14 09:31:58 2025 -0500 + + debconf-updatepo + +commit 659c7037c6956f6d905e55a1ebb13ebe6a273dee +Author: Patrick Schleizer +Date: Tue Jan 14 14:30:58 2025 +0000 + + bumped changelog version + +commit 86d3db15bf94dc0f4547105e18ef5f26ca124fa8 +Author: Patrick Schleizer +Date: Tue Jan 14 09:30:46 2025 -0500 + + output + +commit 876c0b618785fc71d1d399ff7ab649382104a714 +Author: Patrick Schleizer +Date: Tue Jan 14 09:29:35 2025 -0500 + + output + +commit c46178dee46f88e8d0007a12a48addc2493faab7 +Author: Patrick Schleizer +Date: Tue Jan 14 09:27:37 2025 -0500 + + output + +commit f3c07a2451fd2818daca6bc248cbbcba213516e7 +Author: Patrick Schleizer +Date: Tue Jan 14 09:24:06 2025 -0500 + + update link + +commit bbc4ad7c2a0827d079ccbb18dce4aaae042a2253 +Author: Patrick Schleizer +Date: Tue Jan 14 14:16:45 2025 +0000 + + bumped changelog version + +commit 9bb92e91a8f364a9d9e5d69e907fe8ed8a3c58a2 +Author: Patrick Schleizer +Date: Tue Jan 14 09:16:25 2025 -0500 + + debhelper + +commit 95dd8f419fc7e9832d8ce6f74d35af9b36752f3f +Author: Patrick Schleizer +Date: Tue Jan 14 14:07:50 2025 +0000 + + bumped changelog version + +commit 0a2f06b456854f1cec3ff93952edef928ac7a184 +Author: Patrick Schleizer +Date: Tue Jan 14 09:07:32 2025 -0500 + + use pre.bsh + +commit 6a4f9c1bd8c48bb1a711eee077ea7a05646b0598 +Author: Patrick Schleizer +Date: Tue Jan 14 14:06:50 2025 +0000 + + bumped changelog version + +commit e60183ec073d278f8d69a5475aa52d75870cd9b0 +Author: Patrick Schleizer +Date: Tue Jan 14 09:06:41 2025 -0500 + + output + +commit a812961beabacca052b4b25b78ecd2c35184d5d5 +Author: Patrick Schleizer +Date: Tue Jan 14 09:06:12 2025 -0500 + + verbose + +commit 0e4dfc59dd9c06dd732affd8ca7f72a1a70a95b0 +Author: Patrick Schleizer +Date: Tue Jan 14 13:53:49 2025 +0000 + + bumped changelog version + +commit cdf179f1277bcae3ef681d35aeca6289d55b3a6a +Author: Patrick Schleizer +Date: Tue Jan 14 08:53:38 2025 -0500 + + fix + +commit 41cd09933a506d55bab1f8bf101840cf4bbbf028 +Author: Patrick Schleizer +Date: Tue Jan 14 09:26:05 2025 +0000 + + bumped changelog version + +commit eec2e2c8ee621c6ebb152abbfe3951fa0322a0d0 +Author: Patrick Schleizer +Date: Tue Jan 14 04:13:39 2025 -0500 + + comment + +commit 6d282226ef653accf1de32582b999ff31775f60f +Author: Patrick Schleizer +Date: Tue Jan 14 04:12:12 2025 -0500 + + comment + +commit 466308e4f9ebd496ff54dd9f77881ce10a558802 +Author: Patrick Schleizer +Date: Tue Jan 14 04:09:57 2025 -0500 + + permission hardener: disable SUID for `chrome-sandbox` + +commit 7a5f8b87af7142ce973bd88abf98279ce15559a9 +Author: Patrick Schleizer +Date: Tue Jan 14 04:06:44 2025 -0500 + + permission hardener: disable SUID for `ssh-agent`, `ssh-keysign`, `/lib/openssh/*` + + This might break SSH host-based authentication. + +commit d89ffcde30f6115c25c1bc807eb30b18c21e2b6e +Author: Patrick Schleizer +Date: Tue Jan 14 04:04:09 2025 -0500 + + comment + +commit 9f1759ba0ea7ecee87c8777226eb8a56482deeb5 +Author: Patrick Schleizer +Date: Tue Jan 14 03:56:55 2025 -0500 + + comment + +commit 0ac85ea9f56abdf621ec1b4f2acf08a2450067ba +Author: Patrick Schleizer +Date: Tue Jan 14 03:54:35 2025 -0500 + + comment + +commit fce6a5f8303cd891efd8bbfef861e357dc90e88e +Author: Patrick Schleizer +Date: Tue Jan 14 03:51:43 2025 -0500 + + comment + +commit 1e9940481318d8d7a443b98f0906089759f27a5d +Author: Patrick Schleizer +Date: Tue Jan 14 03:50:16 2025 -0500 + + comment + +commit b198591537a01f5b35c9301ca28a24c70864bcbd +Author: Patrick Schleizer +Date: Tue Jan 14 03:49:42 2025 -0500 + + comment + +commit 7d44db2cb268c4eb31b50bbd44b87b8001dc068c +Author: Patrick Schleizer +Date: Tue Jan 14 03:49:15 2025 -0500 + + usrmerge + +commit 7e7632a55396e10e20a6e9d8d563011694cccc85 +Author: Patrick Schleizer +Date: Tue Jan 14 08:24:05 2025 +0000 + + bumped changelog version + +commit 420cb3f86f69c4505702a8f38271fb095316cb6f +Author: Patrick Schleizer +Date: Tue Jan 14 03:19:21 2025 -0500 + + refactoring + +commit b7e7b2767eb957dd1401f5abcff07bfcb47a4c00 +Author: Patrick Schleizer +Date: Tue Jan 14 03:18:17 2025 -0500 + + refactoring + +commit b2a1a0ec9f8db1d84c222e734737b7ed149f6d92 +Author: Patrick Schleizer +Date: Tue Jan 14 03:17:00 2025 -0500 + + refactoring + +commit 69ae2d9ea0826aa81c70e957bb5a9241a84346ad +Merge: de1f31e3 de9ebabd +Author: Patrick Schleizer +Date: Tue Jan 14 03:15:45 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-migrate' + +commit de9ebabd46798ff2afa259907b6a7b976070e7f0 +Author: Aaron Rainbolt +Date: Mon Jan 13 21:57:10 2025 -0600 + + Fix minor migration bugs, don't run the migration code on new image builds + +commit a9e87e9d308f5e61a2d2054fa038dae6faadad3a +Author: Aaron Rainbolt +Date: Sun Jan 12 21:13:43 2025 -0600 + + Prevent installation failures when installing non-interactively + +commit 5570d3e5b9f97f14c772facff16dc45df66d42e9 +Author: Aaron Rainbolt +Date: Sun Jan 12 20:40:41 2025 -0600 + + Add a forgotten set -e + +commit 07786de03953b91310588e0b37b9e150bf1b4736 +Author: Aaron Rainbolt +Date: Sun Jan 12 19:34:41 2025 -0600 + + Enable smooth migration from permission-hardener-v1 to permission-hardener-v2 + +commit de1f31e3df1a0fba0a4c6e41b9b46e076266cfd4 +Author: Patrick Schleizer +Date: Sun Jan 12 11:47:18 2025 +0000 + + bumped changelog version + +commit b0baa8baa57937358dc988b88adab4858a1d8cae +Author: Patrick Schleizer +Date: Sun Jan 12 05:38:35 2025 -0500 + + add link + +commit d6a7cd3e0d1e677c1fa8c1fb3b307cdbe0f45031 +Author: Patrick Schleizer +Date: Sun Jan 12 05:36:16 2025 -0500 + + formatting. + + use chapter to make allow for deep linking + +commit 485d9abd1d14e445b48f0fd63290a985b05a5ac7 +Author: Patrick Schleizer +Date: Fri Jan 10 15:34:21 2025 +0000 + + bumped changelog version + +commit c17485baa118e76cc8074ce3e72ac3ac38c577cd +Merge: 482960d0 e9ef3602 +Author: Patrick Schleizer +Date: Fri Jan 10 10:32:26 2025 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e9ef3602dd1661de0c0c3781d7e0246720643354 +Merge: 1b33e835 cf435a8f +Author: Patrick Schleizer +Date: Fri Jan 10 10:30:34 2025 -0500 + + Merge pull request #292 from raja-grewal/cpu_table + + Add link to tabular comparison of CPU mitigations + +commit 1b33e83529d652dab4468e0b386e333b3ca4745b +Merge: 486757bf 2e6e1701 +Author: Patrick Schleizer +Date: Fri Jan 10 10:29:30 2025 -0500 + + Merge pull request #291 from raja-grewal/drop_gratuitous_arp + + Drop gratuitous ARP packets + +commit 486757bfae5e7ecc389b16c49704e742fd267565 +Merge: 17ff2491 c37f4efa +Author: Patrick Schleizer +Date: Fri Jan 10 10:29:12 2025 -0500 + + Merge pull request #290 from raja-grewal/arp_ignore + + Respond to ARP requests only if the target IP address is on-link + +commit 17ff24915062736a32d4d54da7163fe34aa70fd3 +Merge: 27d19ba5 1f8eee47 +Author: Patrick Schleizer +Date: Fri Jan 10 10:28:48 2025 -0500 + + Merge pull request #289 from raja-grewal/arp_filter + + Enable ARP filtering + +commit 27d19ba568e601c37035a310ae6cdd7d953be286 +Merge: 482960d0 5e3785d7 +Author: Patrick Schleizer +Date: Fri Jan 10 10:28:05 2025 -0500 + + Merge pull request #288 from raja-grewal/shared_media + + Deny sending and receiving shared media redirects + +commit 482960d056ec8d624f127bfe9b1c69a4c30c7e34 +Author: Patrick Schleizer +Date: Fri Jan 10 10:21:12 2025 -0500 + + permission-hardener: move to new state folder `/var/lib/permission-hardener-v2` without migration + + https://github.com/Kicksecure/security-misc/pull/294 + +commit cf435a8fa8e6f795a25ef004cf44a65d461dd32c +Author: raja-grewal +Date: Fri Jan 10 13:22:21 2025 +1100 + + README.md: Note importance of microcode updates + +commit 3a31cc99b34617cdd3c5f8e8950a37158849cb56 +Merge: c4cfb859 5941195e +Author: Patrick Schleizer +Date: Thu Jan 9 09:30:58 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/usrmerge' + +commit 538b312349a97bcecb12e62519d77840afcd6ca3 +Author: raja-grewal +Date: Thu Jan 9 15:28:56 2025 +1100 + + Add comment about microcode updates + +commit 1f8eee47200221e2e38291a31e852e9c222d8c64 +Author: raja-grewal +Date: Wed Jan 8 18:36:00 2025 +1100 + + Add missing sentence full stop + +commit 5e3785d76e616f49407e720b37138f35a50fe4fb +Author: raja-grewal +Date: Wed Jan 8 18:35:52 2025 +1100 + + README.md: Remove double space + +commit 5941195e96880b8beb2a791d3c21f3a4c6d429eb +Author: Aaron Rainbolt +Date: Tue Jan 7 14:10:46 2025 -0600 + + Don't worry about files under /bin anymore, Bookworm uses a merged /usr directory + +commit c4cfb8597d1a8631a4cbfa7e88212b798e2bc514 +Merge: c6be6219 93ebf176 +Author: Patrick Schleizer +Date: Mon Jan 6 08:43:54 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-refactor' + +commit c6be621968c898f792ef1a450d2e1be5cd6056da +Author: Patrick Schleizer +Date: Mon Jan 6 10:31:40 2025 +0000 + + bumped changelog version + +commit 6e0787957b53a64132b64e2a29bafe3e4b66d178 +Author: Patrick Schleizer +Date: Mon Jan 6 05:29:40 2025 -0500 + + increase priority of pam wheel so it is checked even before faillock + + in case of attemtping to use `su` without being a member of the required group `sudo`, it's useful to abort the PAM stack as early as possible to avoid needlessly propmting for a password to later + be rejected tu to lack of group membership + +commit d4767b75206b46f1a006cd91b00239a7b828fc89 +Author: Patrick Schleizer +Date: Mon Jan 6 04:24:44 2025 -0500 + + fix: apply PAM wheal only to `su` PAM service + +commit 93ebf176c5f38bd268e5394e01421e46b9ae7dff +Author: Aaron Rainbolt +Date: Thu Jan 2 20:41:40 2025 -0500 + + Make the main field count check in permission-hardener a bit more elegant + +commit 895c0f541fb34f9ebfee9c7ef79c053d5af4a7cc +Merge: 717e6fcf 40b23cfa +Author: Aaron Rainbolt +Date: Wed Jan 1 15:04:01 2025 -0600 + + Merge branch 'master' into arraybolt3/permission-hardener-refactor + +commit 40b23cfad40825eefc3686e562d78250b58bbc82 +Author: Patrick Schleizer +Date: Tue Dec 31 18:42:01 2024 +0000 + + bumped changelog version + +commit 33114f771aaeb4dccb0b465861d1239129deb8b2 +Author: Patrick Schleizer +Date: Tue Dec 31 13:26:21 2024 -0500 + + copyright + +commit bb24bff2965ca31de6337820eafd787a11a44a2b +Author: Patrick Schleizer +Date: Tue Dec 31 14:09:34 2024 +0000 + + bumped changelog version + +commit 0640964c35b0d977ba718629d4a8791e67700202 +Author: Patrick Schleizer +Date: Tue Dec 31 06:14:29 2024 -0500 + + readme + +commit 717e6fcfbea38cef9d3e201cf2e2b725e3da2267 +Author: Aaron Rainbolt +Date: Mon Dec 30 19:23:20 2024 -0600 + + Post-review improvements to permission-hardener + +commit dbcb612517abbf8d162cfb31ba0585c518df8817 +Author: Aaron Rainbolt +Date: Wed Dec 25 19:48:28 2024 -0600 + + Polish permission-hardener refactor + +commit 397b476a822c9f7e41ec911f5d689b67026660ad +Author: Patrick Schleizer +Date: Thu Dec 26 04:12:02 2024 +0000 + + bumped changelog version + +commit 66f8c18c65f33676d242b57ebb1d4410876461b3 +Merge: aa82202e 6602fb10 +Author: Patrick Schleizer +Date: Wed Dec 25 22:43:04 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sysmaint' + +commit 83d386795940099e0835c51f3522aae3d9217dc8 +Author: Aaron Rainbolt +Date: Tue Dec 24 20:14:57 2024 -0600 + + Refactor permission-hardener to be more idempotent + +commit 6602fb102dedc21300ae4c4519f3d9ef4e668045 +Author: Aaron Rainbolt +Date: Tue Dec 24 20:52:34 2024 -0600 + + Adjust pam-info messaging for sysmaint mode + +commit aa82202e701167eacb63eac208469844e983ca43 +Author: Patrick Schleizer +Date: Tue Dec 24 05:16:22 2024 +0000 + + bumped changelog version + +commit 27d015d58ebc5e750d9d06f042b761720473941d +Merge: 3c73c0cd 2f3a2bce +Author: Patrick Schleizer +Date: Tue Dec 24 00:08:58 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sysmaint' + +commit 2f3a2bce7756efe75cd8aaf5066b599b4c49bbdc +Author: Aaron Rainbolt +Date: Fri Dec 20 11:04:22 2024 -0600 + + Add warning about using non-sysmaint accounts in sysmaint mode + +commit 3c73c0cd3a845d1a484551ff50f59e5f2ef56a68 +Author: Patrick Schleizer +Date: Fri Dec 20 06:01:27 2024 +0000 + + bumped changelog version + +commit a4c76c617a18a49168e0ffdba2d8b0ae834f2877 +Author: Patrick Schleizer +Date: Fri Dec 20 01:01:13 2024 -0500 + + syntax fix + +commit b40bc0a2c9b17b3569918a6839bce1c67af5c9df +Author: Patrick Schleizer +Date: Fri Dec 20 05:58:24 2024 +0000 + + bumped changelog version + +commit b21c394ea52401c0d77b6ec396af6a49335f5e0b +Author: Patrick Schleizer +Date: Fri Dec 20 00:56:20 2024 -0500 + + Trigger permission hardener when new configuration files are being installed. + +commit cd027b86e710b6f6b8fac6dd0ebcdcd691e86dd3 +Author: Patrick Schleizer +Date: Fri Dec 20 05:48:48 2024 +0000 + + bumped changelog version + +commit ad6e1f5ad490e12fc5e69b82da5dc1830cc41c96 +Author: Patrick Schleizer +Date: Fri Dec 20 00:41:06 2024 -0500 + + move from `/etc/permission-hardener.d` to `/usr/lib/permission-hardener.d` + +commit a2c1e8c218117a47ef70dd767d753be5d084adfa +Author: Patrick Schleizer +Date: Fri Dec 20 00:39:51 2024 -0500 + + clean up old files in `/etc/permission-hardener.d` + because will be moved to `/usr/lib/permission-hardener.d` + +commit 6de5d2d0763539d6d0d4b19b501bb316ed3b2c94 +Author: Patrick Schleizer +Date: Fri Dec 20 00:37:44 2024 -0500 + + permission hardener: also parse `/usr/lib/permission-hardener.d/*.conf` folder + +commit 721b100fb64136b7c36c8d43c90c716a1fed42d0 +Author: Patrick Schleizer +Date: Thu Dec 19 10:58:50 2024 +0000 + + bumped changelog version + +commit 642b4eeedc43e69bb82ea259b52c0946ce638983 +Author: raja-grewal +Date: Thu Dec 19 21:57:25 2024 +1100 + + Add link to tabular comparison of CPU mitigations + +commit 175b442d5bb9dfcb4e9b524ec2077e72c74598cc +Author: Patrick Schleizer +Date: Thu Dec 19 05:56:50 2024 -0500 + + use long option name + +commit c99021bb0c1d5b6bf361cc483449330cdd218ee6 +Merge: 95b53576 9d69cd19 +Author: Patrick Schleizer +Date: Thu Dec 19 05:56:01 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sysmaint' + +commit 2e6e1701a052ef32711f6c3abaad693a773323f6 +Author: raja-grewal +Date: Thu Dec 19 10:35:08 2024 +0000 + + Set `net.ipv4.conf.*.drop_gratuitous_arp=1` + +commit c37f4efadf8f046168732871172cb66f58eb7c78 +Author: raja-grewal +Date: Thu Dec 19 10:33:49 2024 +0000 + + Set `net.ipv4.conf.*.arp_ignore=2` + +commit af1d06973bdd46af3e39b0bdfda81b950ccac996 +Author: raja-grewal +Date: Thu Dec 19 10:31:43 2024 +0000 + + Set `net.ipv4.conf.*.arp_filter=1` + +commit 750367a9066ca2a0ff819b438a92cb1f6c325edb +Author: raja-grewal +Date: Thu Dec 19 10:29:56 2024 +0000 + + Set `net.ipv4.conf.*.shared_media=0` + +commit 95b535764c8a98b67a71ee1fd57b7f01da464106 +Author: Patrick Schleizer +Date: Thu Dec 19 09:43:26 2024 +0000 + + bumped changelog version + +commit daf0a0900b780a9d44d0d9b49b3fca6ddbd20d18 +Author: Patrick Schleizer +Date: Thu Dec 19 04:39:34 2024 -0500 + + fix apt-get-update for non-English locale + + https://forums.kicksecure.com/t/systemcheck-reports-warning-debian-package-update-check-result-apt-get-reports-that-packages-can-be-updated-but-system-is-already-fully-upgraded/785 + +commit e9a5b14a0db6f071424c19e6f4b006386afb6ab4 +Author: Patrick Schleizer +Date: Thu Dec 19 06:57:42 2024 +0000 + + bumped changelog version + +commit 3135a03e21f9e5816097e25aaa7f4a1671f8f87d +Merge: f0c611d9 c7f71964 +Author: Patrick Schleizer +Date: Thu Dec 19 00:34:56 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit c7f7196471b07a580c6d4a5d86739215508142cd +Merge: e5b67e04 3749f8ff +Author: Patrick Schleizer +Date: Thu Dec 19 00:31:25 2024 -0500 + + Merge pull request #287 from raja-grewal/patch + + Refactor and add two CPU mitigations + +commit f0c611d9edb5fd7a3e00d13b248c65abda2c9d8a +Author: Patrick Schleizer +Date: Thu Dec 19 00:18:25 2024 -0500 + + comment + +commit 4f681be77429984695a1b0f689065051884e7bf7 +Merge: 4c3ca684 4cf57575 +Author: Patrick Schleizer +Date: Thu Dec 19 00:17:44 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e5b67e044bb5011dd667879a73a670f2c5f74057 +Merge: 4cf57575 c1167968 +Author: Patrick Schleizer +Date: Thu Dec 19 00:15:02 2024 -0500 + + Merge pull request #279 from raja-grewal/arp + + Provide network-related hardening options via `sysctl`'s + +commit 4cf5757575c1257a14331f0169a9d8d163e1326d +Merge: 9d06341c 1708a03e +Author: Patrick Schleizer +Date: Thu Dec 19 00:08:56 2024 -0500 + + Merge pull request #282 from ArrayBolt3/arraybolt3/umask + + Enable umask hardening + +commit 9d69cd1912ab657e7916b38f56b477c2b7abd0a3 +Author: Aaron Rainbolt +Date: Wed Dec 18 21:34:16 2024 -0600 + + Add sysmaint account lock detection + +commit 3749f8ff097551a843e5ed80de52c6770a32e0c6 +Author: raja-grewal +Date: Wed Dec 18 03:36:09 2024 +0000 + + Update presentation on user namespaces + +commit 0dff2cd28fd769955757cdef1b7f9d637a1180c5 +Author: raja-grewal +Date: Wed Dec 18 03:32:35 2024 +0000 + + Minor additions + +commit 3e96fdd9ccb6268403d6c4f9a061c4a33e6f6dd2 +Author: raja-grewal +Date: Tue Dec 17 11:44:11 2024 +0000 + + Enable `kvm.mitigate_smt_rsb=1` + +commit 45355aabdc180a6a2fdd4a374c6f7d72f4d36240 +Author: raja-grewal +Date: Tue Dec 17 11:42:52 2024 +0000 + + Enable `kvm-intel.vmentry_l1d_flush=always` + +commit defba1f2450b2c8bbc668bf5f6f6f0d101338cc7 +Author: raja-grewal +Date: Tue Dec 17 11:42:03 2024 +0000 + + Refactor CPU mitigations + +commit 943c421889ce5dfe3869380e4587ca22724f2ce7 +Author: raja-grewal +Date: Tue Dec 17 11:40:38 2024 +0000 + + Minor refactoring + +commit ca3a73ac13d805515f71f1be7ecedc33d3a1b519 +Author: raja-grewal +Date: Tue Dec 17 11:37:10 2024 +0000 + + Typo + +commit 4c3ca68453b44074025a1ec9f31451c57344f3cf +Author: Aaron Rainbolt +Date: Mon Dec 9 12:37:11 2024 -0600 + + Disable unnecessary sudoers exceptions + +commit 9d06341c91b51f9c737fe67457045924323635f0 +Merge: a9dd592a 5b88e92e +Author: Patrick Schleizer +Date: Sat Dec 14 15:18:56 2024 -0500 + + Merge pull request #285 from Kicksecure/permission-hardener-mount + + Permission Hardener: treat mount same as umount + +commit c1167968542a62d0677517e11505f6e9222ec378 +Author: raja-grewal +Date: Thu Dec 12 06:36:47 2024 +0000 + + `arp_ignore`: Add reference to 2024-12-10 Mullvad VPN audit details + +commit a9dd592a8b49226f326e90111178aebba3cc144f +Author: Patrick Schleizer +Date: Tue Dec 10 19:19:10 2024 +0000 + + bumped changelog version + +commit 58722324ec0be98c3e44938df8cb60ca9b261210 +Merge: 518224b8 439fa7f3 +Author: Patrick Schleizer +Date: Tue Dec 10 14:18:50 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/no-recovery-mode' + +commit 518224b8cf9e99a830b584d8d54b5dea2925c8f5 +Author: Patrick Schleizer +Date: Tue Dec 10 19:17:10 2024 +0000 + + bumped changelog version + +commit 439fa7f3be74f5eba4b98f73c0bb50fd37e8b0e1 +Author: Aaron Rainbolt +Date: Sun Dec 8 03:21:27 2024 -0600 + + Harden/disable recovery mode options + +commit 7902311c570edd4286ba36f0cb85223d1e909a03 +Author: Patrick Schleizer +Date: Sat Dec 7 04:54:47 2024 -0500 + + do not create /etc/sysctl.d/30-lkrg-virtualbox.conf if LKRG is not installed + +commit 1ce37d42cd2c132eca8c45ddb04fdb594349d08f +Author: Patrick Schleizer +Date: Sat Dec 7 04:50:40 2024 -0500 + + . + +commit 5b88e92e5c4b951e659e1574fc248bd11158dfb2 +Author: Patrick Schleizer +Date: Fri Dec 6 09:48:58 2024 -0500 + + permission hardner: treat `mount` the same way we treat `umount` + + Thanks to @the-moog for the bug report! + + fixes https://github.com/Kicksecure/security-misc/issues/284 + +commit 93b51819d4693955936456916188b4118fe68a66 +Author: Patrick Schleizer +Date: Fri Dec 6 09:47:08 2024 -0500 + + permission hardener mount chmod change from `745` to `755` + + https://github.com/Kicksecure/security-misc/issues/284 + +commit 1708a03e1edda821ef091f10c46d32f740511d38 +Author: Aaron Rainbolt +Date: Thu Nov 28 15:20:57 2024 -0600 + + Enable umask hardening + +commit 59299a6639fef31565b8f3cef857c9faa331e0f7 +Author: Patrick Schleizer +Date: Mon Nov 25 21:07:42 2024 +0000 + + bumped changelog version + +commit 98d7c245ee11f16e566422a17543aaed2c155d88 +Author: Patrick Schleizer +Date: Mon Nov 25 15:57:30 2024 -0500 + + "|| exit 1" no longer required thanks to errexit + +commit f9b5d7d3f4f2ed8d1baae67d8427f13cf26aee8d +Author: Patrick Schleizer +Date: Mon Nov 25 15:48:01 2024 -0500 + + use strict shell options + +commit d32cb8c95b09721e52c4d682a0ddd39d590a4368 +Author: Patrick Schleizer +Date: Mon Nov 25 15:44:00 2024 -0500 + + use TMP, sponge, refactoring + +commit 62a551cfe39a6a640f32e6e97f3e915aa8673514 +Merge: af43472d d7475e25 +Author: Patrick Schleizer +Date: Mon Nov 25 15:38:01 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sudoers' + +commit d7475e252a64e296913ed8893261e52e72163d55 +Author: Aaron Rainbolt +Date: Thu Nov 21 20:03:42 2024 -0600 + + Make apt-get-update able to be terminated securely + +commit af43472d0ccdecb1725a200d10aeeb1b8d51f31a +Author: Patrick Schleizer +Date: Thu Nov 14 22:24:50 2024 +0000 + + bumped changelog version + +commit c7e9460b2ae8dcb96196fef69a7e0ed992c1b43b +Author: Patrick Schleizer +Date: Thu Nov 14 16:31:12 2024 -0500 + + output + +commit 31804e30ecc9c5a1c5a8e1e014d3dcb85cee4f36 +Author: Patrick Schleizer +Date: Thu Nov 14 20:46:26 2024 +0000 + + bumped changelog version + +commit ef95b3f9a5aed9652c541cf4bf05b20011718466 +Author: Patrick Schleizer +Date: Thu Nov 14 14:41:14 2024 -0500 + + Revert "fix `panic-on-oops.service`" + + This reverts commit 862d23cb10b7687084f8e7e207d1e2c9c1ef6751. + +commit 412b371e85044962f6620386b767369b9e25d71e +Merge: 141b84c4 57e1edde +Author: raja-grewal +Date: Wed Nov 13 16:47:57 2024 +1100 + + Merge branch 'Kicksecure:master' into arp + +commit 141b84c40de76988ec78bdccf1c1d67fc4367b3f +Author: raja-grewal +Date: Wed Nov 13 05:42:56 2024 +0000 + + Provide option to deny sending and receiving shared media redirects + +commit 18aec201bfb0477fee8800ad1388099e11920016 +Author: raja-grewal +Date: Wed Nov 13 05:41:25 2024 +0000 + + Provide option to harden response to ARP requests + +commit a25d4f8df88908e83e56049204aa625f1196a948 +Author: raja-grewal +Date: Wed Nov 13 05:40:21 2024 +0000 + + Provide option to enable ARP filtering + +commit c2aae73ce161811571e4c85609a0b043399c1b65 +Author: raja-grewal +Date: Wed Nov 13 05:38:03 2024 +0000 + + Add reference and move text + +commit 57e1edde23aa3f313ce087e00ebc14d158356d6c +Author: Patrick Schleizer +Date: Tue Nov 12 09:11:57 2024 +0000 + + bumped changelog version + +commit 7987a3914d364e674eb7479b15708c450041af02 +Author: Patrick Schleizer +Date: Tue Nov 12 02:29:42 2024 -0500 + + deleted no longer used and out-commented `/etc/sudoers.d/xfce-security-misc` leftover + +commit 8c2e8e69798e5255529ab3dbee6ca07b8b293100 +Author: Patrick Schleizer +Date: Tue Nov 12 01:41:12 2024 -0500 + + deleted no longer used and out-commented `etc/sudoers.d/pkexec-security-misc` leftover + +commit 65fc0419a84d62e07c61d7e37ef27d144b6b6794 +Author: Patrick Schleizer +Date: Mon Nov 11 11:07:57 2024 +0000 + + bumped changelog version + +commit 50161f5d79eea2ab796863e4eb30eccc17e0b41d +Author: Patrick Schleizer +Date: Mon Nov 11 05:48:11 2024 -0500 + + moved /etc/dkms/framework.conf.d/30_security-misc.conf (renamed) to usability-misc + +commit 7c06e22c7d11c345428f3ad42ba43805ebc8d810 +Author: Patrick Schleizer +Date: Mon Nov 11 05:43:25 2024 -0500 + + deleted `/usr/bin/pkexec.security-misc` + + This was not used anymore for anything. In the past, we used to `config-package-dev` `replace` `/usr/bin/pkexec` with `/usr/bin/pkexec.security-misc` for the purpose of: + + > Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with hidepid. + + * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 + * https://forums.whonix.org/t/cannot-use-pkexec/8129 + + This was a worthwhile effort, interesting approach but ultimately a dead-end. + +commit ef05b1a160b24d5aa42da9cc15009d94a37cf120 +Author: Patrick Schleizer +Date: Mon Nov 11 05:40:41 2024 -0500 + + disable legacy matroxfb_base framebuffer driver + + fix typo matroxfb_bases -> matroxfb_base + + Thanks to @ArrayBolt3 for the bug report! + +commit 862d23cb10b7687084f8e7e207d1e2c9c1ef6751 +Author: Patrick Schleizer +Date: Mon Nov 11 05:36:41 2024 -0500 + + fix `panic-on-oops.service` + + remove `After=multi-user.target` because already using `WantedBy=multi-user.target` + + Thanks to @ArrayBolt3 for the bug report! + +commit 29ae5f5980d521f6a4b468f5bf41210f78fdf10a +Author: Patrick Schleizer +Date: Mon Nov 11 05:28:31 2024 -0500 + + fix optional opt-in `harden-module-loading.service` + + by making `/usr/libexec/security-misc/disable-kernel-module-loading` executable + + Thanks to @ArrayBolt3 for the bug report! + +commit 4c649577f053af12bcd02c20576bf2d8aec1476d +Author: Patrick Schleizer +Date: Sun Nov 10 11:52:42 2024 +0000 + + bumped changelog version + +commit 29b1f1ec5f3a4bf3991fc1b862751c8eb9769ecd +Merge: 5bd0a277 238f32e8 +Author: Patrick Schleizer +Date: Sun Nov 10 06:32:30 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 5bd0a277bf39812c6adf40a7a3ef6390935fa08e +Author: Patrick Schleizer +Date: Sun Nov 10 06:29:17 2024 -0500 + + fix permission-hardener issue "Removing capabilities failed. File: '/bin/ping'" + + no longer user end-of-options marker (`--`) for `setcap` + since setcap does not support it + + Fixes https://github.com/QubesOS/qubes-issues/issues/9569 + + https://forums.whonix.org/t/permission-hardener-error/20719 + +commit 238f32e81d835e5b9d3bc43a0654d05efa4c4313 +Merge: 3af26841 8107782f +Author: Patrick Schleizer +Date: Fri Nov 8 07:39:40 2024 -0500 + + Merge pull request #280 from raja-grewal/ssbd + + Enable `ssbd=force-on` + +commit 8107782fa54ec0e21893e6bd4a6baabb71eb864b +Author: raja-grewal +Date: Fri Nov 8 15:36:04 2024 +1100 + + Enable `ssbd=force-on` + +commit a1d1f97955fd9fd3cee77dc04e2eb5e5fa29d243 +Author: raja-grewal +Date: Fri Nov 8 03:58:23 2024 +0000 + + Provide option to drop gratuitous ARP packets + +commit 3af2684134279ba6f5b18b40986f02a50baa5604 +Author: Patrick Schleizer +Date: Wed Oct 30 09:43:05 2024 +0000 + + bumped changelog version + +commit 71c58442ca6d57cd95b72a76ed87f8c248cdbd98 +Author: Patrick Schleizer +Date: Mon Oct 28 05:10:19 2024 -0400 + + minor + +commit cfe19e31d858d7899f4d95e21117c992d236d328 +Author: Patrick Schleizer +Date: Mon Oct 28 05:09:53 2024 -0400 + + shell options + +commit 0d506156587f87a303184f22259ffb57dd92cbc8 +Author: Patrick Schleizer +Date: Mon Oct 28 05:07:00 2024 -0400 + + local + +commit ef0eb5f7a0c5a62c5d26bf6dc534f6aa3decc4b0 +Author: Patrick Schleizer +Date: Mon Oct 28 05:06:26 2024 -0400 + + refactoring + +commit fdd1f4b7f88efc22bb57c2ad3e83c0c2e8cbb064 +Author: Patrick Schleizer +Date: Mon Oct 28 05:06:05 2024 -0400 + + refactoring + +commit d00235897d686895a7e2e7da7435832fee008164 +Author: Patrick Schleizer +Date: Mon Oct 28 05:03:59 2024 -0400 + + hide-hardware-info: also parse `/usr/local/etc/hide-hardware-info.d/*.conf` + +commit 6c2e808b9f34900840bd2857fed10d1ffd4cc4c2 +Author: Patrick Schleizer +Date: Mon Oct 28 05:03:20 2024 -0400 + + refactoring + +commit b44e507900defe3db68f31f3e110b1c3e5aa684c +Author: Patrick Schleizer +Date: Wed Oct 23 09:56:05 2024 +0000 + + bumped changelog version + +commit 566cda5e4bc69f54d63d72f1e30703074fdf0ce8 +Author: Patrick Schleizer +Date: Mon Oct 21 05:47:38 2024 -0400 + + output + +commit 5991a23049491dd04c19d9ea80f7d7381dd494a0 +Author: Patrick Schleizer +Date: Mon Oct 21 05:47:25 2024 -0400 + + comment + +commit fd34baff8ff17ed572469d9d6d884e6c0d881d20 +Merge: b6433309 690e8dd8 +Author: Patrick Schleizer +Date: Mon Oct 21 05:43:53 2024 -0400 + + Merge remote-tracking branch 'ArrayBolt3/master' + +commit 690e8dd826d1cb39c0c12c03792781862cc2dd23 +Author: Aaron Rainbolt +Date: Sat Oct 19 23:49:07 2024 -0500 + + Avoid faillock lock/tally reset on reboot or timeout + +commit b6433309fd7d6839cfba89e1197590e1ff62ef58 +Author: Patrick Schleizer +Date: Fri Oct 18 12:45:02 2024 -0400 + + use end-of-options + +commit 0cfcdf4f89dc75f2a8e3f8a9e8c69dc3ba3da78a +Author: Patrick Schleizer +Date: Wed Oct 16 10:57:20 2024 +0000 + + bumped changelog version + +commit 0adb9b7c0609a51d503b61ab40ae7d8e55635043 +Merge: 263335f7 e50ad807 +Author: Patrick Schleizer +Date: Wed Oct 16 06:31:09 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e50ad807c01b5753c67d579126d7b79d38070c0a +Merge: 263335f7 eb72163d +Author: Patrick Schleizer +Date: Wed Oct 16 06:29:25 2024 -0400 + + Merge pull request #276 from raja-grewal/KSPP_header + + Clarify KSPP compliance header + +commit eb72163d5707c7673db1f12405d2e04261bd43c8 +Author: raja-grewal +Date: Mon Oct 14 03:01:15 2024 +0000 + + README.md: Make line lengths consistent + +commit a9f238fe048acfeff49f96c00570acc6ca4c37e8 +Author: raja-grewal +Date: Mon Oct 14 02:57:31 2024 +0000 + + README.md: Split optional setting to new line + +commit 09fe46adc956e8c6de232f1093c37cdd30933acd +Author: raja-grewal +Date: Mon Oct 14 02:54:30 2024 +0000 + + Clarify KSPP compliance header for the undocumented case + +commit 263335f74ea0f050f9c259e20141c3345e7fa789 +Author: Patrick Schleizer +Date: Tue Oct 8 11:24:56 2024 +0000 + + bumped changelog version + +commit 9169611645d0cd5a308ff48862f351ef5ea5f7e8 +Merge: 8a2d432f 8227a3dd +Author: Patrick Schleizer +Date: Tue Oct 8 05:54:50 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 8227a3dde2995ceb113164baf49591d52c2b53e1 +Merge: 8a2d432f 0c0774f6 +Author: Patrick Schleizer +Date: Tue Oct 8 05:53:48 2024 -0400 + + Merge pull request #273 from raja-grewal/text_2 + + Documentation update 2 + +commit 0c0774f6c0927ed1cc599f931175985b8f01ec30 +Merge: dc470cac 8a2d432f +Author: raja-grewal +Date: Sun Oct 6 10:48:52 2024 +0000 + + Merge branch 'master' into text_2 + +commit dc470cac1d93656354aeaaac0a6f8cbbd39f9f0f +Author: raja-grewal +Date: Sun Oct 6 10:46:05 2024 +0000 + + Remmove deprecated link + +commit 8a2d432ffe6d4eb661026b6e7dbf534bb1db971b +Author: Patrick Schleizer +Date: Thu Oct 3 07:22:23 2024 +0000 + + bumped changelog version + +commit 0e3ffa3f11a0049e57803c8f2e75dbb7d8ceb22c +Author: Patrick Schleizer +Date: Thu Oct 3 02:58:58 2024 -0400 + + no longer set `kernel.unprivileged_userns_clone=0` + + because it breaks too much + + fixes https://github.com/Kicksecure/security-misc/issues/274 + +commit f401d94d5e0d0f26e93be55deda440fe565a6b22 +Author: Patrick Schleizer +Date: Thu Oct 3 02:44:06 2024 -0400 + + expand documentation on `kernel.unprivileged_userns_clone=0` sysctl + + https://github.com/Kicksecure/security-misc/issues/274 + +commit ac1378743c7448c9a7e7e02bebcf3270592d42a5 +Author: raja-grewal +Date: Mon Sep 30 16:56:18 2024 +1000 + + Consistent formatting + +commit eae38e72f30ff9b9f8d0b8b0b33182a918333e48 +Author: raja-grewal +Date: Thu Sep 26 13:10:36 2024 +0000 + + README.md: Show the current max_map_count + +commit f3b50a23c976ba4feff34eee721c50f698ecc5bf +Author: raja-grewal +Date: Thu Sep 26 13:10:01 2024 +0000 + + Add reference on unprivileged_userns_restriction + +commit 39d063d494cb540f45747f6253ab896200ba03c3 +Author: raja-grewal +Date: Thu Sep 26 13:09:21 2024 +0000 + + Add KSPP=no definition + +commit 5572eb897a10455041df8abec6b6be6de29431a0 +Author: Patrick Schleizer +Date: Wed Sep 25 01:03:42 2024 +0000 + + bumped changelog version + +commit e04f9cd4c17305d5201aa973c34778e81508734b +Merge: 18d426f5 65aa9105 +Author: Patrick Schleizer +Date: Tue Sep 24 20:16:06 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 65aa910503c07f708abf20f78be2f519ef58764a +Merge: 18d426f5 870ff886 +Author: Patrick Schleizer +Date: Tue Sep 24 20:15:03 2024 -0400 + + Merge pull request #272 from raja-grewal/text + + Documentation update + +commit 870ff88605b8167c8882162cc3da005d71ca0cd3 +Author: raja-grewal +Date: Wed Sep 25 10:01:45 2024 +1000 + + Comment on Flatpak requiring unprivileged user namespaces + +commit 769767a96a5de2a8bc05e70ca490d8340b553061 +Author: raja-grewal +Date: Wed Sep 25 09:54:49 2024 +1000 + + Update mmap ASLR docs + +commit 18d426f521b2b1369fe68e143dc8a0be064d0dcc +Author: Patrick Schleizer +Date: Sat Sep 14 02:56:09 2024 +0000 + + bumped changelog version + +commit 3280dbd5d562d7f6b50118ac0da36c3285493be6 +Author: Patrick Schleizer +Date: Fri Sep 13 22:52:47 2024 -0400 + + Fix VirtualBox audio device ICH AC97. + + no longer `blacklist snd_intel8x0` + + Breaks VirtualBox audio device ICH AC97, which is unfortunately still required by some users. + https://www.kicksecure.com/wiki/Dev/audio + + Fixes https://github.com/Kicksecure/security-misc/issues/271 + +commit 1bc694fa124eaeb6e1517d2191a8fd97446872c4 +Author: Patrick Schleizer +Date: Sun Sep 8 17:41:30 2024 +0000 + + bumped changelog version + +commit 01908d505a59e7ec37cc3de3e1d49ff35ba127aa +Author: Patrick Schleizer +Date: Thu Sep 5 07:00:11 2024 -0400 + + readme + +commit e914028be7a48a3bfdf86e09c029011807f080d7 +Author: Patrick Schleizer +Date: Thu Sep 5 06:03:05 2024 -0400 + + add KSPP compliance status to readme based on comment by @raja-grewal + + https://github.com/Kicksecure/security-misc/issues/256#issuecomment-2330376651 + +commit 40fb14c654df94e9bdfb30ae55fc3bc4f0a0aef4 +Author: Patrick Schleizer +Date: Wed Sep 4 14:13:15 2024 +0000 + + bumped changelog version + +commit 5a255d4831470449a26b324a8f16594432bf834b +Merge: d618f9f3 563a8980 +Author: Patrick Schleizer +Date: Wed Sep 4 10:12:34 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 563a8980133e15e33ac95a631e37ecfff88f6f8f +Merge: 175945ec e61027a4 +Author: Patrick Schleizer +Date: Wed Sep 4 10:11:48 2024 -0400 + + Merge pull request #265 from raja-grewal/mmap_min_addr + + Set `sysctl vm.mmap_min_addr=65536` + +commit d618f9f35b8e8c6eee1e164a6ec300d63b1ee797 +Merge: 59374ce9 175945ec +Author: Patrick Schleizer +Date: Wed Sep 4 10:07:50 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 175945ec9a28bf1e5b0fa0d2ae2bd6546d6c6172 +Merge: b0a85441 3101035a +Author: Patrick Schleizer +Date: Wed Sep 4 10:05:47 2024 -0400 + + Merge pull request #268 from raja-grewal/panic_on_warn + + Enable `panic_on_warn=1` + +commit b0a8544182f6ff3c8c3f1068176ff5e9e4f557ef +Merge: 59374ce9 7393ba15 +Author: Patrick Schleizer +Date: Wed Sep 4 10:04:45 2024 -0400 + + Merge pull request #270 from raja-grewal/typo + + Small typo + +commit 7393ba159192fdfc45ef31a3fa60786f899dbf25 +Author: raja-grewal +Date: Wed Sep 4 23:23:24 2024 +1000 + + Typo + +commit 59374ce902127e2125addc2ebb57d0d856a63671 +Author: Patrick Schleizer +Date: Thu Aug 29 09:49:51 2024 +0000 + + bumped changelog version + +commit 7e2838ec077b53e41d468d5655290152761c8745 +Merge: 9c918eb4 0762794f +Author: Patrick Schleizer +Date: Thu Aug 29 05:06:07 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0762794ff684049a62b5b92b61177615a5376ad7 +Merge: 9c918eb4 6294729c +Author: Patrick Schleizer +Date: Thu Aug 29 04:46:26 2024 -0400 + + Merge pull request #269 from raja-grewal/tidy + + Minor correction + +commit 6294729c8ef24077cd342b4557653806c3aacd34 +Author: Raja Grewal +Date: Thu Aug 29 15:34:24 2024 +1000 + + Follow-up on https://github.com/Kicksecure/security-misc/commit/f70fe308a9f65873d34de2d1906d825f3a56e272 + +commit 3101035a3fd5fbe87c79e95e51dc2da39fee93d5 +Author: Raja Grewal +Date: Thu Aug 29 01:57:32 2024 +1000 + + Enable `panic_on_warn=1` + +commit 9c918eb4313b60dc15aa9fa4474a7977602030c1 +Author: Patrick Schleizer +Date: Wed Aug 28 11:01:37 2024 +0000 + + bumped changelog version + +commit f70fe308a9f65873d34de2d1906d825f3a56e272 +Author: Patrick Schleizer +Date: Wed Aug 28 06:49:50 2024 -0400 + + no longer set sysctl `fs.binfmt_misc.status=0` / + no longer disallow registering interpreters for miscellaneous binary formats + + causing file/folder permissions issue `d????????? ? ? ? ? ? .` + + Firefox no longer starting (probably not not a Firefox issue) + + https://github.com/Kicksecure/security-misc/issues/267 + +commit 463aa58f28b6389d0925fed87096b348b652cc16 +Merge: cf824ddb 328840c9 +Author: Patrick Schleizer +Date: Wed Aug 28 06:42:49 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 328840c933a583adc5458aa08c63fb627b31b298 +Merge: cf824ddb 9e91c98c +Author: Patrick Schleizer +Date: Wed Aug 28 06:38:57 2024 -0400 + + Merge pull request #264 from raja-grewal/kspp_compliance + + Add KSPP compliance notices to corresponding parameters and `sysctls` + +commit 9e91c98cc926e7a166458cd78e3c1d1ced23c753 +Author: Raja Grewal +Date: Mon Aug 26 12:40:04 2024 +1000 + + Add details on BPF hardening and split the `sysctl`s + +commit 2c356e8b0ef7db56e7b453535c8cb6c83fc2e3c6 +Author: Raja Grewal +Date: Mon Aug 26 11:34:12 2024 +1000 + + Add KSPP notice definitions + +commit 2841d789bebbd43f855b6ffb92a3a6f017007a72 +Author: Raja Grewal +Date: Mon Aug 26 11:21:26 2024 +1000 + + README: Update + +commit ac6602ac3531ae57603e8a9e5ac2ee1652164b23 +Author: Raja Grewal +Date: Mon Aug 26 11:19:20 2024 +1000 + + Add detail on disabling user namespaces breaking UPower + +commit 9dbd200be415c86e7039463c6269fad8395a4373 +Merge: 32de5e7c cf824ddb +Author: raja-grewal +Date: Mon Aug 26 11:08:21 2024 +1000 + + Merge branch 'Kicksecure:master' into kspp_compliance + +commit cf824ddb248957fd9e542c1a5adc5e90381f684c +Author: Patrick Schleizer +Date: Sun Aug 25 15:34:55 2024 +0000 + + bumped changelog version + +commit 500568e322b2e3623fc649209d671c7b9d9fa097 +Merge: 43d13b70 73900b59 +Author: Patrick Schleizer +Date: Sun Aug 25 11:01:58 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 73900b59db37d77bc24bd5088aae3cc760aacc69 +Merge: 43d13b70 1f51d4ee +Author: Patrick Schleizer +Date: Sun Aug 25 11:00:51 2024 -0400 + + Merge pull request #263 from raja-grewal/max_user_namespaces + + Provide option to disable user namespaces + +commit 43d13b70f12d2198a800054ce4d1ff901cc474f9 +Merge: 83537641 fae586c3 +Author: Patrick Schleizer +Date: Sun Aug 25 10:55:52 2024 -0400 + + Merge remote-tracking branch 'raja/syntax' + +commit 835376418d616699023f8e638666f43d34241863 +Merge: ae85fd5b 342caf82 +Author: Patrick Schleizer +Date: Sun Aug 25 10:48:25 2024 -0400 + + Merge remote-tracking branch 'raja/mod' + +commit ae85fd5b4ce6f4716f95332c19b79d3daa8f7220 +Author: Patrick Schleizer +Date: Sun Aug 25 14:33:40 2024 +0000 + + bumped changelog version + +commit 433b15f985545f531b87d09659bbbb89993b5a67 +Author: Raja Grewal +Date: Wed Aug 21 12:51:51 2024 +1000 + + README.md: Organise `sysctl`s + +commit af87a84b4f40b2ad9ac05dd9bce837665f239454 +Author: Raja Grewal +Date: Wed Aug 21 12:52:48 2024 +1000 + + README.md: Organise kernel boot parameters + +commit 32de5e7c49d301b62b838ba88550f58b02b6562b +Author: Raja Grewal +Date: Sun Aug 25 12:57:22 2024 +1000 + + Add details on oopses and warnings + +commit e4909b5e28e16f09de0e548c9221578ebe1190a3 +Author: Raja Grewal +Date: Sun Aug 25 12:47:04 2024 +1000 + + Add details on kernel panics + +commit 342caf82b20acc2931563449fafe9a98cbedaba2 +Author: Raja Grewal +Date: Wed Aug 21 12:52:48 2024 +1000 + + README.md: Organise kernel boot parameters + +commit b87a18d4050bbf2add5cc4920684876a440e65bb +Author: Raja Grewal +Date: Wed Aug 21 12:51:51 2024 +1000 + + README.md: Organise `sysctl`s + +commit 18ed77ecc93e9ee759a4990a32edb3dd671b8c26 +Author: Raja Grewal +Date: Wed Aug 21 12:50:14 2024 +1000 + + Refactor modprobe.d to minimise potential future merge conflicts + +commit 56b28e38264fe742b8d694176f1057c15574fc08 +Author: Raja Grewal +Date: Mon Aug 19 11:50:08 2024 +1000 + + Typo + +commit e61027a40e2ab82fac3ae4cfd5f91fd0a47f31e5 +Author: Raja Grewal +Date: Mon Aug 19 11:32:20 2024 +1000 + + Set `sysctl vm.mmap_min_addr=65536` + +commit 94dab1b7c503429e2fa91019a0183b2f36c6693f +Author: Raja Grewal +Date: Mon Aug 19 10:53:05 2024 +1000 + + Partial compliance with the KSPP on kernel panics + +commit 683110e7f02fa5fc6415354386552640cdb8758b +Author: Raja Grewal +Date: Mon Aug 19 01:34:14 2024 +1000 + + Correction + +commit 1f51d4eeb2b0c6e23ce64fb272eecb97e089324d +Author: Raja Grewal +Date: Sun Aug 18 13:53:11 2024 +1000 + + Add details on user namespaces + +commit 248e094b8e0bbf7892f79ad1c3ec77c7ed00d008 +Author: Raja Grewal +Date: Sat Aug 17 01:06:21 2024 +1000 + + Include KSPP compliance notices + +commit 759aee8150a2d1258d73217c071b25432d47496f +Author: Raja Grewal +Date: Fri Aug 16 22:54:57 2024 +1000 + + Provide option to disable user namespaces + +commit fae586c3c5e8382ca01c60f810b26d88189a5514 +Author: Raja Grewal +Date: Fri Aug 16 19:23:48 2024 +1000 + + Patch bug in existing `rp_filter` `sysctl` + +commit e962153f84c4cb8e13fb0cc25d611ae481c7a0c7 +Author: Patrick Schleizer +Date: Fri Aug 16 08:38:12 2024 +0000 + + bumped changelog version + +commit 40b12f5a2a4a40d7033569b11ad4e1c228e7389b +Merge: 12296c68 305467c6 +Author: Patrick Schleizer +Date: Fri Aug 16 04:30:29 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 305467c652af933bb5aa5a677b10a992a5f19cab +Merge: 12296c68 a5373afc +Author: Patrick Schleizer +Date: Fri Aug 16 04:25:43 2024 -0400 + + Merge pull request #245 from raja-grewal/blacklist_to_disable + + Update `/etc/modprobe.d/*` + +commit 12296c68dc0aaa3703e1c36f854a02de8db412fe +Merge: 4bc12b07 036bcea4 +Author: Patrick Schleizer +Date: Fri Aug 16 04:22:43 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 036bcea4e6757de094fcafdadcf56aaa90729d79 +Merge: ef60c5b1 81bf7a8f +Author: Patrick Schleizer +Date: Fri Aug 16 04:20:32 2024 -0400 + + Merge pull request #262 from raja-grewal/docs + + Miscellaneous updates to presentation + +commit 81bf7a8f90098a7107dcb3c783b87a168f5c090f +Merge: cea8e753 ef60c5b1 +Author: raja-grewal +Date: Fri Aug 16 16:57:01 2024 +1000 + + Merge branch 'Kicksecure:master' into docs + +commit ef60c5b153a521e1cfd522ac471a8ca6dc076d90 +Merge: 4bc12b07 b552b924 +Author: Patrick Schleizer +Date: Fri Aug 16 02:43:57 2024 -0400 + + Merge pull request #249 from raja-grewal/binfmt_misc + + Disallow registering interpreters for miscellaneous binary formats + +commit cea8e753786d100ebe961ad74a99925e54d47771 +Author: Raja Grewal +Date: Fri Aug 16 14:55:22 2024 +1000 + + Consistent formating + +commit 84376d23fc17d2ced890ffca0b05d15907d42a6f +Author: Raja Grewal +Date: Fri Aug 16 13:39:11 2024 +1000 + + Add details on ASLR and move to user space section + +commit a13298002350a39491a509d15633edb95a2e3edd +Author: Raja Grewal +Date: Fri Aug 16 13:24:25 2024 +1000 + + Update README.md + +commit 9212a4e93754a4505be3fcf0ff4b029c073d2f07 +Author: Raja Grewal +Date: Fri Aug 16 13:12:07 2024 +1000 + + Typos + +commit 23a77d4973ec20b2aaab6a9c3a9fd8a98034923e +Author: Raja Grewal +Date: Fri Aug 16 12:46:51 2024 +1000 + + Simplify syntax of some network-related `sysctl`'s + +commit e3a3207a4447568a17129afe9dde34debc465e21 +Author: Raja Grewal +Date: Fri Aug 16 12:41:36 2024 +1000 + + Clarify DMA hardening + +commit be9308e490f79a7b7788a744524d1d91cc870726 +Merge: 73db68db 4bc12b07 +Author: raja-grewal +Date: Fri Aug 16 11:45:43 2024 +1000 + + Merge branch 'Kicksecure:master' into docs + +commit 4bc12b07b42def786862b938e3f63c18cf874158 +Author: Patrick Schleizer +Date: Thu Aug 15 17:51:18 2024 +0000 + + bumped changelog version + +commit 9e61e37c17524b57f185b796f2ac19ba193205a8 +Merge: 89e816dd dfd1c971 +Author: Patrick Schleizer +Date: Thu Aug 15 13:47:33 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit dfd1c97168249b229495cbd873d4d8493e244663 +Merge: 89e816dd ec3038c7 +Author: Patrick Schleizer +Date: Thu Aug 15 13:46:30 2024 -0400 + + Merge pull request #248 from raja-grewal/secure_redirects + + Re-enable (default) `secure_redirects` for ICMP redirect messages + +commit b552b92401f67d59e12ac6fda2f7fe1c54b0c8a7 +Author: Raja Grewal +Date: Thu Aug 15 11:54:21 2024 +1000 + + Add references on `fs.binfmt_misc.status` + +commit 326d82a9beee130956dd817812016a6ee16fccbc +Author: Raja Grewal +Date: Thu Aug 15 11:46:56 2024 +1000 + + Revert "Provide optional `sysctl fs.binfmt_misc.status=0`" + + This reverts commit debd7a7b7ae8b03e04d2c8597bcccf2c79000570. + +commit 73db68dbf9a1f9ded95a593db36a4960ce06a173 +Author: Raja Grewal +Date: Fri Aug 9 14:27:30 2024 +1000 + + Add details on KFENCE + +commit f8fa89b245d929aee9884937fdcf44a6551df4cf +Author: Raja Grewal +Date: Fri Aug 9 14:21:59 2024 +1000 + + Add details on `tcp_timestamps` + +commit 3456f1c1d7725846ec201c28dd693bf9b07bab89 +Author: Raja Grewal +Date: Fri Aug 9 13:39:25 2024 +1000 + + Minor consistency update in README.md + +commit 15c638acad64cc3dcc7b5c43d9a6be2fa2350654 +Author: Raja Grewal +Date: Fri Aug 9 13:36:47 2024 +1000 + + Add reference on RDRAND + +commit 077bc48a26d1d3f5d1f758d7e251edccba64742b +Author: Raja Grewal +Date: Fri Aug 9 13:35:33 2024 +1000 + + Add reference on `rp_filter` + +commit d8bcec881f66604e29d6e0c1426635e2ad4979f1 +Author: Raja Grewal +Date: Fri Aug 9 13:33:32 2024 +1000 + + Add some notices for future Debian 13 rebase + +commit 0b0683499a6a21e3995a115c377eb19008bc4cd1 +Author: Raja Grewal +Date: Fri Aug 9 13:30:39 2024 +1000 + + Consistent line length formatting + +commit e5a38fc856c66d2bd6abc35fc08d4f2083ea8e54 +Author: Raja Grewal +Date: Fri Aug 9 13:30:15 2024 +1000 + + Typo + +commit a5373afc55e789f4657f3d843243e878e4afffa2 +Author: Raja Grewal +Date: Wed Aug 7 14:44:14 2024 +1000 + + Details on disabled `fbdev` kernel modules + +commit e98dc8c4f8af32dd3b10c034477fd2154df189ac +Author: Raja Grewal +Date: Wed Aug 7 14:14:47 2024 +1000 + + Update notifications for disabled kernel modules + +commit 50fa721fd54cd696ae90a35bc7df7c8f1eb17a13 +Author: Raja Grewal +Date: Wed Aug 7 14:01:49 2024 +1000 + + Update docs regarding Intel module disabling + +commit ec3038c7bc625f6c8eddb753ffe295ff2697a717 +Author: Raja Grewal +Date: Wed Aug 7 13:48:53 2024 +1000 + + Clarify `secure_redirects` + +commit debd7a7b7ae8b03e04d2c8597bcccf2c79000570 +Author: Raja Grewal +Date: Wed Aug 7 13:33:44 2024 +1000 + + Provide optional `sysctl fs.binfmt_misc.status=0` + +commit 89e816dda6c5a00512b276071c4d9fe108ee63b5 +Author: Patrick Schleizer +Date: Tue Aug 6 14:01:39 2024 +0000 + + bumped changelog version + +commit 967f9e257b09bc73ddb579292d507f7cb9832643 +Merge: fa909186 a25aaf90 +Author: Patrick Schleizer +Date: Tue Aug 6 09:57:56 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit a25aaf900a12666046278a9fab6933b3d5670679 +Merge: 6bc039a4 85590793 +Author: Patrick Schleizer +Date: Tue Aug 6 09:55:20 2024 -0400 + + Merge pull request #260 from raja-grewal/vdso32 + + Enable `vdso32=0` + +commit 6bc039a430289342f06857a52a5f13829d6e50f5 +Merge: ce60d561 d102ec19 +Author: Patrick Schleizer +Date: Tue Aug 6 09:52:56 2024 -0400 + + Merge pull request #259 from raja-grewal/kfence + + Enable `kfence.sample_interval=100` + +commit ce60d5615fe99e41c48d459f562d581a688c295a +Merge: b0278428 c0d140f2 +Author: Patrick Schleizer +Date: Tue Aug 6 09:48:08 2024 -0400 + + Merge pull request #258 from raja-grewal/legacy_tiocsti + + Enable `dev.tty.legacy_tiocsti=0` + +commit b0278428a73cd3d329aaa36626005e0c593331f0 +Merge: fa909186 aa34d865 +Author: Patrick Schleizer +Date: Tue Aug 6 09:39:04 2024 -0400 + + Merge pull request #257 from raja-grewal/slab_debug + + Enable `slab_debug=FZ` + +commit 8559079312adb4ed92e5f478120b408dfe7a1124 +Author: Raja Grewal +Date: Mon Aug 5 15:10:02 2024 +1000 + + Enable `vdso32=0` + +commit d102ec19972865032f12f90bffe3e592546f0267 +Author: Raja Grewal +Date: Mon Aug 5 15:07:56 2024 +1000 + + Enable `kfence.sample_interval=100` + +commit c0d140f2211e6490d13e3cd327005027c668905f +Author: Raja Grewal +Date: Mon Aug 5 15:06:34 2024 +1000 + + Enable `dev.tty.legacy_tiocsti=0` + +commit aa34d86598f5b846b007730104e4c99c59f9984d +Author: Raja Grewal +Date: Mon Aug 5 14:27:17 2024 +1000 + + Enable `slab_debug=FZ` + +commit 4f7f82016015f61002ac8f778b61968c572dc7dc +Author: Raja Grewal +Date: Mon Aug 5 14:16:33 2024 +1000 + + Add reference + +commit fa9091869d417c6494840d0cb32623037d70c8be +Merge: 06f0c271 725118c5 +Author: Patrick Schleizer +Date: Sun Aug 4 16:20:36 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 725118c5759b45118bbd2804492526ea2a7c1a81 +Merge: 6d97408a 6d211faf +Author: Patrick Schleizer +Date: Sun Aug 4 16:19:52 2024 -0400 + + Merge pull request #243 from raja-grewal/namespaces + + Restrict unprivileged user namespaces + +commit 06f0c27128a66c1074f405de3139651519e48204 +Merge: 8abc5ae8 6d97408a +Author: Patrick Schleizer +Date: Sun Aug 4 16:15:01 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 6d97408a6d2f002461ae6ca1d647fbf24bf1b99e +Merge: 8abc5ae8 6f14d68c +Author: Patrick Schleizer +Date: Sun Aug 4 16:11:46 2024 -0400 + + Merge pull request #255 from raja-grewal/SLUB + + Restore option to enable `slub_debug=FZ` + +commit 8abc5ae8f0f152c68f855f0e8d993880589c5d5c +Merge: de6f3ea7 eab66dad +Author: Patrick Schleizer +Date: Sun Aug 4 16:09:52 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit eab66dad0994e408c1beaade3fdcf2cd1d605b31 +Merge: de6f3ea7 ca2179bb +Author: Patrick Schleizer +Date: Sun Aug 4 16:08:32 2024 -0400 + + Merge pull request #254 from raja-grewal/patch + + Updates to kernel and `sysctl` hardening + +commit 6f14d68cdcad3784311e33029eba6906ea0784c2 +Author: Raja Grewal +Date: Sat Aug 3 15:12:15 2024 +1000 + + Update legacy name `slub_debug` -> `slab_debug` + +commit 22b6cee80c74aff3d0f9cd36822ae88f8fa8e601 +Author: Raja Grewal +Date: Sat Aug 3 15:11:14 2024 +1000 + + Add details about `slub_debug` + +commit b77d1a2b980ae20158aa628eec67b016282d0a40 +Author: Raja Grewal +Date: Sat Aug 3 14:49:48 2024 +1000 + + Revert "Remove the optional `slub_debug` parameter since it is no longer recommended" + + This reverts commit 48e1ac416314d2c66f3a0d5044a3c51cb6fb4093. + +commit ca2179bb6a01e3ebbb1e04e3507cc305f25bca4e +Author: Raja Grewal +Date: Sat Aug 3 00:25:49 2024 +1000 + + Provide the option to disable legacy TIOCSTI operation + +commit 52aeacb4da4a8458b0ffdc1ade4094a178def6f4 +Author: Raja Grewal +Date: Sat Aug 3 00:13:38 2024 +1000 + + Provide option to disable 32 bit vDSO mappings + +commit 9099ecce8ae12352f2b739d3d7adf6069488ff49 +Author: Raja Grewal +Date: Sat Aug 3 00:12:50 2024 +1000 + + Provide option to enable the kernel Electric-Fence + +commit f6a16258a116ce5c5f4f6bad9d8ab9b6e1ec6bb7 +Author: Raja Grewal +Date: Sat Aug 3 00:11:06 2024 +1000 + + Add references to KSPP + +commit e53d24fc48b51a21fc182cc59890e97a1d7ac647 +Author: Raja Grewal +Date: Sat Aug 3 00:09:42 2024 +1000 + + Add missing GRUB command lines for disabled boot parameters + +commit de6f3ea74a5a1408e4351c955ecb7010825364c5 +Author: Patrick Schleizer +Date: Sun Jul 28 20:50:22 2024 +0000 + + bumped changelog version + +commit d036094089e3e3a74df981c50882481273fcb6c0 +Merge: e60ce50d 0f86fbd8 +Author: Patrick Schleizer +Date: Sun Jul 28 15:44:40 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0f86fbd8ceea3157ee035eb9f4a0ff13024f1bc9 +Merge: e60ce50d 73979d43 +Author: Patrick Schleizer +Date: Sun Jul 28 15:43:54 2024 -0400 + + Merge pull request #242 from raja-grewal/ptrace + + Disable the usage of `ptrace()` by all processes + +commit 9cabaa1bd15a0639c87bf2e965755d06ff0a7bb4 +Author: Raja Grewal +Date: Sun Jul 28 22:04:30 2024 +1000 + + Typo + +commit d2d024ebe9a371eaf90b7b72f8a227e5d2e9babe +Author: Raja Grewal +Date: Sun Jul 28 22:03:33 2024 +1000 + + Typo + +commit 9fbee9fc82768c3b436307459d174378ee471335 +Author: Raja Grewal +Date: Sun Jul 28 21:57:25 2024 +1000 + + Clarify + +commit e60ce50d30c8981f13d8bab1d6ca8b8efb9d8928 +Author: Patrick Schleizer +Date: Sat Jul 27 16:13:35 2024 +0000 + + bumped changelog version + +commit e86b2e7f8fcda5727b158579610cb6a0354e89cf +Author: Patrick Schleizer +Date: Sat Jul 27 12:13:18 2024 -0400 + + output + +commit 144545762674e914046bb94100237329320e8ece +Author: Raja Grewal +Date: Sat Jul 27 14:00:30 2024 +1000 + + Show details regarding `secure_redirects` (again) + +commit 73979d4342dae2017be52d5182bb66fa28be398d +Author: Raja Grewal +Date: Sat Jul 27 13:28:59 2024 +1000 + + Link to `ptrace()` discussion + +commit 1c9f33f90606fb930744f1b9afc11caf87626194 +Author: Raja Grewal +Date: Sat Jul 27 13:24:08 2024 +1000 + + Revert "Disable the usage of `ptrace()` by all processes" + + This reverts commit b04828f858fa6d101099773d3156841fd6d33b6f. + +commit 330cf14eab248d035fa467dba4f7bc3eb92a33bb +Author: Patrick Schleizer +Date: Fri Jul 26 15:40:24 2024 +0000 + + bumped changelog version + +commit 62bb4bc6269a0603c15f1efaad7ca365ea15c9d7 +Merge: 7969e860 886f6095 +Author: Patrick Schleizer +Date: Fri Jul 26 11:10:25 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 886f6095dba71d76d5fd98277374417657e0cd31 +Merge: 7969e860 ed333669 +Author: Patrick Schleizer +Date: Fri Jul 26 11:08:30 2024 -0400 + + Merge pull request #250 from raja-grewal/Panik-Kalm + + Add details on "oopes" and kernel panics + +commit 7969e8607160eae0cb5a3adddeec8d07c1d6e097 +Merge: e2ae93a9 0318f577 +Author: Patrick Schleizer +Date: Fri Jul 26 11:06:13 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0318f577ab554ae2ac0f9417b18134723ea2b580 +Merge: e2ae93a9 4397de01 +Author: Patrick Schleizer +Date: Fri Jul 26 11:04:29 2024 -0400 + + Merge pull request #246 from raja-grewal/cfi + + Provide the option to change the default CFI implementation in the future + +commit e2ae93a9571f2f0c9077ea61436a540a3be5a894 +Author: Patrick Schleizer +Date: Fri Jul 26 10:30:45 2024 -0400 + + port to safe_echo + +commit 8ec23ed7128580ed0092df43945ba55e94163a6d +Author: Patrick Schleizer +Date: Fri Jul 26 10:28:57 2024 -0400 + + echo does not support end-of-options + +commit 6096ed1109a0d5a62a844552fee500ebe66071c8 +Author: Patrick Schleizer +Date: Fri Jul 26 10:26:43 2024 -0400 + + comment + +commit ac41d1cfff8b722248a5ef1dfe38a8c704f04134 +Author: Patrick Schleizer +Date: Fri Jul 26 10:25:59 2024 -0400 + + comment + +commit 3b033ceba24e5e14056d54710d782397e5c669df +Author: Patrick Schleizer +Date: Fri Jul 26 10:17:24 2024 -0400 + + shellcheck + +commit 04d9ca1ebe79cae5cce04b6533285b8d1299d692 +Author: Patrick Schleizer +Date: Fri Jul 26 10:16:20 2024 -0400 + + use `find` with `safe_echo_nonewline` + +commit 20454fb81157f1f962f36d9c37d34f4ac650a1e6 +Merge: 28b25bda 6bbf176e +Author: raja-grewal +Date: Sat Jul 27 00:09:30 2024 +1000 + + Merge branch 'Kicksecure:master' into blacklist_to_disable + +commit 6bbf176e3b91f842cf4cdeaf8cb1f4c60e159a0c +Author: Patrick Schleizer +Date: Fri Jul 26 09:33:45 2024 -0400 + + consider end-of-options for `find` + +commit 794f6a25fa87a9d6d796b07ee06b690ea0badc92 +Author: Patrick Schleizer +Date: Fri Jul 26 09:08:29 2024 -0400 + + comment + +commit 7e0f1a87010674c63963b70c87e903cf27b288ef +Author: Patrick Schleizer +Date: Fri Jul 26 09:08:04 2024 -0400 + + dpkg-statoverride can actually handle '--file-name'. + +commit ee037c01a1208b9247c3ae144fa3faa68657ffdb +Author: Patrick Schleizer +Date: Fri Jul 26 08:58:44 2024 -0400 + + Skip file names starting with '--', + + because this would be interpreted by dpkg-statoverride as an option. + +commit 82d401a7de58b74448113bed36c8f0cc073c7f82 +Author: Patrick Schleizer +Date: Fri Jul 26 08:52:42 2024 -0400 + + sanity test + +commit 0e661bc688c7222840c9d83fb3ccab6549b3ac11 +Author: Patrick Schleizer +Date: Fri Jul 26 08:49:14 2024 -0400 + + output + +commit d144f68d1a06a1153c4178b2f6ba9643dededbb8 +Author: Patrick Schleizer +Date: Fri Jul 26 08:46:08 2024 -0400 + + output + +commit 05504b9ab251ae6e48b5d28eb5fdcd12d730ea8a +Author: Patrick Schleizer +Date: Fri Jul 26 08:40:10 2024 -0400 + + minor + +commit d96c0633d431dafd034ae8d1ae0ffbb59c49be4a +Author: Patrick Schleizer +Date: Fri Jul 26 08:39:11 2024 -0400 + + more use of end of options + +commit 8e40c10c319a76e0256c8f135182b0ca7f532f85 +Author: Patrick Schleizer +Date: Fri Jul 26 08:31:17 2024 -0400 + + comment + +commit f2c9c2f5d1b59127b22fae4dd4b8bb7a6f98a485 +Author: Patrick Schleizer +Date: Fri Jul 26 08:26:16 2024 -0400 + + output + +commit 2b40ea75e9c3f679fd09ae331a56f294c3ac7607 +Author: Patrick Schleizer +Date: Fri Jul 26 08:24:23 2024 -0400 + + cleanup + +commit 6f0551b944cbf83d82f7a1a554c4461bc971520b +Author: Patrick Schleizer +Date: Fri Jul 26 08:23:54 2024 -0400 + + refactoring + +commit aac450f80836b03478b9e2632afc5a4519f9b37a +Author: Patrick Schleizer +Date: Fri Jul 26 08:22:04 2024 -0400 + + refactoring + +commit 30f46790a4df7662926fa43d44ac34c3286dd590 +Author: Patrick Schleizer +Date: Fri Jul 26 08:21:21 2024 -0400 + + use end of options whenever possible + +commit 95722d6d7902367afb44175263a8628df9ad01b2 +Author: Patrick Schleizer +Date: Fri Jul 26 08:13:33 2024 -0400 + + use long option name + +commit 19f131c7426aaa5199504e75aba180a7771a2520 +Author: Patrick Schleizer +Date: Fri Jul 26 08:07:08 2024 -0400 + + code simplification + + https://github.com/Kicksecure/security-misc/pull/251 + +commit 9694cf0cd1a225c68d45814e0f4d6995659a0066 +Author: Patrick Schleizer +Date: Fri Jul 26 07:43:59 2024 -0400 + + output + +commit bdfe764f9d805b14dca4196e623e81ce95145d9b +Merge: 9f135231 652a06c8 +Author: Patrick Schleizer +Date: Fri Jul 26 07:19:05 2024 -0400 + + Merge remote-tracking branch 'ben-grande/stat-dedup' + +commit 9f135231ccdc3f6eba27db2e1794eff23f03fc0f +Author: Patrick Schleizer +Date: Fri Jul 26 06:43:01 2024 -0400 + + no longer disable Intel ME related kernel modules + + because that might break firmware updates + + This reverts commit 64f8b2eb5870664fca06aa060f2f50af358ced55. + + https://github.com/Kicksecure/security-misc/issues/239 + +commit f616da7c0690fc0dffc21be59174ed8754ec55fb +Author: Patrick Schleizer +Date: Fri Jul 26 09:40:59 2024 +0000 + + bumped changelog version + +commit 4397de0138dac47aee66570fcfe4ef38c8179321 +Author: Raja Grewal +Date: Fri Jul 26 11:30:46 2024 +1000 + + Update description of `cfi=kcfi` kerenel parameter + +commit 652a06c8e9f841e043cc5b5fb030b149cb70dc85 +Author: Ben Grande +Date: Thu Jul 25 12:37:21 2024 +0200 + + Only print SUID or SGID values when set + +commit 3b8a3f9b832ee1eee959fbcce8b5eed417d4712e +Author: Ben Grande +Date: Thu Jul 25 12:20:16 2024 +0200 + + Unduplicate stat call + +commit 28b25bda3f51c7d5a6ee6d28446cb5f731f452d0 +Author: Raja Grewal +Date: Thu Jul 25 15:51:32 2024 +1000 + + Partial inclusion of GrapheneOS infrastructure blacklist + +commit ed3336694ce35614ab47db42bce29d3c69d46752 +Author: Raja Grewal +Date: Thu Jul 25 10:28:27 2024 +1000 + + Provide the option to immediately reboot on a kernel panics + +commit 3926b91dcf371377d38c747e5c7718ac2fed3c83 +Author: Raja Grewal +Date: Thu Jul 25 10:26:23 2024 +1000 + + Add documentation on `sysctl kernel.panic_on_oops=1` + +commit f699eb02a27ef54b9ced5866447b63152984af66 +Author: Raja Grewal +Date: Thu Jul 25 10:11:33 2024 +1000 + + Set `sysctl fs.binfmt_misc.status=0` + +commit 9231f058911ab9059e91c4c0c1677ef66b5bb666 +Author: Patrick Schleizer +Date: Wed Jul 24 13:31:49 2024 -0400 + + todo + +commit 4cc1289e89b341e15725d65e405e607ea4784f9f +Author: Patrick Schleizer +Date: Wed Jul 24 13:30:30 2024 -0400 + + output + +commit 10c73b326f824f783169383888b9464965a53cbb +Author: Patrick Schleizer +Date: Wed Jul 24 12:07:26 2024 -0400 + + fix delimiter parsing + +commit a16dd8474bf72c2b8c63adc7500140e89d19fedb +Author: Patrick Schleizer +Date: Wed Jul 24 11:50:30 2024 -0400 + + sanity test + +commit cc2b335ee692cc04a2c4e298902f3503927b2c50 +Author: Patrick Schleizer +Date: Wed Jul 24 11:48:32 2024 -0400 + + cleanup + +commit 6cadc70a96cd709fb7a94abcb14e7dd97c57fdb8 +Author: Patrick Schleizer +Date: Wed Jul 24 11:47:52 2024 -0400 + + output + +commit cda0d26af7c057dab8edf4897f98c2e8f83e3d56 +Author: Patrick Schleizer +Date: Wed Jul 24 11:45:13 2024 -0400 + + cannot use NULL inside a bash variable + + use custom delimiter instead + +commit 4a5312b3a9419c8b3e07dda2b650d5fbf9a38d34 +Author: Patrick Schleizer +Date: Wed Jul 24 11:27:51 2024 -0400 + + output + +commit 3bf1f26c0bb271d63c16b314e4da040abf5b3713 +Author: Patrick Schleizer +Date: Wed Jul 24 11:20:26 2024 -0400 + + downgrade warning of non-existing folders to info + + to avoid all users by default getting a warning for expected non-existing folders + +commit 151ca659a9f5565744ff57f3b581c8c051def148 +Author: Patrick Schleizer +Date: Wed Jul 24 11:19:15 2024 -0400 + + output + +commit c9fd2ceb61ea176c731432f02a9fa40652fbddc8 +Author: Patrick Schleizer +Date: Wed Jul 24 11:13:35 2024 -0400 + + downgrade warning of non-existing files to info + + to avoid all users by default getting a warning for expected non-existing files + +commit 721392901be384014298f59deb57747b825c8b37 +Author: Patrick Schleizer +Date: Wed Jul 24 11:12:39 2024 -0400 + + remove duplicate test + +commit 9712b5b4e3cff3eac8ef03b5e562ff89d74ef4b8 +Author: Patrick Schleizer +Date: Wed Jul 24 11:12:18 2024 -0400 + + output + +commit 00911df5c1de24960ad6d21b4cd99450f2d08a88 +Author: Patrick Schleizer +Date: Wed Jul 24 11:10:56 2024 -0400 + + modify call of stat to use NUL delimiter + + for more robust string parsing + +commit d5366835112cc5fabef7ec46a9c582c08121cb14 +Author: Patrick Schleizer +Date: Wed Jul 24 11:03:28 2024 -0400 + + local clean_output_prefix clean_output + +commit a6e517736b83c124cf8cec52bac184612a29ad0d +Author: Patrick Schleizer +Date: Wed Jul 24 11:02:25 2024 -0400 + + local stat_output + +commit ced02fb9e03e12c7d51923511e7d6a54b09a6274 +Author: Patrick Schleizer +Date: Wed Jul 24 11:01:24 2024 -0400 + + add sanity test for file_name output from stat + +commit b9dfe70a016e46e1f275918be19890526182cfa2 +Author: Patrick Schleizer +Date: Wed Jul 24 10:58:05 2024 -0400 + + check first if file_name is empty + +commit 1cbda7998196dc04e83c48526d15f9ad5f11e6c9 +Author: Patrick Schleizer +Date: Wed Jul 24 10:57:13 2024 -0400 + + check first if array is empty before parsing further + +commit a077ae54ea050af8828813b781738cba24e27624 +Author: Patrick Schleizer +Date: Wed Jul 24 10:56:08 2024 -0400 + + modify call of stat to use NUL delimiter + + for more robust string parsing + +commit 1135d34ab334c9b39e51a147dc94df568f982512 +Author: Raja Grewal +Date: Wed Jul 24 23:33:36 2024 +1000 + + Reword description of `cfi=kcfi` kerenel parameter + +commit 7200e9bd8c793f5ea30c3448fd03fbd38c6292b5 +Author: Patrick Schleizer +Date: Wed Jul 24 09:15:02 2024 -0400 + + output + +commit 1b6161c2dcd9a0686503c84cda4c9f6a29fe4e02 +Merge: d2563ed9 8be21b6e +Author: Patrick Schleizer +Date: Wed Jul 24 09:13:48 2024 -0400 + + Merge remote-tracking branch 'ben-grande/fuzz' + +commit 88c88187f2909322211cc08598717068ea7cf1d1 +Author: Raja Grewal +Date: Wed Jul 24 17:26:50 2024 +1000 + + Re-enable (default) `secure_redirects` for ICMP redirect messages + +commit 8be21b6eff40fdd3909ef63468463fc52e8bf45f +Author: Ben Grande +Date: Tue Jul 23 19:36:12 2024 +0200 + + Handle newlines in file names + +commit aa99de68d307cd88462665424996d9b730ab5087 +Author: Ben Grande +Date: Tue Jul 23 18:46:47 2024 +0200 + + Log output with defined levels + +commit 06fbcdac1de6f1830d911f05a4f7c14fd522fad4 +Author: Ben Grande +Date: Tue Jul 23 09:55:02 2024 +0200 + + Prettify log messages + +commit fb494c2ba5b7fd0f864a59896710d9cddf92b458 +Author: Raja Grewal +Date: Tue Jul 23 13:12:13 2024 +1000 + + Update docs relating to the `cfi=kcfi` kernel parameter + +commit 7ee1ea2cc7dd62feee3243d64b414130e68d35e9 +Author: Ben Grande +Date: Mon Jul 22 17:06:07 2024 +0200 + + Unify functions that evaluate commands + +commit 9c3566f524f748b9f7c98a36b3f2b1064cdba3ed +Author: Ben Grande +Date: Mon Jul 22 16:01:14 2024 +0200 + + Delimit file names with null terminator + +commit d6fc71dba78a9c871015ebdde3bef61943369b47 +Author: Raja Grewal +Date: Mon Jul 22 17:26:00 2024 +1000 + + Add option to switch (back) to using kCFI in the future + +commit f582e543434ba20a2fb7f7300058f7c8a7d62878 +Merge: a189956a d2563ed9 +Author: raja-grewal +Date: Mon Jul 22 15:12:00 2024 +1000 + + Merge branch 'Kicksecure:master' into blacklist_to_disable + +commit d2563ed92317a029340dbb83f30da008b01325f2 +Author: Patrick Schleizer +Date: Sun Jul 21 10:40:14 2024 +0000 + + bumped changelog version + +commit 64f8b2eb5870664fca06aa060f2f50af358ced55 +Author: Patrick Schleizer +Date: Sun Jul 21 06:36:22 2024 -0400 + + Revert "no longer disable Intel ME related kernel modules" + + This reverts commit 6157e328f40a7f3780208489b1ffecef8e6d738a. + + https://www.kicksecure.com/wiki/Out-of-band_Management_Technology#Intel_ME_Kernel_Modules + + https://github.com/Kicksecure/security-misc/issues/239 + +commit 4cae74d610ad37066e8a334019cfa5c82f088a2e +Author: monsieuremre +Date: Sun Jul 21 11:19:32 2024 +0200 + + Update 30_security-misc.conf + +commit 04fb00572f2e4c9bdfaaa0f6da8007999daab641 +Author: Patrick Schleizer +Date: Sat Jul 20 17:02:05 2024 +0000 + + bumped changelog version + +commit f0a478c7c91697988926a73d3a1880dd8caaca68 +Author: Patrick Schleizer +Date: Sat Jul 20 12:57:56 2024 -0400 + + permission hardener: allow postfix + + postqueue matchwhitelist + postdrop matchwhitelist + +commit a189956adc2cf5a1c8311d0e0e9c7cfbc6e4afe3 +Author: Raja Grewal +Date: Sat Jul 20 20:11:09 2024 +1000 + + Typo + +commit 3c720a0715191c858e8d1df9795dddfea5dbdcf1 +Author: Raja Grewal +Date: Sat Jul 20 15:03:21 2024 +1000 + + Disable some legacy drivers + These were all previously blacklisted for over 2 years. + +commit c4965ed838b1df93ddb9e947fb2f0d23fa8ffc17 +Author: Raja Grewal +Date: Sat Jul 20 14:55:10 2024 +1000 + + Disable legacy framebuffer drivers + These were all previously blacklisted for over 2 years. + +commit 9f53a0182b5f6a7cf8228bf19b04661d39c7a2fe +Author: Patrick Schleizer +Date: Fri Jul 19 07:20:59 2024 -0400 + + undo io_uring related changes + + as these should be done in a separate pull request (if apprpriate) + + https://github.com/Kicksecure/security-misc/pull/244#issuecomment-2238889062 + +commit 8791aecb38a41aa0b0c108505726bc6a1ace903e +Merge: 2d114364 06894d1c +Author: Patrick Schleizer +Date: Fri Jul 19 07:19:09 2024 -0400 + + Merge remote-tracking branch 'raja/fixes' + +commit 06894d1c98e91f43af58cc438559ea76b6a361e3 +Author: Raja Grewal +Date: Fri Jul 19 18:30:42 2024 +1000 + + Typo + +commit 2d11436432d3b2b75f84b05550de06cd77ec6e79 +Author: Patrick Schleizer +Date: Thu Jul 18 18:05:07 2024 +0000 + + bumped changelog version + +commit cac5bbad99a9c083c5b5f85f07c7368287c64f72 +Author: Patrick Schleizer +Date: Thu Jul 18 14:04:00 2024 -0400 + + comment + +commit a5eed00eba76f83c310f62d000830f38b0e87d21 +Author: Patrick Schleizer +Date: Thu Jul 18 14:02:38 2024 -0400 + + cleanup comments + +commit 21efacf1b111d9599e72cef23b791cf4961c04c3 +Author: Patrick Schleizer +Date: Thu Jul 18 14:00:28 2024 -0400 + + cleanup duplicate comments which are already in `/etc/dkms/framework.conf` + +commit 61628c2baf58ca2859bc5fc99782985ef0822750 +Author: Patrick Schleizer +Date: Thu Jul 18 14:11:35 2024 +0000 + + bumped changelog version + +commit 05cf438199ca75f96cf8e67131f4a409b465e7e7 +Author: Patrick Schleizer +Date: Thu Jul 18 10:11:03 2024 -0400 + + no comments / copyright allowed in .displace-extension + +commit 2ccc95f6d44bacd3da97d586542695f33d5faf38 +Author: Patrick Schleizer +Date: Thu Jul 18 14:05:23 2024 +0000 + + bumped changelog version + +commit 95286df50274953326accb615487e21d409b652a +Author: Raja Grewal +Date: Thu Jul 18 15:28:31 2024 +1000 + + Update README.md regarding secure ICMP redirects + +commit 13cc1f0986033855a399b50442a86a8d8552eb96 +Author: Raja Grewal +Date: Thu Jul 18 12:25:00 2024 +1000 + + Clarify (future) disabling of `io_uring` + +commit 9e6facda7017498e8310a9c39403e95e81c5a903 +Author: Raja Grewal +Date: Thu Jul 18 12:21:37 2024 +1000 + + Update module disabling presentation + +commit faa9181a6c0c78b9471c9a4e6bdd3291aec704f6 +Author: Raja Grewal +Date: Thu Jul 18 12:19:27 2024 +1000 + + Typos + +commit 6d211faf591608ea6e7f484e8bc69dd567877abf +Author: Raja Grewal +Date: Thu Jul 18 11:04:54 2024 +1000 + + Restrict unprivileged user namespaces + +commit b04828f858fa6d101099773d3156841fd6d33b6f +Author: Raja Grewal +Date: Thu Jul 18 11:01:41 2024 +1000 + + Disable the usage of `ptrace()` by all processes + +commit d454f36c63bd653e47353fb1c93107b2d5584fe2 +Author: Patrick Schleizer +Date: Wed Jul 17 11:52:29 2024 -0400 + + spelling + +commit f4da582aa31b869413aef6f4e252b7985e961339 +Author: Patrick Schleizer +Date: Wed Jul 17 11:44:17 2024 -0400 + + spelling + +commit 9e976474d5d620be9e4f8d8a97f73c6cc3e64573 +Author: Patrick Schleizer +Date: Wed Jul 17 11:40:51 2024 -0400 + + spelling + +commit b569fc02a4650187e69b62b95439c05ee2611e91 +Author: Patrick Schleizer +Date: Wed Jul 17 11:38:53 2024 -0400 + + spelling + +commit a2e26f441b6f44831c7b1bf3bf9dc2cf6f06e176 +Author: Patrick Schleizer +Date: Wed Jul 17 11:04:03 2024 -0400 + + spelling + +commit c8be4ac83c2563798ee35d56200eb8d11a2c32e3 +Author: Patrick Schleizer +Date: Wed Jul 17 10:56:14 2024 -0400 + + comment + +commit 24cd70a014b221b25669755b955bc114fe083643 +Author: Patrick Schleizer +Date: Wed Jul 17 10:55:12 2024 -0400 + + spelling + +commit 5cec685cf9b0845838f17fba78ac65d6c2e63386 +Author: Patrick Schleizer +Date: Wed Jul 17 10:49:21 2024 -0400 + + spelling + +commit 821a416fe39e11ca030c63f25a5220772d80eae5 +Author: Patrick Schleizer +Date: Wed Jul 17 10:43:16 2024 -0400 + + spelling + +commit 9a387f95e9346030e2adc3252a45942949561b52 +Merge: fd41acdc 4afe257a +Author: Patrick Schleizer +Date: Wed Jul 17 10:32:26 2024 -0400 + + Merge remote-tracking branch 'raja/miscellaneous' + +commit fd41acdc721a6463813bc347cb965b6211fb9447 +Merge: 0da22c20 1087387b +Author: Patrick Schleizer +Date: Wed Jul 17 10:27:31 2024 -0400 + + Merge remote-tracking branch 'raja/fack_off' + +commit 4afe257a42576158a54a68948440a2b4c043b67c +Author: Raja Grewal +Date: Thu Jul 18 00:14:13 2024 +1000 + + minor + +commit d0a59617f6b8a90fd5c758699e910af9d7496c98 +Author: Raja Grewal +Date: Thu Jul 18 00:13:30 2024 +1000 + + Add missing Copyright (C) statements + +commit 8f3896c3dac13b604e36d4249f976598f271a215 +Author: Raja Grewal +Date: Wed Jul 17 23:44:37 2024 +1000 + + Upgrade hyperlinks to HTTPS + +commit 1087387b362d5598e44262db07ab0fff9118b064 +Author: Raja Grewal +Date: Wed Jul 17 23:35:25 2024 +1000 + + Remove obsolete `#net.ipv4.tcp_fack=0` + +commit 0da22c20316c8f0f574e0127926506e52ccbc269 +Author: Patrick Schleizer +Date: Wed Jul 17 09:07:31 2024 -0400 + + minor + +commit c336b266f61528cce27e1cafac6377370927a787 +Merge: afe3c25a df803852 +Author: Patrick Schleizer +Date: Wed Jul 17 09:06:44 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit df80385289717fee0266436d056c9aedd0fb06af +Merge: afe3c25a 724435e5 +Author: Patrick Schleizer +Date: Wed Jul 17 09:04:18 2024 -0400 + + Merge pull request #237 from raja-grewal/intel_pmt + + Disable some Intel PMT kernel modules + +commit afe3c25a49940f7f322414c08e8dbd631e696215 +Author: Patrick Schleizer +Date: Wed Jul 17 08:58:00 2024 -0400 + + update readme + + https://github.com/Kicksecure/security-misc/issues/239 + +commit f7772fb85a1fe6d3c0749e5f34fc29111b6a8125 +Author: Patrick Schleizer +Date: Wed Jul 17 08:57:35 2024 -0400 + + minor + +commit 6157e328f40a7f3780208489b1ffecef8e6d738a +Author: Patrick Schleizer +Date: Wed Jul 17 08:52:11 2024 -0400 + + no longer disable Intel ME related kernel modules + + https://github.com/Kicksecure/security-misc/issues/239 + +commit daee8b900b3057235aedc17b1231c3c05599140c +Merge: 954ff1be a4ba6e48 +Author: Patrick Schleizer +Date: Wed Jul 17 08:47:55 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit a4ba6e485d94512fdf737b9f66137c3f692c9904 +Merge: 9a751356 abafb194 +Author: Patrick Schleizer +Date: Wed Jul 17 08:46:27 2024 -0400 + + Merge pull request #236 from raja-grewal/intel_me + + Disable more Intel ME kernel modules + +commit 954ff1be41288b5fa2e50d492d92544915f93bb5 +Merge: d29a6161 9a751356 +Author: Patrick Schleizer +Date: Wed Jul 17 08:42:52 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 9a75135633ad172f7cbf318e1206865493c28bb4 +Merge: d29a6161 a3408990 +Author: Patrick Schleizer +Date: Wed Jul 17 08:41:43 2024 -0400 + + Merge pull request #238 from raja-grewal/uvcvideo_2 + + Minor additions to `30_security-misc_disable.conf` + +commit d29a616142562492db6c45c299f002100e905828 +Author: Patrick Schleizer +Date: Wed Jul 17 08:39:20 2024 -0400 + + minor + +commit a2802f352fc7021ead0d431c665cc16b2821ae0b +Merge: 0b873b76 81a3715c +Author: Patrick Schleizer +Date: Wed Jul 17 08:38:23 2024 -0400 + + Merge remote-tracking branch 'raja/kargs' + +commit 0b873b765e20b06113d808075fa95c8acbb1e0fc +Author: Patrick Schleizer +Date: Wed Jul 17 08:05:27 2024 -0400 + + minor + +commit 070bb46a08afcd84fb638472c39bd543bad4fb17 +Merge: 6d6e5473 25fd532c +Author: Patrick Schleizer +Date: Wed Jul 17 08:02:45 2024 -0400 + + Merge remote-tracking branch 'raja/sysctl' + +commit 6d6e5473f2778a2a5b1ca7826d0a3a5a63cff08a +Author: Patrick Schleizer +Date: Wed Jul 17 08:00:24 2024 -0400 + + minor + +commit cf5f0edbb85589a72ec891e9c3e090f9e81c4fda +Merge: fe5c840b 693b47e6 +Author: Patrick Schleizer +Date: Wed Jul 17 07:59:35 2024 -0400 + + Merge remote-tracking branch 'raja/sysctl' + +commit 25fd532ce62399d5bb42d844ad32b5128eaf748d +Author: Raja Grewal +Date: Wed Jul 17 21:56:40 2024 +1000 + + Update README.md relating to `sysctl`'s + +commit 39fd125eb0f0c16c8a64933bbd04709287a2686a +Author: Raja Grewal +Date: Wed Jul 17 21:44:44 2024 +1000 + + Provide explanation on the disabling of IPv6 Privacy Extensions + +commit a3408990ab439e6edbf8691cf7d65fb16c0d24df +Author: Raja Grewal +Date: Wed Jul 17 15:03:39 2024 +1000 + + Uncomment disabling of already disabled ATM modules + +commit 693b47e6235528ab7a9032818cce22fd63a4f5ea +Author: Raja Grewal +Date: Wed Jul 17 14:58:30 2024 +1000 + + Clarify ICMP redirect acceptance and sending + +commit 81a3715c7c0b73796a62297ebe55e861a46f7686 +Author: Raja Grewal +Date: Wed Jul 17 13:32:08 2024 +1000 + + Add info regarding the downsides of disabling SMT + +commit abafb1945cace774429fefd0c1a037fb2ec3f774 +Author: Raja Grewal +Date: Wed Jul 17 13:26:03 2024 +1000 + + Add Intel ME references + +commit f317aaebab126bafe3cfaef8159bf0820c392c87 +Author: Raja Grewal +Date: Wed Jul 17 01:09:02 2024 +1000 + + Disable two network modules + These were previously blacklisted for two years in https://github.com/Kicksecure/security-misc/commit/61ef9bd59f9ff39c140f782ff5b41d0a3c6d97bc. + +commit d69fe88091c7212a9af86306c797aed40398584b +Author: Raja Grewal +Date: Wed Jul 17 01:08:01 2024 +1000 + + Provide option to disable `uvcvideo` driver + +commit 49594ccb223c09d70f00434e5875c9dae1a2360d +Author: Raja Grewal +Date: Wed Jul 17 00:49:25 2024 +1000 + + Partially revert https://github.com/raja-grewal/security-misc/commit/f4d652fa7b5dd350b577521c6bba22c9eb3c13f1 + +commit 824d9b82e53485eed8eaf24e9815ac07ad0f2406 +Author: Raja Grewal +Date: Wed Jul 17 00:36:18 2024 +1000 + + Uncomment redundant disabling of TCP FACK` + +commit d1119c38b6ad4193919d4b800de0a3cb014f92c1 +Author: Raja Grewal +Date: Wed Jul 17 00:31:23 2024 +1000 + + Apply changes from code review + +commit fe5c840b79c4aabd5c21a286d3ce1a3ee460812c +Author: Patrick Schleizer +Date: Mon Jul 15 21:18:55 2024 +0000 + + bumped changelog version + +commit 6e63fc8985b97902dbae2553ded51950168dc222 +Merge: fe0846c8 b7796a53 +Author: Patrick Schleizer +Date: Mon Jul 15 17:14:25 2024 -0400 + + Merge remote-tracking branch 'ben-grande/fuzz' + +commit fe0846c8c2bdfc0534850b1e9bf9c4130381def9 +Author: Patrick Schleizer +Date: Mon Jul 15 12:30:38 2024 -0400 + + fix + + https://github.com/Kicksecure/security-misc/pull/234#discussion_r1678065395 + +commit 94df2e3d244f5e6e8e4320c1f28cc11dba00dd36 +Author: Patrick Schleizer +Date: Mon Jul 15 12:29:52 2024 -0400 + + further discussion required + + https://github.com/Kicksecure/security-misc/pull/234#issuecomment-2228909249 + +commit 41f0b53dd62d2968a6ff88a6fd907ca42f581847 +Merge: 5ba5a85a 9300c208 +Author: Patrick Schleizer +Date: Mon Jul 15 12:28:03 2024 -0400 + + Merge remote-tracking branch 'raja/kernel_modules' + +commit 73f6d4b26f51f0c920fe020677f464c536d75410 +Author: Raja Grewal +Date: Tue Jul 16 01:03:41 2024 +1000 + + Fix transcription error + +commit 724435e56ea059183241044a4fc09423187533eb +Author: Raja Grewal +Date: Mon Jul 15 22:38:43 2024 +1000 + + Disable some Intel Platform Monitoring Technology Telemetry (PMT) modules + +commit 61941da37509a4bb809212536b79f461a209f584 +Author: Raja Grewal +Date: Mon Jul 15 22:38:09 2024 +1000 + + Create `disabled-intelpmt-by-security-misc` + +commit 22ba7a7c393a8c9005dfe26aea396815a4d54803 +Author: Raja Grewal +Date: Mon Jul 15 22:21:20 2024 +1000 + + Disable more Intel Management Engine (ME) modules + +commit 9300c208e25d936f2c633a0904126566afc1c275 +Author: Raja Grewal +Date: Mon Jul 15 21:36:25 2024 +1000 + + Fix script + +commit f2db11269e89d4c945642b661aa9cbe356f89037 +Author: Raja Grewal +Date: Mon Jul 15 21:18:32 2024 +1000 + + Fix script + +commit 382f1e9ec00ab5f012f028fa324d6cf73040c37d +Author: Raja Grewal +Date: Mon Jul 15 21:13:25 2024 +1000 + + Fix error + +commit a8bc1144c32b4b4f20904af5f813da1051fe4c9c +Author: Raja Grewal +Date: Mon Jul 15 21:10:13 2024 +1000 + + Updated wording of error files for disabled modules + +commit fda3832eaf293915ab77ce73a0be2caec15e21fa +Author: Raja Grewal +Date: Mon Jul 15 21:08:45 2024 +1000 + + Replace bash file presented for disabling of miscellaneous modules + +commit 8219a1e257525d487a49e7b3a6b14c1e180a7b52 +Author: Raja Grewal +Date: Mon Jul 15 21:02:10 2024 +1000 + + Update README.md relating to disabled miscellaneous modules + +commit cb2fb95b81efa2ebb2bd80aeaacad9122f0f073c +Author: Raja Grewal +Date: Mon Jul 15 21:01:36 2024 +1000 + + Disable more miscellaneous drivers + +commit c52b1a3fd269ef4f98028dd5eead476abe5d138d +Author: Raja Grewal +Date: Mon Jul 15 20:58:45 2024 +1000 + + Create `disabled-miscellaneous-by-security-misc` + +commit 96aa63267a6fcee03f252f0791f37b7b6222a7c1 +Author: Raja Grewal +Date: Mon Jul 15 20:57:14 2024 +1000 + + Disable more Thunderbolt modules + +commit 51f7776bc8722752d53fc503b0c79564d8715d4c +Author: Raja Grewal +Date: Mon Jul 15 20:56:12 2024 +1000 + + Disable more network protocols/drivers + +commit 9e40ff055195b1e8637d1e957c3f8db01f99bbc1 +Author: Raja Grewal +Date: Mon Jul 15 20:54:18 2024 +1000 + + Disable more network file systems + +commit 82c5a93f7cf2846490120c5262a146a313a5ce47 +Author: Raja Grewal +Date: Mon Jul 15 20:53:07 2024 +1000 + + Disable another GPS module + +commit 99b0ce7948213e7f7adf42ddd7c7beb229374bd4 +Author: Raja Grewal +Date: Mon Jul 15 20:47:56 2024 +1000 + + Disable more file systems + +commit 4476a477a77c98cf4334fbcb866bc8f113f568ac +Author: Raja Grewal +Date: Mon Jul 15 20:47:07 2024 +1000 + + Provide option to disable more Bluetooth modules + +commit e0696d02a234e6f7ab9fb601ffe58e7d953846a2 +Author: Raja Grewal +Date: Mon Jul 15 20:46:04 2024 +1000 + + Update `security-misc.maintscript` + Due to previous splitting IN https://github.com/Kicksecure/security-misc/commit/b02230a783941da412be72fb52053db0c6b8010f. + +commit b2657bc61fb15bb89d62f0743a36835c1f0dda8a +Author: Raja Grewal +Date: Mon Jul 15 15:05:00 2024 +1000 + + Improve docs + +commit 1c2afc1f253e15d2605d1bef0e323e6e972a2484 +Author: Raja Grewal +Date: Mon Jul 15 15:01:48 2024 +1000 + + Update presentation of the `kernel.printk` sysctl + +commit c8385d82fbd6ba16ba1f0b4969661474966b74f1 +Author: Raja Grewal +Date: Mon Jul 15 14:57:40 2024 +1000 + + Clarify instructions for increasing log verbosity + +commit d229e8b04d914803fa66c3a695022cfb2d9b2a25 +Author: Raja Grewal +Date: Mon Jul 15 14:50:29 2024 +1000 + + Fix link + +commit fbfdb0fa99087e4160979b612db04e63a1d3e3b1 +Author: Raja Grewal +Date: Mon Jul 15 14:40:03 2024 +1000 + + Update `security-misc.maintscript` relating to grub + +commit f4d652fa7b5dd350b577521c6bba22c9eb3c13f1 +Author: Raja Grewal +Date: Mon Jul 15 14:39:12 2024 +1000 + + Update presentation of `quiet loglevel=0` + +commit 69c8e849270393537d3e024137bc20a42c848333 +Author: Raja Grewal +Date: Mon Jul 15 14:38:21 2024 +1000 + + Fix typos + +commit 48e1ac416314d2c66f3a0d5044a3c51cb6fb4093 +Author: Raja Grewal +Date: Mon Jul 15 02:04:25 2024 +1000 + + Remove the optional `slub_debug` parameter since it is no longer recommended + +commit 99038c7a0621f5c9852638c1706c5306b42e6480 +Author: Raja Grewal +Date: Mon Jul 15 02:02:01 2024 +1000 + + Add option to disable support for x86 processes and syscalls in the future + +commit f550fbe07cafb75112e98268730d1bcc511489e2 +Author: Raja Grewal +Date: Mon Jul 15 01:59:04 2024 +1000 + + Add option to disable the entire IPv6 stack functionality + +commit a33d4cd099b8cbf569ff35627eeacf3562a4371e +Author: Raja Grewal +Date: Mon Jul 15 01:56:25 2024 +1000 + + Refactor existing kernel parameters for clarity + +commit acd60e45d8cbc98ea935c9bf035f2840622ab58d +Author: Raja Grewal +Date: Sun Jul 14 20:07:31 2024 +1000 + + Add comment about enabling core dump files + +commit 5cf9afc21563712b851850e2041141807503807c +Author: Raja Grewal +Date: Sun Jul 14 17:05:49 2024 +1000 + + Include optional `sysctl`'s in README.md + +commit 2b9e174c9db69f2c30828aae236c631d46255e07 +Author: Raja Grewal +Date: Sun Jul 14 16:22:52 2024 +1000 + + Remove empty lines + +commit dd1741c4a1cd18f34f69437c00f3a78a9ebd402a +Author: Raja Grewal +Date: Sun Jul 14 13:40:53 2024 +1000 + + Some documentation additions and fixes + +commit 565597c9a282b08697d04204f5eb9c22153e77bd +Author: Raja Grewal +Date: Sun Jul 14 01:21:24 2024 +1000 + + Minor documentation changes and fixes + +commit 5ba5a85ad09b74a29c5ed0e5c265d54d93da9d32 +Author: Patrick Schleizer +Date: Sat Jul 13 15:01:16 2024 +0000 + + bumped changelog version + +commit ad860063aba0443a8ac8b9cf191d008617d6d904 +Merge: f34b9d7c 9f582665 +Author: Patrick Schleizer +Date: Sat Jul 13 10:55:45 2024 -0400 + + Merge remote-tracking branch 'raja/modprobe' + +commit 9f582665467fd4fdf20c83841305785024bceedf +Author: Raja Grewal +Date: Sat Jul 13 23:32:01 2024 +1000 + + Move nf_conntrack_helper disabling into separate file + +commit 8f2ec75f8173b6ab970a5ef213dcf5a3f67aa84a +Author: Raja Grewal +Date: Sat Jul 13 23:30:55 2024 +1000 + + Clarify README.mmd relating to module disabling + +commit 98580bb39a495a141e7b40792fd9d232fcf29d23 +Author: Raja Grewal +Date: Sat Jul 13 23:29:52 2024 +1000 + + Update modprobe presentation + +commit 2de3a795990234134be15be90aa55f547c064d92 +Author: Raja Grewal +Date: Sat Jul 13 22:41:40 2024 +1000 + + Refactor existing sysctl for clarity + +commit f34b9d7c45cd723535eedd3df99896ee7f852388 +Merge: 05c1711b 5f10cc8b +Author: Patrick Schleizer +Date: Sat Jul 13 06:14:43 2024 -0400 + + Merge remote-tracking branch 'raja/modules' + +commit 5f10cc8bcf11654f5e0f97c07e0a7ff198013c1e +Author: Raja Grewal +Date: Fri Jul 12 16:22:10 2024 +1000 + + Update README.md relating to modprobe + +commit 41a3bf92fbdac88a1884dee735600cafa35134bf +Author: Raja Grewal +Date: Fri Jul 12 16:21:41 2024 +1000 + + Sort `30_security-misc_disable.conf` + +commit f31dc8aebc652b2037c375351fc478d9b5ba4c27 +Author: Raja Grewal +Date: Fri Jul 12 16:21:03 2024 +1000 + + Fix error in error script + +commit b02230a783941da412be72fb52053db0c6b8010f +Author: Raja Grewal +Date: Fri Jul 12 02:42:37 2024 +1000 + + Split modprobe into blacklisted and disabled configurations + +commit fc792ff23234399ed299c3fdc086d47c87d9b4a3 +Author: Raja Grewal +Date: Fri Jul 12 02:29:36 2024 +1000 + + Alphabetically sort existing modprobe + +commit fe20f3240e2f31099bcaa9f9e2045320df810edf +Author: Raja Grewal +Date: Fri Jul 12 02:28:48 2024 +1000 + + Refactor existing modprobe for clarity + +commit 275a4ffc1114856cbd9a1cd49701dcb25d87bfb5 +Author: Raja Grewal +Date: Fri Jul 12 02:27:56 2024 +1000 + + Remove redundant disabled modules + +commit b7796a5334075d5fa538d7579003fde6287d7e6d +Author: Ben Grande +Date: Thu Jul 11 11:04:22 2024 +0200 + + Unify method to find SUID files + +commit 05c1711b16c96a221c13a011a6666fe6b385ec1e +Author: Patrick Schleizer +Date: Tue Jun 11 12:56:56 2024 +0000 + + bumped changelog version + +commit e48115588caae8e51bb980ac84b1f0f415ca0d17 +Merge: b316352e cad8d857 +Author: Patrick Schleizer +Date: Tue Jun 11 07:25:47 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit cad8d857556e29544f742fdac8fe82758a4f885c +Merge: b316352e e1984478 +Author: Patrick Schleizer +Date: Tue Jun 11 07:25:07 2024 -0400 + + Merge pull request #227 from 3uryd1ce/fix-pam.d-path + + fix(etc): delete typo in /etc/apparmor.d tunables + +commit e1984478662fc51e6eacc989bc6bba0ca1fc07cd +Author: Ashlen +Date: Sat Jun 8 22:17:05 2024 -0600 + + fix(etc): delete typo in /etc/apparmor.d tunables + + /etc/pam.d was present twice in a row ("/etc/pam.d//etc/pam.d") in this + file: /etc/apparmor.d/tunables/home.d/security-misc. + +commit b316352ede379d96cff4813735b93eb59506fe42 +Author: Patrick Schleizer +Date: Sat Jun 1 18:13:08 2024 +0000 + + bumped changelog version + +commit c815304026d30f7774f804498d20431ccdf8dc7f +Author: Patrick Schleizer +Date: Sat Jun 1 14:12:57 2024 -0400 + + readme + +commit 641e98e57714f7d38962bfd12d673500b8114356 +Author: Patrick Schleizer +Date: Sat Jun 1 17:35:04 2024 +0000 + + bumped changelog version + +commit e0cd9579d64e6d16667832de51f77a3091ef213e +Author: Patrick Schleizer +Date: Sat Jun 1 13:32:13 2024 -0400 + + remove duplicate `fsckobjects = true` from `/etc/gitconfig` + +commit bbe64a0b7992610dfef6002271718a2aee115cae +Author: Patrick Schleizer +Date: Tue May 28 12:04:53 2024 +0000 + + bumped changelog version + +commit ae24a97d4d0ffcfb3d1cc92edb61e7ecf4535ee7 +Merge: bfca98ea a7358578 +Author: Patrick Schleizer +Date: Tue May 28 08:02:21 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit a7358578520294b51e1001199670a0bbeeb43eb1 +Merge: bfca98ea 4efa293f +Author: Patrick Schleizer +Date: Tue May 28 07:55:31 2024 -0400 + + Merge pull request #226 from Kicksecure/gitconfig + + add `/etc/gitconfig` by default for better `git` security + +commit 4efa293f3b76814bc5399a959482d7db6e7431ec +Author: Patrick Schleizer +Date: Tue May 28 07:51:06 2024 -0400 + + add `/etc/gitconfig` by default for better `git` security + + ``` + [core] + symlinks = false + + [transfer] + fsckobjects = true + fsckobjects = true + [fetch] + fsckobjects = true + fsckobjects = true + [receive] + fsckobjects = true + fsckobjects = true + ``` + + + additional suggestions as comments + + fixes https://github.com/Kicksecure/security-misc/issues/225 + +commit bfca98ea89cea0f8604ecca0c8640860320e8e33 +Author: Patrick Schleizer +Date: Sat May 18 20:45:12 2024 +0000 + + bumped changelog version + +commit eb82884fb2e3d3bb4fa5555d8212146042ba8aa4 +Merge: 5867b1b0 12e006ef +Author: Patrick Schleizer +Date: Sat May 18 16:42:41 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 12e006ef9cabbbcbe9cb45d9a6631e9a7a47cf3a +Merge: 5867b1b0 2f716050 +Author: Patrick Schleizer +Date: Sat May 18 16:30:07 2024 -0400 + + Merge pull request #222 from raja-grewal/text + + Update Readme and Copyright + +commit 2f716050d17016be6f550a7de8e0c1030e869e8f +Author: raja-grewal +Date: Sun May 12 01:06:34 2024 +0000 + + Update README.md + +commit 1bb843ec3863696170242c57668d0b3f44f41d7b +Author: Raja Grewal +Date: Sat May 11 13:18:36 2024 +1000 + + Update Copyright (C) to 2024 + +commit dddac1dc4015a28fc6b12244809685295272edd1 +Author: Raja Grewal +Date: Sat May 11 13:15:42 2024 +1000 + + Update README.md + +commit 5867b1b014f450acdf70c203ffe2f27831f1d9b0 +Author: Patrick Schleizer +Date: Fri May 10 11:20:36 2024 +0000 + + bumped changelog version + +commit 9b589bc3116c8f9d6d574021bcec7b5dec3888b8 +Author: Patrick Schleizer +Date: Fri May 10 06:49:34 2024 -0400 + + comment + +commit 8d01fc2d351285c9c2f810bf5cf10797c9b9eb41 +Author: Patrick Schleizer +Date: Fri May 10 06:48:26 2024 -0400 + + chmod +x + +commit 8a28c1bc38b87bf55f25764c96a0e81e22137232 +Merge: a9886a31 0f1119f3 +Author: Patrick Schleizer +Date: Fri May 10 06:48:04 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0f1119f326cd769db8995e8eb54ff35503c70562 +Merge: 547757f4 677f75ae +Author: Patrick Schleizer +Date: Fri May 10 06:45:57 2024 -0400 + + Merge pull request #221 from raja-grewal/firewire + + Disable Firewire Module + +commit 547757f4514a54437d044656c5e2b6d413a4cc30 +Merge: 7b9fe44a 06f13bb7 +Author: Patrick Schleizer +Date: Fri May 10 06:45:34 2024 -0400 + + Merge pull request #220 from raja-grewal/block_gps + + Block Several GPS-related Modules + +commit 7b9fe44a20f3caf67f386969a5fc7c980e5f0282 +Merge: 62ea4dc1 132b41ae +Author: Patrick Schleizer +Date: Fri May 10 06:43:43 2024 -0400 + + Merge pull request #219 from raja-grewal/logging_martians + + Revert Logging of Martians + +commit 62ea4dc1768f69bb28a69c20e55c87ae692cc0c8 +Merge: a9886a31 4694268b +Author: Patrick Schleizer +Date: Fri May 10 06:43:15 2024 -0400 + + Merge pull request #218 from raja-grewal/secure_cpu + + More CPU Mitigations and Additional References + +commit 677f75ae8ed64af599f837ced15f34990df498e5 +Author: raja-grewal +Date: Thu May 9 02:34:02 2024 +0000 + + Disable `firewire-net` module + +commit 06f13bb766bd84182331aeb1632b917de4b36020 +Author: raja-grewal +Date: Thu May 9 02:28:53 2024 +0000 + + Disable GPS modules like GNSS + +commit f3800a4e2b7bef87cc3bd8791f9e7f654f8d782a +Author: raja-grewal +Date: Thu May 9 02:25:46 2024 +0000 + + Create disabled-gps-by-security-misc + +commit 132b41ae73e9ea72bc3d8aff22ae75fc622758a3 +Author: raja-grewal +Date: Thu May 9 02:16:50 2024 +0000 + + Revert logging of martians + +commit 4694268b8f779c1a0a56546dc6d12bf9f23a7cdd +Author: raja-grewal +Date: Sun May 5 12:52:51 2024 +0000 + + Remove a word + +commit 8f7768ce96e32e3f1ec52118afffc2a44a160976 +Author: raja-grewal +Date: Sun May 5 12:50:39 2024 +0000 + + Add vendor links + +commit 0c031a29d33d13d9106746d61b87f9d98a80b5cd +Author: raja-grewal +Date: Wed May 1 13:55:09 2024 +1000 + + RFDS mitigation on Intel Atom CPUs (including E-cores) + +commit 1122b3402c0856a087415d7ba1a313048b7e3eea +Author: raja-grewal +Date: Wed May 1 13:50:42 2024 +1000 + + GDS mitigation for CPUs + +commit c002bd62e8584a19e73b3f42673a3f9bafba6a2c +Author: raja-grewal +Date: Wed May 1 13:49:34 2024 +1000 + + Clarify use of `mitigations=auto` + +commit d89d7e8ef8ee3fd45456e82e8f649f7f28c93e80 +Author: raja-grewal +Date: Wed May 1 13:49:00 2024 +1000 + + Add reference for RETBleed + +commit 015dcc4212736417a2202ea0e0a92e5c2e58d6a5 +Author: raja-grewal +Date: Wed May 1 13:48:13 2024 +1000 + + Add reference for SSB + +commit de4f4be94762c9751ea62f744d7d6ede3ef30e88 +Author: raja-grewal +Date: Wed May 1 13:47:40 2024 +1000 + + Merge spectre mitigations + +commit 965c8641fd28e0ee592b50605edb7494fe9c3a28 +Author: raja-grewal +Date: Wed May 1 13:47:02 2024 +1000 + + Update BHI mitigation reference + +commit a9886a3119f9b662b15fc26d28a7fedf316b72c4 +Author: Patrick Schleizer +Date: Fri Apr 12 06:56:39 2024 +0000 + + bumped changelog version + +commit 5cbdf3c1262d26ae03b28baee87b1d268329da40 +Merge: 7fba04d1 ab8b6da4 +Author: Patrick Schleizer +Date: Fri Apr 12 02:54:17 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit ab8b6da484a90e9a62f8ba515c757aa3758baf48 +Merge: 7fba04d1 49357683 +Author: Patrick Schleizer +Date: Fri Apr 12 02:53:08 2024 -0400 + + Merge pull request #216 from raja-grewal/spectre_bhi + + BHI mitigation on Intel CPUs + +commit 493576836c90653f9c3514fcd5b3bf816e56d689 +Author: raja-grewal +Date: Fri Apr 12 00:17:06 2024 +1000 + + BHI mitigation on Intel CPUs + +commit 7fba04d1485187fe648f3d3ab44cd834b0eb9791 +Author: Patrick Schleizer +Date: Mon Apr 1 06:56:45 2024 +0000 + + bumped changelog version + +commit 7dba3fb7bebd4fdc7f168df378c2d505971f2c04 +Author: Patrick Schleizer +Date: Mon Apr 1 02:55:59 2024 -0400 + + no longer disable MSR by default + + fixes https://github.com/Kicksecure/security-misc/issues/215 + +commit d9ac01ba5c26f9730feb17fe573d447e625e59f8 +Author: Patrick Schleizer +Date: Mon Mar 18 15:10:10 2024 +0000 + + bumped changelog version + +commit ecaa024f226f4f45ac9d2a4f38bcdb82a6e35a2f +Author: Patrick Schleizer +Date: Mon Mar 18 11:01:56 2024 -0400 + + lower debugging + +commit 357ea5deab85debb9dff5d9e4e80a972954249c8 +Author: Patrick Schleizer +Date: Mon Mar 11 15:07:50 2024 +0000 + + bumped changelog version + +commit 0a018bdebca167d671d8bda81a2b0d929d396945 +Merge: 57fc487e 0b813163 +Author: Patrick Schleizer +Date: Mon Mar 11 10:13:57 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0b8131630041dbd80f1aa61dcedde446208c06f7 +Merge: 57fc487e 03ed546c +Author: Patrick Schleizer +Date: Mon Mar 11 10:12:46 2024 -0400 + + Merge pull request #211 from wryMitts/patch-1 + + Create proc group on install + +commit 03ed546cd8992b29855ca1c2748ed988dd3c765d +Author: wryMitts <158655396+wryMitts@users.noreply.github.com> +Date: Sun Mar 10 16:55:10 2024 -0400 + + Create proc group on install + + Fixes https://github.com/Kicksecure/security-misc/issues/210 + +commit 57fc487e5e5ffad765f1418236744319cc666871 +Author: Patrick Schleizer +Date: Sun Mar 10 13:19:26 2024 +0000 + + bumped changelog version + +commit a5206bde336c159be065345e7dd5cb86b2b6a27f +Author: Patrick Schleizer +Date: Sun Mar 10 08:44:53 2024 -0400 + + `proc-hidepid.service` add `gid=proc` + + This allows users that are a member of the `proc` group to be excluded from `hidepid` protections. + + https://github.com/Kicksecure/security-misc/issues/208 + +commit 0f0d9ca2a42cf9fc04e405ae90f3d67bc0794e12 +Author: Patrick Schleizer +Date: Mon Mar 4 11:48:30 2024 +0000 + + bumped changelog version + +commit 6b76373395622bac0e701c6d15c6656658febced +Author: Patrick Schleizer +Date: Mon Mar 4 06:44:26 2024 -0500 + + fix panic-on-oops started every 10s in Qubes-Whonix + + by changing from a /etc/profile.d etc. related mechanism to start to a systemd unit file based approach + + Thanks to @marmarek for the bug report! + + https://forums.whonix.org/t/panic-on-oops-started-every-10s/19450 + +commit af6c6971a741c69a584ba3f92dbfed12e40784dc +Author: Patrick Schleizer +Date: Mon Mar 4 06:33:51 2024 -0500 + + comment + +commit e013070e0bfc43d006e09ae1c5ae3533f7bebc5f +Author: Patrick Schleizer +Date: Mon Mar 4 06:33:21 2024 -0500 + + newline + +commit a5cc1774f2fbf6475e7b56601fbcd84a2a63fed0 +Author: Patrick Schleizer +Date: Mon Feb 26 13:32:44 2024 +0000 + + bumped changelog version + +commit 808e72f24bf30b3476ab6b87f96eb636632c195c +Author: Patrick Schleizer +Date: Mon Feb 26 08:11:26 2024 -0500 + + use long options + + https://github.com/Kicksecure/security-misc/issues/172 + +commit 2d1d1b246f3fe061d4f817da5cecf46010839e1d +Author: Patrick Schleizer +Date: Mon Feb 26 08:07:29 2024 -0500 + + improve output + + https://github.com/Kicksecure/security-misc/issues/172 + +commit d8f5376c4f36f5deb734e6dead42a62566d13480 +Author: Patrick Schleizer +Date: Mon Feb 26 07:58:06 2024 -0500 + + improve output + + https://github.com/Kicksecure/security-misc/issues/172 + +commit cf84762a3a84d2be3b9510dddb32bdc433170dfa +Author: Patrick Schleizer +Date: Mon Feb 26 07:52:41 2024 -0500 + + improve output + + https://github.com/Kicksecure/security-misc/issues/172 + +commit f2958bbfa5e67ee10380a25d996826233469080a +Author: Patrick Schleizer +Date: Mon Feb 26 07:49:30 2024 -0500 + + comment + +commit bc8f9edc3197e33e75ea1d691834d9abbdcdefd0 +Merge: 02d6f677 b23d1673 +Author: Patrick Schleizer +Date: Mon Feb 26 07:48:19 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit b23d167342ef242a1e9d4e91b6a4b945e80c3e7e +Merge: 02d6f677 ef44ecea +Author: Patrick Schleizer +Date: Mon Feb 26 07:46:02 2024 -0500 + + Merge pull request #204 from DanWin/sysfs-mount + + Make /sys hardening optional and allow access to /sys/fs to make polkit work + +commit 02d6f67741ef93d9ab39e02ac56b27c551a19dca +Author: Patrick Schleizer +Date: Thu Feb 22 20:08:17 2024 +0000 + + bumped changelog version + +commit d13d1aa7ec7e9ac9f1aa87e4b36228bfd3af6eb2 +Author: Patrick Schleizer +Date: Thu Feb 22 15:07:53 2024 -0500 + + comments + +commit a1f898e3b317f49a5bb9507c8b9d3bd3c4e23abf +Author: Patrick Schleizer +Date: Thu Feb 22 19:58:01 2024 +0000 + + bumped changelog version + +commit c3dd178b19be8c078ed6a2f46a072bef3d144c06 +Author: Patrick Schleizer +Date: Thu Feb 22 14:57:50 2024 -0500 + + output + +commit ef44ecea44ee516b1ba92175eb78b2e8143c4502 +Author: Daniel Winzen +Date: Thu Feb 22 16:51:23 2024 +0100 + + Add option to disabe /sys hardening + +commit 3bc1765dbbd333a1d607ab6962281b4d0a5c4b60 +Author: Daniel Winzen +Date: Wed Feb 21 20:37:34 2024 +0100 + + Allow access to /sys/fs for polkit + +commit 6b73e6c2a9ff1efe211e41e005e4ecaa63731d82 +Author: Patrick Schleizer +Date: Thu Feb 22 16:07:16 2024 +0000 + + bumped changelog version + +commit 37a7abdf0c1e6d8179bd09d3c1bd0363e8bc0a96 +Author: Patrick Schleizer +Date: Thu Feb 22 11:07:01 2024 -0500 + + ConditionKernelCommandLine=!remountsecure=0 + +commit eb3e0b9292f71a5dba312500508f893779fb1b9c +Author: Patrick Schleizer +Date: Thu Feb 22 14:52:55 2024 +0000 + + bumped changelog version + +commit c0924321b84874ae7fc72c59fd58e4c4ae8bc6d9 +Author: Patrick Schleizer +Date: Thu Feb 22 09:52:36 2024 -0500 + + fix systemd unit ExecStart + +commit d148a769b7106831c0b27a7ad63d91ab42257678 +Author: Patrick Schleizer +Date: Thu Feb 22 14:50:05 2024 +0000 + + bumped changelog version + +commit 6d7cf3c12a8a772fee1cd893d5504767690b3b77 +Author: Patrick Schleizer +Date: Thu Feb 22 09:49:48 2024 -0500 + + output + +commit f7831db197b2fff33b66eeb44efd749e482315e0 +Author: Patrick Schleizer +Date: Thu Feb 22 09:17:41 2024 -0500 + + do not exit non-zero if folder does not exist + +commit 5bdd7b8475bdfde8dbee5318fb43d0c2a236e3b0 +Author: Patrick Schleizer +Date: Thu Feb 22 09:14:52 2024 -0500 + + output + +commit 44a15cd97da3066e39d2d7df1f456e703036a6e9 +Author: Patrick Schleizer +Date: Thu Feb 22 09:13:56 2024 -0500 + + mount --make-private + + https://github.com/Kicksecure/security-misc/issues/172 + +commit c0f98b05b609c7c8ac6f86e123af9e0642d82697 +Author: Patrick Schleizer +Date: Thu Feb 22 06:03:59 2024 -0500 + + comment + + https://github.com/Kicksecure/security-misc/pull/202 + +commit 1e1613aa93dca1e7fe7f24dbd32028a0cadd21fd +Author: Patrick Schleizer +Date: Thu Feb 22 06:02:28 2024 -0500 + + allow /opt exec as usually optional binaries are placed there such as firefox + + https://github.com/Kicksecure/security-misc/pull/202 + +commit 7c7b4b24b4959f3ef96ff7ef0b11fa4c0bd48c8e +Author: Patrick Schleizer +Date: Thu Feb 22 06:01:00 2024 -0500 + + fix home_noexec_maybe -> most_noexec_maybe + + https://github.com/Kicksecure/security-misc/pull/202 + +commit 38783faf60b85c4e855bf78c87e1c07765776b50 +Author: Patrick Schleizer +Date: Thu Feb 22 05:58:53 2024 -0500 + + add more bind mounts of mount options hardening + + as suggested in https://github.com/Kicksecure/security-misc/pull/202 + +commit ad9d913902d7e696f1114da74d84f9cdcb22bc25 +Author: Patrick Schleizer +Date: Sat Feb 3 18:28:27 2024 +0000 + + bumped changelog version + commit 02090da08cfd411314ffeeb6df95f73c701f06c6 -Merge: 8037ce5 ba13657 +Merge: 8037ce52 ba13657d Author: Patrick Schleizer Date: Sat Feb 3 12:51:07 2024 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit ba13657d894f2f30d8deb7c08b85e5fbc1dcea21 -Merge: 8037ce5 b16c99a +Merge: 8037ce52 b16c99ab Author: Patrick Schleizer Date: Sat Feb 3 12:50:28 2024 -0500 Merge pull request #197 from raja-grewal/mitigations - + Additional Explicit CPU Mitigations commit b16c99ab62a902b1f61b9d4fe63273cd614e757c @@ -55,7 +10731,7 @@ Author: Patrick Schleizer Date: Thu Jan 25 06:54:36 2024 -0500 use `interest-noawait` instead of `interest-await` - + fixes https://github.com/Kicksecure/security-misc/issues/196 commit 64e41b113cae893d1f27f441f99340389ba8b9b3 @@ -81,9 +10757,9 @@ Author: Patrick Schleizer Date: Wed Jan 17 14:03:09 2024 -0500 use wildcards - + instead of outdated, incomplete list - + https://github.com/Kicksecure/security-misc/issues/160 commit 08619d6a7307b6ab05a3ba7e71ea33b00db20b27 @@ -91,7 +10767,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:59:36 2024 -0500 minor RPM updates - + https://github.com/Kicksecure/security-misc/issues/160 commit 3048e0ac76e4eba1c53b43ba2424157505578cdd @@ -99,7 +10775,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:54:07 2024 -0500 usrmerge - + https://github.com/Kicksecure/security-misc/issues/190 commit 5a6cd4c2abd243c91575e9477a921aa290c68ba5 @@ -107,7 +10783,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:51:30 2024 -0500 remove now empty /bin from copying since it is empty after usrmerge - + https://github.com/Kicksecure/security-misc/issues/190 commit 071b984a1eaaa8a8ea6a40e4ee36eabcde2d630d @@ -115,7 +10791,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:49:05 2024 -0500 `sort -d` - + https://github.com/Kicksecure/security-misc/issues/190 commit 011e55e3e52485ccd728b4bb249efbc816f38806 @@ -123,7 +10799,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:45:17 2024 -0500 remove duplicates after usrmerge - + https://github.com/Kicksecure/security-misc/issues/190 commit 0efee2f50fd38feade7700c2f033cc3d4c200d34 @@ -131,7 +10807,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:39:56 2024 -0500 usrmerge - + fixes https://github.com/Kicksecure/security-misc/issues/190 commit 18a06935e0cca3dc090643aad406d861e4583085 @@ -139,9 +10815,9 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:23:20 2024 -0500 run permission hardener when new packages are install files to /usr or /opt - + (basically anywhere) - + fixes https://github.com/Kicksecure/security-misc/issues/189 commit 66e6371221c3395a0523e30e8ef1a051d3e6cdd0 @@ -161,11 +10837,11 @@ Author: Patrick Schleizer Date: Tue Jan 16 09:23:54 2024 -0500 update permission-hardener.service - + Which is now only an additional opt-in systemd unit, because permission-hardener is run by default at security-misc package installation time. - + https://github.com/Kicksecure/security-misc/pull/181 commit 186f6015da7b3314c95c2833032c6fe953a71afd @@ -179,7 +10855,7 @@ Author: Patrick Schleizer Date: Tue Jan 16 09:10:59 2024 -0500 delete legacy folder /etc/permission-hardening.d if empty - + https://github.com/Kicksecure/security-misc/pull/181 commit 9cafd78fe21baa3c2a36853f57e0638b2facfe5c @@ -187,7 +10863,7 @@ Author: Patrick Schleizer Date: Tue Jan 16 09:05:09 2024 -0500 rm_conffile /etc/permission-hardening.d - + https://github.com/Kicksecure/security-misc/pull/181 commit fa53848b5cda135fbb8a3855e8508692084fc7e9 @@ -207,9 +10883,9 @@ Author: Patrick Schleizer Date: Tue Jan 16 08:45:13 2024 -0500 permission-hardening -> permission-hardener migration - + mv --verbose /var/lib/permission-hardening /var/lib/permission-hardener - + https://github.com/Kicksecure/security-misc/pull/181 commit a90cd43631216f28a18a1b3f066b9f6ef3301ac4 @@ -217,11 +10893,11 @@ Author: Patrick Schleizer Date: Tue Jan 16 08:32:52 2024 -0500 fix postinst for new permission-hardener - + https://github.com/Kicksecure/security-misc/pull/181 commit 862bf6b5ab29917138325023eb3507f5fbd5653c -Merge: dc8d9ee bc02c72 +Merge: dc8d9eec bc02c720 Author: Patrick Schleizer Date: Tue Jan 16 08:19:28 2024 -0500 @@ -238,7 +10914,7 @@ Author: Patrick Schleizer Date: Sun Jan 7 06:37:34 2024 -0500 undo IPv6 privacy due to potential server issues - + https://github.com/Kicksecure/security-misc/issues/184 commit 128bb01b35d20e97351dfb53768f35482f9756a2 @@ -246,7 +10922,7 @@ Author: Patrick Schleizer Date: Sun Jan 7 06:36:25 2024 -0500 undo IPv6 privacy due to potential server issues - + https://github.com/Kicksecure/security-misc/issues/184 commit df0f9d3267644c4aea87add2dcade86044c496f0 @@ -260,9 +10936,9 @@ Author: Patrick Schleizer Date: Sat Jan 6 09:10:45 2024 -0500 revert umask 027 by default - + because broken because this also happens for root while it should not - + https://github.com/Kicksecure/security-misc/issues/185 commit 3f1304403fbf04f15dac01963c66f82cd84452d4 @@ -270,7 +10946,7 @@ Author: Patrick Schleizer Date: Sat Jan 6 08:15:31 2024 -0500 disable MAC randomization in Network Manager (NM) because it breaks VirtualBox DHCP - + https://github.com/Kicksecure/security-misc/issues/184 commit e8f8dcd0fb1c23a62974849f55516da9dce5948e @@ -280,19 +10956,19 @@ Date: Thu Jan 4 02:03:26 2024 +0000 bumped changelog version commit 70a86fa994c0a894643e876fc86226ad0443a741 -Merge: db0503e 71060f1 +Merge: db0503e7 71060f1f Author: Patrick Schleizer Date: Wed Jan 3 05:12:48 2024 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 71060f1f53ca7a275f10c4b6ab3e6c25585d5440 -Merge: db0503e 74afcc9 +Merge: db0503e7 74afcc9c Author: Patrick Schleizer Date: Wed Jan 3 05:00:41 2024 -0500 Merge pull request #182 from raja-grewal/io_uring - + Clarify validity of disabling io_uring commit 74afcc9c63ad064f20778ad2870690925c3cee81 @@ -306,7 +10982,7 @@ Author: Ben Grande Date: Tue Jan 2 17:08:45 2024 +0100 Fix unbound variable - + - Run messages preceded by INFO; - Comment unknown unused variables; - Remove unnecessary variables; and @@ -323,7 +10999,7 @@ Author: Ben Grande Date: Tue Jan 2 13:34:29 2024 +0100 Rename file permission hardening script - + Hardener as the script is the agent that is hardening the file permissions. @@ -332,7 +11008,7 @@ Author: Ben Grande Date: Tue Jan 2 12:17:16 2024 +0100 Refactor permission-hardener - + - Organize comments from default configuration; - Apply and undo changes from a single file controlled by parameters; - Arrays should be evaluated as arrays and not normal variables; @@ -347,19 +11023,19 @@ Date: Tue Jan 2 12:17:16 2024 +0100 - Use long options for "set" command; commit a94f2a3f4626a9292660bc7f98a6513f34d0f5b2 -Merge: 94c0e26 8daf97a +Merge: 94c0e26a 8daf97ab Author: Patrick Schleizer Date: Tue Jan 2 05:30:49 2024 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 8daf97ab0181a9cbb9e9dec57f1f00270dbb3a50 -Merge: 94c0e26 f055fe5 +Merge: 94c0e26a f055fe5d Author: Patrick Schleizer Date: Tue Jan 2 05:29:35 2024 -0500 Merge pull request #178 from raja-grewal/io_uring - + Disable asynchronous I/O commit 94c0e26a082f61f71e89b1fb7386a58166ffa411 @@ -373,7 +11049,7 @@ Author: Patrick Schleizer Date: Fri Dec 29 14:57:38 2023 -0500 /dev/, /dev/shm, /tmp - + https://github.com/Kicksecure/security-misc/issues/157#issuecomment-1869073716 commit e15596e7af6fc645dd652c043397baaa91954915 @@ -393,7 +11069,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 10:31:58 2023 -0500 formatting - + https://github.com/Kicksecure/security-misc/issues/157 commit 971ff687b1423499c54495a03e5e6fafcbfefb2a @@ -401,7 +11077,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 10:30:35 2023 -0500 do not mount /dev/cdrom by default - + https://github.com/Kicksecure/security-misc/issues/157 commit 9fce67fcd942a7e3e0dd2e874226fcdab5e33ba3 @@ -409,7 +11085,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 10:28:47 2023 -0500 remove superfluous, broken `remount` mount option - + https://github.com/Kicksecure/security-misc/issues/157 commit 40fd8cb6081512e2bc0ef1a7a1ee17cd317024c2 @@ -417,9 +11093,9 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:51:09 2023 -0500 no `nofail` mount option to avoid breaking the boot of a system - + unit testing belongs elsewhere - + https://github.com/Kicksecure/security-misc/issues/157 commit 4aa645f29ff741b6e5cdf629deade1923fdcc234 @@ -427,7 +11103,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:46:33 2023 -0500 comment - + https://github.com/Kicksecure/security-misc/issues/157 commit 2b7aeedb4a543d0a43a35918999338097d13bb16 @@ -436,10 +11112,10 @@ Date: Mon Dec 25 09:44:51 2023 -0500 mount /dev/cdrom to /mnt/cdrom (instead of /mnt/cdrom0) and nodev,nosuid,noexec - + as per: https://www.debian.org/doc/manuals/securing-debian-manual/ch04s10.en.html - + https://github.com/Kicksecure/security-misc/issues/157 commit 0d9e9780daca563a726470a3a5d6fa8c20487240 @@ -447,7 +11123,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:37:14 2023 -0500 formatting - + https://github.com/Kicksecure/security-misc/issues/157 commit 00f9ab43947795c1144d797547968c7c149d6f21 @@ -455,7 +11131,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:36:05 2023 -0500 /dev devtmpfs - + https://github.com/Kicksecure/security-misc/issues/157 commit 55709b3aa0acd6cad0c9fedb8782c49fbea79689 @@ -463,7 +11139,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:30:57 2023 -0500 /tmp tmpfs - + https://github.com/Kicksecure/security-misc/issues/157 commit b0dd967611c27f5b8e2472bb74a664aead7a229e @@ -471,7 +11147,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:27:45 2023 -0500 usrmerge - + https://github.com/Kicksecure/security-misc/issues/157 commit 269fada14a616c53d7421e88e662f6893eb1fd88 @@ -479,7 +11155,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:25:14 2023 -0500 combine bind lines - + https://github.com/Kicksecure/security-misc/issues/157 commit 0810c1ce3c9e19c745b8f0d2cd9410353b172779 @@ -487,7 +11163,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:10:31 2023 -0500 fix bluetooth in readme - + fixes https://github.com/Kicksecure/security-misc/issues/180 commit 37b4ab15a823134e616a2a0fe1dda18d5ebfa3c0 @@ -519,9 +11195,9 @@ Author: Patrick Schleizer Date: Mon Dec 25 08:26:03 2023 -0500 improve bluetooth in readme - + as suggested by @monsieuremre - + https://github.com/Kicksecure/security-misc/issues/180 commit 7fa597deca7ff2b2932a5f5fad56be57bd78b6cf @@ -535,7 +11211,7 @@ Author: Patrick Schleizer Date: Fri Dec 22 08:31:58 2023 -0500 exclude hardened malloc from SUID disabler - + fixes https://github.com/Kicksecure/security-misc/issues/179 commit f055fe5da2219b68f46c3c577d79fcfd7e79cfc6 @@ -543,7 +11219,7 @@ Author: Raja Grewal Date: Fri Dec 15 08:33:36 2023 +0000 Disable asynchronous I/O - + io_uring creation is disabled for all processes. io_uring_setup always fails with -EPERM. Existing io_uring instances can still be used. commit 99f2edd4f685cdc9a47b32107125408e12a294c2 @@ -557,13 +11233,13 @@ Author: Patrick Schleizer Date: Tue Dec 12 11:50:11 2023 -0500 add hardened fstab `/usr/share/doc/security-misc/fstab-vm` - + to the documentation folder as an example - + not directly used by security-misc - + will later be used by Kicksecure VM build process - + https://github.com/Kicksecure/security-misc/issues/157 commit dcaafa6c8bf380dd990942e9c10e280943b442a6 @@ -577,7 +11253,7 @@ Author: Patrick Schleizer Date: Mon Dec 4 11:38:49 2023 -0500 move to `/usr/lib/issue.d/20_security-misc.issue` - + https://github.com/Kicksecure/security-misc/pull/167 commit dfaea492c76a277b9cbe84982a135cb4f03a557c @@ -585,23 +11261,23 @@ Author: Patrick Schleizer Date: Mon Dec 4 11:37:02 2023 -0500 remove `etc/issue.net.d/20_security-misc` - + since not mentioned on debian.org commit 69c895af09f05000ace5f273f3e5032aabf8c64e -Merge: c9ea7a4 36850f8 +Merge: c9ea7a4d 36850f89 Author: Patrick Schleizer Date: Mon Dec 4 11:27:53 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 36850f89fb07678ca24eb580a18247e593eac608 -Merge: c9ea7a4 0d7af97 +Merge: c9ea7a4d 0d7af970 Author: Patrick Schleizer Date: Mon Dec 4 11:27:16 2023 -0500 Merge pull request #167 from monsieuremre/patch-4 - + Non-Identifiable and Generic Issue Banners that include the Recommended Keywords commit c9ea7a4dca6e985c3a1044a3b4ddda83909fbc51 @@ -609,25 +11285,25 @@ Author: Patrick Schleizer Date: Mon Dec 4 11:02:55 2023 -0500 use `amd_iommu=force_isolation` instead of `amd_iommu=force_enable` - + because we set `iommu=force` already anyhow - + fixes https://github.com/Kicksecure/security-misc/issues/175 commit e83c1d7ed662bb0533c670dd5b7a6745a75e9ca4 -Merge: c4e21ca befd21e +Merge: c4e21ca5 befd21e0 Author: Patrick Schleizer Date: Mon Dec 4 11:01:02 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit befd21e0c0c38eaf91c7096e9f60120f533a5842 -Merge: c4e21ca f2ad838 +Merge: c4e21ca5 f2ad8383 Author: Patrick Schleizer Date: Mon Dec 4 11:00:29 2023 -0500 Merge pull request #176 from monsieuremre/patch-1 - + Iommu Kernel Parameters commit c4e21ca5f49fbc2d67853eebca647539acbca815 @@ -635,7 +11311,7 @@ Author: Patrick Schleizer Date: Mon Dec 4 10:58:16 2023 -0500 added development philosophy - + https://github.com/Kicksecure/security-misc/issues/154 commit feab1432f9d0966118ca233c9f88270b98c3f120 @@ -643,7 +11319,7 @@ Author: Patrick Schleizer Date: Mon Dec 4 10:48:27 2023 -0500 clarify scope - + https://github.com/Kicksecure/security-misc/issues/154 commit dc04040cb3644c9e3be9b44a34da4a5f7b61f2cc @@ -689,7 +11365,7 @@ Date: Sun Dec 3 19:30:55 2023 +0000 Update 20_security-misc commit 7963f811e1bb6f5e0e2ba41e96b14e4a3a70f847 -Merge: c8b9f5a 82bd913 +Merge: c8b9f5a9 82bd9138 Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> Date: Sun Dec 3 19:30:22 2023 +0000 @@ -706,7 +11382,7 @@ Author: Patrick Schleizer Date: Mon Nov 20 04:40:28 2023 -0500 moved libpam-tmpdir dependency to kicksecure-meta-packages - + https://github.com/Kicksecure/security-misc/pull/147 commit c8b9f5a917e6c415575d6763a65930f1a91a7c78 @@ -721,6 +11397,18 @@ Date: Sat Nov 18 10:02:16 2023 +0000 20_security-misc +commit 7c8b9b294678056d684fd3dc22f012d75da40426 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Nov 17 17:14:01 2023 +0000 + + 30_security-misc.conf + +commit 7d31e17fc5a8fe3055568c1a0f541dea064f30a0 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Nov 17 17:02:41 2023 +0000 + + usbguard + commit 4e4df5dd7c6b5cf1deb179a2c3f8fe7a8844884d Author: Patrick Schleizer Date: Sat Nov 11 22:29:57 2023 +0000 @@ -750,7 +11438,7 @@ Author: Patrick Schleizer Date: Sat Nov 11 13:41:28 2023 -0500 change license to AGPL-3+ - + https://forums.whonix.org/t/license-change-to-agplv3/17455 commit 20f804f19c046e3ef2b38c367de9d5c80cccccd9 @@ -836,7 +11524,7 @@ Author: Patrick Schleizer Date: Mon Nov 6 16:22:42 2023 -0500 remount-secure systemd unit - + https://github.com/Kicksecure/security-misc/pull/152 commit 79f9c1fb3adac319342a22c099401cb21af4429f @@ -844,7 +11532,7 @@ Author: Patrick Schleizer Date: Mon Nov 6 15:48:09 2023 -0500 add sysinit-post.target - + https://github.com/Kicksecure/security-misc/pull/152 commit 2de5ab41201c561a2684f15196ce37b0f34038a9 @@ -852,7 +11540,7 @@ Author: Patrick Schleizer Date: Mon Nov 6 13:47:30 2023 -0500 clarify scope of application specific hardening - + fixes https://github.com/Kicksecure/security-misc/issues/154 commit 5a96616b39e7188903bd0d35c9812a02fddc02f9 @@ -866,7 +11554,7 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:55:55 2023 -0500 readme - + https://github.com/Kicksecure/security-misc/pull/152 commit be023c77223c4ec0e26ffe2a88acd94653efee9a @@ -874,7 +11562,7 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:54:43 2023 -0500 readme - + https://github.com/Kicksecure/security-misc/issues/159 commit e1f413c1ee5107468cb2a9c4aa8bd061d0dc911b @@ -882,9 +11570,9 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:53:26 2023 -0500 disable harden-module-loading.service for now - + due to issues - + https://github.com/Kicksecure/security-misc/issues/159 commit f2ea1abc9b3efc035f4d1381bece458de9b89ff3 @@ -898,9 +11586,9 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:49:36 2023 -0500 Revert "remove no longer required remount-service systemd unit" - + This reverts commit 479ab61a1d0c91d26c2cd200d97b39b2b786e073. - + https://github.com/Kicksecure/security-misc/pull/152 commit 24b4d59ce41bc95e0b0aadf401223dc40b0f9c8f @@ -920,7 +11608,7 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:12:03 2023 -0500 fix systemd unit - + https://github.com/Kicksecure/security-misc/issues/159 commit 2571bbf315693f65f564ef4ad1b2ff4941f2ebc3 @@ -966,19 +11654,19 @@ Date: Sun Nov 5 17:43:07 2023 -0500 set -e commit 18a2d814cc0c477599b276bb319ed8bdd34499ea -Merge: 4fda9d2 36f3c30 +Merge: 4fda9d2e 36f3c304 Author: Patrick Schleizer Date: Sun Nov 5 17:42:28 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 36f3c30440e73c8bf4946742095f0495994fed99 -Merge: 4fda9d2 2e64d89 +Merge: 4fda9d2e 2e64d89b Author: Patrick Schleizer Date: Sun Nov 5 17:41:56 2023 -0500 Merge pull request #148 from monsieuremre/module-loading-hardening - + Harden the loading of new modules to the kernel after install commit 4fda9d2e8459c043ec27178ceb87483229b45d5f @@ -1052,9 +11740,9 @@ Author: Patrick Schleizer Date: Sun Nov 5 15:27:09 2023 -0500 disable remount-secure dracut modules - + pending new systemd based implementation - + https://github.com/Kicksecure/security-misc/pull/152 commit 949c1633701ac168e908794d4dd74c5a9b09a437 @@ -1074,7 +11762,7 @@ Author: Patrick Schleizer Date: Sun Nov 5 15:09:29 2023 -0500 lower verbosity of permission hardener - + fixes https://github.com/Kicksecure/security-misc/issues/158 commit 0544657123100b333211a91ef32054dc7e14c7db @@ -1104,19 +11792,19 @@ Date: Sun Nov 5 14:50:13 2023 -0500 cleanup commit 811d1cd0dd0dcb9021d2f72638dd6c12b734964c -Merge: 9343795 5a75bcf +Merge: 93437952 5a75bcfb Author: Patrick Schleizer Date: Sun Nov 5 14:49:43 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 5a75bcfb19ac6c555a52cb1600e4efd13a8cfc06 -Merge: 9343795 229032d +Merge: 93437952 229032d6 Author: Patrick Schleizer Date: Sun Nov 5 14:49:00 2023 -0500 Merge pull request #145 from monsieuremre/wifi-and-bluetooth - + Wifi and Bluetooth Patch | Security and Privacy commit 93437952b4f64866dfe6067d8caf19415112418d @@ -1126,51 +11814,51 @@ Date: Sun Nov 5 14:41:01 2023 -0500 readme commit f32b5438872ad0b9e10cb7b0519f1f18fce1913e -Merge: 56b90ee 4946f85 +Merge: 56b90eec 4946f85d Author: Patrick Schleizer Date: Sun Nov 5 14:38:20 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 4946f85d43083c64bc3f8f02e26b08f79b622bfe -Merge: 817ca11 1abac79 +Merge: 817ca116 1abac794 Author: Patrick Schleizer Date: Sun Nov 5 14:37:47 2023 -0500 Merge pull request #146 from monsieuremre/thunderbird - + Thunderbird Hardening commit 56b90eecbfb21e546d52d1f41ce9361f2843cd71 -Merge: 3178677 817ca11 +Merge: 31786775 817ca116 Author: Patrick Schleizer Date: Sun Nov 5 14:35:23 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 817ca116f693893e6dcb69254ee91815d200b8a1 -Merge: d9b5d77 fbd9e5d +Merge: d9b5d770 fbd9e5d0 Author: Patrick Schleizer Date: Sun Nov 5 14:34:13 2023 -0500 Merge pull request #153 from monsieuremre/readme - + Updated Readme commit 317867758478619fe1df4ebdb5e22240c40104c0 -Merge: dcead44 d9b5d77 +Merge: dcead44c d9b5d770 Author: Patrick Schleizer Date: Sun Nov 5 14:32:21 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit d9b5d770cfd5f7747f1d606f3136a93034928f30 -Merge: dcead44 ac224b2 +Merge: dcead44c ac224b27 Author: Patrick Schleizer Date: Sun Nov 5 14:31:26 2023 -0500 Merge pull request #150 from monsieuremre/sysreq - + Disable SysRq by default commit dcead44cc6d4272b0966562046f9dab1792845b6 @@ -1214,11 +11902,11 @@ Author: Patrick Schleizer Date: Fri Nov 3 15:55:17 2023 -0400 revert enabling kernel module signature enforcement - + due to issues - + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/63 - + https://github.com/dell/dkms/issues/359 commit 978e3e4abd8f55a877dfe0d6e39b45ee9f58ba6d @@ -1232,7 +11920,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 14:51:14 2023 -0400 port to DKMS drop-in folder - + undisplace /etc/dkms/framework.conf.security-misc moved to /etc/dkms/framework.conf.d/30_security-misc.conf @@ -1241,7 +11929,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 12:55:34 2023 -0400 /usr/sbin/pam-tmpdir-helper exactwhitelist - + https://github.com/Kicksecure/security-misc/pull/147 commit 48adb44c6fd157673cdf7fab3b86ecf7c6b31966 @@ -1255,7 +11943,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 12:17:00 2023 -0400 Revert "allow loading unsigned modules due to issues" - + This reverts commit 661bcd8603425934188cf139f33e20675ff4b765. commit 04b210ee88589ef9e6e214d3a5a614780244abc9 @@ -1265,19 +11953,19 @@ Date: Fri Nov 3 12:10:48 2023 -0400 bumped changelog version commit 5e73f78ed9282bf0895b01d44d9c261ea0050cce -Merge: ceffd2b 8e66a41 +Merge: ceffd2b3 8e66a417 Author: Patrick Schleizer Date: Fri Nov 3 12:10:33 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 8e66a4177868ee7b51dafdb06062b0cb7cbc7415 -Merge: ceffd2b 7dc99d5 +Merge: ceffd2b3 7dc99d54 Author: Patrick Schleizer Date: Fri Nov 3 12:10:00 2023 -0400 Merge pull request #147 from monsieuremre/PAM-tmp-files-hardening - + Depend on libpam-tmpdir for very solid extra security commit 7dc99d54c0358842745ee48c7cc24f589fd63d14 @@ -1287,7 +11975,7 @@ Date: Fri Nov 3 12:09:39 2023 -0400 fix commit 2a602e78d6ca0f87f11de9a30ae2114468243075 -Merge: 3ee4be6 ceffd2b +Merge: 3ee4be65 ceffd2b3 Author: Patrick Schleizer Date: Fri Nov 3 12:08:50 2023 -0400 @@ -1328,9 +12016,9 @@ Author: Patrick Schleizer Date: Fri Nov 3 10:31:59 2023 -0400 do not change default umask for root - + since this causes permission issues in `/etc/` - + https://github.com/Kicksecure/security-misc/pull/151 commit 07540db90d60b10cbd10881b0024d8e8871330de @@ -1338,7 +12026,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 09:45:12 2023 -0400 Revert "Revert "set default umask to 027"" - + This reverts commit f8913ceb2e2fdd274011377c41b5d08e7459e4af. commit f8913ceb2e2fdd274011377c41b5d08e7459e4af @@ -1346,7 +12034,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 09:43:44 2023 -0400 Revert "set default umask to 027" - + This reverts commit cd216095eb8d9387437e653d7764ec765ce42a10. commit 43bd789c30a562aa60349d019107277a428aece8 @@ -1360,11 +12048,11 @@ Author: Patrick Schleizer Date: Fri Nov 3 09:12:24 2023 -0400 set default umask to 027 - + using package libpam-umask - + https://www.debian.org/doc/manuals/securing-debian-manual/ch04s11.en.html#id-1.5.14.19 - + https://github.com/Kicksecure/security-misc/pull/151 commit ac224b270a3a0945d187202f8cca89af0e71a166 @@ -1378,7 +12066,7 @@ Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> Date: Thu Nov 2 10:44:19 2023 +0000 enable service on install - + not sure if this would be the right way to do it commit 9f063584c1f96267b04f8f7fe0eee773f9345370 @@ -1436,19 +12124,19 @@ Date: Wed Nov 1 12:26:21 2023 -0400 bumped changelog version commit bb14a058520b13e242fea9f3022c439c4677bd1d -Merge: 5ed2a5c 44906e8 +Merge: 5ed2a5ce 44906e8f Author: Patrick Schleizer Date: Wed Nov 1 11:11:54 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 44906e8f398aae6e9565b131b82124e738e2d0d1 -Merge: 5ed2a5c f2c23a2 +Merge: 5ed2a5ce f2c23a28 Author: Patrick Schleizer Date: Wed Nov 1 11:11:27 2023 -0400 Merge pull request #142 from monsieuremre/patch-5 - + ssh config commit 5ed2a5ce4a24a1a9c3e722a30aa9c6af1dc5d78a @@ -1458,19 +12146,19 @@ Date: Wed Nov 1 11:10:36 2023 -0400 bumped changelog version commit bb1161986b6d108c4fc5a16a48cdac55f98ab35d -Merge: 7d57684 b7cddd6 +Merge: 7d576842 b7cddd6e Author: Patrick Schleizer Date: Wed Nov 1 10:31:04 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit b7cddd6e552cb5f5139de91ef2aeae6fde691136 -Merge: 7d57684 c975c3c +Merge: 7d576842 c975c3c0 Author: Patrick Schleizer Date: Wed Nov 1 10:30:26 2023 -0400 Merge pull request #143 from monsieuremre/patch-6 - + new lines 990-security-misc.conf commit fc8e201e84e4c777c087fd113c539ca368fd3a31 @@ -1520,7 +12208,7 @@ Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> Date: Fri Oct 27 11:07:53 2023 +0000 new lines 990-security-misc.conf - + added new recommended hardening settings with comments commit f2c23a28319e359c642da2dde424456a1064763f @@ -1542,19 +12230,19 @@ Date: Thu Oct 26 19:31:14 2023 -0400 remove duplicates commit 928cdb81d43dfd337c82917182d2914d9c9d0915 -Merge: a330a9f 39fed05 +Merge: a330a9fd 39fed058 Author: Patrick Schleizer Date: Thu Oct 26 19:29:55 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 39fed058f4734029b303fac4ea9a1b11f652fab4 -Merge: 92a6ecc 99355c6 +Merge: 92a6ecc4 99355c61 Author: Patrick Schleizer Date: Thu Oct 26 19:27:41 2023 -0400 Merge pull request #140 from monsieuremre/patch-3 - + New lines in default permission config commit a330a9fd75314931639e7e873adc31c5cc65d555 @@ -1564,19 +12252,19 @@ Date: Thu Oct 26 19:20:21 2023 -0400 refactor permission-lockdown commit 8bf5ff82be706599f33228ecd6df42be0dc29f39 -Merge: 1123d23 92a6ecc +Merge: 1123d231 92a6ecc4 Author: Patrick Schleizer Date: Thu Oct 26 19:15:04 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 92a6ecc40a4d3bd4d8f3cec7dd9b1334c72399dc -Merge: ca9603a 91c4452 +Merge: ca9603af 91c44524 Author: Patrick Schleizer Date: Thu Oct 26 19:13:34 2023 -0400 Merge pull request #141 from monsieuremre/patch-4 - + New permission-lockdown commit 1123d23114201988ac3f5f50ab6e74a5307d3d52 @@ -1638,9 +12326,9 @@ Author: Patrick Schleizer Date: Thu Oct 26 12:20:48 2023 -0400 enable SUID Disabler and Permission Hardener by default - + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener - + https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706 commit e5d989af5ac2899985c48d60311856fb86e0ddeb @@ -1662,7 +12350,7 @@ Date: Wed Oct 25 17:41:05 2023 -0400 comment commit 5d71217e597aa3366658524ec5395c9f76dd527b -Merge: 6a22351 a2f811a +Merge: 6a22351d a2f811af Author: Patrick Schleizer Date: Wed Oct 25 17:40:13 2023 -0400 @@ -1683,12 +12371,12 @@ Date: Wed Oct 25 17:28:43 2023 -0400 renamed: etc/sysctl.d/30_silent-kernel-printk.conf -> usr/lib/sysctl.d/30_silent-kernel-printk.conf commit a2f811aff0cb4e73c3975093012c223127495707 -Merge: 3317332 ee6716e +Merge: 3317332c ee6716e1 Author: Patrick Schleizer Date: Wed Oct 25 17:26:46 2023 -0400 Merge pull request #135 from monsieuremre/kernel-fix - + Kernel hardening fix commit ee6716e178806912da08b671ae31504ed2f3ac56 @@ -1704,19 +12392,19 @@ Date: Tue Oct 24 05:51:11 2023 -0400 bumped changelog version commit 42c802cd1eca3d2586abde871e4842cdf83490c4 -Merge: f3b40f1 5320c11 +Merge: f3b40f12 5320c11f Author: Patrick Schleizer Date: Tue Oct 24 05:30:15 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 5320c11f3f92b66b7dcab7ca1f67fcba2de5deba -Merge: f3b40f1 f0857fd +Merge: f3b40f12 f0857fd5 Author: Patrick Schleizer Date: Tue Oct 24 05:22:33 2023 -0400 Merge pull request #134 from monsieuremre/patch-1 - + Fix double mount issue for /var/log and /var/tmp commit 1f489719efb37492b9c040ba4e332e8dd70fde1f @@ -1742,7 +12430,7 @@ Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> Date: Mon Oct 23 15:33:05 2023 +0000 Fix double mount issue for /var/log and /var/tmp - + Mounting var with bind and mounting a subdirectory causes /var/tmp and /var/log bind mounted twice each. can be checked with lsblk. When we bind mount var only after having mounted the subdirectories, everything is mounted only one. commit f3b40f12cb4bad0f2f00d4ba2dec59fb315c0798 @@ -2407,19 +13095,19 @@ Date: Mon May 15 17:31:59 2023 +0000 bumped changelog version commit b11a336b4ff6c748d20aade6e98b25c251bd8c8e -Merge: c921d4e b0b73db +Merge: c921d4e9 b0b73db3 Author: Patrick Schleizer Date: Mon May 15 16:58:11 2023 +0000 Merge remote-tracking branch 'github-kicksecure/master' commit b0b73db3c84f8cc7594b6b181e0e495cd7e92571 -Merge: c921d4e cf003df +Merge: c921d4e9 cf003dfa Author: Patrick Schleizer Date: Mon May 15 12:57:46 2023 -0400 Merge pull request #126 from raja-grewal/Comment - + Update comments commit cf003dfad85434f5a52524fdd97a7f619ba82429 @@ -2435,28 +13123,28 @@ Date: Mon May 15 11:56:30 2023 +0000 bumped changelog version commit 39676395f814007f74ce1edb0aee0ada4d4fa478 -Merge: 6511dac 1f38fcf +Merge: 6511dac1 1f38fcfe Author: Patrick Schleizer Date: Mon May 15 11:34:57 2023 +0000 Merge remote-tracking branch 'github-kicksecure/master' commit 1f38fcfefa1ccd732e4500522cc0978bda69ab0b -Merge: d66a9ba 6ab400c +Merge: d66a9bac 6ab400c9 Author: Patrick Schleizer Date: Mon May 15 07:34:16 2023 -0400 Merge pull request #125 from JeremyRand/typo - + mmap-rnd-bits: Fix typo in error message commit d66a9bac551e7544eed592a69f576d27880e2bf3 -Merge: 6511dac 9d23717 +Merge: 6511dac1 9d23717b Author: Patrick Schleizer Date: Mon May 15 07:34:00 2023 -0400 Merge pull request #124 from JeremyRand/doc-aslr - + README: Document mmap-rnd-bits commit 6ab400c9d982bde16271052f181c87255046037e @@ -2562,19 +13250,19 @@ Date: Fri May 5 14:44:29 2023 +0000 minor mmap-rnd-bits improvements commit 15d0ee100834e01e3f17ee179c3120f37eb3cae5 -Merge: 1137e6c 2d40bbc +Merge: 1137e6c9 2d40bbc8 Author: Patrick Schleizer Date: Fri May 5 14:37:34 2023 +0000 Merge remote-tracking branch 'github-kicksecure/master' commit 2d40bbc8fec7ceea47b64fdebc9e751b26e0cf27 -Merge: 5c6db28 48a68ba +Merge: 5c6db288 48a68ba2 Author: Patrick Schleizer Date: Fri May 5 10:14:43 2023 -0400 Merge pull request #120 from JeremyRand/aslr-ppc64le - + vm.mmap_rnd_bits: Fix ppc64le commit 48a68ba237895c0c6c24ebd256ae6a9adec2628f @@ -2606,25 +13294,25 @@ Author: Jeremy Rand Date: Fri Mar 24 12:32:58 2023 +0000 vm.mmap_rnd_bits: Fix ppc64le - + Probably fixes a bunch of other non-x86_64 arches too. commit 5c6db28881463e8c764872a8cd268c23ac64b8f1 -Merge: 8a34d6c ed5f8be +Merge: 8a34d6c0 ed5f8be9 Author: Patrick Schleizer Date: Fri Mar 31 04:52:55 2023 -0400 Merge pull request #122 from raja-grewal/tcp - + Remove outdated comment about SACK, DSACK, and FACK commit 8a34d6c067bdebc513f34cd3c434b0675f118e10 -Merge: 1137e6c 7a4212d +Merge: 1137e6c9 7a4212dd Author: Patrick Schleizer Date: Fri Mar 31 04:52:18 2023 -0400 Merge pull request #121 from raja-grewal/copyright - + Update Copyright commit ed5f8be9ebd4f34c8b8de78abe0a8df0775b80aa @@ -2656,7 +13344,7 @@ Author: Patrick Schleizer Date: Wed Jan 25 15:13:19 2023 -0500 move kexec disabling to dedicated file `/etc/sysctl.d/30_security-misc_kexec-disable.conf` - + so ram-wipe can `config-package-dev` `hide` this config file commit 56c7c57b3a3929f57c9173f9156b2b9f7f7f854e @@ -2712,7 +13400,7 @@ Author: Patrick Schleizer Date: Mon Jan 9 06:37:45 2023 -0500 disable kexec (revert enabling kexec) - + remove kexec-utils for ram-wipe since moved to its own package commit 87c4e77c017aba7d57ae1fc7cf41a1f3143f1a04 @@ -2732,7 +13420,7 @@ Author: Patrick Schleizer Date: Mon Jan 9 05:34:07 2023 -0500 use warn instead of info for now - + because dracut does not show info messages when kernel parameter quiet is set commit 7fa6946694a997e04b17ecb3a167d767543093a2 @@ -2962,7 +13650,7 @@ Author: Patrick Schleizer Date: Sat Jan 7 15:32:25 2023 -0500 Depends: kexec-tools - + required for cold boot attack defense second RAM wipe after reboot commit b0630f58c136d6c7a964447806ec8ee603a73aa8 @@ -3164,7 +13852,7 @@ Date: Sat Jan 7 12:43:07 2023 -0500 minor commit 450ff378b067070618e4a972f8131acac5b292e0 -Merge: 929f49f b8e82ff +Merge: 929f49f3 b8e82fff Author: Patrick Schleizer Date: Sat Jan 7 12:38:14 2023 -0500 @@ -3333,23 +14021,23 @@ Date: Sun Dec 18 14:37:51 2022 -0500 bumped changelog version commit 75beb52bd5b7cee4a48eead53dbbe7fac9f6cc9e -Merge: 98f753d 58b622f +Merge: 98f753d8 58b622f0 Author: Patrick Schleizer Date: Sun Dec 18 06:24:41 2022 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 58b622f0fe373b6e2fb30b9564b22f1064f690b0 -Merge: 98f753d f81714b +Merge: 98f753d8 f81714be Author: Patrick Schleizer Date: Sun Dec 18 06:23:26 2022 -0500 Merge pull request #114 from raja-grewal/framebuffer - + Add some framebuffer drivers into blacklist commit f81714be506d1b15c0e79cbe8378bf8a18a2256f -Merge: d67845f 98f753d +Merge: d67845fe 98f753d8 Author: Raja Grewal Date: Tue Dec 13 05:14:56 2022 +0000 @@ -3516,7 +14204,7 @@ Author: Patrick Schleizer Date: Tue Nov 15 12:29:41 2022 -0500 pam-info: create debug log file ~/pam-info-debug.txt - + when file /etc/pam-info-debug exists commit 2872c2ab52ae9a1eaa25ea8b9852401e82d5616a @@ -3536,7 +14224,7 @@ Author: Raja Grewal Date: Wed Nov 9 20:43:59 2022 +1100 Include several framebuffer drivers into blacklist - + These were previously commented out to test for compatibility issues. commit 2319458e9f1a0ae2b60cf5786122c19459bbaea1 @@ -3546,19 +14234,19 @@ Date: Wed Aug 24 18:28:39 2022 -0400 bumped changelog version commit cdfc175953a8ab358bb8e6db2610df11733ba258 -Merge: ff84514 ae4d498 +Merge: ff845146 ae4d4989 Author: Patrick Schleizer Date: Mon Aug 22 06:09:30 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit ae4d4989b0e8ea79b5661f098e9814379ff9401e -Merge: ff84514 d500205 +Merge: ff845146 d500205f Author: Patrick Schleizer Date: Mon Aug 22 06:09:40 2022 -0400 Merge pull request #113 from raja-grewal/master - + Comment out machine check exception commit d500205f556ba896417eb0bae1df0144b00ef7b9 @@ -3626,25 +14314,25 @@ Author: Patrick Schleizer Date: Sat Jul 23 07:49:56 2022 -0400 undo `"force kernel to panic on "oopses"` - + because implemented differently already - + https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713 commit c1c04b4619eea4c79a0dbb5cced3ebb77482877c -Merge: 465775c bfe6b88 +Merge: 465775c9 bfe6b888 Author: Patrick Schleizer Date: Sat Jul 23 07:43:19 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit bfe6b888395abf554623a9e530fe7e6605047e12 -Merge: 465775c ca764d8 +Merge: 465775c9 ca764d8d Author: Patrick Schleizer Date: Sat Jul 23 07:27:24 2022 -0400 Merge pull request #111 from raja-grewal/harden - + Increased kernel hardening at boot commit ca764d8de0f17bb7e6d44e3d79ea1805276fc521 @@ -3690,7 +14378,7 @@ Date: Tue Jul 19 02:29:46 2022 +1000 shuffle and rewording commit 39314b291263a93fcb11756ce12bd8691a1fa0f6 -Merge: bb831d5 c4a1094 +Merge: bb831d57 c4a10947 Author: Raja Grewal Date: Tue Jul 19 00:49:08 2022 +1000 @@ -3709,7 +14397,7 @@ Date: Tue Jul 19 00:37:31 2022 +1000 enforce default net.ipv6.icmp_ignore_bogus_error_responses commit c4a10947608b0d5508ef5b18e0ab34a2ee4f35de -Merge: 2b23703 465775c +Merge: 2b237039 465775c9 Author: Raja Grewal Date: Mon Jul 18 13:36:23 2022 +0000 @@ -3722,19 +14410,19 @@ Date: Sat Jul 16 08:00:16 2022 -0400 bumped changelog version commit 1fafb5f53bbec57812f535e79bfb475628cc58e3 -Merge: 24d6a93 27aa523 +Merge: 24d6a93e 27aa5231 Author: Patrick Schleizer Date: Fri Jul 15 08:09:16 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 27aa5231e2d1dafd89ba19c8d6becf461e781605 -Merge: 24d6a93 a72bbb1 +Merge: 24d6a93e a72bbb18 Author: Patrick Schleizer Date: Fri Jul 15 08:06:08 2022 -0400 Merge pull request #112 from raja-grewal/blacklist - + Corrected kernel module disabling commit a72bbb1883613ee56be29949c153e0edb2d72a29 @@ -3756,27 +14444,27 @@ Date: Wed Jul 13 22:25:53 2022 +1000 Update README.md commit 8f31e5d1d172eb117bde63702f63081da182d5c5 -Merge: 6aa9a94 c410890 +Merge: 6aa9a947 c410890a Author: Patrick Schleizer Date: Wed Jul 13 07:26:58 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit c410890a8ade6d4be13dc99a7003f03ebded8153 -Merge: 6aa9a94 fe0cc10 +Merge: 6aa9a947 fe0cc108 Author: Patrick Schleizer Date: Wed Jul 13 07:24:12 2022 -0400 Merge pull request #110 from raja-grewal/master - - Incorporated Ubuntu’s kernel module blacklists and more verbose errors + + Incorporated Ubuntu_s kernel module blacklists and more verbose errors commit 4e93b4d37e4c6d23a0ac76ddb2144c6504a66ad1 Author: Raja Grewal Date: Wed Jul 13 21:10:39 2022 +1000 Revert "enforce defualt net.ipv4.ip_forward" - + This reverts commit 57b5b2145c4e6779f0b879ee4199d46938f20965. commit a47922ad28fc9ebba93615a6ffdaaeb4887cc140 @@ -3855,7 +14543,7 @@ commit 61ef9bd59f9ff39c140f782ff5b41d0a3c6d97bc Author: Raja Grewal Date: Sun Jul 10 04:52:00 2022 +1000 - Incorporated Ubuntu’s kernel module blacklists + Incorporated Ubuntu_s kernel module blacklists commit 6aa9a9472f10d4d6270dd59fbcd94d9001aca9e6 Author: Patrick Schleizer @@ -3894,19 +14582,19 @@ Date: Sat Jul 9 11:38:04 2022 -0400 fix commit 52c46e4706d5799d452f260616a3909c9a3bc78f -Merge: 1b8500c dc41a58 +Merge: 1b8500cc dc41a581 Author: Patrick Schleizer Date: Sat Jul 9 11:37:41 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit dc41a58102a114e21209aabeef9ad6b851365898 -Merge: 1b8500c e5f8004 +Merge: 1b8500cc e5f8004a Author: Patrick Schleizer Date: Sat Jul 9 11:37:57 2022 -0400 Merge pull request #108 from Krish-sysadmin/master - + Continue for loop if unable to change one directory's permission commit 1b8500cc22fdd6a51ec66ae1b04abccb9a529150 @@ -3932,7 +14620,7 @@ Author: Patrick Schleizer Date: Thu Jul 7 15:39:40 2022 -0400 not blacklist CD-ROM / DVD yet - + https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31 commit d5c16503411bee4199c35a51226fc59924d6e142 @@ -3948,7 +14636,7 @@ Date: Thu Jul 7 15:27:15 2022 -0400 shuffle commit d018bdaf73e109a61c0687a171af843c890729e0 -Merge: 1b287a6 780dc8e +Merge: 1b287a64 780dc8ee Author: Patrick Schleizer Date: Thu Jul 7 15:26:08 2022 -0400 @@ -3971,7 +14659,7 @@ Author: Raja Grewal Date: Fri Jul 8 02:12:04 2022 +1000 Revert "replace /bin/false -> /bin/true" - + This reverts commit f0511635a9725f79863c41a7b8d9f8a077ba8788. commit 28381e81d4a57c59929a37745fa8ba5f3e0b25cb @@ -4081,10 +14769,10 @@ Author: Patrick Schleizer Date: Sat Jul 2 18:12:36 2022 -0400 wipe RAM at shutdown: Ensure any remaining disk cache is erased by Linux' memory poisoning - + by running: `echo 3 > /proc/sys/vm/drop_caches` - + Inspired by Tails: https://gitlab.tails.boum.org/tails/tails/-/blob/master/config/chroot_local-includes/usr/local/lib/initramfs-pre-shutdown-hook @@ -4172,7 +14860,7 @@ Author: Patrick Schleizer Date: Thu Jun 30 13:50:18 2022 -0400 skip ram wipe inside VMs - + https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596/40 commit e06405c7be683450e6c6f737171b4f10513254e7 @@ -4336,9 +15024,9 @@ Author: Patrick Schleizer Date: Wed Jun 29 14:13:30 2022 -0400 ram wipe on shutdown: fix, added `need_shutdown` hook - + Otherwise dracut does not run on shutdown. - + Without `need_shutdown` file `/run/initramfs/.need_shutdown` does not get created. And without that file `/usr/lib/dracut/dracut-initramfs-restore`, which itself is started by `/lib/systemd/system/dracut-shutdown.service` does nothing. @@ -4432,7 +15120,7 @@ Author: Patrick Schleizer Date: Wed Jun 29 09:35:08 2022 -0400 add shebang /bin/sh - + to fix lintian warning security-misc: executable-not-elf-or-script usr/lib/dracut/modules.d/40sdmem-security-misc/wipe.sh @@ -4442,11 +15130,11 @@ Date: Wed Jun 29 09:32:55 2022 -0400 - Wipe LUKS Disk Encryption Key for Root Disk from RAM during Shutdown to defeat Cold Boot Attacks - Confirm in console output if encrypted mounts (root disk) is unmounted. (Because that is a pre-condition for wiping the LUKS full disk encryption key from RAM.) - + Thanks to @friedy10! - + https://github.com/friedy10/dracut/tree/master/modules.d/40sdmem - + https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596 commit adca1ebdf6c83c5c1c846cdb29f3e16ea9cdf32f @@ -4468,19 +15156,19 @@ Date: Wed Jun 8 09:04:03 2022 -0400 remove unicode commit fcaec49675ce7e240bdd049aab184fbee0945c7d -Merge: 5c43197 995e4ba +Merge: 5c43197f 995e4ba7 Author: Patrick Schleizer Date: Wed Jun 8 08:20:24 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 995e4ba7fafc1bf4f691b83dde415c57cebed63d -Merge: 616fe85 6e8f584 +Merge: 616fe857 6e8f584d Author: Patrick Schleizer Date: Wed Jun 8 08:19:03 2022 -0400 Merge pull request #104 from ntninja/patch-1 - + Fix issues found with permission-hardening on my system commit 5c43197f10df3a49704a66ef3e3d56f122be4775 @@ -4532,19 +15220,19 @@ Date: Fri May 20 14:46:38 2022 -0400 copyright commit 78a9956b73498bad471ee1cb0fa0993f2e5ce3c0 -Merge: 4a3ed17 7651308 +Merge: 4a3ed171 76513087 Author: Patrick Schleizer Date: Thu May 19 19:41:33 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 76513087872943442df32451de5af158c2bbe944 -Merge: 4a3ed17 93efa50 +Merge: 4a3ed171 93efa506 Author: Patrick Schleizer Date: Thu May 19 19:39:42 2022 -0400 Merge pull request #103 from 0xC0ncord/bugfix/selinuxfs_restrictions - + hide-hardware-info: re-enable restrictions on sysfs when using SELinux commit 4a3ed17160c14ba7122d770665b53bde96038307 @@ -4588,11 +15276,11 @@ Author: Patrick Schleizer Date: Thu Feb 10 13:44:55 2022 -0500 fix, skip deletion of system.map files on read-only filesystems - + This is required for Qubes /lib/modules read-only implementation at time of writing. - + Thanks to @marmarek for the bug report! - + https://forums.whonix.org/t/remove-system-map-cannot-work-lib-modules-is-mounted-read-only/13324 commit 356232677a036cd1a673d805caa4d74a327ea096 @@ -4612,7 +15300,7 @@ Author: 0xC0ncord Date: Fri Oct 8 22:11:58 2021 -0400 hide-hardware-info: re-enable restrictions on sysfs when using SELinux - + When using SELinux, restrict the parts of sysfs explicitly to ensure restrictions are working as expected. @@ -4669,7 +15357,7 @@ Author: Patrick Schleizer Date: Mon Sep 6 08:22:55 2021 -0400 do not set kernel parameter `quiet loglevel=0` for recovery boot option - + for easier debugging commit 49902b8c56512c3ee8b3d16b0ca513e44349c66d @@ -4737,7 +15425,7 @@ Author: Patrick Schleizer Date: Wed Sep 1 15:55:53 2021 -0400 fix faillock implementation - + dovecot / ssh are exempted commit 8b104f544a9e4e8da1691659fefa4999a4f6f085 @@ -4745,7 +15433,7 @@ Author: Patrick Schleizer Date: Wed Sep 1 15:45:36 2021 -0400 fix, add sshd to pam_service_exclusion_list - + to avoid faillock commit 224ae730c13f4add672fffaf58206eeb7ae24090 @@ -4777,11 +15465,11 @@ Author: Patrick Schleizer Date: Tue Aug 17 15:21:26 2021 -0400 add hardened malloc compatibility for haveged workaround - + `/lib/systemd/system/haveged.service.d/30_security-misc.conf` - + `SystemCallFilter=getrandom` - + Otherwise haveged will exit with a core dump. commit 8676beef90040bdf0782e0a9c683c6463ddb48b5 @@ -4795,7 +15483,7 @@ Author: Patrick Schleizer Date: Tue Aug 10 17:13:00 2021 -0400 port from pam_tally2 to pam_faillock - + since pam_tally2 was deprecated upstream commit 2bf0e7471cbd3b813ce385d994e43e48636f7a0b @@ -4803,7 +15491,7 @@ Author: Patrick Schleizer Date: Tue Aug 10 15:11:01 2021 -0400 port from pam_tally2 to pam_faillock - + since pam_tally2 was deprecated upstream commit 2aea74bd715d865f44f91aaab6ca1bf0a00a2b0b @@ -4825,7 +15513,7 @@ Author: Patrick Schleizer Date: Tue Aug 3 13:04:34 2021 -0400 `lintian --suppress-tags obsolete-command-in-modprobe.d-file` - + https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/24 commit 50bdd097df4c87cd4507311df9c0b14d237c534b @@ -4851,11 +15539,11 @@ Author: Patrick Schleizer Date: Tue Aug 3 12:37:39 2021 -0400 enable "`apt-get --error-on=any`" by default - + makes apt exit non-zero for transient failures - + `/etc/apt/apt.conf.d/40error-on-any` - + https://forums.whonix.org/t/debian-bullseye-apt-get-error-on-any/12068 commit 240ec7672a4d513e7e6cca280aca3d67c265d1cc @@ -4923,7 +15611,7 @@ Author: Patrick Schleizer Date: Sun Jul 25 11:26:20 2021 -0400 improve LKRG VirtualBox host configuration - + as per https://github.com/openwall/lkrg/issues/82#issuecomment-886188999 commit 3ebe9e7c530b39f1b0429a97eab2627f2bbd1635 @@ -4937,7 +15625,7 @@ Author: Patrick Schleizer Date: Sat Jul 24 18:03:40 2021 -0400 add LKRG compatibility settings automation for VirtualBox hosts - + https://github.com/openwall/lkrg/issues/82 commit 0f86ffef04e533be1c88584b6419c276d176fc05 @@ -4951,7 +15639,7 @@ Author: Patrick Schleizer Date: Sun Jun 20 11:18:56 2021 -0400 pam-abort-on-locked-password: more descriptive error handling - + https://forums.whonix.org/t/restrict-root-access/7658/1 commit 0f3dbfc4a1fb08b5542e265dfbeab4e7f401549d @@ -4973,19 +15661,19 @@ Date: Mon Jun 7 12:13:37 2021 -0400 bumped changelog version commit 30d1ce36af7835d47e0b53af475f3a7e99617b77 -Merge: 0305baf 70a1eb2 +Merge: 0305baf2 70a1eb25 Author: Patrick Schleizer Date: Mon Jun 7 12:11:58 2021 -0400 Merge remote-tracking branch 'github-whonix/master' commit 70a1eb25a5976e0461056ff2c56bd82ab5df6c2c -Merge: 0305baf 97d8db3 +Merge: 0305baf2 97d8db3f Author: Patrick Schleizer Date: Sat Jun 5 15:55:41 2021 -0400 Merge pull request #101 from madaidan/sudo - + Restrict sudo's file permissions commit 97d8db3f74b9fc00c8f4416cb72966e62c7de88e @@ -5023,7 +15711,7 @@ Author: Patrick Schleizer Date: Thu Apr 29 11:17:30 2021 -0400 config-package-dev displace /etc/dkms/framework.conf - + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 commit e2afd00627b097f75467cd0e2fe7e15977141026 @@ -5031,17 +15719,17 @@ Author: Patrick Schleizer Date: Thu Apr 29 11:14:30 2021 -0400 modify DKMS configuration file `/etc/dkms/framework.conf` - + Lower parallel compilation jobs to 1 if less than 2 GB RAM to avoid freezing of virtual machines. - + `parallel_jobs=1` - + This does not necessarily belong into security-misc, however likely security-misc will need to modify `/etc/dkms/framework.conf` in the future to enable kernel module signing. - + https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/26 - + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 commit 3ba3b371873d221db6845fb0fe52191b8b349b0a @@ -5049,11 +15737,11 @@ Author: Patrick Schleizer Date: Thu Apr 29 11:08:30 2021 -0400 add `/etc/dkms/framework.conf.security-misc` - + original, from - https://github.com/dell/dkms/blob/master/dkms_framework.conf - https://raw.githubusercontent.com/dell/dkms/master/dkms_framework.conf - + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 commit 1d35bdf2912d1dfd0b49ce727338f86d17decd72 @@ -5067,9 +15755,9 @@ Author: Patrick Schleizer Date: Sat Apr 3 11:44:13 2021 -0400 systemd RemainAfterExit=yes - + for better usability - + https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/33 commit e8ea94325b1df7bc0c47eabdfbd7c24b2fe51539 @@ -5097,19 +15785,19 @@ Date: Mon Mar 1 09:15:44 2021 -0500 comment commit 3382192b89de3891d45261f138652bdb48c5674b -Merge: 7f30d70 2e8e3c0 +Merge: 7f30d702 2e8e3c07 Author: Patrick Schleizer Date: Mon Mar 1 09:12:18 2021 -0500 Merge remote-tracking branch 'github/master' commit 2e8e3c07c4dda7f8500237dfa7a1d2bc7aecef5d -Merge: 7f30d70 4db7d6b +Merge: 7f30d702 4db7d6be Author: Patrick Schleizer Date: Mon Mar 1 14:11:28 2021 +0000 Merge pull request #100 from 0xC0ncord/bugfix/selinuxfs_restrictions - + hide-hardware-info: allow unrestricting selinuxfs commit 7f30d702953b2e46255e3e8e71ee47af3f5a5725 @@ -5129,7 +15817,7 @@ Author: Kenton Groombridge Date: Sat Feb 6 03:02:08 2021 -0500 hide-hardware-info: allow unrestricting selinuxfs - + On SELinux systems, the /sys/fs/selinux directory must be visible to userspace utilities in order to function properly. @@ -5168,9 +15856,9 @@ Author: Patrick Schleizer Date: Wed Jan 27 05:49:34 2021 -0500 skip counting failed login attempts from dovecot - + Failed dovecot logins should not result in account getting locked. - + revert "use pam_tally2 only for login" commit 480f74cab6d79886fe29eeecc5b7ebc1f138f8dd @@ -5184,7 +15872,7 @@ Author: Patrick Schleizer Date: Sun Jan 24 05:04:48 2021 -0500 use pam_tally2 only for login - + to skip counting failed login attempts over ssh and mail login commit 126c31c37d17a55b0980dcae8c546aeed4282a99 @@ -5230,19 +15918,19 @@ Date: Tue Jan 12 03:19:31 2021 -0500 new file: README_generic.md commit 94627f0875e69c9314faab8b0dc2dbe22af5c88f -Merge: 353e74f 79876f7 +Merge: 353e74fb 79876f7b Author: Patrick Schleizer Date: Tue Jan 12 03:18:41 2021 -0500 Merge remote-tracking branch 'github/master' commit 79876f7b1261006885a713dbfda97609c8e81f3f -Merge: 353e74f 3066b5a +Merge: 353e74fb 3066b5ad Author: Patrick Schleizer Date: Tue Jan 12 08:17:04 2021 +0000 Merge pull request #99 from madaidan/docs - + Overhaul documentation commit 3066b5ad972f16069361999afbca0978986db862 @@ -5298,7 +15986,7 @@ Author: Patrick Schleizer Date: Sun Dec 6 04:08:58 2020 -0500 /opt - + https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706/68 commit 261ef85c14ff9c13d3d7734d8c9eba5a54497187 @@ -5312,7 +16000,7 @@ Author: Patrick Schleizer Date: Tue Dec 1 05:14:48 2020 -0500 SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists - + `whitelists_disable_all=true` commit b09cc0de6af2d7e12110a0f3030234539288abad @@ -5320,7 +16008,7 @@ Author: Patrick Schleizer Date: Tue Dec 1 05:10:26 2020 -0500 Revert "SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists" - + This reverts commit 36a471ebce883f7a1660977f486b21ece320d0c2. commit 704f0500ba4e23a1e5b33688db02e03b1169046d @@ -5328,7 +16016,7 @@ Author: Patrick Schleizer Date: Tue Dec 1 05:03:16 2020 -0500 fix, rename 40_default_whitelist_[...].conf to 25_default_whitelist_[...].conf - + since whitelist needs to be defined before SUID removal commands commit 36a471ebce883f7a1660977f486b21ece320d0c2 @@ -5336,7 +16024,7 @@ Author: Patrick Schleizer Date: Tue Dec 1 05:02:34 2020 -0500 SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists - + `whitelists_disable_all=true` commit 318ab570aacd48b7f163331dc2ba8b012e0d2336 @@ -5344,11 +16032,11 @@ Author: Patrick Schleizer Date: Tue Dec 1 04:28:15 2020 -0500 simplify disabling of SUID Disabler and Permission Hardener whitelist - + split `/etc/permission-hardening.d/30_default.conf` into multiple files - + `/etc/permission-hardening.d/40_default_whitelist_[...].conf` - + therefore make it easier to delete any whitelisted SUID binaries commit cf07e977bd6697af7a4326d7705447d500d35593 @@ -5356,7 +16044,7 @@ Author: Patrick Schleizer Date: Sun Nov 29 09:09:42 2020 -0500 add `/bin/pkexec exactwhitelist` for consistency - + since there is already `/usr/bin/pkexec exactwhitelist` commit fe274838861ada125eccdca11ba044123fdae663 @@ -5370,9 +16058,9 @@ Author: Patrick Schleizer Date: Sat Nov 28 05:31:12 2020 -0500 add feature `/usr/lib/security-misc/permission-hardening-undo /path/to/filename` - + to allow removing 1 SUID - + fix, show INFO message if file does not exist during removal rather than ERROR commit 0ef35f877066ddac21737e707829c4571bb76abd @@ -5398,11 +16086,11 @@ Author: Patrick Schleizer Date: Thu Nov 5 06:42:47 2020 -0500 fix, no longer unconditionally abort pam for user accounts with locked passwords - + as locked user accounts might have valid sudoers exceptions - + Thanks to @mimp for the bug report! - + https://forums.whonix.org/t/pam-abort-on-locked-password-and-running-privileged-command-from-web-browser/10521 commit 211769dc65a5c98cbdb55ce62e83c9e2a9fa1540 @@ -5455,19 +16143,19 @@ Date: Mon Oct 5 07:03:37 2020 -0400 bumped changelog version commit 3adb2c92d9551f649b177753fede18da3cc4b0eb -Merge: feb7cea 5856013 +Merge: feb7cea4 58560138 Author: Patrick Schleizer Date: Sat Oct 3 14:10:32 2020 -0400 Merge remote-tracking branch 'github/master' commit 58560138cdc36fa5f6142f75f0fed53bcad96363 -Merge: feb7cea 06ffd5d +Merge: feb7cea4 06ffd5d2 Author: Patrick Schleizer Date: Sat Oct 3 18:09:07 2020 +0000 Merge pull request #77 from madaidan/debugfs - + Restrict access to debugfs commit 06ffd5d2201152c60eb4309860b8c42be386dccb @@ -5487,7 +16175,7 @@ Author: Patrick Schleizer Date: Mon Sep 28 10:29:50 2020 -0400 unblacklist squashfs as this would likely break Whonix-Host ISO - + https://github.com/Whonix/security-misc/pull/75#issuecomment-700044182 commit 4070133ed65af409adeb6f8c7970d3bc7074b02b @@ -5495,32 +16183,32 @@ Author: Patrick Schleizer Date: Mon Sep 28 10:25:57 2020 -0400 unblacklist vfat - + https://github.com/Whonix/security-misc/pull/75#issuecomment-695201068 commit 77d461ec08ffdf0eb6a5d124927d9f9748c0dd3c -Merge: 5fc7b79 3684ab5 +Merge: 5fc7b791 3684ab58 Author: Patrick Schleizer Date: Mon Sep 28 10:24:59 2020 -0400 Merge remote-tracking branch 'github/master' commit 3684ab585eeab46ff17a1d410ce1bcff1a63968c -Merge: ae90107 a813e7d +Merge: ae90107e a813e7da Author: Patrick Schleizer Date: Mon Sep 28 14:24:15 2020 +0000 Merge pull request #75 from flawedworld/patch-1 - + Blacklist more modules (based on OpenSCAP for RHEL 8) commit ae90107e6df4d312a6734985df38b8533d1283c8 -Merge: 5fc7b79 8f7727e +Merge: 5fc7b791 8f7727e8 Author: Patrick Schleizer Date: Mon Sep 28 14:23:42 2020 +0000 Merge pull request #76 from flawedworld/patch-2 - + Add IPv6 sysctl options and enforce kernel.perf_event_paranoid=3 commit a813e7da07a39e96e0cd7937aee7568307a00287 @@ -5536,19 +16224,19 @@ Date: Sat Sep 19 09:28:27 2020 -0400 bumped changelog version commit bff6ce7abb920d55edc49b19340a1e9251a4cd8c -Merge: 98c0dec 9239c8b +Merge: 98c0deca 9239c8b8 Author: Patrick Schleizer Date: Sat Sep 19 06:54:50 2020 -0400 Merge remote-tracking branch 'github/master' commit 9239c8b8074018090d4fa1381aa06e66a99359cc -Merge: 98c0dec 8dfdec1 +Merge: 98c0deca 8dfdec1d Author: Patrick Schleizer Date: Sat Sep 19 10:54:21 2020 +0000 Merge pull request #71 from onions-knight/patch-1 - + Update thunar.xml commit 8f7727e823a86a1826686d5c95d0070721c7acba @@ -5562,7 +16250,7 @@ Author: flawedworld <38294951+flawedworld@users.noreply.github.com> Date: Fri Sep 18 23:29:04 2020 +0100 Disallow kernel profiling by users without CAP_SYS_ADMIN - + It's the default on a lot of stuff, but still nice to have. commit 98c0decaa46c6fb839062ff9af0556d821c254e6 @@ -5576,11 +16264,11 @@ Author: Patrick Schleizer Date: Mon Aug 3 08:12:19 2020 -0400 fix, allow group `sudo` and `console` to use consoles - + fix /etc/security/access-security-misc.conf syntax error - + Thanks to @81a989 for the bug report! - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/31 commit b09f5ddc154d6561fd97b436feeb6a6225f89206 @@ -5606,9 +16294,9 @@ Author: Patrick Schleizer Date: Thu May 14 13:47:58 2020 -0400 move "kernel.printk = 3 3 3 3" to separate file /etc/sysctl.d/30_silent-kernel-printk.conf - + so package debug-misc can easily disable it - + https://phabricator.whonix.org/T950 commit 81cb6ad2462a900f9c5193278de70ada62a5585b @@ -5622,9 +16310,9 @@ Author: Patrick Schleizer Date: Thu Apr 23 12:26:31 2020 -0400 Prevent kernel info leaks in console during boot. - + add kernel parameter `quiet loglevel=0` - + https://phabricator.whonix.org/T950 commit aa5631b02b0127b4681ae08c973b08b23befd701 @@ -5638,11 +16326,11 @@ Author: Patrick Schleizer Date: Thu Apr 16 08:00:31 2020 -0400 Prevent kernel info leaks in console during boot. - + By setting `kernel.printk = 3 3 3 3`. - + https://phabricator.whonix.org/T950 - + Thanks to @madaidan for the suggestion! commit 4898a9e753e9399e83e4a39d8fa340e1ad9d4f6d @@ -5650,9 +16338,9 @@ Author: Patrick Schleizer Date: Thu Apr 16 07:54:33 2020 -0400 fix, sysctl-initramfs: switch log to /run/initramfs/sysctl-initramfs-error.log - + since ephemeral, in RAM, not written to disk, no conflict with grub-live - + https://forums.whonix.org/t/kernel-hardening/7296/435 commit 701da5f6cc911e3946904c152078dc6c637e5070 @@ -5696,13 +16384,13 @@ Author: Patrick Schleizer Date: Mon Apr 13 06:50:32 2020 -0400 /etc/security/access-security-misc.conf white list ttyS0 etc. - + ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9 - + Thanks to @subpar_marlin for the bug report and helping to fix this! - + https://forums.whonix.org/t/how-do-i-enter-the-whonix-shell-from-cli/7271/43 - + https://forums.whonix.org/t/etc-security-hardening/8592 commit b3ce18f0f9f1da0552a4a1bd882a5b5dda13626e @@ -5710,7 +16398,7 @@ Author: Patrick Schleizer Date: Sun Apr 12 16:54:10 2020 -0400 disable proc-hidepid by default because incompatible with pkexec - + and undo pkexec wrapper commit 442931529121e9e402e7ac56e27df3dcec43167b @@ -5718,7 +16406,7 @@ Author: Patrick Schleizer Date: Sun Apr 12 16:52:55 2020 -0400 disable proc-hidepid by default because incompatible with pkexec - + and undo pkexec wrapper commit 72be31e870057b035651c1b5a7e9a9db149e9d25 @@ -5726,7 +16414,7 @@ Author: Patrick Schleizer Date: Sun Apr 12 16:48:13 2020 -0400 disable proc-hidepid by default because incompatible with pkexec - + and undo pkexec wrapper commit 938e929f39ff68296ab01a4b619f963ad3bdf535 @@ -5734,7 +16422,7 @@ Author: Patrick Schleizer Date: Sun Apr 12 16:37:51 2020 -0400 add pkexec to suid default whitelist - + /usr/bin/pkexec exactwhitelist /usr/bin/pkexec.security-misc-orig exactwhitelist @@ -5755,9 +16443,9 @@ Author: Patrick Schleizer Date: Wed Apr 8 21:04:02 2020 +0000 vm.swappiness=1 - + import from swappiness-lowest - + https://forums.whonix.org/t/vm-swappiness-1-set-swapiness-to-lowest-setting-still-useful-swappiness-lowest/9278 commit 642d4d8d939f33c19564dcc5a0ed46d85feb80aa @@ -5783,7 +16471,7 @@ Author: Patrick Schleizer Date: Wed Apr 8 16:46:11 2020 +0000 fix etc/default/grub.d/40_kernel_hardening.cfg - + in Qubes if no kernel package is installed commit bfd6018d8d108ee8691556529121fe2a679de1d2 @@ -5851,11 +16539,11 @@ Author: Patrick Schleizer Date: Thu Apr 2 06:04:45 2020 -0400 console lockdown: allow members of group `sudo` to use console - + https://forums.whonix.org/t/etc-security-hardening/8592 - + https://github.com/Whonix/security-misc/pull/74#issuecomment-607748407 - + https://www.whonix.org/wiki/Dev/Strong_Linux_User_Account_Isolation#Console_Lockdown commit 7764ee0d202193dc67f5805fc23be2b804962186 @@ -5975,19 +16663,19 @@ Date: Sat Mar 21 14:12:42 2020 -0400 remove trailing space commit 7c25fc517e6f42d4364a55407f6bf0c84d130c8e -Merge: 20f0c57 1cbc7f6 +Merge: 20f0c574 1cbc7f6b Author: Patrick Schleizer Date: Sat Mar 21 14:12:25 2020 -0400 Merge remote-tracking branch 'origin/master' commit 1cbc7f6bed8acc112b610e05f527cffc6e9e1e87 -Merge: 20f0c57 89ada11 +Merge: 20f0c574 89ada11c Author: Patrick Schleizer Date: Sat Mar 21 18:11:57 2020 +0000 Merge pull request #73 from madaidan/sysctl-initramfs - + Only remount in sysctl-initramfs if already mounted read-only commit 89ada11cf9a76cf02b3d5f92fd5c66194fe40ff0 @@ -5997,19 +16685,19 @@ Date: Sat Mar 21 17:49:07 2020 +0000 Only remount if already mounted read-only commit 20f0c574d5424c78ab6b4d3829a6662615967ba5 -Merge: e4118cb 2938182 +Merge: e4118cb2 2938182c Author: Patrick Schleizer Date: Sat Mar 21 13:28:43 2020 -0400 Merge remote-tracking branch 'origin/master' commit 2938182ce6303e6e55086e2e9e82f8263a3c8e76 -Merge: e4118cb c8826d6 +Merge: e4118cb2 c8826d67 Author: Patrick Schleizer Date: Sat Mar 21 17:26:37 2020 +0000 Merge pull request #72 from madaidan/master - + Fix sysctl-initramfs logs commit c8826d6702ebaf280994effb22aea39b4cfd2dac @@ -6023,7 +16711,7 @@ Author: onions-knight <38859709+onions-knight@users.noreply.github.com> Date: Tue Mar 17 16:38:53 2020 +0000 Update thunar.xml - + Adding Delete option for thunar on right mouse click (removed in Debian 10). See https://forums.whonix.org/t/whonix-host-calamares-branding-suggestion/7772/26 commit e4118cb21eb8765bc8f4e7b5e05d464d72575824 @@ -6033,19 +16721,19 @@ Date: Thu Mar 12 04:43:08 2020 -0400 bumped changelog version commit e6e7886a6e3dca1a75943c5a04c4d29ab8682cec -Merge: 04a87f7 711e786 +Merge: 04a87f70 711e786b Author: Patrick Schleizer Date: Wed Mar 11 09:08:41 2020 -0400 Merge remote-tracking branch 'origin/master' commit 711e786be504179c832172acb39d567b323520e6 -Merge: 04a87f7 4d0de87 +Merge: 04a87f70 4d0de87f Author: Patrick Schleizer Date: Wed Mar 11 13:06:23 2020 +0000 Merge pull request #70 from madaidan/userfaultfd - + Fix unprivileged_userfaultfd commit 4d0de87f799d8032731140e9a5815d4773d91baa @@ -6071,13 +16759,13 @@ Author: Patrick Schleizer Date: Sun Mar 8 08:07:10 2020 -0400 disable `vm.unprivileged_userfaultfd=0` for now - + because broken - + https://forums.whonix.org/t/kernel-hardening/7296/406 - + reverts "Restrict the userfaultfd() syscall to root as it can make heap sprays easier." - + https://duasynt.com/blog/linux-kernel-heap-spray commit 44351ec9b78d59aeeef44675e8e203c7ace243f0 @@ -6135,23 +16823,23 @@ Date: Tue Mar 3 09:07:42 2020 -0500 readme commit 63c6405ab74f0dd5f3ec3838135b29304a3d1fc8 -Merge: e3e39f2 453aa8a +Merge: e3e39f22 453aa8a4 Author: Patrick Schleizer Date: Sat Feb 29 07:34:46 2020 -0500 Merge remote-tracking branch 'origin/master' commit 453aa8a4eb76fe56ad67f1aea8abfeb122e68a9c -Merge: e3e39f2 60fbf8b +Merge: e3e39f22 60fbf8b0 Author: Patrick Schleizer Date: Sat Feb 29 12:28:32 2020 +0000 Merge pull request #65 from madaidan/userfaultfd - + Restrict the userfaultfd() syscall to root commit e3e39f22354595c9f21c243d7bdadc1487374db8 -Merge: 649ec5d bd7678c +Merge: 649ec5df bd7678c5 Author: Patrick Schleizer Date: Sat Feb 29 05:01:41 2020 -0500 @@ -6162,10 +16850,10 @@ Author: Patrick Schleizer Date: Sat Feb 29 04:59:56 2020 -0500 pkexec wrapper: fix gdebi / synaptic - + but at cost of checking for passwordless sudo /etc/suders /etc/sudoers.d exceptions. - + http://forums.whonix.org/t/cannot-use-pkexec/8129/53 commit 32269d32b63e549f76b4090b675dd53256fbc42d @@ -6181,12 +16869,12 @@ Date: Sat Feb 29 04:59:02 2020 -0500 description commit bd7678c574819298b364185fe7e3362c7e8d4930 -Merge: d04d4bf 42d3b98 +Merge: d04d4bf0 42d3b986 Author: Patrick Schleizer Date: Fri Feb 28 12:04:05 2020 +0000 Merge pull request #66 from madaidan/mce - + Fix docs commit 42d3b986c41854fc2990557d2333874e9379793b @@ -6226,19 +16914,19 @@ Date: Mon Feb 24 18:23:15 2020 +0000 Restrict the userfaultfd() syscall to root commit 221000db5b184664c09dfe9cb7055de45331a7e1 -Merge: 01eaee9 c7f2537 +Merge: 01eaee99 c7f25379 Author: Patrick Schleizer Date: Mon Feb 17 03:17:11 2020 -0500 Merge remote-tracking branch 'origin/master' commit c7f2537930925e3ec250db81791a107af003079b -Merge: 01eaee9 8ea4e50 +Merge: 01eaee99 8ea4e50c Author: Patrick Schleizer Date: Mon Feb 17 08:16:34 2020 +0000 Merge pull request #64 from madaidan/extra_latent_entropy - + Gather more entropy during boot commit 8ea4e50c8e9c3c9ee650b665a32b78f67aedc1aa @@ -6260,7 +16948,7 @@ Date: Sat Feb 15 15:35:44 2020 -0500 bumped changelog version commit 412a83923dd09f36a25ebf9ce1991369d09c5e34 -Merge: dce54d5 4399a51 +Merge: dce54d5d 4399a512 Author: Patrick Schleizer Date: Sat Feb 15 15:30:32 2020 -0500 @@ -6279,12 +16967,12 @@ Date: Sat Feb 15 15:28:30 2020 -0500 readme commit 4399a512bef77ddec428bd4150cacebb77fc22da -Merge: 757df8f a79ce7f +Merge: 757df8fc a79ce7fa Author: Patrick Schleizer Date: Sat Feb 15 19:43:05 2020 +0000 Merge pull request #63 from madaidan/ldisc_autoload - + Document ldisc_autoload better commit a79ce7fa68c22048d3e10789fe209b14b818d0fb @@ -6294,23 +16982,23 @@ Date: Sat Feb 15 17:30:21 2020 +0000 Document ldisc_autoload better commit 757df8fceb29d9b6143cf26e73cb31dde69d0a71 -Merge: 9bbae90 a9a1581 +Merge: 9bbae903 a9a15817 Author: Patrick Schleizer Date: Sat Feb 15 05:43:43 2020 -0500 Merge remote-tracking branch 'origin/master' commit a9a1581720739966e94f18be556552e9d75d63b1 -Merge: 9bbae90 1e5946c +Merge: 9bbae903 1e5946c7 Author: Patrick Schleizer Date: Sat Feb 15 10:42:20 2020 +0000 Merge pull request #60 from madaidan/sysrq - + Restrict the SysRq key commit 1e5946c795e3962fdc2229146b9331d36a1d6c41 -Merge: 0f49736 9bbae90 +Merge: 0f497369 9bbae903 Author: Patrick Schleizer Date: Sat Feb 15 10:41:52 2020 +0000 @@ -6323,37 +17011,37 @@ Date: Sat Feb 15 05:29:48 2020 -0500 remove-system.map: lower verbosity output commit cce35e5109489df44916a08722d9016bb1e578ec -Merge: 14140ad e403517 +Merge: 14140ad4 e4035179 Author: Patrick Schleizer Date: Sat Feb 15 05:27:52 2020 -0500 Merge remote-tracking branch 'origin/master' commit e40351796e297673e1ec45dee7483079e96d9639 -Merge: 5124f8c 31009f0 +Merge: 5124f8ce 31009f0b Author: Patrick Schleizer Date: Sat Feb 15 10:25:15 2020 +0000 Merge pull request #62 from madaidan/shred - + Shred System.map files commit 5124f8cebcf6113547d11fc5193f83af1a2b6f84 -Merge: ac8757a 9b76713 +Merge: ac8757a0 9b767139 Author: Patrick Schleizer Date: Sat Feb 15 10:18:56 2020 +0000 Merge pull request #61 from madaidan/disable_early_pci_dma - + Avoid holes in IOMMU commit ac8757a031a02c6cbad564e6a857954c0cf01a54 -Merge: ad6b766 ace6211 +Merge: ad6b7668 ace62111 Author: Patrick Schleizer Date: Sat Feb 15 10:09:46 2020 +0000 Merge pull request #59 from madaidan/ldisc - + Restrict loading line disciplines to CAP_SYS_MODULE commit 31009f0bfa10e7b67f5823a5be92273e5414fff3 @@ -6393,12 +17081,12 @@ Date: Fri Feb 14 17:50:19 2020 +0000 Restrict loading line disciplines to CAP_SYS_MODULE commit ad6b76688677cd4f9f0b2f2524c0f6b0a381bf29 -Merge: 14140ad 14f8458 +Merge: 14140ad4 14f84583 Author: Patrick Schleizer Date: Thu Feb 13 18:40:58 2020 +0000 Merge pull request #57 from madaidan/sysctl - + Prevent symlink/hardlink TOCTOU races commit 14140ad41ba45b2457570a7df28b42cfd3bf3155 @@ -6414,19 +17102,19 @@ Date: Thu Feb 13 13:38:21 2020 -0500 readme commit 76a51a3b45113b4f771397bf32daae3fb38af6a6 -Merge: 163e20b 5ebab39 +Merge: 163e20b8 5ebab397 Author: Patrick Schleizer Date: Thu Feb 13 13:37:34 2020 -0500 Merge remote-tracking branch 'origin/master' commit 5ebab397b201f431e3d0ca3bebfb71fa61a7ed2b -Merge: 163e20b 2796c2d +Merge: 163e20b8 2796c2dd Author: Patrick Schleizer Date: Thu Feb 13 18:36:41 2020 +0000 Merge pull request #58 from madaidan/mitigations - + Improve CPU mitigations documentation commit 2796c2dd00fca0bb458bdb4ea5c2cdbd35854bef @@ -6466,19 +17154,19 @@ Date: Wed Feb 5 06:31:48 2020 -0500 bumped changelog version commit 3024006f63be34f0c9d2968b1839a855419792dd -Merge: 8c5cd86 024576e +Merge: 8c5cd865 024576e3 Author: Patrick Schleizer Date: Tue Feb 4 00:24:50 2020 -0500 Merge remote-tracking branch 'origin/master' commit 024576e3307e45c90b97ed8658ee82ceb1ed00aa -Merge: 8c5cd86 e4c6e89 +Merge: 8c5cd865 e4c6e897 Author: Patrick Schleizer Date: Tue Feb 4 05:24:05 2020 +0000 Merge pull request #56 from HulaHoop0/patch-1 - + kvm.nx_huge_pages=force commit e4c6e897cf37cbf5de6d90888a0ddbe56db11c2f @@ -6540,16 +17228,16 @@ Author: Patrick Schleizer Date: Thu Jan 30 05:55:13 2020 -0500 unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...) - + this might reduce performance - + * `spectre_v2=on` * `spec_store_bypass_disable=on` * `tsx=off` * `tsx_async_abort=full,nosmt` - + Thanks to @madaidan for the suggestion! - + https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647 commit 2711d0f7f08362f97383fbae81ce9d520b19dcbc @@ -6569,7 +17257,7 @@ Author: Patrick Schleizer Date: Thu Jan 30 00:46:48 2020 -0500 set kernel boot parameter `l1tf=full,force` and `nosmt=force` - + https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 commit efc40da4fb1fffcc760685cda0e49dc04da4c5fe @@ -6637,9 +17325,9 @@ Author: Patrick Schleizer Date: Fri Jan 24 04:30:36 2020 -0500 merge the many modprobe.d config files into 1 - + and use a name starting with double digits - + to make it easier to disable settings using a lexically higher config file commit 6a4c493213929b354a3c8d2acf2325473ae63cfd @@ -6647,9 +17335,9 @@ Author: Patrick Schleizer Date: Fri Jan 24 04:26:36 2020 -0500 merge the many sysctl config files into 1 - + and use a name starting with double digits - + to make it easier to disable settings using a lexically higher config file commit f653b94e7747436323e2083d416ab86560e3cd71 @@ -6687,7 +17375,7 @@ Author: Patrick Schleizer Date: Wed Jan 22 07:08:08 2020 -0500 add update initramfs trigger - + https://github.com/Whonix/security-misc/pull/53 commit df0b2afda1e1d5a3fddfd8c48b62a5de8295d687 @@ -6713,10 +17401,10 @@ Author: Patrick Schleizer Date: Mon Jan 20 08:49:02 2020 -0500 fix Whonix / Kicksecure - + /var/lib/dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted. /var/lib/dpkg/tmp.ci/preinst: ERROR: You probably want to run: - + sudo adduser user console commit 960e1ff6e82f8593c2d242a6a0f1e1cf5805c85b @@ -6738,19 +17426,19 @@ Date: Wed Jan 15 15:54:06 2020 -0500 error handling commit 7211f6e0199d2ccb50437c7a5b0842050590b5dc -Merge: e110ea0 f6cc76a +Merge: e110ea0b f6cc76ac Author: Patrick Schleizer Date: Wed Jan 15 15:53:36 2020 -0500 Merge remote-tracking branch 'origin/master' commit f6cc76acd729428f83d3497a2e83bfc4b14f1ff8 -Merge: e110ea0 1df48a2 +Merge: e110ea0b 1df48a22 Author: Patrick Schleizer Date: Wed Jan 15 20:52:33 2020 +0000 Merge pull request #55 from madaidan/sysctl.conf - + Process sysctl.conf in initramfs commit 1df48a226d83b98dadc8bfb8dbc479dd656e2313 @@ -6796,23 +17484,23 @@ Date: Wed Jan 15 10:08:57 2020 -0500 readme commit 8ab4623f8e81ad1b67858b458f2ae4085e7c8e65 -Merge: 8015954 087465a +Merge: 80159545 087465a0 Author: Patrick Schleizer Date: Wed Jan 15 06:06:39 2020 -0500 Merge remote-tracking branch 'origin/master' commit 087465a0cdecc4765f7b659256cdd5e8cdef73ab -Merge: 8015954 528c5fc +Merge: 80159545 528c5fc4 Author: Patrick Schleizer Date: Wed Jan 15 11:02:30 2020 +0000 Merge pull request #53 from madaidan/sysctl-initramfs - + Set sysctl values in initramfs commit 528c5fc4c41026396a63ac91af7c156dd0d4f191 -Merge: 9dc43ea 8015954 +Merge: 9dc43eae 80159545 Author: Patrick Schleizer Date: Wed Jan 15 11:02:03 2020 +0000 @@ -6823,11 +17511,11 @@ Author: Patrick Schleizer Date: Wed Jan 15 02:42:10 2020 -0500 fix xfce4-power-manager xfpm-power-backlight-helper pkexec lxsudo popup - + https://forums.whonix.org/t/xfce4-power-manager-xfpm-power-backlight-helper-pkexec-lxsudo-popup/8764 - + do show lxqt-sudo password prompt if there is a sudoers exceptoin - + improved pkexec wrapper logging commit d90ca4b1ad18289d6bcfcef51cfb032a0b4423eb @@ -6879,19 +17567,19 @@ Date: Tue Jan 14 09:18:30 2020 -0500 readme commit c377c5ff83437a5447ecc9c873150421f4f1e691 -Merge: 8341242 539f24b +Merge: 8341242a 539f24b6 Author: Patrick Schleizer Date: Tue Jan 14 09:01:38 2020 -0500 Merge remote-tracking branch 'origin/master' commit 539f24b65ee7739487d8038fcb1fdfb1ed62ab22 -Merge: 8341242 0953bbe +Merge: 8341242a 0953bbe1 Author: Patrick Schleizer Date: Tue Jan 14 14:01:17 2020 +0000 Merge pull request #54 from madaidan/panic_on_oops - + Document panic_on_oops commit 0953bbe1d7f3e789aef2218a65c14c586dab4bcb @@ -6931,19 +17619,19 @@ Date: Sat Jan 11 15:15:12 2020 -0500 lintian commit 3fae8e771ffbdd3023921b296e46cf982034d2ac -Merge: 13a1e13 e9f4dbd +Merge: 13a1e132 e9f4dbdd Author: Patrick Schleizer Date: Sat Jan 11 15:14:43 2020 -0500 Merge remote-tracking branch 'origin/master' commit e9f4dbdda579db83f330054253100bc7c5d1e2be -Merge: 13a1e13 6088444 +Merge: 13a1e132 6088444c Author: Patrick Schleizer Date: Sat Jan 11 20:14:10 2020 +0000 Merge pull request #52 from madaidan/vivid - + Blacklist the vivid kernel module commit 6088444c371f021ca23daa3a0ab1ee431d429a61 @@ -6993,7 +17681,7 @@ Author: Patrick Schleizer Date: Tue Dec 31 05:55:44 2019 -0500 add user "user" to group "console" in Whonix and Kicksecure - + enable Console Lockdown in Whonix and Kicksecure commit b5a2d1dc581b53974aaa148f6d8f3054c9d1c5fe @@ -7013,7 +17701,7 @@ Author: Patrick Schleizer Date: Tue Dec 31 02:46:32 2019 -0500 group ssh check was removed - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/27 commit 06ed728d791abe0ad3c93091fd8ebc088f73c4ef @@ -7027,15 +17715,15 @@ Author: Patrick Schleizer Date: Mon Dec 30 06:39:24 2019 -0500 Protect /bin/mount from 'chmod -x'. - + /bin/mount exactwhitelist /usr/bin/mount exactwhitelist - + Remove SUID from 'mount' but keep executable. - + /bin/mount 745 root root /usr/bin/mount 745 root root - + https://forums.whonix.org/t/disable-suid-binaries/7706/61 commit e4e9c4e3b09138af25e94a6db81b0f759ddb4d1b @@ -7109,7 +17797,7 @@ Author: Patrick Schleizer Date: Sun Dec 29 04:35:46 2019 -0500 exit with error if a config line cannot be processed rather than skipping - + https://forums.whonix.org/t/disable-suid-binaries/7706/59 commit d5c99f3a60372a00ded4b1b4340775aab1421d31 @@ -7135,9 +17823,9 @@ Author: Patrick Schleizer Date: Thu Dec 26 05:44:35 2019 -0500 /fusermount matchwhitelist - + unbreak AppImages such as electrum Bitcoin wallet - + https://forums.whonix.org/t/disable-suid-binaries/7706/57 commit 507a30d6e39f17fcb09b92033fe1d831e7d4baf4 @@ -7177,37 +17865,37 @@ Date: Tue Dec 24 06:00:41 2019 -0500 no longer hardcode amd64 commit d03a3d9ac03bc29ba349107855936dd194e12271 -Merge: 9d77d88 27a42a9 +Merge: 9d77d88a 27a42a9d Author: Patrick Schleizer Date: Tue Dec 24 05:57:24 2019 -0500 Merge remote-tracking branch 'origin/master' commit 27a42a9da82bc1f22135ffa509925f63177f25d9 -Merge: ac49c55 79241c5 +Merge: ac49c55d 79241c5d Author: Patrick Schleizer Date: Tue Dec 24 10:55:11 2019 +0000 Merge pull request #50 from madaidan/modules - + Make /lib/modules unreadable commit ac49c55d1fafff5f36bd7c595f50db295ff616a2 -Merge: 0c3d4ad 98e88d1 +Merge: 0c3d4ad2 98e88d14 Author: Patrick Schleizer Date: Tue Dec 24 10:55:03 2019 +0000 Merge pull request #49 from madaidan/kver - + Detect kernel upgrades commit 0c3d4ad255de75b57a2e316bf8a7fd77a2fc0d4d -Merge: 9d77d88 d1a0650 +Merge: 9d77d88a d1a0650f Author: Patrick Schleizer Date: Tue Dec 24 10:54:23 2019 +0000 Merge pull request #48 from madaidan/kernel-hardening - + Use only one slub_debug parameter commit 79241c5d09c4a7123cf90b45289b53d893135efb @@ -7283,7 +17971,7 @@ Date: Mon Dec 23 03:38:49 2019 -0500 description: lockdown not enabled yet commit b05669accfe6fac8070003bbd57939ca2c621445 -Merge: 11b4192 1ff51ee +Merge: 11b4192f 1ff51ee0 Author: Patrick Schleizer Date: Mon Dec 23 03:38:04 2019 -0500 @@ -7330,9 +18018,9 @@ Author: Patrick Schleizer Date: Mon Dec 23 02:29:47 2019 -0500 rename keyword whitelist to exactwhitelist - + add new keyword disablewhitelist - + refactoring commit 175d1c284552a08881286e8c3ca5d8eb9b97a144 @@ -7352,7 +18040,7 @@ Author: Patrick Schleizer Date: Mon Dec 23 01:42:03 2019 -0500 polkit-agent-helper-1 matchwhitelist to match both - + - /usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist - /lib/policykit-1/polkit-agent-helper-1 @@ -7361,7 +18049,7 @@ Author: Patrick Schleizer Date: Mon Dec 23 01:38:31 2019 -0500 matchwhitelist /qubes/qfile-unpacker to match both - + - /usr/lib/qubes/qfile-unpacker whitelist - /lib/qubes/qfile-unpacker @@ -7442,7 +18130,7 @@ Author: Patrick Schleizer Date: Mon Dec 23 00:47:49 2019 -0500 fix capability removal error handling - + https://forums.whonix.org/t/disable-suid-binaries/7706/45 commit b631e2ecd8ae0e08850edd81bf64b02666fb6234 @@ -7462,14 +18150,14 @@ Author: Patrick Schleizer Date: Sun Dec 22 19:42:40 2019 -0500 Remove suid / gid and execute permission for 'group' and 'others'. - + Similar to: chmod og-ugx /path/to/filename - + Removing execution permission is useful to make binaries such as 'su' fail closed rather than fail open if suid was removed from these. - + Do not remove read access since no security benefit and easier to manually undo for users. - + chmod 744 commit 58a4e0bc7d1b87d4d169f31dc5935c75e929c0b4 @@ -7489,26 +18177,26 @@ Author: Patrick Schleizer Date: Sun Dec 22 18:56:36 2019 -0500 suid utempter/utempter matchwhitelist - + to cover both: - + /usr/lib/x86_64-linux-gnu/utempter/utempter /lib/x86_64-linux-gnu/utempter/utempter commit 9409209b48fb8f803b88d72c0e7febaa74f5bd2c -Merge: 008ce48 bce02ff +Merge: 008ce481 bce02ffd Author: Patrick Schleizer Date: Sun Dec 22 10:29:08 2019 -0500 Merge remote-tracking branch 'origin/master' commit bce02ffdc01c22c8d5528eb5eaa7729a6b3137dd -Merge: 008ce48 8f11a52 +Merge: 008ce481 8f11a520 Author: Patrick Schleizer Date: Sun Dec 22 15:26:07 2019 +0000 Merge pull request #47 from madaidan/msr - + Blacklist CPU MSRs commit 8f11a520f4c406fa3187ad530f945a564b78a28c @@ -7558,23 +18246,23 @@ Author: Patrick Schleizer Date: Sat Dec 21 14:06:10 2019 -0500 no longer remount /lib - + https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25 commit 10c19d6a8fc6b6bc03067dc3be88f486aa78d438 -Merge: b2260f4 fffdf50 +Merge: b2260f48 fffdf509 Author: Patrick Schleizer Date: Sat Dec 21 13:00:41 2019 -0500 Merge remote-tracking branch 'origin/master' commit fffdf5090c707c698de4adacfd5837809b33aa99 -Merge: 1c99b56 f5a52ae +Merge: 1c99b56c f5a52aed Author: Patrick Schleizer Date: Sat Dec 21 17:59:56 2019 +0000 Merge pull request #46 from madaidan/remount-secure - + Don't remount /sys/kernel/security commit f5a52aeddc4742b4dbd8a0075d759b2ceaaae691 @@ -7588,7 +18276,7 @@ Author: Patrick Schleizer Date: Sat Dec 21 08:03:33 2019 -0500 add support for /etc/exec / /usr/local/etc/exec - + to allow enabling exec on a per VM basis commit 1c99b56c9b99cceab6fe38580d06197dd4bcfb77 @@ -7657,23 +18345,23 @@ Date: Sat Dec 21 06:58:01 2019 -0500 rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown - + https://github.com/Whonix/security-misc/pull/45 commit 2350e0f5d06d9625835ba1547aab0054b795c0c5 -Merge: 3ea5871 efd65a3 +Merge: 3ea58718 efd65a3f Author: Patrick Schleizer Date: Sat Dec 21 06:57:10 2019 -0500 Merge remote-tracking branch 'origin/master' commit efd65a3f15fc9380e2019c9d7ad0bf82adcc230d -Merge: c336bc4 c28ddf5 +Merge: c336bc4f c28ddf5c Author: Patrick Schleizer Date: Sat Dec 21 11:56:31 2019 +0000 Merge pull request #45 from madaidan/apparmor - + Delete apparmor profiles commit 3ea587187e9d0a927799a66d15d163ee56a41978 @@ -7681,7 +18369,7 @@ Author: Patrick Schleizer Date: Sat Dec 21 06:53:07 2019 -0500 no need to exclude xorg nosuid on Debian - + http://forums.whonix.org/t/permission-hardening/8655/25 commit c336bc4fd229d9a6370df5520aaa4e872465de5a @@ -7893,7 +18581,7 @@ Author: Patrick Schleizer Date: Sat Dec 21 04:08:35 2019 -0500 record existing modes in separate dpkg-statoverwrite databases - + to have a history of what was modified and to allow to undo changes commit 89be5f2ecb998c46ff4864996cd86b97fa56d176 @@ -7931,9 +18619,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 12:59:27 2019 -0500 add "/usr/lib/xorg/Xorg.wrap whitelist" - + until this is researched - + https://manpages.debian.org/buster/xserver-xorg-legacy/Xorg.wrap.1.en.html https://lwn.net/Articles/590315/ @@ -7942,7 +18630,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 12:57:24 2019 -0500 add matchwhitelist feature - + add "/usr/lib/virtualbox/ matchwhitelist" commit 3fab3876693f20303c95f03c45af9adb9ae680e2 @@ -7950,7 +18638,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 12:50:35 2019 -0500 suid /usr/bin/firejail whitelist - + There is a controversy about firejail but those who choose to install it should be able to use it. https://www.whonix.org/wiki/Dev/Firejail#Security @@ -7978,9 +18666,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 11:58:07 2019 -0500 fix terminology, sguid -> sgid - + Thanks to @madaidan for the bug report! - + https://forums.whonix.org/t/permission-hardening/8655/21 commit 1cd5fb6a0020504c7897acf169772d39b67f4bd4 @@ -8096,7 +18784,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 10:31:26 2019 -0500 speed up setuid removal by using find with '-perm /u=s,g=s' - + https://forums.whonix.org/t/permission-hardening/8655/19 commit 4cfdf2c65b57f410163653304871ee3eb1d3f6ea @@ -8128,7 +18816,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 09:43:23 2019 -0500 fix missing processing files bug - + https://forums.whonix.org/t/permission-hardening/8655/16 commit fbe2479f486add30cd29f5c4063a140c42c502fe @@ -8136,7 +18824,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 08:54:56 2019 -0500 count processed file system objects - + to be able to verify if any were "forgotten" commit 195ea522f5a8582851792b53047185717a6f679e @@ -8168,7 +18856,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 08:13:23 2019 -0500 do not remove suid from whitelisted binaries ever - + https://forums.whonix.org/t/permission-hardening/8655/13 commit d5f1bd8dd29a4f9e1ccb6fed82a255f7b7abfe6f @@ -8176,9 +18864,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 08:02:30 2019 -0500 fix mode sanity check - + no longer use seq due to issue - + https://forums.whonix.org/t/permission-hardening/8655/13 commit ddc0eec63d744e4600f3b1b8cdf60fef6d647cbe @@ -8306,9 +18994,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:32:26 2019 -0500 remove hardening-enable - + please invent package security-paranoid instead - + https://forums.whonix.org/t/security-hardening-tool-usr-bin-hardening-enable-by-security-misc/8609 commit 6c8127e3cd32c04a6eb4641ad856c7bf2c777fee @@ -8316,7 +19004,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:29:37 2019 -0500 remove "/lib/ nosuid" from permission hardening - + Takes 1 minute to parse. No SUID binaries there by default. remount-secure mounts it with nosuid anyhow. Therefore no processing it here. @@ -8326,7 +19014,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:27:11 2019 -0500 remount /lib with nosuid,nodev - + https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/22 commit 7f201604779e442660c4c13798b2b48d706576ac @@ -8340,7 +19028,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:22:59 2019 -0500 use must manually enable permission-hardening.service - + until development finished commit fa6f1e156898572513cacb1d65b042482896011a @@ -8366,10 +19054,10 @@ Author: Patrick Schleizer Date: Fri Dec 20 04:48:02 2019 -0500 fix - + fso: /lib/ usr/lib/security-misc/permission-hardening: line 19: /usr/bin/stat: Argument list too long - + https://forums.whonix.org/t/kernel-hardening/7296/326 commit e74d2e4f94f4cdb2f3a83f27e17e19e9e4078961 @@ -8527,7 +19215,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 02:57:57 2019 -0500 skip symlinks - + https://forums.whonix.org/t/kernel-hardening/7296/323? commit cc8f795799e76d61b60f31e718effb88478b0fea @@ -8553,7 +19241,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 02:39:53 2019 -0500 check string length of permission variable - + https://forums.whonix.org/t/kernel-hardening/7296/322 commit a89befd902f6976ebef303b22ee9f9cbc3a1cc23 @@ -8621,9 +19309,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 02:01:36 2019 -0500 exit non-zero if some line cannot be parsed - + therefore make systemd notice this - + therefore allow the sysadmin to notice this commit 66bcba831317cf4810e9123b305597ee85fc94bf @@ -8651,19 +19339,19 @@ Date: Fri Dec 20 01:31:37 2019 -0500 refactoring commit c5d1e9dda7059d18fad303128f6f09c98fe955b7 -Merge: 62eb462 a20b300 +Merge: 62eb4629 a20b3001 Author: Patrick Schleizer Date: Fri Dec 20 01:30:31 2019 -0500 Merge remote-tracking branch 'origin/master' commit a20b30013f9ae229d1fe86cc5992aac474a9d8e6 -Merge: 62eb462 9df7407 +Merge: 62eb4629 9df74072 Author: Patrick Schleizer Date: Fri Dec 20 06:29:58 2019 +0000 Merge pull request #44 from madaidan/permission-hardening - + Remove SUID bits commit 9df74072862b31871d0aad7bed8333fc8344ffec @@ -8707,9 +19395,9 @@ Author: Patrick Schleizer Date: Mon Dec 16 03:52:09 2019 -0500 remount /sys/kernel/security with nodev,nosuid[,noexec] - + as suggested by @madaidan - + http://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/238 commit 2c4170e6f3366709c391db396a74547d4fed9589 @@ -8729,11 +19417,11 @@ Author: Patrick Schleizer Date: Thu Dec 12 09:29:00 2019 -0500 increase priority of pam-abort-on-locked-password-security-misc - + since it has its own user help output - + so it shows before pam tally2 info - + to avoid duplicate non-applicable help text commit a10597de92c316cc32ab552865a6658b38b19f5e @@ -8803,7 +19491,7 @@ Author: Patrick Schleizer Date: Mon Dec 9 02:23:43 2019 -0500 read -r; refactoring - + as per https://mywiki.wooledge.org/BashFAQ/001 commit 7467252122cb2e7600ce5ab3dce9dac2aa7a0676 @@ -8813,19 +19501,19 @@ Date: Mon Dec 9 02:22:16 2019 -0500 quotes commit 9bea9960173cf06dcbc0aefa2fb3b10df1f84c69 -Merge: 6f94423 af62da3 +Merge: 6f944234 af62da34 Author: Patrick Schleizer Date: Mon Dec 9 02:21:47 2019 -0500 Merge remote-tracking branch 'origin/master' commit af62da34457a56fee43a6003036a3bb387b23b32 -Merge: 6f94423 d7e2dea +Merge: 6f944234 d7e2deae Author: Patrick Schleizer Date: Sun Dec 8 20:45:16 2019 +0000 Merge pull request #42 from madaidan/permission-hardening - + File permission hardening commit d7e2deae9250abd79ab83c2025b98476dde710d3 @@ -8863,20 +19551,20 @@ Author: Patrick Schleizer Date: Sun Dec 8 05:21:35 2019 -0500 security-misc `/usr/share/pam-configs/permission-lockdown-security-misc` is no longer required, removed. - + Thereby fix apparmor issue. - + > Dec 08 09:47:50 host audit[3232]: AVC apparmor="DENIED" operation="exec" profile="/usr/bin/whonixcheck" name="/usr/lib/security-misc/permission-lockdown" pid=3232 comm="sudo" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 > Dec 08 09:47:50 host sudo[3232]: pam_exec(sudo:session): execve(/usr/lib/security-misc/permission-lockdown,...) failed: Permission denied - + It is no longer required, because... - + existing linux user accounts: - + * Get permission lock down because security-misc `debian/security-misc.postinst` calls `/usr/lib/security-misc/permission-lockdown`. - + new linux user accounts (created at first boot): - + * security-misc `/usr/share/pam-configs/mkhomedir-security-misc` pam mkhomedir sets secure permissions using `umask=027`. commit edcc2de71dea9cf2f94ec008d2817a0cdfdf5b7c @@ -8902,9 +19590,9 @@ Author: Patrick Schleizer Date: Sun Dec 8 04:25:19 2019 -0500 skip sudo_users_check in Qubes - + Qubes users can use dom0 to get a root terminal emulator. - + For example: qvm-run -u root debian-10 xterm @@ -8943,7 +19631,7 @@ Author: Patrick Schleizer Date: Sun Dec 8 03:15:53 2019 -0500 higher priority usr/share/pam-configs/tally2-security-misc - + so it can give info before pam stack gets aborted by other pam modules commit 3bd0b3f837d5ad8c87e59b99c6baef1e2c74507b @@ -8975,7 +19663,7 @@ Author: Patrick Schleizer Date: Sun Dec 8 02:38:19 2019 -0500 abort installation if no user is a member of group "console"; output - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/7 commit 1dbca1ea2d80ff7f60a0f426b444994d6bd97d30 @@ -9063,19 +19751,19 @@ Date: Sun Dec 8 01:30:42 2019 -0500 description commit 491dd4d93d133ca23eaf5c501b7ab3d3bbf52a27 -Merge: 9432d16 a78a7e5 +Merge: 9432d163 a78a7e55 Author: Patrick Schleizer Date: Sun Dec 8 01:22:16 2019 -0500 Merge remote-tracking branch 'origin/master' commit a78a7e5571b178cbf4cddd065306d130431bc185 -Merge: 373e873 6846a94 +Merge: 373e8733 6846a943 Author: Patrick Schleizer Date: Sun Dec 8 06:21:44 2019 +0000 Merge pull request #41 from madaidan/system.map - + Check for more locations of System.map commit 6846a943277c5ad9049cbf3e21fcd739c316cf44 @@ -9091,19 +19779,19 @@ Date: Sat Dec 7 12:13:42 2019 -0500 /usr/bin/cat mrix, commit 373e8733d37cb795c7c48642346b0b6dc6dce30c -Merge: c1800b1 447eb14 +Merge: c1800b13 447eb144 Author: Patrick Schleizer Date: Sat Dec 7 11:34:42 2019 -0500 Merge remote-tracking branch 'origin/master' commit 447eb144325a532b0aaf7ce772d5a04005b2af1f -Merge: c1800b1 668b642 +Merge: c1800b13 668b6420 Author: Patrick Schleizer Date: Sat Dec 7 16:34:21 2019 +0000 Merge pull request #40 from madaidan/system.map - + Remove hyphen from remove-system.map commit c1800b13fe33a1c129dcb30c51dbead7f894b818 @@ -9111,9 +19799,9 @@ Author: Patrick Schleizer Date: Sat Dec 7 11:26:39 2019 -0500 separate group "ssh" for incoming ssh console permission - + Thanks to @madaidan - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/16 commit 668b6420de8024fdeaf948f1750beb8b62d9ffb7 @@ -9211,22 +19899,22 @@ Author: Patrick Schleizer Date: Sat Dec 7 05:40:20 2019 -0500 Console Lockdown. - + Allow members of group 'console' to use tty1 to tty7. Everyone else except members of group 'console-unrestricted' are restricted from using console using ancient, unpopular login methods such as using /bin/login over networks, which might be exploitable. (CVE-2001-0797) - + Not enabled by default in this package since this package does not know which users shall be added to group 'console'. - + In new Whonix builds, user 'user" will be added to group 'console' and pam console-lockdown enabled by package anon-base-files. - + /usr/share/pam-configs/console-lockdown - + /etc/security/access-security-misc.conf - + https://forums.whonix.org/t/etc-security-hardening/8592 commit 52934c9288a596b233c1ce3b5f68a29248602c96 @@ -9318,7 +20006,7 @@ Author: Patrick Schleizer Date: Fri Dec 6 05:14:02 2019 -0500 remount /home /tmp /dev/shm /run with nosuid,nodev (default) and noexec (opt-in) - + https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 commit 8cf5ed990a3940c108d661c6c169b5720b1459d1 @@ -9328,19 +20016,19 @@ Date: Thu Dec 5 15:52:24 2019 -0500 comment commit 19add3299c9215d05208e3c2e748527bf87e66b5 -Merge: 0c25a96 9679292 +Merge: 0c25a96b 96792928 Author: Patrick Schleizer Date: Thu Dec 5 15:46:19 2019 -0500 Merge remote-tracking branch 'origin/master' commit 96792928787c1c129a964bd81e97450d2edb29a6 -Merge: 0c25a96 af9e19c +Merge: 0c25a96b af9e19c5 Author: Patrick Schleizer Date: Thu Dec 5 20:33:47 2019 +0000 Merge pull request #39 from madaidan/rp_filter - + Enable reverse path filtering commit af9e19c51f256504c5c2206e31da1911872b6ef8 @@ -9362,19 +20050,19 @@ Date: Tue Dec 3 02:18:32 2019 -0500 description / comments commit d26ba05c4776cdff0750b872f3da70fd25fca1f4 -Merge: 6ca48ff 73c6410 +Merge: 6ca48fff 73c6410a Author: Patrick Schleizer Date: Tue Dec 3 01:52:04 2019 -0500 Merge remote-tracking branch 'origin/master' commit 73c6410a0e1e6e56529ba8ea98681867bd8acb37 -Merge: 6ca48ff 8d63da3 +Merge: 6ca48fff 8d63da3c Author: Patrick Schleizer Date: Tue Dec 3 06:51:31 2019 +0000 Merge pull request #38 from madaidan/distrust-cpu - + Distrust the CPU for initial entropy commit 8d63da3cef6e114deaa6943ea9a633d6620a974b @@ -9424,25 +20112,25 @@ Author: Patrick Schleizer Date: Wed Nov 27 10:22:31 2019 -0500 fix, make sure to undo pam changes on package removal - + Thanks to minimal for the bug report! - + https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/11 commit 62b924eea7d50f58649e089ff9cf8d73075cac63 -Merge: 9091f69 ba02dcb +Merge: 9091f69e ba02dcb2 Author: Patrick Schleizer Date: Tue Nov 26 13:00:36 2019 -0500 Merge remote-tracking branch 'origin/master' commit ba02dcb267a95d332bd01bb3fc725e051ccb3246 -Merge: 9091f69 d9d6d07 +Merge: 9091f69e d9d6d077 Author: Patrick Schleizer Date: Tue Nov 26 18:00:11 2019 +0000 Merge pull request #37 from madaidan/apparmor-fixes - + Fix permission-lockdown commit d9d6d0771433700f49c4ddf156a0b5bc7098d94b @@ -9468,7 +20156,7 @@ Author: Patrick Schleizer Date: Mon Nov 25 01:39:53 2019 -0500 Lock user accounts after 50 rather than 100 failed login attempts. - + https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698/19 commit 6277db1383451822769948bbebac31f719e98e74 @@ -9488,11 +20176,11 @@ Author: Patrick Schleizer Date: Sat Nov 23 11:20:32 2019 +0000 load jitterentropy_rng kernel module for better entropy collection - + https://www.whonix.org/wiki/Dev/Entropy - + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972 - + https://forums.whonix.org/t/jitterentropy-rngd/7204 commit d32024a3da3cdfbb07f61dd3e9a52535e747de6b @@ -9500,7 +20188,7 @@ Author: Patrick Schleizer Date: Sat Nov 23 05:53:19 2019 -0500 /usr/sbin/pam_tally2 mrix, - + https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/152 commit 03e80238477bef26cf14a86a136d2ab688c87d08 @@ -9534,19 +20222,19 @@ Date: Mon Nov 18 19:16:16 2019 +0000 bumped changelog version commit 9a20b85fe16584dda909fd5f1aa6bbb62d06bcf0 -Merge: 477d476 2b17c0f +Merge: 477d476b 2b17c0f3 Author: Patrick Schleizer Date: Sun Nov 17 11:20:17 2019 -0500 Merge remote-tracking branch 'origin/master' commit 2b17c0f3e4dcd7cb9f2239da649b4a885c27e7cf -Merge: 477d476 e92022a +Merge: 477d476b e92022a2 Author: Patrick Schleizer Date: Sun Nov 17 16:19:55 2019 +0000 Merge pull request #36 from madaidan/hidepid-fix - + Remove proc-hidepid systemd sandboxing commit e92022a21cbe2df76026b36482f5c71e3471b344 @@ -9602,7 +20290,7 @@ Author: Patrick Schleizer Date: Tue Nov 5 10:02:55 2019 -0500 do not set kernel boot parameter page_poison=1 in Qubes since does not work - + https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012 commit f57702c1589047f5d0eff7a7bdffb928117532f6 @@ -9640,9 +20328,9 @@ Author: Patrick Schleizer Date: Sun Nov 3 04:34:31 2019 -0500 add /var/cache/security-misc/state-files/placeholder file - + to make sure folder already exists to avoid AppArmor issue - + https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/76 commit 7c0ec7e50797c0da719f389e61445ff7d8e252b3 @@ -9658,7 +20346,7 @@ Date: Sun Nov 3 02:50:51 2019 -0500 Enables punycode (`network.IDN_show_punycode`) by default in Thunderbird to make phising attacks more difficult. Fixing URL not showing real Domain Name (Homograph attack). - + https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415 commit bf62306d4fc3b3168204254ca354028a1fe857a7 @@ -9672,7 +20360,7 @@ Author: Patrick Schleizer Date: Thu Oct 31 16:32:28 2019 +0000 apparmor fix - + https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/67 commit 6e5d8b357d977991953e153d618dbdda2b05c0e6 @@ -9688,19 +20376,19 @@ Date: Thu Oct 31 11:19:44 2019 -0400 copyright commit f001250ae61789bef7b2b19d5c40831273b0acca -Merge: d832ab9 5a3cbe8 +Merge: d832ab91 5a3cbe81 Author: Patrick Schleizer Date: Mon Oct 28 10:31:30 2019 -0400 Merge remote-tracking branch 'origin/master' commit 5a3cbe81000c3a9bbc69ba03c944c6c5ae9115bf -Merge: d832ab9 0e49bdc +Merge: d832ab91 0e49bdc4 Author: Patrick Schleizer Date: Mon Oct 28 14:30:45 2019 +0000 Merge pull request #35 from madaidan/apparmor - + Apparmor profiles commit 0e49bdc45f6c94b3f6c2874fd48a6b1c75519790 @@ -9816,11 +20504,11 @@ Author: Patrick Schleizer Date: Mon Oct 21 05:46:49 2019 -0400 Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with hidepid. - + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 - + https://forums.whonix.org/t/cannot-use-pkexec/8129 - + Thanks to AnonymousUser for the bug report! commit 31b771ac2e1cd692851f0d58191c3147d4a09335 @@ -9840,7 +20528,7 @@ Author: Patrick Schleizer Date: Fri Oct 18 10:38:25 2019 +0000 fix lintian warning - + W: security-misc: maintainer-script-should-not-parse-etc-passwd-or-group preinst:19 commit d301e7f3653bdb4b56c42deab9d0566ff1b27380 @@ -9866,9 +20554,9 @@ Author: Patrick Schleizer Date: Thu Oct 17 06:46:47 2019 -0400 abort installation if no user is part of group sudo - + https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 - + Thanks to minimal for the bug report! commit a5045dc26e3b7d6acd6ae2c5727920824f992cc7 @@ -9907,7 +20595,7 @@ Author: Patrick Schleizer Date: Thu Oct 17 06:08:55 2019 -0400 shuffle - + https://forums.whonix.org/t/restrict-hardware-information-to-root/7329/80 commit 28a440091dd98fd4f3284cce01d692c08aa96bf1 @@ -9923,28 +20611,28 @@ Date: Thu Oct 17 06:05:23 2019 -0400 remove trailing spaces commit c8e0303d6d59e3303c0582ff8ab2664762199c81 -Merge: 4b1b3b7 8a42c5b +Merge: 4b1b3b7d 8a42c5b0 Author: Patrick Schleizer Date: Thu Oct 17 06:04:34 2019 -0400 Merge remote-tracking branch 'origin/master' commit 8a42c5b02387da454ff5661057be88a7c6fe9d9c -Merge: 994ca02 61f7423 +Merge: 994ca024 61f74230 Author: Patrick Schleizer Date: Thu Oct 17 09:59:12 2019 +0000 Merge pull request #34 from madaidan/whitelist - + Add a whitelist for /sys and /proc/cpuinfo commit 994ca024c24cf80075b2f03bc65475a5d9980d94 -Merge: 4b1b3b7 259b1f2 +Merge: 4b1b3b7d 259b1f2c Author: Patrick Schleizer Date: Thu Oct 17 06:19:46 2019 +0000 Merge pull request #33 from madaidan/documentation - + Improve documentation commit 61f742304d26e73df8433bd6fa03d33d39e39625 @@ -10060,7 +20748,7 @@ Author: Patrick Schleizer Date: Sat Oct 5 13:15:34 2019 +0000 comment out sack by default - + https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109/8?u=patrick commit 02096f8d7c7ee1f61285cf96564616f2828aa6c2 @@ -10068,7 +20756,7 @@ Author: Patrick Schleizer Date: Sat Oct 5 13:13:46 2019 +0000 Revert "undo Disabling TCP SACK, DSACK, FACK" - + This reverts commit 5fb4eb8e561e7c37cea977072944501fc32ee883. commit 62a0239207ee355e3d07e0097c963a0ded496e76 @@ -10088,23 +20776,23 @@ Author: Patrick Schleizer Date: Sat Oct 5 07:00:47 2019 -0400 undo Disabling TCP SACK, DSACK, FACK - + https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109/5 commit c19942f72b8d74056dd8da8c3cd9ac7e0fbe8991 -Merge: 213aef6 a33851a +Merge: 213aef6e a33851a3 Author: Patrick Schleizer Date: Sat Oct 5 06:58:27 2019 -0400 Merge remote-tracking branch 'origin/master' commit a33851a3c99a5eb9021d2d28b3164ed10025fbd9 -Merge: 213aef6 d0c6bb1 +Merge: 213aef6e d0c6bb1e Author: Patrick Schleizer Date: Sat Oct 5 10:58:08 2019 +0000 Merge pull request #32 from madaidan/disable-dsack-fack - + Disable TCP DSACK and FACK commit 213aef6eb9288efffe9fb0458f0aa8a44a6dafa6 @@ -10138,19 +20826,19 @@ Date: Sat Oct 5 09:14:41 2019 +0000 chmod +x usr/lib/security-misc/hide-hardware-info commit ffe0d62c8148ec60f7528002e988b969ebb868ca -Merge: ddc778b 7bcf73d +Merge: ddc778b4 7bcf73de Author: Patrick Schleizer Date: Sat Oct 5 04:49:05 2019 -0400 Merge remote-tracking branch 'origin/master' commit 7bcf73deaa1c77f9c650d8844ad94d24e38746fd -Merge: ddc778b 7345287 +Merge: ddc778b4 73452875 Author: Patrick Schleizer Date: Sat Oct 5 08:46:21 2019 +0000 Merge pull request #31 from madaidan/hide-hardware-info - + Restrict /proc/cpuinfo, /proc/bus, /proc/scsi and /sys to root commit d0c6bb1e9064ffdf45f7ac606f708c3f5e7dc247 @@ -10230,17 +20918,17 @@ Author: Patrick Schleizer Date: Mon Sep 16 12:30:23 2019 +0000 pam_tally2-info: fix, do nothing when started as user "user" - + xscreensaver runs as user "user", therefore pam_tally2 cannot function. xscreensaver has its own failed login counter. - + as user "user" /sbin/pam_tally2 -u user pam_tally2: Error opening /var/log/tallylog for update: Permission denied /sbin/pam_tally2: Authentication error - + https://askubuntu.com/questions/983183/how-lock-the-unlock-screen-after-wrong-password-attempts - + https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698 commit c2e444479cf723a7ddb3c51cd6394795daba108e @@ -10284,7 +20972,7 @@ Author: Patrick Schleizer Date: Tue Sep 10 12:35:42 2019 -0400 undo SysRq restrictions - + https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079 commit fbd1a5bde922be9c571d54567c977618e2c4bfc5 @@ -10300,19 +20988,19 @@ Date: Mon Sep 9 12:10:24 2019 +0000 bumped changelog version commit 1b4391417619a51cfe22d9eee21d9fa644d145b6 -Merge: 9d875d7 d0b3bc7 +Merge: 9d875d7c d0b3bc7d Author: Patrick Schleizer Date: Mon Sep 9 11:45:36 2019 +0000 Merge remote-tracking branch 'origin/master' commit d0b3bc7d3da6a4e3a04adb85cc5c7aa6c22bb466 -Merge: 9d875d7 60db7e6 +Merge: 9d875d7c 60db7e62 Author: Patrick Schleizer Date: Mon Sep 9 11:45:19 2019 +0000 Merge pull request #30 from madaidan/patch-23 - + fix typo commit 60db7e6294ab405a862c1cbc62140c9e89208b25 @@ -10338,7 +21026,7 @@ Author: Patrick Schleizer Date: Sat Sep 7 05:47:34 2019 +0000 blacklist modules with /bin/false rather than /bin/true to fail with error - + message rather than failing without notification commit 8132052ce01215a98cb4464e5f78d75349e77b10 @@ -10352,7 +21040,7 @@ Author: Patrick Schleizer Date: Sat Sep 7 05:39:56 2019 +0000 allow loading unsigned modules due to issues - + https://forums.whonix.org/t/allow-loading-signed-kernel-modules-by-default-disallow-kernel-module-loading-by-default/7880/23 commit 9ee9309f542472a8c8045df44573a5ec38e32a90 @@ -10474,9 +21162,9 @@ Author: Patrick Schleizer Date: Sat Aug 24 12:14:22 2019 -0400 remove umask changes since these are causing issues are are not needed anymore - + thanks to home folder permission lockdown - + https://forums.whonix.org/t/change-default-umask/7416/45 commit 41c4682280b7bc8e700d9ed41b55e464c0511b69 @@ -10492,7 +21180,7 @@ Date: Fri Aug 23 16:53:55 2019 +0000 readme commit 793c9b6801ffda5d75d389b8e7a2a6d140d8d382 -Merge: a74b983 44d62e0 +Merge: a74b9832 44d62e05 Author: Patrick Schleizer Date: Mon Aug 19 12:48:23 2019 +0000 @@ -10503,22 +21191,22 @@ Author: Patrick Schleizer Date: Mon Aug 19 12:46:59 2019 +0000 remove LLC - IEEE 802.2 from blacklist - + since required by KVM - + https://forums.whonix.org/t/whonix-desktop-installer-with-calamares-field-report/7350/107 - + https://forums.whonix.org/t/blacklist-uncommon-network-protocols/7391/22 - + https://github.com/Whonix/security-misc/pull/29 commit 44d62e05b5a60a3d45afd829fb67970afa7678b7 -Merge: 0140df8 a8b6281 +Merge: 0140df86 a8b62811 Author: Patrick Schleizer Date: Mon Aug 19 12:45:52 2019 +0000 Merge pull request #29 from onions-knight/patch-1 - + Update uncommon-network-protocols.conf commit a8b62811199b6c4e5d86439cd0fc9e9c18dc027b @@ -10526,7 +21214,7 @@ Author: onions-knight <38859709+onions-knight@users.noreply.github.com> Date: Mon Aug 19 11:30:57 2019 +0000 Update uncommon-network-protocols.conf - + Removing llc from blacklisted network protocols as it is needed by KVM for networking. See https://hub.packtpub.com/kvm-networking-libvirt/ and https://forums.whonix.org/t/whonix-desktop-installer-with-calamares-field-report/7350/107 @@ -10565,7 +21253,7 @@ Author: Patrick Schleizer Date: Mon Aug 19 07:47:20 2019 +0000 keep cache folder outside of reach of user since even user can remove files - + owned by root in its home folder commit 1fa1efa58e6f719766394bc8b94d4aa4076bdc0d @@ -10621,9 +21309,9 @@ Author: Patrick Schleizer Date: Sat Aug 17 10:33:47 2019 +0000 PAM: abort on locked password - + to avoid needlessly bumping pam_tally2 counter - + https://forums.whonix.org/t/restrict-root-access/7658/1 commit e0e25364e2d14459b918eea2cb63cbe10b8371f3 @@ -10643,9 +21331,9 @@ Author: Patrick Schleizer Date: Sat Aug 17 09:55:20 2019 +0000 change default umask to 027 - + as per: - + https://forums.whonix.org/t/change-default-umask/7416/47 commit b9127faac300024f7d8851d41037bebd5d3fe05c @@ -10683,7 +21371,7 @@ Author: Patrick Schleizer Date: Fri Aug 16 11:15:25 2019 -0400 sudo default umask 006 - + https://forums.whonix.org/t/change-default-umask/7416/43 commit 17cfcb63b6358f51a65df9623bc23ddf869b06cc @@ -10693,23 +21381,23 @@ Date: Fri Aug 16 10:50:56 2019 -0400 code simplification; report locked account earlier commit 5754671c460c67bd7d8e064841383ea7b7f90824 -Merge: 34672b8 9781598 +Merge: 34672b88 97815986 Author: Patrick Schleizer Date: Fri Aug 16 10:36:43 2019 -0400 Merge remote-tracking branch 'origin/master' commit 97815986321b6daf9c1f0c6f33a4b282ca05438c -Merge: 34672b8 85502ad +Merge: 34672b88 85502ad4 Author: Patrick Schleizer Date: Fri Aug 16 14:36:00 2019 +0000 Merge pull request #27 from madaidan/patch-21 - + Blacklist bluetooth commit 85502ad430f560070806c8b95b7fed3fe7028587 -Merge: 4a6f87f 34672b8 +Merge: 4a6f87f3 34672b88 Author: Patrick Schleizer Date: Fri Aug 16 14:35:51 2019 +0000 @@ -10732,7 +21420,7 @@ Author: Patrick Schleizer Date: Thu Aug 15 13:37:28 2019 +0000 informational output during PAM: - + * Show failed and remaining password attempts. * Document unlock procedure if Linux user account got locked. * Point out, that there is no password feedback for `su`. @@ -10751,7 +21439,7 @@ Author: Patrick Schleizer Date: Thu Aug 15 07:30:56 2019 +0000 use requisite rather than required to avoid asking for password needlessly - + if login will fail anyhow commit ce4a30d3cecb7e9bddb96c79aab871804cb90bd4 @@ -10777,7 +21465,7 @@ Author: Patrick Schleizer Date: Wed Aug 14 11:10:18 2019 +0000 add Depends: apparmor-profile-anondist to fix apparmor issue - + sudo[19806]: pam_exec(sudo:session): execve(/usr/lib/security-misc/permission-lockdown,...) failed: Permission denied sudo[18961]: pam_exec(sudo:session): /usr/lib/security-misc/permission-lockdown failed: exit code 13 kernel: audit: type=1400 audit(1565780860.972:224): apparmor="DENIED" operation="exec" profile="/usr/bin/whonixcheck" name="/usr/lib/security-misc/permission-lockdown" pid=19806 comm="sudo" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 @@ -10877,7 +21565,7 @@ Author: Patrick Schleizer Date: Wed Aug 14 08:34:03 2019 +0000 run permission lockdown during pam - + https://forums.whonix.org/t/change-default-umask/7416 commit 42f2d5f6664f15baebdaf200a5690cf32cdbe284 @@ -10903,12 +21591,12 @@ Author: Patrick Schleizer Date: Wed Aug 14 07:22:14 2019 +0000 add hook etc/kernel/postinst.d/30_remove-system-map to remove system.map - + on kernel package upgrade; - + self-document this package: during upgrade the following will be written to stdout: - + Setting up linux-image-4.19.0-5-amd64 (4.19.37-5+deb10u2) ... /etc/kernel/postinst.d/30_remove-system-map: removed '/boot/System.map-4.19.0-5-amd64 @@ -10932,19 +21620,19 @@ Date: Wed Aug 14 07:01:25 2019 +0000 description commit ff8c0979435b491cf462c5ef6e8e02f6d85f1d81 -Merge: 6f8acf0 a8ea379 +Merge: 6f8acf06 a8ea3795 Author: Patrick Schleizer Date: Wed Aug 14 06:59:50 2019 +0000 Merge remote-tracking branch 'origin/master' commit a8ea37952669b3f40a452cb580442126ec44233a -Merge: 6f8acf0 9a49b8e +Merge: 6f8acf06 9a49b8ec Author: Patrick Schleizer Date: Wed Aug 14 06:59:34 2019 +0000 Merge pull request #28 from madaidan/patch-22 - + Require all loaded kernel modules to be signed with a valid key. commit 9a49b8ecbb863a995862a4d380c6a03f6c0991ac @@ -10952,7 +21640,7 @@ Author: madaidan <50278627+madaidan@users.noreply.github.com> Date: Tue Aug 13 13:33:07 2019 +0000 Create 40_only_allow_signed_modules.cfg - + Require all loaded kernel modules to be signed with a valid key. commit 6f8acf06d79c77e3bee15cc8696a433271e2b7c9 @@ -11015,11 +21703,11 @@ Author: Patrick Schleizer Date: Sat Aug 10 07:07:28 2019 -0400 pam_tally2.so deny=100 - + during testing, due to issues - + https://github.com/Whonix/security-misc/commit/d17e25272b9b7bbb6abc4dccd500a6b34311a7dd - + https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698/12 commit d17e25272b9b7bbb6abc4dccd500a6b34311a7dd @@ -11027,12 +21715,12 @@ Author: Patrick Schleizer Date: Sat Aug 10 06:06:39 2019 -0400 effectively (not directly) add "required pam_tally2.so debug" to /etc/pam.d/common-account - + This is required because otherwise something like "sudo bash" would count as a failed login for pam_tally2 even though it was successful. - + https://bugzilla.redhat.com/show_bug.cgi?id=707660 - + https://forums.whonix.org/t/restrict-root-access/7658 commit 0f896a9d8d6f7c125311a0e226755f8a00214f3c @@ -11171,33 +21859,33 @@ Date: Mon Jul 22 01:16:18 2019 +0000 bumped changelog version commit f38f307b37d2efb036c5b4e85f48921b0acfadeb -Merge: 8c538ba b2582fb +Merge: 8c538ba3 b2582fbd Author: Patrick Schleizer Date: Sun Jul 21 09:12:33 2019 -0400 Merge remote-tracking branch 'origin/master' commit b2582fbd4c2364c7bca95b4038eec2ef2a2fae41 -Merge: 8c538ba 077899c +Merge: 8c538ba3 077899c2 Author: Patrick Schleizer Date: Sun Jul 21 12:40:37 2019 +0000 Merge pull request #26 from fepitre/fix-files - + Fix files commit 077899c23d518416cd9ee801a3607585d3a51aab -Author: Frédéric Pierret (fepitre) +Author: Fr_d_ric Pierret (fepitre) Date: Sun Jul 21 11:23:06 2019 +0200 Add .gitignore commit 5fbe7537613a2034d80983e095cdd8d2971b1bcc -Author: Frédéric Pierret (fepitre) +Author: Fr_d_ric Pierret (fepitre) Date: Sun Jul 21 11:19:35 2019 +0200 spec: update %files section - + QubesOS/qubes-issues#1885 commit 8c538ba318e5524d07034f2f718e4b5ae483176d @@ -11277,10 +21965,10 @@ Author: Patrick Schleizer Date: Wed Jul 17 20:36:51 2019 +0000 passwordless recovery / emergency console - + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d - + https://forums.whonix.org/t/restrict-root-access/7658/46 commit 50036b2934410b57936a4909d022d436cd27cdfc @@ -11294,7 +21982,7 @@ Author: Patrick Schleizer Date: Wed Jul 17 14:25:19 2019 -0400 Revert "set back to default group "root" rather than group "sudo" membership required to use su" - + This reverts commit 2f276cdb10aedf0d30c01d25e50b17cac7d1c62c. commit 1b772c6a9aac9e6c203c0c89b49e589a2b6e83d3 @@ -11350,11 +22038,11 @@ Author: Patrick Schleizer Date: Mon Jul 15 08:44:28 2019 -0400 set back to default group "root" rather than group "sudo" membership required to use su - + since root login will be locked by default anyhow - + Thanks to @madaidan for providing the rationale! - + https://forums.whonix.org/t/restrict-root-access/7658/42 commit 6d1e8ac9a4657bb3d49a9674ce3a1500350d4bba @@ -11368,7 +22056,7 @@ Author: Patrick Schleizer Date: Sun Jul 14 11:11:59 2019 +0000 fix, add 'group=sudo' and 'debug' for debugging - + https://forums.whonix.org/t/restrict-root-access/7658 commit 1731196c9fda93233917bcf6dba48834be03a448 @@ -11437,9 +22125,9 @@ Date: Sat Jul 13 16:21:34 2019 +0000 removed: The amount of hashing rounds used by shadow is bumped to 65536. This increases the security of hashed passwords. - + Since we do not do that currently. - + https://forums.whonix.org/t/restrict-root-access/7658/37 commit 3f031a297dc2d54346e9c9b3d566c3fa3a469240 @@ -11495,7 +22183,7 @@ Author: Patrick Schleizer Date: Sat Jul 13 10:35:10 2019 -0400 port umask from /etc/pam.d to /usr/share/pam-configs implementation - + https://forums.whonix.org/t/change-default-umask/7416 commit ac25733de871b0da5ef42e2e0283a44d94ac3112 @@ -11503,9 +22191,9 @@ Author: Patrick Schleizer Date: Sat Jul 13 14:01:53 2019 +0000 remove etc/pam.d/common-password.security-misc rounds=65536 - + due to unclean implementation, see: - + https://forums.whonix.org/t/restrict-root-access/7658/37 commit 69b97981f3b5e4efc75954d6957659f1bb8e7d18 @@ -11513,7 +22201,7 @@ Author: Patrick Schleizer Date: Sat Jul 13 12:33:51 2019 +0000 convert etc/pam.d/su.security-misc to usr/share/pam-configs/wheel - + https://forums.whonix.org/t/restrict-root-access/7658/32 commit 4079632d1aed4f3e50ea21de674a9b6d537d3e05 @@ -11523,7 +22211,7 @@ Date: Sat Jul 13 11:41:37 2019 +0000 remove modifying to /etc/pam.d directly (unrelased) config-package-dev displace /etc/securetty remove trailing spaces - + https://forums.whonix.org/t/restrict-root-access/7658/31 commit cdb7c6f7eb8e61bd203c9a4cb755da0b97cc9a3d @@ -11539,19 +22227,19 @@ Date: Thu Jul 11 18:26:17 2019 +0000 fix lintian warning commit a40a04aaec0c30ceb47266a3f9b2b714e9b89888 -Merge: f5356ce 93190eb +Merge: f5356cee 93190ebf Author: Patrick Schleizer Date: Thu Jul 11 14:08:30 2019 -0400 Merge remote-tracking branch 'origin/master' commit 93190ebf1019f76b73cf0f1e4491f15fd36bcae1 -Merge: f5356ce 1aee08f +Merge: f5356cee 1aee08fa Author: Patrick Schleizer Date: Thu Jul 11 18:08:01 2019 +0000 Merge pull request #25 from madaidan/patch-20 - + Improve documentation of blacklisting uncommon network protocols commit 1aee08fa5e46cbd9439c36df9bcbb7a513270e1b @@ -11591,28 +22279,28 @@ Date: Thu Jul 11 07:07:01 2019 +0000 fix lintian warning commit 2a893c0562438aaf0c34a25538a8e21bb11ba197 -Merge: 3df6a44 a54500c +Merge: 3df6a44e a54500c6 Author: Patrick Schleizer Date: Thu Jul 11 06:50:35 2019 +0000 Merge remote-tracking branch 'origin/master' commit a54500c6f18719520ae66c335870d3e8f03e9e14 -Merge: 7d3a615 1e4d349 +Merge: 7d3a6156 1e4d3495 Author: Patrick Schleizer Date: Thu Jul 11 06:41:37 2019 +0000 Merge pull request #23 from madaidan/patch-18 - + Blacklist more uncommon network protocols commit 7d3a61564dc01b899466defe957a7bc65d38dc89 -Merge: 3df6a44 932524c +Merge: 3df6a44e 932524cb Author: Patrick Schleizer Date: Thu Jul 11 06:41:08 2019 +0000 Merge pull request #24 from madaidan/patch-19 - + Move disable-coredumps.conf to correct position commit 932524cbd1b15df06bd4e395dc391dd489ba100f @@ -11658,42 +22346,42 @@ Date: Tue Jul 9 06:56:23 2019 -0400 also allow members of group sudo to run /usr/lib/security-misc/panic-on-oops commit 5fb500ac32a8935ef989770b2b9d17df4fa1698c -Merge: 8793708 e4bb770 +Merge: 87937089 e4bb7703 Author: Patrick Schleizer Date: Tue Jul 9 06:55:27 2019 -0400 Merge remote-tracking branch 'origin/master' commit e4bb77037e9327eea7b8fd92961192613d6e0763 -Merge: a9441e7 0f15303 +Merge: a9441e7b 0f15303e Author: Patrick Schleizer Date: Tue Jul 9 10:54:48 2019 +0000 Merge pull request #21 from madaidan/patch-16 - + Make the kernel panic on oopses commit 0f15303eb4dd5701cae5b3985be47918e2e4700a -Merge: 45f8102 a9441e7 +Merge: 45f8102d a9441e7b Author: Patrick Schleizer Date: Tue Jul 9 10:54:24 2019 +0000 Merge branch 'master' into patch-16 commit 8793708906d037746a2e946177d8a4d1884b391a -Merge: 50c00fc a9441e7 +Merge: 50c00fcf a9441e7b Author: Patrick Schleizer Date: Tue Jul 9 03:23:26 2019 -0400 Merge remote-tracking branch 'origin/master' commit a9441e7be4794e88f782f1ff5dd95f00e3928279 -Merge: 50c00fc 24b326d +Merge: 50c00fcf 24b326d9 Author: Patrick Schleizer Date: Tue Jul 9 07:21:47 2019 +0000 Merge pull request #22 from madaidan/patch-17 - + Restrict access to the root account commit 24b326d906375bb543b936936519231f51154dcd @@ -11767,7 +22455,7 @@ Author: Patrick Schleizer Date: Sun Jul 7 23:39:58 2019 +0000 add 'Depends: libpam-cgfs' - + https://forums.whonix.org/t/change-default-umask/7416/30?u=patrick commit d31a16f264ea23a2fc890ffd6664deac3f4c4bdf @@ -11787,7 +22475,7 @@ Author: Patrick Schleizer Date: Sun Jul 7 21:31:56 2019 +0000 move to pam-auth-update --force - + --package hangs in Qubes updater since it starts whiptail for interactive dpkg configuration dialog. commit 8399a1136788dfbbfd5dfb5c11356776e90326cc @@ -11801,7 +22489,7 @@ Author: Patrick Schleizer Date: Sun Jul 7 21:09:26 2019 +0000 add "Depends: libpam-runtime" so pam-auth-update is available - + for Debian maintainer script commit f68b96241c6afc7dffa8831f35d38bf1bf49508a @@ -11817,7 +22505,7 @@ Date: Sun Jul 7 16:51:40 2019 -0400 Due to error: Jul 07 20:35:39 host sudo[16090]: PAM unable to dlopen(pam_cgfs.so): /lib/security/pam_cgfs.so: cannot open shared object file: No such file or directory Jul 07 20:35:39 host sudo[16090]: PAM adding faulty module: pam_cgfs.so - + run: pam-auth-update --package from Debian maintainer scripts @@ -11839,9 +22527,9 @@ Author: Patrick Schleizer Date: Sun Jul 7 09:37:25 2019 +0000 Enable APT seccomp sandboxing. - + Thanks to @torjunkie for the suggestion! - + https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702 commit 93e81b433036ef2f226d0a2b1422034aba54ea3a @@ -11863,19 +22551,19 @@ Date: Sat Jul 6 13:53:10 2019 +0000 bumped changelog version commit 7b0b9da32c660e527741a56543c78ee3ac93d541 -Merge: 6df7b3c 649878f +Merge: 6df7b3c2 649878fd Author: Patrick Schleizer Date: Sat Jul 6 07:06:54 2019 -0400 Merge remote-tracking branch 'origin/master' commit 649878fdcb81ac621af9bc1481a3b6b41d3e22a0 -Merge: 6df7b3c 8888147 +Merge: 6df7b3c2 8888147e Author: Patrick Schleizer Date: Sat Jul 6 11:06:25 2019 +0000 Merge pull request #20 from madaidan/patch-15 - + Blacklist HDLC and use "install" for blacklisting firewire/thunderbolt commit 8888147e1e1102fa852dce14c3ca1cb91cd1ff3b @@ -11937,7 +22625,7 @@ Author: Patrick Schleizer Date: Mon Jul 1 13:35:45 2019 +0000 config-package-dev displace files for change umask - + https://forums.whonix.org/t/change-default-umask/7416 commit a73f0566e978afb6d5b9693bf432a2496bedd61f @@ -11945,9 +22633,9 @@ Author: Patrick Schleizer Date: Mon Jul 1 13:25:23 2019 +0000 change default umask to 006 - + session optional pam_umask.so usergroups - + https://forums.whonix.org/t/change-default-umask/7416/17 commit 41b61e32776c15a8dcde4479841b71c7e9ca28d4 @@ -11957,19 +22645,19 @@ Date: Mon Jul 1 13:24:29 2019 +0000 revert to Debian buster original commit 88a78b1c87e8419bbb70daa77f7ddfb2332668ae -Merge: 24cc8e3 8c60e7c +Merge: 24cc8e38 8c60e7c6 Author: Patrick Schleizer Date: Mon Jul 1 09:21:05 2019 -0400 Merge remote-tracking branch 'origin/master' commit 8c60e7c67f692aa9e70316bdde29cdc41eff2a75 -Merge: 24cc8e3 cfaafe4 +Merge: 24cc8e38 cfaafe40 Author: Patrick Schleizer Date: Mon Jul 1 13:20:21 2019 +0000 Merge pull request #18 from madaidan/patch-14 - + Change the default umask to 006 commit 24cc8e380df8706cd8e9765d89bd44ac78c58936 @@ -11977,13 +22665,13 @@ Author: Patrick Schleizer Date: Mon Jul 1 03:43:02 2019 -0400 comment out proc-hidepid.service hardening for now - + since broken in Qubes Debian AppVMs - + https://forums.whonix.org/t/kernel-hardening/7296/104 commit 0bffc7a9303d0b32427da04694bbefcf6a3104c8 -Merge: 3c176ce 344d009 +Merge: 3c176ce1 344d0090 Author: Patrick Schleizer Date: Mon Jul 1 03:08:26 2019 -0400 @@ -11994,16 +22682,16 @@ Author: Patrick Schleizer Date: Mon Jul 1 03:07:14 2019 -0400 allow permissions openat mkdir - + since required in Qubes Debian templates commit 344d00903250d699fc64d7fa9fad80475ade92e5 -Merge: f26ad14 b8f2aee +Merge: f26ad14d b8f2aee9 Author: Patrick Schleizer Date: Mon Jul 1 06:39:28 2019 +0000 Merge pull request #19 from madaidan/patch-15 - + Add licensing to proc-hidepid.service commit b8f2aee905b78034a115e1e2c1d6ecb7fa624122 @@ -12079,35 +22767,35 @@ Date: Sun Jun 30 04:11:38 2019 -0400 fix package description commit e47339706170c92b8db44f014942ea7d94d1ff9e -Merge: 24b19c5 ec78a3e +Merge: 24b19c59 ec78a3e4 Author: Patrick Schleizer Date: Sun Jun 30 04:11:12 2019 -0400 Merge remote-tracking branch 'origin/master' commit ec78a3e42e23a270a245dc254046ac1d7fc6ceec -Merge: 9525ff8 67de524 +Merge: 9525ff87 67de5247 Author: Patrick Schleizer Date: Sun Jun 30 08:10:28 2019 +0000 Merge pull request #17 from madaidan/patch-13 - + Disable coredumps commit 67de5247c8e7cd68c851a3d62168e9de69000afe -Merge: dbfb9e1 9525ff8 +Merge: dbfb9e1c 9525ff87 Author: Patrick Schleizer Date: Sun Jun 30 08:10:04 2019 +0000 Merge branch 'master' into patch-13 commit 9525ff87c6ae3cd6538a0a8f294e6b8610e79a32 -Merge: 24b19c5 22267c8 +Merge: 24b19c59 22267c89 Author: Patrick Schleizer Date: Sun Jun 30 08:09:23 2019 +0000 Merge pull request #16 from madaidan/patch-12 - + Mount /proc with hidepid=2 commit dbfb9e1cdf1e042c8985e2e69b7f5f5f1eaed860 @@ -12177,19 +22865,19 @@ Date: Sat Jun 29 10:34:48 2019 +0000 fix lintian warning commit 250919b821a00c93ee4fe7d92f6f3ed812110aac -Merge: ecf5d80 60e6dfc +Merge: ecf5d80f 60e6dfcb Author: Patrick Schleizer Date: Sat Jun 29 06:06:02 2019 -0400 Merge remote-tracking branch 'origin/master' commit 60e6dfcbff08dd4526e60c3302741e40d98c8b3e -Merge: ecf5d80 9e9c854 +Merge: ecf5d80f 9e9c854d Author: Patrick Schleizer Date: Sat Jun 29 10:05:34 2019 +0000 Merge pull request #15 from madaidan/patch-11 - + Update control commit 9e9c854d274d7322759a9e5d2c49bcbd60e63e0d @@ -12235,37 +22923,37 @@ Date: Fri Jun 28 03:02:49 2019 -0400 update files list commit ccb89cfd5574ed5a7b3802edc3bf188250edfddd -Merge: 0a0be1a ab31223 +Merge: 0a0be1ad ab312235 Author: Patrick Schleizer Date: Fri Jun 28 03:00:21 2019 -0400 Merge remote-tracking branch 'origin/master' commit ab312235ba89d62b7b83c26f8e9b8a8ff0ec985b -Merge: 5e02100 3801a53 +Merge: 5e02100e 3801a53a Author: Patrick Schleizer Date: Fri Jun 28 06:59:16 2019 +0000 Merge pull request #14 from madaidan/patch-10 - + Add some hardening for other distributions commit 5e02100e34776bf410ba05d7a3f7ee7f696ca0fc -Merge: 7e12e16 b809185 +Merge: 7e12e16d b8091850 Author: Patrick Schleizer Date: Fri Jun 28 06:58:32 2019 +0000 Merge pull request #13 from madaidan/patch-9 - + Remove System.map and restrict the SysRq key. commit 7e12e16dc0513f0a6936e576e3c8fa8ee44509d2 -Merge: 0a0be1a 641407c +Merge: 0a0be1ad 641407c8 Author: Patrick Schleizer Date: Fri Jun 28 06:57:42 2019 +0000 Merge pull request #11 from madaidan/patch-7 - + Protect against DMA attacks commit 3801a53a9e01aafa3783276059a7907f5b20b96e @@ -12335,19 +23023,19 @@ Date: Sun Jun 23 19:47:05 2019 +0000 debian/control syntax fix commit a098b18560e30ef238f693bf8f05933489027dd4 -Merge: 2a62899 90d676e +Merge: 2a628998 90d676ec Author: Patrick Schleizer Date: Sun Jun 23 19:46:30 2019 +0000 Merge remote-tracking branch 'origin/master' commit 90d676ec1864bd915310673d134d62d10a17a42f -Merge: 2a62899 1a07d90 +Merge: 2a628998 1a07d90e Author: Patrick Schleizer Date: Sun Jun 23 19:45:31 2019 +0000 Merge pull request #12 from madaidan/patch-8 - + Update control commit 1a07d90ed2da597db6d58c5f2da6dc3b32a8104b @@ -12361,25 +23049,25 @@ Author: Patrick Schleizer Date: Sun Jun 23 18:46:52 2019 +0000 syntax fix - + GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" - + https://forums.whonix.org/t/kernel-hardening/7296/70 commit f1147318c04642f355eae96786c26ec1cb53977c -Merge: cd73466 aec6da2 +Merge: cd734669 aec6da28 Author: Patrick Schleizer Date: Sun Jun 23 18:45:41 2019 +0000 Merge remote-tracking branch 'origin/master' commit aec6da28e9ac4f8289d7b7aaa77bcef2562cda74 -Merge: cd73466 2178fb3 +Merge: cd734669 2178fb37 Author: Patrick Schleizer Date: Sun Jun 23 18:45:24 2019 +0000 Merge pull request #10 from madaidan/patch-6 - + Enable more kernel hardening parameters commit 641407c8e9c728429ec86e7c89e431896d88e116 @@ -12419,19 +23107,19 @@ Date: Sun Jun 23 08:38:01 2019 +0000 bumped changelog version commit ae50d8134294d3746235d383c18fc187c18717d7 -Merge: 5269cfe cd7172c +Merge: 5269cfee cd7172c0 Author: Patrick Schleizer Date: Sun Jun 23 03:59:58 2019 -0400 Merge remote-tracking branch 'origin/master' commit cd7172c00cbf0cb69e159b6159ef0bfff663a507 -Merge: 5269cfe 807ac7d +Merge: 5269cfee 807ac7d6 Author: Patrick Schleizer Date: Sun Jun 23 07:59:35 2019 +0000 Merge pull request #9 from madaidan/patch-5 - + Disables SACK. commit 807ac7d65916071e4294f42d62b8b2353255c4bc @@ -12447,35 +23135,35 @@ Date: Fri Jun 21 05:40:04 2019 +0000 bumped changelog version commit 0a5b15ff45dc1b30867b0093d238b95dde7c0810 -Merge: ca1aa1e f9dc1b6 +Merge: ca1aa1e5 f9dc1b63 Author: Patrick Schleizer Date: Fri Jun 21 04:05:50 2019 +0000 Merge remote-tracking branch 'origin/master' commit f9dc1b6322961ff0e6c7a5be122f9d1031ba87ea -Merge: ca1aa1e 2e81885 +Merge: ca1aa1e5 2e81885f Author: Patrick Schleizer Date: Thu Jun 20 23:54:58 2019 -0400 Merge pull request #8 from marmarek/packaging - + qubes-builder integration commit 2e81885f691201e2229dadfd5ec7b554980ac689 -Author: Marek Marczykowski-Górecki +Author: Marek Marczykowski-G_recki Date: Fri Jun 21 04:52:01 2019 +0200 Add rpm packaging - + QubesOS/qubes-issues#1885 commit 27e68a39fe005a58cac02336fc6c468a4b2f5d31 -Author: Marek Marczykowski-Górecki +Author: Marek Marczykowski-G_recki Date: Fri Jun 21 04:51:33 2019 +0200 Add Makefile.builder for qubes-builder (Debian) - + QubesOS/qubes-issues#1885 commit ca1aa1e577179d92f4ec002221b8c4207e6ce1d6 @@ -12501,7 +23189,7 @@ Author: Patrick Schleizer Date: Sun Jun 9 10:06:58 2019 +0000 solve package file conflict - + https://github.com/QubesOS/qubes-issues/issues/1885#issuecomment-500200375 commit d5127e716632af2f494e9b41571c44a56a887667 @@ -12535,19 +23223,19 @@ Date: Thu May 23 22:38:13 2019 +0000 bumped changelog version commit 0a200e09ecf745d23e5e880d521f1aec2a7b25a9 -Merge: 65d7eb8 244234c +Merge: 65d7eb81 244234c8 Author: Patrick Schleizer Date: Thu May 23 18:25:47 2019 -0400 Merge remote-tracking branch 'origin/master' commit 244234c8b709a425feed4f3cfb87389f4fb2c6f5 -Merge: 65d7eb8 7177c60 +Merge: 65d7eb81 7177c604 Author: Patrick Schleizer Date: Thu May 23 22:25:13 2019 +0000 Merge pull request #7 from madaidan/patch-3 - + Disable uncommon network protocols commit 7177c6041a9b086a4cb90504a492136b4da732a2 @@ -12563,19 +23251,19 @@ Date: Thu May 16 20:25:46 2019 +0000 bumped changelog version commit a2b184e5bb9942aa63a36fb918b203053a53f1e4 -Merge: 71bf635 7d7b899 +Merge: 71bf6351 7d7b899d Author: Patrick Schleizer Date: Thu May 16 19:53:27 2019 +0000 Merge remote-tracking branch 'origin/master' commit 7d7b899dd13f7123822bf269a639c68ff5cb737e -Merge: 71bf635 b814f33 +Merge: 71bf6351 b814f338 Author: Patrick Schleizer Date: Thu May 16 19:52:52 2019 +0000 Merge pull request #6 from madaidan/patch-2 - + Even more kernel hardening commit b814f338b803ae33380551919b00144bb63a53b8 @@ -12619,11 +23307,11 @@ Author: Patrick Schleizer Date: Wed May 8 21:38:25 2019 -0400 port to /etc/xdg/xfce4/xfconf/xfce-perchannel-xml - + https://forums.whonix.org/t/whonix-xfce-development/6213/84?u=patrick commit 3bd4da6794067708f517b099548c0aa2a2b65146 -Merge: c80b746 b00a264 +Merge: c80b7465 b00a264c Author: Patrick Schleizer Date: Wed May 8 21:32:29 2019 -0400 @@ -12672,19 +23360,19 @@ Date: Mon May 6 05:51:14 2019 -0400 remove trailing spaces commit 83e12f8e89cf0269daeca36946cdef07e23075b3 -Merge: 74cdecf 5177444 +Merge: 74cdecfd 5177444d Author: Patrick Schleizer Date: Mon May 6 05:50:35 2019 -0400 Merge remote-tracking branch 'origin/master' commit 5177444d624a8a935c461ebe1065d451d2f8da0f -Merge: 74cdecf 02e8888 +Merge: 74cdecfd 02e8888b Author: Patrick Schleizer Date: Mon May 6 05:46:03 2019 -0400 Merge pull request #5 from madaidan/patch-1 - + More kernel hardening commit 02e8888b0bc4f0dfadccbebc9e6e75849d32ba76 @@ -12782,18 +23470,18 @@ Author: Patrick Schleizer Date: Fri Mar 1 14:32:41 2019 +0000 add improved legal protections clauses - + The license for software created by Whonix is the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version with additional terms applicable per GNU GPL version 3 section 7. - + The additional terms are based on the Doom 3 license which is Debian refers to as `GPL-3+-with-id-software-additional-terms`, which is Debian DFSG [1] (The Debian Free Software Guidelines) approved and which is therefore suitable for Debian `main`. Whonix made applied minimal changes to it: - + * Rewrite `The Doom 3 BFG Edition GPL Source Code` to the more common `this program` which is used throughout the GPL. * Added a "trump clause" [2], in other words, any conflicts or disputes between the additional terms and the GPLv3 shall be resolved in favor of the GPLv3 by adding `Notwithstanding any other provision of this License` (as mentioned in GPL FAQ [3]) at the beginning of the additional terms. - + [1] https://www.debian.org/social_contract#guidelines [2] https://www.fsf.org/news/canonical-updated-licensing-terms [3] https://www.gnu.org/licenses/gpl-faq.html#v3Notwithstanding - + For more considerations, see also: https://www.whonix.org/wiki/Dev/Licensing @@ -12808,7 +23496,7 @@ Author: Patrick Schleizer Date: Mon Nov 19 06:27:52 2018 -0500 fix hiding network bookmark in thunar by default - + Thanks to @Algernon for suggesting the fix! commit daf7fc002b2d946c2946b9effe3fecc5cebe4cf2 @@ -12824,19 +23512,19 @@ Date: Thu Nov 8 09:55:41 2018 +0000 bumped changelog version commit 0c020af885b3dfb2924102e6cf41a5af114cc140 -Merge: f9e1877 6f240c0 +Merge: f9e18772 6f240c0c Author: Patrick Schleizer Date: Thu Nov 8 09:53:47 2018 +0000 Merge remote-tracking branch 'origin/master' commit 6f240c0c4c88df2946fdd673f833ee05dd8340bb -Merge: f9e1877 f84f988 +Merge: f9e18772 f84f9881 Author: Patrick Schleizer Date: Thu Nov 8 04:53:25 2018 -0500 Merge pull request #4 from Algernon-01/master - + Enable hidden files and volume management again. commit f84f988118e30a2a3d4d74ed008c1a626c35c365 @@ -12948,19 +23636,19 @@ Date: Wed Jul 26 14:37:34 2017 +0000 bumped changelog version commit dc2c9a9992551f5967e09b31a90721a9aadaf962 -Merge: 61bd4d0 91ff0c2 +Merge: 61bd4d05 91ff0c25 Author: Patrick Schleizer Date: Tue Mar 14 13:43:18 2017 +0000 Merge remote-tracking branch 'origin/master' commit 91ff0c2571b41710440006e770b8295c03b3a295 -Merge: 61bd4d0 6e5e5d6 +Merge: 61bd4d05 6e5e5d6e Author: Patrick Schleizer Date: Tue Mar 14 13:42:37 2017 +0000 Merge pull request #2 from HulaHoopWhonix/patch-2 - + Update README.md commit 6e5e5d6ea65a0fee4c76e5ad74c444344ff1f462 @@ -12998,7 +23686,7 @@ Author: Patrick Schleizer Date: Mon Feb 27 23:57:04 2017 +0000 No longer ignore duplicate apt sources in apt-get-wrapper. - + No longer acceptable because these generate lots of noise in the terminal. commit 191918027c1971bfb871abb438c4917e5b98bb74 @@ -13012,7 +23700,7 @@ Author: Patrick Schleizer Date: Mon Feb 27 23:16:32 2017 +0000 use python rather than unbuffer - + because unbuffer eats exit code when process is killed commit cc351165dc78a8b7158a2b9bfdd9e4f0b3866239 @@ -13040,7 +23728,7 @@ Author: Patrick Schleizer Date: Sun Feb 26 23:57:17 2017 +0000 fix, show progress during apt-get-wrapper - + fix, propagate signals to apt-get child process commit 49cde21078ccc9f623add6f587ee719843647ee7 @@ -13048,7 +23736,7 @@ Author: Patrick Schleizer Date: Tue Feb 21 19:54:41 2017 +0000 Whonix 14 KDE plasma 5 fixes - + https://phabricator.whonix.org/T633 commit 0228e87d477f634d1e1db7c1cf6f213275d40dd9 @@ -13062,7 +23750,7 @@ Author: Patrick Schleizer Date: Sun Feb 19 22:32:04 2017 +0000 override glib-compile-schemas with || true in postinst - + https://phabricator.whonix.org/T500 commit 5ba2a5b6ff53df37ad38f082ad86ff2227158d93 @@ -13070,13 +23758,13 @@ Author: Patrick Schleizer Date: Sun Feb 19 22:25:28 2017 +0000 disable previews in nautilus by default for better security - + copied solution by @unman - + https://github.com/QubesOS/qubes-issues/issues/1108 - + https://github.com/QubesOS/qubes-core-agent-linux/pull/39 - + https://phabricator.whonix.org/T500 commit 91adab0d1bab6c6b31903f1e165944b3f8c8adb1 @@ -13090,7 +23778,7 @@ Author: Patrick Schleizer Date: Wed Feb 15 20:46:22 2017 +0000 Debian stretch / kde plasma5 fix: KDEDIRS -> XDG_CONFIG_DIRS - + https://phabricator.whonix.org/T633 commit bddbba84a6fad680359bc8eee0c395fcc4d79ca9 @@ -13104,7 +23792,7 @@ Author: Patrick Schleizer Date: Tue Feb 14 02:37:08 2017 +0000 add usr/lib/security-misc/apt-get-update-sanity-test - + a CVE-2016-1252 sanity test script commit 5e076415536e1513463c59dba6e8afc4e90b7f1a @@ -13118,7 +23806,7 @@ Author: Patrick Schleizer Date: Fri Feb 10 15:47:52 2017 +0000 remove faketime from Build-Depends: - + since no longer used for reproducible builds commit be8084ad1c136ee4a18cb24abcc0c14c522b8089 @@ -13132,7 +23820,7 @@ Author: Patrick Schleizer Date: Wed Feb 8 14:26:26 2017 +0000 double apt-get-update wrapper timeout from 120 to 240 seconds - + since it takes a bit longer than 120 seconds for me on a fast connection commit 1e66e03da14ae2e3f7b315e443836c35f954b84f @@ -13200,7 +23888,7 @@ Author: Patrick Schleizer Date: Mon Oct 10 16:10:30 2016 +0000 disable conntrack helper for better security - + https://phabricator.whonix.org/T486 commit 0d66fc60b9ea65e826560986698c11cea7ca4ea6 @@ -13214,7 +23902,7 @@ Author: Patrick Schleizer Date: Mon Apr 25 23:19:54 2016 +0000 /etc/sysctl.d/nf_conntrack_helper.conf disabled for now as it needs more work - + https://phabricator.whonix.org/T486 commit 492ce128909cfda8645738b092fd9e8722c64aa0 @@ -13234,27 +23922,27 @@ Author: Patrick Schleizer Date: Thu Mar 31 15:36:59 2016 +0000 added 'Replaces: tcp-timestamps-disable' - + https://phabricator.whonix.org/T486 commit 7b54755841907c2b86b12eed5035860e17445193 -Merge: 10c87b8 be086ae +Merge: 10c87b84 be086aea Author: Patrick Schleizer Date: Thu Mar 31 15:35:07 2016 +0000 merged tcp-timestamps-disable package into security-misc package - + disable conntrack helper for better security - + https://phabricator.whonix.org/T486 commit be086aea597ff5e4db29f56fa57399c67568d4b6 -Merge: 10c87b8 d0eceae +Merge: 10c87b84 d0eceae0 Author: Patrick Schleizer Date: Thu Mar 31 15:34:17 2016 +0000 Merge pull request #1 from HulaHoopWhonix/patch-1 - + Create tcp_timestamps.conf commit d0eceae0c84a42bce4ade28c593fd6ba002a67b9 diff --git a/ci/codeql-build.sh b/ci/codeql-build.sh new file mode 100755 index 00000000..08c3e151 --- /dev/null +++ b/ci/codeql-build.sh @@ -0,0 +1,46 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## CodeQL manual build for the C sources in this repo. +## +## Delegates the actual gcc invocations to the upstream compile +## helpers under usr/libexec/security-misc/. Those helpers also run +## at install-time / first-run (out of build-fm-shim-backend and +## emerg-shutdown). Single source of truth means CI cannot drift on +## hardening flags vs runtime. +## +## Source-tree prep: +## +## ci/codeql-prepare.sh has already symlinked '*.c#' to clean +## '*.c' names by the time we run (the workflow runs prepare via +## the reusable's pre-init hook). gcc selects its driver behavior +## by file extension - a '.c#tag' source gets misclassified as a +## linker script - so the symlink is required even though gcc +## tolerates the tagged name in error messages. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +set -o xtrace + +sudo --non-interactive apt-get update --error-on=any +sudo --non-interactive apt-get install --yes --no-install-recommends \ + pkg-config libdbus-1-dev libsystemd-dev libc6-dev linux-libc-dev + +build_dir="$(mktemp -d)" +trap 'rm -rf -- "${build_dir}"' EXIT + +bash 'usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared' \ + usr/src/security-misc/fm-shim-backend.c \ + "${build_dir}/fm-shim-backend" + +bash 'usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared' \ + usr/src/security-misc/emerg-shutdown.c \ + "${build_dir}/emerg-shutdown" + +ls -l -- "${build_dir}" diff --git a/ci/codeql-prepare.sh b/ci/codeql-prepare.sh new file mode 100755 index 00000000..e4b63923 --- /dev/null +++ b/ci/codeql-prepare.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## CodeQL pre-init source-tree prep. +## +## This repo names installable files with a '#' suffix +## (Kicksecure/genmkfile convention - the suffix routes the file to +## the correct Debian binary package at build time). The suffix +## breaks two CodeQL paths: +## +## * Python extractor discovers source files by the '.py' +## extension; 'foo.py#security-misc-shared' is invisible. +## * gcc selects driver behavior by extension; 'foo.c#tag' is +## treated by ld as a linker script ("file format not +## recognized"). The compile helpers used by ci/codeql-build.sh +## receive their .c source by path argument, so a clean +## '.c'-extension symlink is required here too. +## +## Walk the tracked file list and create same-directory symlinks +## without the '#tag' suffix so both extractors and gcc see the +## source under its conventional name. Symlinks point at the +## original tagged file via basename so the link resolves regardless +## of how the tree is later moved. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(git rev-parse --show-toplevel)" +cd -- "${repo_root}" + +linked=0 +skipped=0 +while IFS= read -r tagged; do + ## Only files where the suffix immediately follows a known + ## source-language extension. Other tagged files (config files, + ## scripts without an extension, etc.) need no rename. + case "${tagged}" in + *'.py#'*|*'.c#'*|*'.h#'*) + ;; + *) + continue + ;; + esac + + clean="${tagged%#*}" + + ## Do not clobber a real (untagged) file. + if [ -e "${clean}" ] && [ ! -L "${clean}" ]; then + skipped=$((skipped + 1)) + continue + fi + + ## Symlink target must be relative to the link's directory. + target="$(basename -- "${tagged}")" + ln -snf -- "${target}" "${clean}" + linked=$((linked + 1)) +done < <(git ls-files -- '*.py#*' '*.c#*' '*.h#*') + +printf 'codeql-prepare: linked=%d skipped=%d\n' "${linked}" "${skipped}" diff --git a/ci/dfuzzer-build.sh b/ci/dfuzzer-build.sh new file mode 100755 index 00000000..607fe9ad --- /dev/null +++ b/ci/dfuzzer-build.sh @@ -0,0 +1,61 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Build dfuzzer from upstream source. Run from +## .github/workflows/local-dbus-fuzz.yml (R-100; no inline scripts +## in the YAML). +## +## Build / runtime deps are installed by the caller workflow via +## developer-meta-files/.github/actions/install-deps (genmkfile + +## helper-scripts + apt packages); the apt list lives in the +## caller workflow. +## +## Required apt deps for this script: +## - meson ninja-build # build system +## - xsltproc docbook-xsl # man-page generation +## - libglib2.0-dev # dfuzzer dep +## - dbus dbus-x11 # dfuzzer runtime +## - libdbus-1-dev libsystemd-dev pkg-config gcc # for the +## # fm-shim-backend +## # build below +## +## dfuzzer is NOT packaged in Ubuntu 24.04 noble (verified via +## packages.ubuntu.com - 'No such package'); hence the from-source +## build. Pinned to upstream tag v2.6 AND its exact commit (verified +## below); latest release as of 2026-05-08. Bump both DFUZZER_TAG and +## DFUZZER_COMMIT together when a new release lands. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## style-ok: no-tmp-hardcode (ephemeral CI build clone under /tmp/dfuzzer) + +if [ "${CI:-}" != "true" ] && [ "${ALLOW_LOCAL:-}" != "true" ]; then + printf '%s\n' "${BASH_SOURCE[0]}: refusing to run outside CI. Set ALLOW_LOCAL=true to override." >&2 + exit 1 +fi + +DFUZZER_TAG="${DFUZZER_TAG:-v2.6}" +DFUZZER_COMMIT="${DFUZZER_COMMIT:-a955a80f7dd20fd7aeffad91da1c495aab5dbbd3}" + +git clone --depth 1 --branch "${DFUZZER_TAG}" \ + https://github.com/dbus-fuzzer/dfuzzer /tmp/dfuzzer + +dfuzzer_actual_commit="$(git -C /tmp/dfuzzer rev-parse --verify HEAD)" +if [ "${dfuzzer_actual_commit}" != "${DFUZZER_COMMIT}" ]; then + printf '%s\n' "${BASH_SOURCE[0]}: dfuzzer tag ${DFUZZER_TAG} resolved to ${dfuzzer_actual_commit}, expected ${DFUZZER_COMMIT} -- refusing (tag moved?)." >&2 + exit 1 +fi + +meson setup --buildtype=release /tmp/dfuzzer/build /tmp/dfuzzer +ninja -C /tmp/dfuzzer/build -v +sudo install -m 0755 /tmp/dfuzzer/build/dfuzzer /usr/local/bin/dfuzzer +dfuzzer --version || dfuzzer -V || true diff --git a/ci/dfuzzer-run.sh b/ci/dfuzzer-run.sh new file mode 100755 index 00000000..9a293290 --- /dev/null +++ b/ci/dfuzzer-run.sh @@ -0,0 +1,194 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Run dfuzzer against fm-shim-backend's D-Bus surface. +## +## fm-shim-backend implements org.freedesktop.FileManager1 on the +## session bus. dfuzzer is the standard D-Bus service fuzzer +## (Debian-archive-shipped); given a bus name it iterates every +## method and signal on every interface the service exposes, sends +## type-correct adversarial payloads (overflow, mangled UTF-8, +## empty / max-length strings, weird container nesting), and +## flags any case where the service crashes, hangs, or returns +## an unexpected error. +## +## This is process-level fuzzing - we boot the actual binary +## under a transient D-Bus session bus rather than driving the +## function dispatcher in-process. Catches the integration +## surface (D-Bus marshaling glue, sd_notify, signal handlers, +## leaks across method calls) that an in-process libFuzzer +## harness on the parser alone would miss. +## +## Cwd contract: caller workflow runs this with the +## security-misc repo checkout as cwd. ci/codeql-prepare.sh +## must have run first to create the .c symlink the upstream +## compile script expects. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## CI guard. +if [ "${CI:-}" != "true" ] && [ "${ALLOW_LOCAL:-}" != "true" ]; then + printf '%s\n' "${BASH_SOURCE[0]}: refusing to run outside CI (CI != 'true'). Set ALLOW_LOCAL=true to override." >&2 + exit 1 +fi + +dfuzzer_seconds="${DFUZZER_SECONDS:-60}" + +work="$(mktemp -d)" + +dfuzzer_run_cleanup() { + # shellcheck disable=SC2317 ## invoked via 'trap' + rm -r -f -- "${work}" +} + +trap dfuzzer_run_cleanup EXIT + +printf '%s\n' "::group::Build fm-shim-backend" +bash 'usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared' \ + usr/src/security-misc/fm-shim-backend.c \ + "${work}/fm-shim-backend" +chmod 0755 -- "${work}/fm-shim-backend" +ls -l -- "${work}/fm-shim-backend" +printf '%s\n' "::endgroup::" + +## Inner script that runs INSIDE dbus-run-session's transient +## session bus. Manually starts fm-shim-backend in the background +## (auto-activation via XDG service files turned out to be +## flaky inside dbus-run-session) and fuzzes it. +## +## Written to a temp file rather than passed inline via 'bash -c' +## to avoid the multi-level shell quoting that was hiding bugs +## during initial debugging. +inner="${work}/dfuzzer-inner.sh" +cat > "${inner}" <<'INNER' +#!/bin/bash +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## Args (positional) from outer script: +## $1 = backend binary path +## $2 = dfuzzer seconds budget +backend_bin="$1" +seconds="$2" + +printf '%s\n' "DBUS_SESSION_BUS_ADDRESS=${DBUS_SESSION_BUS_ADDRESS}" + +backend_log="$(dirname -- "${backend_bin}")/fm-shim-backend.log" + +## Start fm-shim-backend in the background. Capture its stdout + +## stderr so we can surface them in the workflow log if dfuzzer +## fails to connect (without a tty the backend's output is +## block-buffered and would otherwise be lost on kill). +"${backend_bin}" >"${backend_log}" 2>&1 & +backend_pid=$! + +dfuzzer_inner_cleanup() { + kill "${backend_pid}" 2>/dev/null || true +} + +trap dfuzzer_inner_cleanup EXIT + +## Wait up to 5s for the backend to register the well-known name +## on the bus. dbus-run-session-internal name registration is +## usually < 100ms but allow a generous budget for slow runners. +for _i in {1..5}; do + sleep 1 + if ! kill -0 "${backend_pid}" 2>/dev/null; then + printf '%s\n' "::error::fm-shim-backend exited during startup" + cat -- "${backend_log}" || true + wait "${backend_pid}" 2>/dev/null + exit 1 + fi + if dbus-send --session --print-reply --dest=org.freedesktop.DBus \ + /org/freedesktop/DBus org.freedesktop.DBus.NameHasOwner \ + string:org.freedesktop.FileManager1 2>/dev/null \ + | grep -q 'boolean true'; then + printf '%s\n' "fm-shim-backend registered (after ${_i}s)" + break + fi +done + +## Sanity-check: confirm the name is actually owned and dump the +## backend's startup output to the workflow log. If anything +## subsequent fails, this gives a maintainer enough to triage. +printf '%s\n' "::group::backend startup log" +cat -- "${backend_log}" 2>/dev/null || printf '%s\n' "(no log lines flushed yet)" +printf '%s\n' "::endgroup::" + +printf '%s\n' "::group::busctl introspect (verifies Introspectable wiring)" +busctl --user --no-pager introspect \ + org.freedesktop.FileManager1 /org/freedesktop/FileManager1 || true +printf '%s\n' "::endgroup::" + +## Run the actual fuzzer. Iteration-bounded by default (-I 50 +## per method gives enough coverage on the small FileManager1 +## surface; bumpable per consumer). Total wall-clock bounded +## by the outer timeout wrapper. +rc=0 +## -n bus name (required) +## -o object path - dfuzzer defaults to '/' if omitted, which is +## empty for fm-shim-backend (its methods are at +## /org/freedesktop/FileManager1). Without -o the previous +## runs exited in milliseconds because there was nothing to +## fuzz at the default path. +## -s --no-suppressions. Without this flag dfuzzer 2.6 treats +## "no suppression file found at ./dfuzzer.conf, +## ~/.dfuzzer.conf, or /etc/dfuzzer.conf" as a fatal error +## and exits 1 before fuzzing anything. None of those paths +## exist on a fresh GitHub runner. We don't need suppressions +## anyway - we want every error reported. +## -I iterations per method. +## -v verbose per-method progress. +timeout --preserve-status "${seconds}" \ + dfuzzer \ + -n org.freedesktop.FileManager1 \ + -o /org/freedesktop/FileManager1 \ + -s \ + -I 50 \ + -v || rc=$? + +printf '%s\n' "::group::backend log after fuzz" +cat -- "${backend_log}" 2>/dev/null || true +printf '%s\n' "::endgroup::" + +printf '%s\n' "dfuzzer raw exit code: ${rc}" +exit "${rc}" +INNER +chmod +x "${inner}" + +printf '%s\n' "::group::dfuzzer (org.freedesktop.FileManager1, ${dfuzzer_seconds}s)" +rc=0 +dbus-run-session -- "${inner}" "${work}/fm-shim-backend" "${dfuzzer_seconds}" || rc=$? +printf '%s\n' "::endgroup::" +printf '%s\n' "dfuzzer wrapper exit code: ${rc}" + +case "${rc}" in + 0) + printf '%s\n' "dfuzzer: completed cleanly; no crashes / exceptions detected." + ;; + 124) + ## 'timeout --preserve-status' surfaces 124 when the wall- + ## clock budget is reached. Treat as 'budget reached, no + ## crash detected within window'. + printf '%s\n' "dfuzzer: ${dfuzzer_seconds}s budget reached; no crash detected within window." + rc=0 + ;; + *) + printf '%s\n' "::error::dfuzzer reported a finding (exit ${rc}). See log above for the failing method." + ;; +esac + +exit "${rc}" diff --git a/ci/tests/fm_shim_frontend/test_property.py b/ci/tests/fm_shim_frontend/test_property.py new file mode 100644 index 00000000..1361258e --- /dev/null +++ b/ci/tests/fm_shim_frontend/test_property.py @@ -0,0 +1,194 @@ +#!/usr/bin/python3 -Bsu + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Hypothesis property tests for fm_shim_frontend.get_path_list_from_uris. +## +## Target rationale: get_path_list_from_uris is the URI-validation +## chokepoint between the FileManager1 D-Bus surface and the user- +## facing dialog. It runs urllib.parse.urlsplit + urllib.parse.unquote +## on attacker-supplied strings, then enforces three independent +## invariants (no Unicode/control chars, no newlines/NUL post-decode, +## absolute-path-only) before the value is shown to the user or +## passed to a file manager. A property-test pass over Hypothesis- +## generated URI lists is the right shape to catch invariant +## violations: the function should never raise on any input (must +## degrade gracefully), and several output properties must hold for +## EVERY entry in the returned list - regardless of input pathology. + +# pylint: disable=missing-function-docstring,missing-class-docstring + +from pathlib import Path + +import pytest +from hypothesis import given, settings, HealthCheck, strategies as st + +from fm_shim_frontend.fm_shim_frontend import get_path_list_from_uris + + +## ---------------------------------------------------------------- +## Hypothesis strategies +## ---------------------------------------------------------------- + +## Arbitrary text that may include Unicode, control chars, NULs, +## newlines, percent escapes, etc. - explicitly UNSANITIZED so we +## probe the function's defensive behavior. +adversarial_text = st.text( + min_size=0, max_size=200, + alphabet=st.characters(blacklist_categories=()), +) + +## URIs that look plausibly file:// shaped so we exercise the +## post-urlsplit branches (most adversarial_text values fail at the +## scheme/netloc gate). Use 7-bit-ASCII for the URI body and let +## the unquoted path become arbitrary text via percent-escapes. +ascii_safe = st.text( + min_size=0, max_size=120, + alphabet=st.characters(min_codepoint=0x20, max_codepoint=0x7E), +) + +handler_modes = st.sampled_from([ + "--show-folders", + "--show-items", + "--show-item-properties", +]) + + +def _file_uri_from_text(t: str) -> str: + ## Always produce a file:// URI shape so the input survives the + ## scheme-check gate at least often enough for the inner code + ## paths to get exercised. + import urllib.parse as up + return "file://" + up.quote(t, safe="/-._~") + + +file_uri = ascii_safe.map(_file_uri_from_text) + +## Mix the two pools: half-and-half adversarial vs file-uri-shaped. +uri_strategy = st.one_of(adversarial_text, file_uri) + +uri_list_strategy = st.lists(uri_strategy, min_size=0, max_size=8) + + +## ---------------------------------------------------------------- +## Properties +## ---------------------------------------------------------------- + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_never_raises(handler_mode: str, uri_list: list[str]) -> None: + ## Foundational invariant: no input may crash the function. It + ## must always return a (possibly empty) list. Hypothesis will + ## try empty lists, lists of "", lists of malformed URIs, + ## arbitrary unicode, percent-escaped control chars, etc. + result = get_path_list_from_uris(handler_mode, uri_list) + assert isinstance(result, list) + for p in result: + assert isinstance(p, Path) + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_output_paths_are_absolute(handler_mode: str, uri_list: list[str]) -> None: + ## Domain invariant: every Path returned must be absolute. The + ## function explicitly skips relative paths; this property + ## guards against future refactors that drop the guard. + for p in get_path_list_from_uris(handler_mode, uri_list): + assert p.is_absolute(), f"non-absolute path leaked: {p!r}" + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_output_has_no_dangerous_chars( + handler_mode: str, uri_list: list[str] +) -> None: + ## Domain invariant: no path in the output may contain a newline + ## or a NUL byte. Both are explicitly filtered post-unquote; + ## this property catches a regression where the filter is moved + ## or weakened. + for p in get_path_list_from_uris(handler_mode, uri_list): + s = str(p) + assert "\n" not in s, f"newline leaked in output: {s!r}" + assert "\x00" not in s, f"NUL leaked in output: {s!r}" + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_output_unique_and_sorted( + handler_mode: str, uri_list: list[str] +) -> None: + ## Domain invariant: output is deduplicated and sorted (function + ## docs the dedup via 'set'; the sort is documented at the end). + ## A regression that drops either property would surprise + ## downstream callers that rely on stable iteration order. + out = get_path_list_from_uris(handler_mode, uri_list) + assert out == sorted(set(out)), \ + f"output not sorted-unique: {out!r}" + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_idempotent_when_paths_are_string_form( + handler_mode: str, uri_list: list[str] +) -> None: + ## If we feed the function back its own output (re-encoded as + ## file:// URIs), the result should be a subset of the original + ## output (filesystem state may have changed; some entries may + ## have disappeared, but no NEW entries should appear). This + ## catches refactors that introduce non-idempotent behavior. + import urllib.parse as up + first = get_path_list_from_uris(handler_mode, uri_list) + re_uris = ["file://" + up.quote(str(p), safe="/-._~") for p in first] + second = get_path_list_from_uris(handler_mode, re_uris) + assert set(second).issubset(set(first)), \ + f"second pass introduced paths not in first: " \ + f"first={first!r} second={second!r}" + + +## ---------------------------------------------------------------- +## Targeted regressions +## ---------------------------------------------------------------- + +@pytest.mark.parametrize("uri", [ + "", # empty + "file:///\nevil", # newline post-decode + "file:///%00etc/passwd", # NUL post-decode + "file:///etc/passwd?query=1", # query component + "file:///etc/passwd#frag", # fragment component + "http://example.com/etc/passwd", # non-file scheme + "file://attacker.example/etc/passwd", # non-localhost netloc + "file:relative/path", # relative + "file:///" + "A" * 10000, # very long + "file:///%C3%A9clair", # non-ASCII percent-escape +]) +def test_known_adversarial_inputs_rejected(uri: str) -> None: + ## Concrete fixed-input regressions for the categories the + ## function explicitly defends against. These are NOT + ## Hypothesis-generated; they nail down specific past or + ## anticipated bug shapes so a regression is caught immediately + ## rather than waiting for Hypothesis to rediscover them. + out = get_path_list_from_uris("--show-folders", [uri]) + assert out == [], f"adversarial URI not rejected: {uri!r} -> {out!r}" diff --git a/ci/tests/permission_hardener/test_state_spaced_filename.sh b/ci/tests/permission_hardener/test_state_spaced_filename.sh new file mode 100755 index 00000000..bfd77155 --- /dev/null +++ b/ci/tests/permission_hardener/test_state_spaced_filename.sh @@ -0,0 +1,70 @@ +#!/bin/bash +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## WARNING: Not human-reviewed, MUST be moved to dist-ai. + +## Regression test: a hardened file whose path contains spaces must be +## un-hardenable via 'disable'. +## +## load_state_without_policy() reads the dpkg-statoverride state DB, one entry +## per line as 'owner group mode path'. A plain 4-field split drops any spaced +## path, so 'disable' never finds the entry and the file can never be restored. +## +## Seeds one spaced entry (mode 0744) into the state DB, sets the file to 0600, +## runs 'disable', and asserts the mode is restored to 0744 -- which only +## happens if load_state_without_policy read the spaced path back. +## +## Requires root: writes the state DB and chmod/chowns the target file. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" +ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}" + +if [ ! -f "${ph_bin}" ]; then + printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2 + exit 1 +fi + +## Must match store_dir in the script under test. +existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode' +mkdir -p -- "${existing_mode_admindir}" + +test_dir="$(mktemp -d -t ph-state-test.XXXXXX)" +spaced_file="${test_dir}/spaced tool" +touch -- "${spaced_file}" +chmod 0600 -- "${spaced_file}" + +## invoked indirectly via 'trap ... EXIT' +# shellcheck disable=SC2317 +cleanup() { + ## undo touches the master and new_mode DBs, not existing_mode, so remove the + ## seeded entry explicitly. + dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \ + "${spaced_file}" >/dev/null 2>&1 || true + safe-rm -rf -- "${test_dir}" +} +trap cleanup EXIT + +## Seed the state DB: this is the record 'enable' would have written. +dpkg-statoverride --admindir "${existing_mode_admindir}" --add \ + root root 0744 "${spaced_file}" + +"${ph_bin}" disable "${spaced_file}" >/dev/null 2>&1 || true + +actual_mode="$(stat -c '%a' -- "${spaced_file}")" +if [ "${actual_mode}" = '744' ]; then + printf '%s\n' "PASS: spaced-path state entry read back; mode restored to 744." + exit 0 +fi + +printf '%s\n' "FAIL: mode is '${actual_mode}', expected '744' -- spaced state entry not read back, file cannot be un-hardened." >&2 +exit 1 diff --git a/ci/tests/permission_hardener/test_whitelists_disable_all.sh b/ci/tests/permission_hardener/test_whitelists_disable_all.sh new file mode 100755 index 00000000..e69b200c --- /dev/null +++ b/ci/tests/permission_hardener/test_whitelists_disable_all.sh @@ -0,0 +1,91 @@ +#!/bin/bash +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## WARNING: Not human-reviewed, MUST be moved to dist-ai. + +## Regression test: the documented special directive 'whitelists_disable_all=true' +## must be honored, not rejected. +## +## The line contains '=', which is outside the config character-class allow-set. +## The directive check must run BEFORE that character-class validation; otherwise +## the documented line trips "invalid characters" and aborts the whole hardener +## (exit 200), so every other hardening rule in every conf is dropped too. +## +## Drives the REAL script via 'print-policy' with a conf that holds the directive +## plus one ordinary entry, and asserts print-policy exits 0 with the ordinary +## entry present. +## +## Requires root: writes a temporary config under /etc/permission-hardener.d/ +## and needs helper-scripts installed (sourced by permission-hardener). + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" +ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}" + +if [ ! -f "${ph_bin}" ]; then + printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2 + exit 1 +fi + +test_dir="$(mktemp -d -t ph-wda-test.XXXXXX)" +ordinary_file="${test_dir}/ordinary" +touch -- "${ordinary_file}" + +config_dir="/etc/permission-hardener.d" +config_file="${config_dir}/zz-ai-whitelists-disable-all-test.conf" +mkdir -p -- "${config_dir}" + +## print-policy captures the file's current mode into this DB (must match +## store_dir in the script under test); remove the entry so a test run does not +## leave a stale root-owned override pointing at a deleted temp file. +existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode' + +## invoked indirectly via 'trap ... EXIT' +# shellcheck disable=SC2317 +cleanup() { + dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \ + "${ordinary_file}" >/dev/null 2>&1 || true + safe-rm -f -- "${config_file}" + safe-rm -rf -- "${test_dir}" +} +trap cleanup EXIT + +{ + printf '%s\n' 'whitelists_disable_all=true' + printf '%s\n' "${ordinary_file} 0744 root root" +} > "${config_file}" + +## The directive line aborts the whole run (exit 200) on the buggy ordering; +## capture the status via an 'if' condition (errexit stays enabled). +if policy_output="$( "${ph_bin}" print-policy 2>/dev/null )"; then + ph_rc=0 +else + ph_rc=$? +fi + +test_status=0 +if [ "${ph_rc}" -ne 0 ]; then + printf '%s\n' "FAIL: print-policy exited ${ph_rc} (directive rejected as invalid characters)." >&2 + test_status=1 +fi +if printf '%s\n' "${policy_output}" | grep --quiet --fixed-strings -- "${ordinary_file}"$'\t'; then + printf '%s\n' "PASS: whitelists_disable_all=true accepted; ordinary entry present." +else + printf '%s\n' "FAIL: ordinary entry '${ordinary_file}' missing from print-policy output." >&2 + test_status=1 +fi + +if [ "${test_status}" -ne 0 ]; then + printf '%s\n' "----- print-policy output -----" >&2 + printf '%s\n' "${policy_output}" >&2 +fi +exit "${test_status}" diff --git a/ci/tests/permission_hardener/test_whitespace_filename.sh b/ci/tests/permission_hardener/test_whitespace_filename.sh new file mode 100755 index 00000000..6d2a63b6 --- /dev/null +++ b/ci/tests/permission_hardener/test_whitespace_filename.sh @@ -0,0 +1,138 @@ +#!/bin/bash +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## WARNING: Not human-reviewed, MUST be moved to dist-ai. + +## Regression test: permission-hardener must parse a config filename that +## contains spaces. +## +## load_state() recovers the filename by reading the option fields from the +## right (a trailing whitelist keyword, or the mode/owner/group[/capability] +## tail anchored by the octal mode). A space in the filename must NOT split it +## into the wrong fields -- that drops the entry silently, leaving a SUID +## binary un-hardened. +## +## Drives the REAL script via 'print-policy' with a mode-form entry +## ( ) whose filename contains a space, and +## asserts the recovered filename appears in the printed policy. +## +## Requires root: writes a temporary config under /etc/permission-hardener.d/ +## and needs helper-scripts installed (sourced by permission-hardener). + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" +ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}" + +if [ ! -f "${ph_bin}" ]; then + printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2 + exit 1 +fi + +test_dir="$(mktemp -d -t ph-ws-test.XXXXXX)" +## The space in the directory name is the property under test. +spaced_file="${test_dir}/some space/binary" +mkdir -p -- "${test_dir}/some space" +touch -- "${spaced_file}" + +## A filename whose space-split yields a BARE octal chunk ('744'). The mode +## must be anchored from the RIGHT: a left-to-right scan anchors on that chunk +## instead of the real mode at the end, fails the field-count check, and aborts +## the whole hardener (exit 200) rather than parsing the entry. +octal_chunk_file="${test_dir}/a 744 name" +touch -- "${octal_chunk_file}" + +## A space-free filename with a 4-option (capability) tail whose OWNER is a +## numeric id that looks octal ('0755'). Right-anchoring must NOT treat that +## owner as the mode: it would fold the real mode into the filename, the folded +## path does not exist, and the entry is silently dropped -- leaving the file +## un-hardened. The line is already well formed, so no recovery must happen. +numeric_owner_file="${test_dir}/numowner" +touch -- "${numeric_owner_file}" + +## The mirror-image of the numeric-owner case: a SPACED filename whose second +## component (field index 1) is a bare octal, with a 3-field tail. Here field 1 +## is NOT the mode, so recovery must happen. Existence disambiguates: the spaced +## name exists, its no-recovery prefix does not. +octal_second_file="${test_dir}/a 744" +touch -- "${octal_second_file}" + +## Six fields: a SPACED filename plus a numeric octal-looking owner and a +## capability tail. The rightmost octal candidate (field_count-3) is the owner, +## not the mode; anchoring there folds the mode into the filename and drops the +## entry. Existence must select field_count-4 (the real mode) instead. +numeric_owner_spaced_file="${test_dir}/x y" +touch -- "${numeric_owner_spaced_file}" + +config_dir="/etc/permission-hardener.d" +config_file="${config_dir}/zz-ai-whitespace-regression-test.conf" +mkdir -p -- "${config_dir}" + +## print-policy captures each file's current mode into this DB (must match +## store_dir in the script under test); remove the entries so a test run does +## not leave stale root-owned overrides pointing at deleted temp files. +existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode' + +## invoked indirectly via 'trap ... EXIT' +# shellcheck disable=SC2317 +cleanup() { + local leaked_file + for leaked_file in "${spaced_file}" "${octal_chunk_file}" \ + "${numeric_owner_file}" "${octal_second_file}" \ + "${numeric_owner_spaced_file}"; do + dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \ + "${leaked_file}" >/dev/null 2>&1 || true + done + safe-rm -f -- "${config_file}" + safe-rm -rf -- "${test_dir}" +} +trap cleanup EXIT + +## mode-form entries: [capability] +{ + printf '%s\n' "${spaced_file} 0744 root root" + printf '%s\n' "${octal_chunk_file} 0744 root root" + printf '%s\n' "${numeric_owner_file} 0744 0755 root cap_net_raw" + printf '%s\n' "${octal_second_file} 0644 root root" + printf '%s\n' "${numeric_owner_spaced_file} 0744 0755 root cap_net_raw" +} > "${config_file}" + +## A parse failure on any line aborts the whole run with exit 200; capture the +## status via an 'if' condition (errexit stays enabled) so the failure is +## reported cleanly rather than aborting the test. +if policy_output="$( "${ph_bin}" print-policy 2>/dev/null )"; then + ph_rc=0 +else + ph_rc=$? +fi + +test_status=0 +if [ "${ph_rc}" -ne 0 ]; then + printf '%s\n' "FAIL: print-policy exited ${ph_rc} (parse aborted the whole run)." >&2 + test_status=1 +fi +## print-policy prints tab-separated columns (FileUser...), so match +## each filename as the whole first field (trailing TAB). A bare substring match +## would let '/a 744' spuriously match the '/a 744 name' entry. +for expected_file in "${spaced_file}" "${octal_chunk_file}" "${numeric_owner_file}" "${octal_second_file}" "${numeric_owner_spaced_file}"; do + if printf '%s\n' "${policy_output}" | grep --quiet --fixed-strings -- "${expected_file}"$'\t'; then + printf '%s\n' "PASS: filename '${expected_file}' parsed and present in policy." + else + printf '%s\n' "FAIL: filename '${expected_file}' missing from print-policy output." >&2 + test_status=1 + fi +done + +if [ "${test_status}" -ne 0 ]; then + printf '%s\n' "----- print-policy output -----" >&2 + printf '%s\n' "${policy_output}" >&2 +fi +exit "${test_status}" diff --git a/debian/changelog b/debian/changelog index 1b722e76..3d05dca1 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,1107 @@ +security-misc (3:54.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 30 Sep 2026 08:33:58 +0000 + +security-misc (3:54.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 29 Sep 2026 08:08:57 +0000 + +security-misc (3:54.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 19 Sep 2026 14:09:17 +0000 + +security-misc (3:53.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 15 Sep 2026 14:32:35 +0000 + +security-misc (3:53.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 15 Sep 2026 12:00:54 +0000 + +security-misc (3:53.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 09 Sep 2026 11:05:43 +0000 + +security-misc (3:53.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 08 Sep 2026 15:30:04 +0000 + +security-misc (3:53.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 06 Sep 2026 16:58:23 +0000 + +security-misc (3:53.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 16 Aug 2026 08:24:20 +0000 + +security-misc (3:53.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Aug 2026 08:12:04 +0000 + +security-misc (3:53.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 28 Jul 2026 13:20:23 +0000 + +security-misc (3:53.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 21 Jul 2026 09:23:19 +0000 + +security-misc (3:53.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 20 May 2026 22:20:09 +0000 + +security-misc (3:52.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 18 May 2026 10:14:14 +0000 + +security-misc (3:52.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 15 May 2026 18:40:53 +0000 + +security-misc (3:52.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 11 May 2026 20:28:53 +0000 + +security-misc (3:52.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 02 May 2026 08:48:24 +0000 + +security-misc (3:52.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 25 Apr 2026 09:26:49 +0000 + +security-misc (3:52.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 22 Apr 2026 13:16:45 +0000 + +security-misc (3:52.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 16 Apr 2026 12:27:58 +0000 + +security-misc (3:52.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 12 Apr 2026 14:03:30 +0000 + +security-misc (3:52.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 Apr 2026 09:21:40 +0000 + +security-misc (3:52.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 09 Apr 2026 11:57:57 +0000 + +security-misc (3:51.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 08 Apr 2026 17:51:28 +0000 + +security-misc (3:51.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Mar 2026 11:13:50 +0000 + +security-misc (3:51.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Mar 2026 18:30:25 +0000 + +security-misc (3:51.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 14 Mar 2026 12:08:52 +0000 + +security-misc (3:51.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 23 Feb 2026 13:34:15 +0000 + +security-misc (3:51.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Feb 2026 12:17:16 +0000 + +security-misc (3:51.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 11 Jan 2026 16:40:08 +0000 + +security-misc (3:51.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 05 Jan 2026 10:28:53 +0000 + +security-misc (3:51.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 01 Jan 2026 17:28:24 +0000 + +security-misc (3:51.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 28 Dec 2025 06:36:59 +0000 + +security-misc (3:50.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Dec 2025 11:38:31 +0000 + +security-misc (3:50.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Dec 2025 09:56:05 +0000 + +security-misc (3:50.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 12 Dec 2025 13:17:08 +0000 + +security-misc (3:50.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 09 Dec 2025 14:06:55 +0000 + +security-misc (3:50.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 05 Dec 2025 11:39:12 +0000 + +security-misc (3:50.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 03 Dec 2025 08:31:21 +0000 + +security-misc (3:50.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 24 Nov 2025 08:44:09 +0000 + +security-misc (3:50.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 23 Nov 2025 10:26:13 +0000 + +security-misc (3:50.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 19 Nov 2025 07:02:14 +0000 + +security-misc (3:50.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 14 Nov 2025 06:21:34 +0000 + +security-misc (3:49.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 12 Nov 2025 06:13:05 +0000 + +security-misc (3:49.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 10 Nov 2025 08:00:05 +0000 + +security-misc (3:49.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 09 Nov 2025 10:47:45 +0000 + +security-misc (3:49.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 09 Nov 2025 08:12:41 +0000 + +security-misc (3:49.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 08 Nov 2025 07:44:43 +0000 + +security-misc (3:49.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 02 Nov 2025 11:41:51 +0000 + +security-misc (3:49.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Nov 2025 10:13:49 +0000 + +security-misc (3:49.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Nov 2025 09:41:23 +0000 + +security-misc (3:49.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Nov 2025 09:18:12 +0000 + +security-misc (3:49.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 31 Oct 2025 14:38:30 +0000 + +security-misc (3:48.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 27 Oct 2025 11:48:10 +0000 + +security-misc (3:48.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 26 Oct 2025 12:30:29 +0000 + +security-misc (3:48.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 23 Oct 2025 06:03:25 +0000 + +security-misc (3:48.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 19 Oct 2025 08:43:36 +0000 + +security-misc (3:48.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 18 Oct 2025 09:19:07 +0000 + +security-misc (3:48.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 Oct 2025 12:08:28 +0000 + +security-misc (3:48.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 07 Oct 2025 08:40:31 +0000 + +security-misc (3:48.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 28 Sep 2025 21:09:45 +0000 + +security-misc (3:48.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 26 Sep 2025 08:40:20 +0000 + +security-misc (3:48.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 24 Sep 2025 14:32:34 +0000 + +security-misc (3:47.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 22 Sep 2025 17:25:48 +0000 + +security-misc (3:47.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Sep 2025 18:43:35 +0000 + +security-misc (3:47.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Sep 2025 18:10:09 +0000 + +security-misc (3:47.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Sep 2025 16:18:37 +0000 + +security-misc (3:47.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 13 Sep 2025 08:33:02 +0000 + +security-misc (3:47.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 02 Sep 2025 15:25:49 +0000 + +security-misc (3:47.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 30 Aug 2025 14:19:30 +0000 + +security-misc (3:47.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 27 Aug 2025 19:31:06 +0000 + +security-misc (3:47.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 26 Aug 2025 09:16:15 +0000 + +security-misc (3:47.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 10 Aug 2025 06:34:30 +0000 + +security-misc (3:46.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 09 Aug 2025 09:45:34 +0000 + +security-misc (3:46.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 07 Aug 2025 07:08:19 +0000 + +security-misc (3:46.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 06 Aug 2025 08:27:15 +0000 + +security-misc (3:46.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 04 Aug 2025 09:27:11 +0000 + +security-misc (3:46.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 03 Aug 2025 11:33:03 +0000 + +security-misc (3:46.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 21 Jul 2025 10:00:25 +0000 + +security-misc (3:46.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 02 Jul 2025 20:52:17 +0000 + +security-misc (3:46.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 14 Jun 2025 11:51:44 +0000 + +security-misc (3:46.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 28 May 2025 13:48:11 +0000 + +security-misc (3:46.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 28 May 2025 12:12:00 +0000 + +security-misc (3:45.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 27 May 2025 19:41:25 +0000 + +security-misc (3:45.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 27 May 2025 15:51:50 +0000 + +security-misc (3:45.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 22:06:01 +0000 + +security-misc (3:45.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 15:52:16 +0000 + +security-misc (3:45.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 13:58:18 +0000 + +security-misc (3:45.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 11:23:39 +0000 + +security-misc (3:45.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 20 May 2025 11:40:27 +0000 + +security-misc (3:45.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 25 Apr 2025 09:54:23 +0000 + +security-misc (3:45.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 25 Apr 2025 08:19:34 +0000 + +security-misc (3:45.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 21 Apr 2025 10:21:54 +0000 + +security-misc (3:44.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 19 Apr 2025 17:33:56 +0000 + +security-misc (3:44.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 15 Apr 2025 20:59:37 +0000 + +security-misc (3:44.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 10 Apr 2025 11:38:17 +0000 + +security-misc (3:44.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 09 Apr 2025 15:15:59 +0000 + +security-misc (3:44.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 08 Apr 2025 14:08:24 +0000 + +security-misc (3:44.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 03 Mar 2025 11:00:37 +0000 + +security-misc (3:44.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 09 Feb 2025 23:04:36 +0000 + +security-misc (3:44.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 31 Jan 2025 19:38:41 +0000 + +security-misc (3:44.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 30 Jan 2025 12:58:48 +0000 + +security-misc (3:44.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jan 2025 14:36:41 +0000 + +security-misc (3:43.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 23 Jan 2025 16:28:58 +0000 + +security-misc (3:43.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 22 Jan 2025 14:11:21 +0000 + +security-misc (3:43.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 22 Jan 2025 13:52:29 +0000 + +security-misc (3:43.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 20 Jan 2025 11:35:08 +0000 + +security-misc (3:43.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 20 Jan 2025 10:11:42 +0000 + +security-misc (3:43.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 17 Jan 2025 13:35:27 +0000 + +security-misc (3:43.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 15 Jan 2025 15:02:43 +0000 + +security-misc (3:43.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:32:12 +0000 + +security-misc (3:43.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:30:58 +0000 + +security-misc (3:43.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:16:45 +0000 + +security-misc (3:42.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:07:50 +0000 + +security-misc (3:42.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:06:50 +0000 + +security-misc (3:42.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 13:53:49 +0000 + +security-misc (3:42.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 09:26:05 +0000 + +security-misc (3:42.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 08:24:05 +0000 + +security-misc (3:42.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 12 Jan 2025 11:47:17 +0000 + +security-misc (3:42.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 Jan 2025 15:34:20 +0000 + +security-misc (3:42.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 06 Jan 2025 10:31:40 +0000 + +security-misc (3:42.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 31 Dec 2024 18:42:01 +0000 + +security-misc (3:42.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 31 Dec 2024 14:09:34 +0000 + +security-misc (3:41.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 26 Dec 2024 04:12:02 +0000 + +security-misc (3:41.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 24 Dec 2024 05:16:21 +0000 + +security-misc (3:41.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 20 Dec 2024 06:01:27 +0000 + +security-misc (3:41.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 20 Dec 2024 05:58:24 +0000 + +security-misc (3:41.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 20 Dec 2024 05:48:48 +0000 + +security-misc (3:41.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Dec 2024 10:58:50 +0000 + +security-misc (3:41.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Dec 2024 09:43:26 +0000 + +security-misc (3:41.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Dec 2024 06:57:42 +0000 + +security-misc (3:41.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Dec 2024 19:19:10 +0000 + +security-misc (3:41.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Dec 2024 19:17:10 +0000 + +security-misc (3:40.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 25 Nov 2024 21:07:41 +0000 + +security-misc (3:40.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 14 Nov 2024 22:24:50 +0000 + +security-misc (3:40.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 14 Nov 2024 20:46:26 +0000 + +security-misc (3:40.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 12 Nov 2024 09:11:57 +0000 + +security-misc (3:40.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 11 Nov 2024 11:07:57 +0000 + +security-misc (3:40.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 10 Nov 2024 11:52:42 +0000 + +security-misc (3:40.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 30 Oct 2024 09:43:05 +0000 + +security-misc (3:40.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 23 Oct 2024 09:56:05 +0000 + +security-misc (3:40.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 16 Oct 2024 10:57:20 +0000 + +security-misc (3:40.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 08 Oct 2024 11:24:55 +0000 + +security-misc (3:39.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 03 Oct 2024 07:22:23 +0000 + +security-misc (3:39.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 25 Sep 2024 01:03:42 +0000 + +security-misc (3:39.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 14 Sep 2024 02:56:08 +0000 + +security-misc (3:39.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 08 Sep 2024 17:41:30 +0000 + +security-misc (3:39.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 04 Sep 2024 14:13:15 +0000 + +security-misc (3:39.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 29 Aug 2024 09:49:51 +0000 + +security-misc (3:39.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 28 Aug 2024 11:01:36 +0000 + +security-misc (3:39.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 25 Aug 2024 15:34:54 +0000 + +security-misc (3:39.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 25 Aug 2024 14:33:39 +0000 + +security-misc (3:39.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 16 Aug 2024 08:38:11 +0000 + +security-misc (3:38.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 15 Aug 2024 17:51:18 +0000 + +security-misc (3:38.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 06 Aug 2024 14:01:38 +0000 + +security-misc (3:38.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 28 Jul 2024 20:50:21 +0000 + +security-misc (3:38.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 27 Jul 2024 16:13:34 +0000 + +security-misc (3:38.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 26 Jul 2024 15:40:23 +0000 + +security-misc (3:38.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 26 Jul 2024 09:40:58 +0000 + +security-misc (3:38.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 21 Jul 2024 10:40:13 +0000 + +security-misc (3:38.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 20 Jul 2024 17:02:04 +0000 + +security-misc (3:38.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 18 Jul 2024 18:05:06 +0000 + +security-misc (3:38.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 18 Jul 2024 14:11:35 +0000 + +security-misc (3:37.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 18 Jul 2024 14:05:22 +0000 + +security-misc (3:37.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 15 Jul 2024 21:18:54 +0000 + +security-misc (3:37.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 13 Jul 2024 15:01:15 +0000 + +security-misc (3:37.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 11 Jun 2024 12:56:56 +0000 + +security-misc (3:37.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Jun 2024 18:13:08 +0000 + +security-misc (3:37.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Jun 2024 17:35:04 +0000 + +security-misc (3:37.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 28 May 2024 12:04:52 +0000 + +security-misc (3:37.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 18 May 2024 20:45:11 +0000 + +security-misc (3:37.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 May 2024 11:20:36 +0000 + +security-misc (3:37.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 12 Apr 2024 06:56:38 +0000 + +security-misc (3:36.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 01 Apr 2024 06:56:44 +0000 + +security-misc (3:36.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 18 Mar 2024 15:10:10 +0000 + +security-misc (3:36.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 11 Mar 2024 15:07:50 +0000 + +security-misc (3:36.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 10 Mar 2024 13:19:26 +0000 + +security-misc (3:36.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 04 Mar 2024 11:48:30 +0000 + +security-misc (3:36.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 26 Feb 2024 13:32:44 +0000 + +security-misc (3:36.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 20:08:17 +0000 + +security-misc (3:36.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 19:58:00 +0000 + +security-misc (3:36.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 16:07:16 +0000 + +security-misc (3:36.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 14:52:54 +0000 + +security-misc (3:35.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 14:50:05 +0000 + security-misc (3:35.8-1) unstable; urgency=medium * New upstream version (local package). diff --git a/debian/control b/debian/control index 77d5704c..1673ab33 100644 --- a/debian/control +++ b/debian/control @@ -1,42 +1,82 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. Source: security-misc Section: misc Priority: optional Maintainer: Patrick Schleizer -Build-Depends: config-package-dev, - debhelper (>= 13), +Build-Depends: debhelper (>= 13), debhelper-compat (= 13), - dh-apparmor + dh-apparmor, + dh-exec, + config-package-dev, + po-debconf Homepage: https://www.kicksecure.com/wiki/Security-misc Vcs-Browser: https://github.com/Kicksecure/security-misc Vcs-Git: https://github.com/Kicksecure/security-misc.git -Standards-Version: 4.6.2 +Standards-Version: 4.7.2 Rules-Requires-Root: no -Package: security-misc +## 'Package: security-misc-shared' Comments +## +## 'Conflicts: security-misc' is needed. +## > dpkg-divert: error: 'diversion of /etc/securetty to /etc/securetty.security-misc-orig by security-misc-shared' clashes with 'diversion of /etc/securetty to /etc/securetty.security-misc-orig by security-misc' +## +## 'Provides: security-misc' is useful. +## sudo dpkg -i /home/user/derivative-binary/genmkfile-packages-result/security-misc-shared_47.7-1_all.deb +## > dpkg: considering removing security-misc in favour of security-misc-shared ... +## > dpkg: no, cannot proceed with removal of security-misc (--auto-deconfigure will help): +## > systemcheck depends on security-misc +## > security-misc is to be removed +Package: security-misc-shared Architecture: all +Pre-Depends: helper-scripts Depends: adduser, apparmor-profile-dist, + build-essential, dmsetup, - helper-scripts, libcap2-bin, + libdbus-1-dev, libglib2.0-bin, libpam-modules-bin, libpam-runtime, libpam-umask, + libsystemd-dev, + memlockd, + pkgconf, python3, secure-delete, - sudo, ${misc:Depends} -Replaces: anon-gpg-tweaks, swappiness-lowest, tcp-timestamps-disable +Replaces: anon-gpg-tweaks, + security-misc, + swappiness-lowest, + tcp-timestamps-disable +Conflicts: security-misc +Provides: security-misc Description: Enhances Miscellaneous Security Settings https://github.com/Kicksecure/security-misc/blob/master/README.md . https://www.kicksecure.com/wiki/Security-misc . + Package security-misc-desktop and/or security-misc-server may also be useful. + . Discussion: . Happening primarily in Whonix forums. - https://forums.whonix.org/t/kernel-hardening/7296 + https://forums.whonix.org/t/kernel-hardening-security-misc/7296 + +Package: security-misc-desktop +Architecture: all +Depends: security-misc-shared, ${misc:Depends} +Description: Security improvements for desktops + For desktops. + . + (Or servers running a desktop?) + +Package: security-misc-server +Architecture: all +Depends: security-misc-shared, ${misc:Depends} +Description: Security improvements for servers + For servers. + . + (Or desktops running a server?) diff --git a/debian/copyright b/debian/copyright index 2a78337c..829d9096 100644 --- a/debian/copyright +++ b/debian/copyright @@ -1,14 +1,14 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Files: * -Copyright: 2012 - 2023 ENCRYPTED SUPPORT LP +Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC License: AGPL-3+ License: AGPL-3+ GNU AFFERO GENERAL PUBLIC LICENSE Version 3, 19 November 2007 . - Copyright (C) 2007 Free Software Foundation, Inc. + Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. . @@ -650,7 +650,7 @@ License: AGPL-3+ GNU Affero General Public License for more details. . You should have received a copy of the GNU Affero General Public License - along with this program. If not, see . + along with this program. If not, see . . Also add information on how to contact you by electronic and paper mail. . @@ -665,4 +665,4 @@ License: AGPL-3+ You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see - . + . diff --git a/debian/make-helper-overrides.bsh b/debian/make-helper-overrides.bsh index c43ca87e..4804b3e2 100755 --- a/debian/make-helper-overrides.bsh +++ b/debian/make-helper-overrides.bsh @@ -1,7 +1,7 @@ #!/bin/bash -## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/24 -genmkfile_lintian_post_opts+=" --suppress-tags obsolete-command-in-modprobe.d-file" +genmkfile_lintian_post_opts+=" --suppress-tags obsolete-command-in-modprobe.d-file --suppress-tags no-complete-debconf-translation" diff --git a/debian/po/POTFILES.in b/debian/po/POTFILES.in new file mode 100644 index 00000000..2d13c3f1 --- /dev/null +++ b/debian/po/POTFILES.in @@ -0,0 +1 @@ +[type: gettext/rfc822deb] security-misc-shared.templates diff --git a/debian/po/templates.pot b/debian/po/templates.pot new file mode 100644 index 00000000..6d99cfe5 --- /dev/null +++ b/debian/po/templates.pot @@ -0,0 +1,36 @@ +# SOME DESCRIPTIVE TITLE. +# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER +# This file is distributed under the same license as the security-misc-shared package. +# FIRST AUTHOR , YEAR. +# +#, fuzzy +msgid "" +msgstr "" +"Project-Id-Version: security-misc-shared\n" +"Report-Msgid-Bugs-To: security-misc-shared@packages.debian.org\n" +"POT-Creation-Date: 2025-01-14 09:31-0500\n" +"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" +"Last-Translator: FULL NAME \n" +"Language-Team: LANGUAGE \n" +"Language: \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=CHARSET\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Type: note +#. Description +#: ../security-misc-shared.templates:1001 +msgid "Manual intervention may be required for permission-hardener update" +msgstr "" + +#. Type: note +#. Description +#: ../security-misc-shared.templates:1001 +msgid "" +"No need to panic. Nothing is broken. A rare condition has been encountered. " +"permission-hardener is being updated to fix a minor bug that caused " +"corruption in the permission-hardener state file. If you installed your own " +"custom permission-hardener configuration, some manual intervention may be " +"required. See: https://www.kicksecure.com/wiki/" +"SUID_Disabler_and_Permission_Hardener#fixing_state_files" +msgstr "" diff --git a/debian/rules b/debian/rules index a1570ba6..ca5e85c2 100755 --- a/debian/rules +++ b/debian/rules @@ -1,6 +1,6 @@ #!/usr/bin/make -f -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. #export DH_VERBOSE=1 diff --git a/debian/security-misc-desktop.install b/debian/security-misc-desktop.install new file mode 100755 index 00000000..609f3f7c --- /dev/null +++ b/debian/security-misc-desktop.install @@ -0,0 +1,12 @@ +#!/usr/bin/dh-exec + +## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file was generated using 'genmkfile debinstfile'. + +etc/bluetooth/30_security-misc.conf#security-misc-desktop => /etc/bluetooth/30_security-misc.conf +etc/sudoers.d/security-misc-desktop#security-misc-desktop => /etc/sudoers.d/security-misc-desktop +usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop => /usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf +usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop => /usr/lib/NetworkManager/conf.d/80_randomize-mac.conf +usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop => /usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf diff --git a/debian/security-misc-server.install b/debian/security-misc-server.install new file mode 100755 index 00000000..5e86b45a --- /dev/null +++ b/debian/security-misc-server.install @@ -0,0 +1,8 @@ +#!/usr/bin/dh-exec + +## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file was generated using 'genmkfile debinstfile'. + +usr/libexec/security-misc/placeholder#security-misc-server => /usr/libexec/security-misc/placeholder diff --git a/debian/security-misc-shared.config b/debian/security-misc-shared.config new file mode 100755 index 00000000..71d76190 --- /dev/null +++ b/debian/security-misc-shared.config @@ -0,0 +1,190 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + source /usr/libexec/helper-scripts/pre.bsh +fi + +source /usr/share/debconf/confmodule + +set -e + +## Not set by DPKG for '.config' script. +DPKG_MAINTSCRIPT_PACKAGE="security-misc-shared" +DPKG_MAINTSCRIPT_NAME="config" + +true " +##################################################################### +## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $* +##################################################################### +" + +## NOTE: Code duplication. +## Copied from: helper-scripts /usr/libexec/helper-scripts/package_installed_check.sh +## +## '.config' scripts are run very early. Even 'Pre-Depends: helper-scripts' would be insufficient. +## Therefore the code is duplicated here. +pkg_installed() { + local package_name dpkg_query_output + local requested_action status error_state + + package_name="$1" + ## Cannot use '&>' because it is a bashism. + dpkg_query_output="$(dpkg-query --show --showformat='${Status}' "$package_name" 2>/dev/null)" || true + ## dpkg_query_output Examples: + ## install ok half-configured + ## install ok installed + + requested_action=$(printf '%s' "$dpkg_query_output" | awk '{print $1}') + status=$(printf '%s' "$dpkg_query_output" | awk '{print $2}') + error_state=$(printf '%s' "$dpkg_query_output" | awk '{print $3}') + + if [ "$requested_action" = 'install' ]; then + true "$0: INFO: $package_name is installed, ok." + return 0 + fi + + true "$0: INFO: $package_name is not installed, ok." + return 1 +} + +check_migrate_permission_hardener_state() { + local pkg_list modified_pkg_data_str custom_hardening_arr config_file + + ## If folder /var/lib/permission-hardener (version 1) does not exist, this migration is unneeded. + if [ ! -d '/var/lib/permission-hardener' ]; then + return 0 + fi + + local orig_hardening_arr custom_hardening_arr config_file custom_config_file + if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" ]; then + return 0 + fi + mkdir --parents '/var/lib/security-misc/do_once' + + orig_hardening_arr=( + '/usr/lib/permission-hardener.d/25_default_passwd.conf' + '/usr/lib/permission-hardener.d/25_default_sudo.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_selinux.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf' + '/usr/lib/permission-hardener.d/20_user-sysmaint-split.conf' + '/usr/lib/permission-hardener.d/30_ping.conf' + '/usr/lib/permission-hardener.d/30_default.conf' + '/etc/permission-hardener.d/25_default_passwd.conf' + '/etc/permission-hardener.d/25_default_sudo.conf' + '/etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf' + '/etc/permission-hardener.d/25_default_whitelist_chromium.conf' + '/etc/permission-hardener.d/25_default_whitelist_dbus.conf' + '/etc/permission-hardener.d/25_default_whitelist_firejail.conf' + '/etc/permission-hardener.d/25_default_whitelist_fuse.conf' + '/etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf' + '/etc/permission-hardener.d/25_default_whitelist_mount.conf' + '/etc/permission-hardener.d/25_default_whitelist_pam.conf' + '/etc/permission-hardener.d/25_default_whitelist_passwd.conf' + '/etc/permission-hardener.d/25_default_whitelist_policykit.conf' + '/etc/permission-hardener.d/25_default_whitelist_postfix.conf' + '/etc/permission-hardener.d/25_default_whitelist_qubes.conf' + '/etc/permission-hardener.d/25_default_whitelist_selinux.conf' + '/etc/permission-hardener.d/25_default_whitelist_spice.conf' + '/etc/permission-hardener.d/25_default_whitelist_ssh.conf' + '/etc/permission-hardener.d/25_default_whitelist_sudo.conf' + '/etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf' + '/etc/permission-hardener.d/25_default_whitelist_virtualbox.conf' + '/etc/permission-hardener.d/20_user-sysmaint-split.conf' + '/etc/permission-hardener.d/30_ping.conf' + '/etc/permission-hardener.d/30_default.conf' + ) + + pkg_list=( "security-misc-shared" ) + if pkg_installed user-sysmaint-split ; then + pkg_list+=( "user-sysmaint-split" ) + fi + if pkg_installed anon-apps-config ; then + pkg_list+=( "anon-apps-config" ) + fi + + ## This will exit non-zero if some of the packages don't exist, but we + ## don't care. The packages that *are* installed will still be scanned. + modified_pkg_data_str="$(dpkg --verify "${pkg_list[@]}")" || true + + ## Example modified_pkg_data_str: + #modified_pkg_data_str='missing /usr/lib/permission-hardener.d/20_user-sysmaint-split.conf' + + readarray -t custom_hardening_arr < <(awk '/permission-hardener.d/{ print $NF }' <<< "${modified_pkg_data_str}") + + ## If the above `dpkg --verify` command doesn't return any permission-hardener + ## related lines, the array will contain no meaningful info, just a single + ## blank element at the start. Set the array to be explicitly empty in + ## this scenario. + if [ -z "${custom_hardening_arr[0]}" ]; then + custom_hardening_arr=() + fi + + for config_file in \ + /usr/lib/permission-hardener.d/*.conf \ + /etc/permission-hardener.d/*.conf \ + /usr/local/etc/permission-hardener.d/*.conf \ + /etc/permission-hardening.d/*.conf \ + /usr/local/etc/permission-hardening.d/*.conf + do + # shellcheck disable=SC2076 + if ! [[ " ${orig_hardening_arr[*]} " =~ " ${config_file} " ]]; then + if [ -f "${config_file}" ]; then + custom_hardening_arr+=( "${config_file}" ) + fi + fi + done + + if [ "${#custom_hardening_arr[@]}" != '0' ]; then + for custom_config_file in "${custom_hardening_arr[@]}"; do + if ! test -e "${custom_config_file}" ; then + echo "$0: INFO: Possible missing configuration file found: '${custom_config_file}'" + else + echo "$0: INFO: Possible custom configuration file found: '${custom_config_file}'" + fi + done + ## db_input will return code 30 if the message won't be displayed, which + ## causes a non-interactive install to error out if you don't use || true + db_input critical security-misc-shared/alert-on-permission-hardener-v2-upgrade || true + ## db_go can return code 30 too in some instances, we don't care here + # shellcheck disable=SC2119 + db_go || true + fi + + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" +} + +check_migrate_permission_hardener_state + +true "INFO: debhelper beginning here." + +#DEBHELPER# + +true "INFO: Done with debhelper." + +true " +##################################################################### +## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $* +##################################################################### +" + +## Explicitly "exit 0", so eventually trapped errors can be ignored. +exit 0 diff --git a/debian/security-misc-shared.displace b/debian/security-misc-shared.displace new file mode 100644 index 00000000..29bac069 --- /dev/null +++ b/debian/security-misc-shared.displace @@ -0,0 +1,7 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +/etc/securetty.security-misc +/etc/security/faillock.conf.security-misc +/etc/usbguard/usbguard-daemon.conf.security-misc +/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc diff --git a/debian/security-misc.displace-extension b/debian/security-misc-shared.displace-extension similarity index 100% rename from debian/security-misc.displace-extension rename to debian/security-misc-shared.displace-extension diff --git a/debian/security-misc-shared.gconf-defaults b/debian/security-misc-shared.gconf-defaults new file mode 100644 index 00000000..b79536a9 --- /dev/null +++ b/debian/security-misc-shared.gconf-defaults @@ -0,0 +1,6 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +/apps/nautilus/preview_sound never +/apps/nautilus/show_icon_text never +/apps/nautilus/show-image-thumbnails never diff --git a/debian/security-misc-shared.hide b/debian/security-misc-shared.hide new file mode 100644 index 00000000..7beb77ee --- /dev/null +++ b/debian/security-misc-shared.hide @@ -0,0 +1,6 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Allows users in the 'sudo' group to install Flatpak software without +## authorization. Breaks user/sysmaint separation, thus disabled. +/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules diff --git a/debian/security-misc-shared.install b/debian/security-misc-shared.install new file mode 100755 index 00000000..b141aba2 --- /dev/null +++ b/debian/security-misc-shared.install @@ -0,0 +1,153 @@ +#!/usr/bin/dh-exec + +## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file was generated using 'genmkfile debinstfile'. + +etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared => /etc/apparmor.d/tunables/home.d/security-misc +etc/apt/apt.conf.d/40error-on-any#security-misc-shared => /etc/apt/apt.conf.d/40error-on-any +etc/apt/apt.conf.d/40sandbox#security-misc-shared => /etc/apt/apt.conf.d/40sandbox +etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared => /etc/default/grub.d/40_cpu_mitigations.cfg +etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared => /etc/default/grub.d/40_kernel_hardening.cfg +etc/default/grub.d/40_remount_secure.cfg#security-misc-shared => /etc/default/grub.d/40_remount_secure.cfg +etc/default/grub.d/40_signed_modules.cfg#security-misc-shared => /etc/default/grub.d/40_signed_modules.cfg +etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared => /etc/default/grub.d/41_quiet_boot.cfg +etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared => /etc/default/grub.d/41_recovery_restrict.cfg +etc/dracut.conf.d/30-security-misc.conf#security-misc-shared => /etc/dracut.conf.d/30-security-misc.conf +etc/gitconfig#security-misc-shared => /etc/gitconfig +etc/hide-hardware-info.d/30_default.conf#security-misc-shared => /etc/hide-hardware-info.d/30_default.conf +etc/kernel/postinst.d/30_remove-system-map#security-misc-shared => /etc/kernel/postinst.d/30_remove-system-map +etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared => /etc/modprobe.d/30_security-misc_blacklist.conf +etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared => /etc/modprobe.d/30_security-misc_conntrack.conf +etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared => /etc/modprobe.d/30_security-misc_disable.conf +etc/profile.d/30_security-misc.sh#security-misc-shared => /etc/profile.d/30_security-misc.sh +etc/securetty.security-misc#security-misc-shared => /etc/securetty.security-misc +etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared => /etc/security-misc/emerg-shutdown/30_security_misc.conf +etc/security/access-security-misc.conf#security-misc-shared => /etc/security/access-security-misc.conf +etc/security/faillock.conf.security-misc#security-misc-shared => /etc/security/faillock.conf.security-misc +etc/security/limits.d/30_security-misc.conf#security-misc-shared => /etc/security/limits.d/30_security-misc.conf +etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared => /etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml +etc/skel/.gnupg/gpg.conf#security-misc-shared => /etc/skel/.gnupg/gpg.conf +etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared => /etc/ssh/ssh_config.d/30_security-misc.conf +etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared => /etc/ssh/sshd_config.d/30_security-misc.conf +etc/sudoers.d/security-misc#security-misc-shared => /etc/sudoers.d/security-misc +etc/systemd/system/emergency.service.d/override.conf#security-misc-shared => /etc/systemd/system/emergency.service.d/override.conf +etc/systemd/system/rescue.service.d/override.conf#security-misc-shared => /etc/systemd/system/rescue.service.d/override.conf +etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared => /etc/usbguard/IPCAccessControl.d/:qubes +etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared => /etc/usbguard/IPCAccessControl.d/:sudo +etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared => /etc/usbguard/rules.d/30_security-misc.conf +etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared => /etc/usbguard/usbguard-daemon.conf.security-misc +usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared => /usr/bin/disabled-bluetooth-by-security-misc +usr/bin/disabled-cdrom-by-security-misc#security-misc-shared => /usr/bin/disabled-cdrom-by-security-misc +usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared => /usr/bin/disabled-cpumsr-by-security-misc +usr/bin/disabled-filesys-by-security-misc#security-misc-shared => /usr/bin/disabled-filesys-by-security-misc +usr/bin/disabled-firewire-by-security-misc#security-misc-shared => /usr/bin/disabled-firewire-by-security-misc +usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared => /usr/bin/disabled-framebuffer-by-security-misc +usr/bin/disabled-gps-by-security-misc#security-misc-shared => /usr/bin/disabled-gps-by-security-misc +usr/bin/disabled-intelme-by-security-misc#security-misc-shared => /usr/bin/disabled-intelme-by-security-misc +usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared => /usr/bin/disabled-intelpmt-by-security-misc +usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared => /usr/bin/disabled-miscellaneous-by-security-misc +usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared => /usr/bin/disabled-netfilesys-by-security-misc +usr/bin/disabled-network-by-security-misc#security-misc-shared => /usr/bin/disabled-network-by-security-misc +usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared => /usr/bin/disabled-thunderbolt-by-security-misc +usr/bin/fm-shim-frontend#security-misc-shared => /usr/bin/fm-shim-frontend +usr/bin/permission-hardener#security-misc-shared => /usr/bin/permission-hardener +usr/bin/remount-secure#security-misc-shared => /usr/bin/remount-secure +usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared => /usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh +usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared => /usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh +usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared => /usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh +usr/lib/issue.d/20_security-misc.issue#security-misc-shared => /usr/lib/issue.d/20_security-misc.issue +usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared => /usr/lib/modules-load.d/30_security-misc.conf +usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf +usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf +usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf +usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf +usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf +usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf +usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_mount.conf +usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_pam.conf +usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf +usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf +usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf +usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf +usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_spice.conf +usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf +usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf +usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf +usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf +usr/lib/permission-hardener.d/30_default.conf#security-misc-shared => /usr/lib/permission-hardener.d/30_default.conf +usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py#security-misc-shared => /usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py +usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared => /usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py +usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared => /usr/lib/sysctl.d/30_security-misc_kexec-disable.conf +usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared => /usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf +usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared => /usr/lib/sysctl.d/30_silent-kernel-printk.conf +usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared => /usr/lib/sysctl.d/990-security-misc.conf +usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/coredump.conf.d/30_security-misc.conf +usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/journald.conf.d/30_security-misc.conf +usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/pstore.conf.d/30_security-misc.conf +usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared => /usr/lib/systemd/system-preset/50-security-misc.preset +usr/lib/systemd/system/block-shutdown.service#security-misc-shared => /usr/lib/systemd/system/block-shutdown.service +usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared => /usr/lib/systemd/system/emerg-shutdown.service +usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared => /usr/lib/systemd/system/ensure-shutdown-trigger.service +usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared => /usr/lib/systemd/system/ensure-shutdown.service +usr/lib/systemd/system/harden-module-loading.service#security-misc-shared => /usr/lib/systemd/system/harden-module-loading.service +usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/system/haveged.service.d/30_security-misc.conf +usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared => /usr/lib/systemd/system/hide-hardware-info.service +usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared => /usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service +usr/lib/systemd/system/panic-on-oops.service#security-misc-shared => /usr/lib/systemd/system/panic-on-oops.service +usr/lib/systemd/system/permission-hardener.service#security-misc-shared => /usr/lib/systemd/system/permission-hardener.service +usr/lib/systemd/system/proc-hidepid.service#security-misc-shared => /usr/lib/systemd/system/proc-hidepid.service +usr/lib/systemd/system/remount-secure.service#security-misc-shared => /usr/lib/systemd/system/remount-secure.service +usr/lib/systemd/system/remove-system-map.service#security-misc-shared => /usr/lib/systemd/system/remove-system-map.service +usr/lib/systemd/system/sysinit-post.target#security-misc-shared => /usr/lib/systemd/system/sysinit-post.target +usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf +usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared => /usr/lib/systemd/system/user@.service.d/sysfs.conf +usr/lib/systemd/user/fm-shim.service#security-misc-shared => /usr/lib/systemd/user/fm-shim.service +usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf +usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared => /usr/lib/udev/rules.d/95-emerg-shutdown.rules +usr/libexec/security-misc/askpass#security-misc-shared => /usr/libexec/security-misc/askpass +usr/libexec/security-misc/block-unsafe-logins#security-misc-shared => /usr/libexec/security-misc/block-unsafe-logins +usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared => /usr/libexec/security-misc/build-emerg-shutdown +usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared => /usr/libexec/security-misc/build-fm-shim-backend +usr/libexec/security-misc/check-for-usb-controller#security-misc-shared => /usr/libexec/security-misc/check-for-usb-controller +usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared => /usr/libexec/security-misc/compile-emerg-shutdown +usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared => /usr/libexec/security-misc/compile-fm-shim-backend +usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared => /usr/libexec/security-misc/disable-kernel-module-loading +usr/libexec/security-misc/echo-path#security-misc-shared => /usr/libexec/security-misc/echo-path +usr/libexec/security-misc/emerg-shutdown#security-misc-shared => /usr/libexec/security-misc/emerg-shutdown +usr/libexec/security-misc/ensure-shutdown#security-misc-shared => /usr/libexec/security-misc/ensure-shutdown +usr/libexec/security-misc/hide-hardware-info#security-misc-shared => /usr/libexec/security-misc/hide-hardware-info +usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared => /usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown +usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared => /usr/libexec/security-misc/mmap-rnd-bits +usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared => /usr/libexec/security-misc/pam-abort-on-locked-password +usr/libexec/security-misc/pam-info#security-misc-shared => /usr/libexec/security-misc/pam-info +usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared => /usr/libexec/security-misc/pam_faillock_not_if_x +usr/libexec/security-misc/pam_only_if_login#security-misc-shared => /usr/libexec/security-misc/pam_only_if_login +usr/libexec/security-misc/pam_only_if_su#security-misc-shared => /usr/libexec/security-misc/pam_only_if_su +usr/libexec/security-misc/panic-on-oops#security-misc-shared => /usr/libexec/security-misc/panic-on-oops +usr/libexec/security-misc/permission-lockdown#security-misc-shared => /usr/libexec/security-misc/permission-lockdown +usr/libexec/security-misc/remove-system.map#security-misc-shared => /usr/libexec/security-misc/remove-system.map +usr/libexec/security-misc/virusforget#security-misc-shared => /usr/libexec/security-misc/virusforget +usr/share/doc/security-misc/fstab-vm#security-misc-shared => /usr/share/doc/security-misc/fstab-vm +usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared => /usr/share/glib-2.0/schemas/30_security-misc.gschema.override +usr/share/lintian/overrides/security-misc-shared#security-misc-shared => /usr/share/lintian/overrides/security-misc-shared +usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared => /usr/share/pam-configs/block-unsafe-logins-security-misc +usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared => /usr/share/pam-configs/console-lockdown-security-misc +usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared => /usr/share/pam-configs/faillock-preauth-security-misc +usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared => /usr/share/pam-configs/mkhomedir-security-misc +usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared => /usr/share/pam-configs/pam-abort-on-locked-password-security-misc +usr/share/pam-configs/umask-security-misc#security-misc-shared => /usr/share/pam-configs/umask-security-misc +usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared => /usr/share/pam-configs/unix-faillock-security-misc +usr/share/pam-configs/wheel-security-misc#security-misc-shared => /usr/share/pam-configs/wheel-security-misc +usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared => /usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc +usr/share/security-misc/dolphinrc#security-misc-shared => /usr/share/security-misc/dolphinrc +usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared => /usr/share/security-misc/emerg-shutdown-initramfs.service +usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared => /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf +usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared => /usr/share/security-misc/lkrg/lkrg-virtualbox +usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared => /usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded +usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared => /usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded +usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared => /usr/share/security-misc/security-misc-memlockd.cfg +usr/src/security-misc/emerg-shutdown.c#security-misc-shared => /usr/src/security-misc/emerg-shutdown.c +usr/src/security-misc/fm-shim-backend.c#security-misc-shared => /usr/src/security-misc/fm-shim-backend.c +var/cache/security-misc/state-files/placeholder#security-misc-shared => /var/cache/security-misc/state-files/placeholder diff --git a/debian/security-misc.links b/debian/security-misc-shared.links similarity index 53% rename from debian/security-misc.links rename to debian/security-misc-shared.links index 308f0700..c3369df2 100644 --- a/debian/security-misc.links +++ b/debian/security-misc-shared.links @@ -1,2 +1,5 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + /etc/profile.d/30_security-misc.sh /etc/zprofile.d/30_security-misc.zsh /etc/profile.d/30_security-misc.sh /etc/X11/Xsession.d/30_security-misc diff --git a/debian/security-misc.maintscript b/debian/security-misc-shared.maintscript similarity index 52% rename from debian/security-misc.maintscript rename to debian/security-misc-shared.maintscript index 7e44c41f..f1c61145 100644 --- a/debian/security-misc.maintscript +++ b/debian/security-misc-shared.maintscript @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. rm_conffile /etc/sudoers.d/umask-security-misc @@ -6,11 +6,11 @@ rm_conffile /etc/sudoers.d/umask-security-misc ## https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079 rm_conffile /etc/sysctl.d/sysrq.conf -## https://github.com/Whonix/security-misc/pull/45 +## https://github.com/Kicksecure/security-misc/pull/45 rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown -## merged into 1 file /etc/sysctl.d/30_security-misc.conf +## merged into 3 files /usr/lib/sysctl.d/30_security-misc_kexec-disable.conf, /usr/lib/sysctl.d/30_silent-kernel-printk.conf, and /usr/lib/sysctl.d/990-security-misc.conf rm_conffile /etc/sysctl.d/fs_protected.conf rm_conffile /etc/sysctl.d/kptr_restrict.conf rm_conffile /etc/sysctl.d/suid_dumpable.conf @@ -24,13 +24,14 @@ rm_conffile /etc/sysctl.d/kexec.conf rm_conffile /etc/sysctl.d/tcp_hardening.conf rm_conffile /etc/sysctl.d/tcp_sack.conf -## merged into 1 file /etc/modprobe.d/30_security-misc.conf +## merged into 3 files /etc/modprobe.d/30_security-misc_blacklist.conf, 30_security-misc_conntrack.conf, and /etc/modprobe.d/30_security-misc_disable.conf rm_conffile /etc/modprobe.d/uncommon-network-protocols.conf rm_conffile /etc/modprobe.d/blacklist-bluetooth.conf rm_conffile /etc/modprobe.d/vivid.conf rm_conffile /etc/modprobe.d/blacklist-dma.conf rm_conffile /etc/modprobe.d/msr.conf rm_conffile /etc/modprobe.d/30_nf_conntrack_helper_disable.conf +rm_conffile /etc/modprobe.d/30_security-misc.conf ## renamed to /etc/security/limits.d/30_security-misc.conf rm_conffile /etc/security/limits.d/disable-coredumps.conf @@ -46,7 +47,7 @@ rm_conffile /etc/sysctl.d/30_security-misc.conf rm_conffile /etc/sysctl.d/30_silent-kernel-printk.conf rm_conffile /etc/sysctl.d/30_security-misc_kexec-disable.conf -## moved to etc/permission-hardener.d +## moved to /etc/permission-hardener.d rm_conffile /etc/permission-hardening.d/25_default_passwd.conf rm_conffile /etc/permission-hardening.d/25_default_sudo.conf rm_conffile /etc/permission-hardening.d/25_default_whitelist_bubblewrap.conf @@ -66,3 +67,45 @@ rm_conffile /etc/permission-hardening.d/25_default_whitelist_sudo.conf rm_conffile /etc/permission-hardening.d/25_default_whitelist_unix_chkpwd.conf rm_conffile /etc/permission-hardening.d/25_default_whitelist_virtualbox.conf rm_conffile /etc/permission-hardening.d/30_default.conf + +## moved to /usr/lib/permission-hardener.d +rm_conffile /etc/permission-hardener.d/25_default_passwd.conf +rm_conffile /etc/permission-hardener.d/25_default_sudo.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_chromium.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_dbus.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_firejail.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_fuse.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_mount.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_pam.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_policykit.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_postfix.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_qubes.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_selinux.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_spice.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_ssh.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_sudo.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_virtualbox.conf +rm_conffile /etc/permission-hardener.d/30_default.conf + +## merged into 1 file /etc/default/grub.d/40_kernel_hardening.cfg +rm_conffile /etc/default/grub.d/40_distrust_bootloader.cfg +rm_conffile /etc/default/grub.d/40_distrust_cpu.cfg +rm_conffile /etc/default/grub.d/40_enable_iommu.cfg + +## renamed to /etc/default/grub.d/40_remount_secure.cfg +rm_conffile /etc/default/grub.d/40_remmount-secure.cfg + +## renamed to /etc/default/grub.d/40_signed_modules.cfg +rm_conffile /etc/default/grub.d/40_only_allow_signed_modules.cfg + +## renamed to /etc/default/grub.d/41_quiet_boot.cfg +rm_conffile /etc/default/grub.d/41_quiet.cfg + +## moved to usability-misc +rm_conffile /etc/dkms/framework.conf.d/30_security-misc.conf + +## renamed to reflect the fact that this uses a whitelist +rm_conffile /usr/lib/permission-hardener.d/25_default_passwd.conf diff --git a/debian/security-misc-shared.postinst b/debian/security-misc-shared.postinst new file mode 100755 index 00000000..0b1567c7 --- /dev/null +++ b/debian/security-misc-shared.postinst @@ -0,0 +1,231 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## style-ok: no-has - has.bsh isn't reliably available in maintainer scripts +## style-ok: no-strict - full strict block could leak into APT/debconf + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + source /usr/libexec/helper-scripts/pre.bsh +fi + +## Required since this package uses debconf - this is mandatory even though +## the postinst itself does not use debconf commands. +source /usr/share/debconf/confmodule + +set -o errexit + +true " +##################################################################### +## INFO: BEGIN: ${DPKG_MAINTSCRIPT_PACKAGE} ${DPKG_MAINTSCRIPT_NAME} $* +##################################################################### +" + +permission_hardening_legacy_config_folder() { + if ! test -d /etc/permission-hardening.d ; then + return 0 + fi + rmdir --verbose --ignore-fail-on-non-empty /etc/permission-hardening.d || true +} + +permission_hardening() { + printf '%s\n' "Running SUID Disabler and Permission Hardener... See also:" + printf '%s\n' "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener" + printf '%s\n' "$0: INFO: running: permission-hardener enable" + ## By design: report error but return 0 to avoid breaking APT. + ## A failing postinst would leave the package in a broken state. + if ! permission-hardener enable ; then + printf '%s\n' "$0: ERROR: Permission hardening failed." >&2 + return 0 + fi + printf '%s\n' "$0: INFO: Permission hardening success." +} + +fix_pkexec_remembered_permissions() { + if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" ]; then + return 0 + fi + mkdir --parents '/var/lib/security-misc/do_once' + + if ! [ -f "/var/lib/permission-hardener-v2/existing_mode/statoverride" ]; then + ## 'statoverride' file does not exist yet. Therefore no need to fix it using 'str_replace'. + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" + return 0 + fi + + ## The existing_mode database may incorrectly list the original permissions + ## of pkexec as '755'. They should be '4755'. Fix this with str_replace. If + ## this issue is not present, str_replace will do nothing. + str_replace 'root root 755 /usr/bin/pkexec' \ + 'root root 4755 /usr/bin/pkexec' \ + /var/lib/permission-hardener-v2/existing_mode/statoverride + + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" +} + +install_permission_hardener_base_state() { + local state_str + + if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" ]; then + return 0 + fi + mkdir --parents '/var/lib/security-misc/do_once' + + if [ -f "/var/lib/permission-hardener-v2/existing_mode/statoverride" ]; then + ## 'statoverride' file already exists. Therefore no need to pre-populate it. + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" + return 0 + fi + + mkdir --parents -- '/var/lib/permission-hardener-v2/existing_mode' + state_str="root root 644 /etc/passwd- +root root 755 /etc/cron.monthly +root root 755 /etc/sudoers.d +root shadow 2755 /usr/bin/expiry +root root 4755 /usr/bin/umount +root root 4755 /usr/bin/gpasswd +root root 755 /usr/lib/modules +root root 644 /etc/issue.net +root root 644 /etc/group- +root root 4755 /usr/bin/newgrp +root root 755 /etc/cron.weekly +root root 4755 /usr/lib/polkit-1/polkit-agent-helper-1 +root root 644 /etc/hosts.deny +root root 4755 /usr/bin/newgidmap +root root 644 /etc/issue.kicksecure +root root 4755 /usr/bin/pkexec +root root 4755 /usr/bin/su +root root 644 /etc/hosts.allow +root root 700 /root +root root 755 /etc/cron.daily +root root 644 /etc/motd +root root 4755 /usr/bin/newuidmap +root root 755 /boot +root root 755 /home +root shadow 2755 /usr/bin/chage +root root 4755 /usr/lib/openssh/ssh-keysign +root root 4755 /usr/bin/ntfs-3g +root root 4755 /usr/bin/chsh +root root 644 /etc/motd.kicksecure +root root 755 /usr/bin/su-to-root +root root 4755 /usr/bin/passwd +root root 4755 /usr/bin/chfn +root root 644 /etc/group +root root 4755 /usr/bin/sudo +root root 644 /etc/passwd +root root 755 /usr/src +root root 4755 /usr/bin/mount +root root 644 /etc/issue +root root 755 /etc/cron.d" + + printf '%s\n' "${state_str}" | tee /var/lib/permission-hardener-v2/existing_mode/statoverride + + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" +} + +build_fm_shim_backend() { + /usr/libexec/security-misc/build-fm-shim-backend +} + +build_emerg_shutdown() { + /usr/libexec/security-misc/build-emerg-shutdown +} + +case "$1" in + configure) + if [ -d /etc/skel/.gnupg ]; then + ## Lintian warns against use of chmod --recursive. + chmod 700 /etc/skel/.gnupg + fi + + ## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override + glib-compile-schemas /usr/share/glib-2.0/schemas || true + + ## state dir for PAM 'faillock' + mkdir -p /var/lib/security-misc/faillock + + ## Fix pkexec remembered permissions if necessary. + fix_pkexec_remembered_permissions + + ## Pre-populate permission-hardener state on first postinst run. + ## Necessary because the first permission-hardener run may occur + ## before all permissions are set properly by package postinst + ## scripts. In particular, pkexec is not SUID-root until after its + ## postinst runs. + install_permission_hardener_base_state + + ## Fix usbguard config permissions, this seemingly can't be done + ## during the unpack stage + usbguard_config_file_list=( + '/etc/usbguard/rules.d/30_security-misc.conf' + '/etc/usbguard/usbguard-daemon.conf.security-misc' + '/etc/usbguard/IPCAccessControl.d/:sudo' + '/etc/usbguard/IPCAccessControl.d/:qubes' + ) + for usbguard_config_file in "${usbguard_config_file_list[@]}"; do + if test -f "${usbguard_config_file}"; then + chmod 0600 "${usbguard_config_file}" + fi + done + + ## Build the org.freedesktop.FileManager1 shim backend. + build_fm_shim_backend + + ## Pre-compile emerg-shutdown. + build_emerg_shutdown + ;; + + abort-upgrade|abort-remove|abort-deconfigure) + ;; + + triggered) + printf '%s\n' "INFO: triggered ${DPKG_MAINTSCRIPT_PACKAGE}: '${DPKG_MAINTSCRIPT_PACKAGE}' ${DPKG_MAINTSCRIPT_PACKAGE} DPKG_MAINTSCRIPT_NAME: '${DPKG_MAINTSCRIPT_NAME}' $\*: '$*' 2: '$2'" + /usr/share/security-misc/lkrg/lkrg-virtualbox || true + /usr/libexec/security-misc/mmap-rnd-bits || true + permission_hardening + exit 0 + ;; + + *) + printf '%s\n' "${DPKG_MAINTSCRIPT_NAME} called with unknown argument \`$1'" >&2 + exit 1 + ;; +esac + +pam-auth-update --package + +/usr/libexec/security-misc/permission-lockdown + +permission_hardening + +## https://phabricator.whonix.org/T377 +## Debian has no update-grub trigger yet: +## https://bugs.debian.org/481542 +if command -v update-grub >/dev/null 2>&1; then + update-grub || \ + printf '%s\n' "${DPKG_MAINTSCRIPT_PACKAGE} ${DPKG_MAINTSCRIPT_NAME} ERROR: Running \ +'update-grub' failed with exit code $?. ${DPKG_MAINTSCRIPT_PACKAGE} is most \ +likely only the trigger, not the cause. Unless you know this is not an issue, \ +you should fix running 'update-grub', otherwise your system might no longer \ +boot." >&2 +fi + +/usr/libexec/security-misc/mmap-rnd-bits || true + +true "INFO: debhelper beginning here." + +#DEBHELPER# + +true "INFO: Done with debhelper." + +permission_hardening_legacy_config_folder + +true " +##################################################################### +## INFO: END : ${DPKG_MAINTSCRIPT_PACKAGE} ${DPKG_MAINTSCRIPT_NAME} $* +##################################################################### +" + +## Explicitly "exit 0", so eventually trapped errors can be ignored. +exit 0 diff --git a/debian/security-misc.postrm b/debian/security-misc-shared.postrm old mode 100644 new mode 100755 similarity index 85% rename from debian/security-misc.postrm rename to debian/security-misc-shared.postrm index c40721f7..0be096ef --- a/debian/security-misc.postrm +++ b/debian/security-misc-shared.postrm @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then @@ -16,7 +16,9 @@ true " " ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/11 -pam-auth-update --package --remove "$DPKG_MAINTSCRIPT_PACKAGE" +if command -v pam-auth-update >/dev/null 2>&1; then + pam-auth-update --package +fi rm -f /etc/sysctl.d/30_security-misc_aslr-mmap.conf diff --git a/debian/security-misc-shared.preinst b/debian/security-misc-shared.preinst new file mode 100755 index 00000000..43a07ff6 --- /dev/null +++ b/debian/security-misc-shared.preinst @@ -0,0 +1,219 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## helper-scripts is a Pre-Depends. +source /usr/libexec/helper-scripts/pre.bsh +source /usr/libexec/helper-scripts/has.bsh +source /usr/libexec/helper-scripts/accountctl.sh + +true " +##################################################################### +## INFO: BEGIN: ${DPKG_MAINTSCRIPT_PACKAGE:-} ${DPKG_MAINTSCRIPT_NAME:-} $* +##################################################################### +" + +user_groups_modifications() { + ## /usr/libexec/security-misc/hide-hardware-info + addgroup --system sysfs + addgroup --system cpuinfo + + ## /usr/lib/systemd/system/proc-hidepid.service + addgroup --system proc + + ## Avoid 'debian/control' file 'Depends:' 'sudo'. + ## + ## Could use '/usr/libexec/helper-scripts/user_create.bsh' in preinst? Looks more complex. Avoided. + ## group 'sudo' is not a system group. + #addgroup --system sudo + ## Function 'is_group' is complex. Hence, use '2>/dev/null || true'. + addgroup sudo 2>/dev/null || true + + ## group 'sudo' membership required to use 'su' + ## /usr/share/pam-configs/wheel-security-misc + adduser root sudo + + ## Useful to create groups in preinst rather than postinst. + ## Otherwise if a user saw an error message such as this: + ## + ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted. + ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: You probably want to run: + ## sudo adduser user console + ## + ## Then the user could not run 'sudo adduser user console' but also would + ## have to create the groups himself. + + ## Related to Console Lockdown. + ## /usr/share/pam-configs/console-lockdown-security-misc + ## /etc/security/access-security-misc.conf + addgroup --system console + addgroup --system console-unrestricted + ## This has no effect since by default this package also ships and an + ## /etc/securetty configuration file that contains nothing but comments, i.e. + ## an "empty" /etc/securetty. + ## In case a system administrator edits /etc/securetty, there is no need to + ## block for this to be still blocked by console lockdown. See also: + ## https://www.kicksecure.com/wiki/Root#Root_Login + adduser root console +} + +output_skip_checks() { + printf '%s\n' "security-misc-shared '${0}' INFO: Allow installation of security-misc-shared anyway." >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: (technical reason: $*)" >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: If this is a chroot this is probably OK." >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: Otherwise you might not be able to login." >&2 +} + +sudo_users_check () { + if has qubesdb-read; then + ## Qubes users can use dom0 to get a root terminal emulator. + ## For example: + ## qvm-run -u root debian-10 xterm + return 0 + fi + + if group_has_nonroot_member sudo; then + return 0 + fi + + ## Prevent users from locking themselves out. + ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 + printf '%s\n' "${0}: ERROR: No account is a member of group 'sudo'. Installation aborted." >&2 + printf '%s\n' "${0}: ERROR: You probably want to run:" >&2 + printf '%s\n' "${0}: NOTE: Replace account 'user' with your actual Linux user account name." >&2 + printf '%s\n' "" >&2 + printf '%s\n' "sudo adduser user sudo" >&2 + printf '%s\n' "sudo adduser user console" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "${0}: ERROR: See also installation instructions:" >&2 + printf '%s\n' "https://www.kicksecure.com/wiki/security-misc#install" >&2 + + if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then + output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'." + return 0 + fi + if test -f "/var/lib/security-misc/skip_install_check" \ + || [ "${dist_build_iso:-}" = "true" ] ; then + output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists or this is an ISO/live build (dist_build_iso=true)." + return 0 + fi + + exit 200 +} + +console_users_check() { + if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then + return 0 + fi + if test -f "/var/lib/security-misc/skip_install_check" \ + || [ "${dist_build_iso:-}" = "true" ] ; then + return 0 + fi + if has qubesdb-read; then + ## Qubes users can use dom0 to get a root terminal emulator. + ## For example: + ## qvm-run -u root debian-10 xterm + return 0 + fi + + ## Prevent users from locking themselves out. + ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 + if group_has_nonroot_member console \ + || group_has_nonroot_member console-unrestricted; then + return 0 + fi + + printf '%s\n' "${0}: ERROR: No account is a member of group 'console'. Installation aborted." >&2 + printf '%s\n' "${0}: ERROR: You probably want to run:" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "sudo adduser user console" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "${0}: ERROR: See also installation instructions:" >&2 + printf '%s\n' "https://www.whonix.org/wiki/security-misc#install" >&2 + + if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then + output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'." + return 0 + fi + if test -f "/var/lib/security-misc/skip_install_check" \ + || [ "${dist_build_iso:-}" = "true" ] ; then + output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists or this is an ISO/live build (dist_build_iso=true)." + return 0 + fi + + exit 201 +} + +legacy() { + if [ -f "/var/lib/legacy/do_once/${FUNCNAME[0]}_version_1" ]; then + return 0 + fi + + local continue_yes user_to_be_created + + if [ -f "/usr/share/whonix/marker" ]; then + continue_yes=true + fi + if [ -f "/usr/share/kicksecure/marker" ]; then + continue_yes=true + fi + + if [ ! "${continue_yes:-}" = "true" ]; then + return 0 + fi + + if has qubesdb-read; then + ## Qubes users can use dom0 to get a root terminal emulator. + ## For example: + ## qvm-run -u root debian-10 xterm + return 0 + fi + + ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/7 + + user_to_be_created=user + + if ! id "${user_to_be_created}" &>/dev/null ; then + true "INFO: Account '${user_to_be_created}' does not exist. Skipping adding account '${user_to_be_created}' to group 'console' and also skipping 'pam-auth-update --enable console-lockdown-security-misc'." + return 0 + fi + + adduser "${user_to_be_created}" console + + pam-auth-update --enable console-lockdown-security-misc + + mkdir --parents "/var/lib/legacy/do_once" + touch "/var/lib/legacy/do_once/${FUNCNAME[0]}_version_1" +} + +user_groups_modifications +legacy + +if [ "${1:-}" = "install" ] || [ "${1:-}" = "upgrade" ]; then + sudo_users_check + console_users_check +fi + +true "INFO: debhelper beginning here." + +#DEBHELPER# + +true "INFO: Done with debhelper." + +true " +##################################################################### +## INFO: END : ${DPKG_MAINTSCRIPT_PACKAGE:-} ${DPKG_MAINTSCRIPT_NAME:-} $* +##################################################################### +" + +## Explicitly "exit 0", so eventually trapped errors can be ignored. +exit 0 diff --git a/debian/security-misc.prerm b/debian/security-misc-shared.prerm old mode 100644 new mode 100755 similarity index 60% rename from debian/security-misc.prerm rename to debian/security-misc-shared.prerm index 78d5f3a1..a4106c3e --- a/debian/security-misc.prerm +++ b/debian/security-misc-shared.prerm @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then @@ -16,7 +16,17 @@ true " " if [ "$1" = remove ]; then - pam-auth-update --package --remove "$DPKG_MAINTSCRIPT_PACKAGE" + ## REMINDER: This list of policies must be kept in sync with the contents of + ## usr/share/pam-configs. + pam-auth-update --package --remove \ + block-unsafe-logins-security-misc \ + console-lockdown-security-misc \ + faillock-preauth-security-misc \ + mkhomedir-security-misc \ + pam-abort-on-locked-password-security-misc \ + umask-security-misc \ + unix-faillock-security-misc \ + wheel-security-misc fi true "INFO: debhelper beginning here." diff --git a/debian/security-misc-shared.templates b/debian/security-misc-shared.templates new file mode 100644 index 00000000..d45dfa17 --- /dev/null +++ b/debian/security-misc-shared.templates @@ -0,0 +1,9 @@ +Template: security-misc-shared/alert-on-permission-hardener-v2-upgrade +Type: note +_Description: Manual intervention may be required for permission-hardener update + No need to panic. Nothing is broken. A rare condition has been encountered. + permission-hardener is being updated to fix a minor bug that caused + corruption in the permission-hardener state file. If you installed your own + custom permission-hardener configuration, some manual intervention may be + required. See: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#fixing_state_files diff --git a/debian/security-misc-shared.triggers b/debian/security-misc-shared.triggers new file mode 100644 index 00000000..1f4a5921 --- /dev/null +++ b/debian/security-misc-shared.triggers @@ -0,0 +1,16 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## use noawait +## https://github.com/Kicksecure/security-misc/issues/196 + +## Trigger permission hardener when new binaries are being installed. +interest-noawait /usr +interest-noawait /opt + +## Trigger permission hardener when new configuration files are being installed. +interest-noawait /usr/lib/permission-hardener.d +interest-noawait /etc/permission-hardener.d +interest-noawait /usr/local/etc/permission-hardener.d +interest-noawait /etc/permission-hardening.d +interest-noawait /usr/local/etc/permission-hardening.d diff --git a/debian/security-misc.undisplace b/debian/security-misc-shared.undisplace similarity index 66% rename from debian/security-misc.undisplace rename to debian/security-misc-shared.undisplace index 4aed27c1..990101a0 100644 --- a/debian/security-misc.undisplace +++ b/debian/security-misc-shared.undisplace @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. /etc/login.defs.security-misc diff --git a/debian/security-misc.displace b/debian/security-misc.displace deleted file mode 100644 index d80a247c..00000000 --- a/debian/security-misc.displace +++ /dev/null @@ -1,5 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -/etc/securetty.security-misc -/etc/security/faillock.conf.security-misc diff --git a/debian/security-misc.gconf-defaults b/debian/security-misc.gconf-defaults deleted file mode 100644 index 26d57ff7..00000000 --- a/debian/security-misc.gconf-defaults +++ /dev/null @@ -1,3 +0,0 @@ -/apps/nautilus/preview_sound never -/apps/nautilus/show_icon_text never -/apps/nautilus/show-image-thumbnails never diff --git a/debian/security-misc.install b/debian/security-misc.install deleted file mode 100644 index 9cea19c6..00000000 --- a/debian/security-misc.install +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2020 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## This file was generated using 'genmkfile debinstfile'. - -etc/* -usr/* -var/* diff --git a/debian/security-misc.postinst b/debian/security-misc.postinst deleted file mode 100644 index b3aaae8c..00000000 --- a/debian/security-misc.postinst +++ /dev/null @@ -1,112 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then - source /usr/libexec/helper-scripts/pre.bsh -fi - -set -e - -true " -##################################################################### -## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -permission_hardening_legacy_state_files() { - if test -d /var/lib/permission-hardener ; then - return 0 - fi - if ! test -d /var/lib/permission-hardening ; then - return 0 - fi - mv --verbose /var/lib/permission-hardening /var/lib/permission-hardener -} - -permission_hardening_legacy_config_folder() { - if ! test -d /etc/permission-hardening.d ; then - return 0 - fi - rmdir --verbose --ignore-fail-on-non-empty /etc/permission-hardening.d || true -} - -permission_hardening() { - echo "Running SUID Disabler and Permission Hardener... See also:" - echo "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener" - echo "$0: INFO: running: permission-hardener enable" - echo "" - if ! permission-hardener enable ; then - echo "$0: ERROR: Permission hardening failed." >&2 - return 0 - fi - echo "" - echo "$0: INFO: Permission hardening success." -} - -case "$1" in - configure) - if [ -d /etc/skel/.gnupg ]; then - ## Lintian warns against use of chmod --recursive. - chmod 700 /etc/skel/.gnupg - fi - - ## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override - glib-compile-schemas /usr/share/glib-2.0/schemas || true - ;; - - abort-upgrade|abort-remove|abort-deconfigure) - ;; - - triggered) - echo "INFO: triggered $DPKG_MAINTSCRIPT_PACKAGE: '$DPKG_MAINTSCRIPT_PACKAGE' $DPKG_MAINTSCRIPT_PACKAGE DPKG_MAINTSCRIPT_NAME: '$DPKG_MAINTSCRIPT_NAME' $\@: '$@' 2: '$2'" - /usr/share/security-misc/lkrg/lkrg-virtualbox || true - /usr/libexec/security-misc/mmap-rnd-bits || true - permission_hardening - exit 0 - ;; - - *) - echo "$DPKG_MAINTSCRIPT_NAME called with unknown argument \`$1'" >&2 - exit 1 - ;; -esac - -pam-auth-update --package - -/usr/libexec/security-misc/permission-lockdown -permission_hardening_legacy_state_files - -permission_hardening - -## https://phabricator.whonix.org/T377 -## Debian has no update-grub trigger yet: -## https://bugs.debian.org/481542 -if command -v update-grub >/dev/null 2>&1; then - update-grub || \ - echo "$DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME ERROR: Running \ -'update-grub' failed with exit code $?. $DPKG_MAINTSCRIPT_PACKAGE is most \ -likely only the trigger, not the cause. Unless you know this is not an issue, \ -you should fix running 'update-grub', otherwise your system might no longer \ -boot." >&2 -fi - -/usr/libexec/security-misc/mmap-rnd-bits || true - -true "INFO: debhelper beginning here." - -#DEBHELPER# - -true "INFO: Done with debhelper." - -permission_hardening_legacy_config_folder - -true " -##################################################################### -## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -## Explicitly "exit 0", so eventually trapped errors can be ignored. -exit 0 diff --git a/debian/security-misc.preinst b/debian/security-misc.preinst deleted file mode 100644 index dc032b1f..00000000 --- a/debian/security-misc.preinst +++ /dev/null @@ -1,246 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then - source /usr/libexec/helper-scripts/pre.bsh -fi - -set -e - -true " -##################################################################### -## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -user_groups_modifications() { - ## /usr/libexec/security-misc/hide-hardware-info - addgroup --system sysfs - addgroup --system cpuinfo - - ## group 'sudo' membership required to use 'su' - ## /usr/share/pam-configs/wheel-security-misc - adduser root sudo - - ## Useful to create groups in preinst rather than postinst. - ## Otherwise if a user saw an error message such as this: - ## - ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted. - ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: You probably want to run: - ## sudo adduser user console - ## - ## Then the user could not run 'sudo adduser user console' but also would - ## have to create the groups himself. - - ## Related to Console Lockdown. - ## /usr/share/pam-configs/console-lockdown-security-misc - ## /etc/security/access-security-misc.conf - addgroup --system console - addgroup --system console-unrestricted - ## This has no effect since by default this package also ships and an - ## /etc/securetty configuration file that contains nothing but comments, i.e. - ## an "empty" /etc/securetty. - ## In case a system administrator edits /etc/securetty, there is no need to - ## block for this to be still blocked by console lockdown. See also: - ## https://www.whonix.org/wiki/Root#Root_Login - adduser root console -} - -output_skip_checks() { - echo "security-misc '$0' INFO: Allow installation of security-misc anyway." >&2 - echo "security-misc '$0' INFO: (technical reason: $@)" >&2 - echo "security-misc '$0' INFO: If this is a chroot this is probably OK." >&2 - echo "security-misc '$0' INFO: Otherwise you might not be able to login." >&2 -} - -sudo_users_check () { - if command -v "qubesdb-read" &>/dev/null; then - ## Qubes users can use dom0 to get a root terminal emulator. - ## For example: - ## qvm-run -u root debian-10 xterm - return 0 - fi - - local sudo_users user_with_sudo are_there_any_sudo_users OLD_IFS - - sudo_users="$(getent group sudo | cut -d: -f4)" - ## example sudo_users: - ## user,root - - OLD_IFS="$IFS" - IFS="," - export IFS - - for user_with_sudo in $sudo_users ; do - if [ "$user_with_sudo" = "root" ]; then - ## root login is also restricted. - ## Therefore user "root" being member of group "sudo" is - ## considered insufficient. - continue - fi - are_there_any_sudo_users=yes - break - done - - IFS="$OLD_IFS" - export IFS - - if [ "$are_there_any_sudo_users" = "yes" ]; then - return 0 - fi - - ## Prevent users from locking themselves out. - ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 - echo "$0: ERROR: No user is a member of group 'sudo'. Installation aborted." >&2 - echo "$0: ERROR: You probably want to run:" >&2 - echo "$0: NOTE: Replace user 'user' with your actual Linux user account name." >&2 - echo "" >&2 - echo "sudo adduser user sudo" >&2 - echo "sudo adduser user console" >&2 - echo "" >&2 - echo "$0: ERROR: See also installation instructions:" >&2 - echo "https://www.kicksecure.com/wiki/security-misc#install" >&2 - - if [ "$SECURITY_MISC_INSTALL" = "force" ]; then - output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'." - return 0 - fi - if test -f "/var/lib/security-misc/skip_install_check" ; then - output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists." - return 0 - fi - - exit 200 -} - -console_users_check() { - if [ "$SECURITY_MISC_INSTALL" = "force" ]; then - return 0 - fi - if test -f "/var/lib/security-misc/skip_install_check" ; then - return 0 - fi - if command -v "qubesdb-read" &>/dev/null; then - ## Qubes users can use dom0 to get a root terminal emulator. - ## For example: - ## qvm-run -u root debian-10 xterm - return 0 - fi - - local console_users console_unrestricted_users user_with_console are_there_any_console_users OLD_IFS - - console_users="$(getent group console | cut -d: -f4)" - ## example console_users: - ## user - console_unrestricted_users="$(getent group console-unrestricted | cut -d: -f4)" - - OLD_IFS="$IFS" - IFS="," - export IFS - - for user_with_console in $console_users $console_unrestricted_users ; do - if [ "$user_with_console" = "root" ]; then - ## root login is also restricted. - ## Therefore user "root" being member of group "console" is - ## considered insufficient. - continue - fi - are_there_any_console_users=yes - break - done - - IFS="$OLD_IFS" - export IFS - - ## Prevent users from locking themselves out. - ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 - if [ "$are_there_any_console_users" = "yes" ]; then - return 0 - fi - - echo "$0: ERROR: No user is a member of group 'console'. Installation aborted." >&2 - echo "$0: ERROR: You probably want to run:" >&2 - echo "" >&2 - echo "sudo adduser user console" >&2 - echo "" >&2 - echo "$0: ERROR: See also installation instructions:" >&2 - echo "https://www.whonix.org/wiki/security-misc#install" >&2 - - if [ "$SECURITY_MISC_INSTALL" = "force" ]; then - output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'." - return 0 - fi - if test -f "/var/lib/security-misc/skip_install_check" ; then - output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists." - return 0 - fi - - exit 201 -} - -legacy() { - if [ -f "/var/lib/legacy/do_once/${FUNCNAME}_version_1" ]; then - return 0 - fi - - local continue_yes user_to_be_created - - if [ -f "/usr/share/whonix/marker" ]; then - continue_yes=true - fi - if [ -f "/usr/share/kicksecure/marker" ]; then - continue_yes=true - fi - - if [ ! "$continue_yes" = "true" ]; then - return 0 - fi - - if command -v "qubesdb-read" &>/dev/null; then - ## Qubes users can use dom0 to get a root terminal emulator. - ## For example: - ## qvm-run -u root debian-10 xterm - return 0 - fi - - ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/7 - - user_to_be_created=user - - if ! id "$user_to_be_created" &>/dev/null ; then - true "INFO: user '$user_to_be_created' does not exist. Skipping adduser console and pam-auth-update." - return 0 - fi - - adduser "$user_to_be_created" console - - pam-auth-update --enable console-lockdown-security-misc - - mkdir --parents "/var/lib/legacy/do_once" - touch "/var/lib/legacy/do_once/${FUNCNAME}_version_1" -} - -user_groups_modifications -legacy - -if [ "$1" = "install" ] || [ "$1" = "upgrade" ]; then - sudo_users_check - console_users_check -fi - -true "INFO: debhelper beginning here." - -#DEBHELPER# - -true "INFO: Done with debhelper." - -true " -##################################################################### -## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -## Explicitly "exit 0", so eventually trapped errors can be ignored. -exit 0 diff --git a/debian/security-misc.triggers b/debian/security-misc.triggers deleted file mode 100644 index f4250764..00000000 --- a/debian/security-misc.triggers +++ /dev/null @@ -1,6 +0,0 @@ -## Copyright (C) 2024 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://github.com/Kicksecure/security-misc/issues/196 -interest-noawait /usr -interest-noawait /opt diff --git a/debian/watch b/debian/watch index 4a80d35c..ea85f6bb 100644 --- a/debian/watch +++ b/debian/watch @@ -1,6 +1,6 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. version=4 opts=filenamemangle=s/.+\/v?(\d\S+)\.tar\.gz/security-misc-$1\.tar\.gz/ \ - https://github.com/Whonix/security-misc/tags .*/v?(\d\S+)\.tar\.gz + https://github.com/Kicksecure/security-misc/tags .*/v?(\d\S+)\.tar\.gz diff --git a/etc/apparmor.d/tunables/home.d/security-misc b/etc/apparmor.d/tunables/home.d/security-misc deleted file mode 100644 index b1aad3d5..00000000 --- a/etc/apparmor.d/tunables/home.d/security-misc +++ /dev/null @@ -1,7 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -alias /etc/pam.d/common-session -> /etc/pam.d//etc/pam.d/common-session.security-misc, -alias /etc/pam.d/common-session-noninteractive -> /etc/pam.d/common-session-noninteractive.security-misc, -alias /etc/login.defs -> /etc/login.defs.security-misc, -alias /etc/securetty -> /etc/securetty.security-misc, diff --git a/etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared b/etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared new file mode 100644 index 00000000..b8b97362 --- /dev/null +++ b/etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared @@ -0,0 +1,4 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +alias /etc/securetty -> /etc/securetty.security-misc, diff --git a/etc/apt/apt.conf.d/40error-on-any b/etc/apt/apt.conf.d/40error-on-any#security-misc-shared similarity index 84% rename from etc/apt/apt.conf.d/40error-on-any rename to etc/apt/apt.conf.d/40error-on-any#security-misc-shared index fbde1db8..f1be4729 100644 --- a/etc/apt/apt.conf.d/40error-on-any +++ b/etc/apt/apt.conf.d/40error-on-any#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Make "sudo apt-get update" exit non-zero for transient failures. diff --git a/etc/apt/apt.conf.d/40sandbox b/etc/apt/apt.conf.d/40sandbox#security-misc-shared similarity index 65% rename from etc/apt/apt.conf.d/40sandbox rename to etc/apt/apt.conf.d/40sandbox#security-misc-shared index eb7ef7a4..43150ec6 100644 --- a/etc/apt/apt.conf.d/40sandbox +++ b/etc/apt/apt.conf.d/40sandbox#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702 diff --git a/etc/bluetooth/30_security-misc.conf b/etc/bluetooth/30_security-misc.conf#security-misc-desktop similarity index 85% rename from etc/bluetooth/30_security-misc.conf rename to etc/bluetooth/30_security-misc.conf#security-misc-desktop index d3410f2d..8de8384c 100644 --- a/etc/bluetooth/30_security-misc.conf +++ b/etc/bluetooth/30_security-misc.conf#security-misc-desktop @@ -1,3 +1,6 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + [General] # How long to stay in pairable mode before going back to non-discoverable # The value is in seconds. Default is 0. @@ -13,11 +16,6 @@ DiscoverableTimeout = 30 # Default=0 (unlimited) MaxControllers=1 -# How long to keep temporary devices around -# The value is in seconds. Default is 30. -# 0 = disable timer, i.e. never keep temporary devices -TemporaryTimeout = 0 - [Policy] # AutoEnable defines option to enable all controllers when they are found. # This includes adapters present on start as well as adapters that are plugged diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg b/etc/default/grub.d/40_cpu_mitigations.cfg deleted file mode 100644 index 9bd9fc51..00000000 --- a/etc/default/grub.d/40_cpu_mitigations.cfg +++ /dev/null @@ -1,77 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Enables all known mitigations for CPU vulnerabilities. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html -## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html -## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647 - -## Enable known mitigations for CPU vulnerabilities and disable SMT. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt" - -## Enable mitigations for Spectre variant 2 (indirect branch speculation). -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on" - -## Disable Speculative Store Bypass. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on" - -## Enable mitigations for the L1TF vulnerability through disabling SMT -## and L1D flush runtime control. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force" - -## Enable mitigations for the MDS vulnerability through clearing buffer cache -## and disabling SMT. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" - -## Patches the TAA vulnerability by disabling TSX and enables mitigations using -## TSX Async Abort along with disabling SMT. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off tsx_async_abort=full,nosmt" - -## Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force" - -## Enables mitigations for SRBDS to prevent MDS attacks on RDRAND and RDSEED instructions. -## Only mitigated through microcode updates from Intel. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/special-register-buffer-data-sampling.html -## https://access.redhat.com/solutions/5142691 - -## Force disable SMT as it has caused numerous CPU vulnerabilities. -## The only full mitigation of cross-HT attacks is to disable SMT. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html -## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force" - -## Enables the prctl interface to prevent leaks from L1D on context switches. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on" - -## Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt" - -## Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with -## Return Instructions) vulnerability and disable SMT. -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt" - -## Control RAS overflow mitigation on AMD Zen CPUs. -## The current default kernel parameter is 'spec_rstack_overflow=safe-ret' -## This default will used until provided sufficient evidence to modify. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html - diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared b/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared new file mode 100644 index 00000000..9d78a8ff --- /dev/null +++ b/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared @@ -0,0 +1,232 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Enable known mitigations for CPU vulnerabilities. +## Note, the mitigations for SSB and Retbleed are not currently mentioned in the first link. +## https://docs.kernel.org/admin-guide/hw-vuln/index.html +## https://docs.kernel.org/admin-guide/kernel-parameters.html +## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647 + +## Check for potential updates directly from AMD and Intel. +## https://www.amd.com/en/resources/product-security.html +## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html +## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html + +## Tabular comparison between the utility and functionality of various mitigations. +## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/587 + +## For complete protection, users must install the latest relevant security microcode update. +## BIOS/UEFI updates should only be obtained directly from OEMs and/or motherboard manufacturers. +## Note that incorrectly performing system BIOS/UEFI updates can potentially lead to serious functionality issues. +## The parameters below only provide (partial) protection at both the kernel and user space level. + +## If using Secure Boot, users must also ensure the Secure Boot Forbidden Signature Database (DBX) is up to date. +## The UEFI Revocation List contains signatures of now revoked firmware and software used in booting systems. +## If using compatible hardware, the database can be updated directly in user space using fwupd. +## Note that incorrectly performing DBX updates can potentially lead to serious functionality issues. +## https://github.com/microsoft/secureboot_objects +## https://uefi.org/revocationlistfile +## https://github.com/fwupd/fwupd + +## Enable a subset of known default mitigations for some CPU vulnerabilities and disable SMT. +## Note that this redundant parameter simply applies each mitigation at the already applied default settings. +## The default values are not always the strictest and so we reapply each below to their highest setting. +## We retain it here for completeness as many other distributions heavily rely on this for many CPU mitigations. +## +## https://github.com/Kicksecure/security-misc/issues/199#issuecomment-3327391859 +## https://github.com/secureblue/secureblue/issues/1405 +## https://docs.kernel.org/admin-guide/hw-vuln/attack_vector_controls.html +## +## KSPP=yes +## KSPP sets the kernel parameters. +## +## WARNING: Do not rely on this parameter, it is presented here only for educational purposes. +## WARNING: Parameters are applied consecutively and so do not ever move this setting down. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt" + +## Disable SMT as it has been the cause of and amplified numerous CPU exploits. +## The only full mitigation of cross-HT attacks is to disable SMT. +## Disabling will significantly decrease system performance on multi-threaded tasks. +## Note, this setting will prevent re-enabling SMT via the sysfs interface. +## +## https://docs.kernel.org/admin-guide/hw-vuln/core-scheduling.html +## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 +## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365 +## +## KSPP=yes +## KSPP sets the kernel parameter. +## +## To re-enable SMT: +## - Remove "nosmt=force". +## - Remove all occurrences of ",nosmt" in this file (note the comma ","). +## - Downgrade "l1tf=full,force" protection to "l1tf=flush". +## - Regenerate the dracut initramfs and then reboot system. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force" + +## Spectre Side Channels (BTI and BHI): +## Unconditionally enable mitigation for Spectre Variant 2 (branch target injection). +## Enable mitigation for the Intel branch history injection vulnerability. +## Currently affects both AMD and Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/spectre.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on" + +## Meltdown: +## Mitigate Spectre Variant 3 using kernel page table isolation (PTI). +## Enables kernel PTI to harden against kernel ASLR (KASLR) bypasses. +## Force enables PTI of user and kernel address spaces on all ARM cores. +## Currently affects AMD, ARM64, and Intel CPUs. +## +## https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability) +## https://en.wikipedia.org/wiki/Kernel_page-table_isolation +## +## KSPP=yes +## KSPP sets "pti=on", CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y, and CONFIG_UNMAP_KERNEL_AT_EL0=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kpti=1" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on" + +## Speculative Store Bypass (SSB): +## Mitigate Spectre Variant 4 by disabling speculative store bypass system-wide. +## Unconditionally enable the mitigation for both kernel and userspace. +## Currently affects AMD, ARM64, and Intel CPUs. +## +## https://en.wikipedia.org/wiki/Speculative_Store_Bypass +## https://www.suse.com/support/kb/doc/?id=000019189 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ssbd=force-on" + +## L1 Terminal Fault (L1TF): +## Mitigate the vulnerability by disabling L1D flush runtime control and SMT. +## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/l1tf.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always" + +## Microarchitectural Data Sampling (MDS): +## Mitigate the vulnerability by clearing the CPU buffer cache and disabling SMT. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/mds.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" + +## TSX Asynchronous Abort (TAA): +## Mitigate the vulnerability by disabling TSX. +## If TSX is enabled, clear CPU buffer rings on transitions and disable SMT. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/tsx_async_abort.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt" + +## iTLB Multihit: +## Mitigate the vulnerability by marking all huge pages in the EPT as non-executable. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/multihit.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force" + +## Special Register Buffer Data Sampling (SRBDS): +## Mitigation of the vulnerability is only possible via microcode update from Intel. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/special-register-buffer-data-sampling.html +## https://access.redhat.com/solutions/5142691 + +## L1D Flushing: +## Mitigate leaks from the L1D cache on context switches by enabling the prctl() interface. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/l1d_flush.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on" + +## Processor MMIO Stale Data: +## Mitigate the vulnerabilities by appropriately clearing the CPU buffer and disabling SMT. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/processor_mmio_stale_data.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt" + +## Arbitrary Speculative Code Execution with Return Instructions (Retbleed): +## Mitigate the vulnerability through CPU-dependent implementation and disable SMT. +## Currently affects both AMD Zen 1-2 and Intel CPUs. +## +## https://en.wikipedia.org/wiki/Retbleed +## https://comsec.ethz.ch/research/microarch/retbleed/ +## https://www.suse.com/support/kb/doc/?id=000020693 +## https://access.redhat.com/solutions/retbleed +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt" + +## Cross-Thread Return Address Predictions: +## Mitigate the vulnerability for certain KVM hypervisor configurations. +## Currently affects AMD Zen 1-2 CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/cross-thread-rsb.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.mitigate_smt_rsb=1" + +## Speculative Return Stack Overflow (SRSO): +## Mitigate the vulnerability by ensuring all RET instructions speculate to a controlled location. +## Currently affects AMD Zen 1-4 CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/srso.html +## +## The default kernel setting will be utilized until provided sufficient evidence to modify. +## Using "spec_rstack_overflow=ibpb" may provide superior protection to the default software-based approach. +## The use of hardware barriers may be more effective while possibly incurring a greater performance loss. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_rstack_overflow=safe-ret" + +## Gather Data Sampling (GDS): +## Mitigate the vulnerability either via microcode update or by disabling AVX. +## Note, without a suitable microcode update, this will entirely disable use of the AVX instructions set. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/gather_data_sampling.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX gather_data_sampling=force" + +## Register File Data Sampling (RFDS): +## Mitigate the vulnerability by appropriately clearing the CPU buffer. +## Currently affects Intel Atom CPUs (which encompasses E-cores on hybrid architectures). +## +## https://docs.kernel.org/admin-guide/hw-vuln/reg-file-data-sampling.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX reg_file_data_sampling=on" + +## Indirect Target Selection (ITS): +## Mitigate the vulnerability by not allowing indirect branches in the lower half of the cacheline. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/indirect-target-selection.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX indirect_target_selection=force" + +## VMScape: +## Mitigate the vulnerability by flushing branch predictors before returning to userspace when exiting guests. +## Comprehensive protection may also require disabling SMT to limit cross-thread attacks. +## Currently affects both AMD and Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/vmscape.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vmscape=force" diff --git a/etc/default/grub.d/40_distrust_bootloader.cfg b/etc/default/grub.d/40_distrust_bootloader.cfg deleted file mode 100644 index 36ce1838..00000000 --- a/etc/default/grub.d/40_distrust_bootloader.cfg +++ /dev/null @@ -1,7 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Distrusts the bootloader for initial entropy at boot. -## -## https://lkml.org/lkml/2022/6/5/271 -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_bootloader=off" diff --git a/etc/default/grub.d/40_distrust_cpu.cfg b/etc/default/grub.d/40_distrust_cpu.cfg deleted file mode 100644 index 107b7177..00000000 --- a/etc/default/grub.d/40_distrust_cpu.cfg +++ /dev/null @@ -1,12 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Distrusts the CPU for initial entropy at boot as it is not possible to -## audit, may contain weaknesses or a backdoor. -## -## https://en.wikipedia.org/wiki/RDRAND#Reception -## https://twitter.com/pid_eins/status/1149649806056280069 -## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html -## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566 -## https://lkml.org/lkml/2022/6/5/271 -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off" diff --git a/etc/default/grub.d/40_enable_iommu.cfg b/etc/default/grub.d/40_enable_iommu.cfg deleted file mode 100644 index 10a82fd0..00000000 --- a/etc/default/grub.d/40_enable_iommu.cfg +++ /dev/null @@ -1,17 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Enables IOMMU to prevent DMA attacks. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on amd_iommu=force_isolation" - -## Disable the busmaster bit on all PCI bridges during very -## early boot to avoid holes in IOMMU. -## -## https://mjg59.dreamwidth.org/54433.html -## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94 -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma" - -## Enables strict enforcement of IOMMU TLB invalidation so devices will never be able to access stale data contents -## https://github.com/torvalds/linux/blob/master/drivers/iommu/Kconfig#L97 -## Page 11 of https://lenovopress.lenovo.com/lp1467.pdf -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu=force iommu.passthrough=0 iommu.strict=1" diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg deleted file mode 100644 index be7c40c4..00000000 --- a/etc/default/grub.d/40_kernel_hardening.cfg +++ /dev/null @@ -1,64 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -kpkg="linux-image-$(dpkg --print-architecture)" || true -kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || true -#echo "## kver: $kver" - -## Disables the merging of slabs of similar sizes. -## Sometimes a slab can be used in a vulnerable way which an attacker can exploit. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" - -## Enables sanity checks (F) and redzoning (Z). -## Disabled due to kernel deciding to implicitly disable kernel pointer hashing -## https://github.com/torvalds/linux/commit/792702911f581f7793962fbeb99d5c3a1b28f4c3 -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ" - -## Zero memory at allocation and free time. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1" - -## Machine check exception handler decides whether the system should panic or not based on the exception that happened. -## https://forums.whonix.org/t/kernel-hardening/7296/494 -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0" - -## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on" - -## Vsyscalls are obsolete, are at fixed addresses and are a target for ROP. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none" - -## Enables page allocator freelist randomization. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1" - -## Enables randomisation of the kernel stack offset on syscall entries (introduced in kernel 5.13). -## https://lkml.org/lkml/2019/3/18/246 -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX randomize_kstack_offset=on" - -## Enables kernel lockdown. -## -## Disabled for now as it enforces module signature verification which breaks -## too many things. -## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880 -## -#if dpkg --compare-versions "${kver}" ge "5.4"; then -# GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality" -#fi - -## Gather more entropy during boot. -## -## Requires linux-hardened kernel patch. -## https://github.com/anthraxx/linux-hardened -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy" - -## Restrict access to debugfs since it can contain a lot of sensitive information. -## https://lkml.org/lkml/2020/7/16/122 -## https://github.com/torvalds/linux/blob/fb1201aececc59990b75ef59fca93ae4aa1e1444/Documentation/admin-guide/kernel-parameters.txt#L835-L848 -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off" - -## Force the kernel to panic on "oopses" (which may be due to false positives) -## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713 -## Implemented differently: -## /usr/libexec/security-misc/panic-on-oops -## /etc/profile.d/security-misc.sh -## /etc/sudoers.d/security-misc -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX oops=panic" diff --git a/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared b/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared new file mode 100644 index 00000000..ecbddc7a --- /dev/null +++ b/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared @@ -0,0 +1,437 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +kpkg="linux-image-$(dpkg --print-architecture)" || true +kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || true +#echo "## kver: $kver" + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## This configuration file is split into 4 sections: +## 1. Kernel Space +## 2. Direct Memory Access +## 3. Entropy +## 4. Networking + +## See the documentation below for details on the majority of the selected commands: +## https://docs.kernel.org/admin-guide/kernel-parameters.html +## https://wiki.archlinux.org/title/Kernel_parameters#GRUB + +## 1. Kernel Space: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#boot-parameters +## https://kspp.github.io/Recommended_Settings#kernel-command-line-options + +## Disable merging of slabs with similar size. +## Reduces the risk of triggering heap overflows. +## Prevents overwriting objects from merged caches and limits influencing slab cache layout. +## +## https://www.openwall.com/lists/kernel-hardening/2017/06/19/33 +## https://www.openwall.com/lists/kernel-hardening/2017/06/20/10 +## +## KSPP=yes +## KSPP sets the kernel parameter and does not set CONFIG_SLAB_MERGE_DEFAULT. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" + +## Enable sanity checks and red zoning of slabs via debugging options to detect memory corruption. +## Sanity checks force additional verification steps on every memory allocation and free operation. +## Red zoning adds extra metadata to each object to detect writes beyond the object's boundaries. +## As a by product of debugging, this will implicitly disabling kernel pointer hashing unless manually re-enabled. +## Enabling this (for now) will therefore leak exact and all kernel memory addresses to root. +## Introduces a noticeable performance overhead during all memory allocation and deallocation operations. +## +## https://docs.kernel.org/mm/slub.html +## https://www.kernel.org/doc/Documentation/vm/slub.txt +## https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u +## https://blogs.oracle.com/linux/post/linux-slub-allocator-internals-and-debugging-2 +## https://gitlab.tails.boum.org/tails/tails/-/issues/19613 +## https://github.com/Kicksecure/security-misc/issues/253 +## +## KSPP=partial +## KSPP sets the kernel parameters and CONFIG_SLUB_DEBUG. +## +## REMINDER: Debian forky / 14 +## The first parameter is applicable when using Linux kernel >= 6.17 (retained here for future-proofing and completeness). +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX hash_pointers=always" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ" + +## Zero memory at allocation time and free time. +## Fills newly allocated pages, freed pages, and heap objects with zeros. +## Mitigates use-after-free exploits by erasing sensitive information in memory. +## +## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6471384af2a6530696fc0203bafe4de41a23c9ef +## +## KSPP=yes +## KSPP sets the kernel parameters, CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y, and CONFIG_INIT_ON_FREE_DEFAULT_ON=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_free=1" + +## Enable the kernel page allocator to randomize free lists. +## During early boot, the page allocator has predictable FIFO behavior for physical pages. +## Limits some data exfiltration and ROP attacks that rely on inferring sensitive data location. +## Also improves performance by optimizing memory-side cache utilization. +## +## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e900a918b0984ec8f2eb150b8477a47b75d17692 +## https://en.wikipedia.org/wiki/Return-oriented_programming#Attacks +## +## KSPP=yes +## KSPP sets the kernel parameter and CONFIG_SHUFFLE_PAGE_ALLOCATOR=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1" + +## Enable randomization of the kernel stack offset on syscall entries. +## Hardens against memory corruption attacks due to increased entropy. +## Limits attacks relying on deterministic stack addresses or cross-syscall address exposure. +## +## https://lkml.org/lkml/2019/3/18/246 +## https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html +## +## KSPP=yes +## KSPP sets the kernel parameter and CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX randomize_kstack_offset=on" + +## Disable vsyscalls to reduce attack surface as they have been replaced by vDSO. +## Vulnerable to ROP attacks as vsyscalls are located at fixed addresses in memory. +## +## https://lwn.net/Articles/446528/ +## https://en.wikipedia.org/wiki/VDSO +## +## KSPP=yes +## KSPP sets the kernel parameter, CONFIG_LEGACY_VSYSCALL_NONE=y and does not set CONFIG_X86_VSYSCALL_EMULATION. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none" + +## Restrict access to debugfs by not registering the file system. +## Deactivated since the file system can contain sensitive information. +## +## https://lkml.org/lkml/2020/7/16/122 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off" + +## Force immediate system reboots on the occurrence of a single kernel panic. +## Increases resilience and limits impact of denial of service attacks as system automatically restarts. +## Ensures the system does not hang forever if a panic occurs, reducing susceptibility to both cold and warm boot attacks. +## Immediate rebooting also prevents persistent information disclosure on panic details that were dumped to screen. +## +## KSPP=yes +## KSPP sets CONFIG_PANIC_TIMEOUT=-1. +## +## See /usr/lib/sysctl.d/990-security-misc.conf for implementation. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic=-1" + +## Force the kernel to immediately panic on "oopses" and kernel warnings in the WARN() path. +## Panics may be due to false-positives such as bad drivers. +## Both allowed limits are set to one so that panics occur on the single first instance of either scenario. +## Oopses are serious but non-fatal errors. +## Certain "oopses" can sometimes indicate and thwart potential kernel exploitation attempts. +## Warnings are messages generated by the kernel to indicate unexpected conditions or errors. +## By default, code execution continues regardless of warnings emitted by macros like WARN() and WARN_ON(). +## Note that by forcing kernel panics on oopses and warnings, this exposes the system to targeted denial of service attacks. +## +## https://en.wikipedia.org/wiki/Kernel_panic#Linux +## https://en.wikipedia.org/wiki/Linux_kernel_oops +## https://lwn.net/Articles/876209/ +## https://git.sr.ht/~gregkh/presentation-security/tree/3fdaf81a2f8b2c8d64cdb2f529cc714624868aa8/item/security-stuff.pdf +## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713 +## +## KSPP=yes +## KSPP sets CONFIG_PANIC_ON_OOPS=y. +## +## Note that this must be used with panic=-1 for it to function as intended. +## +## See /usr/libexec/security-misc/panic-on-oops for implementation. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX oops=panic" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic_on_warn=1" + +## Force the kernel to immediately panic if it becomes tainted. +## Using kernel documentation, one can select a subset of taints to create a security policy. +## Requires summing the numbers for each taint state and then converting it to a hexadecimal bitmask. +## Some example combinations are shown below. +## S - Panic on using out of specification hardware: 4 = 0x4. +## B - On the above and bad page faults or some unexpected page flags: 36 = 0x24. +## A - On the above and ACPI tables are overridden by users: 292 = 0x124. +## I - On the above and severe firmware bugs: 2340 = 0x924. +## N - On the above and in-kernel tests have been run: 264484 = 0x40924. +## J - On the above and userspace has used a mutating debug operation in fwctl: 788772 = 0xC0924. +## G/P, O - On the above and the loading of proprietary or out-of-tree modules: 792869 = 0xC1925. +## All must first be tested to ensure there are no pre-existing issues on user hardware. +## After confirming stability this reduces attack surface. +## +## https://docs.kernel.org/admin-guide/tainted-kernels.html +## https://support.scc.suse.com/s/kb/Tainted-kernel-1583239310621?language=en_US +## https://lore.kernel.org/all/20200515175502.146720-1-aquini@redhat.com/T/ +## https://github.com/Kicksecure/security-misc/pull/339 +## +## Note that this must be used with panic=-1 for it to function as intended. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic_on_taint=0xC0924" + +## Prevent sensitive kernel information leaks in the console during boot. +## Must be used in combination with the kernel.printk sysctl. +## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation. +## +## https://docs.kernel.org/core-api/printk-basics.html +## https://wiki.archlinux.org/title/silent_boot +## +## See /etc/default/grub.d/41_quiet_boot.cfg for implementation. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX loglevel=0" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet" + +## Enable the kernel "Electric-Fence" sampling-based memory safety error detector. +## KFENCE detects heap out-of-bounds access, use-after-free, and invalid-free errors. +## Aims to have very low processing overhead at each sampling interval. +## Sampling interval is set to occur every 100 milliseconds as per KSPP recommendation. +## +## https://docs.kernel.org/dev-tools/kfence.html +## https://google.github.io/kernel-sanitizers/KFENCE.html +## https://blogs.oracle.com/linux/post/linux-slub-allocator-internals-and-debugging-4 +## https://lwn.net/Articles/835542/ +## +## KSPP=yes +## KSPP sets the kernel parameter, CONFIG_KFENCE=y, and CONFIG_KFENCE_SAMPLE_INTERVAL=100. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kfence.sample_interval=100" + +## Disable 32-bit Virtual Dynamic Shared Object (vDSO) mappings. +## Legacy compatibility feature for superseded glibc versions. +## +## https://lore.kernel.org/lkml/20080409082927.BD59E26F992@magilla.localdomain/T/ +## https://lists.openwall.net/linux-kernel/2014/03/11/3 +## +## KSPP=yes +## KSPP sets the kernel parameter and does not set CONFIG_COMPAT_VDSO. +## +## See /usr/lib/sysctl.d/990-security-misc.conf for another additional implementation. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0" + +## Switch (back) to using kCFI as the default Control Flow Integrity (CFI) implementation. +## The default implementation is FineIBT as of Linux kernel 6.2. +## The Intel-developed IBT (Indirect Branch Tracking) is only used if supported by the CPU. +## kCFI is software-only while FineIBT is a hybrid software/hardware implementation. +## FineIBT may result in some performance benefits as it only performs hash checks at the destinations. +## kCFI mandates hash validation at the source (which is randomized), making it more difficult to bypass. +## FineIBT is considered weaker against attacks that can write arbitrary executables into memory. +## +## https://lwn.net/Articles/891976/ +## https://lore.kernel.org/lkml/202210010918.4918F847C4@keescook/T/#u +## https://lore.kernel.org/lkml/202210182217.486CBA50@keescook/T/ +## https://lore.kernel.org/all/20221027092842.699804264@infradead.org/ +## https://lore.kernel.org/lkml/202407150933.E1871BE@keescook/ +## https://isopenbsdsecu.re/mitigations/forward_edge_cfi/ +## https://docs.kernel.org/next/x86/shstk.html +## https://source.android.com/docs/security/test/kcfi +## https://lpc.events/event/16/contributions/1315/attachments/1067/2169/cfi.pdf +## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/561 +## +## KSPP=yes +## KSPP sets the kernel parameter. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cfi=kcfi" + +## Disable support for all 32-bit x86 processes and syscalls. +## Unconditionally disables IA32 emulation to substantially reduce attack surface. +## +## https://lore.kernel.org/all/20230623111409.3047467-7-nik.borisov@suse.com/ +## +## KSPP=yes +## KSPP does not set CONFIG_COMPAT, CONFIG_IA32_EMULATION, CONFIG_X86_X32, CONFIG_X86_X32_ABI, and CONFIG_MODIFY_LDT_SYSCALL. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0" + +## Disable EFI persistent storage feature. +## Disable Error Record Serialization Table (ERST) support as a form of defense-in-depth. +## Prevents the kernel from writing crash logs and other persistent data to the storage backend. +## Both the UEFI variable storage and ACPI ERST backends are deactivated. +## +## https://blogs.oracle.com/linux/post/pstore-linux-kernel-persistent-storage-file-system +## https://www.ais.com/understanding-pstore-linux-kernel-persistent-storage-file-system/ +## https://lwn.net/Articles/434821/ +## https://manpages.debian.org/testing/systemd/systemd-pstore.service.8.en.html +## https://gitlab.tails.boum.org/tails/tails/-/issues/20813 +## https://github.com/Kicksecure/security-misc/issues/299 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable" + +## Restrict processes from modifying their own memory mappings. +## Prevents using /proc/PID/mem to write to protected pages unless via ptrace() for debugging. +## Increases the difficulty in tricking applications into overwriting their own memory. +## Limit self-modification which can be used trigger existing vulnerabilities. +## +## https://lore.kernel.org/lkml/20240712-vfs-procfs-ce7e6c7cf26b@brauner/ +## https://lwn.net/Articles/983169/ +## https://github.com/a13xp0p0v/kernel-hardening-checker/pull/201 +## https://github.com/Kicksecure/security-misc/issues/330 +## +## KSPP=partial +## KSPP sets the stricter kernel parameter "proc_mem.force_override=never". +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX proc_mem.force_override=ptrace" + +## Prevent processes from writing to block devices that are mounted by filesystems. +## Enhances system stability and security by protecting against runaway privileged processes. +## Allowing processes to write to the buffer cache can cause filesystem corruption and kernel crashes. +## Does not prevent data modifications using direct SCSI commands or lower-level storage stack access. +## May lead to breakages in certain limited scenarios. +## +## https://github.com/torvalds/linux/commit/ed5cc702d311c14b653323d76062b0294effa66e +## https://lore.kernel.org/lkml/20240105-vfs-super-4092d802972c@brauner/ +## https://github.com/a13xp0p0v/kernel-hardening-checker/issues/186 +## +## https://github.com/Kicksecure/security-misc/pull/334 +## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/609 +## https://forums.whonix.org/t/how-to-compress-and-prevent-vdi-from-ballooning-after-each-update-deleting-large-files/22675/9 +## https://forums.kicksecure.com/t/resizing-disk-for-guest-in-kvm/1657 +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX bdev_allow_write_mounted=0" + +## Enable AMD Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV). +## SME encrypts memory with a single key at the kernel level to protect against cold boot attacks. +## SEV extends SME to VMs by encrypting the memory of each with a unique key for guest isolation. +## SEV-ES (Encrypted State) extends SEV by encrypting each guests virtual CPU register state during VM exits. +## SEV-SNP (Secure Nested Paging) extends SEV by activating hardware-level memory integrity. +## This is hardware-based encryption managed by the proprietary and closed-source AMD Platform Security Processor (PSP). +## Both require a compatible AMD CPU and support for SME to first be enabled in the BIOS/UEFI. +## Likely unavailable in consumer-grade AMD CPUs where Transparent SME (TSME) can be enabled in the BIOS/UEFI to achieve SME. +## Note the corresponding Intel Total Memory Encryption (TME) can also be enabled via the BIOS/UEFI. +## May cause boot failure on certain hardware with incompatible DMA masks especially if IOMMU is disabled. +## +## https://www.kernel.org/doc/html/next/x86/amd-memory-encryption.html +## https://docs.kernel.org/virt/kvm/x86/amd-memory-encryption.html +## https://docs.amd.com/v/u/en-US/memory-encryption-white-paper +## https://docs.amd.com/v/u/en-US/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more +## https://github.com/AMDESE/AMDSEV +## https://en.wikichip.org/wiki/x86/sme +## https://lore.kernel.org/all/YWRgN63FOrQGO8jS@zn.tnic/ +## https://lore.kernel.org/lkml/YWvy9bSRaC+m1sV+@zn.tnic/T/#m01bcb37040b6b0d119d385d9a34b9c7ac4ce5f84 +## https://mricher.fr/post/amd-memory-encryption/ +## https://www.kicksecure.com/wiki/Dev/confidential_computing#AMD +## https://github.com/secureblue/secureblue/pull/1631#issuecomment-3655501478 +## https://forums.whonix.org/t/enable-secure-memory-encryption-sme-kernel-parameter-mem-encrypt-by-default/10393 +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mem_encrypt=on" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev=1" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_es=1" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_snp=1" + +## 2. Direct Memory Access: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks + +## Enable CPU manufacturer-specific IOMMU drivers to mitigate some DMA attacks. +## +## KSPP=yes +## KSPP sets CONFIG_INTEL_IOMMU=y, CONFIG_INTEL_IOMMU_DEFAULT_ON=y, CONFIG_INTEL_IOMMU_SVM=y, CONFIG_AMD_IOMMU=y, and CONFIG_AMD_IOMMU_V2=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX amd_iommu=force_isolation" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on" + +## Enable and force use of IOMMU translation to protect against some DMA attacks. +## Strictly force DMA unmap operations to synchronously invalidate IOMMU hardware TLBs. +## Ensures devices will never be able to access stale data contents. +## +## https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit +## https://en.wikipedia.org/wiki/DMA_attack +## https://lenovopress.lenovo.com/lp1467.pdf +## https://www.kb.cert.org/vuls/id/382314 +## +## KSPP=yes +## KSPP sets the kernel parameters, CONFIG_IOMMU_SUPPORT=y, CONFIG_IOMMU_DEFAULT_DMA_STRICT=y, and does not set CONFIG_IOMMU_DEFAULT_PASSTHROUGH. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu=force" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu.passthrough=0" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu.strict=1" + +## Clear the busmaster bit on all PCI bridges during the EFI hand-off. +## Terminates all existing DMA transactions prior to the kernel's IOMMU setup. +## Forces third party PCI devices to then re-set their busmaster bit in order to perform DMA. +## Assumes that the motherboard chipset and firmware are not malicious. +## May cause complete boot failure on certain hardware with incompatible firmware. +## +## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94 +## https://mjg59.dreamwidth.org/54433.html +## +## KSPP=yes +## KSPP sets CONFIG_EFI_DISABLE_PCI_DMA=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma" + +## 3. Entropy: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#rdrand + +## Do not credit the CPU seeds as an entropy sources at boot. +## The RDRAND and RDSEED CPU (RNG) instructions are proprietary and closed-source. +## Numerous implementations of RDRAND and RDSEED have a long history of being defective. +## Maximizing the entropy pool at boot is desirable for all cryptographic operations. +## This ensures additional entropy is obtained from other sources to initialize the Linux CRNG. +## Note that distrusting this (relatively fast) source of entropy will increase boot time. +## +## https://en.wikipedia.org/wiki/RDRAND +## https://systemd.io/RANDOM_SEEDS/ +## https://www.kicksecure.com/wiki/Dev/Entropy#RDRAND +## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html +## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566 +## https://lkml.org/lkml/2022/6/5/271 +## https://lwn.net/Articles/961121/ +## https://lore.kernel.org/lkml/aPFDn-4Cm6n0_3_e@gourry-fedora-PF4VCD3F/ +## https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7055.html +## +## KSPP=yes +## KSPP sets CONFIG_RANDOM_TRUST_CPU=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off" + +## Do not credit the bootloader seeds as an entropy source at boot. +## The RNG seed passed by the bootloader could potentially be tampered. +## Maximizing the entropy pool at boot is desirable for all cryptographic operations. +## This ensures additional entropy is obtained from other sources to initialize the Linux CRNG. +## Note that distrusting this (relatively fast) source of entropy will increase boot time. +## +## https://systemd.io/RANDOM_SEEDS/ +## https://github.com/NixOS/nixpkgs/pull/165355 +## https://lkml.org/lkml/2022/6/5/271 +## +## KSPP=yes +## KSPP sets CONFIG_RANDOM_TRUST_BOOTLOADER=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_bootloader=off" + +## Obtain more entropy during boot as the runtime memory allocator is being initialized. +## Entropy will be extracted from up to the first 4GB of RAM as another source. +## Note that entropy extracted this way is not cryptographically secure and so is not credited. +## Maximizing the entropy pool at boot is desirable for all cryptographic operations. +## This will increase boot time due to interrupting the boot process. +## Requires the linux-hardened kernel patch. +## +## https://www.kicksecure.com/wiki/Hardened-kernel#linux-hardened +## https://github.com/anthraxx/linux-hardened/commit/c3e7df1dba1eb8105d6d5143079a6a0ad9e9ebc7 +## https://github.com/anthraxx/linux-hardened/commit/a04458f97fe1f7e95888c77c0165b646375db9c4 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy" + +## 4. Networking +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-boot-parameters + +## Disable the entire IPv6 stack functionality. +## Removes attack surface associated with the IPv6 module. +## +## https://docs.kernel.org/networking/ipv6.html +## https://wiki.archlinux.org/title/IPv6#Disable_IPv6 +## +## Enabling makes redundant many network hardening sysctl's in /usr/lib/sysctl.d/990-security-misc.conf. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ipv6.disable=1" diff --git a/etc/default/grub.d/40_only_allow_signed_modules.cfg b/etc/default/grub.d/40_only_allow_signed_modules.cfg deleted file mode 100644 index 5d1a3572..00000000 --- a/etc/default/grub.d/40_only_allow_signed_modules.cfg +++ /dev/null @@ -1,8 +0,0 @@ -## Requires every module to be signed before being loaded. -## Any module that is unsigned or signed with an invalid key cannot be loaded. -## This makes it harder to load a malicious module. -## -## Not enabled by default yet due to issues: -## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/61 -## https://github.com/dell/dkms/issues/359 -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX module.sig_enforce=1" diff --git a/etc/default/grub.d/40_remmount-secure.cfg b/etc/default/grub.d/40_remmount-secure.cfg deleted file mode 100644 index 845ca461..00000000 --- a/etc/default/grub.d/40_remmount-secure.cfg +++ /dev/null @@ -1,16 +0,0 @@ -## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://www.kicksecure.com/wiki/Security-misc#Remount_Secure - -## Disable Remount Secure. -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=0" - -## Re-mount with nodev, nosuid only. -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1" - -## Re-mount with nodev, nosuid and most with noexec except for /home. -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=2" - -## Re-mount with nodev, nosuid and all with noexec including /home. -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=3" diff --git a/etc/default/grub.d/40_remount_secure.cfg#security-misc-shared b/etc/default/grub.d/40_remount_secure.cfg#security-misc-shared new file mode 100644 index 00000000..c3cc30a7 --- /dev/null +++ b/etc/default/grub.d/40_remount_secure.cfg#security-misc-shared @@ -0,0 +1,31 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Remount Secure provides enhanced security via mount options: +## https://www.kicksecure.com/wiki/Security-misc#Remount_Secure + +## Option A (No Security): +## Disable Remount Secure. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=0" + +## Option B (Low Security): +## Re-mount with nodev and nosuid only. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1" + +## Option C (Medium Security): +## Re-mount with nodev, nosuid, and noexec for most mount points, excluding /home. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=2" + +## Option D (Highest Security): +## Re-mount with nodev, nosuid, and noexec for all mount points including /home. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=3" diff --git a/etc/default/grub.d/40_signed_modules.cfg#security-misc-shared b/etc/default/grub.d/40_signed_modules.cfg#security-misc-shared new file mode 100644 index 00000000..36af7f33 --- /dev/null +++ b/etc/default/grub.d/40_signed_modules.cfg#security-misc-shared @@ -0,0 +1,37 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Require every kernel module to be signed before being loaded. +## Any module that is unsigned or signed with an invalid key cannot be loaded. +## This prevents all out-of-tree kernel modules unless signed. +## This makes it harder to load a malicious module. +## +## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/61 +## https://github.com/dell/dkms/issues/359 +## +## KSPP=yes +## KSPP sets CONFIG_MODULE_SIG=y, CONFIG_MODULE_SIG_FORCE=y, and CONFIG_MODULE_SIG_ALL=y. +## +## Not enabled by default yet due to several issues. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX module.sig_enforce=1" + +## Enable kernel lockdown to enforce security boundary between user and kernel space. +## Confidentiality mode enforces module signature verification. +## +## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880 +## +## KSPP=yes +## KSPP sets CONFIG_SECURITY_LOCKDOWN_LSM=y, CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y, and CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y. +## +## Not enabled by default yet due to several issues. +## +#if dpkg --compare-versions "${kver}" ge "5.4"; then +# GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality" +#fi diff --git a/etc/default/grub.d/41_quiet.cfg b/etc/default/grub.d/41_quiet.cfg deleted file mode 100644 index b8630299..00000000 --- a/etc/default/grub.d/41_quiet.cfg +++ /dev/null @@ -1,27 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Prevent kernel info leaks in console during boot. -## https://phabricator.whonix.org/T950 - -## LANG=C str_replace is provided by package helper-scripts. - -## The following command actually removed "quiet" from the kernel command line. -## If verbosity is desired, the user might want to keep this line. -## Remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT because "quiet" must be first. -GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | LANG=C str_replace "quiet" "")" - -## If verbosity is desired, the user might want to out-comment the following line. -GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT quiet loglevel=0" - -## NOTE: -## After editing this file, running: -## sudo update-grub -## is required. -## -## If higher verbosity is desired, the user might also want to delete file -## /etc/sysctl.d/30_silent-kernel-printk.conf -## (or out-comment its settings). -## -## Alternatively, the user could consider to install the debug-misc package, -## which will undo the settings found here. diff --git a/etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared b/etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared new file mode 100644 index 00000000..21b73f5b --- /dev/null +++ b/etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared @@ -0,0 +1,35 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Some default configuration files automatically include the "quiet" parameter. +## Therefore, first remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT since "quiet" must be first. +## str_replace is provided by package helper-scripts. +## +## https://github.com/Kicksecure/security-misc/pull/233#issuecomment-2228792461 +## +GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | str_replace "quiet" "")" + +## Prevent sensitive kernel information leaks in the console during boot. +## Must be used in combination with the kernel.printk sysctl. +## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation. +## +## https://docs.kernel.org/core-api/printk-basics.html +## https://wiki.archlinux.org/title/silent_boot +## +## For easier debugging, these are not applied to the recovery boot option. +## Switch the pair of commands to universally apply parameters to all boot options. +## +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT loglevel=0" +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT quiet" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX loglevel=0" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet" + +## For Increased Log Verbosity: +## Adjust (or comment out) the kernel.printk sysctl in /usr/lib/sysctl.d/30_silent-kernel-printk.conf. +## Alternatively, installing the debug-misc package will undo these settings. diff --git a/etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared b/etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared new file mode 100644 index 00000000..5da19e7e --- /dev/null +++ b/etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Disable access to the GRUB single-user (recovery) mode menu entries. +## +## https://forums.kicksecure.com/t/remove-linux-recovery-mode-boot-option-from-default-grub-boot-menu/727 +## +GRUB_DISABLE_RECOVERY="true" + +## Disable access to Dracut's recovery console. +## Prevents the emergency shell from starting automatically during boot failures. +## +## https://insinuator.net/2025/07/insecure-boot-injecting-initramfs-from-a-debug-shell/ +## https://serverfault.com/questions/554853/how-can-i-secure-the-dracut-shell +## https://forums.kicksecure.com/t/harden-dracut-initramfs-generator-by-disabling-recovery-console/724 +## +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.emergency=halt" +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.shell=0" diff --git a/etc/dkms/framework.conf.d/30_security-misc.conf b/etc/dkms/framework.conf.d/30_security-misc.conf deleted file mode 100644 index f9a643de..00000000 --- a/etc/dkms/framework.conf.d/30_security-misc.conf +++ /dev/null @@ -1,64 +0,0 @@ -## This configuration file modifies the behavior of -## DKMS (Dynamic Kernel Module Support) and is sourced -## in by DKMS every time it is run. - -## Source Tree Location (default: /usr/src) -# source_tree="/usr/src" - -## DKMS Tree Location (default: /var/lib/dkms) -# dkms_tree="/var/lib/dkms" - -## Install Tree Location (default: /lib/modules) -# install_tree="/lib/modules" - -## tmp Location (default: /tmp) -# tmp_location="/tmp" - -## verbosity setting (verbose will be active if you set it to a non-null value) -# verbose="" - -## symlink kernel modules (will be active if you set it to a non-null value) -## This creates symlinks from the install_tree into the dkms_tree instead of -## copying the modules. This preserves some space on the costs of being less -## safe. -# symlink_modules="" - -## Automatic installation and upgrade for all installed kernels (if set to a -## non-null value) -# autoinstall_all_kernels="" - -## Script to sign modules during build, script is called with kernel version -## and module name -# sign_tool="/etc/dkms/sign_helper.sh" - -### BEGIN modifications by package security-misc ### - -## original: -## https://github.com/dell/dkms/blob/master/dkms_framework.conf - -## DKMS feature request: -## add /etc/dkms/framework.conf.d configuration file drop-in folder -## https://github.com/dell/dkms/issues/116 - -## Lower parallel compilation jobs to 1 if less than 2 GB RAM to avoid freezing -## of virtual machines. -## -## This does not necessarily belong into security-misc, however likely -## security-misc will need to modify /etc/dkms/framework.conf in the future to -## enable kernel module signing. See below. -## -## https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/26 -ENOUGH_RAM="1950" -total_ram="$(free -m | sed -n -e '/^Mem:/s/^[^0-9]*\([0-9]*\) .*/\1/p')" -if [ "$total_ram" -ge "$ENOUGH_RAM" ]; then - true "INFO: Enough RAM available. Not lowering compilation cores." -else - true "INFO: Not enough RAM available. Lowering compilation cores to 1." - parallel_jobs=1 -fi - -## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 -## https://github.com/dell/dkms/blob/master/sign_helper.sh -#sign_tool="/etc/dkms/sign_helper.sh" - -### END modifications by package security-misc ### diff --git a/etc/dracut.conf.d/30-security-misc.conf b/etc/dracut.conf.d/30-security-misc.conf deleted file mode 100644 index 90c76984..00000000 --- a/etc/dracut.conf.d/30-security-misc.conf +++ /dev/null @@ -1,4 +0,0 @@ -reproducible=yes - -## Debugging. -#show_modules=yes diff --git a/etc/dracut.conf.d/30-security-misc.conf#security-misc-shared b/etc/dracut.conf.d/30-security-misc.conf#security-misc-shared new file mode 100644 index 00000000..5b3c7b5a --- /dev/null +++ b/etc/dracut.conf.d/30-security-misc.conf#security-misc-shared @@ -0,0 +1,7 @@ +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +reproducible=yes + +## Debugging. +#show_modules=yes diff --git a/etc/gitconfig#security-misc-shared b/etc/gitconfig#security-misc-shared new file mode 100644 index 00000000..c7a8c5d8 --- /dev/null +++ b/etc/gitconfig#security-misc-shared @@ -0,0 +1,40 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Lines starting with a hash symbol ('#') are comments. +## https://github.com/Kicksecure/security-misc/issues/225 + +[core] + ## https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm + symlinks = false + + #hooksPath = /home/user/.config/git/hooks + +## https://forums.whonix.org/t/git-users-enable-fsck-by-default-for-better-security/2066 +[transfer] + fsckobjects = true +[fetch] + fsckobjects = true +[receive] + fsckobjects = true + +## Generally a good idea but too intrusive to enable by default. +## Listed here as suggestions what users should put into their ~/.gitconfig +## file. + +## Not enabled by default because it requires essential knowledge about OpenPGP +## and an already existing local signing key. Otherwise would prevent all new +## commits. +#[commit] +# gpgsign = true + +## Not enabled by default because it would break the 'git merge' command for +## unsigned commits and require the '--no-verify-signature' command line +## option. +#[merge] +# verifySignatures = true + +## Not enabled by default because it would break for users who are not having +## an account at the git server and having added a SSH public key. +#[url "ssh://git@github.com/"] +# insteadOf = https://github.com/ diff --git a/etc/hide-hardware-info.d/30_default.conf b/etc/hide-hardware-info.d/30_default.conf#security-misc-shared similarity index 54% rename from etc/hide-hardware-info.d/30_default.conf rename to etc/hide-hardware-info.d/30_default.conf#security-misc-shared index df6952e8..d1bc221c 100644 --- a/etc/hide-hardware-info.d/30_default.conf +++ b/etc/hide-hardware-info.d/30_default.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Disable the /sys whitelist. @@ -7,6 +7,9 @@ ## Disable the /proc/cpuinfo whitelist. #cpuinfo_whitelist=0 +## Disable /sys hardening. +#sysfs=0 + ## Disable selinux mode. -## https://www.whonix.org/wiki/Security-misc#selinux +## https://www.kicksecure.com/wiki/Security-misc#selinux #selinux=0 diff --git a/etc/initramfs-tools/hooks/sysctl-initramfs b/etc/initramfs-tools/hooks/sysctl-initramfs deleted file mode 100755 index 1a80c8f3..00000000 --- a/etc/initramfs-tools/hooks/sysctl-initramfs +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh - -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -PREREQ="" -prereqs() -{ - echo "$PREREQ" -} -case $1 in -prereqs) - prereqs - exit 0 - ;; -esac - -. /usr/share/initramfs-tools/hook-functions -copy_exec /usr/sbin/sysctl /usr/sbin diff --git a/etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs b/etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs deleted file mode 100755 index d932fc11..00000000 --- a/etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh - -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -PREREQ="" -prereqs() -{ - echo "$PREREQ" -} -case $1 in -prereqs) - prereqs - exit 0 - ;; -esac - -## Write to '/run/initramfs' folder. -## https://forums.whonix.org/t/kernel-hardening/7296/435 - -sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null 2> "/run/initramfs/sysctl-initramfs-error.log" -sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null 2>> "/run/initramfs/sysctl-initramfs-error.log" - -grep -v "unprivileged_userfaultfd" "/run/initramfs/sysctl-initramfs-error.log" - -true diff --git a/etc/kernel/postinst.d/30_remove-system-map b/etc/kernel/postinst.d/30_remove-system-map deleted file mode 100755 index 14ac9b60..00000000 --- a/etc/kernel/postinst.d/30_remove-system-map +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if test -x /usr/libexec/security-misc/remove-system.map ; then - /usr/libexec/security-misc/remove-system.map -fi diff --git a/etc/kernel/postinst.d/30_remove-system-map#security-misc-shared b/etc/kernel/postinst.d/30_remove-system-map#security-misc-shared new file mode 100755 index 00000000..e2d1228d --- /dev/null +++ b/etc/kernel/postinst.d/30_remove-system-map#security-misc-shared @@ -0,0 +1,15 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +if test -x /usr/libexec/security-misc/remove-system.map ; then + /usr/libexec/security-misc/remove-system.map +fi diff --git a/etc/modprobe.d/30_security-misc.conf b/etc/modprobe.d/30_security-misc.conf deleted file mode 100644 index 24ee928d..00000000 --- a/etc/modprobe.d/30_security-misc.conf +++ /dev/null @@ -1,149 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## See the following links for a community discussion and overview regarding the selections -## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989 -## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules - -## Disable automatic conntrack helper assignment -## https://phabricator.whonix.org/T486 -options nf_conntrack nf_conntrack_helper=0 - -## Disable bluetooth to reduce attack surface due to extended history of security vulnerabilities -## https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns -# -## Now replaced by a privacy and security preserving default bluetooth configuration for better usability -# -# install bluetooth /usr/bin/disabled-bluetooth-by-security-misc -# install btusb /usr/bin/disabled-bluetooth-by-security-misc - -## Disable thunderbolt and firewire modules to prevent some DMA attacks -install thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc -install firewire-core /usr/bin/disabled-firewire-by-security-misc -install firewire_core /usr/bin/disabled-firewire-by-security-misc -install firewire-ohci /usr/bin/disabled-firewire-by-security-misc -install firewire_ohci /usr/bin/disabled-firewire-by-security-misc -install firewire_sbp2 /usr/bin/disabled-firewire-by-security-misc -install firewire-sbp2 /usr/bin/disabled-firewire-by-security-misc -install ohci1394 /usr/bin/disabled-firewire-by-security-misc -install sbp2 /usr/bin/disabled-firewire-by-security-misc -install dv1394 /usr/bin/disabled-firewire-by-security-misc -install raw1394 /usr/bin/disabled-firewire-by-security-misc -install video1394 /usr/bin/disabled-firewire-by-security-misc - -## Disable CPU MSRs as they can be abused to write to arbitrary memory. -## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode -install msr /usr/bin/disabled-msr-by-security-misc - -## Disables unneeded network protocols that will likely not be used as these may have unknown vulnerabilties. -## Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these. -## > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users. -## > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record. -install dccp /usr/bin/disabled-network-by-security-misc -install sctp /usr/bin/disabled-network-by-security-misc -install rds /usr/bin/disabled-network-by-security-misc -install tipc /usr/bin/disabled-network-by-security-misc -install n-hdlc /usr/bin/disabled-network-by-security-misc -install ax25 /usr/bin/disabled-network-by-security-misc -install netrom /usr/bin/disabled-network-by-security-misc -install x25 /usr/bin/disabled-network-by-security-misc -install rose /usr/bin/disabled-network-by-security-misc -install decnet /usr/bin/disabled-network-by-security-misc -install econet /usr/bin/disabled-network-by-security-misc -install af_802154 /usr/bin/disabled-network-by-security-misc -install ipx /usr/bin/disabled-network-by-security-misc -install appletalk /usr/bin/disabled-network-by-security-misc -install psnap /usr/bin/disabled-network-by-security-misc -install p8023 /usr/bin/disabled-network-by-security-misc -install p8022 /usr/bin/disabled-network-by-security-misc -install can /usr/bin/disabled-network-by-security-misc -install atm /usr/bin/disabled-network-by-security-misc - -## Disable uncommon file systems to reduce attack surface -## HFS and HFS+ are legacy Apple filesystems that may be required depending on the EFI parition format -install cramfs /usr/bin/disabled-filesys-by-security-misc -install freevxfs /usr/bin/disabled-filesys-by-security-misc -install jffs2 /usr/bin/disabled-filesys-by-security-misc -install hfs /usr/bin/disabled-filesys-by-security-misc -install hfsplus /usr/bin/disabled-filesys-by-security-misc -install udf /usr/bin/disabled-filesys-by-security-misc - -## Disable uncommon network file systems to reduce attack surface -install cifs /usr/bin/disabled-netfilesys-by-security-misc -install nfs /usr/bin/disabled-netfilesys-by-security-misc -install nfsv3 /usr/bin/disabled-netfilesys-by-security-misc -install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc -install ksmbd /usr/bin/disabled-netfilesys-by-security-misc -install gfs2 /usr/bin/disabled-netfilesys-by-security-misc - -## Disables the vivid kernel module as it's only required for testing and has been the cause of multiple vulnerabilities -## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233 -## https://www.openwall.com/lists/oss-security/2019/11/02/1 -## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 -install vivid /usr/bin/disabled-vivid-by-security-misc - -## Disable Intel Management Engine (ME) interface with the OS -## https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html -install mei /usr/bin/disabled-intelme-by-security-misc -install mei-me /usr/bin/disabled-intelme-by-security-misc - -## Blacklist automatic loading of the Atheros 5K RF MACs madwifi driver -## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-ath_pci.conf?h=ubuntu/disco -blacklist ath_pci - -## Blacklist automatic loading of miscellaneous modules -## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco -blacklist evbug -blacklist usbmouse -blacklist usbkbd -blacklist eepro100 -blacklist de4x5 -blacklist eth1394 -blacklist snd_intel8x0m -blacklist snd_aw2 -blacklist prism54 -blacklist bcm43xx -blacklist garmin_gps -blacklist asus_acpi -blacklist snd_pcsp -blacklist pcspkr -blacklist amd76x_edac - -## Blacklist automatic loading of framebuffer drivers -## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco -blacklist aty128fb -blacklist atyfb -blacklist radeonfb -blacklist cirrusfb -blacklist cyber2000fb -blacklist cyblafb -blacklist gx1fb -blacklist hgafb -blacklist i810fb -blacklist intelfb -blacklist kyrofb -blacklist lxfb -blacklist matroxfb_bases -blacklist neofb -blacklist nvidiafb -blacklist pm2fb -blacklist rivafb -blacklist s1d13xxxfb -blacklist savagefb -blacklist sisfb -blacklist sstfb -blacklist tdfxfb -blacklist tridentfb -blacklist vesafb -blacklist vfb -blacklist viafb -blacklist vt8623fb -blacklist udlfb - -## Disable CD-ROM devices -## https://nvd.nist.gov/vuln/detail/CVE-2018-11506 -## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31 -#install cdrom /usr/bin/disabled-cdrom-by-security-misc -#install sr_mod /usr/bin/disabled-cdrom-by-security-misc -blacklist cdrom -blacklist sr_mod diff --git a/etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared b/etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared new file mode 100644 index 00000000..f3bd87bf --- /dev/null +++ b/etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared @@ -0,0 +1,59 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## See the following links for a community discussion and overview regarding the selections. +## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989 +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules + +## Blacklisting prevents kernel modules from automatically starting. +## Disabling prohibits kernel modules from starting. + +## CD-ROM/DVD: +## Blacklist CD-ROM and DVD modules. +## Not disabled by default due to potential future ISO plans. +## Can uncomment the bottom pair to disable both modules. +## +## https://nvd.nist.gov/vuln/detail/CVE-2018-11506 +## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31 +## +blacklist cdrom +blacklist sr_mod +#install cdrom /usr/bin/disabled-cdrom-by-security-misc +#install sr_mod /usr/bin/disabled-cdrom-by-security-misc + +## Miscellaneous: + +## GrapheneOS: +## Partial selection of their infrastructure blacklist. +## Duplicate and already disabled modules have been omitted. +## Currently snd_intel8x0 is required by some users for VirtualBox audio device ICH AC97. +## +## https://github.com/GrapheneOS/infrastructure/tree/main/etc/modprobe.d +## https://www.kicksecure.com/wiki/Dev/audio +## https://github.com/Kicksecure/security-misc/issues/271 +## +#blacklist cfg80211 +#blacklist intel_agp +#blacklist ip_tables +#blacklist mousedev +#blacklist psmouse +#blacklist snd_intel8x0 +#blacklist tls +#blacklist virtio_balloon +#blacklist virtio_console + +## Ubuntu: +## Already disabled modules have been omitted. +## +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-ath_pci.conf?h=ubuntu/disco +## +blacklist amd76x_edac +blacklist ath_pci +blacklist evbug +blacklist pcspkr +blacklist snd_aw2 +blacklist snd_intel8x0m +blacklist snd_pcsp +blacklist usbkbd +blacklist usbmouse diff --git a/etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared b/etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared new file mode 100644 index 00000000..7c51595e --- /dev/null +++ b/etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared @@ -0,0 +1,13 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Conntrack: +## Disable Netfilter's automatic connection tracking helper assignment. +## This functionality adds unnecessary features, such as IRC protocol parsing, into the kernel. +## Disabling it reduces the kernel attack surface and improves security. +## +## https://conntrack-tools.netfilter.org/manual.html +## https://home.regit.org/netfilter-en/secure-use-of-helpers/ +## https://forums.whonix.org/t/disable-conntrack-helper/18917 +## +options nf_conntrack nf_conntrack_helper=0 diff --git a/etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared b/etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared new file mode 100644 index 00000000..4396c473 --- /dev/null +++ b/etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared @@ -0,0 +1,356 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## See the following links for a community discussion and overview regarding the selections: +## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989 +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules + +## Blacklisting prevents kernel modules from automatically starting. +## Disabling prohibits kernel modules from starting. + +## This configuration file is split into 4 sections: +## 1. Hardware +## 2. File Systems +## 3. Networking +## 4. Miscellaneous + +## 1. Hardware: + +## Bluetooth: +## Disable Bluetooth to reduce the attack surface due to its long history of security vulnerabilities. +## Replaced with a privacy and security preserving default Bluetooth configuration for better usability. +## +## https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns +## https://github.com/Kicksecure/security-misc/pull/145 +## +#install bluetooth /usr/bin/disabled-bluetooth-by-security-misc +#install bluetooth_6lowpan /usr/bin/disabled-bluetooth-by-security-misc +#install bt3c_cs /usr/bin/disabled-bluetooth-by-security-misc +#install btbcm /usr/bin/disabled-bluetooth-by-security-misc +#install btintel /usr/bin/disabled-bluetooth-by-security-misc +#install btmrvl /usr/bin/disabled-bluetooth-by-security-misc +#install btmrvl_sdio /usr/bin/disabled-bluetooth-by-security-misc +#install btmtk /usr/bin/disabled-bluetooth-by-security-misc +#install btmtksdio /usr/bin/disabled-bluetooth-by-security-misc +#install btmtkuart /usr/bin/disabled-bluetooth-by-security-misc +#install btnxpuart /usr/bin/disabled-bluetooth-by-security-misc +#install btqca /usr/bin/disabled-bluetooth-by-security-misc +#install btrsi /usr/bin/disabled-bluetooth-by-security-misc +#install btrtl /usr/bin/disabled-bluetooth-by-security-misc +#install btsdio /usr/bin/disabled-bluetooth-by-security-misc +#install btusb /usr/bin/disabled-bluetooth-by-security-misc +#install virtio_bt /usr/bin/disabled-bluetooth-by-security-misc + +## CPU Model-Specific Registers (MSRs): +## User-level read access to MSRs can allow malicious unprivileged applications to access other trust domains. +## MSRs can also be abused to write to arbitrary memory. +## +## https://en.wikipedia.org/wiki/Model-specific_register +## https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/running-average-power-limit-energy-reporting.html +## https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/reading-writing-msrs-in-linux.html +## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode +## https://github.com/Kicksecure/security-misc/issues/215 +## +#install intel_rapl_msr /usr/bin/disabled-cpumsr-by-security-misc +#install isst_if_mbox_msr /usr/bin/disabled-cpumsr-by-security-misc +#install msr /usr/bin/disabled-cpumsr-by-security-misc + +## FireWire (IEEE 1394): +## Disable IEEE 1394 (FireWire/i.LINK/Lynx) modules to prevent certain DMA attacks. +## +## https://en.wikipedia.org/wiki/IEEE_1394#Security_issues +## +install dv1394 /usr/bin/disabled-firewire-by-security-misc +install firewire-core /usr/bin/disabled-firewire-by-security-misc +install firewire-ohci /usr/bin/disabled-firewire-by-security-misc +install firewire-net /usr/bin/disabled-firewire-by-security-misc +install firewire-sbp2 /usr/bin/disabled-firewire-by-security-misc +install ohci1394 /usr/bin/disabled-firewire-by-security-misc +install raw1394 /usr/bin/disabled-firewire-by-security-misc +install sbp2 /usr/bin/disabled-firewire-by-security-misc +install video1394 /usr/bin/disabled-firewire-by-security-misc + +## Global Positioning Systems (GPS): +## Disable GPS-related modules like GNSS (Global Navigation Satellite System). +## +install garmin_gps /usr/bin/disabled-gps-by-security-misc +install gnss /usr/bin/disabled-gps-by-security-misc +install gnss-mtk /usr/bin/disabled-gps-by-security-misc +install gnss-serial /usr/bin/disabled-gps-by-security-misc +install gnss-sirf /usr/bin/disabled-gps-by-security-misc +install gnss-ubx /usr/bin/disabled-gps-by-security-misc +install gnss-usb /usr/bin/disabled-gps-by-security-misc + +## Intel Management Engine (ME): +## Partially disable the Intel ME interface with the OS. +## ME functionality has increasingly become intertwined with basic Intel system operation. +## Disabling it may lead to breakages in various components without clear debugging/error messages. +## It may affect firmware updates, security, power management, display, and DRM. +## +## https://docs.kernel.org/driver-api/mei/mei.html +## https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities +## https://www.kicksecure.com/wiki/Out-of-band_Management_Technology#Intel_ME_Disabling_Disadvantages +## https://github.com/Kicksecure/security-misc/pull/236#issuecomment-2229092813 +## https://github.com/Kicksecure/security-misc/issues/239 +## +#install mei /usr/bin/disabled-intelme-by-security-misc +#install mei-gsc /usr/bin/disabled-intelme-by-security-misc +#install mei_gsc_proxy /usr/bin/disabled-intelme-by-security-misc +#install mei_hdcp /usr/bin/disabled-intelme-by-security-misc +#install mei-me /usr/bin/disabled-intelme-by-security-misc +#install mei_phy /usr/bin/disabled-intelme-by-security-misc +#install mei_pxp /usr/bin/disabled-intelme-by-security-misc +#install mei-txe /usr/bin/disabled-intelme-by-security-misc +#install mei-vsc /usr/bin/disabled-intelme-by-security-misc +#install mei-vsc-hw /usr/bin/disabled-intelme-by-security-misc +#install mei_wdt /usr/bin/disabled-intelme-by-security-misc +#install microread_mei /usr/bin/disabled-intelme-by-security-misc + +## Intel Platform Monitoring Technology (PMT) Telemetry: +## Disable certain functionalities of the Intel PMT components. +## +## https://www.intel.com/content/www/us/en/content-details/710389/intel-platform-monitoring-technology-intel-pmt-technical-specification.html +## https://github.com/intel/Intel-PMT +## +install pmt_class /usr/bin/disabled-intelpmt-by-security-misc +install pmt_crashlog /usr/bin/disabled-intelpmt-by-security-misc +install pmt_telemetry /usr/bin/disabled-intelpmt-by-security-misc + +## Thunderbolt: +## Disable Thunderbolt modules to prevent certain DMA attacks. +## +## https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Security_vulnerabilities +## +install intel-wmi-thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc +install thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc +install thunderbolt_net /usr/bin/disabled-thunderbolt-by-security-misc + +## 2. File Systems: + +## File Systems: +## Disable uncommon file systems to reduce attack surface. +## HFS/HFS+ are legacy Apple file systems that may be required depending on the EFI partition format. +## +## https://docs.kernel.org/filesystems/index.html +## https://github.com/secureblue/secureblue/tree/live/files/system/usr/lib/modprobe.d +## +install adfs /usr/bin/disabled-filesys-by-security-misc +install affs /usr/bin/disabled-filesys-by-security-misc +install afs /usr/bin/disabled-filesys-by-security-misc +install befs /usr/bin/disabled-filesys-by-security-misc +install ceph /usr/bin/disabled-filesys-by-security-misc +install coda /usr/bin/disabled-filesys-by-security-misc +install cramfs /usr/bin/disabled-filesys-by-security-misc +install ecryptfs /usr/bin/disabled-filesys-by-security-misc +install freevxfs /usr/bin/disabled-filesys-by-security-misc +install hfs /usr/bin/disabled-filesys-by-security-misc +install hfsplus /usr/bin/disabled-filesys-by-security-misc +install jffs2 /usr/bin/disabled-filesys-by-security-misc +install jfs /usr/bin/disabled-filesys-by-security-misc +install kafs /usr/bin/disabled-filesys-by-security-misc +install minix /usr/bin/disabled-filesys-by-security-misc +install nilfs2 /usr/bin/disabled-filesys-by-security-misc +install ocfs2 /usr/bin/disabled-filesys-by-security-misc +install orangefs /usr/bin/disabled-filesys-by-security-misc +install reiserfs /usr/bin/disabled-filesys-by-security-misc +install romfs /usr/bin/disabled-filesys-by-security-misc +install sysv /usr/bin/disabled-filesys-by-security-misc +install ubifs /usr/bin/disabled-filesys-by-security-misc +install udf /usr/bin/disabled-filesys-by-security-misc +install ufs /usr/bin/disabled-filesys-by-security-misc +install zonefs /usr/bin/disabled-filesys-by-security-misc + +## Network File Systems: +## Disable uncommon network file systems to reduce attack surface. +## Currently 9p is required for KVM shared folders in Whonix. +## +## https://www.whonix.org/wiki/KVM#Shared_Folder +## +#install 9p /usr/bin/disabled-netfilesys-by-security-misc +install gfs2 /usr/bin/disabled-netfilesys-by-security-misc +install ksmbd /usr/bin/disabled-netfilesys-by-security-misc + +## Network File System - Common Internet File System (CIFS): +## +install cifs /usr/bin/disabled-netfilesys-by-security-misc +install cifs_arc4 /usr/bin/disabled-netfilesys-by-security-misc +install cifs_md4 /usr/bin/disabled-netfilesys-by-security-misc + +## Network File System - Network File System (NFS): +## +install nfs /usr/bin/disabled-netfilesys-by-security-misc +install nfs_acl /usr/bin/disabled-netfilesys-by-security-misc +install nfs_layout_nfsv41_files /usr/bin/disabled-netfilesys-by-security-misc +install nfs_layout_flexfiles /usr/bin/disabled-netfilesys-by-security-misc +install nfsd /usr/bin/disabled-netfilesys-by-security-misc +install nfsv2 /usr/bin/disabled-netfilesys-by-security-misc +install nfsv3 /usr/bin/disabled-netfilesys-by-security-misc +install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc + +## 3. Networking: + +## Network Protocols: +## Disable rare and unneeded network protocols that are a common source of unknown vulnerabilities. +## Previously had blacklisted eepro100 and eth1394. +## +## https://tails.boum.org/blueprint/blacklist_modules/ +## https://fedoraproject.org/wiki/Security_Features_Matrix#Blacklist_Rare_Protocols +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-rare-network.conf?h=ubuntu/disco +## https://github.com/Kicksecure/security-misc/pull/234#issuecomment-2230732015 +## +install af_802154 /usr/bin/disabled-network-by-security-misc +install appletalk /usr/bin/disabled-network-by-security-misc +install ax25 /usr/bin/disabled-network-by-security-misc +install decnet /usr/bin/disabled-network-by-security-misc +install dccp /usr/bin/disabled-network-by-security-misc +install econet /usr/bin/disabled-network-by-security-misc +install eepro100 /usr/bin/disabled-network-by-security-misc +install eth1394 /usr/bin/disabled-network-by-security-misc +install ipx /usr/bin/disabled-network-by-security-misc +install n-hdlc /usr/bin/disabled-network-by-security-misc +install netrom /usr/bin/disabled-network-by-security-misc +install p8022 /usr/bin/disabled-network-by-security-misc +install p8023 /usr/bin/disabled-network-by-security-misc +install psnap /usr/bin/disabled-network-by-security-misc +install rose /usr/bin/disabled-network-by-security-misc +install x25 /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Asynchronous Transfer Mode (ATM): +## +install atm /usr/bin/disabled-network-by-security-misc +install ueagle-atm /usr/bin/disabled-network-by-security-misc +install usbatm /usr/bin/disabled-network-by-security-misc +install xusbatm /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Controller Area Network (CAN): +## +install c_can /usr/bin/disabled-network-by-security-misc +install c_can_pci /usr/bin/disabled-network-by-security-misc +install c_can_platform /usr/bin/disabled-network-by-security-misc +install can /usr/bin/disabled-network-by-security-misc +install can-bcm /usr/bin/disabled-network-by-security-misc +install can-dev /usr/bin/disabled-network-by-security-misc +install can-gw /usr/bin/disabled-network-by-security-misc +install can-isotp /usr/bin/disabled-network-by-security-misc +install can-raw /usr/bin/disabled-network-by-security-misc +install can-j1939 /usr/bin/disabled-network-by-security-misc +install can327 /usr/bin/disabled-network-by-security-misc +install ifi_canfd /usr/bin/disabled-network-by-security-misc +install janz-ican3 /usr/bin/disabled-network-by-security-misc +install m_can /usr/bin/disabled-network-by-security-misc +install m_can_pci /usr/bin/disabled-network-by-security-misc +install m_can_platform /usr/bin/disabled-network-by-security-misc +install phy-can-transceiver /usr/bin/disabled-network-by-security-misc +install slcan /usr/bin/disabled-network-by-security-misc +install ucan /usr/bin/disabled-network-by-security-misc +install vxcan /usr/bin/disabled-network-by-security-misc +install vcan /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Transparent Inter Process Communication (TIPC): +## +install tipc /usr/bin/disabled-network-by-security-misc +install tipc_diag /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Reliable Datagram Sockets (RDS): +## +install rds /usr/bin/disabled-network-by-security-misc +install rds_rdma /usr/bin/disabled-network-by-security-misc +install rds_tcp /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Stream Control Transmission Protocol (SCTP): +## +install sctp /usr/bin/disabled-network-by-security-misc +install sctp_diag /usr/bin/disabled-network-by-security-misc + +## 4. Miscellaneous: + +## Amateur Radios: +## +install hamradio /usr/bin/disabled-miscellaneous-by-security-misc + +## Floppy Disks: +## +install floppy /usr/bin/disabled-miscellaneous-by-security-misc + +## Framebuffer (fbdev): +## Video drivers are known to be buggy, cause kernel panics, and are generally only used by legacy devices. +## These were all previously blacklisted. +## +## https://docs.kernel.org/fb/index.html +## https://en.wikipedia.org/wiki/Linux_framebuffer +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco +## +install aty128fb /usr/bin/disabled-framebuffer-by-security-misc +install atyfb /usr/bin/disabled-framebuffer-by-security-misc +install cirrusfb /usr/bin/disabled-framebuffer-by-security-misc +install cyber2000fb /usr/bin/disabled-framebuffer-by-security-misc +install cyblafb /usr/bin/disabled-framebuffer-by-security-misc +install gx1fb /usr/bin/disabled-framebuffer-by-security-misc +install hgafb /usr/bin/disabled-framebuffer-by-security-misc +install i810fb /usr/bin/disabled-framebuffer-by-security-misc +install intelfb /usr/bin/disabled-framebuffer-by-security-misc +install kyrofb /usr/bin/disabled-framebuffer-by-security-misc +install lxfb /usr/bin/disabled-framebuffer-by-security-misc +install matroxfb_base /usr/bin/disabled-framebuffer-by-security-misc +install neofb /usr/bin/disabled-framebuffer-by-security-misc +install nvidiafb /usr/bin/disabled-framebuffer-by-security-misc +install pm2fb /usr/bin/disabled-framebuffer-by-security-misc +install radeonfb /usr/bin/disabled-framebuffer-by-security-misc +install rivafb /usr/bin/disabled-framebuffer-by-security-misc +install s1d13xxxfb /usr/bin/disabled-framebuffer-by-security-misc +install savagefb /usr/bin/disabled-framebuffer-by-security-misc +install sisfb /usr/bin/disabled-framebuffer-by-security-misc +install sstfb /usr/bin/disabled-framebuffer-by-security-misc +install tdfxfb /usr/bin/disabled-framebuffer-by-security-misc +install tridentfb /usr/bin/disabled-framebuffer-by-security-misc +install vesafb /usr/bin/disabled-framebuffer-by-security-misc +install vfb /usr/bin/disabled-framebuffer-by-security-misc +install viafb /usr/bin/disabled-framebuffer-by-security-misc +install vt8623fb /usr/bin/disabled-framebuffer-by-security-misc +install udlfb /usr/bin/disabled-framebuffer-by-security-misc + +## Joysticks: +## +## https://docs.kernel.org/input/joydev/joystick.html +## +install joydev /usr/bin/disabled-miscellaneous-by-security-misc + +## Replaced Modules: +## These legacy drivers have all been entirely replaced and superseded by newer drivers. +## Many of these were previously blacklisted. +## +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco +## +install asus_acpi /usr/bin/disabled-miscellaneous-by-security-misc +install bcm43xx /usr/bin/disabled-miscellaneous-by-security-misc +install brcm80211 /usr/bin/disabled-miscellaneous-by-security-misc +install de4x5 /usr/bin/disabled-miscellaneous-by-security-misc +install prism54 /usr/bin/disabled-miscellaneous-by-security-misc + +## RNDIS: +## Disable as believed to have unfixable buffer overflow issues impossible to make secure. +## Used by some network devices common with Android USB tethering. +## +## https://en.wikipedia.org/wiki/RNDIS +## https://lkml.org/lkml/2022/11/23/728 +## https://lore.kernel.org/lkml/2023071333-wildly-playroom-878b@gregkh/ +## +install rndis_host /usr/bin/disabled-miscellaneous-by-security-misc +install usb_f_rndis /usr/bin/disabled-miscellaneous-by-security-misc + +## USB Video Device Class: +## Disable the USB-based video streaming driver for devices like some webcams and digital camcorders. +## +#install uvcvideo /usr/bin/disabled-miscellaneous-by-security-misc + +## Vivid: +## Disable the vivid kernel module since it has been the cause of multiple vulnerabilities. +## Required only for running tests associated with the Qubes Video Companion. +## +## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233 +## https://www.openwall.com/lists/oss-security/2019/11/02/1 +## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 +## https://forums.whonix.org/t/testing-qubes-video-companion-on-whonix/21393 +## https://github.com/Kicksecure/security-misc/issues/298 +## +#install vivid /usr/bin/disabled-miscellaneous-by-security-misc diff --git a/etc/permission-hardener.d/25_default_sudo.conf b/etc/permission-hardener.d/25_default_sudo.conf deleted file mode 100644 index 6a1cf211..00000000 --- a/etc/permission-hardener.d/25_default_sudo.conf +++ /dev/null @@ -1,20 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## https://forums.whonix.org/t/restrict-root-access/7658/116 -## This restricts the file permissions of the sudo executable so that a vulnerability -## in the program will not be exploitable by any users not in the "sudo" group. sudo -## is a very complex program and is setuid so vulnerabilities in it can allow privilege -## escalation, regardless of other root access restrictions. For example, the following -## buffer overflow vulnerability could have been exploited by any user on the system: -## https://www.openwall.com/lists/oss-security/2021/01/26/3 -## With this restriction, only users explicitly permitted to use sudo by being added to -## the "sudo" group could exploit such vulnerabilities. For example, this would prevent a -## compromised network-facing daemon (such as web servers, time synchronization daemons, -## etc.) running as its own user from exploiting sudo to escalate privileges. -#/usr/bin/sudo 4750 root sudo -#/bin/sudo 4750 root sudo diff --git a/etc/permission-hardener.d/25_default_whitelist_chromium.conf b/etc/permission-hardener.d/25_default_whitelist_chromium.conf deleted file mode 100644 index db6f8ea0..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_chromium.conf +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -chrome-sandbox matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_dbus.conf b/etc/permission-hardener.d/25_default_whitelist_dbus.conf deleted file mode 100644 index 29979156..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_dbus.conf +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -dbus-daemon-launch-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_fuse.conf b/etc/permission-hardener.d/25_default_whitelist_fuse.conf deleted file mode 100644 index 4affc6a2..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_fuse.conf +++ /dev/null @@ -1,10 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## required for AppImages such as electrum Bitcoin wallet -## https://forums.whonix.org/t/disable-suid-binaries/7706/57 -/fusermount matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_pam.conf b/etc/permission-hardener.d/25_default_whitelist_pam.conf deleted file mode 100644 index 7348e0c0..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_pam.conf +++ /dev/null @@ -1,9 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## Without this, Xfce fails to start with a dbus-launch error. -pam-tmpdir-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_policykit.conf b/etc/permission-hardener.d/25_default_whitelist_policykit.conf deleted file mode 100644 index 032c6b2b..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_policykit.conf +++ /dev/null @@ -1,17 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -/usr/bin/pkexec exactwhitelist -/bin/pkexec exactwhitelist -/usr/bin/pkexec.security-misc-orig exactwhitelist -/bin/pkexec.security-misc-orig exactwhitelist - -## TODO: research -## match both: -#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist -#/lib/policykit-1/polkit-agent-helper-1 -polkit-agent-helper-1 matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_qubes.conf b/etc/permission-hardener.d/25_default_whitelist_qubes.conf deleted file mode 100644 index ad8592ab..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_qubes.conf +++ /dev/null @@ -1,18 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## TODO: research -## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c -## -## Qubes upstream security issue: -## qfile-unpacker allows unprivileged users in VMs to gain root privileges -## https://github.com/QubesOS/qubes-issues/issues/8633 -## -## match both: -#/usr/lib/qubes/qfile-unpacker whitelist -#/lib/qubes/qfile-unpacker -qfile-unpacker matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_selinux.conf b/etc/permission-hardener.d/25_default_whitelist_selinux.conf deleted file mode 100644 index 2a5686a8..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_selinux.conf +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -/utempter/utempter matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_spice.conf b/etc/permission-hardener.d/25_default_whitelist_spice.conf deleted file mode 100644 index a8b7f7a4..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_spice.conf +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -spice-client-glib-usb-acl-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_ssh.conf b/etc/permission-hardener.d/25_default_whitelist_ssh.conf deleted file mode 100644 index f7ef445b..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_ssh.conf +++ /dev/null @@ -1,11 +0,0 @@ -## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## TODO: research -ssh-agent matchwhitelist -ssh-keysign matchwhitelist -/lib/openssh matchwhitelist diff --git a/etc/profile.d/30_security-misc.sh b/etc/profile.d/30_security-misc.sh deleted file mode 100755 index 351d3ed1..00000000 --- a/etc/profile.d/30_security-misc.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/sh - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -z "$XDG_CONFIG_DIRS" ]; then - XDG_CONFIG_DIRS=/etc/xdg -fi -if ! echo "$XDG_CONFIG_DIRS" | grep --quiet /usr/share/security-misc/ ; then - export XDG_CONFIG_DIRS=/usr/share/security-misc/:$XDG_CONFIG_DIRS -fi - -if [ -x /usr/libexec/security-misc/panic-on-oops ]; then - ## Hide output. Otherwise could confuse Qubes UpdatesProxy. - sudo --non-interactive /usr/libexec/security-misc/panic-on-oops 1>/dev/null 2>/dev/null -fi diff --git a/etc/profile.d/30_security-misc.sh#security-misc-shared b/etc/profile.d/30_security-misc.sh#security-misc-shared new file mode 100755 index 00000000..39ee52ba --- /dev/null +++ b/etc/profile.d/30_security-misc.sh#security-misc-shared @@ -0,0 +1,11 @@ +#!/bin/sh + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +if [ -z "$XDG_CONFIG_DIRS" ]; then + XDG_CONFIG_DIRS="/etc:/etc/xdg:/usr/share" +fi +if ! printf '%s\n' "$XDG_CONFIG_DIRS" | grep -- "/usr/share/security-misc/" >/dev/null 2>/dev/null ; then + export XDG_CONFIG_DIRS="/usr/share/security-misc/:$XDG_CONFIG_DIRS" +fi diff --git a/etc/securetty.security-misc b/etc/securetty.security-misc deleted file mode 100644 index ca0d81b1..00000000 --- a/etc/securetty.security-misc +++ /dev/null @@ -1,2 +0,0 @@ -# /etc/securetty: list of terminals on which root is allowed to login. -# See securetty(5) and login(1). diff --git a/etc/securetty.security-misc#security-misc-shared b/etc/securetty.security-misc#security-misc-shared new file mode 100644 index 00000000..c98d20d3 --- /dev/null +++ b/etc/securetty.security-misc#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +# /etc/securetty: list of terminals on which root is allowed to login. +# See securetty(5) and login(1). diff --git a/etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared b/etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared new file mode 100644 index 00000000..e8b4b486 --- /dev/null +++ b/etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared @@ -0,0 +1,34 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/security-misc/emerg-shutdown/50_user.conf" or +## "/usr/local/etc/security-misc/emerg-shutdown/50_user.conf" +## for your custom configuration, which will override the defaults found here. +## When Kicksecure is updated, this file may be overwritten. + +## Set the key combo for forcing immediate shutdown. See the "Keys and +## buttons" section of "/usr/include/linux/input-event-codes.h" for possibly +## supported values. Not all keys are supported. +## +## All specified keys must be depressed at the same time to trigger a +## shutdown. Use a comma (",") to separate keys. If you want to alias certain +## keys to each other from emerg-shutdown's standpoint, use a pipe +## character("|"). +## +## The default key sequence triggers a shutdown when Ctrl+Alt+Delete is +## pressed, allowing the use of either the left or right Ctrl and Alt keys. +EMERG_SHUTDOWN_KEYS="KEY_LEFTCTRL|KEY_RIGHTCTRL,KEY_LEFTALT|KEY_RIGHTALT,KEY_END" + +## Set the maximum number of seconds shutdown can take. If shutdown gets stuck +## for longer than this, the system will forcibly power down. +## +## NOTE: This requires ensure-shutdown.service and +## ensure-shutdown-trigger.service to be enabled, which is not done by +## default. Enabling ensure-shutdown.service will cause shutdown to always +## take at least as long as systemd's DefaultTimeoutStopSec (which by default +## is 90 seconds). If you are going to enable ensure-shutdown.service, it is +## highly recommended to set DefaultTimeoutStopSec to a much smaller value, +## such as 5 seconds. The maximum shutdown time set here should be at least 10 +## seconds *longer* than DefaultTimeoutStopSec, to give normal shutdown a +## chance to actually succeed before forcibly shutting down the system. +ENSURE_SHUTDOWN_TIMEOUT=30 diff --git a/etc/security/access-security-misc.conf b/etc/security/access-security-misc.conf#security-misc-shared similarity index 88% rename from etc/security/access-security-misc.conf rename to etc/security/access-security-misc.conf#security-misc-shared index 248335c4..d34325e9 100644 --- a/etc/security/access-security-misc.conf +++ b/etc/security/access-security-misc.conf#security-misc-shared @@ -1,8 +1,8 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## To enable root login, see: -## https://www.whonix.org/wiki/Root#Root_Login +## https://www.kicksecure.com/wiki/Root#Root_Login ## Console Lockdown ## https://forums.whonix.org/t/etc-security-hardening/8592 @@ -33,7 +33,7 @@ +:(console):console tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9 ## Same as above also for members of group `sudo`. -## https://github.com/Whonix/security-misc/pull/74#issuecomment-607748407 +## https://github.com/Kicksecure/security-misc/pull/74#issuecomment-607748407 +:(sudo):console tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9 ## Everyone else except members of group 'console-unrestricted' diff --git a/etc/security/faillock.conf.security-misc b/etc/security/faillock.conf.security-misc#security-misc-shared similarity index 78% rename from etc/security/faillock.conf.security-misc rename to etc/security/faillock.conf.security-misc#security-misc-shared index bb81754d..4b70cdee 100644 --- a/etc/security/faillock.conf.security-misc +++ b/etc/security/faillock.conf.security-misc#security-misc-shared @@ -1,9 +1,12 @@ +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + # Configuration for locking the user after multiple failed # authentication attempts. # # The directory where the user files with the failure records are kept. # The default is /var/run/faillock. -# dir = /var/run/faillock +dir = /var/lib/security-misc/faillock # # Will log the user name into the system log if the user is not found. # Enabled if option is present. @@ -35,14 +38,19 @@ deny = 50 # authentication failures must happen for the user account # lock out is n seconds. # The default is 900 (15 minutes). -# fail_interval = 900 +# security-misc note: the interval should be set to infinity if possible, +# however pam_faillock arbitrarily limits this variable to a maximum of 604800 +# seconds (7 days). See +# https://github.com/linux-pam/linux-pam/blob/539816e4a0a277dbb632412be91e482fff9d9d09/modules/pam_faillock/faillock_config.h#L59 +# for details. Therefore we set this to the maximum allowable value of 7 days. +fail_interval = 604800 # # The access will be re-enabled after n seconds after the lock out. # The value 0 has the same meaning as value `never` - the access # will not be re-enabled without resetting the faillock # entries by the `faillock` command. # The default is 600 (10 minutes). -# unlock_time = 600 +unlock_time = never # # Root account can become locked as well as regular accounts. # Enabled if option is present. diff --git a/etc/security/limits.d/30_security-misc.conf b/etc/security/limits.d/30_security-misc.conf deleted file mode 100644 index bbbe31d0..00000000 --- a/etc/security/limits.d/30_security-misc.conf +++ /dev/null @@ -1,5 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Disable coredumps. -* hard core 0 diff --git a/etc/security/limits.d/30_security-misc.conf#security-misc-shared b/etc/security/limits.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..632b8736 --- /dev/null +++ b/etc/security/limits.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,7 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Disable core dumps. +## `-` in the second field sets both hard and soft limits at the same time. +## See `man 5 limits.conf`. +* - core 0 diff --git a/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml b/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared similarity index 90% rename from etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml rename to etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared index fa9d01dc..dd943495 100644 --- a/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml +++ b/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared @@ -1,6 +1,6 @@ - + diff --git a/etc/skel/.gnupg/gpg.conf b/etc/skel/.gnupg/gpg.conf#security-misc-shared similarity index 98% rename from etc/skel/.gnupg/gpg.conf rename to etc/skel/.gnupg/gpg.conf#security-misc-shared index f8004fe9..f0ed5a4b 100644 --- a/etc/skel/.gnupg/gpg.conf +++ b/etc/skel/.gnupg/gpg.conf#security-misc-shared @@ -282,13 +282,13 @@ display-charset utf-8 ################################################################## ################################################################## -## BEGIN Some suggestions from Debian http://keyring.debian.org/creating-key.html +## BEGIN Some suggestions from Debian https://keyring.debian.org/creating-key.html personal-digest-preferences SHA512 cert-digest-algo SHA512 default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed -## END Some suggestions from Debian http://keyring.debian.org/creating-key.html +## END Some suggestions from Debian https://keyring.debian.org/creating-key.html ################################################################## ################################################################## diff --git a/etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared b/etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..67ad1e86 --- /dev/null +++ b/etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Don't edit this file; to overwrite any options, edit a file with a higher +## number that is read earlier by SSH, such as +## '/etc/ssh/ssh_config.d/10_user.conf'. If your configuration changes do not +## need to be system-wide, you may also consider placing overrides in +## ~/.ssh/config. + +## See also: +## https://www.kicksecure.com/wiki/SSH#Client_Configuration_File + +Host * + VisualHostKey yes + ## Ciphers that are Terrapin-vulnerable when an outdated client or server are + ## used are intentionally retained. Connecting to a Terrapin-vulnerable + ## server cannot be made secure (as any Terrapin-vulnerable server will be + ## vulnerable to other issues as well) and is therefore unsupported. + Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr + MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com + ## Only post-quantum-sequre KexAlgorithms are allowed. + KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256 + HostKeyAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519 + PubkeyAcceptedAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519 diff --git a/etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared b/etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..6d52003d --- /dev/null +++ b/etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,80 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Don't edit this file; to overwrite any options, edit a file with a lower +## number that is read earlier by sshd, such as +## '/etc/ssh/sshd_config.d/10_user.conf'. + +## See also: +## https://www.kicksecure.com/wiki/SSH#Server_Configuration_File + +## Number of allowed login attempts per connection. +MaxAuthTries 3 + +## Require strong ciphers and algorithms. +HostKey /etc/ssh/ssh_host_ed25519_key +HostKeyAlgorithms ssh-ed25519 +PubkeyAcceptedAlgorithms ssh-ed25519,sk-ssh-ed25519@openssh.com +## Ciphers that are Terrapin-vulnerable when an outdated client or server are +## used are intentionally retained. Connections from a Terrapin-vulnerable +## client cannot be made secure (as any Terrapin-vulnerable client will be +## vulnerable to other issues as well) and is therefore unsupported. +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com +MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com +## Only post-quantum-sequre KexAlgorithms are allowed. +KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256 + +## Override with 'no' to fully deny root login, or leave this as +## 'prohibit-password' for denying root password login but still allowing +## other authentication methods such as public key. +PermitRootLogin prohibit-password + +## Public key authentication is transparent, non-interactive and more secure. +PasswordAuthentication no + +## Change to 'yes' to enable challenge-response passwords (beware issues with +## some PAM modules and threads) +KbdInteractiveAuthentication no + +## PAM can be used for account and session processing when using +## ChallengeResponseAuthentication or PasswordAuthentication. +## +## Depending on your PAM configuration, PAM authentication via +## ChallengeResponseAuthentication may bypass the setting of "PermitRootLogin +## without-password". +## +## If you want PAM account and session checks to run without PAM +## authentication, then enable this but set PasswordAuthentication and +## ChallengeResponseAuthentication to 'no'. +## +## The default upstream is 'no', Debian sets this to 'yes'. If using a locked +## account, read: +## https://www.kicksecure.com/wiki/SSH#SSH_Login_Comparison_Table +## We set it to 'yes' to work with libpam-tmpdir. +## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#libpam-tmpdir +## Also folders such as '/run/user/1000' will exist thanks to PAM. +## The absence of that folder can lead to issues (such as with msgcollector). +UsePAM yes + +## Block dangerous forwarding. +AllowAgentForwarding no +AllowTcpForwarding no +X11Forwarding no + +## Hide unnecessary login banners. +PrintMotd no +#Banner /etc/issue.net +#Hiding Debian version from SSH banner (obscurity) +DebianBanner no + +## Some options are dangerous but may be required in certain circumstances. As +## an example, if forwarding is required, selectively allow it with a 'Match' +## block. Consider a new separate user named 'tunnel' which wants to forward +## its local port to be available on the server on port 443. Note that a +## tunnel user doesn't even require a TTY nor a shell, so don't forget to +## change the 'tunnel' shell to something that prevents login such as +## '/usr/sbin/nologin'. +#Match User tunnel +# AllowTcpForwarding yes +# PermitListen localhost:443 +# PermitTTY no diff --git a/etc/sudoers.d/pkexec-security-misc b/etc/sudoers.d/pkexec-security-misc deleted file mode 100644 index db5f32f3..00000000 --- a/etc/sudoers.d/pkexec-security-misc +++ /dev/null @@ -1,11 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## REVIEW: is it ok that users can find out the PATH setting of root? -#%sudo ALL=NOPASSWD: /usr/libexec/security-misc/echo-path - -## xfpm-power-backlight-helper demands environment variable PKEXEC_UID to be -## set. Would otherwise error out with the following error message: -## "This program must only be run through pkexec" -## REVIEW: Can bad things be done by spoofing PKEXEC_UID? -#Defaults:ALL env_keep += "PKEXEC_UID" diff --git a/etc/sudoers.d/security-misc b/etc/sudoers.d/security-misc deleted file mode 100644 index 4256683e..00000000 --- a/etc/sudoers.d/security-misc +++ /dev/null @@ -1,6 +0,0 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -user ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops -%sudo ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops - diff --git a/etc/sudoers.d/security-misc#security-misc-shared b/etc/sudoers.d/security-misc#security-misc-shared new file mode 100644 index 00000000..1fa2146e --- /dev/null +++ b/etc/sudoers.d/security-misc#security-misc-shared @@ -0,0 +1,12 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Neither of these are needed. +#user ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops +#%sudo ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops + +## Use a more open umask when executing commands with sudo +## Can be overridden on a per-user basis using .[z]profile if desirable +## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#umask_hardening +Defaults umask_override +Defaults umask=0022 diff --git a/etc/sudoers.d/security-misc-desktop#security-misc-desktop b/etc/sudoers.d/security-misc-desktop#security-misc-desktop new file mode 100644 index 00000000..cab7ca7c --- /dev/null +++ b/etc/sudoers.d/security-misc-desktop#security-misc-desktop @@ -0,0 +1,6 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Don't attempt to determine the local machine's FQDN via DNS. This can leak +## the machine's hostname in cleartext to the configured DNS server. +Defaults !fqdn diff --git a/etc/sudoers.d/xfce-security-misc b/etc/sudoers.d/xfce-security-misc deleted file mode 100644 index be92ce9f..00000000 --- a/etc/sudoers.d/xfce-security-misc +++ /dev/null @@ -1,19 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://forums.whonix.org/t/xfce4-power-manager-xfpm-power-backlight-helper-pkexec-lxsudo-popup/8764 -## /usr/share/polkit-1/actions/org.xfce.power.policy - -## Feel free to out comment this if you are not using xfce4-power-manager or Xfce. - -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]] -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]] -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]][[\:digit\:]] - -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]] -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]] -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]][[\:digit\:]] - -## XXX: Should we allow this? -#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --suspend -#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --hibernate diff --git a/etc/systemd/system/emergency.service.d/override.conf b/etc/systemd/system/emergency.service.d/override.conf#security-misc-shared similarity index 61% rename from etc/systemd/system/emergency.service.d/override.conf rename to etc/systemd/system/emergency.service.d/override.conf#security-misc-shared index b24186a0..42fefd44 100644 --- a/etc/systemd/system/emergency.service.d/override.conf +++ b/etc/systemd/system/emergency.service.d/override.conf#security-misc-shared @@ -1,3 +1,6 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 ## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d diff --git a/etc/systemd/system/rescue.service.d/override.conf b/etc/systemd/system/rescue.service.d/override.conf#security-misc-shared similarity index 61% rename from etc/systemd/system/rescue.service.d/override.conf rename to etc/systemd/system/rescue.service.d/override.conf#security-misc-shared index b24186a0..42fefd44 100644 --- a/etc/systemd/system/rescue.service.d/override.conf +++ b/etc/systemd/system/rescue.service.d/override.conf#security-misc-shared @@ -1,3 +1,6 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 ## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d diff --git a/etc/thunderbird/pref/40_security-misc.js b/etc/thunderbird/pref/40_security-misc.js deleted file mode 100644 index b0586e85..00000000 --- a/etc/thunderbird/pref/40_security-misc.js +++ /dev/null @@ -1,59 +0,0 @@ -//#### Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -//#### See the file COPYING for copying conditions. - -//#### meta start -//#### project Whonix and Kicksecure -//#### category security and apps -//#### description https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415 -//#### meta end - -// https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415 -pref("network.IDN_show_punycode", true); - -// Disable all and any kind of telemetry by default -pref("toolkit.telemetry.enabled", false); -pref("toolkit.telemetry.unified", false); -pref("toolkit.telemetry.shutdownPingSender.enabled", false); -pref("toolkit.telemetry.updatePing.enabled", false); -pref("toolkit.telemetry.archive.enabled", false); -pref("toolkit.telemetry.bhrPing.enabled", false); -pref("toolkit.telemetry.firstShutdownPing.enabled", false); -pref("toolkit.telemetry.newProfilePing.enabled", false); -pref("toolkit.telemetry.server", ""); // Defense in depth -pref("toolkit.telemetry.server_owner", ""); // Defense in depth -pref("datareporting.healthreport.uploadEnabled", false); -pref("datareporting.policy.dataSubmissionEnabled", false); -pref("toolkit.telemetry.coverage.opt-out", true); // from Firefox -pref("toolkit.coverage.opt-out", true); // from Firefox - -// Disable implicit outbound traffic -pref("network.connectivity-service.enabled", false); -pref("network.prefetch-next", false); -pref("network.dns.disablePrefetch", true); -pref("network.predictor.enabled", false); - -// No need to explain the problems with javascript -// If you want javascript, use your browser -// Thunderbird needs no javascript -// pref("javascript.enabled", false); // Will break setting up services that require redirecting to their javascripted webpage for login, like gmail etc. So commented out for now. - -// Disable scripting when viewing pdf files -user_pref("pdfjs.enableScripting", false); - -// If you want cookies, use your browser -pref("network.cookie.cookieBehavior", 2); - -// Do not send user agent information -// For email clients, this is more like a relic of the past -// Completely not necessary and just exposes a lot of information about the client -// Since v115.0 Thunderbird already minimizes the user agent -// But we want it gone for good for no information leak at all -// https://hg.mozilla.org/comm-central/rev/cbbbc8d93cd7 -pref("mailnews.headers.sendUserAgent", false); - -// Normally we send emails after marking them with a time stamp -// That includes our local time zone -// This option makes our local time zone appear as UTC -// And rounds the time stamp to the closes minute -// https://hg.mozilla.org/comm-central/rev/98aa0bf2e719 -pref("mail.sanitize_date_header", true); diff --git a/etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared b/etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared new file mode 100644 index 00000000..1d7596d4 --- /dev/null +++ b/etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared @@ -0,0 +1 @@ +Devices=listen,list,modify diff --git a/etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared b/etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared new file mode 100644 index 00000000..1d7596d4 --- /dev/null +++ b/etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared @@ -0,0 +1 @@ +Devices=listen,list,modify diff --git a/etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared b/etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..7315d9d5 --- /dev/null +++ b/etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,76 @@ +## We allow devices that were plugged in before the daemon starts. Everything +## is blocked as the default. Following rules apply on top of this. + +## First match wins. Therefore, reject rules should be on the top. +## Quote: +## https://usbguard.github.io/documentation/rule-language +## > the daemon scans the existing rules sequentially + +## Explicitly reject any interface that is not documented and/or defined by +## USB.org. +## Note: Most probably superfluous. +reject with-interface none-of { 00:*:* 01:*:* 02:*:* 03:*:* 05:*:* 06:*:* 07:*:* 08:*:* 09:*:* 0a:*:* 0b:*:* 0d:*:* 0e:*:* 0f:*:* 10:*:* 11:*:* 12:*:* 13:*:* 14:*:* 3c:*:* dc:*:* e0:*:* ef:*:* fe:*:* ff:*:* } + +## Explicitly reject any device with a mouse/keyboard interface in +## combination with some other interface. +## Mice and keyboards should likely never have non-HID interfaces provided +## alongside them. +reject with-interface all-of { 03:*:* 00:*:* } +reject with-interface all-of { 03:*:* 01:*:* } +reject with-interface all-of { 03:*:* 02:*:* } +reject with-interface all-of { 03:*:* 05:*:* } +reject with-interface all-of { 03:*:* 06:*:* } +reject with-interface all-of { 03:*:* 07:*:* } +reject with-interface all-of { 03:*:* 08:*:* } +reject with-interface all-of { 03:*:* 09:*:* } +reject with-interface all-of { 03:*:* 0a:*:* } +reject with-interface all-of { 03:*:* 0b:*:* } +reject with-interface all-of { 03:*:* 0d:*:* } +reject with-interface all-of { 03:*:* 0e:*:* } +reject with-interface all-of { 03:*:* 0f:*:* } +reject with-interface all-of { 03:*:* 10:*:* } +reject with-interface all-of { 03:*:* 11:*:* } +reject with-interface all-of { 03:*:* 12:*:* } +reject with-interface all-of { 03:*:* 13:*:* } +reject with-interface all-of { 03:*:* 14:*:* } +reject with-interface all-of { 03:*:* 3c:*:* } +reject with-interface all-of { 03:*:* dc:*:* } +reject with-interface all-of { 03:*:* e0:*:* } +reject with-interface all-of { 03:*:* ef:*:* } +reject with-interface all-of { 03:*:* fe:*:* } +reject with-interface all-of { 03:*:* ff:*:* } + +## Explicitly reject any device with an RNDIS interface. RNDIS is believed to +## have protocol-level buffer overflow vulnerabilities that cannot be fixed. +reject with-interface one-of { ef:04:* } + +## Allow all mouses and keyboards, in a sense, so the user can conveniently +## change them without restrating the daemon. + +## Allow only one keyboard to be connected +allow with-interface equals { 03:01:01 } if !allowed-matches(with-interface equals { 03:01:01 }) +## Allow only one mouse to be connected +allow with-interface equals { 03:01:02 } if !allowed-matches(with-interface equals { 03:01:02 }) +## NOTE: Some HID devices will have an interface of 03:00:00 - these are HID +## devices that do not support a "boot interface". **These are blocked +## entirely.** It is very likely that this will cause issues with some mice +## and keyboards. Also note, all HID devices other than mice and keyboards +## will be blocked, **including touchscreens.** + +## Allow USB audio devices. The intended functionality of these devices is +## unlikely to be usable in a malicious capacity without having already +## compromised the machine. +allow with-interface equals { 01:*:* } + +## Allow USB video devices (i.e. webcams). Also tricky to use in a malicious +## manner without having already compromised the machine. +allow with-interface equals { 0e:*:* } + +## Allow USB mass storage, if and only if the USB device only has the mass +## storage interface and nothing extra. +## Suspicious interface combinations with mass storage are blocked. +allow with-interface equals { 08:*:* } + +## Allow USB hubs, these are likely safe and are required for Qubes OS USB +## passthrough to work. +allow with-interface equals { 09:*:* } diff --git a/etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared b/etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared new file mode 100644 index 00000000..f2c1406b --- /dev/null +++ b/etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared @@ -0,0 +1,218 @@ +# +# Rule set file path. +# +# The USBGuard daemon will use this file to load the policy +# rule set from it and to write new rules received via the +# IPC interface. +# +# RuleFile=/path/to/rules.conf +# +RuleFile=/etc/usbguard/rules.conf + +# +# Rule set folder path. +# +# The USBGuard daemon will use this folder to load the policy +# rule set from it and to write new rules received via the +# IPC interface. Usually, we set the option to +# /etc/usbguard/rules.d/. The USBGuard daemon is supposed to +# behave like any other standard Linux daemon therefore it +# loads rule files in alphanumeric order. File names inside +# RuleFolder directory should start with a two-digit number +# prefix indicating the position, in which the rules are +# scanned by the daemon. +# +# RuleFolder=/path/to/rulesfolder/ +# +RuleFolder=/etc/usbguard/rules.d/ + + + +# +# Implicit policy target. +# +# How to treat devices that don't match any rule in the +# policy. One of: +# +# * allow - authorize the device +# * block - block the device +# * reject - remove the device +# +ImplicitPolicyTarget=block + +# +# Present device policy. +# +# How to treat devices that are already connected when the +# daemon starts. One of: +# +# * allow - authorize every present device +# * block - deauthorize every present device +# * reject - remove every present device +# * keep - just sync the internal state and leave it +# * apply-policy - evaluate the ruleset for every present +# device +# +# Overridden by Kicksecure to allow all devices that are connected at startup. +# +PresentDevicePolicy=allow + +# +# Present controller policy. +# +# How to treat USB controllers that are already connected +# when the daemon starts. One of: +# +# * allow - authorize every present device +# * block - deauthorize every present device +# * reject - remove every present device +# * keep - just sync the internal state and leave it +# * apply-policy - evaluate the ruleset for every present +# device +# +PresentControllerPolicy=keep + +# +# Inserted device policy. +# +# How to treat USB devices that are already connected +# *after* the daemon starts. One of: +# +# * block - deauthorize every present device +# * reject - remove every present device +# * apply-policy - evaluate the ruleset for every present +# device +# +InsertedDevicePolicy=apply-policy + +# +# Control which devices are authorized by default. +# +# The USBGuard daemon modifies some the default authorization state attributes +# of controller devices. This setting, enables you to define what value the +# default authorization is set to. +# +# * keep - do not change the authorization state +# * none - every new device starts out deauthorized +# * all - every new device starts out authorized +# * internal - internal devices start out authorized, external devices start +# out deauthorized (this requires the ACPI tables to properly +# label internal devices, and kernel support) +# +AuthorizedDefault=none + +# +# Restore controller device state. +# +# The USBGuard daemon modifies some attributes of controller +# devices like the default authorization state of new child device +# instances. Using this setting, you can control whether the +# daemon will try to restore the attribute values to the state +# before modification on shutdown. +# +# SECURITY CONSIDERATIONS: If set to true, the USB authorization +# policy could be bypassed by performing some sort of attack on the +# daemon (via a local exploit or via a USB device) to make it shutdown +# and restore to the operating-system default state (known to be permissive). +# +RestoreControllerDeviceState=false + +# +# Device manager backend +# +# Which device manager backend implementation to use. One of: +# +# * uevent - Netlink based implementation which uses sysfs to scan for present +# devices and an uevent netlink socket for receiving USB device +# related events. +# * umockdev - umockdev based device manager capable of simulating devices based +# on umockdev-record files. Useful for testing. +# +DeviceManagerBackend=uevent + +#!!! WARNING: It's good practice to set at least one of the !!! +#!!! two options below. If none of them are set, !!! +#!!! the daemon will accept IPC connections from !!! +#!!! anyone, thus allowing anyone to modify the !!! +#!!! rule set and (de)authorize USB devices. !!! + +# +# Users allowed to use the IPC interface. +# +# A space delimited list of usernames that the daemon will +# accept IPC connections from. +# +# IPCAllowedUsers=username1 username2 ... +# +IPCAllowedUsers=root + +# +# Groups allowed to use the IPC interface. +# +# A space delimited list of groupnames that the daemon will +# accept IPC connections from. +# +# IPCAllowedGroups=groupname1 groupname2 ... +# +IPCAllowedGroups=root plugdev + +# +# IPC access control definition files path. +# +# The files at this location will be interpreted by the USBGuard +# daemon as access control definition files for the IPC interface. +# The (base)name of a file should be in the form: +# +# [user][:] +# +# where user is either username or UID and group is either groupname or GID. +# IPC access control files should contain lines in the form: +# +#
=[privilege1][,privilege2] ... +# +# This way each file defines who is able to connect to the IPC +# bus and what privileges he has. Note that the IPC access control +# files need to have file permissions set to 0600. +# +IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/ + +# +# Generate device specific rules including the "via-port" +# attribute. +# +# This option modifies the behavior of the allowDevice +# action. When instructed to generate a permanent rule, +# the action can generate a port specific rule. Because +# some systems have unstable port numbering, the generated +# rule might not match the device after rebooting the system. +# +# If set to false, the generated rule will still contain +# the "parent-hash" attribute which also defines an association +# to the parent device. See usbguard-rules.conf(5) for more +# details. +# +DeviceRulesWithPort=false + +# +# USBGuard Audit events log backend +# +# One of: +# +# * FileAudit - Log audit events into a file specified by +# AuditFilePath setting (see below) +# * LinuxAudit - Log audit events using the Linux Audit +# subsystem (using audit_log_user_message) +# +AuditBackend=FileAudit + +# +# USBGuard audit events log file path. +# +AuditFilePath=/var/log/usbguard/usbguard-audit.log + +# +# Hides personally identifiable information such as device serial numbers and +# hashes of descriptors (which include the serial number) from audit entries. +# +HidePII=false + diff --git a/usr/bin/disabled-bluetooth-by-security-misc b/usr/bin/disabled-bluetooth-by-security-misc deleted file mode 100755 index 55b1e631..00000000 --- a/usr/bin/disabled-bluetooth-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This bluetooth kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared b/usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared new file mode 100755 index 00000000..f52a6b1d --- /dev/null +++ b/usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Bluetooth kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-cdrom-by-security-misc b/usr/bin/disabled-cdrom-by-security-misc deleted file mode 100755 index 9efd765f..00000000 --- a/usr/bin/disabled-cdrom-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This CD-ROM kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-cdrom-by-security-misc#security-misc-shared b/usr/bin/disabled-cdrom-by-security-misc#security-misc-shared new file mode 100755 index 00000000..bb4db834 --- /dev/null +++ b/usr/bin/disabled-cdrom-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This CD-ROM/DVD kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared b/usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared new file mode 100755 index 00000000..7e5bdadd --- /dev/null +++ b/usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This CPU MSR kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-filesys-by-security-misc b/usr/bin/disabled-filesys-by-security-misc deleted file mode 100755 index 50dd6385..00000000 --- a/usr/bin/disabled-filesys-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This file system kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-filesys-by-security-misc#security-misc-shared b/usr/bin/disabled-filesys-by-security-misc#security-misc-shared new file mode 100755 index 00000000..d85a951a --- /dev/null +++ b/usr/bin/disabled-filesys-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This file system kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-firewire-by-security-misc b/usr/bin/disabled-firewire-by-security-misc deleted file mode 100755 index ca04ab15..00000000 --- a/usr/bin/disabled-firewire-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This firewire kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-firewire-by-security-misc#security-misc-shared b/usr/bin/disabled-firewire-by-security-misc#security-misc-shared new file mode 100755 index 00000000..ecd429e1 --- /dev/null +++ b/usr/bin/disabled-firewire-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This FireWire (IEEE 1394) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared b/usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared new file mode 100755 index 00000000..97e5869a --- /dev/null +++ b/usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This framebuffer (fbdev) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-gps-by-security-misc#security-misc-shared b/usr/bin/disabled-gps-by-security-misc#security-misc-shared new file mode 100755 index 00000000..9a29b36d --- /dev/null +++ b/usr/bin/disabled-gps-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Global Positioning System (GPS) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-intelme-by-security-misc b/usr/bin/disabled-intelme-by-security-misc deleted file mode 100755 index 108cc815..00000000 --- a/usr/bin/disabled-intelme-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This Intel Management Engine (ME) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-intelme-by-security-misc#security-misc-shared b/usr/bin/disabled-intelme-by-security-misc#security-misc-shared new file mode 100755 index 00000000..b50fbbd0 --- /dev/null +++ b/usr/bin/disabled-intelme-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Intel Management Engine (ME) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared b/usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared new file mode 100755 index 00000000..edee2680 --- /dev/null +++ b/usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Intel Platform Monitoring Technology (PMT) Telemetry kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared b/usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared new file mode 100755 index 00000000..04b627c8 --- /dev/null +++ b/usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-msr-by-security-misc b/usr/bin/disabled-msr-by-security-misc deleted file mode 100755 index 2c5e6e19..00000000 --- a/usr/bin/disabled-msr-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This CPU MSR kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-netfilesys-by-security-misc b/usr/bin/disabled-netfilesys-by-security-misc deleted file mode 100755 index 5c15b392..00000000 --- a/usr/bin/disabled-netfilesys-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This network file system kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared b/usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared new file mode 100755 index 00000000..de4db437 --- /dev/null +++ b/usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This network file system kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-network-by-security-misc b/usr/bin/disabled-network-by-security-misc deleted file mode 100755 index d2ae58c7..00000000 --- a/usr/bin/disabled-network-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This network protocol kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-network-by-security-misc#security-misc-shared b/usr/bin/disabled-network-by-security-misc#security-misc-shared new file mode 100755 index 00000000..3d2e342a --- /dev/null +++ b/usr/bin/disabled-network-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This network protocol kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-thunderbolt-by-security-misc b/usr/bin/disabled-thunderbolt-by-security-misc deleted file mode 100755 index e086d4ad..00000000 --- a/usr/bin/disabled-thunderbolt-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This thunderbolt kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared b/usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared new file mode 100755 index 00000000..faa380bc --- /dev/null +++ b/usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Thunderbolt kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-vivid-by-security-misc b/usr/bin/disabled-vivid-by-security-misc deleted file mode 100755 index ed1487f8..00000000 --- a/usr/bin/disabled-vivid-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This vivid kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 - -exit 1 diff --git a/usr/bin/fm-shim-frontend#security-misc-shared b/usr/bin/fm-shim-frontend#security-misc-shared new file mode 100755 index 00000000..fadcd9e0 --- /dev/null +++ b/usr/bin/fm-shim-frontend#security-misc-shared @@ -0,0 +1,10 @@ +#!/usr/bin/python3 -Bsu + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Shell-invocation guard. +"exec" "bash" "-c" "printf '%s\n' '$0: ERROR: Do not execute this script with bash!' >&2; exit 1" + +from fm_shim_frontend.fm_shim_frontend import main +main() diff --git a/usr/bin/permission-hardener b/usr/bin/permission-hardener deleted file mode 100755 index 2e5df3d0..00000000 --- a/usr/bin/permission-hardener +++ /dev/null @@ -1,669 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://forums.whonix.org/t/disable-suid-binaries/7706 -## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 - -set -o errexit -o nounset -o pipefail - -exit_code=0 -store_dir="/var/lib/permission-hardener" -dpkg_admindir_parameter_existing_mode="--admindir ${store_dir}/existing_mode" -dpkg_admindir_parameter_new_mode="--admindir ${store_dir}/new_mode" - -echo_wrapper_ignore() { - echo "INFO: run: $*" - "$@" 2>/dev/null || true -} - -echo_wrapper_silent_ignore() { - #echo "INFO: run: $@" - "$@" 2>/dev/null || true -} - -echo_wrapper_audit() { - echo "INFO: run: $*" - return_code=0 - "$@" || - { - return_code="$?" - exit_code=203 - echo "ERROR: above command failed with exit code '${return_code}'! calling function name: '${FUNCNAME[1]}'" >&2 - } -} - -echo_wrapper_silent_audit() { - #echo "run (debugging): $@" - return_code=0 - "$@" || - { - return_code="$?" - exit_code=204 - echo "ERROR: above command '$*' failed with exit code '${return_code}'! calling function name: '${FUNCNAME[1]}'" >&2 - } -} - -make_store_dir(){ - mkdir --parents "${store_dir}/private" - mkdir --parents "${store_dir}/existing_mode" - mkdir --parents "${store_dir}/new_mode" -} - -sanity_tests() { - echo_wrapper_silent_audit which \ - capsh getcap setcap stat find dpkg-statoverride getent xargs grep 1>/dev/null -} - -add_nosuid_statoverride_entry() { - local fso_to_process - fso_to_process="${fso}" - local should_be_counter - should_be_counter="$(find "${fso_to_process}" -perm /u=s,g=s | wc -l)" || true - local counter_actual - counter_actual=0 - - local line - while read -r line; do - true "line: ${line}" - counter_actual="$((counter_actual + 1))" - - local arr file_name existing_mode existing_owner existing_group - IFS=" " read -r -a arr <<< "${line}" - file_name="${arr[0]}" - existing_mode="${arr[1]}" - existing_owner="${arr[2]}" - existing_group="${arr[3]}" - - if test "${#arr[@]}" = 0; then - echo "ERROR: arr is empty. line: '${line}'" >&2 - continue - fi - if test -z "${file_name}"; then - echo "ERROR: file_name is empty. line: '${line}'" >&2 - continue - fi - if test -z "${existing_mode}"; then - echo "ERROR: existing_mode is empty. line: '${line}'" >&2 - continue - fi - if test -z "${existing_owner}"; then - echo "ERROR: existing_owner is empty. line: '${line}'" >&2 - continue - fi - if test -z "${existing_group}"; then - echo "ERROR: existing_group is empty. line: '${line}'" >&2 - continue - fi - - ## -h file True if file is a symbolic Link. - ## -u file True if file has its set-user-id bit set. - ## -g file True if file has its set-group-id bit set. - - if test -h "${file_name}"; then - ## https://forums.whonix.org/t/disable-suid-binaries/7706/14 - true "skip symlink: ${file_name}" - continue - fi - - if test -d "${file_name}"; then - true "skip directory: ${file_name}" - continue - fi - - local setuid setuid_output setsgid setsgid_output - setuid="" - setuid_output="" - if test -u "${file_name}"; then - setuid=true - setuid_output="set-user-id" - fi - setsgid="" - setsgid_output="" - if test -g "${file_name}"; then - setsgid=true - setsgid_output="set-group-id" - fi - - local setuid_or_setsgid - setuid_or_setsgid="" - if test "${setuid}" = "true" || test "${setsgid}" = "true"; then - setuid_or_setsgid=true - fi - if test -z "${setuid_or_setsgid}"; then - continue - fi - - ## Remove suid / gid and execute permission for 'group' and 'others'. - ## Similar to: chmod og-ugx /path/to/filename - ## Removing execution permission is useful to make binaries such as 'su' - ## fail closed rather than fail open if suid was removed from these. - ## Do not remove read access since no security benefit and easier to - ## manually undo for users. - ## Are there suid or sgid binaries which are still useful if suid / sgid - ## has been removed from these? - new_mode="744" - - local is_exact_whitelisted - is_exact_whitelisted="" - for white_list_entry in ${exact_white_list}; do - if test "${file_name}" = "${white_list_entry}"; then - is_exact_whitelisted="true" - ## Stop looping through the whitelist. - break - fi - done - - local is_match_whitelisted - is_match_whitelisted="" - for matchwhite_list_entry in ${match_white_list}; do - if echo "${file_name}" | grep --quiet --fixed-strings "${matchwhite_list_entry}"; then - is_match_whitelisted="true" - ## Stop looping through the match_white_list. - break - fi - done - - local is_disable_whitelisted - is_disable_whitelisted="" - for disablematch_list_entry in ${disable_white_list:-}; do - if echo "${file_name}" | grep --quiet --fixed-strings "${disablematch_list_entry}"; then - is_disable_whitelisted="true" - ## Stop looping through the disablewhitelist. - break - fi - done - - if test "${whitelists_disable_all:-}" = "true"; then - true "INFO: whitelists_disable_all=true - ${setuid_output} ${setsgid_output} found - file_name: '${file_name}' | existing_mode: '${existing_mode}'" - elif test "${is_disable_whitelisted}" = "true"; then - true "INFO: white list disabled - ${setuid_output} ${setsgid_output} found - file_name: '${file_name}' | existing_mode: '${existing_mode}'" - else - if test "${is_exact_whitelisted}" = "true"; then - true "INFO: SKIP whitelisted - ${setuid_output} ${setsgid_output} found - file_name: '${file_name}' | existing_mode: '${existing_mode}'" - continue - fi - if test "${is_match_whitelisted}" = "true"; then - true "INFO: SKIP matchwhitelisted - ${setuid_output} ${setsgid_output} found - file_name: '${file_name}' | existing_mode: '${existing_mode}' | matchwhite_list_entry: '${matchwhite_list_entry}'" - continue - fi - fi - - echo "INFO: ${setuid_output} ${setsgid_output} found - file_name: '${file_name}' | existing_mode: '${existing_mode}' | new_mode: '${new_mode}'" - - # shellcheck disable=SC2086 - if dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --list "${file_name}" >/dev/null; then - true "OK Existing mode already saved previously. Not saving again." - else - ## Save existing_mode in separate database. - ## Not using --update as not intending to enforce existing_mode. - # shellcheck disable=SC2086 - echo_wrapper_silent_audit dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --add "${existing_owner}" "${existing_group}" "${existing_mode}" "${file_name}" - fi - - ## No need to check "dpkg-statoverride --list" for existing entries. - ## If existing_mode was correct already, we would not have reached this - ## point. Since existing_mode is incorrect, remove from dpkg-statoverride - ## and re-add. - - ## Remove from real database. - echo_wrapper_silent_ignore dpkg-statoverride --remove "${file_name}" - - ## Remove from separate database. - # shellcheck disable=SC2086 - echo_wrapper_silent_ignore dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --remove "${file_name}" - - ## Add to real database and use --update to make changes on disk. - echo_wrapper_audit dpkg-statoverride --add --update "${existing_owner}" "${existing_group}" "${new_mode}" "${file_name}" - - ## Not using --update as this is only for recording. - # shellcheck disable=SC2086 - echo_wrapper_silent_audit dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --add "${existing_owner}" "${existing_group}" "${new_mode}" "${file_name}" - - ## /usr/lib will hit ARG_MAX if using bash 'shopt -s globstar' and '/usr/lib/**'. - ## Using 'find' with '-perm /u=s,g=s' is faster and avoids ARG_MAX. - ## https://forums.whonix.org/t/disable-suid-binaries/7706/17 - done < <(find "${fso_to_process}" -perm /u=s,g=s -print0 | xargs -I{} -0 stat -c "%n %a %U %G" {}) - - ## Sanity test. - if test ! "${should_be_counter}" = "${counter_actual}"; then - echo "INFO: fso_to_process: '${fso_to_process}' | counter_actual : '${counter_actual}'" - echo "INFO: fso_to_process: '${fso_to_process}' | should_be_counter: '${should_be_counter}'" - exit_code=202 - echo "ERROR: counter does not check out." >&2 - fi -} - -set_file_perms() { - true "INFO: START parsing config_file: '${config_file}'" - local line - while read -r line || test -n "${line}"; do - if test -z "${line}"; then - continue - fi - - if [[ "${line}" =~ ^# ]]; then - continue - fi - - if [[ "${line}" =~ [0-9a-zA-Z/] ]]; then - true "OK line contains only white listed characters." - else - exit_code=200 - echo "ERROR: cannot parse line with invalid character. line: '${line}'" >&2 - ## Safer to exit with error in this case. - ## https://forums.whonix.org/t/disable-suid-binaries/7706/59 - exit "${exit_code}" - fi - - if test "${line}" = 'whitelists_disable_all=true'; then - whitelists_disable_all=true - echo "INFO: whitelists_disable_all=true - all whitelists disabled." - continue - fi - - #global fso - local mode_from_config owner_from_config group_from_config capability_from_config - if ! read -r fso mode_from_config owner_from_config group_from_config capability_from_config <<<"${line}"; then - exit_code=201 - echo "ERROR: cannot parse. line: '${line}'" >&2 - ## Debugging. - du -hs /tmp || true - echo "test -w /tmp: '$(test -w /tmp)'" >&2 || true - ## Safer to exit with error in this case. - ## https://forums.whonix.org/t/disable-suid-binaries/7706/59 - exit "${exit_code}" - fi - - ## Debugging. - #echo "line: '${line}'" - #echo "fso: '${fso}'" - #echo "mode_from_config: '${mode_from_config}'" - #echo "owner_from_config: '${owner_from_config}'" - - local fso_without_trailing_slash - fso_without_trailing_slash="${fso%/}" - - if test "${mode_from_config}" = "disablewhitelist"; then - ## TODO: test/add white spaces inside file name support - disable_white_list+="${fso} " - continue - fi - - if test "${mode_from_config}" = "exactwhitelist"; then - ## TODO: test/add white spaces inside file name support - exact_white_list+="${fso} " - continue - fi - - if test "${mode_from_config}" = "matchwhitelist"; then - ## TODO: test/add white spaces inside file name support - match_white_list+="${fso} " - continue - fi - - if test ! -e "${fso}"; then - true "INFO: fso: '${fso}' - does not exist. This is likely normal." - continue - fi - - ## Use dpkg-statoverride so permissions are not reset during upgrades. - - if test "${mode_from_config}" = "nosuid"; then - ## If mode_from_config is "nosuid" the config does not set owner and - ## group. Therefore do not enforce owner/group check. - add_nosuid_statoverride_entry - else - local string_length_of_mode_from_config - string_length_of_mode_from_config="${#mode_from_config}" - if test "${string_length_of_mode_from_config}" -gt "4"; then - echo "ERROR: Mode '${mode_from_config}' is invalid!" >&2 - continue - fi - if test "${string_length_of_mode_from_config}" -lt "3"; then - echo "ERROR: Mode '${mode_from_config}' is invalid!" >&2 - continue - fi - - if ! grep --quiet --fixed-strings "${owner_from_config}:" "${store_dir}/private/passwd"; then - echo "ERROR: owner_from_config '${owner_from_config}' does not exist!" >&2 - continue - fi - - if ! grep --quiet --fixed-strings "${group_from_config}:" "${store_dir}/private/group"; then - echo "ERROR: group_from_config '${group_from_config}' does not exist!" >&2 - continue - fi - - local mode_for_grep - mode_for_grep="${mode_from_config}" - first_character_of_mode_from_config="${mode_from_config::1}" - if test "${first_character_of_mode_from_config}" = "0"; then - ## Remove leading '0'. - mode_for_grep="${mode_from_config:1}" - fi - - local stat_output - stat_output="" - if ! stat_output="$(stat -c "%n %a %U %G" "${fso_without_trailing_slash}")"; then - echo "ERROR: failed to run 'stat' for fso_without_trailing_slash: '${fso_without_trailing_slash}'!" >&2 - continue - fi - - local arr file_name existing_mode existing_owner existing_group - IFS=" " read -r -a arr <<< "${stat_output}" - file_name="${arr[0]}" - existing_mode="${arr[1]}" - existing_owner="${arr[2]}" - existing_group="${arr[3]}" - - if test "${#arr[@]}" = 0; then - echo "ERROR: arr is empty. stat_output: '${stat_output}' | line: '${line}'" >&2 - continue - fi - if test -z "${file_name}"; then - echo "ERROR: file_name is empty. stat_output: '${stat_output}' | line: '${line}'" >&2 - continue - fi - if test -z "${existing_mode}"; then - echo "ERROR: existing_mode is empty. stat_output: '${stat_output}' | line: '${line}'" >&2 - continue - fi - if test -z "${existing_owner}"; then - echo "ERROR: existing_owner is empty. stat_output: '${stat_output}' | line: '${line}'" >&2 - continue - fi - if test -z "${existing_group}"; then - echo "ERROR: ${existing_group} is empty. stat_output: '${stat_output}' | line: '${line}'" >&2 - continue - fi - - ## Check there is an entry for the fso. - ## - ## example: dpkg-statoverride --list | grep /home - ## output: - ## root root 755 /home - ## - ## dpkg-statoverride does not show leading '0'. - local dpkg_statoverride_list_output="" - local dpkg_statoverride_list_exit_code=0 - dpkg_statoverride_list_output="$(dpkg-statoverride --list "${fso_without_trailing_slash}")" || { - dpkg_statoverride_list_exit_code=$? - true - } - - if test "${dpkg_statoverride_list_exit_code}" = "0"; then - true "There is an fso entry. Check if owner/group/mode match." - local grep_line - grep_line="${owner_from_config} ${group_from_config} ${mode_for_grep} ${fso_without_trailing_slash}" - if echo "${dpkg_statoverride_list_output}" | grep --quiet --fixed-strings "${grep_line}"; then - true "OK The owner/group/mode matches. No further action required." - else - true "The owner/group/mode do not match, therefore remove and re-add the entry to update it." - ## fso_without_trailing_slash instead of fso to prevent - ## "dpkg-statoverride: warning: stripping trailing /" - - # shellcheck disable=SC2086 - if dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --list "${fso_without_trailing_slash}" >/dev/null; then - true "OK Existing mode already saved previously. No need to save again." - else - ## Save existing_mode in separate database. - ## Not using --update as not intending to enforce existing_mode. - # shellcheck disable=SC2086 - echo_wrapper_silent_audit dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --add "${existing_owner}" "${existing_group}" "${existing_mode}" "${fso_without_trailing_slash}" - fi - - # shellcheck disable=SC2086 - echo_wrapper_silent_ignore dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --remove "${fso_without_trailing_slash}" - - ## Remove from and add to real database. - echo_wrapper_silent_ignore dpkg-statoverride --remove "${fso_without_trailing_slash}" - echo_wrapper_audit dpkg-statoverride --add --update "${owner_from_config}" "${group_from_config}" "${mode_from_config}" "${fso_without_trailing_slash}" - - ## Save in separate database. - ## Not using --update as this is only for saving. - # shellcheck disable=SC2086 - echo_wrapper_silent_audit dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --add "${owner_from_config}" "${group_from_config}" "${mode_from_config}" "${fso_without_trailing_slash}" - fi - else - true "There is no fso entry. Therefore add one." - - # shellcheck disable=SC2086 - if dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --list "${fso_without_trailing_slash}" >/dev/null; then - true "OK Existing mode already saved previously. No need to save again." - else - ## Save existing_mode in separate database. - ## Not using --update as not intending to enforce existing_mode. - # shellcheck disable=SC2086 - echo_wrapper_silent_audit dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --add "${existing_owner}" "${existing_group}" "${existing_mode}" "${fso_without_trailing_slash}" - fi - - ## Add to real database. - echo_wrapper_audit dpkg-statoverride --add --update "${owner_from_config}" "${group_from_config}" "${mode_from_config}" "${fso_without_trailing_slash}" - - ## Save in separate database. - ## Not using --update as this is only for saving. - # shellcheck disable=SC2086 - echo_wrapper_silent_audit dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --add "${owner_from_config}" "${group_from_config}" "${mode_from_config}" "${fso_without_trailing_slash}" - fi - fi - if test -z "${capability_from_config}"; then - continue - fi - - if test "${capability_from_config}" = "none"; then - ## https://forums.whonix.org/t/disable-suid-binaries/7706/45 - ## sudo setcap -r /bin/ping 2>/dev/null - ## Failed to set capabilities on file '/bin/ping' (No data available) - ## The value of the capability argument is not permitted for a file. Or - ## the file is not a regular (non-symlink) file - ## Therefore use echo_wrapper_ignore. - echo_wrapper_ignore setcap -r "${fso}" - getcap_output="$(getcap "${fso}")" - if test -n "${getcap_output}"; then - exit_code=205 - echo "ERROR: removing capabilities for fso '${fso}' failed!" >&2 - continue - fi - else - if ! capsh --print | grep --fixed-strings "Bounding set" | grep --quiet "${capability_from_config}"; then - echo "ERROR: capability_from_config '${capability_from_config}' does not exist!" >&2 - continue - fi - - ## feature request: dpkg-statoverride: support for capabilities - ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502580 - echo_wrapper_audit setcap "${capability_from_config}+ep" "${fso}" - fi - done <"${config_file}" - true "INFO: END parsing config_file: '${config_file}'" -} - -parse_config_folder() { - touch "${store_dir}/private/passwd" - chmod og-rwx "${store_dir}/private/passwd" - touch "${store_dir}/private/group" - chmod og-rwx "${store_dir}/private/group" - - local passwd_file_contents_temp - ## Query contents of password and group databases only once and buffer them - ## - ## If we don't buffer we sometimes get incorrect results when checking for - ## entries using 'if getent passwd | grep --quiet '^root:'; ...' since - ## 'grep' exits after the first match in this case causing 'getent' to - ## receive SIGPIPE, which then fails the pipeline since 'set -o pipefail' is - ## set for this script. - passwd_file_contents_temp=$(getent passwd) - echo "${passwd_file_contents_temp}" | tee "${store_dir}/private/passwd" >/dev/null - group_file_contents_temp=$(getent group) - echo "${group_file_contents_temp}" | tee "${store_dir}/private/group" >/dev/null - - #passwd_file_contents="$(cat "${store_dir}/private/passwd")" - #group_file_contents="$(cat "${store_dir}/private/group")" - - shopt -s nullglob - for config_file in \ - /etc/permission-hardener.d/*.conf \ - /usr/local/etc/permission-hardener.d/*.conf \ - /etc/permission-hardening.d/*.conf \ - /usr/local/etc/permission-hardening.d/*.conf - do - set_file_perms - done -} - -apply() { - check_root - make_store_dir - sanity_tests - parse_config_folder - - echo "\ -INFO: To compare the current and previous permission modes: - Install 'meld' (or preferred diff tool) for comparison of file mode changes: - sudo apt install --no-install-recommends meld - - Use 'meld' or another diff tool to view the differences: - meld ${store_dir}/existing_mode/statoverride ${store_dir}/new_mode/statoverride" -} - -spare() { - check_root - make_store_dir - - remove_file="${1}" - exit_code=0 - dpkg_admindir_parameter_existing_mode="--admindir ${store_dir}/existing_mode" - dpkg_admindir_parameter_new_mode="--admindir ${store_dir}/new_mode" - - if test ! -f "${store_dir}/existing_mode/statoverride"; then - return 0 - fi - - local line - while read -r line; do - ## example line: - ## root root 4755 /usr/lib/eject/dmcrypt-get-device - - local owner group mode file_name - if ! read -r owner group mode file_name <<< "${line}"; then - exit_code=201 - echo "ERROR: cannot parse line: ${line}" >&2 - continue - fi - true "owner: '${owner}' group: '${group}' mode: '${mode}' file_name: '${file_name}'" - - if test "${remove_file}" = "all"; then - verbose="" - remove_one=false - else - if test "${remove_file}" = "${file_name}"; then - verbose="--verbose" - remove_one=true - echo "${remove_one}" | tee "${store_dir}/remove_one" >/dev/null - else - echo "false" | tee "${store_dir}/remove_one" >/dev/null - continue - fi - fi - - if test "${remove_one}" = "true"; then - set -o xtrace - fi - - if test -e "${file_name}"; then - # shellcheck disable=SC2086 - chown ${verbose} "${owner}:${group}" "${file_name}" || exit_code=202 - ## chmod need to be run after chown since chown removes suid. - ## https://unix.stackexchange.com/questions/53665/chown-removes-setuid-bit-bug-or-feature - # shellcheck disable=SC2086 - chmod ${verbose} "${mode}" "${file_name}" || exit_code=203 - else - echo "INFO: file_name: '${file_name}' - does not exist. This is likely normal." - fi - - dpkg-statoverride --remove "${file_name}" &>/dev/null || true - # shellcheck disable=SC2086 - dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --remove "${file_name}" &>/dev/null || true - # shellcheck disable=SC2086 - dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --remove "${file_name}" &>/dev/null || true - - if test "${remove_one}" = "true"; then - set +o xtrace - break - fi - - done < "${store_dir}/existing_mode/statoverride" - - if test ! "${remove_file}" = "all"; then - if test "$(cat "${store_dir}/remove_one")" = "false"; then - echo "INFO: no file was removed. - - File '${remove_file}' has not been removed from SUID Disabler and Permission Hardener during this invocation of this program. - - Note: This is expected if already done earlier. - - Note: This program expects the full path to the file. Example: - $0 disable /usr/bin/newgrp - - The following syntax will not work: - $0 disable program-name - - The following example will not work: - $0 disable newgrp - - To remove all: - $0 disable all - - This change might not be permanent. For full instructions, see: - https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener - - To view list of changed by SUID Disabler and Permission Hardener: - https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#View_List_of_Permissions_Changed_by_SUID_Disabler_and_Permission_Hardener - - For re-enabling any specific SUID binary: - https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Re-Enable_Specific_SUID_Binaries - - For completely disabling SUID Disabler and Permission Hardener: - https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Disable_SUID_Disabler_and_Permission_Hardener" - fi - fi -} - -check_root(){ - if test "$(id -u)" != "0"; then - echo "ERROR: Not running as root, aborting." - exit 1 - fi -} - -usage(){ - echo "Usage: ${0##*/} enable - ${0##*/} disable [FILE|all] - -Examples: - ${0##*/} enable - ${0##*/} disable all - ${0##*/} disable /usr/bin/newgrp" >&2 - exit "${1}" -} - -case "${1:-}" in - enable) shift; apply "$@";; - disable) - shift - case "${1:-}" in - "") usage 1;; - *) spare "${1}";; - esac - ;; - -h|--help) usage 0;; - *) usage 1;; -esac - -if test "${exit_code}" != "0"; then - echo "ERROR: Exiting with non-zero exit code: '${exit_code}'" >&2 -fi - -exit "${exit_code}" diff --git a/usr/bin/permission-hardener#security-misc-shared b/usr/bin/permission-hardener#security-misc-shared new file mode 100755 index 00000000..7e92e0a5 --- /dev/null +++ b/usr/bin/permission-hardener#security-misc-shared @@ -0,0 +1,1096 @@ +#!/bin/bash +# shellcheck disable=SC2076 + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## https://forums.whonix.org/t/disable-suid-binaries/7706 +## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 + +## dpkg-statoverride does not support end-of-options ("--"). + +## SC2076 is disabled because ShellCheck seems to think that any use of +## [[ ... =~ ... ]] is supposed to be a regex match. But [[ '...' =~ '...' ]] +## works very well for literal matching, and it is used that way extensively +## throughout this script. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## Constants +# shellcheck disable=SC2034 +log_level=notice +store_dir="/var/lib/permission-hardener-v2" +state_file="${store_dir}/existing_mode/statoverride" +dpkg_admindir_parameter_existing_mode="--admindir ${store_dir}/existing_mode" +dpkg_admindir_parameter_new_mode="--admindir ${store_dir}/new_mode" +delimiter="#permission-hardener-delimiter#" + +## Library imports +# shellcheck source=../../../helper-scripts/usr/libexec/helper-scripts/safe_echo.sh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/safe_echo.sh +# shellcheck source=../../../helper-scripts/usr/libexec/helper-scripts/log_run_die.sh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/log_run_die.sh +# shellcheck source=../../../helper-scripts/usr/libexec/helper-scripts/strings.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/strings.bsh + +## Functions +echo_wrapper_ignore() { + if [ "${1}" = 'verbose' ]; then + shift + log notice "Executing: $*" + elif [ "${1}" = 'silent' ]; then + shift + else + log error "Unrecognized command '${1}'! calling function name: '${FUNCNAME[1]}'" >&2 + return + fi + "$@" 2>/dev/null || true +} + +echo_wrapper_audit() { + local return_code + if [ "${1}" = 'verbose' ]; then + shift + log notice "Executing: $*" + elif [ "${1}" = 'silent' ]; then + shift + else + log error "Unrecognized command '${1}'! calling function name: '${FUNCNAME[1]}'" >&2 + return + fi + return_code=0 + "$@" || + { + return_code="$?" + exit_code=203 + log error "Command '$*' failed with exit code '${return_code}'! calling function name: '${FUNCNAME[1]}'" >&2 + } +} + +## Some tools may fail on newlines and even variable assignment to array may +## fail if a variable that will be assigned to an array element contains +## characters that are used as delimiters. +block_newlines() { + local newline_variable newline_value + newline_variable="${1:-}" + newline_value="${2:-}" + ## dpkg-statoverride: error: path may not contain newlines + if [[ "${newline_value}" != "${newline_value//$'\n'/NEWLINE}" ]]; then + log warn "Skipping ${newline_variable} that contains newlines: '${newline_value}'" >&2 + return 1 + fi +} + +output_stat() { + local file_name stat_output stat_output_newlined hardlink_count + declare -a arr + file_name="${1:-}" + + if [ -z "${file_name}" ]; then + log error "File name is empty. file_name: '${file_name}'" >&2 + return 1 + fi + + if ! block_newlines file "${file_name}"; then + existing_mode='' + existing_owner='' + existing_group='' + file_name_from_stat='' + return 0 + fi + + if [ ! -e "${file_name}" ]; then + log info "File does not exist. file_name: '${file_name}'" >&2 + existing_mode='' + existing_owner='' + existing_group='' + file_name_from_stat='' + return 0 + fi + + if ! stat_output="$(stat -L \ + --format="%a${delimiter}%U${delimiter}%G${delimiter}%n${delimiter}%h${delimiter}" \ + -- "${file_name}")"; then + log error "Failed to run 'stat' on file: '${file_name}'!" >&2 + return 1 + fi + + if [ -z "${stat_output}" ]; then + log error "stat_output is empty. +File name: '${file_name}' +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + stat_output_newlined="$(printf '%s\n' "${stat_output//${delimiter}/$'\n'}")" + + if [ -z "${stat_output_newlined}" ]; then + log error "stat_output_newlined is empty. +File name: '${file_name}' +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + readarray -t arr <<< "${stat_output_newlined}" + + if [ "${#arr[@]}" = '0' ]; then + log error "Array length is 0. +File name: '${file_name}' +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + existing_mode="${arr[0]}" + existing_owner="${arr[1]}" + existing_group="${arr[2]}" + file_name_from_stat="${arr[3]}" + hardlink_count="${arr[4]}" + + if ! is_whole_number "${hardlink_count}"; then + log error "\ +hardlink_count returned by stat is not an integer. +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +hardlink_count: '${hardlink_count}' +" >&2 + return 1 + fi + + if [ "${file_name}" != "${file_name_from_stat}" ]; then + log error "\ +File name is different from file name received from stat: +File name: '${file_name}' +File name from stat: '${file_name_from_stat}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + ## We can't handle files with hardlinks because figuring out all of the files + ## in a "hardlink pool" requires scanning the whole filesystem, which would + ## result in an unacceptable performance hit for this script. We don't check + ## directory hardlinks since directories can't have traditional hardlinks. + if [ ! -d "${file_name_from_stat}" ]; then + if (( hardlink_count > 1 )); then + log info "File has unexpected hardlinks, cannot handle. file_name: '${file_name}'" >&2 + existing_mode='' + existing_owner='' + existing_group='' + file_name_from_stat='' + return 0 + fi + fi + + if [ -z "${existing_mode}" ]; then + log error "Existing mode is empty. Stat output: '${stat_output}', line: '${processed_config_line}'" >&2 + return 1 + fi + if [ -z "${existing_owner}" ]; then + log error "Existing owner is empty. Stat output: '${stat_output}', line: '${processed_config_line}'" >&2 + return 1 + fi + if [ -z "${existing_group}" ]; then + log error "Existing group is empty. Stat output: '${stat_output}', line: '${processed_config_line}'" >&2 + return 1 + fi + + ## If a symlink was passed as input, return the original file's path rather + ## than the symlink to avoid problems stemming from using the wrong path + if [ -h "${file_name_from_stat}" ]; then + file_name_from_stat="$(realpath "${file_name_from_stat}")" + fi +} + +print_usage(){ + safe_echo "Usage: ${0##*/} enable + ${0##*/} disable [FILE|all] + ${0##*/} print-policy + ${0##*/} print-state + ${0##*/} print-policy-applied-state + ${0##*/} print-diagnostics + +Examples: + ${0##*/} enable + ${0##*/} disable all + ${0##*/} disable /usr/bin/newgrp" >&2 +} + +add_to_policy() { + local file_name file_mode file_owner file_group updated_entry policy_idx \ + file_capabilities + file_name="${1:-}" + file_mode="${2:-}" + file_owner="${3:-}" + file_group="${4:-}" + file_capabilities="${5:-}" + updated_entry=false + + if [ -z "${file_name}" ]; then + exit_code=207 + log error "Attempted to add a policy entry with an empty filename! file_mode='${file_mode}' file_onwer='${file_owner}' file_group='${file_group}' file_capabilities='${file_capabilities}'" >&2 + exit "${exit_code}" + fi + + if [ -h "${file_name}" ]; then + file_name="$(realpath "${file_name}")" || return 1 + fi + + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + if [ "${policy_file_list[policy_idx]}" = "${file_name}" ]; then + policy_mode_list[policy_idx]="${file_mode}" + policy_user_owner_list[policy_idx]="${file_owner}" + policy_group_owner_list[policy_idx]="${file_group}" + policy_capability_list[policy_idx]="${file_capabilities}" + updated_entry=true + break + fi + done + + if [ "${updated_entry}" != 'true' ]; then + policy_file_list+=( "${file_name}" ) + policy_mode_list+=( "${file_mode}" ) + policy_user_owner_list+=( "${file_owner}" ) + policy_group_owner_list+=( "${file_group}" ) + policy_capability_list+=( "${file_capabilities}" ) + fi +} + +check_nosuid_whitelist() { + local target_file match_white_list_entry + + target_file="${1:-}" + + ## Handle whitelists, if we're supposed to + [ "${whitelists_disable_all}" = 'true' ] && return 0 + + ## literal matching is intentional here + [[ " ${policy_disable_white_list[*]} " =~ " ${target_file} " ]] && return 0 + + ## literal matching is intentional here too + [[ " ${policy_exact_white_list[*]} " =~ " ${target_file} " ]] && return 1 + + for match_white_list_entry in "${policy_match_white_list[@]}"; do + if [[ "${target_file}" == *"${match_white_list_entry}"* ]]; then + return 1 + fi + done + + return 0 +} + +load_early_nosuid_policy() { + local target_file find_list_item + + target_file="${1:-}" + + # shellcheck disable=SC2185 + while IFS="" read -r -d "" find_list_item; do + check_nosuid_whitelist "${find_list_item}" || continue + + ## sets: + ## exiting_mode + ## existing_owner + ## existing_group + output_stat "${find_list_item}" + if [ -z "${file_name_from_stat}" ]; then + continue + fi + + ## -h file True if file is a symbolic link. + if [ -h "${find_list_item}" ]; then + ## https://forums.whonix.org/t/disable-suid-binaries/7706/14 + log info "Skip symlink: '${find_list_item}'" + continue + fi + + if [ -d "${find_list_item}" ]; then + log info "Skip directory: '${find_list_item}'" + continue + fi + + ## Remove suid / gid and execute permission for 'group' and 'others'. + ## Similar to: chmod og-ugx /path/to/filename + ## Removing execution permission is useful to make binaries such as 'su' + ## fail closed rather than fail open if suid was removed from these. + ## Do not remove read access since no security benefit and easier to + ## manually undo for users. + ## Are there suid or sgid binaries which are still useful if suid / sgid + ## has been removed from these? + local new_mode + new_mode='744' + + add_to_policy "${file_name_from_stat}" "${new_mode}" "${existing_owner}" \ + "${existing_group}" + done < <(safe_echo_nonewline "${target_file}" \ + | find -files0-from - -perm /u=s,g=s -print0) +} + +## If the "target file" matches the start of the state file name, that's a +## likely match. This is used by load_late_nosuid_policy for detecting info +## about files that need SUID-locked that are in the state. +match_dir() { + local base_str match_str base_arr match_arr base_idx + + base_str="${1}" + match_str="${2}" + if [ -z "${base_str}" ] || [ -z "${match_str}" ]; then + exit_code=207 + log error "Empty base_str or match_str provided to match_dir! base_str: '${base_str}' match_str: '${match_str}'" >&2 + exit "${exit_code}" + fi + [[ "${base_str}" =~ '//' ]] && return 1 + [[ "${match_str}" =~ '//' ]] && return 1 + + IFS='/' read -r -a base_arr <<< "${base_str}" + IFS='/' read -r -a match_arr <<< "${match_str}" + (( ${#base_arr[@]} > ${#match_arr[@]} )) && return 1 + + for (( base_idx=0; base_idx < ${#base_arr[@]}; base_idx++ )); do + if [ "${base_arr[base_idx]}" != "${match_arr[base_idx]}" ]; then + return 1 + fi + done + + return 0 +} + +load_late_nosuid_policy() { + local target_file state_idx state_file_item state_user_owner_item \ + state_group_owner_item new_mode + + target_file="${1:-}" + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + check_nosuid_whitelist "${state_file_item}" || continue + + match_dir "${target_file}" "${state_file_item}" || continue + + if [ -h "${state_file_item}" ]; then + ## https://forums.whonix.org/t/disable-suid-binaries/7706/14 + log info "Skip symlink: '${state_file_item}'" + continue + fi + + if [ -d "${state_file_item}" ]; then + log info "Skip directory: '${state_file_item}'" + continue + fi + + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + new_mode='744' + add_to_policy "${state_file_item}" "${new_mode}" \ + "${state_user_owner_item}" "${state_group_owner_item}" + done +} + +load_state_without_policy() { + local line sf_owner sf_group sf_mode sf_path + + ## Load the state file from disk. + if [ -f "${state_file}" ]; then + while read -r line; do + read -r sf_owner sf_group sf_mode sf_path <<< "${line}" + if [ -z "${sf_path}" ]; then + log info \ + "Invalid number of fields in state file line: '${line}'. Skipping." + continue + fi + state_user_owner_list+=( "${sf_owner}" ) + state_group_owner_list+=( "${sf_group}" ) + state_mode_list+=( "${sf_mode}" ) + state_file_list+=( "${sf_path}" ) + done < "${state_file}" + fi +} + +load_state() { + ## Config format: + ## path options + ## where options is one of: + ## filemode user_owner group_owner [capability-setting] + ## [nosuid|exactwhitelist|matchwhitelist|disablewhitelist] + ## + ## Additionally, the special value 'whitelists_disable_all=true' is understood + ## to mean that all whitelisting should be ignored. + + local config_file line field_list policy_nosuid_file_item policy_file_item + local one_field field_count fso_name meta_list field_index hit_barrier + + ## Load configuration, deferring whitelist handling until later + for config_file in \ + /usr/lib/permission-hardener.d/*.conf \ + /etc/permission-hardener.d/*.conf \ + /usr/local/etc/permission-hardener.d/*.conf \ + /etc/permission-hardening.d/*.conf \ + /usr/local/etc/permission-hardening.d/*.conf + do + if [ ! -f "${config_file}" ]; then + continue + fi + + while read -r line; do + if [ -z "${line}" ]; then + true 'DEBUG: line is empty. Skipping.' + continue + fi + + if [[ "${line}" =~ ^\s*# ]]; then + continue + fi + + if [ "${line}" = 'whitelists_disable_all=true' ]; then + whitelists_disable_all=true + log info "whitelists_disable_all=true" + continue + fi + + if ! [[ "${line}" =~ ^[-0-9a-zA-Z._/[:space:]]*$ ]]; then + exit_code=200 + log error "Line contains invalid characters: '${line}'" >&2 + ## Safer to exit with error in this case. + ## https://forums.whonix.org/t/disable-suid-binaries/7706/59 + exit "${exit_code}" + fi + + processed_config_line="${line}" + + ## We can handle filenames with spaces. This is because the first item + ## after a filename is either an octal file mode or a keyword, and we + ## only support user/group names, not UIDs and GIDs, as owner + ## identifiers. This means that we can scan from right to left for the + ## furthest-right octal integer or keyword field and use it to separate + ## the filename from the rest of the options. (If usernames could + ## themselves be octal integers, this would break, but adduser.conf's + ## default NAME_REGEX forbids this. This is definitely a hack, but the + ## alternative is to change the format of the policy files, which would + ## break custom config for users. + ## + ## Do not attempt to reimplement this in a way that copes with usernames + ## that look identical to UIDs. Systems containing such usernames are + ## very broken and unsupported. + ## + ## 'read' will collapse consecutive spaces when splitting on spaces. + ## Convert spaces into newlines first, then split on newlines with a + ## loop. + field_list=() + while IFS= read -r one_field; do + field_list+=( "${one_field}" ) + done < <(printf '%s\n' "${line}" | tr ' ' '\n') + field_count="${#field_list[@]}" + + hit_barrier='false' + fso_name="" + meta_list=() + for (( field_index = field_count - 1; field_index >= 0; \ + field_index-- )); do + if [ "${hit_barrier}" = 'false' ]; then + if [[ "${field_list[field_index]}" =~ ^[0-7]{3,4}$ ]] \ + || [[ "${field_list[field_index]}" =~ ^(nosuid|exactwhitelist|matchwhitelist|disablewhitelist)$ ]]; then + hit_barrier='true' + fi + meta_list=( "${field_list[field_index]}" "${meta_list[@]}" ) + else + fso_name="${field_list[field_index]}${fso_name:+" ${fso_name}"}" + fi + done + + case "${#meta_list[@]}" in + 1|3|4) + true + ;; + *) + exit_code=200 + log error "Line contains an invalid number of fields: '${line}'" >&2 + exit "${exit_code}" + ;; + esac + + # Strip trailing slash if appropriate + fso_name="${fso_name%/}" + + case "${meta_list[0]}" in + 'exactwhitelist') + [ ! -e "${fso_name}" ] && continue + policy_exact_white_list+=( "${fso_name}" ) + continue + ;; + 'matchwhitelist') + policy_match_white_list+=( "${fso_name}" ) + continue + ;; + 'disablewhitelist') + policy_disable_white_list+=( "${fso_name}" ) + continue + ;; + 'nosuid') + [ ! -e "${fso_name}" ] && continue + policy_nosuid_file_list+=( "${fso_name}" ) + ;; + *) + [ ! -e "${fso_name}" ] && continue + add_to_policy "${fso_name}" "${meta_list[@]}" + ;; + esac + done < "${config_file}" + done + + ## We have to handle nosuid files at the end since the whitelist arrays need + ## built first. + for policy_nosuid_file_item in "${policy_nosuid_file_list[@]}"; do + load_early_nosuid_policy "${policy_nosuid_file_item}" + done + + load_state_without_policy + + ## Find any files in the policy that don't already have a matching file in + ## the state. Add those files to the state, and save them to the state file + ## as well. + for policy_file_item in "${policy_file_list[@]}"; do + if [[ " ${state_file_list[*]} " =~ " ${policy_file_item} " ]]; then + continue + fi + output_stat "${policy_file_item}" + if [ -z "${file_name_from_stat}" ]; then + continue + fi + state_file_list+=( "${file_name_from_stat}" ) + state_user_owner_list+=( "${existing_owner}" ) + state_group_owner_list+=( "${existing_group}" ) + state_mode_list+=( "${existing_mode}" ) + # shellcheck disable=SC2086 + echo_wrapper_audit silent dpkg-statoverride \ + ${dpkg_admindir_parameter_existing_mode} \ + --add "${existing_owner}" "${existing_group}" "${existing_mode}" \ + "${file_name_from_stat}" + done + + ## Fix up nosuid policies using state information + for policy_nosuid_file_item in "${policy_nosuid_file_list[@]}"; do + load_late_nosuid_policy "${policy_nosuid_file_item}" + done +} + +apply_policy() { + local policy_idx did_state_update state_idx + + ## Modify the in-memory state so that all items that the policy affects match + ## the policy. DO NOT save these changes to the state file! + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + did_state_update=false + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + if [ "${state_file_list[state_idx]}" = "${policy_file_list[policy_idx]}" ]; then + state_user_owner_list[state_idx]="${policy_user_owner_list[policy_idx]}" + state_group_owner_list[state_idx]="${policy_group_owner_list[policy_idx]}" + state_mode_list[state_idx]="${policy_mode_list[policy_idx]}" + did_state_update=true + break + fi + done + if [ "${did_state_update}" = 'false' ]; then + exit_code=206 + log error \ + "File exists in policy but not in state! File: '${policy_file_list[policy_idx]}'" + exit "${exit_code}" + fi + done +} + +commit_policy() { + local policy_idx state_idx state_file_item \ + state_user_owner_item state_group_owner_item \ + state_mode_item orig_main_statoverride_db orig_new_statoverride_db \ + policy_file_item policy_capability_item + + ## Check each file on the filesystem against the state, and update it if the + ## state does not match. Also ensure the consistency of the new_mode database + ## so that people can compare the original permissions of files with the new + ## permissions. + orig_main_statoverride_db="$(dpkg-statoverride --list)" || true + # shellcheck disable=SC2086 + orig_new_statoverride_db="$(dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --list)" || true + + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + state_mode_item="${state_mode_list[state_idx]}" + + ## Get rid of leading zeros, stat doesn't output them due to how we use it. + ## Using BASH_REMATCH is faster than sed. We capture all leading zeros into + ## one group, and the rest of the string into a second group. The second + ## group is the string we want. BASH_REMATCH[0] is the entire string, + ## BASH_REMATCH[1] is the first match that we want to discard, and + ## BASH_REMATCH[2] is the desired second group. + if [[ "${state_mode_item}" =~ ^(0*)(.*) ]]; then + state_mode_item="${BASH_REMATCH[2]}" + else + exit_code=208 + log error "'Impossible' regex match failure in commit_policy! Regex: '^(0*)(.*)' String (state_mode_item): '${state_mode_item}'" >&2 + exit "${exit_code}" + fi + + output_stat "${state_file_item}" + if [ -z "${file_name_from_stat}" ]; then + continue + fi + + if [ "${existing_owner}" != "${state_user_owner_item}" ] \ + || [ "${existing_group}" != "${state_group_owner_item}" ] \ + || [ "${existing_mode}" != "${state_mode_item}" ]; then + ## Anchor user/group lookups to line boundaries to prevent substring + ## matches (e.g. 'oot' must not match 'root:...') + if ! [[ $'\n'"${passwd_file_contents}" \ + =~ $'\n'"${state_user_owner_item}:" ]]; then + log error "Owner from config does not exist: '${state_user_owner_item}'" >&2 + continue + fi + + if ! [[ $'\n'"${group_file_contents}" \ + =~ $'\n'"${state_group_owner_item}:" ]]; then + log error "Group from config does not exist: '${state_group_owner_item}'" >&2 + continue + fi + ## Remove and reapply in main list + ## Anchor to file field and line boundary to prevent substring path + ## matches + if [[ "${orig_main_statoverride_db}"$'\n' \ + =~ [[:space:]]"${file_name_from_stat}"$'\n' ]]; then + echo_wrapper_ignore silent dpkg-statoverride --remove \ + "${file_name_from_stat}" + fi + echo_wrapper_audit verbose dpkg-statoverride --add --update \ + "${state_user_owner_item}" "${state_group_owner_item}" \ + "${state_mode_item}" "${file_name_from_stat}" + + ## Update item in secondary list + if [[ "${orig_new_statoverride_db}"$'\n' \ + =~ [[:space:]]"${file_name_from_stat}"$'\n' ]]; then + # shellcheck disable=SC2086 + echo_wrapper_ignore silent dpkg-statoverride \ + ${dpkg_admindir_parameter_new_mode} --remove \ + "${file_name_from_stat}" + fi + # shellcheck disable=SC2086 + echo_wrapper_audit verbose dpkg-statoverride \ + ${dpkg_admindir_parameter_new_mode} --add \ + "${state_user_owner_item}" "${state_group_owner_item}" \ + "${state_mode_item}" "${file_name_from_stat}" + fi + done + + ## Apply capability hardening, dpkg-statoverride can't handle this so we have + ## to do this manually + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + policy_file_item="${policy_file_list[policy_idx]}" + policy_capability_item="${policy_capability_list[policy_idx]}" + if [ -z "${policy_capability_item}" ]; then + continue + fi + + if [ "${policy_capability_item}" = 'none' ]; then + echo_wrapper_ignore verbose setcap -r "${policy_file_item}" + if [ -n "$(getcap -- "${policy_file_item}")" ]; then + exit_code=205 + log error \ + "Removing capabilities failed. File: '${policy_file_item}'" >&2 + continue + fi + else + if ! capsh --print \ + | grep --fixed-strings -- "Bounding set" \ + | grep -- "${policy_capability_item}" >/dev/null; then + log error \ + "Capability from config does not exist: '${policy_capability_item}'" \ + >&2 + continue + fi + + ## feature request: dpkg-statoverride: support for capabilities + ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502580 + echo_wrapper_audit verbose setcap "${policy_capability_item}+ep" \ + -- "${policy_file_item}" + fi + done + + log notice "\ +To compare the current and previous permission modes, install 'meld' (or preferred diff tool) for comparison of file mode changes: + sudo apt install --no-install-recommends meld + meld ${store_dir}/existing_mode/statoverride ${store_dir}/new_mode/statoverride" +} + +undo_policy_for_file() { + local undo_file state_idx state_file_item did_undo \ + undo_all verbose orig_main_statoverride_db orig_new_statoverride_db \ + state_user_owner_item state_group_owner_item state_mode_item + + undo_file="${1}" + undo_all=false + verbose=('--verbose') + if [ "${undo_file}" = 'all' ]; then + undo_all=true + verbose=() + fi + + if [ ! -f "${state_file}" ]; then + true 'DEBUG: State file does not exist, hardening was not applied before.' + return 0 + fi + + did_undo=false + + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + if [ "${undo_all}" = 'true' ]; then + undo_file="${state_file_item}" + fi + + if [ "${state_file_item}" = "${undo_file}" ]; then + orig_main_statoverride_db="$(dpkg-statoverride --list)" || true + # shellcheck disable=SC2086 + orig_new_statoverride_db="$(dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --list)" || true + + if [[ "${orig_main_statoverride_db}"$'\n' \ + =~ [[:space:]]"${undo_file}"$'\n' ]]; then + echo_wrapper_ignore silent dpkg-statoverride --remove \ + "${undo_file}" + fi + + if [[ "${orig_new_statoverride_db}"$'\n' \ + =~ [[:space:]]"${undo_file}"$'\n' ]]; then + # shellcheck disable=SC2086 + echo_wrapper_ignore silent dpkg-statoverride \ + ${dpkg_admindir_parameter_new_mode} --remove \ + "${undo_file}" + fi + + if [ -e "${undo_file}" ]; then + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + state_mode_item="${state_mode_list[state_idx]}" + chown "${verbose[@]}" -- "${state_user_owner_item}:${state_group_owner_item}" \ + "${undo_file}" || exit_code=202 + ## chmod needs to be run after chown since chown removes suid. + chmod "${verbose[@]}" "${state_mode_item}" "${undo_file}" || exit_code=203 + else + log info "File does not exist: '${undo_file}'" + fi + did_undo=true + + if [ "${undo_all}" = 'false' ]; then + break + fi + fi + done + + if [ "${did_undo}" = 'false' ]; then + log notice "The specified file is not hardened, leaving unchanged. + + File '${undo_file}' has not been removed from SUID Disabler and Permission Hardener during this invocation. This is expected if no policy was ever applied to the file before. + + This program expects the full path to the file. Example: + $0 disable /usr/bin/newgrp # absolute path: works + $0 disable newgrp # relative path: does not work + + To remove all: + $0 disable all + + This change might not be permanent. For full instructions, see: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener + + To view list of changed by SUID Disabler and Permission Hardener: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#View_List_of_Permissions_Changed_by_SUID_Disabler_and_Permission_Hardener + + For re-enabling any specific SUID binary: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Re-Enable_Specific_SUID_Binaries + + For completely disabling SUID Disabler and Permission Hardener: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Disable_SUID_Disabler_and_Permission_Hardener" + fi +} + +print_columns() { + local format_str + format_str='' + for _ in "$@"; do + format_str="${format_str}%s\t" + done + format_str="${format_str}\n" + ## Using a dynamically generated format string on purpose. + ## style-ok: printf-format + # shellcheck disable=SC2059 + printf "${format_str}" "$@" +} + +print_policy() { + local policy_idx + + print_columns 'File' 'User' 'Group' 'Mode' 'Capabilities' + + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + print_columns \ + "${policy_file_list[policy_idx]}" \ + "${policy_user_owner_list[policy_idx]}" \ + "${policy_group_owner_list[policy_idx]}" \ + "${policy_mode_list[policy_idx]}" \ + "${policy_capability_list[policy_idx]}" + done +} + +print_state() { + local state_idx + + print_columns 'File' 'User' 'Group' 'Mode' + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + print_columns \ + "${state_file_list[state_idx]}" \ + "${state_user_owner_list[state_idx]}" \ + "${state_group_owner_list[state_idx]}" \ + "${state_mode_list[state_idx]}" + done +} + +print_raw_policy_config() { + local config_file + for config_file in \ + /usr/lib/permission-hardener.d/*.conf \ + /etc/permission-hardener.d/*.conf \ + /usr/local/etc/permission-hardener.d/*.conf \ + /etc/permission-hardening.d/*.conf \ + /usr/local/etc/permission-hardening.d/*.conf + do + if [ ! -f "${config_file}" ]; then + continue + fi + printf '%s\n' "*** begin ${config_file} ***" + cat "${config_file}" + printf '%s\n' "*** end ${config_file} ***" + done +} + +print_raw_state() { + local state_file + for state_file in "${store_dir}/existing_mode/statoverride" \ + "${store_dir}/new_mode/statoverride"; do + printf '%s\n' "*** begin ${state_file} ***" + if [ -f "${state_file}" ]; then + cat "${state_file}" + else + printf '%s\n' '(file does not exist)' + fi + printf '%s\n' "*** end ${state_file} ***" + done +} + +print_fs_audit() { + local state_idx state_file_item state_user_owner_item state_group_owner_item \ + state_mode_item + + printf '%s\n' 'Legend:' + printf '%s\n' '... - Warning about an unusual, but not necessarily wrong, condition' + printf '%s\n' '!!! - Warning about an unusual and definitely wrong condition' + printf '%s\n' '*** - File permission data, actual state on filesystem is consistent with policy' + printf '%s\n' '^^^ - File permission data, actual state on filesystem is inconsistent with policy' + printf '%s\n' 'vvv - File permissions specified by state, always shown after a ^^^ item' + printf '%s\n' '' + + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + state_mode_item="${state_mode_list[state_idx]}" + + ## Get rid of leading zeros, stat doesn't output them due to how we use it. + ## Using BASH_REMATCH is faster than sed. We capture all leading zeros into + ## one group, and the rest of the string into a second group. The second + ## group is the string we want. BASH_REMATCH[0] is the entire string, + ## BASH_REMATCH[1] is the first match that we want to discard, and + ## BASH_REMATCH[2] is the desired second group. + if [[ "${state_mode_item}" =~ ^(0*)(.*) ]]; then + state_mode_item="${BASH_REMATCH[2]}" + else + exit_code=208 + log error "'Impossible' regex match failure in print_fs_audit! Regex: '^(0*)(.*)' String (state_mode_item): '${state_mode_item}'" >&2 + exit "${exit_code}" + fi + + output_stat "${state_file_item}" + if [ -z "${file_name_from_stat}" ]; then + printf '%s\n' "... '${state_file_item}' does not exist or has multiple hardlinks" + continue + fi + + if [ "${existing_owner}" != "${state_user_owner_item}" ] \ + || [ "${existing_group}" != "${state_group_owner_item}" ] \ + || [ "${existing_mode}" != "${state_mode_item}" ]; then + if ! [[ $'\n'"${passwd_file_contents}" \ + =~ $'\n'"${state_user_owner_item}:" ]]; then + printf '%s\n' "!!! Owner from config does not exist: '${state_user_owner_item}'" + continue + fi + + if ! [[ $'\n'"${group_file_contents}" \ + =~ $'\n'"${state_group_owner_item}:" ]]; then + printf '%s\n' "!!! Group from config does not exist: '${state_group_owner_item}'" + continue + fi + + printf '%s\n' "^^^ ${file_name_from_stat} ${existing_owner}:${existing_group} ${existing_mode}" + printf '%s\n' "vvv ${file_name_from_stat} ${state_user_owner_item}:${state_group_owner_item} ${state_mode_item}" + else + printf '%s\n' "*** ${file_name_from_stat} ${existing_owner}:${existing_group} ${existing_mode}" + fi + done +} + +reset_global_vars() { + ## Global variables + policy_file_list=() + policy_user_owner_list=() + policy_group_owner_list=() + policy_mode_list=() + policy_capability_list=() + policy_exact_white_list=() + policy_match_white_list=() + policy_disable_white_list=() + policy_nosuid_file_list=() + state_file_list=() + state_user_owner_list=() + state_group_owner_list=() + state_mode_list=() + whitelists_disable_all=false + existing_mode='' + existing_owner='' + existing_group='' + processed_config_line='' + file_name_from_stat='' + passwd_file_contents="$(getent passwd)" + group_file_contents="$(getent group)" + exit_code=0 +} + +reset_global_vars + +## Setup and sanity checking +if [ "$(id -u)" != '0' ]; then + log error "Not running as root, aborting." + exit 1 +fi + +mkdir --parents "${store_dir}/existing_mode" +mkdir --parents "${store_dir}/new_mode" + +echo_wrapper_audit silent which capsh getcap setcap stat find \ + dpkg-statoverride getent grep 1>/dev/null + +## Command parsing and execution +case "${1:-}" in + enable) + shift + load_state + apply_policy + commit_policy + ;; + disable) + shift + case "${1:-}" in + "") + print_usage + exit 1 + ;; + *) + load_state_without_policy + undo_policy_for_file "${1}" + ;; + esac + ;; + print-policy) + load_state + print_policy + ;; + print-state) + load_state + print_state + ;; + print-policy-applied-state) + load_state + apply_policy + print_state + ;; + print-diagnostics) + printf '%s\n' '=== BEGIN PERMISSION-HARDENER DIAGNOSTICS ===' + + printf '%s\n' '--- BEGIN State without policy ---' + load_state_without_policy + print_state + printf '%s\n' '--- END State without policy ---' + + reset_global_vars + + printf '%s\n' '--- BEGIN Policy without state ---' + load_state + print_policy + printf '%s\n' '--- END Policy without state ---' + + reset_global_vars + + printf '%s\n' '--- BEGIN Policy-applied-state ---' + load_state + apply_policy + print_state + printf '%s\n' '--- END Policy-applied state ---' + + reset_global_vars + + printf '%s\n' '--- BEGIN Master dpkg-statoverride database ---' + dpkg-statoverride --list + printf '%s\n' '--- END Master dpkg-statoverride database ---' + + printf '%s\n' '--- BEGIN Raw policy configuration ---' + print_raw_policy_config + printf '%s\n' '--- END Raw policy configuration ---' + + printf '%s\n' '--- BEGIN Raw state data ---' + print_raw_state + printf '%s\n' '--- END Raw state data ---' + + printf '%s\n' '--- BEGIN Filesystem state audit ---' + load_state + apply_policy + print_fs_audit + printf '%s\n' '--- END Filesystem state audit ---' + + printf '%s\n' '=== END PERMISSION-HARDENER DIAGNOSTICS ===' + ;; + -h|--help) + print_usage + exit 0 + ;; + *) + print_usage + exit 1 + ;; +esac + +## Exit +if test "${exit_code}" != "0"; then + log error "Exiting with non-zero exit code: '${exit_code}'" >&2 +fi + +exit "${exit_code}" diff --git a/usr/bin/pkexec.security-misc b/usr/bin/pkexec.security-misc deleted file mode 100755 index cb57c9a1..00000000 --- a/usr/bin/pkexec.security-misc +++ /dev/null @@ -1,132 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with -## hidepid. -## * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 -## * https://forums.whonix.org/t/cannot-use-pkexec/8129 - -set -e - -my_real_path="$(realpath "$0")" || true -identifier="$my_real_path wrapper" -exec > >(systemd-cat --identifier="$identifier output by program:") 2>&1 - -log_to_journal() { - echo "$@" | systemd-cat --identifier="$identifier output by wrapper:" || true -} - -log_to_journal "$0 $@" -log_to_journal "DISPLAY: '$DISPLAY'" -my_pstree="$(pstree -p $$)" || true -log_to_journal "my_pstree: '$my_pstree'" - -## If hidepid is not in use, just use pkexec normally. -if ! mount | grep "/proc" | grep "hidepid=2" &>/dev/null ; then - pkexec.security-misc-orig "$@" - exit $? -fi - -switch_user=false - -original_args="$@" - -## Thanks to: -## http://mywiki.wooledge.org/BashFAQ/035 - -while : -do - case $1 in - ## Should show 'pkexec --version' or fail? - --version) - shift - pkexec.security-misc-orig "$original_args" - exit $? - ;; - ## Should show 'pkexec --help' or fail? - --help) - shift - pkexec.security-misc-orig "$original_args" - exit $? - ;; - ## Drop --disable-internal-agent as not needed and breaking both, - ## lxqt-sudo and sudo. - --disable-internal-agent) - shift - ;; - --user) - ## lxqt-sudo does not support "--user". - ## We should not make this wrapper run something as root which - ## is supposed to run under a different user. Try using - ## "sudo -A --user user --set-home" instead. - user_pkexec_wrapper="$2" - if [ "$user_pkexec_wrapper" = "" ]; then - shift - else - shift 2 - fi - switch_user=true - maybe_switch_to_user="--user $user_pkexec_wrapper" - ;; - --) - shift - break - ;; - *) - break - ;; - esac -done - -## If there are input files (for example) that follow the options, they -## will remain in the "$@" positional parameters. - -if [ "$PKEXEC_UID" = "" ]; then - if [ ! "$user_pkexec_wrapper" = "" ]; then - PKEXEC_UID="$user_pkexec_wrapper" - elif [ ! "$SUDO_USER" = "" ]; then - PKEXEC_UID="$SUDO_USER" - else - PKEXEC_UID="$(whoami)" - fi -fi -export PKEXEC_UID - -if [[ "$@" = "" ]]; then - ## Call original pkexec in case there are no arguments. - pkexec.security-misc-orig $original_args - exit $? -fi - -exit_code=0 - -## lxqt-sudo does not check /etc/sudoers / /etc/sudoers.d exceptions. -## Therefore use 'sudo -l' to see if there is any already existing sudoers exception. -## Did not work. 'sudo -l' will always exit with exit code '0'. -# if sudo -l --non-interactive $maybe_switch_to_user --set-home PKEXEC_UID="$PKEXEC_UID" "$@" ; then -# log_to_journal "sudoers exception: yes" -# sudo --non-interactive $maybe_switch_to_user --set-home PKEXEC_UID="$PKEXEC_UID" "$@" || { exit_code=$? ; true; }; -# log_to_journal "sudo --user | exit_code: '$exit_code'" -# exit "$exit_code" -# fi -# -# log_to_journal "sudoers exception: no" - -if [ "$switch_user" = "true" ]; then - ## 'sudo --user user' clears environment variables such as PATH. - lxqt-sudo sudo $maybe_switch_to_user --set-home PKEXEC_UID="$PKEXEC_UID" "$@" || { exit_code=$? ; true; }; -else - ## set PATH same as root - ## This is required for gdebi. - ## REVIEW: is it ok that users can find out the PATH setting of root? - ## lxqt-sudo does not clear environment variable PATH. - PATH="$(sudo --non-interactive /usr/libexec/security-misc/echo-path)" - export PATH - lxqt-sudo "$@" || { exit_code=$? ; true; }; -fi - -log_to_journal "exit_code: '$exit_code'" - -exit "$exit_code" diff --git a/usr/bin/remount-secure b/usr/bin/remount-secure#security-misc-shared similarity index 53% rename from usr/bin/remount-secure rename to usr/bin/remount-secure#security-misc-shared index 233287c1..5d1322ab 100755 --- a/usr/bin/remount-secure +++ b/usr/bin/remount-secure#security-misc-shared @@ -1,32 +1,58 @@ #!/bin/bash -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. +## features: +## - nodev,nosuid where appropriate +## - optional noexec for most except /home +## - optional noexec for all including /home +## - idempotent (script can be safely re-run) +## - can be run from: +## - systemd +## - dracut +## - manually from command line +## - can safely handle non-existing folders +## - error handling +## - log output: +## - shows each and every command executed +## - shows old mount options prior running remount-secure +## - shows new mount options after running remount-secure + ## noexec in /tmp and/or /home can break some malware but also legitimate ## applications. +## https://www.kicksecure.com/wiki/Noexec ## https://www.kicksecure.com/wiki/Dev/remount-secure ## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 +## style-ok: no-has - may run in dracut without helper-scripts + +## Mount helper functions (_boot, _sys, _usr, ...) are invoked indirectly via +## the dispatch in main(). +# shellcheck disable=SC2317 + #set -x -set -e -set -o pipefail +set -o errexit set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose init() { if test -o xtrace ; then - output_command=true + output_command=( true ) else - output_command=echo + output_command=( printf '%s\n' ) fi - $output_command "$0: INFO: START" + "${output_command[@]}" "$0: INFO: START" ## dracut does not have id. Saving space in initial ramdisk. if command -v id &>/dev/null ; then if [ "$(id -u)" != "0" ]; then - $output_command "ERROR: must be run as root! sudo $0" + "${output_command[@]}" "ERROR: must be run as root! sudo $0" exit 1 fi fi @@ -36,10 +62,10 @@ init() { ## dracut sets NEWROOT=/sysroot [[ -v NEWROOT ]] || NEWROOT="" - if [ "$NEWROOT" = "" ]; then - $output_command "INFO: dracut detected: no" + if [ "${NEWROOT}" = "" ]; then + "${output_command[@]}" "INFO: dracut detected: no" else - $output_command "INFO: dracut detected: yes - NEWROOT: '$NEWROOT'" + "${output_command[@]}" "INFO: dracut detected: yes - NEWROOT: '${NEWROOT}'" fi ## Debugging. @@ -53,39 +79,39 @@ init() { parse_options() { ## Thanks to: - ## http://mywiki.wooledge.org/BashFAQ/035 + ## https://mywiki.wooledge.org/BashFAQ/035 while : do case ${1:-} in 0) - $output_command "WARNING: Not using remount-secure." + "${output_command[@]}" "WARNING: Not using remount-secure." exit 0 shift ;; 1) - $output_command "INFO: level 1/3 (low)" + "${output_command[@]}" "INFO: level 1/3 (low)" most_noexec_maybe="" home_noexec_maybe="" parsed=true shift ;; 2) - $output_command "INFO: level 2/3 (medium)" + "${output_command[@]}" "INFO: level 2/3 (medium)" most_noexec_maybe=",noexec" home_noexec_maybe="" parsed=true shift ;; 3) - $output_command "INFO: level 3/3 (high)" + "${output_command[@]}" "INFO: level 3/3 (high)" most_noexec_maybe=",noexec" home_noexec_maybe=",noexec" parsed=true shift ;; --force) - $output_command "INFO: --force" + "${output_command[@]}" "INFO: --force" option_force=true shift ;; @@ -94,7 +120,7 @@ parse_options() { break ;; -*) - echo "ERROR: unknown option: $1" >&2 + "${output_command[@]}" "ERROR: unknown option: ${1}" >&2 exit 1 ;; *) @@ -108,27 +134,27 @@ parse_options() { [[ -v home_noexec_maybe ]] || home_noexec_maybe="" [[ -v most_noexec_maybe ]] || most_noexec_maybe="" - $output_command "INFO: using nosuid,nodev: yes" + "${output_command[@]}" "INFO: using nosuid,nodev: yes" - if [ "$home_noexec_maybe" = "" ]; then - $output_command "INFO: using noexec for all: no" + if [ "${home_noexec_maybe}" = "" ]; then + "${output_command[@]}" "INFO: using noexec for all: no" else - $output_command "INFO: using noexec for all: yes" + "${output_command[@]}" "INFO: using noexec for all: yes" return 0 fi - if [ "$most_noexec_maybe" = "" ]; then - $output_command "INFO: using noexec for most: no" + if [ "${most_noexec_maybe}" = "" ]; then + "${output_command[@]}" "INFO: using noexec for most: no" else - $output_command "INFO: using noexec for most (not all): yes" + "${output_command[@]}" "INFO: using noexec for most (not all): yes" return 0 fi - if [ "$parsed" = "true" ]; then + if [ "${parsed}" = "true" ]; then return 0 fi - $output_command "ERROR: syntax error. use either: + "${output_command[@]}" "ERROR: syntax error. use either: $0 0 $0 1 $0 2 @@ -139,14 +165,14 @@ $0 3" preparation() { ## Debugging. - #$output_command "INFO: 'findmnt --list' output at the START." - #$output_command "$(findmnt --list)" - #$output_command "" + #"${output_command[@]}" "INFO: 'findmnt --list' output at the START." + #"${output_command[@]}" "$(findmnt --list)" + #"${output_command[@]}" "" true } remount_secure() { - $output_command "" + "${output_command[@]}" "" ## ${FUNCNAME[1]} is the name of the calling function. I.e. the function ## which called this function. @@ -157,52 +183,52 @@ remount_secure() { ## example status_file_full_path: ## /run/remount-secure/_home - old_mount_options="$(findmnt --noheadings --output options -- "$mount_folder")" || true + old_mount_options="$(findmnt --noheadings --output options -- "${mount_folder}")" || true ## example old_mount_options: ## rw,nosuid,nodev,relatime,discard - $output_command "INFO: '$mount_folder' old_mount_options: '$old_mount_options'" + "${output_command[@]}" "INFO: '${mount_folder}' old_mount_options: '${old_mount_options}'" - if echo "$old_mount_options" | grep --quiet "$intended_mount_options" ; then - $output_command "INFO: '$mount_folder' has already intended mount options. ($intended_mount_options)" + if printf '%s\n' "${old_mount_options}" | grep "${intended_mount_options}" >/dev/null 2>/dev/null ; then + "${output_command[@]}" "INFO: '${mount_folder}' has already intended mount options. ('${intended_mount_options}')" return 0 fi ## When this package is upgraded, the systemd unit will run again. ## If the user meanwhile manually relaxed mount options, this should not be undone. - if [ ! "$option_force" == "true" ]; then - if [ -e "$status_file_full_path" ]; then - $output_command "INFO: '$mount_folder' already remounted earlier. Not remounting again. Use --force if this is what you want." + if [ ! "${option_force}" == "true" ]; then + if [ -e "${status_file_full_path}" ]; then + "${output_command[@]}" "INFO: '${mount_folder}' already remounted earlier. Not remounting again. Use --force if this is what you want." return 0 fi fi - if ! test -d "$mount_folder" ; then - $output_command "INFO: '$mount_folder' folder exists: no" - exit_code=102 + if ! test -d "${mount_folder}" ; then + ## For example /boot/efi does not always exist on all systems. + "${output_command[@]}" "INFO: '${mount_folder}' folder exists: no" return 0 fi - $output_command "INFO: '$mount_folder' folder exists: yes" + "${output_command[@]}" "INFO: '${mount_folder}' folder exists: yes" - if findmnt --noheadings "$mount_folder" >/dev/null ; then - $output_command "INFO: '$mount_folder' already mounted, therefore using remount." - $output_command INFO: Executing: mount --options "remount,${intended_mount_options}" "$mount_folder" - mount --options "remount,${intended_mount_options}" "$mount_folder" || exit_code=100 + if findmnt --noheadings "${mount_folder}" >/dev/null ; then + "${output_command[@]}" "INFO: '${mount_folder}' already mounted, therefore using remount." + "${output_command[@]}" "INFO: Executing: mount --make-private --options remount,${intended_mount_options} ${mount_folder}" + mount --make-private --options "remount,${intended_mount_options}" "${mount_folder}" || exit_code=100 else - $output_command "INFO: '$mount_folder' not yet mounted, therefore using mount bind." - $output_command INFO: Executing: mount --options "$intended_mount_options" --bind "$mount_folder" "$mount_folder" - mount --options "$intended_mount_options" --bind "$mount_folder" "$mount_folder" || exit_code=101 + "${output_command[@]}" "INFO: '${mount_folder}' not yet mounted, therefore using mount bind." + "${output_command[@]}" "INFO: Executing: mount --make-private --options ${intended_mount_options} --bind ${mount_folder} ${mount_folder}" + mount --make-private --options "${intended_mount_options}" --bind "${mount_folder}" "${mount_folder}" || exit_code=101 fi - new_mount_options="$(findmnt --noheadings --output options -- "$mount_folder")" || true - $output_command "INFO: '$mount_folder' new_mount_options: $new_mount_options" + new_mount_options="$(findmnt --noheadings --output options -- "${mount_folder}")" || true + "${output_command[@]}" "INFO: '${mount_folder}' new_mount_options: '${new_mount_options}'" - touch "$status_file_full_path" + touch "${status_file_full_path}" } _boot() { - mount_folder="$NEWROOT/boot" + mount_folder="${NEWROOT}/boot" ## https://lists.freedesktop.org/archives/systemd-devel/2015-February/028456.html intended_mount_options="nosuid,nodev,noexec" remount_secure @@ -210,7 +236,7 @@ _boot() { _boot_efi() { ## TODO: new, test - mount_folder="$NEWROOT/boot/efi" + mount_folder="${NEWROOT}/boot/efi" intended_mount_options="nosuid,nodev,noexec" remount_secure } @@ -244,25 +270,25 @@ _sys() { } _tmp() { - mount_folder="$NEWROOT/tmp" + mount_folder="${NEWROOT}/tmp" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _var_tmp() { - mount_folder="$NEWROOT/var/tmp" + mount_folder="${NEWROOT}/var/tmp" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _var_log() { - mount_folder="$NEWROOT/var/log" + mount_folder="${NEWROOT}/var/log" intended_mount_options="nosuid,nodev,noexec" remount_secure } _var() { - mount_folder="$NEWROOT/var" + mount_folder="${NEWROOT}/var" ## noexec: Not possible. Reason: ## Debian stores executable maintainer scripts in /var/lib/dpkg/info folder. intended_mount_options="nosuid,nodev" @@ -271,48 +297,48 @@ _var() { _usr() { ## TODO: new, test - mount_folder="$NEWROOT/usr" + mount_folder="${NEWROOT}/usr" intended_mount_options="nodev" remount_secure } _home() { - mount_folder="$NEWROOT/home" + mount_folder="${NEWROOT}/home" intended_mount_options="nosuid,nodev${home_noexec_maybe}" remount_secure } _root() { ## TODO: new, test - mount_folder="$NEWROOT/root" + mount_folder="${NEWROOT}/root" intended_mount_options="nosuid,nodev${home_noexec_maybe}" remount_secure } _srv() { ## TODO: new, test - mount_folder="$NEWROOT/srv" + mount_folder="${NEWROOT}/srv" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _media() { ## TODO: new, test - mount_folder="$NEWROOT/media" + mount_folder="${NEWROOT}/media" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _mnt() { ## TODO: new, test - mount_folder="$NEWROOT/mnt" + mount_folder="${NEWROOT}/mnt" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _opt() { ## TODO: new, test - mount_folder="$NEWROOT/opt" + mount_folder="${NEWROOT}/opt" ## Allow /opt exec as usually optional binaries are placed there such as Firefox ## when manually installed from tarball. intended_mount_options="nosuid,nodev" @@ -323,19 +349,20 @@ _etc() { ## TODO: new, test ## /etc cannot be noexec because various executables are there. To find, run: ## sudo find /etc -executable - mount_folder="$NEWROOT/etc" + mount_folder="${NEWROOT}/etc" intended_mount_options="nosuid,nodev" remount_secure } end() { ## Debugging. - #$output_command "INFO: 'findmnt --list' output at the END." - #$output_command "$(findmnt --list)" + #"${output_command[@]}" "INFO: 'findmnt --list' output at the END." + #"${output_command[@]}" "$(findmnt --list)" - $output_command "INFO: exit_code: $exit_code" - $output_command "$0: INFO: END" - exit $exit_code + "${output_command[@]}" "" + "${output_command[@]}" "INFO: exit_code: ${exit_code}" + "${output_command[@]}" "$0: INFO: END" + exit "${exit_code}" } main() { @@ -364,7 +391,7 @@ main() { end } -## TODO: see also hidepid /usr/lib/systemd/system/proc-hidepid.service +## REMINDER: see also hidepid /usr/lib/systemd/system/proc-hidepid.service #mount --options defaults,nosuid,nodev,noexec,remount,subset=pid /proc main "$@" diff --git a/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf b/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf deleted file mode 100644 index bc2280cc..00000000 --- a/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf +++ /dev/null @@ -1,2 +0,0 @@ -#[connection] -#ipv6.ip6-privacy=2 diff --git a/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop b/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop new file mode 100644 index 00000000..5bd18739 --- /dev/null +++ b/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop @@ -0,0 +1,13 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## MAC randomisation breaks root server and VirtualBox DHCP likely due to IPv6 Privacy Extensions. +## +## https://datatracker.ietf.org/doc/html/rfc4941 +## https://github.com/Kicksecure/security-misc/pull/145 +## https://github.com/Kicksecure/security-misc/issues/184 +## +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. + +#[connection] +#ipv6.ip6-privacy=2 diff --git a/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf b/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf deleted file mode 100644 index 428c0e24..00000000 --- a/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf +++ /dev/null @@ -1,6 +0,0 @@ -#[device-mac-randomization] -#wifi.scan-rand-mac-address=yes - -#[connection-mac-randomization] -#ethernet.cloned-mac-address=random -#wifi.cloned-mac-address=random diff --git a/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop b/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop new file mode 100644 index 00000000..c664e9b7 --- /dev/null +++ b/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop @@ -0,0 +1,17 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## MAC randomisation breaks root server and VirtualBox DHCP likely due to IPv6 Privacy Extensions. +## +## https://datatracker.ietf.org/doc/html/rfc4941 +## https://github.com/Kicksecure/security-misc/pull/145 +## https://github.com/Kicksecure/security-misc/issues/184 +## +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. + +#[device-mac-randomization] +#wifi.scan-rand-mac-address=yes + +#[connection-mac-randomization] +#ethernet.cloned-mac-address=random +#wifi.cloned-mac-address=random diff --git a/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh b/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared similarity index 92% rename from usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh rename to usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared index ce0a67bf..89170912 100755 --- a/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh +++ b/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. # called by dracut diff --git a/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh b/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared similarity index 89% rename from usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh rename to usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared index b742dda4..0e0a0c17 100755 --- a/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh +++ b/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared @@ -1,6 +1,6 @@ #!/bin/sh -## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## This script is intended to remount specified mount points with more secure diff --git a/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared b/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared new file mode 100755 index 00000000..092b610f --- /dev/null +++ b/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared @@ -0,0 +1,50 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## style-ok: no-strict (sourced by dracut) + +## called by dracut +check() { + require_binaries /usr/bin/emerg-shutdown || return 1 + return 255 +} + +## called by dracut +depends() { + printf '%s\n' 'systemd bash' + return 0 +} + +## called by dracut +install() { + local config_file + + inst systemd-notify + + inst_simple /usr/libexec/security-misc/emerg-shutdown + inst_simple /usr/share/security-misc/emerg-shutdown-initramfs.service /usr/lib/systemd/system/emerg-shutdown-initramfs.service + inst_simple /usr/bin/emerg-shutdown /emerg-shutdown + + for config_file in /etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + inst_multiple /etc/security-misc/emerg-shutdown/*.conf + break + fi + done + for config_file in /usr/local/etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + inst_multiple /usr/local/etc/security-misc/emerg-shutdown/*.conf + break + fi + done + + mkdir -p "${initdir}/usr/lib/systemd/system/initrd.target.wants" + ln -s '../emerg-shutdown-initramfs.service' "${initdir}/usr/lib/systemd/system/initrd.target.wants/emerg-shutdown-initramfs.service" +} + +## called by dracut +installkernel () { + hostonly='' instmods evdev +} diff --git a/usr/lib/issue.d/20_security-misc.issue b/usr/lib/issue.d/20_security-misc.issue#security-misc-shared similarity index 100% rename from usr/lib/issue.d/20_security-misc.issue rename to usr/lib/issue.d/20_security-misc.issue#security-misc-shared diff --git a/usr/lib/modules-load.d/30_security-misc.conf b/usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared similarity index 60% rename from usr/lib/modules-load.d/30_security-misc.conf rename to usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared index 072c9b0b..6ee13ca8 100644 --- a/usr/lib/modules-load.d/30_security-misc.conf +++ b/usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared @@ -1,7 +1,7 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. -## https://www.whonix.org/wiki/Dev/Entropy +## https://www.kicksecure.com/wiki/Dev/Entropy ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972 ## https://forums.whonix.org/t/jitterentropy-rngd/7204 jitterentropy_rng diff --git a/etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf b/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared similarity index 54% rename from etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared index 071e724f..e45baa3f 100644 --- a/etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared @@ -1,9 +1,9 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. /usr/bin/bwrap exactwhitelist -/bin/bwrap exactwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared new file mode 100644 index 00000000..0c00e338 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared @@ -0,0 +1,18 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Chrome/Chromium now uses namespace-based sandboxing rather than a SUID +## sandbox for most use cases, and while the SUID sandbox is still technically +## supported [1], it's also virtually unused [2]. Chromium still works fine +## when it is stripped of its SUID bit and rendered no longer executable, +## and opening `chrome://sandbox` while in this state shows that sandboxing is +## still working perfectly fine. +## +## [1] https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_sandboxing.md +## [2] https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_suid_sandbox.md +#chrome-sandbox matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared new file mode 100644 index 00000000..8d370cd4 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared @@ -0,0 +1,17 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Needed for D-Bus system activation to work. +## https://dbus.freedesktop.org/doc/system-activation.txt +## +## May be vital for desktop features to work normally. +## +## Appears to have been designed with security in mind and can only be called +## by root or a user in the `messagebus` group (which currently has one member, +## namely user `messagebus`). +dbus-daemon-launch-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_firejail.conf b/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared similarity index 59% rename from etc/permission-hardener.d/25_default_whitelist_firejail.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared index a56cb239..79517913 100644 --- a/etc/permission-hardener.d/25_default_whitelist_firejail.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared @@ -1,11 +1,12 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. ## There is a controversy about firejail but those who choose to install it ## should be able to use it. -## https://www.whonix.org/wiki/Dev/Firejail#Security +## https://www.kicksecure.com/wiki/Dev/Firejail#Security /usr/bin/firejail exactwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared new file mode 100644 index 00000000..785df830 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared @@ -0,0 +1,18 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Critical component of FUSE (Filesystem in USErspace) +## +## Used by things such as: +## - AppImages +## - such as electrum Bitcoin wallet +## - Docker +## If not SUID, unprivileged users will be unable to use FUSE any longer. +## +## https://forums.whonix.org/t/disable-suid-binaries/7706/57 +/fusermount matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf b/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared similarity index 61% rename from etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared index 6cc01fed..3d8eae38 100644 --- a/etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared @@ -1,9 +1,10 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. libhardened_malloc.so matchwhitelist libhardened_malloc-light.so matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_mount.conf b/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared similarity index 65% rename from etc/permission-hardener.d/25_default_whitelist_mount.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared index ce7d014f..d1955e28 100644 --- a/etc/permission-hardener.d/25_default_whitelist_mount.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared @@ -1,17 +1,18 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. ## https://forums.whonix.org/t/disable-suid-binaries/7706/61 ## Protect from 'chmod -x' (and SUID removal). ## SUID will be removed below in separate step. -/bin/mount exactwhitelist /usr/bin/mount exactwhitelist +/usr/bin/umount exactwhitelist ## Remove SUID from 'mount' but keep executable. ## https://forums.whonix.org/t/disable-suid-binaries/7706/61 -/bin/mount 745 root root -/usr/bin/mount 745 root root +/usr/bin/mount 755 root root +/usr/bin/umount 755 root root diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared new file mode 100644 index 00000000..a851cbb6 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared @@ -0,0 +1,23 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Used by the pam_tmpdir module to create a secure temporary directory for the +## user that is logging in. +## https://manpages.ubuntu.com/manpages/oracular/man8/pam-tmpdir-helper.8.html +## Apparently specific to Debian, there isn't actually any Git repo with this +## code in it, it's just a "floating" package in the Debian archive. Written by +## the same person who maintains the package. Almost certainly cannot be +## disabled without causing serious problems, but may be worth auditing. +## (Worthy of note, it doesn't seem this program takes any user input, but +## relies solely on the calling user's UID and GID, though this could require +## further review.) +## +## Without this, LXQt fails to start with a dbus-launch error. +## +## TODO-HUMAN-DEVELOPER-ONLY: source audit pam-tmpdir-helper +pam-tmpdir-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_passwd.conf b/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared similarity index 57% rename from etc/permission-hardener.d/25_default_passwd.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared index dcd403fc..4cd8d358 100644 --- a/etc/permission-hardener.d/25_default_passwd.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared @@ -1,14 +1,16 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. # Keep the `passwd` utility executable to prevent issues with the # /usr/libexec/security-misc/pam-abort-on-locked-password script blocking -# user logins with `su` and KScreenLocker +# user logins with `su` and KScreenLocker. exactwhitelist is needed to keep +# the nosuid rule on /usr/bin from fighting with these rules. # # See also: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#passwd +/usr/bin/passwd exactwhitelist /usr/bin/passwd 0755 root root -/bin/passwd 0755 root root diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared new file mode 100644 index 00000000..e328564a --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared @@ -0,0 +1,28 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## user-sysmaint-split hardens this further. +/usr/bin/pkexec exactwhitelist +/usr/bin/pkexec.security-misc-orig exactwhitelist + +## Required for PolicyKit (Polkit) to function. +## +## https://polkit-devel.freedesktop.narkive.com/zXO4yEg7/documentation-on-polkit-agent-helper-1-and-suid# +## https://gitlab.freedesktop.org/polkit/polkit/-/issues/168 +## https://cgit.freedesktop.org/polkit/tree/src/polkitagent/polkitagenthelper-pam.c#n93 +## +## Changing permissions here may break more than just normal privilege escalation. +## May be safe to disable for users other than sysmaint similar to what was done with pkexec and sudo, +## however even that might not be safe. +## +## matches both: +## - /usr/lib/policykit-1/polkit-agent-helper-1 +## - /lib/policykit-1/polkit-agent-helper-1 +## +## user-sysmaint-split hardens this further. +polkit-agent-helper-1 matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared new file mode 100644 index 00000000..e4508770 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared @@ -0,0 +1,12 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Ref: https://www.postfix.org/postconf.5.html (setgid_group) +## TODO-HUMAN-DEVELOPER-ONLY: research +postqueue matchwhitelist +postdrop matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared new file mode 100644 index 00000000..82be6d2e --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## qfile-unpacker is written by Qubes and is trusted. Needed as part of copying +## files between VMs. +## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c +## +## Historic Qubes upstream security issue: +## qfile-unpacker allows unprivileged users in VMs to gain root privileges +## https://github.com/QubesOS/qubes-issues/issues/8633 +## +## matches both: +## - /usr/lib/qubes/qfile-unpacker whitelist +## - Not bit-for-bit identical to /usr/lib/qubes/qfile-unpacker. +## - Stripping SUID from this does *not* break file copying. +## - TODO-HUMAN-DEVELOPER-ONLY: further research required on its purpose +## - /usr/bin/qfile-unpacker +## - Appears to be an integral part of file transfer between qubes, stripping +## SUID from this in an AppVM results in that AppVM being unable to receive +## files any longer. (It can still send files to other qubes though.) +qfile-unpacker matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared new file mode 100644 index 00000000..6265587f --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared @@ -0,0 +1,11 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Ref: https://packages.debian.org/trixie/spice-client-glib-usb-acl-helper +## TODO-HUMAN-DEVELOPER-ONLY: research +spice-client-glib-usb-acl-helper matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared new file mode 100644 index 00000000..6a987f3e --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared @@ -0,0 +1,22 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Used for SSH client key management +## https://manpages.debian.org/ssh-agent +## Debian installs ssh-agent with setgid permissions (2755) and with +## _ssh as the group to help mitigate ptrace attacks that could extract +## private keys from the agent's memory. +ssh-agent matchwhitelist + +## Used only for SSH host-based authentication +## https://manpages.debian.org/ssh-keysign +## Needed to allow access to the machine's host key for use in the +## authentication process. This is a non-default method of authenticating to +## SSH, and is likely rarely used, thus this should be safe to disable. +#ssh-keysign matchwhitelist +#/usr/lib/openssh matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_sudo.conf b/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared similarity index 50% rename from etc/permission-hardener.d/25_default_whitelist_sudo.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared index a7b0fd23..84e74975 100644 --- a/etc/permission-hardener.d/25_default_whitelist_sudo.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared @@ -1,9 +1,10 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. +## user-sysmaint-split hardens this further. /usr/bin/sudo exactwhitelist -/bin/sudo exactwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf b/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared similarity index 64% rename from etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared index dc1fb5af..0733fc9a 100644 --- a/etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared @@ -1,11 +1,11 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. ## required for performing password validation from unprivileged user ## processes such as KScreenLocker's unlock prompt /usr/sbin/unix_chkpwd exactwhitelist -/sbin/unix_chkpwd exactwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_virtualbox.conf b/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared similarity index 65% rename from etc/permission-hardener.d/25_default_whitelist_virtualbox.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared index 17701d9f..6e27e081 100644 --- a/etc/permission-hardener.d/25_default_whitelist_virtualbox.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared @@ -1,13 +1,13 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. -## TODO: research +## TODO-HUMAN-DEVELOPER-ONLY: research /usr/lib/virtualbox/ matchwhitelist -/lib/virtualbox/ matchwhitelist VirtualBoxVM matchwhitelist VBoxSDL matchwhitelist VBoxNetNAT matchwhitelist diff --git a/etc/permission-hardener.d/30_default.conf b/usr/lib/permission-hardener.d/30_default.conf#security-misc-shared similarity index 88% rename from etc/permission-hardener.d/30_default.conf rename to usr/lib/permission-hardener.d/30_default.conf#security-misc-shared index d35ee5a9..91e15eb5 100644 --- a/etc/permission-hardener.d/30_default.conf +++ b/usr/lib/permission-hardener.d/30_default.conf#security-misc-shared @@ -1,9 +1,10 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. ## File permission hardening. ## @@ -11,7 +12,8 @@ ## [filename] [mode] [owner] [group] [capability] ## [filename] [exactwhitelist|matchwhitelist|disablewhitelist|nosuid] ## -## TODO: white spaces inside file name untested and probably will not work. +## White spaces inside a file name are supported, no quoting or escaping is +## necessary (or permitted). ###################################################################### # Global Settings @@ -23,10 +25,6 @@ # SUID disables below (or in lexically higher) files: disablewhitelist ###################################################################### -## For example, if you are not using SELinux the following might make sense to -## enable. TODO: research -#/utempter/utempter disablewhitelist - ## If you are not going to use AppImages such as electrum Bitcoin wallet. #/fusermount disablewhitelist @@ -118,5 +116,5 @@ ## anon-apps-config does this. #/usr/bin/ping 0744 root root none -## TODO: research -#/usr/lib/x86_64-linux-gnu/gstreamer1.0/grstreamer-1.0/gst-ptp-helper 0744 root root none +## TODO-HUMAN-DEVELOPER-ONLY: research +#/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper 0744 root root none diff --git a/usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py#security-misc-shared b/usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py#security-misc-shared new file mode 100644 index 00000000..e69de29b diff --git a/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared b/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared new file mode 100755 index 00000000..3fb3053e --- /dev/null +++ b/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared @@ -0,0 +1,724 @@ +#!/usr/bin/python3 -Bsu + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +# pylint: disable=broad-exception-caught + +## Notes for reviewers: +## +## * Local denial-of-service is out of scope. There are easier ways for +## malware to pop up lots of windows or consume huge amounts of RAM. +## * The shim's primary purpose is to ensure that files aren't accidentally +## opened when trying to view the contents of a directory. We do not care if +## the exact directory that exists at launch time is the directory that gets +## opened when the user chooses to open it. Therefore replacement attacks +## involving swapping one directory with another or with a symlink to a +## directory are out of scope. +## * Python version lower than 3.13.5 are out of scope. + +""" +fm_shim_frontend.py - Prompts the user if they want to open one or more +directories in the default file manager. +""" + +import sys +import os +import signal +import subprocess +import traceback +import urllib.parse +from pathlib import Path +from typing import NoReturn, cast +from types import FrameType + +from PyQt5.QtCore import QTimer, QObject, QEvent, Qt +from PyQt5.QtGui import QFontDatabase, QBrush, QColor +from PyQt5.QtWidgets import ( + QApplication, + QCheckBox, + QDialog, + QLabel, + QListWidget, + QListWidgetItem, + QPushButton, + QSizePolicy, + QTextEdit, + QVBoxLayout, + QHBoxLayout, + QWidget, + QScrollBar, + QLayout, + QMessageBox, +) + +from stdisplay.stdisplay import stdisplay + + +class WidgetShowBinding(QObject): + """ + Detects when a widget is shown or hidden, and shows or hides another + widget in response. + """ + + def __init__( + self, bound_widget: QWidget, parent: QObject | None = None + ) -> None: + """ + ScrollBarEventFilter constructor. + """ + + super().__init__(parent) + + self.bound_widget = bound_widget + + # pylint: disable=invalid-name, unused-argument + def eventFilter(self, obj: QObject | None, event: QEvent | None) -> bool: + """ + Shows or hides the bound widget when the binding widget is shown or + hidden. + """ + + if event is None: + return False + + # pylint: disable=no-member + do_recalc_layout: bool = False + if event.type() == QEvent.Type.Show: + self.bound_widget.show() + do_recalc_layout = True + # pylint: disable=no-member + elif event.type() == QEvent.Type.Hide: + self.bound_widget.hide() + do_recalc_layout = True + if do_recalc_layout: + parent_object: QObject | None = self.bound_widget.parent() + assert parent_object is not None + parent_widget: QWidget = cast(QWidget, parent_object) + parent_layout: QLayout | None = parent_widget.layout() + assert parent_layout is not None + parent_layout.update() + return False + + +class AnalyzePathsWindow(QDialog): + """ + Helper window for analyzing unsafe characters in paths. + """ + + def __init__( + self, dir_list: list[Path], parent: QDialog | None = None + ) -> None: + """ + AnalyzePathsWindow constructor. + """ + + super().__init__(parent) + + self.dir_list: list[Path] = dir_list + self.has_unsafe_chars_list: list[bool] = [] + + self.core_layout: QVBoxLayout = QVBoxLayout() + self.dir_list_view: QListWidget = QListWidget() + self.dir_list_view.resize(1, 50) + # pylint: disable=no-member + self.dir_list_view.setSizePolicy( + QSizePolicy.Policy.Expanding, + QSizePolicy.Policy.Fixed, + ) + self.dir_list_view.currentRowChanged.connect( + self.populate_unicode_show_view + ) + self.core_layout.addWidget(self.dir_list_view) + + self.unicode_show_view: QTextEdit = QTextEdit() + self.unicode_show_view.setReadOnly(True) + # pylint: disable=no-member + self.unicode_show_view.setLineWrapMode(QTextEdit.LineWrapMode.NoWrap) + # pylint: disable=no-member + self.unicode_show_view.setCurrentFont( + QFontDatabase.systemFont(QFontDatabase.SystemFont.FixedFont) + ) + self.core_layout.addWidget(self.unicode_show_view) + + self.button_layout: QHBoxLayout = QHBoxLayout() + self.button_layout.addStretch() + self.done_button: QPushButton = QPushButton("Done") + self.done_button.clicked.connect(self.accept) + self.button_layout.addWidget(self.done_button) + self.core_layout.addLayout(self.button_layout) + + self.setLayout(self.core_layout) + self.setWindowTitle("Analyze Paths") + self.resize(690, 500) + + for dir_path in self.dir_list: + qlwi: QListWidgetItem = QListWidgetItem( + stdisplay(str(dir_path), sgr=-1) + ) + if any( + (not 0x20 <= ord(path_char) <= 0x7E) + for path_char in str(dir_path) + ): + qlwi.setBackground(QBrush(QColor(255, 128, 128))) + self.has_unsafe_chars_list.append(True) + else: + self.has_unsafe_chars_list.append(False) + self.dir_list_view.addItem(qlwi) + + self.populate_unicode_show_view(-1) + + def populate_unicode_show_view(self, path_idx: int) -> None: + """ + Runs the path through unicode-show and populates info about it in the + unicode_show_view widget. + """ + + if path_idx < 0 or path_idx >= len(self.dir_list): + self.unicode_show_view.setPlainText( + "Select a file path to analyze above.\n" + + "Paths highlighted in red contain potentially unsafe " + + "characters." + ) + return + + if self.has_unsafe_chars_list[path_idx]: + try: + unicode_show_output: str = subprocess.run( + ["/usr/bin/unicode-show"], + input=str(self.dir_list[path_idx]), + capture_output=True, + check=False, + encoding="utf-8", + ).stdout + self.unicode_show_view.setPlainText(unicode_show_output) + except Exception: + traceback.print_exc(file=sys.stderr) + self.unicode_show_view.setPlainText( + "Unable to check this path for unsafe chars!\n" + + "See logs in 'journalctl --user --boot fm-shim.service' " + + "for more information." + ) + else: + self.unicode_show_view.setPlainText( + "No unsafe chars found in the selected path." + ) + + +# pylint: disable=too-many-instance-attributes +class FmShimWindow(QDialog): + """ + Core fm_shim_frontend window. + """ + + # pylint: disable=too-many-statements + def __init__( + self, dir_list: list[Path], parent: QDialog | None = None + ) -> None: + """ + FmShimWindow constructor. + """ + + super().__init__(parent) + + self.dir_list: list[Path] = dir_list + + self.core_layout: QVBoxLayout = QVBoxLayout() + self.head_label: QLabel = QLabel( + "An application has requested to open the following directories " + + "with the default file manager:" + ) + self.core_layout.addWidget(self.head_label) + + self.dir_list_view: QTextEdit = QTextEdit() + self.dir_list_view.setReadOnly(True) + # pylint: disable=no-member + self.dir_list_view.setLineWrapMode(QTextEdit.LineWrapMode.NoWrap) + # pylint: disable=no-member + self.dir_list_view.setCurrentFont( + QFontDatabase.systemFont(QFontDatabase.SystemFont.FixedFont) + ) + self.core_layout.addWidget(self.dir_list_view) + + self.sanitized_text_label: QLabel = QLabel( + "Note: Any spaces in the above filenames are displayed as " + + '"middle dot" (\N{MIDDLE DOT}) characters. Potentially ' + + "unsafe characters are displayed as underscores (_)." + ) + self.sanitized_text_label.setWordWrap(True) + self.sanitized_text_label.setVisible(False) + self.core_layout.addWidget(self.sanitized_text_label) + + self.unsafe_text_label: QLabel = QLabel( + 'WARNING: Some of the listed paths ' + + "contain Unicode or ASCII control characters. These can be " + + 'malicious. Use the "Analyze Paths" button for more details. ' + + 'If you are sure the text is safe, check "Display raw path ' + + 'text" below.' + ) + self.unsafe_text_label.setWordWrap(True) + self.unsafe_text_label.setVisible(False) + self.core_layout.addWidget(self.unsafe_text_label) + + horiz_scroll_bar: QScrollBar | None = ( + self.dir_list_view.horizontalScrollBar() + ) + assert horiz_scroll_bar is not None + self.horiz_overflow_warning_label: QLabel = QLabel( + 'WARNING: Some of the paths listed ' + + "above are too long to display all at once. Double-check that " + + "the paths do not look suspicious." + ) + self.horiz_overflow_warning_label.setWordWrap(True) + self.core_layout.addWidget(self.horiz_overflow_warning_label) + self.horiz_overflow_warning_label.setVisible( + horiz_scroll_bar.isVisible() + ) + self.horiz_overflow_warning_binding: WidgetShowBinding = ( + WidgetShowBinding(self.horiz_overflow_warning_label, self) + ) + horiz_scroll_bar.installEventFilter(self.horiz_overflow_warning_binding) + + vert_scroll_bar: QScrollBar | None = ( + self.dir_list_view.verticalScrollBar() + ) + assert vert_scroll_bar is not None + self.vert_overflow_warning_label: QLabel = QLabel( + 'WARNING: Too many paths are listed ' + + "above to display all at once. A new file manager window will " + + "be opened for every listed path. Double-check that this is " + + "what you want." + ) + self.vert_overflow_warning_label.setWordWrap(True) + self.core_layout.addWidget(self.vert_overflow_warning_label) + self.vert_overflow_warning_label.setVisible(vert_scroll_bar.isVisible()) + self.vert_overflow_warning_binding: WidgetShowBinding = ( + WidgetShowBinding(self.vert_overflow_warning_label, self) + ) + vert_scroll_bar.installEventFilter(self.vert_overflow_warning_binding) + + self.foot_label: QLabel = QLabel( + "Would you like to open these directories? A separate file " + + "manager window will be opened for every listed path." + ) + self.core_layout.addWidget(self.foot_label) + + self.button_layout: QHBoxLayout = QHBoxLayout() + self.display_raw_checkbox: QCheckBox = QCheckBox( + "Display raw path text" + ) + self.display_raw_checkbox.stateChanged.connect(self.toggle_display_raw) + self.button_layout.addWidget(self.display_raw_checkbox) + + self.analyze_paths_button: QPushButton = QPushButton("Analyze Paths") + self.analyze_paths_button.clicked.connect(self.analyze_paths) + self.analyze_paths_button.setVisible(False) + self.button_layout.addWidget(self.analyze_paths_button) + self.button_layout.addStretch() + + self.open_button: QPushButton = QPushButton("Open") + self.open_button.clicked.connect(self.open_dir_list) + self.cancel_button: QPushButton = QPushButton("Cancel") + self.cancel_button.clicked.connect(self.exit_app) + self.button_layout.addWidget(self.open_button) + self.button_layout.addWidget(self.cancel_button) + self.core_layout.addLayout(self.button_layout) + + self.setLayout(self.core_layout) + self.setWindowTitle("Open Directories") + + for dir_path in self.dir_list: + if any( + (not 0x20 <= ord(path_char) <= 0x7E) + for path_char in str(dir_path) + ): + self.unsafe_text_label.setVisible(True) + self.analyze_paths_button.setVisible(True) + + self.resize(690, 500) + + self.display_sanitized_dir_paths() + self.show() + + def display_sanitized_dir_paths(self) -> None: + """ + Sanitizes the paths in the dir list from all unsafe characters, + replaces spaces with middle dot characters, displays them to the user, + and displays a note about text sanitization. + """ + + sanitized_string: str = stdisplay( + "\n".join([str(x) for x in self.dir_list]), sgr=-1 + ) + self.dir_list_view.setPlainText( + sanitized_string.replace(" ", "\N{MIDDLE DOT}") + ) + self.sanitized_text_label.setVisible(True) + + def display_unsanitized_dir_paths(self) -> None: + """ + Displays the paths in the dir list unsanitized, and hides the text + sanitization note. + """ + + self.dir_list_view.setPlainText( + "\n".join([str(x) for x in self.dir_list]) + ) + self.sanitized_text_label.setVisible(False) + + def toggle_display_raw(self, new_state: int) -> None: + """ + Turns text sanitization on or off. + """ + + if new_state == 0: + self.display_sanitized_dir_paths() + else: + self.display_unsanitized_dir_paths() + + def analyze_paths(self) -> None: + """ + Opens a new window where the user can analyze potentially unsafe paths + before opening them with PCManFM-Qt. + """ + + apw: AnalyzePathsWindow = AnalyzePathsWindow(self.dir_list) + apw.exec() + + # pylint: disable=too-many-branches + def open_dir_list(self) -> None: + """ + Opens all specified directories using the default file manager. + """ + + try: + default_fm_desktop_file: str = subprocess.run( + ["/usr/bin/xdg-mime", "query", "default", "inode/directory"], + check=True, + capture_output=True, + encoding="utf-8", + ).stdout.strip() + except Exception: + print( + "ERROR: Unable to get default file manager!", + file=sys.stderr, + ) + sys.exit(1) + + ## Expect a plain desktop filename, not a path. + if ( + default_fm_desktop_file == "" + or "/" in default_fm_desktop_file + or not default_fm_desktop_file.endswith(".desktop") + ): + print( + "ERROR: Invalid default file manager desktop file name!", + file=sys.stderr, + ) + sys.exit(1) + + search_dir_list: list[str] = [] + + ## "" rather than None is intentional here, as + ## os.environ["XDG_DATA_HOME"] may be "", not None. + xdg_data_home: str = "" + try: + xdg_data_home = os.environ["XDG_DATA_HOME"] + except KeyError: + pass + if xdg_data_home == "": + home_env_var = "" + try: + home_env_var = os.environ["HOME"] + except KeyError: + pass + if home_env_var == "": + print( + "ERROR: Both the XDG_DATA_HOME and HOME environment " + + "variables are either undefined or empty!", + file=sys.stderr, + ) + sys.exit(1) + xdg_data_home = home_env_var + "/.local/share" + if not xdg_data_home.startswith("/"): + print( + "ERROR: XDG_DATA_HOME is not an absolute path!", file=sys.stderr + ) + sys.exit(1) + search_dir_list.append(xdg_data_home) + + ## Again, using "" rather than None is intentional here. + xdg_data_dirs: str = "" + try: + xdg_data_dirs = os.environ["XDG_DATA_DIRS"] + except Exception: + pass + xdg_data_dir_list = [p for p in xdg_data_dirs.split(":") if p != ""] + if len(xdg_data_dir_list) == 0: + xdg_data_dir_list = ["/usr/local/share", "/usr/share"] + if not all(x.startswith("/") for x in xdg_data_dir_list): + print( + "ERROR: XDG_DATA_DIRS contains non-absolute paths!", + file=sys.stderr, + ) + sys.exit(1) + search_dir_list.extend(xdg_data_dir_list) + + found_desktop_file: bool = False + for search_dir in search_dir_list: + default_fm_path: Path = Path( + search_dir + "/applications/" + default_fm_desktop_file + ) + if default_fm_path.is_file(): + found_desktop_file = True + break + if not found_desktop_file: + print( + "ERROR: Cannot find default file manager's desktop file!", + file=sys.stderr, + ) + sys.exit(1) + + for target_dir in self.dir_list: + if target_dir.is_dir(): + subprocess.run( + ["/usr/bin/gio", "launch", str(default_fm_path), str(target_dir)], + check=False, + ) + else: + QMessageBox.warning( + self, + "Open Directories", + Qt.convertFromPlainText( # type: ignore + "ERROR: The following path was no longer a dir when " + + "checked before opening:\n" + + "\n" + + f"{stdisplay(str(target_dir), sgr=-1)}\n" + + "\n" + + "This may be the result of an attempted attack. No " + + "further directories will be opened." + ), + ) + sys.exit(1) + + sys.exit(0) + + @staticmethod + def exit_app() -> None: + """ + Exits the application. + """ + + sys.exit(0) + + +# pylint: disable=unused-argument +def signal_handler(sig: int, frame: FrameType | None) -> None: + """ + Handles SIGINT and SIGTERM. + """ + + print("Received SIGINT or SIGTERM, exiting.", file=sys.stderr) + sys.exit(128 + sig) + + +def get_path_list_from_uris( + handler_mode: str, uri_list: list[str] +) -> list[Path]: + """ + Converts a list of URIs into a list of paths, discarding any invalid URIs + that are encountered in the process. + """ + + path_set: set[Path] = set() + + for uri in uri_list: + ## Do not permit Unicode or control characters in URIs. While the + ## files pointed to by URIs may contain Unicode in their filenames, + ## Unicode characters beyond 7-bit ASCII are forbidden in URIs. The + ## org.freedesktop.FileManager1 spec says that we should expect URI + ## strings here, not IRI strings (which can contain Unicode), so this + ## is safe. + if any((not 0x20 <= ord(uri_char) <= 0x7E) for uri_char in uri): + print( + "WARNING: Path URI contains Unicode or control characters, " + + f"skipping. Sanitized URI: '{stdisplay(uri, sgr=-1)}'", + file=sys.stderr, + ) + continue + + uri_components: urllib.parse.SplitResult = urllib.parse.urlsplit(uri) + + ## Sanity-check the URI (must be a local file URI, must not have a + ## query or fragment component) + if ( + uri_components.scheme != "file" + or uri_components.netloc not in ("", "localhost") + or uri_components.query != "" + or uri_components.fragment != "" + ): + print( + f"WARNING: Path URI '{uri}' does not look like a local file " + + "URI, skipping.", + file=sys.stderr, + ) + continue + + path_str: str = urllib.parse.unquote(uri_components.path) + + ## Do not permit newlines in the path. It is unlikely that these will + ## be used in practice, and they can easily be used to confuse the + ## user. + if "\n" in path_str: + print( + "WARNING: Decoded path string contains newlines, skipping. " + + f"Path: {stdisplay(path_str, sgr=-1)}", + file=sys.stderr, + ) + continue + + ## Do not permit NUL characters in the path. + if "\x00" in path_str: + print( + "WARNING: Decoded path string contains NUL characters, " + + f"skipping. Path: {stdisplay(path_str, sgr=-1)}", + file=sys.stderr, + ) + continue + + ## Ensure path_str is absolute. + if not path_str.startswith("/"): + print( + f"WARNING: Path '{stdisplay(path_str, sgr=-1)}' is not " + + "absolute, skipping.", + file=sys.stderr, + ) + continue + + ## Ensure the path is valid, exists, and is accessible. + path_item: Path = Path(path_str) + try: + path_exists = path_item.exists(follow_symlinks=False) + except OSError as exc: + ## Under Python 3.13, Path.exists() can raise on pathological + ## inputs - in particular ENAMETOOLONG (errno 36) when any single + ## path component exceeds NAME_MAX. An attacker who can inject a + ## URI here (D-Bus FileManager1 calls from another desktop app) + ## could otherwise crash this process by sending one long path. + ## Treat as "non-existent, skip" - same as the False branch. This + ## issue does not exist in Python 3.14, so we can remove this + ## check in Forky. + print( + f"WARNING: Path could not be checked (errno " + f"{exc.errno}: {exc.strerror}), skipping. Sanitized " + f"path: '{stdisplay(path_str, sgr=-1)}'", + file=sys.stderr, + ) + continue + if not path_exists: + print( + f"WARNING: Path '{stdisplay(path_str, sgr=-1)}' does not " + + "exist, skipping.", + file=sys.stderr, + ) + continue + + ## Grab the parent dir if necessary. Note that we aren't able to + ## actually highlight items or show item properties with the API that + ## PCManFM-Qt provides us, but we are able to open the parent + ## directories, which at least gets the user closer to the intended + ## action. + if handler_mode in ("--show-items", "--show-item-properties"): + path_item = path_item.parent + + ## Resolve symlinks and '..' components of the path so the user sees + ## what they're actually going to open. + try: + path_item = path_item.resolve(strict=True) + except OSError: + print( + "WARNING: Could not resolve path " + + f"'{stdisplay(str(path_item), sgr=-1)}', skipping.", + file=sys.stderr, + ) + continue + + ## Only respect directories that we can access the contents of. + if not path_item.is_dir(): + print( + f"WARNING: Path '{stdisplay(str(path_item), sgr=-1)}' does " + + "not point to a directory, skipping.", + file=sys.stderr, + ) + continue + if not os.access(path_item, os.R_OK | os.X_OK): + print( + f"WARNING: Path '{stdisplay(str(path_item), sgr=-1)}' cannot " + + "be accessed by us, skipping.", + file=sys.stderr, + ) + continue + + path_set.add(path_item) + + output_list: list[Path] = list(path_set) + output_list.sort() + return output_list + + +def main() -> NoReturn: + """ + Main function. + """ + + handler_mode: str | None = None + uri_list: list[str] = [] + + for arg_idx, arg in enumerate(sys.argv): + if arg_idx == 0: + continue + if arg in ("--show-folders", "--show-items", "--show-item-properties"): + if handler_mode is not None: + print( + f"ERROR: {arg} and {handler_mode} are mutually exclusive!", + file=sys.stderr, + ) + sys.exit(1) + handler_mode = arg + elif arg == "--": + uri_list = sys.argv[arg_idx + 1 :] + break + else: + uri_list = sys.argv[arg_idx:] + break + + if len(uri_list) == 0: + print("ERROR: No URIs provided!", file=sys.stderr) + sys.exit(1) + if handler_mode is None: + print("ERROR: No handler mode provided!", file=sys.stderr) + sys.exit(1) + + path_list: list[Path] = get_path_list_from_uris(handler_mode, uri_list) + if len(path_list) == 0: + print("ERROR: All provided URIs were invalid!", file=sys.stderr) + sys.exit(1) + + app: QApplication = QApplication(sys.argv) + + signal.signal(signal.SIGINT, signal_handler) + signal.signal(signal.SIGTERM, signal_handler) + + timer: QTimer = QTimer() + timer.timeout.connect(lambda: None) + timer.start(500) + + ## Keep a reference to the window so it isn't garbage-collected. + # pylint: disable=unused-variable + fsw: FmShimWindow = FmShimWindow(path_list) # noqa: F841 + app.exec_() + sys.exit(0) + + +if __name__ == "__main__": + main() diff --git a/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf b/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf deleted file mode 100644 index 5cca3045..00000000 --- a/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf +++ /dev/null @@ -1,16 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Quote https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html -## -## kexec_load_disabled: -## -## A toggle indicating if the kexec_load syscall has been disabled. This value defaults to 0 (false: kexec_load enabled), but can be set to 1 (true: kexec_load disabled). Once true, kexec can no longer be used, and the toggle cannot be set back to false. This allows a kexec image to be loaded before disabling the syscall, allowing a system to set up (and later use) an image without it being altered. Generally used together with the "modules_disabled" sysctl. -## Disables kexec which can be used to replace the running kernel. -kernel.kexec_load_disabled=1 - -## Why is this in a dedicated config file? -## Package ram-wipe requires kexec. However, ram-wipe could not ship a config -## file /etc/sysctl.d/40_ram-wipe.conf which sets 'kernel.kexec_load_disabled=0'. -## This is because once systemd-sysctl.service has set 'kernel.kexec_load_disabled=1' -## it cannot be undone without reboot. This is a upstream Linux security feature. diff --git a/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared b/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared new file mode 100644 index 00000000..0ef99dab --- /dev/null +++ b/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## NOTE: +## This configuration is in a dedicated file because the ram-wipe package +## requires kexec. However, ram-wipe cannot ship a config file +## /etc/sysctl.d/40_ram-wipe.conf that sets 'kernel.kexec_load_disabled=0'. +## Once systemd-sysctl.service has set 'kernel.kexec_load_disabled=1', +## it cannot be undone without a reboot. This is an upstream Linux security feature. +## Instead, ram-wipe will config-package-dev 'hide' this file. + +## Disables kexec, which can be used to replace the running kernel. +## Useful for live kernel patching without rebooting. +## +## https://en.wikipedia.org/wiki/Kexec +## +## KSPP=yes +## KSPP sets the sysctl and does not set CONFIG_KEXEC. +## +kernel.kexec_load_disabled=1 diff --git a/usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared b/usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared new file mode 100644 index 00000000..724e0f14 --- /dev/null +++ b/usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Disable the usage of the ptrace() system call by all processes. +## Restrict ptrace() as it enables programs to inspect and modify other active processes. +## Prevents native code debugging which some programs use as a method to detect tampering. +## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE. +## +## https://docs.kernel.org/admin-guide/LSM/Yama.html#ptrace-scope +## https://en.wikipedia.org/wiki/Ptrace +## https://grapheneos.org/features#attack-surface-reduction +## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928 +## https://github.com/netblue30/firejail/issues/2860 +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.yama.ptrace_scope=3 diff --git a/usr/lib/sysctl.d/30_silent-kernel-printk.conf b/usr/lib/sysctl.d/30_silent-kernel-printk.conf deleted file mode 100644 index e99f0b5a..00000000 --- a/usr/lib/sysctl.d/30_silent-kernel-printk.conf +++ /dev/null @@ -1,14 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Prevent kernel info leaks in console during boot. -## https://phabricator.whonix.org/T950 -kernel.printk = 3 3 3 3 - -## NOTE: -## For higher verbosity, the user might also want to delete file -## /etc/default/grub.d/41_quiet.cfg -## (or out-comment its settings). -## -## Alternatively, the user could consider to install the debug-misc package, -## which will undo the settings found here. diff --git a/usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared b/usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared new file mode 100644 index 00000000..3e424917 --- /dev/null +++ b/usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared @@ -0,0 +1,20 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Prevent kernel information leaks in the console during boot. +## Must be used in conjunction with kernel boot parameters. +## See /etc/default/grub.d/41_quiet_boot.cfg for implementation. +## +## https://docs.kernel.org/core-api/printk-basics.html +## +kernel.printk=3 3 3 3 + +## For increased log verbosity: +## A) Adjust (or comment out) the kernel parameters in /etc/default/grub.d/41_quiet_boot.cfg. Or, +## B) Alternatively, install the debug-misc package to undo these settings. diff --git a/usr/lib/sysctl.d/990-security-misc.conf b/usr/lib/sysctl.d/990-security-misc.conf deleted file mode 100644 index 321f3b80..00000000 --- a/usr/lib/sysctl.d/990-security-misc.conf +++ /dev/null @@ -1,175 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## NOTE: -## This file has a weird file name so /usr/lib/sysctl.d/99-protect-links.conf -## is parsed first and /usr/lib/sysctl.d/990-security-misc.conf is parsed -## afterwards. See also: -## https://github.com/Kicksecure/security-misc/pull/135 - -## Restricts the kernel log to root only. -kernel.dmesg_restrict=1 - -## Disables coredumps. This setting may be overwritten by systemd so this may not be useful. -## security-misc also disables coredumps in other ways. -kernel.core_pattern=|/bin/false - -## Does not set coredump name to 'core' which is default. Defense in depth. -kernel.core_uses_pid=1 - -## Prevent setuid processes from creating coredumps. -fs.suid_dumpable=0 - -## Don't allow writes to files that we don't own -## in world writable sticky directories, unless -## they are owned by the owner of the directory. -fs.protected_fifos=2 -fs.protected_regular=2 - -## Only allow symlinks to be followed when outside of -## a world-writable sticky directory, or when the owner -## of the symlink and follower match, or when the directory -## owner matches the symlink's owner. -## -## Prevent hardlinks from being created by users that do not -## have read/write access to the source file. -## -## These prevent many TOCTOU races. -fs.protected_symlinks=1 -fs.protected_hardlinks=1 - -## Hides kernel addresses in various files in /proc. -## Kernel addresses can be very useful in certain exploits. -## -## https://kernsec.org/wiki/index.php/Bug_Classes/Kernel_pointer_leak -kernel.kptr_restrict=2 - -## Improves ASLR effectiveness for mmap. -## Both explicit sysctl are made redundant due to automation -## https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514 -## Do NOT enable either - displaying only for clarity -## -#vm.mmap_rnd_bits=32 -#vm.mmap_rnd_compat_bits=16 - -## Restricts the use of ptrace to root. This might break some programs running under WINE. -## A workaround for WINE would be to give the wineserver and wine-preloader ptrace capabilities. This can be done by running: -## -## sudo apt-get install libcap2-bin -## sudo setcap cap_sys_ptrace=eip /usr/bin/wineserver -## sudo setcap cap_sys_ptrace=eip /usr/bin/wine-preloader -kernel.yama.ptrace_scope=2 - -## Randomize the addresses for mmap base, heap, stack, and VDSO pages -kernel.randomize_va_space=2 - -## Hardens the BPF JIT compiler and restricts it to root. -kernel.unprivileged_bpf_disabled=1 -net.core.bpf_jit_harden=2 - -## Disable asynchronous I/O for all processes. -## Valid only for linux kernel version >= 6.6. -## Command is retained here for future-proofing and completeness. -## https://forums.whonix.org/t/io-uring-security-vulnerabilties/16890/6 -kernel.io_uring_disabled=2 - -#### meta start -#### project Kicksecure -#### category networking and security -#### description -## TCP/IP stack hardening - -## A martian packet is a one with a source address which is blatantly wrong -## Recommended to keep a log of these to identify these suspicious packets -net.ipv4.conf.all.log_martians=1 -net.ipv4.conf.default.log_martians=1 - -## Protects against time-wait assassination. -## It drops RST packets for sockets in the time-wait state. -net.ipv4.tcp_rfc1337=1 - -## Disables ICMP redirect acceptance. -net.ipv4.conf.all.accept_redirects=0 -net.ipv4.conf.default.accept_redirects=0 -net.ipv4.conf.all.secure_redirects=0 -net.ipv4.conf.default.secure_redirects=0 -net.ipv6.conf.all.accept_redirects=0 -net.ipv6.conf.default.accept_redirects=0 - -## Disables ICMP redirect sending. -net.ipv4.conf.all.send_redirects=0 -net.ipv4.conf.default.send_redirects=0 - -## Ignores ICMP requests. -net.ipv4.icmp_echo_ignore_all=1 -net.ipv6.icmp.echo_ignore_all=1 - -## Ignores bogus ICMP error responses -net.ipv4.icmp_ignore_bogus_error_responses=1 - -## Enables TCP syncookies. -net.ipv4.tcp_syncookies=1 - -## Disable source routing. -net.ipv4.conf.all.accept_source_route=0 -net.ipv4.conf.default.accept_source_route=0 -net.ipv6.conf.all.accept_source_route=0 -net.ipv6.conf.default.accept_source_route=0 - -## Enable reverse path filtering to prevent IP spoofing and -## mitigate vulnerabilities such as CVE-2019-14899. -## https://forums.whonix.org/t/enable-reverse-path-filtering/8594 -net.ipv4.conf.default.rp_filter=1 -net.ipv4.conf.all.rp_filter=1 - -#### meta end - - -## Previously disabled SACK, DSACK, and FACK. -## https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109 -#net.ipv4.tcp_sack=0 -#net.ipv4.tcp_dsack=0 -#net.ipv4.tcp_fack=0 - - -#### meta start -#### project Kicksecure -#### category networking and security -#### description -## disable IPv4 TCP Timestamps - -net.ipv4.tcp_timestamps=0 - -#### meta end - - -## Disable SysRq key -kernel.sysrq=0 - -## Restrict loading TTY line disciplines to CAP_SYS_MODULE to prevent -## unprivileged attackers from loading vulnerable line disciplines -## with the TIOCSETD ioctl which has been used in exploits before -## such as https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html -## -## https://lkml.org/lkml/2019/4/15/890 -dev.tty.ldisc_autoload=0 - -## Restrict the userfaultfd() syscall to root as it can make heap sprays -## easier. -## -## https://duasynt.com/blog/linux-kernel-heap-spray -vm.unprivileged_userfaultfd=0 - -## Let the kernel only swap if it is absolutely necessary. -## Better not be set to zero: -## - https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Performance_Tuning_Guide/s-memory-tunables.html -## - https://en.wikipedia.org/wiki/Swappiness -vm.swappiness=1 - -## Disallow kernel profiling by users without CAP_SYS_ADMIN -## https://www.kernel.org/doc/Documentation/sysctl/kernel.txt -kernel.perf_event_paranoid=3 - -## Do not accept router advertisements -net.ipv6.conf.all.accept_ra=0 -net.ipv6.conf.default.accept_ra=0 diff --git a/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared b/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared new file mode 100644 index 00000000..4dc06302 --- /dev/null +++ b/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared @@ -0,0 +1,678 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## NOTE: +## This file has a special name to ensure that /usr/lib/sysctl.d/99-protect-links.conf +## is parsed first, followed by /usr/lib/sysctl.d/990-security-misc.conf. +## https://github.com/Kicksecure/security-misc/pull/135 + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## This configuration file is divided into 6 sections: +## 1. Kernel Space +## 2. User Space +## 3. Core Dumps +## 4. Swap Space +## 5. Networking +## 6. CD-ROM/DVD + +## For detailed explanations of most of the selected commands, refer to: +## https://docs.kernel.org/admin-guide/sysctl/index.html +## https://docs.kernel.org/networking/ip-sysctl.html + +## 1. Kernel Space: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-kernel +## https://kspp.github.io/Recommended_Settings#sysctls +## https://wiki.archlinux.org/title/Security#Kernel_hardening + +## Restrict kernel address visibility via /proc and other interfaces, regardless of user privileges. +## Kernel pointers expose specific locations in kernel memory. +## +## https://kernsec.org/wiki/index.php/Bug_Classes/Kernel_pointer_leak +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.kptr_restrict=2 + +## Restrict access to the kernel log buffer to users with CAP_SYSLOG. +## Kernel logs often contain sensitive information such as kernel pointers. +## +## KSPP=yes +## KSPP sets the sysctl and CONFIG_SECURITY_DMESG_RESTRICT=y. +## +kernel.dmesg_restrict=1 + +## Prevent kernel information leaks in the console during boot. +## Must be used in conjunction with kernel boot parameters. +## See /etc/default/grub.d/41_quiet_boot.cfg for implementation. +## +## https://docs.kernel.org/core-api/printk-basics.html +## +## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation. +## +#kernel.printk=3 3 3 3 + +## Restrict eBPF access to CAP_BPF. +## Disables unprivileged calls to bpf() without recovery. +## +## https://en.wikipedia.org/wiki/EBPF#Security +## https://lwn.net/Articles/660331/ +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.unprivileged_bpf_disabled=1 + +## Restrict loading TTY line disciplines to users with CAP_SYS_MODULE. +## Prevents unprivileged users from loading vulnerable line disciplines with the TIOCSETD ioctl. +## +## https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html +## https://lkml.org/lkml/2019/4/15/890 +## +## KSPP=yes +## KSPP sets the sysctl does not set CONFIG_LDISC_AUTOLOAD. +## +dev.tty.ldisc_autoload=0 + +## Restrict the userfaultfd() syscall to users with SYS_CAP_PTRACE. +## Reduces the likelihood of use-after-free exploits from heap sprays. +## +## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cefdca0a86be517bc390fc4541e3674b8e7803b0 +## https://duasynt.com/blog/linux-kernel-heap-spray +## +## KSPP=yes +## KSPP sets the sysctl. +## +vm.unprivileged_userfaultfd=0 + +## Disables kexec, which can be used to replace the running kernel. +## Useful for live kernel patching without rebooting. +## +## https://en.wikipedia.org/wiki/Kexec +## +## See /usr/lib/sysctl.d/30_security-misc_kexec-disable.conf for implementation. +## +## KSPP=yes +## KSPP sets the sysctl and does not set CONFIG_KEXEC. +## +#kernel.kexec_load_disabled=1 + +## Disable the SysRq key to prevent leakage of kernel information. +## The Secure Attention Key (SAK) can no longer be utilized. +## +## https://docs.kernel.org/admin-guide/sysrq.html +## https://www.kicksecure.com/wiki/SysRq +## https://github.com/xairy/unlockdown +## +## KSPP=yes +## KSPP sets the less strict CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=176. +## +kernel.sysrq=0 + +## Disable user namespaces entirely. +## User namespaces aim to improve sandboxing and accessibility for unprivileged users. +## Disabling entirely will reduce compatibility with some AppArmor profiles. +## Disabling entirely is known to break the UPower systemd service. +## Not recommended due to well-known breakages across numerous software packages. +## +## https://lwn.net/Articles/673597/ +## https://madaidans-insecurities.github.io/linux.html#kernel +## https://github.com/a13xp0p0v/kernel-hardening-checker#questions-and-answers +## https://github.com/NixOS/nixpkgs/pull/84522#issuecomment-614640601 +## https://github.com/Kicksecure/security-misc/pull/263 +## +## KSPP=no +## KSPP sets the sysctl. +## +#user.max_user_namespaces=0 + +## Restrict user namespaces to users with CAP_SYS_ADMIN. +## See the user.max_user_namespaces setting for more details. +## This is a Debian-specific kernel feature, not a Linux mainline setting. +## Unprivileged user namespaces pose substantial privilege escalation risks. +## Flatpak requires unprivileged users to create new user namespaces for sandboxing. +## Restricting is known to cause breakages in some AppImages and the Evolution Email Client. +## Not recommended due to widespread breakages across many software packages. +## +## https://salsa.debian.org/debian/bubblewrap/-/blob/debian/latest/debian/README.Debian +## https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction +## https://github.com/flatpak/flatpak/wiki/User-namespace-requirements +## https://forums.kicksecure.com/t/can-not-run-flatpak-apps-after-kicksecure-update/592 +## https://forums.kicksecure.com/t/cannot-run-some-appimage-apps-after-kicksecure-upate/594 +## https://forums.kicksecure.com/t/impossible-to-start-evolution-app-since-the-last-update/601 +## https://github.com/Kicksecure/security-misc/issues/274 +## +#kernel.unprivileged_userns_clone=0 + +## Restricts kernel profiling to users with CAP_PERFMON. +## The performance events system should not be accessible by unprivileged users. +## Other distributions such as Ubuntu and Fedora may permit further restricting. +## +## https://docs.kernel.org/admin-guide/perf-security.html#unprivileged-users +## https://lore.kernel.org/kernel-hardening/1469630746-32279-1-git-send-email-jeffv@google.com/ +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.perf_event_paranoid=3 + +## Force immediate system reboots on the occurrence of a single kernel panic. +## Increases resilience and limits impact of denial-of-service attacks as system automatically restarts. +## Ensures the system does not hang forever if a panic occurs, reducing susceptibility to both cold and warm boot attacks. +## Immediate rebooting also prevents persistent information disclosure on panic details that were dumped to screen. +## +## KSPP=yes +## KSPP sets CONFIG_PANIC_TIMEOUT=-1. +## +kernel.panic=-1 + +## Force the kernel to immediately panic on "oopses" and kernel warnings in the WARN() path. +## Panics may be due to false-positives such as bad drivers. +## Both allowed limits are set to one so that panics occur on the single first instance of either scenario. +## Oopses are serious but non-fatal errors. +## Certain "oopses" can sometimes indicate and thwart potential kernel exploitation attempts. +## Warnings are messages generated by the kernel to indicate unexpected conditions or errors. +## By default, code execution continues regardless of warnings emitted by macros like WARN() and WARN_ON(). +## Note that by forcing kernel panics on oopses and warnings, this exposes the system to targeted denial-of-service attacks. +## +## https://en.wikipedia.org/wiki/Kernel_panic#Linux +## https://en.wikipedia.org/wiki/Linux_kernel_oops +## https://lwn.net/Articles/876209/ +## https://git.sr.ht/~gregkh/presentation-security/tree/3fdaf81a2f8b2c8d64cdb2f529cc714624868aa8/item/security-stuff.pdf +## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panisc-on-oops-1-sysctl-for-better-security/7713 +## +## KSPP=yes +## KSPP sets the sysctls and CONFIG_PANIC_ON_OOPS=y +## +## Note that this must be used with kernel.panic=-1 for it to function as intended. +## +## See /usr/libexec/security-misc/panic-on-oops for implementation. +## +#kernel.oops_limit=1 +#kernel.warn_limit=1 + +## Force immediate kernel panic on OOM (out of memory) scenarios. +## Registers a kernel panic whenever the oom_killer is triggered to kill some rogue process based on their OOM score. +## This prevents security features such as the screen locker, kloak, and emerg-shutdown from being arbitrarily terminated. +## Enabling these two together creates a risk of userspace-based denial-of-service attacks that maliciously fill memory. +## This forces immediate system reboot rather than placing any reliance on the oom_killer. +## Known to cause extreme user experience problems with certain applications as the Tor Browser. +## Enabling by default requires improved upstream handling of user space OOM better accounting for desktop users. +## +## https://en.wikipedia.org/wiki/Out_of_memory +## https://forums.whonix.org/t/screen-locker-in-security-can-we-disable-these-at-least-4-backdoors/8128/14 +## https://github.com/KSPP/kspp.github.io/issues/9 +## https://github.com/Kicksecure/security-misc/issues/324 +## +## Note that this must be used with kernel.panic=-1 for it to function as intended. +## +#vm.panic_on_oom=2 + +## Force immediate kernel panic on certain NMIs (Non-Maskable Interrupts). +## NMIs are hardware interrupts that cannot be ignored by standard interrupt-masking techniques. +## NMIs are reserved for critical events that require immediate attention. +## Panic upon a NMI indicating a serious hardware-level I/O issue to prevent data corruption. +## Panic upon a NMI indicating uncorrectable memory and hardware errors to prevent data corruption. +## Panic upon receiving an undefined or unknown NMI. +## All three must first be tested to ensure there are no pre-existing issues on user hardware. +## After confirming stability of each they can then be used to prevent data corruption from hardware sources. +## These are valuable for high-reliability systems where data integrity is critical. +## +## https://en.wikipedia.org/wiki/Non-maskable_interrupt +## https://docs.kernel.org/trace/events-nmi.html +## https://0xax.gitbook.io/linux-insides/summary/interrupts/linux-interrupts-6 +## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_for_real_time/7/html/reference_guide/non-maskable_interrupts +## +## Note that these must be used with kernel.panic=-1 for them to function as intended. +## +#kernel.panic_on_io_nmi=1 +#kernel.panic_on_unrecovered_nmi=1 +#kernel.unknown_nmi_panic=1 + +## Disable the use of legacy TIOCSTI operations which can be used to inject keypresses. +## Can lead to privilege escalation by pushing characters into a controlling TTY. +## Will break out-dated screen readers that continue to rely on this legacy functionality. +## Note this was already disabled by default as of Linux kernel 6.2. +## +## https://lore.kernel.org/lkml/20221228205726.rfevry7ud6gmttg5@begin/T/ +## +## KSPP=yes +## KSPP sets the sysctl and does not set CONFIG_LEGACY_TIOCSTI. +## +dev.tty.legacy_tiocsti=0 + +## Disable asynchronous I/O for all processes. +## Use of io_uring has been the leading cause of numerous kernel exploits. +## Disabling will reduce the read/write performance of storage devices. +## +## https://en.wikipedia.org/wiki/Io_uring#Security +## https://lwn.net/Articles/902466/ +## https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html +## https://github.com/moby/moby/pull/46762 +## https://forums.whonix.org/t/io-uring-security-vulnerabilties/16890 +## +kernel.io_uring_disabled=2 + +## Disable 32-bit Virtual Dynamic Shared Object (vDSO) mappings. +## Legacy compatibility feature for superseded glibc versions. +## +## https://lore.kernel.org/lkml/20080409082927.BD59E26F992@magilla.localdomain/T/ +## https://lists.openwall.net/linux-kernel/2014/03/11/3 +## +## KSPP=yes +## KSPP sets the kernel parameter and does not set CONFIG_COMPAT_VDSO. +## +## See /etc/default/grub.d/40_kernel_hardening.cfg for another additional implementation. +## +abi.vsyscall32=0 + +## 2. User Space: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-userspace + +## Disable the usage of the ptrace() system call by all processes. +## Restrict ptrace() as it enables programs to inspect and modify other active processes. +## Prevents native code debugging which some programs use as a method to detect tampering. +## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE. +## +## https://docs.kernel.org/admin-guide/LSM/Yama.html#ptrace-scope +## https://en.wikipedia.org/wiki/Ptrace +## https://grapheneos.org/features#attack-surface-reduction +## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928 +## https://github.com/netblue30/firejail/issues/2860 +## +## KSPP=yes +## KSPP sets the sysctl. +## +## See /usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf for implementation. +## +#kernel.yama.ptrace_scope=3 + +## Maximize bits of entropy for improved effectiveness of mmap ASLR. +## The maximum number of bits depends on CPU architecture (the ones shown below are for x86). +## Both explicit sysctl are made redundant due to automation. +## Do NOT enable either sysctl - displaying only for clarity. +## +## https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514 +## +## See /usr/libexec/security-misc/mmap-rnd-bits for implementation. +## +#vm.mmap_rnd_bits=32 +#vm.mmap_rnd_compat_bits=16 + +## Prevent hardlink creation by users who do not have read/write/ownership of source file. +## Only allow symlinks to be followed when outside of world-writable sticky directories. +## Allow symlinks when the owner and follower match or when the directory owner matches the symlink's owner. +## Hardens cross-privilege boundaries if root process follows a hardlink/symlink belonging to another user. +## This mitigates many hardlink/symlink-based TOCTOU races in world-writable directories like /tmp. +## +## https://wiki.archlinux.org/title/Security#File_systems +## https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=/tmp +## https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use#Preventing_TOCTOU +## +## KSPP=yes +## KSPP sets the sysctls. +## +fs.protected_hardlinks=1 +fs.protected_symlinks=1 + +## Disallow writes to files in world-writable sticky directories unless owned by the directory owner. +## Also applies to group-writable sticky directories to make data spoofing attacks more difficult. +## Prevents unintentional writes to attacker-controlled files. +## +## KSPP=yes +## KSPP sets the sysctls. +## +fs.protected_fifos=2 +fs.protected_regular=2 + +## Enable ASLR for mmap base, stack, VDSO pages, and heap. +## Forces shared libraries to be loaded to random addresses. +## Start location of PIE-linked binaries is randomized. +## Heap randomization can lead to breakages with legacy applications. +## +## https://en.wikipedia.org/wiki/Address_space_layout_randomization#Linux +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.randomize_va_space=2 + +## Raise the minimum address a process can request for memory mapping to 64KB as a form of defense-in-depth. +## Prevents kernel null pointer dereference vulnerabilities which may trigger kernel panics. +## Protects against local unprivileged users gaining root privileges by mapping data to low memory pages. +## Some legacy applications may still depend on low virtual memory addresses for proper functionality. +## +## https://googleprojectzero.blogspot.com/2023/01/exploiting-null-dereferences-in-linux.html +## https://access.redhat.com/articles/20484 +## https://wiki.debian.org/mmap_min_addr +## +## KSPP=yes +## KSPP sets CONFIG_DEFAULT_MMAP_MIN_ADDR=65536. +## +vm.mmap_min_addr=65536 + +## Increase the maximum number of memory map areas a process is permitted to utilize. +## Addresses performance, crash, and start-up issues for some memory-intensive applications. +## Required to accommodate the very large number of guard pages created by hardened_malloc. +## Kicksecure version 18 will deprecate hardened_malloc, so this sysctl will be applied here instead. +## +## https://archlinux.org/news/increasing-the-default-vmmax_map_count-value/ +## https://github.com/GrapheneOS/hardened_malloc#traditional-linux-based-operating-systems +## https://github.com/Kicksecure/hardened_malloc/blob/master/debian/hardened_malloc.conf +## https://www.kicksecure.com/wiki/Hardened_Malloc#Deprecation_in_Kicksecure +## +vm.max_map_count=1048576 + +## Disable the miscellaneous binary format virtual file system to prevent unintended code execution. +## Prevents registering interpreters for various binary formats based on a magic number or their file extension. +## Otherwise arbitrary executables with recognized file formats will be passed to relevant user space applications. +## These interpreters will then run with root permissions when a setuid binary is owned by root. +## Can stop maliciously crafted files with specific file extensions from automatically executing. +## Breaks many scripts that do not have appropriate shebang interpreter directives (#!/bin/...). +## +## https://docs.kernel.org/admin-guide/binfmt-misc.html +## https://salsa.debian.org/debian/binfmt-support +## https://access.redhat.com/solutions/1985633 +## https://en.wikipedia.org/wiki/Binfmt_misc +## https://security.stackexchange.com/questions/271786/does-allowing-binfmt-misc-significantly-increase-the-attack-surface-for-unprivil +## https://unix.stackexchange.com/questions/439569/what-kinds-of-executable-formats-do-the-files-under-proc-sys-fs-binfmt-misc-al +## https://github.com/Kicksecure/security-misc/pull/249 +## +## KSPP=no +## KSPP does not set CONFIG_BINFMT_MISC. +## +## This is disabled by default due to file/folder permission issues: +## https://github.com/Kicksecure/security-misc/issues/267 +## +#fs.binfmt_misc.status=0 + +## 3. Core Dumps: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#core-dumps + +## Disable core dump files by preventing any pattern names. +## This setting may be overwritten by systemd and is not comprehensive. +## Core dumps are also disabled in security-misc-shared via other means. +## +## https://wiki.archlinux.org/title/Core_dump#Disabling_automatic_core_dumps +## +kernel.core_pattern=|/bin/false + +## Prevent setuid processes or otherwise protected/tainted binaries from creating core dumps. +## Any process which has changed privilege levels or is execute-only will not be dumped. +## +## https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598 +## +## KSPP=yes +## KSPP sets the sysctl. +## +fs.suid_dumpable=0 + +## Set core dump file name to 'core.PID' instead of 'core' as a form of defense-in-depth. +## If core dumps are permitted, only useful if PID listings are hidden from non-root users. +## +kernel.core_uses_pid=1 + +## 4. Swap Space: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#swap + +## Limit the copying of memory to the swap device only if absolutely necessary. +## Minimizes the likelihood of writing potentially sensitive contents to disk. +## Not recommended to set to zero since this disables periodic write behavior. +## +## https://en.wikipedia.org/wiki/Memory_paging#Linux +## https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Performance_Tuning_Guide/s-memory-tunables.html +## +vm.swappiness=1 + +## 5. Networking: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-network +## https://wiki.archlinux.org/title/Sysctl#TCP/IP_stack_hardening + +## Enable hardening of the BPF JIT compiler for all users. +## Provides some mitigation against JIT spraying. +## +## https://en.wikipedia.org/wiki/JIT_spraying +## https://www.blackhat.com/docs/eu-16/materials/eu-16-Reshetova-Randomization-Can't-Stop-BPF-JIT-Spray-wp.pdf +## https://lwn.net/Articles/686098/ +## https://lwn.net/Articles/525609/ +## +## KSPP=yes +## KSPP sets the sysctl. +## +net.core.bpf_jit_harden=2 + +## Enable TCP SYN cookie protection to assist against SYN flood attacks. +## +## https://en.wikipedia.org/wiki/SYN_flood +## https://cateee.net/lkddb/web-lkddb/SYN_COOKIES.html +## +## KSPP=yes +## KSPP sets CONFIG_SYN_COOKIES=y. +## +net.ipv4.tcp_syncookies=1 + +## Protect against TCP time-wait assassination hazards. +## Drops RST packets for sockets in the time-wait state. +## +## https://tools.ietf.org/html/rfc1337 +## +net.ipv4.tcp_rfc1337=1 + +## Enable reverse path filtering (source validation) of packets received from all interfaces. +## Prevents IP spoofing and mitigates vulnerabilities such as CVE-2019-14899. +## The second "default" command fixes a bug in the existing kernel implementation. +## +## https://en.wikipedia.org/wiki/IP_address_spoofing +## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-reverse_path_forwarding#sect-Security_Guide-Server_Security-Reverse_Path_Forwarding +## https://forums.whonix.org/t/enable-reverse-path-filtering/8594 +## https://seclists.org/oss-sec/2019/q4/122 +## https://github.com/Kicksecure/security-misc/pull/261 +## +net.ipv4.conf.*.rp_filter=1 +net.ipv4.conf.default.rp_filter=1 + +## Disable ICMP redirect acceptance and redirect sending messages. +## Prevents man-in-the-middle attacks and minimizes information disclosure. +## If ICMP redirects are permitted, accept messages only through approved gateways (kernel default). +## Approving gateways requires the managing of a default gateway list. +## +## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing#sect-Security_Guide-Server_Security-Disable-Source-Routing +## https://www.frozentux.net/ipsysctl-tutorial/chunkyhtml/theconfvariables.html +## https://www.debian.org/doc/manuals/securing-debian-manual/network-secure.en.html +## https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked +## https://github.com/Kicksecure/security-misc/pull/248 +## +net.ipv4.conf.*.accept_redirects=0 +net.ipv4.conf.*.send_redirects=0 +net.ipv6.conf.*.accept_redirects=0 +#net.ipv4.conf.*.secure_redirects=1 + +## Deny sending and receiving RFC1620 shared media redirects. +## Relevant mainly for network interfaces that operate over shared media such as Ethernet hubs. +## Stops the kernel from sending ICMP redirects to specific networks from the connected network. +## This variable overrides the use secure_redirects. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## https://datatracker.ietf.org/doc/html/rfc1620 +## https://www.frozentux.net/ipsysctl-tutorial/chunkyhtml/theconfvariables.html +## +net.ipv4.conf.*.shared_media=0 + +## Enable ARP (Address Resolution Protocol) filtering. +## Prevents the Linux kernel from handling the ARP table globally. +## Can mitigate some ARP spoofing and ARP cache poisoning attacks. +## Improper filtering can lead to increased ARP traffic and inadvertently block legitimate ARP requests. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## +net.ipv4.conf.*.arp_filter=1 + +## Respond to ARP (Address Resolution Protocol) requests only if the target IP address is on-link. +## Reduces IP spoofing attacks by limiting the scope of allowable ARP responses. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## https://github.com/mullvad/mullvadvpn-app/blob/main/audits/2024-12-10-X41-D-Sec.md#mllvd-cr-24-03-virtual-ip-address-of-tunnel-device-leaks-to-network-adjacent-participant-severity-medium +## https://github.com/mullvad/mullvadvpn-app/pull/7141 +## https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf +## +## Can lead to breakages with certain VM configurations that may be resolved by lowering protection to `arp_ignore=1`. +## https://github.com/Kicksecure/security-misc/pull/290 +## +net.ipv4.conf.*.arp_ignore=2 + +## Drop gratuitous ARP (Address Resolution Protocol) packets. +## Stops ARP responses sent by a device without being explicitly requested. +## Prevents ARP cache poisoning by rejecting fake ARP entries into a network. +## Prevents man-in-the-middle and denial-of-service attacks. +## May cause breakages when ARP proxies are used in the network. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## https://patchwork.ozlabs.org/project/netdev/patch/1428652454-1224-3-git-send-email-johannes@sipsolutions.net/ +## https://www.practicalnetworking.net/series/arp/gratuitous-arp/ +## +net.ipv4.conf.*.drop_gratuitous_arp=1 + +## Ignore ICMP echo requests. +## Prevents clock fingerprinting through ICMP timestamps and Smurf attacks. +## +## https://en.wikipedia.org/wiki/Smurf_attack +## +net.ipv4.icmp_echo_ignore_all=1 +net.ipv6.icmp.echo_ignore_all=1 + +## Ignore bogus ICMP error responses. +## Mitigates attacks designed to fill log files with useless error messages. +## +net.ipv4.icmp_ignore_bogus_error_responses=1 + +## Disable source routing which allows users to redirect network traffic. +## Prevents man-in-the-middle attacks in which the traffic is redirected. +## +## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing +## +net.ipv4.conf.*.accept_source_route=0 +net.ipv6.conf.*.accept_source_route=0 + +## Do not accept IPv6 router advertisements (RAs) and solicitations. +## RAs are unsecured and unauthenticated and any device on the local link can send and accept them without verification. +## Malicious RAs can activate IPv6 connectivity on dormant hosts leading to unauthorized access. +## Flooding the network with malicious RAs can lead to denial-of-service attacks. +## Rogue RAs can lead to interception of all network traffic by setting the attacker's system as the default gateway. +## +## https://datatracker.ietf.org/doc/html/rfc6104 +## https://datatracker.ietf.org/doc/html/rfc6105 +## https://archive.conference.hitb.org/hitbsecconf2012kul/materials/D1T2%20-%20Marc%20Heuse%20-%20IPv6%20Insecurity%20Revolutions.pdf +## +net.ipv6.conf.*.accept_ra=0 + +## Disable SACK and DSACK. +## Select acknowledgements (SACKs) are a known common vector of exploitation. +## Duplicate select acknowledgements (DSACKs) are an extension of SACK. +## Disabling can cause severe connectivity issues on networks with high latency or packet loss. +## Enabling on stable high-bandwidth networks can lead to reduced efficiency of TCP connections. +## +## https://datatracker.ietf.org/doc/html/rfc2018 +## https://datatracker.ietf.org/doc/html/rfc2883 +## https://access.redhat.com/sites/default/files/attachments/20150325_network_performance_tuning.pdf +## https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md +## https://wiki.archlinux.org/title/Sysctl#TCP_Selective_Acknowledgement +## https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109/5 +## +## SACK and DSACK are currently enabled. +## +#net.ipv4.tcp_sack=0 +#net.ipv4.tcp_dsack=0 + +## Disable TCP timestamps to limit device fingerprinting via system time. +## Timestamps allow round-trip time measurement and protection against wrapped sequence numbers. +## Disabling timestamps on very fast links is likely to cause TCP Sequence Numbers to wrap. +## Segments with wrapped numbers will be incorrectly discarded, reducing network performance. +## +## https://datatracker.ietf.org/doc/html/rfc1323 +## https://forums.whonix.org/t/do-ntp-and-tcp-timestamps-really-leak-your-local-time/7824 +## https://web.archive.org/web/20170201160732/https://mailman.boum.org/pipermail/tails-dev/2013-December/004520.html +## https://access.redhat.com/sites/default/files/attachments/20150325_network_performance_tuning.pdf +## +net.ipv4.tcp_timestamps=0 + +## Disable reuse of TIME_WAIT sockets for new outgoing connections. +## The safety of reusing of TIME_WAIT sockets requires enabling TCP timestamps. +## The kernel uses timestamps to verify a new connection is not a duplicate segment from an older connection. +## Hence TIME-WAIT sockets should wait the full timeout period before being made available again. +## Can lead to port exhaustion on high-traffic networks with numerous short-lived connections. +## +## https://vincent.bernat.ch/en/blog/2014-tcp-time-wait-state-linux +## +net.ipv4.tcp_tw_reuse=0 + +## Enable logging of packets with impossible source or destination addresses. +## Martian and unroutable packets may be used for malicious purposes. +## Recommended to keep a (kernel dmesg) log of these to identify suspicious packets. +## Useful for troubleshooting and diagnostics but not necessary by default. +## Previously known to cause performance issues, especially on systems with multiple interfaces. +## This no longer seems to be a problem. +## +## https://wiki.archlinux.org/title/Sysctl#Log_martian_packets +## https://www.cyberciti.biz/faq/linux-log-suspicious-martian-packets-un-routable-source-addresses/ +## https://support.scc.suse.com/s/kb/Martian-sources-errors-showing-in-messages-log?language=en_US +## https://github.com/Kicksecure/security-misc/issues/214 +## +net.ipv4.conf.*.log_martians=1 + +## Enable IPv6 Privacy Extensions to prefer temporary addresses over public addresses. +## The temporary/privacy address is used as the source for all outgoing traffic. +## Must be used in combination with /usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf. +## Must be used in combination with /usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf. +## Should be used with MAC randomization in /usr/lib/NetworkManager/conf.d/80_randomize-mac.conf. +## +## MAC randomization breaks root server and VirtualBox DHCP, likely due to IPv6 Privacy Extensions. +## +## https://datatracker.ietf.org/doc/html/rfc4941 +## https://github.com/Kicksecure/security-misc/pull/145 +## https://github.com/Kicksecure/security-misc/issues/184 +## +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. +## +#net.ipv6.conf.*.use_tempaddr=2 + +## 6. CD-ROM/DVD +## +## https://github.com/Kicksecure/security-misc/issues/348 + +## Disable CD-ROM/DVD drive automatic tray closure and ejection functionality. +## Prevents scripted tray cycling attacks. +## Requires users to press physical hardware buttons to insert and eject media. +## +## https://github.com/torvalds/linux/blob/master/drivers/cdrom/cdrom.c +## https://github.com/Kicksecure/security-misc/issues/348 +## +dev.cdrom.autoclose=0 +dev.cdrom.autoeject=0 + +## Disable all CD-ROM/DVD drive debug messages. +## Prevents verbose logging that could leak drive information. +## +## https://github.com/torvalds/linux/blob/master/drivers/cdrom/cdrom.c +## https://github.com/Kicksecure/security-misc/issues/348 +## +dev.cdrom.debug=0 + +## Restrict CD-ROM/DVD drives by disabling usage and hardware access. +## Disable the kernel from checking for media changes to the drive bay. +## Lock the drive bay preventing the physical eject button from opening the tray. +## +## https://github.com/torvalds/linux/blob/master/drivers/cdrom/cdrom.c +## https://github.com/Kicksecure/security-misc/issues/348 +## +#dev.cdrom.check_media=0 +#dev.cdrom.lock=1 diff --git a/usr/lib/systemd/coredump.conf.d/30_security-misc.conf b/usr/lib/systemd/coredump.conf.d/30_security-misc.conf deleted file mode 100644 index 519f838c..00000000 --- a/usr/lib/systemd/coredump.conf.d/30_security-misc.conf +++ /dev/null @@ -1,2 +0,0 @@ -[Coredump] -Storage=none diff --git a/usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..2d02bc99 --- /dev/null +++ b/usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Coredump] +Storage=none diff --git a/usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..8e6ca79f --- /dev/null +++ b/usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,7 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Mitigation for https://www.openwall.com/lists/oss-security/2026/04/08/1 + +[Journal] +ForwardToWall=no diff --git a/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf b/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf deleted file mode 100644 index ad1e9479..00000000 --- a/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf +++ /dev/null @@ -1,2 +0,0 @@ -#[Network] -#IPv6PrivacyExtensions=kernel diff --git a/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop b/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop new file mode 100644 index 00000000..70aca2c9 --- /dev/null +++ b/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop @@ -0,0 +1,13 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## MAC randomisation breaks root server and VirtualBox DHCP likely due to IPv6 Privacy Extensions. +## +## https://datatracker.ietf.org/doc/html/rfc4941 +## https://github.com/Kicksecure/security-misc/pull/145 +## https://github.com/Kicksecure/security-misc/issues/184 +## +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. + +#[Network] +#IPv6PrivacyExtensions=kernel diff --git a/usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..9e513c62 --- /dev/null +++ b/usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[PStore] +Storage=none diff --git a/usr/lib/systemd/system-preset/50-security-misc.preset b/usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared similarity index 58% rename from usr/lib/systemd/system-preset/50-security-misc.preset rename to usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared index a852419c..8b1c2615 100644 --- a/usr/lib/systemd/system-preset/50-security-misc.preset +++ b/usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618 @@ -17,3 +17,13 @@ disable proc-hidepid.service ## Disable due to issues. See: ## https://github.com/Kicksecure/security-misc/issues/159 disable harden-module-loading.service + +## TODO: polish, test +## Disable due to timing difficulties. See: +## https://github.com/systemd/systemd/issues/38261#issuecomment-3134580852 +disable ensure-shutdown.service +disable ensure-shutdown-trigger.service + +## memlockd is needed by emerg-shutdown, but the service is not, the user can +## enable this manually if desired. +disable memlockd.service diff --git a/usr/lib/systemd/system/block-shutdown.service#security-misc-shared b/usr/lib/systemd/system/block-shutdown.service#security-misc-shared new file mode 100644 index 00000000..3d4be21b --- /dev/null +++ b/usr/lib/systemd/system/block-shutdown.service#security-misc-shared @@ -0,0 +1,29 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This unit, if uncommented and started, will prevent the system from ever +## shutting down unless ensure-shutdown.service is enabled and correctly +## configured. If you have enabled ensure-shutdown.service and tuned the +## ENSURE_SHUTDOWN_TIMEOUT and DefaultTimeoutStopSec variables (in +## /etc/security-misc/emerg-shutdown/30_security_misc.conf and +## /etc/systemd/system.conf respectively) and want to make sure +## ensure-shutdown.service actually works, you can uncomment this unit and +## start it with `sudo systemctl start block-shutdown.service`. If the systems +## successfully powers down even with this unit started, +## ensure-shutdown.service is working. + +# [Unit] +# Description=Blocks shutdown indefinitely unless ensure-shutdown.service is enabled +# +# [Service] +# Type=exec +# ExecStart=bash -c -- "trap '' SIGTERM; sleep infinity" +# KillSignal=SIGTERM +# FinalKillSignal=SIGTERM +# RestartKillSignal=SIGTERM +# WatchdogSignal=SIGTERM +# SendSIGHUP=no +# TimeoutStopSec=infinity +# +# [Install] +# WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared b/usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared new file mode 100644 index 00000000..06c232e0 --- /dev/null +++ b/usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared @@ -0,0 +1,30 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## WARNING: Do not add ANY "Requires" dependencies to this unit. If a required +## dependency terminates, systemd will terminate emerg-shutdown, and many +## services crash when the boot drive is removed. Use "Wants" instead. + +[Unit] +Description=Emergency shutdown when boot media is removed +Documentation=https://github.com/Kicksecure/security-misc +DefaultDependencies=no +Before=sysinit.target +Wants=systemd-udevd.service +After=systemd-udevd.service +Wants=local-fs.target +After=local-fs.target +ConditionPathExists=!/usr/share/qubes/marker-vm +## Do not run emerg-shutdown.service in case 'rd.live.ram' or 'rd.live.ram=1' +## is set. +## https://forums.kicksecure.com/t/how-to-run-iso-live-mode-from-ram/1542/9 +ConditionKernelCommandLine=!rd.live.ram +ConditionKernelCommandLine=!rd.live.ram=1 + +[Service] +Type=notify +ExecStart=/usr/libexec/security-misc/emerg-shutdown +NotifyAccess=main + +[Install] +WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared b/usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared new file mode 100644 index 00000000..593f08de --- /dev/null +++ b/usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared @@ -0,0 +1,19 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## NOTE: If enabling this unit, also enable ensure-shutdown.service, otherwise +## this will do nothing. + +[Unit] +Description=Forcibly shut down the system if normal shutdown gets stuck (alternate trigger unit) +Documentation=https://github.com/Kicksecure/security-misc +ConditionPathExists=!/usr/share/qubes/marker-vm + +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=true +ExecStop=bash -c -- 'echo "d" > /run/emerg-shutdown-trigger' + +[Install] +WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared b/usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared new file mode 100644 index 00000000..ad124f55 --- /dev/null +++ b/usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## NOTE: If enabling this unit, also enable ensure-shutdown-trigger.service, +## otherwise this will likely be unable to unstick a stuck shutdown. + +[Unit] +Description=Forcibly shut down the system if normal shutdown gets stuck +Documentation=https://github.com/Kicksecure/security-misc +DefaultDependencies=no +Before=sysinit.target +Requires=systemd-udevd.service +After=systemd-udevd.service +Wants=emerg-shutdown.service +After=emerg-shutdown.service +ConditionPathExists=!/usr/share/qubes/marker-vm + +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=/usr/libexec/security-misc/ensure-shutdown +ExecStop=bash -c -- 'echo "d" > /run/emerg-shutdown-trigger' +KillMode=process + +[Install] +WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/harden-module-loading.service b/usr/lib/systemd/system/harden-module-loading.service#security-misc-shared similarity index 84% rename from usr/lib/systemd/system/harden-module-loading.service rename to usr/lib/systemd/system/harden-module-loading.service#security-misc-shared index ed2392c3..8efea40e 100644 --- a/usr/lib/systemd/system/harden-module-loading.service +++ b/usr/lib/systemd/system/harden-module-loading.service#security-misc-shared @@ -1,3 +1,6 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + [Unit] Description=Disable the loading of additional modules after systemd-modules-load.service Documentation=https://github.com/Kicksecure/security-misc diff --git a/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf b/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared similarity index 69% rename from usr/lib/systemd/system/haveged.service.d/30_security-misc.conf rename to usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared index fd79dc81..29814644 100644 --- a/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf +++ b/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Service] diff --git a/usr/lib/systemd/system/hide-hardware-info.service b/usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared similarity index 84% rename from usr/lib/systemd/system/hide-hardware-info.service rename to usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared index 68d7401a..659c3f57 100644 --- a/usr/lib/systemd/system/hide-hardware-info.service +++ b/usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] diff --git a/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared b/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared new file mode 100644 index 00000000..136ff7ae --- /dev/null +++ b/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared @@ -0,0 +1,15 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=kill VBoxDRMClient during shutdown to allow /tmp to be unmounted properly +ConditionVirtualization=oracle + +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=true +ExecStop=/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown + +[Install] +WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/panic-on-oops.service#security-misc-shared b/usr/lib/systemd/system/panic-on-oops.service#security-misc-shared new file mode 100644 index 00000000..bf97d7f2 --- /dev/null +++ b/usr/lib/systemd/system/panic-on-oops.service#security-misc-shared @@ -0,0 +1,21 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=Sets 'sysctl' settings relating to kernel panics on both oopses and warnings late during the boot process. +Documentation=https://github.com/Kicksecure/security-misc + +ConditionKernelCommandLine=!panic-on-oops=0 + +After=multi-user.target +After=graphical.target +After=getty.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/security-misc/panic-on-oops enable +ExecStop=/usr/libexec/security-misc/panic-on-oops disable + +[Install] +WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/permission-hardener.service b/usr/lib/systemd/system/permission-hardener.service#security-misc-shared similarity index 73% rename from usr/lib/systemd/system/permission-hardener.service rename to usr/lib/systemd/system/permission-hardener.service#security-misc-shared index 94ddd6b5..1285bf06 100644 --- a/usr/lib/systemd/system/permission-hardener.service +++ b/usr/lib/systemd/system/permission-hardener.service#security-misc-shared @@ -1,8 +1,8 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] -Description=Permission Hardener at Boot Time (opt-in in addition to security-misc package installation time hardening) +Description=Permission Hardener at Boot Time (opt-in in addition to security-misc-shared package installation time hardening) Documentation=https://github.com/Kicksecure/security-misc DefaultDependencies=no diff --git a/usr/lib/systemd/system/proc-hidepid.service b/usr/lib/systemd/system/proc-hidepid.service#security-misc-shared similarity index 68% rename from usr/lib/systemd/system/proc-hidepid.service rename to usr/lib/systemd/system/proc-hidepid.service#security-misc-shared index 7acad5b5..d7ea4d9e 100644 --- a/usr/lib/systemd/system/proc-hidepid.service +++ b/usr/lib/systemd/system/proc-hidepid.service#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] @@ -12,7 +12,7 @@ After=local-fs.target [Service] Type=oneshot -ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc +ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2,gid=proc /proc RemainAfterExit=yes [Install] diff --git a/usr/lib/systemd/system/remount-secure.service b/usr/lib/systemd/system/remount-secure.service#security-misc-shared similarity index 80% rename from usr/lib/systemd/system/remount-secure.service rename to usr/lib/systemd/system/remount-secure.service#security-misc-shared index b801fe2b..2489d347 100644 --- a/usr/lib/systemd/system/remount-secure.service +++ b/usr/lib/systemd/system/remount-secure.service#security-misc-shared @@ -1,10 +1,12 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] Description=remount /home /tmp /dev/shm /run with nosuid,nodev (default) and noexec (opt-in) Documentation=https://github.com/Kicksecure/security-misc +ConditionKernelCommandLine=!remountsecure=0 + DefaultDependencies=no Before=sysinit-post.target @@ -24,7 +26,7 @@ Requires=sysinit.target [Service] Type=oneshot RemainAfterExit=yes -ExecStart=remount-secure +ExecStart=remount-secure 3 [Install] WantedBy=sysinit-post.target diff --git a/usr/lib/systemd/system/remove-system-map.service b/usr/lib/systemd/system/remove-system-map.service#security-misc-shared similarity index 83% rename from usr/lib/systemd/system/remove-system-map.service rename to usr/lib/systemd/system/remove-system-map.service#security-misc-shared index c6eb17b4..1e36d61c 100644 --- a/usr/lib/systemd/system/remove-system-map.service +++ b/usr/lib/systemd/system/remove-system-map.service#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] diff --git a/usr/lib/systemd/system/sysinit-post.target b/usr/lib/systemd/system/sysinit-post.target deleted file mode 100644 index faeb6f91..00000000 --- a/usr/lib/systemd/system/sysinit-post.target +++ /dev/null @@ -1,9 +0,0 @@ -[Unit] -Description=sys-init.target by security-misc - -After=sysinit.target -Before=basic.target -Requires=sysinit.target - -[Install] -WantedBy=basic.target diff --git a/usr/lib/systemd/system/sysinit-post.target#security-misc-shared b/usr/lib/systemd/system/sysinit-post.target#security-misc-shared new file mode 100644 index 00000000..81fb65bf --- /dev/null +++ b/usr/lib/systemd/system/sysinit-post.target#security-misc-shared @@ -0,0 +1,12 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=sysinit-post.target by security-misc-shared + +After=sysinit.target +Before=basic.target +Requires=sysinit.target + +[Install] +WantedBy=basic.target diff --git a/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..24cb0da2 --- /dev/null +++ b/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,8 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +ConditionPathExists=/sys/bus/usb + +[Service] +ExecCondition=/usr/libexec/security-misc/check-for-usb-controller diff --git a/usr/lib/systemd/system/user@.service.d/sysfs.conf b/usr/lib/systemd/system/user@.service.d/sysfs.conf deleted file mode 100644 index e0cf3a75..00000000 --- a/usr/lib/systemd/system/user@.service.d/sysfs.conf +++ /dev/null @@ -1,2 +0,0 @@ -[Service] -SupplementaryGroups=sysfs diff --git a/usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared b/usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared new file mode 100644 index 00000000..3a9129d2 --- /dev/null +++ b/usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Service] +SupplementaryGroups=sysfs diff --git a/usr/lib/systemd/user/fm-shim.service#security-misc-shared b/usr/lib/systemd/user/fm-shim.service#security-misc-shared new file mode 100644 index 00000000..b372859c --- /dev/null +++ b/usr/lib/systemd/user/fm-shim.service#security-misc-shared @@ -0,0 +1,16 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=org.freedesktop.FileManager1 handler +StartLimitIntervalSec=10 +StartLimitBurst=3 + +[Service] +Type=notify +NotifyAccess=main +ExecStart=/usr/bin/fm-shim-backend +Restart=always + +[Install] +WantedBy=default.target diff --git a/usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..70accafb --- /dev/null +++ b/usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +ConditionPathExists=/sys/bus/usb diff --git a/usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared b/usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared new file mode 100644 index 00000000..051af9fe --- /dev/null +++ b/usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared @@ -0,0 +1,9 @@ +SUBSYSTEM!="input", GOTO="end" + +# new keyboard or mouse attached or removed, restart emerg-shutdown +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEYBOARD}=="1", RUN+="/usr/bin/systemctl restart emerg-shutdown.service" +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEYBOARD}=="1", GOTO="end" +KERNEL=="event*", ACTION=="remove", ENV{ID_INPUT_KEYBOARD}=="1", RUN+="/usr/bin/systemctl restart emerg-shutdown.service" +KERNEL=="event*", ACTION=="remove", ENV{ID_INPUT_KEYBOARD}=="1", GOTO="end" + +LABEL="end" diff --git a/usr/libexec/security-misc/apt-get-update b/usr/libexec/security-misc/apt-get-update deleted file mode 100755 index 39afd9ce..00000000 --- a/usr/libexec/security-misc/apt-get-update +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -sigterm_trap() { - if [ "$lastpid" = "" ]; then - exit 143 - fi - ps -p "$lastpid" >/dev/null 2>&1 - if [ ! "$?" = "0" ]; then - ## Already terminated. - exit 143 - fi - kill -s sigterm "$lastpid" - exit 143 -} - -trap "sigterm_trap" SIGTERM SIGINT - -[ -n "$timeout_after" ] || timeout_after="600" -[ -n "$kill_after" ] || kill_after="10" - -timeout \ - --kill-after="$kill_after" \ - "$timeout_after" \ - apt-get update --error-on=any "$@" & - -lastpid="$!" -wait "$lastpid" - -exit "$?" diff --git a/usr/libexec/security-misc/apt-get-update-sanity-test b/usr/libexec/security-misc/apt-get-update-sanity-test deleted file mode 100755 index d71e6807..00000000 --- a/usr/libexec/security-misc/apt-get-update-sanity-test +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -x -set -e -set -o pipefail - -wc -L "/var/lib/apt/lists/"*InRelease -wc -L "/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}' diff --git a/usr/libexec/security-misc/askpass b/usr/libexec/security-misc/askpass deleted file mode 100755 index 73f7d408..00000000 --- a/usr/libexec/security-misc/askpass +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -title="$0: password required for $(whoami) to perform action as superuser" - -zenity --password --title="$title" diff --git a/usr/libexec/security-misc/askpass#security-misc-shared b/usr/libexec/security-misc/askpass#security-misc-shared new file mode 100755 index 00000000..64d36fd8 --- /dev/null +++ b/usr/libexec/security-misc/askpass#security-misc-shared @@ -0,0 +1,15 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +title="$0: password required for $(whoami) to perform action as superuser" + +yad --password --title="${title}" diff --git a/usr/libexec/security-misc/block-unsafe-logins#security-misc-shared b/usr/libexec/security-misc/block-unsafe-logins#security-misc-shared new file mode 100755 index 00000000..3000c688 --- /dev/null +++ b/usr/libexec/security-misc/block-unsafe-logins#security-misc-shared @@ -0,0 +1,146 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +source /usr/libexec/helper-scripts/package_installed_check.sh + +if [ -z "${PAM_USER:-}" ]; then + true "$0: ERROR: Environment variable 'PAM_USER' is unset!" + ## 'exit 0' here to let the appropriate PAM module handle this. + exit 0 +fi +if [ -z "${PAM_SERVICE:-}" ]; then + true "$0: ERROR: Environment variable 'PAM_SERVICE' is unset!" + ## 'exit 0' here to let the appropriate PAM module handle this. + exit 0 +fi + +if ! pkg_installed 'user-sysmaint-split' ; then + true "$0: INFO: user-sysmaint-split not installed. Proceeding, ok." + exit 0 +fi + +kernel_cmdline='' +if [ -r /proc/cmdline ]; then + kernel_cmdline="$(cat /proc/cmdline)" +elif [ -r /proc/1/cmdline ]; then + kernel_cmdline="$(cat /proc/1/cmdline)" +fi + +if [[ "$kernel_cmdline" =~ 'boot-role=sysmaint' ]]; then + true "INFO: session type: sysmaint session" + if [ "$PAM_USER" != 'sysmaint' ]; then + printf '%s\n' "ERROR: Rejecting non-sysmaint account '$PAM_USER' in sysmaint session!" + exit 1 + fi + true 'INFO: Running in sysmaint session and authenticating as sysmaint account, allowing authentication to proceed.' + exit 0 +fi + +true "INFO: session type: user session" + +if [ "$PAM_USER" = 'sysmaint' ]; then + printf '%s\n' 'ERROR: Rejecting sysmaint account in user session!' + exit 1 +fi + +## Threat model: +## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#Block_Unsafe_Logins + +login_service_list=( 'login' 'greetd' 'sshd' 'swaylock' ) +for login_service in "${login_service_list[@]}"; do + if [ "$PAM_SERVICE" = "$login_service" ]; then + true "INFO: Login service '$PAM_SERVICE' is considered safe, allowing authentication to proceed." + exit 0 + fi +done + +true "INFO: Login service '$PAM_SERVICE' is potentially unsafe, checking if account is sensitive and passwordless." + +if ! user_list_str="$(/usr/libexec/helper-scripts/get-user-list)"; then + printf '%s\n' 'ERROR: Failed to get user list!' + exit 1 +fi +readarray -t user_list <<< "$user_list_str" +if [ "${#user_list[@]}" = '0' ] || [ -z "${user_list[0]}" ]; then + printf '%s\n' 'ERROR: No user accounts found!' + exit 1 +fi + +## Minor race condition here, quick deletion of users during this process +## could result in user_list and passwd_status_list becoming misaligned. This +## attack would require root privileges to execute though, so this is likely +## not a concern. We do this before checking if $PAM_USER is in the list of +## interactive users to keep the race window as short as possible. +## +## NOTE: PAM modules may run as non-root in some instances (such as when used +## by Swaylock). +if [ "$(id -u)" = '0' ]; then + passwd_status_list_cmd=( + '/usr/libexec/helper-scripts/get-password-status-list' + ) +else + passwd_status_list_cmd=( 'leaprun' 'get-password-status-list' ) +fi +if ! password_status_list_str="$("${passwd_status_list_cmd[@]}")"; then + printf '%s\n' 'ERROR: Failed to get password status list!' + exit 1 +fi +readarray -t passwd_status_list <<< "$password_status_list_str" +if [ "${#passwd_status_list[@]}" = '0' ] \ + || [ -z "${passwd_status_list[0]}" ] \ + || (( ${#passwd_status_list[@]} != ${#user_list[@]} )); then + printf '%s\n' 'ERROR: Unexpected number of password status entries!' + exit 1 +fi + +interactive_user_idx='-1' +for user_idx in "${!user_list[@]}"; do + if [ "${user_list[user_idx]}" = "$PAM_USER" ]; then + interactive_user_idx="$user_idx" + break + fi +done +if [ "$interactive_user_idx" = '-1' ]; then + ## This isn't a user account we care about (it's not an interactive + ## account), therefore allow authentication to proceed. + true "INFO: Account '$PAM_USER' is not an interactive account, allowing authentication to proceed." + exit 0 +fi + +IFS=' ' read -r -a user_gid_list < <(id --groups -- "$PAM_USER") +sensitive_group_list=( 'sudo' 'root' 'sysmaint' ) +is_user_sensitive='false' + +for sensitive_group in "${sensitive_group_list[@]}"; do + sensitive_gid="$(accountctl "$sensitive_group" get-entry group gid)" + for user_gid in "${user_gid_list[@]}"; do + if [ "$sensitive_gid" = "$user_gid" ]; then + is_user_sensitive='true' + break + fi + done + if [ "$is_user_sensitive" = 'true' ]; then + break + fi +done + +if [ "$is_user_sensitive" = 'true' ]; then + if [ "${passwd_status_list[interactive_user_idx]}" = 'Absent' ]; then + ## User account is sensitive and passwordless, deny authentication + printf '%s\n' "ERROR: Rejecting passwordless sensitive account '$PAM_USER'!" + exit 1 + else + true "INFO: Account '$PAM_USER' is sensitive but protected, allowing authentication to proceed." + exit 0 + fi +fi + +true "INFO: Account '$PAM_USER' is not sensitive, allowing authentication to proceed." +exit 0 diff --git a/usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared b/usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared new file mode 100755 index 00000000..c66662cb --- /dev/null +++ b/usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared @@ -0,0 +1,36 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +export LC_ALL=C + +## Compile to a temporary file first, then atomically move into place. +## This prevents leaving a corrupted binary if compilation is interrupted. +tmp_output="$(mktemp -- /usr/bin/emerg-shutdown.XXXXXX)" + +cleanup() { + rm -f -- "${tmp_output}" +} +trap cleanup EXIT + +/usr/libexec/security-misc/compile-emerg-shutdown \ + /usr/src/security-misc/emerg-shutdown.c \ + "${tmp_output}" \ + || { + printf '%s\n' 'Could not compile emerg-shutdown executable!' + exit 1 + } + +chmod 0755 -- "${tmp_output}" +mv -f -- "${tmp_output}" /usr/bin/emerg-shutdown +trap - EXIT diff --git a/usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared b/usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared new file mode 100755 index 00000000..af4c53f8 --- /dev/null +++ b/usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared @@ -0,0 +1,29 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +export LC_ALL=C + +## Compile to a temporary file first, then atomically move into place. +## This prevents leaving a corrupted binary if compilation is interrupted. +tmp_output="$(mktemp -- /usr/bin/fm-shim-backend.XXXXXX)" +trap 'rm -f -- "${tmp_output}"' EXIT + +/usr/libexec/security-misc/compile-fm-shim-backend \ + /usr/src/security-misc/fm-shim-backend.c \ + "${tmp_output}" \ + || { + printf "%s\n" 'Could not compile fm-shim-backend executable!' + rm -f -- "${tmp_output}" + exit 1 + } + +chmod 0755 -- "${tmp_output}" +mv -f -- "${tmp_output}" /usr/bin/fm-shim-backend +trap - EXIT diff --git a/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared new file mode 100755 index 00000000..efb7641d --- /dev/null +++ b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared @@ -0,0 +1,25 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## security-misc-shared Depends on helper-scripts. +# shellcheck source=../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh + +## Package 'pciutils' provides tool 'lspci'. +has lspci + +if lspci | grep -- '^[^ ]* USB controller: ' >/dev/null; then + exit 0 +fi + +exit 1 diff --git a/usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared b/usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared new file mode 100755 index 00000000..1954de3f --- /dev/null +++ b/usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared @@ -0,0 +1,79 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Compile emerg-shutdown.c with the project's standard hardening +## flag set, statically linked. +## +## Usage: +## compile-emerg-shutdown +## +## Used by: +## * usr/libexec/security-misc/build-emerg-shutdown +## * ci/codeql-build.sh (CodeQL static analysis prebuild) + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +export LC_ALL=C + +if [ "$#" -ne 2 ]; then + printf '%s\n' "usage: ${BASH_SOURCE[0]} " >&2 + exit 64 +fi + +source_file="$1" +output_binary="$2" + +gcc_hardening_options=( + "-O2" "-Wall" "-Wextra" "-Wformat" "-Wformat=2" "-Wconversion" + "-Wimplicit-fallthrough" "-Werror=format-security" "-Werror=implicit" + "-Werror=int-conversion" "-Werror=incompatible-pointer-types" + "-Wformat-overflow" "-Wformat-signedness" "-Wformat-truncation" + "-Wnull-dereference" "-Winit-self" + "-Wmissing-include-dirs" "-Wshift-negative-value" "-Wshift-overflow" + "-Wswitch-default" "-Wuninitialized" "-Walloca" "-Warray-bounds" + "-Wfloat-equal" "-Wshadow" "-Wpointer-arith" "-Wundef" "-Wunused-macros" + "-Wbad-function-cast" "-Wcast-qual" "-Wcast-align" "-Wwrite-strings" + "-Wdate-time" "-Wstrict-prototypes" "-Wold-style-definition" + "-Wredundant-decls" "-Winvalid-utf8" "-Wvla" "-Wdisabled-optimization" + "-Wstack-protector" "-Wdeclaration-after-statement" "-Wtrampolines" + "-Wbidi-chars=any,ucn" "-Wformat-overflow=2" "-Wformat-truncation=2" + "-Wshift-overflow=2" "-Wtrivial-auto-var-init" "-Wstringop-overflow=3" + "-Wstrict-flex-arrays" "-Walloc-zero" "-Warray-bounds=2" + "-Wattribute-alias=2" "-Wduplicated-branches" "-Wduplicated-cond" + "-Wcast-align=strict" "-Wjump-misses-init" "-Wlogical-op" "-U_FORTIFY_SOURCE" + "-D_FORTIFY_SOURCE=3" "-fstack-clash-protection" "-fstack-protector-all" + "-fno-delete-null-pointer-checks" "-fno-strict-aliasing" + "-fno-strict-overflow" "-fstrict-flex-arrays=3" + "-ftrivial-auto-var-init=pattern" "-fPIE" +) + +gcc_machine="$(gcc -dumpmachine)" +if [ "${gcc_machine}" = 'x86_64-linux-gnu' ]; then + gcc_hardening_options+=( '-fcf-protection=full' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +elif [ "${gcc_machine}" = 'aarch64-linux-gnu' ]; then + gcc_hardening_options+=( '-mbranch-protection=standard' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +fi + +gcc_hardening_options+=( + "-Wl,-z,nodlopen" "-Wl,-z,noexecstack" "-Wl,-z,relro" "-Wl,-z,now" + "-Wl,-z,separate-code" "-Wl,--as-needed" "-Wl,--no-copy-dt-needed-entries" + "-pie" +) + +gcc \ + -g \ + "${source_file}" \ + -o "${output_binary}" \ + -static \ + "${gcc_hardening_options[@]}" diff --git a/usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared b/usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared new file mode 100755 index 00000000..ffebdbb1 --- /dev/null +++ b/usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared @@ -0,0 +1,91 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Compile fm-shim-backend.c with the project's standard hardening +## flag set. Pure compile - the helper does not chmod, mv, or +## otherwise install the produced binary; the caller decides. +## +## Usage: +## compile-fm-shim-backend +## +## Used by: +## * usr/libexec/security-misc/build-fm-shim-backend (postinst-time +## compile-and-install on the user's machine) +## * ci/codeql-build.sh (CodeQL static +## analysis prebuild) +## +## Holding the gcc command in one place keeps the runtime build path +## and the CI analysis path from drifting on hardening flags. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +export LC_ALL=C + +if [ "$#" -ne 2 ]; then + printf '%s\n' "usage: ${BASH_SOURCE[0]} " >&2 + exit 64 +fi + +source_file="$1" +output_binary="$2" + +gcc_hardening_options=( + "-O2" "-Wall" "-Wextra" "-Wformat" "-Wformat=2" "-Wconversion" + "-Wimplicit-fallthrough" "-Werror=format-security" "-Werror=implicit" + "-Werror=int-conversion" "-Werror=incompatible-pointer-types" + "-Wformat-overflow" "-Wformat-signedness" "-Wformat-truncation" + "-Wnull-dereference" "-Winit-self" + "-Wmissing-include-dirs" "-Wshift-negative-value" "-Wshift-overflow" + "-Wswitch-default" "-Wuninitialized" "-Walloca" "-Warray-bounds" + "-Wfloat-equal" "-Wshadow" "-Wpointer-arith" "-Wundef" "-Wunused-macros" + "-Wbad-function-cast" "-Wcast-qual" "-Wcast-align" "-Wwrite-strings" + "-Wdate-time" "-Wstrict-prototypes" "-Wold-style-definition" + "-Wredundant-decls" "-Winvalid-utf8" "-Wvla" "-Wdisabled-optimization" + "-Wstack-protector" "-Wdeclaration-after-statement" "-Wtrampolines" + "-Wbidi-chars=any,ucn" "-Wformat-overflow=2" "-Wformat-truncation=2" + "-Wshift-overflow=2" "-Wtrivial-auto-var-init" "-Wstringop-overflow=3" + "-Wstrict-flex-arrays" "-Walloc-zero" "-Warray-bounds=2" + "-Wattribute-alias=2" "-Wduplicated-branches" "-Wduplicated-cond" + "-Wcast-align=strict" "-Wjump-misses-init" "-Wlogical-op" "-U_FORTIFY_SOURCE" + "-D_FORTIFY_SOURCE=3" "-fstack-clash-protection" "-fstack-protector-all" + "-fno-delete-null-pointer-checks" "-fno-strict-aliasing" + "-fno-strict-overflow" "-fstrict-flex-arrays=3" + "-ftrivial-auto-var-init=pattern" "-fPIE" +) + +gcc_machine="$(gcc -dumpmachine)" +if [ "${gcc_machine}" = 'x86_64-linux-gnu' ]; then + gcc_hardening_options+=( '-fcf-protection=full' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +elif [ "${gcc_machine}" = 'aarch64-linux-gnu' ]; then + gcc_hardening_options+=( '-mbranch-protection=standard' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +fi + +gcc_hardening_options+=( + "-Wl,-z,nodlopen" "-Wl,-z,noexecstack" "-Wl,-z,relro" "-Wl,-z,now" + "-Wl,-z,separate-code" "-Wl,--as-needed" "-Wl,--no-copy-dt-needed-entries" + "-pie" +) + +## NOTE: pkg-config subshells intentionally are not quoted; pkg-config +## output is designed to be word-split by shells safely and would be +## broken by quoting. (See AGENTS.md "pkg-config quoting in build +## script".) +# shellcheck disable=SC2046 +gcc \ + -g \ + $(pkg-config --cflags dbus-1) \ + $(pkg-config --cflags libsystemd) \ + "${source_file}" \ + -o "${output_binary}" \ + $(pkg-config --libs dbus-1) \ + $(pkg-config --libs libsystemd) \ + "${gcc_hardening_options[@]}" diff --git a/usr/libexec/security-misc/disable-kernel-module-loading b/usr/libexec/security-misc/disable-kernel-module-loading deleted file mode 100644 index e2174ac6..00000000 --- a/usr/libexec/security-misc/disable-kernel-module-loading +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -set -x -set -e - -sysctl -w kernel.modules_disabled=1 - -true "The loading of new modules to the kernel has been disabled by security-misc." diff --git a/usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared b/usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared new file mode 100755 index 00000000..ae0ccd34 --- /dev/null +++ b/usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared @@ -0,0 +1,16 @@ +#!/bin/bash + +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +sysctl -w kernel.modules_disabled=1 + +true "The loading of new modules to the kernel has been disabled by package security-misc-shared." diff --git a/usr/libexec/security-misc/echo-path b/usr/libexec/security-misc/echo-path deleted file mode 100755 index 9231d853..00000000 --- a/usr/libexec/security-misc/echo-path +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -echo "$PATH" diff --git a/usr/libexec/security-misc/echo-path#security-misc-shared b/usr/libexec/security-misc/echo-path#security-misc-shared new file mode 100755 index 00000000..f5d0d00f --- /dev/null +++ b/usr/libexec/security-misc/echo-path#security-misc-shared @@ -0,0 +1,13 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "${PATH}" diff --git a/usr/libexec/security-misc/emerg-shutdown#security-misc-shared b/usr/libexec/security-misc/emerg-shutdown#security-misc-shared new file mode 100755 index 00000000..10ac93b5 --- /dev/null +++ b/usr/libexec/security-misc/emerg-shutdown#security-misc-shared @@ -0,0 +1,67 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## Make sure globs sort in a predictable, reproducible fashion +export LC_ALL=C + +in_dracut='false' +if [ -f '/dracut-state.sh' ]; then + in_dracut='true' +fi +binary_prefix='/run' +EMERG_SHUTDOWN_KEYS='' +root_devices[0]='' + +## Read emergency shutdown key configuration +for config_file in /etc/security-misc/emerg-shutdown/*.conf /usr/local/etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + bash -n "${config_file}" + source "${config_file}" + fi +done + +if [ "${in_dracut}" = 'true' ]; then + binary_prefix='' + modprobe evdev || { + printf '%s\n' 'Failed to load evdev driver!' + exit 1 + } + ## modules may not work immediately after loaded, give them time to + ## initialize + sleep 0.1 +else + ## Find the devices that make up the root device + readarray -t root_devices < <(/usr/libexec/helper-scripts/get-backing-devices-for-mountpoint '/') || true; + + if [ ! -f '/run/emerg-shutdown' ]; then + if [ -f '/usr/bin/emerg-shutdown' ]; then + cp -- /usr/bin/emerg-shutdown /run/emerg-shutdown + else + /usr/libexec/security-misc/compile-emerg-shutdown \ + /usr/src/security-misc/emerg-shutdown.c \ + /run/emerg-shutdown \ + || { + printf '%s\n' 'Could not compile emerg-shutdown executable!' + exit 1 + } + fi + fi + + ## memlockd daemonizes itself, so no need to background it. + memlockd -c /usr/share/security-misc/security-misc-memlockd.cfg || true +fi + +systemd-notify --ready + +## Launch emerg-shutdown +IFS=',' +"${binary_prefix}/emerg-shutdown" "--devices=${root_devices[*]}" "--keys=${EMERG_SHUTDOWN_KEYS}" diff --git a/usr/libexec/security-misc/ensure-shutdown#security-misc-shared b/usr/libexec/security-misc/ensure-shutdown#security-misc-shared new file mode 100755 index 00000000..9a1cf1cf --- /dev/null +++ b/usr/libexec/security-misc/ensure-shutdown#security-misc-shared @@ -0,0 +1,31 @@ +#!/bin/bash + +# Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +# See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +source /usr/libexec/helper-scripts/strings.bsh + +## Make sure globs sort in a predictable, reproducible fashion +export LC_ALL=C + +## Read emergency shutdown key configuration +for config_file in /etc/security-misc/emerg-shutdown/*.conf /usr/local/etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + bash -n "${config_file}" + source "${config_file}" + fi +done +if [ -z "${ENSURE_SHUTDOWN_TIMEOUT:-}" ] \ + || ! is_whole_number "${ENSURE_SHUTDOWN_TIMEOUT}"; then + ENSURE_SHUTDOWN_TIMEOUT=30; +fi + +/run/emerg-shutdown --monitor-fifo "--timeout=${ENSURE_SHUTDOWN_TIMEOUT}" & +sleep 1 +disown +exit 0 diff --git a/usr/libexec/security-misc/hide-hardware-info b/usr/libexec/security-misc/hide-hardware-info deleted file mode 100755 index b55441f8..00000000 --- a/usr/libexec/security-misc/hide-hardware-info +++ /dev/null @@ -1,108 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -sysfs_whitelist=1 -cpuinfo_whitelist=1 - -## https://www.whonix.org/wiki/Security-misc#selinux -selinux=0 - -shopt -s nullglob - -## Allows for disabling the whitelist. -for i in /etc/hide-hardware-info.d/*.conf -do - bash -n "${i}" - source "${i}" -done - -create_whitelist() { - if [ "${1}" = "sysfs" ]; then - whitelist_path="/sys" - elif [ "${1}" = "cpuinfo" ]; then - whitelist_path="/proc/cpuinfo" - else - echo "ERROR: ${1} is not a correct parameter." - exit 1 - fi - - if grep -q "${1}" /etc/group; then - ## Changing the permissions of /sys recursively - ## causes errors as the permissions of /sys/kernel/debug - ## and /sys/fs/cgroup cannot be changed. - chgrp -fR "${1}" "${whitelist_path}" || true - - chmod o-rwx "${whitelist_path}" - else - echo "ERROR: The ${1} group does not exist, the ${1} whitelist was not created." - fi -} - -## sysfs and debugfs expose a lot of information -## that should not be accessible by an unprivileged -## user which includes hardware info, debug info and -## more. This restricts /sys, /proc/cpuinfo, /proc/bus -## and /proc/scsi to the root user only. This hides -## many hardware identifiers from ordinary users -## and increases security. -for i in /proc/cpuinfo /proc/bus /proc/scsi /sys -do - if [ -e "${i}" ]; then - if [ "${i}" = "/sys" ]; then - ## Whitelist for /sys. - if [ "${sysfs_whitelist}" = "1" ]; then - create_whitelist sysfs - else - chmod og-rwx /sys - echo "INFO: The sysfs whitelist is not enabled. Some things may not work properly." - fi - elif [ "${i}" = "/proc/cpuinfo" ]; then - ## Whitelist for /proc/cpuinfo. - if [ "${cpuinfo_whitelist}" = "1" ]; then - create_whitelist cpuinfo - else - chmod og-rwx /proc/cpuinfo - echo "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly." - fi - else - chmod og-rwx "${i}" - fi - else - ## /proc/scsi doesn't exist on Debian so errors - ## are expected here. - if ! [ "${i}" = "/proc/scsi" ]; then - echo "ERROR: ${i} could not be found." - fi - fi -done - -## on SELinux systems, at least /sys/fs/selinux -## must be visible to unprivileged users, else -## SELinux userspace utilities will not function -## properly -if [ -d /sys/fs/selinux ]; then - echo "INFO: SELinux detected because folder /sys/fs/selinux exists. See also:" - echo "https://www.kicksecure.com/wiki/Security-misc#selinux" - if [ "${selinux}" = "1" ]; then - ## restrict permissions on everything but - ## what is needed - for i in /sys/* /sys/fs/* - do - ## Using '|| true': - ## https://github.com/Kicksecure/security-misc/pull/108 - if [ "${sysfs_whitelist}" = "1" ]; then - chmod o-rwx "${i}" || true - else - chmod og-rwx "${i}" || true - fi - done - chmod o+rx /sys /sys/fs /sys/fs/selinux - echo "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function." - else - echo "INFO: SELinux detected, but SELinux mode is not enabled. Some userspace utilities may not work properly." - fi -fi diff --git a/usr/libexec/security-misc/hide-hardware-info#security-misc-shared b/usr/libexec/security-misc/hide-hardware-info#security-misc-shared new file mode 100755 index 00000000..081e06e9 --- /dev/null +++ b/usr/libexec/security-misc/hide-hardware-info#security-misc-shared @@ -0,0 +1,138 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail +shopt -s nullglob + +run_cmd() { + printf '%s\n' "INFO: normal executing : $@" + "$@" +} + +run_cmd_whitelist() { + printf '%s\n' "INFO: whitelist executing: $@" + "$@" +} + +printf '%s\n' "$0: INFO: START" + +default_variables_set() { + sysfs_whitelist=1 + cpuinfo_whitelist=1 + sysfs=1 + ## https://www.kicksecure.com/wiki/Security-misc#selinux + selinux=0 +} + +parse_configuration() { + ## Allows for disabling the whitelist. + local i + for i in /usr/local/etc/hide-hardware-info.d/*.conf /etc/hide-hardware-info.d/*.conf ; do + bash -n -- "${i}" + source "${i}" + done +} + +create_whitelist() { + if [ "${1}" = "sysfs" ]; then + whitelist_path="/sys" + elif [ "${1}" = "cpuinfo" ]; then + whitelist_path="/proc/cpuinfo" + else + printf '%s\n' "ERROR: ${1} is not a correct parameter." + exit 1 + fi + + if getent group -- "${1}" >/dev/null; then + ## Changing the permissions of /sys recursively + ## causes errors as the permissions of /sys/kernel/debug + ## and /sys/fs/cgroup cannot be changed. + run_cmd_whitelist chgrp --quiet --recursive -- "${1}" "${whitelist_path}" || true + + run_cmd_whitelist chmod -- o-rwx "${whitelist_path}" + else + printf '%s\n' "ERROR: The ${1} group does not exist, the ${1} whitelist was not created." + fi +} + +default_variables_set +parse_configuration + +## sysfs and debugfs expose a lot of information +## that should not be accessible by an unprivileged +## user which includes hardware info, debug info and +## more. This restricts /sys, /proc/cpuinfo, /proc/bus +## and /proc/scsi to the root user only. This hides +## many hardware identifiers from ordinary users +## and increases security. +for i in /proc/cpuinfo /proc/bus /proc/scsi /sys ; do + if [ -e "${i}" ]; then + if [ "${i}" = "/sys" ]; then + if [ "${sysfs}" = "1" ]; then + ## Whitelist for /sys. + if [ "${sysfs_whitelist}" = "1" ]; then + create_whitelist sysfs + else + printf '%s\n' "INFO: The sysfs whitelist is not enabled. Some things may not work properly. Full sysfs hardening..." + run_cmd chmod -- og-rwx /sys + fi + fi + elif [ "${i}" = "/proc/cpuinfo" ]; then + if [ "${cpuinfo_whitelist}" = "1" ]; then + create_whitelist cpuinfo + else + printf '%s\n' "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly. Full cpuinfo hardening..." + run_cmd chmod -- og-rwx /proc/cpuinfo + fi + else + run_cmd chmod -- og-rwx "${i}" + fi + else + ## /proc/scsi doesn't exist on Debian so errors + ## are expected here. + if ! [ "${i}" = "/proc/scsi" ]; then + printf '%s\n' "ERROR: ${i} could not be found." + fi + fi +done + + +if [ "${sysfs}" = "1" ]; then + ## restrict permissions on everything but + ## what is needed + for i in /sys/* /sys/fs/* ; do + ## Using '|| true': + ## https://github.com/Kicksecure/security-misc/pull/108 + if [ "${sysfs_whitelist}" = "1" ]; then + run_cmd chmod -- o-rwx "${i}" || true + else + run_cmd chmod -- og-rwx "${i}" || true + fi + done + + ## polkit needs stat access to /sys/fs/cgroup + ## to function properly + run_cmd chmod -- o+rx /sys /sys/fs + + ## on SELinux systems, at least /sys/fs/selinux + ## must be visible to unprivileged users, else + ## SELinux userspace utilities will not function + ## properly + if [ -d /sys/fs/selinux ]; then + printf '%s\n' "INFO: SELinux detected because folder /sys/fs/selinux exists. See also:" + printf '%s\n' "https://www.kicksecure.com/wiki/Security-misc#selinux" + if [ "${selinux}" = "1" ]; then + run_cmd chmod -- o+rx /sys /sys/fs /sys/fs/selinux + printf '%s\n' "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function." + else + printf '%s\n' "INFO: SELinux detected, but SELinux mode is not enabled. Some userspace utilities may not work properly." + fi + fi +fi + +printf '%s\n' "$0: INFO: END" diff --git a/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared b/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared new file mode 100755 index 00000000..677dc90b --- /dev/null +++ b/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared @@ -0,0 +1,29 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +vboxdrmclient_sock='/tmp/.iprt-localipc-DRMIpcServer' + +if ! [ -S "$vboxdrmclient_sock" ]; then + printf '%s\n' "INFO: Socket file '$vboxdrmclient_sock' does not exist or is not a socket, ok." + exit 0 +fi + +sock_pid="$(/usr/libexec/helper-scripts/query-sock-pid "$vboxdrmclient_sock")" || true +if [ -z "$sock_pid" ]; then + printf '%s\n' "INFO: Cannot get PID listening on '$vboxdrmclient_sock', ok." + exit 0 +fi +if kill -SIGKILL -- "$sock_pid"; then + printf '%s\n' "INFO: Killed VBoxDRMClient ('$sock_pid'), ok." + exit 0 +fi + +printf '%s\n' "ERROR: Could not kill VBoxDRMClient ('$sock_pid')!" +exit 1 diff --git a/usr/libexec/security-misc/mmap-rnd-bits b/usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared similarity index 53% rename from usr/libexec/security-misc/mmap-rnd-bits rename to usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared index 17482bf2..c7ec5782 100755 --- a/usr/libexec/security-misc/mmap-rnd-bits +++ b/usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared @@ -1,6 +1,6 @@ #!/usr/bin/env bash -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## This script enforces the maximum ASLR hardening settings for mmap, given the @@ -8,26 +8,31 @@ ## See also: ## https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514 -set -euo pipefail +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose shopt -s failglob more_info_link="https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514" aslr_mmap_config_file="/etc/sysctl.d/30_security-misc_aslr-mmap.conf" exit_with_error() { - echo "$0: SEE ALSO:" >&2 - echo "" >&2 - echo "$more_info_link" >&2 + printf '%s\n' "$0: SEE ALSO:" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "${more_info_link}" >&2 exit 1 } if ! test -d /etc/sysctl.d ; then - echo "$0: ERROR: Folder /etc/sysctl.d does not exist!" >&2 + printf '%s\n' "$0: ERROR: Folder /etc/sysctl.d does not exist!" >&2 exit_with_error fi if ! test -w /etc/sysctl.d ; then - echo "$0: ERROR: Folder /etc/sysctl.d not writeable! This script is supposed to be run as root." >&2 + printf '%s\n' "$0: ERROR: Folder /etc/sysctl.d not writeable! This script is supposed to be run as root." >&2 exit_with_error fi @@ -37,45 +42,49 @@ BITS_MAX_DEFAULT=32 COMPAT_BITS_MAX_DEFAULT=16 ## Find the most recently modified Linux config file. -if compgen -G "/boot/config-*" > /dev/null && CONFIG=$(ls -1 -t /boot/config-* | head -n 1) ; then +## Kernel config filenames are /boot/config-: no spaces or newlines, +## so the ls-parsing hazard SC2012 warns about is not reachable here, and a +## find-based newest-file rewrite would be a behaviour risk for no gain. +# shellcheck disable=SC2012 +if compgen -G "/boot/config-*" > /dev/null && CONFIG=$(ls -1 -t /boot/config-* | head -n1) ; then ## Find the relevant config options. if ! BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) ; then - echo "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_BITS_MAX! Using built-in default." >&2 + printf '%s\n' "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_BITS_MAX! Using built-in default." >&2 BITS_MAX="${BITS_MAX_DEFAULT}" fi if ! COMPAT_BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) ; then - echo "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX! Using built-in default." >&2 + printf '%s\n' "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX! Using built-in default." >&2 COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}" fi else ## Could be a chroot. - echo "$0: INFO: No Linux config file detected in folder /boot/ (starting with 'config-'). Therefore using built-in defaults." >&2 + printf '%s\n' "$0: INFO: No Linux config file detected in folder /boot/ (starting with 'config-'). Therefore using built-in defaults." >&2 BITS_MAX="${BITS_MAX_DEFAULT}" COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}" fi ## Generate a sysctl.d conf file. SYSCTL="\ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## This file is automatically generated by: ## $0 ## Do not edit! ## See also: -## $more_info_link +## ${more_info_link} ## Improves ASLR effectiveness for mmap. vm.mmap_rnd_bits=${BITS_MAX} vm.mmap_rnd_compat_bits=${COMPAT_BITS_MAX}" ## Write the sysctl.d conf file. -if echo "${SYSCTL}" | tee "$aslr_mmap_config_file" > /dev/null ; then - echo "$0: INFO: Successfully written ASLR map config file: -$aslr_mmap_config_file" +if printf '%s\n' "${SYSCTL}" | tee "${aslr_mmap_config_file}" > /dev/null ; then + printf '%s\n' "$0: INFO: Successfully written ASLR map config file: +${aslr_mmap_config_file}" exit 0 fi -echo "$0: ERROR: Error writing ASLR map config file: -$aslr_mmap_config_file" >&2 +printf '%s\n' "$0: ERROR: Error writing ASLR map config file: +${aslr_mmap_config_file}" >&2 exit_with_error diff --git a/usr/libexec/security-misc/pam-abort-on-locked-password b/usr/libexec/security-misc/pam-abort-on-locked-password deleted file mode 100755 index 8e2a575c..00000000 --- a/usr/libexec/security-misc/pam-abort-on-locked-password +++ /dev/null @@ -1,53 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## This is only a usability feature to avoid needlessly bumping pam_faillock -## counter. This is not a security feature. -## https://forums.whonix.org/t/restrict-root-access/7658/1 - -passwd_bin="$(type -P "passwd")" - -if ! test -x "$passwd_bin" ; then - echo "\ -$0: ERROR: passwd_bin \"$passwd_bin\" is not executable. -See https://www.whonix.org/wiki/SUID_Disabler_and_Permission_Hardener#passwd" >&2 - ## Identifiable exit codes in case stdout / stderr is not logged in journal. - exit 2 -fi - -if ! passwd_output="$("$passwd_bin" -S "$PAM_USER" 2>/dev/null)" ; then - echo "$0: ERROR: user \"$PAM_USER\" does not exist." >&2 - exit 3 -fi - -password_status_field="$(echo "$passwd_output" | cut -d ' ' -f 2)" - -if [ "$password_status_field" = "P" ]; then - true "$0: INFO: user \"$PAM_USER\" has a usable password." -elif [ "$password_status_field" = "NP" ]; then - true "$0: INFO: user \"$PAM_USER\" has no password." -elif [ "$password_status_field" = "L" ]; then - echo "$0: INFO: Password for user \"$PAM_USER\" is locked." - - if [ -f /usr/share/whonix/marker ] || [ -f /usr/share/kicksecure/marker ]; then - if [ "$PAM_USER" = "root" ]; then - echo "$0: ERROR: root account is locked by default. See:" >&2 - echo "https://www.kicksecure.com/wiki/root" >&2 - echo "" >&2 - exit 4 - fi - fi - - ## Should not unconditionally 'exit 1' here. - ## Locked user accounts might have valid sudoers exceptions. - ## https://forums.whonix.org/t/pam-abort-on-locked-password-and-running-privileged-command-from-web-browser/10521 - ## 'exit 1' would be good for usability here because then the user would get - ## faster feedback. A new login attempt would not be needlessly delayed. - exit 0 -else - echo "$0: INFO: Password status field for user \"$PAM_USER\" could not be parsed. Please report this bug." -fi - -exit 0 diff --git a/usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared b/usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared new file mode 100755 index 00000000..5452a1af --- /dev/null +++ b/usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared @@ -0,0 +1,62 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This is only a usability feature to avoid needlessly bumping pam_faillock +## counter. This is not a security feature. +## https://forums.whonix.org/t/restrict-root-access/7658/1 + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +PAM_USER="${PAM_USER:-}" + +passwd_bin="$(type -P -- "passwd")" + +if ! test -x "${passwd_bin}" ; then + printf '%s\n' "\ +$0: ERROR: passwd_bin \"${passwd_bin}\" is not executable. +See https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#passwd" >&2 + ## Identifiable exit codes in case stdout / stderr is not logged in journal. + exit 2 +fi + +if ! passwd_output="$("${passwd_bin}" -S -- "${PAM_USER}" 2>/dev/null)" ; then + printf '%s\n' "$0: ERROR: user \"${PAM_USER}\" does not exist." >&2 + exit 3 +fi + +password_status_field="$(printf '%s\n' "${passwd_output}" | cut -d ' ' -f 2)" + +if [ "${password_status_field}" = "P" ]; then + true "$0: INFO: user \"${PAM_USER}\" has a usable password." +elif [ "${password_status_field}" = "NP" ]; then + true "$0: INFO: user \"${PAM_USER}\" has no password." +elif [ "${password_status_field}" = "L" ]; then + printf '%s\n' "$0: INFO: Password for user \"${PAM_USER}\" is locked." + + if [ -f /usr/share/whonix/marker ] || [ -f /usr/share/kicksecure/marker ]; then + if [ "${PAM_USER}" = "root" ]; then + printf '%s\n' "$0: ERROR: root account is locked by default. See:" >&2 + printf '%s\n' "https://www.kicksecure.com/wiki/root" >&2 + printf '%s\n' "" >&2 + exit 4 + fi + fi + + ## Should not unconditionally 'exit 1' here. + ## Locked user accounts might have valid sudoers exceptions. + ## https://forums.whonix.org/t/pam-abort-on-locked-password-and-running-privileged-command-from-web-browser/10521 + ## 'exit 1' would be good for usability here because then the user would get + ## faster feedback. A new login attempt would not be needlessly delayed. + exit 0 +else + printf '%s\n' "$0: INFO: Password status field for user \"${PAM_USER}\" could not be parsed. Please report this bug." +fi + +exit 0 diff --git a/usr/libexec/security-misc/pam-info b/usr/libexec/security-misc/pam-info deleted file mode 100755 index de6a3e07..00000000 --- a/usr/libexec/security-misc/pam-info +++ /dev/null @@ -1,208 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## To enable debug log, run: -## sudo touch /etc/pam-info-debug -## -## Debug log if enabled can be found in file: -## /root/pam-info-debug.txt - -true "$0: START PHASE 1" - -if test -f /etc/pam-info-debug || test -f /usr/local/etc/pam-info-debug ; then - set -x - exec 5>&1 1>> ~/pam-info-debug.txt - exec 6>&2 2>> ~/pam-info-debug.txt -fi - -true "$0: START PHASE 2" - -set -o pipefail - -## Debugging. -who_ami="$(whoami)" -true "$0: who_ami: $who_ami" -true "$0: PAM_USER: $PAM_USER" -true "$0: SUDO_USER: $SUDO_USER" - -if [ "$PAM_USER" = "" ]; then - true "$0: ERROR: Environment variable PAM_USER is unset!" - exit 0 -fi - -grep_result="$(grep "accessfile=/etc/security/access-security-misc.conf" /etc/pam.d/common-account 2>/dev/null)" - -## Check if grep matched something. -if [ ! "$grep_result" = "" ]; then - ## Yes, grep matched. - - ## Check if not out commented. - if ! echo "$grep_result" | grep -q "#" ; then - ## Not out commented indeed. - - ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592 - - if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console"; then - console_allowed=true - fi - if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console-unrestricted"; then - console_allowed=true - fi - - if [ ! "$console_allowed" = "true" ]; then - echo "\ -$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console' -To unlock, run the following command as superuser: -(If you still have a sudo/root shell somewhere.) - -adduser $PAM_USER console - -However, possibly unlock procedure is required. -First boot into recovery mode at grub boot menu and then run above command. -See also: -https://www.kicksecure.com/wiki/root#console -" >&2 - exit 0 - fi - fi -fi - -## https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698 - -## Does not work (yet) for login, pam_securetty runs before and aborts. -## Also this should only run for login since securetty covers only login. -# if [ "$PAM_USER" = "root" ]; then -# if [ -f /etc/securetty ]; then -# grep_result="$(grep "^[^#]" /etc/securetty)" -# if [ "$grep_result" = "" ]; then -# echo "\ -# $0: ERROR: Root login is disabled. -# ERROR: This is because /etc/securetty is empty. -# See also: -# https://www.kicksecure.com/wiki/root#login -# " >&2 -# exit 0 -# fi -# fi -# fi - -## as user "user" -## /usr/sbin/faillock -u user -## faillock: Error opening /var/log/tallylog for update: Permission denied -## /usr/sbin/faillock: Authentication error -## -## xscreensaver runs as user "user", therefore pam_faillock cannot function. -## xscreensaver has its own failed login counter. -## -## https://askubuntu.com/questions/983183/how-lock-the-unlock-screen-after-wrong-password-attempts -## -## https://www.whonix.org/pipermail/whonix-devel/2019-September/001439.html -## -## Checking exit code to avoid breaking when read-only disk boot but -## without ro-mode-init or grub-live being used. -if ! pam_faillock_output="$(faillock --user "$PAM_USER")" ; then - true "$0: faillock non-zero exit code." - exit 0 -fi - -if [ "$pam_faillock_output" = "" ]; then - true "$0: no failed login" - exit 0 -fi - -## example pam_faillock_output (stdout): -## user: -## When Type Source Valid -## 2021-08-10 16:26:33 RHOST V -## 2021-08-10 16:26:54 RHOST V - -## example pam_faillock_output (stderr): -## faillock: No user name supplied. -## Usage: faillock [--dir /path/to/tally-directory] [--user username] [--reset] - -## Get first line. -#pam_faillock_output_first_line="$(echo "$pam_faillock_output" | head --lines=1)" -while read -t 10 -r pam_faillock_output_first_line ; do - break -done <<< "$pam_faillock_output" - -true "pam_faillock_output_first_line: '$pam_faillock_output_first_line'" -## example pam_faillock_output_first_line: -## user: - -user_name="$(echo "$pam_faillock_output_first_line" | LANG=C str_replace ":" "")" -## example user_name: -## user -## root - -pam_faillock_output_count="$(echo "$pam_faillock_output" | wc -l)" -## example pam_faillock_output_count: -## 2 -## example pam_faillock_output_count: -## 4 - -## Do not count the first two informational textual output lines -## (starting with "user:" and "When"). -failed_login_counter=$(( pam_faillock_output_count - 2 )) - -## example failed_login_counter: -## 2 - -if [ "$failed_login_counter" = "0" ]; then - true "$0: INFO: Failed login counter is 0, ok." - exit 0 -fi - -## pam_faillock default if it cannot be determined below. -deny=3 - -if test -f /etc/security/faillock.conf ; then - deny_line=$(grep --invert-match "#" /etc/security/faillock.conf | grep "deny =") - deny="$(echo "$deny_line" | LANG=C str_replace "=" "" | LANG=C str_replace "deny" "" | LANG=C str_replace " " "")" - ## Example: - #deny=50 -fi - -if [[ "$deny" == *[!0-9]* ]]; then - echo "\ -$0: ERROR: deny is not numeric. deny: '$deny' -ERROR: Please report this bug. -" >&2 - exit 0 -fi - -remaining_attempts="$(( $deny - $failed_login_counter ))" - -if [ "$remaining_attempts" -le "0" ]; then - echo "\ -$0: ERROR: Login blocked after $failed_login_counter attempts. -To unlock, run the following command as superuser: -(If you still have a sudo/root shell somewhere.) - -faillock --reset --user $PAM_USER - -However, most likely unlock procedure is required. -First boot into recovery mode at grub boot menu and then run above command. -See also: -https://www.kicksecure.com/wiki/root#unlock -" >&2 - exit 0 -fi - -echo "\ -$0: WARNING: $failed_login_counter failed login attempts for user_name '$user_name'. -Login will be blocked after $deny attempts. -You have $remaining_attempts more attempts before unlock procedure is required. -" >&2 - -if [ "$PAM_SERVICE" = "su" ]; then - echo "\ -$0: NOTE: Type the password. When entering the password, no password feedback (no asterisk (\"*\") symbol) will be shown. -" >&2 -fi - -true "$0: END" - -exit 0 diff --git a/usr/libexec/security-misc/pam-info#security-misc-shared b/usr/libexec/security-misc/pam-info#security-misc-shared new file mode 100755 index 00000000..70e0d98d --- /dev/null +++ b/usr/libexec/security-misc/pam-info#security-misc-shared @@ -0,0 +1,299 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## To enable debug log, run: +## sudo touch /etc/pam-info-debug +## +## Debug log if enabled can be found in file: +## /root/pam-info-debug.txt + +true "$0: START PHASE 1" + +if test -f /etc/pam-info-debug || test -f /usr/local/etc/pam-info-debug ; then + set -x + exec 5>&1 1>> ~/pam-info-debug.txt + exec 6>&2 2>> ~/pam-info-debug.txt +fi + +true "$0: START PHASE 2" + +set -o errexit +set -o errtrace +set -o pipefail +set -o nounset + +error_handler() { + exit_code="$?" + printf '%s\n' "\ +$0: ERROR: Unexpected error. +BASH_COMMAND: '$BASH_COMMAND' +exit_code: '$exit_code' +ERROR: Please report this bug." >&2 + exit 1 +} + +trap error_handler ERR + +if ! printf '%s\n' "" | wc -l >/dev/null ; then + printf '%s\n' "\ +$0: ERROR: command 'wc' test failed! Do not ignore this! + +'wc' can core dump. Example: +zsh: illegal hardware instruction (core dumped) wc -l +https://github.com/rspamd/rspamd/issues/5137" >&2 + exit 1 +fi + +command -v str_replace &>/dev/null + +## Named constants. +pam_faillock_state_dir="/var/lib/security-misc/faillock" + +[[ -v PAM_USER ]] || PAM_USER="" +[[ -v SUDO_USER ]] || SUDO_USER="" + +## Debugging. +who_ami="$(whoami)" +true "$0: who_ami: $who_ami" +true "$0: PAM_USER: $PAM_USER" +true "$0: SUDO_USER: $SUDO_USER" + +if [ "$PAM_USER" = "" ]; then + true "$0: ERROR: Environment variable PAM_USER is unset!" + exit 0 +fi + +## PAM_USER is set by the PAM stack and is generally trusted. +## Sanity check: reject control characters and values starting with '-' +## to prevent option injection into commands like faillock. +if [[ "$PAM_USER" =~ [[:cntrl:]] ]] || [[ "$PAM_USER" == -* ]]; then + true "$0: ERROR: PAM_USER contains suspicious characters: '$(printf '%q' "$PAM_USER")'" + exit 0 +fi + +grep_result="$(grep -- "accessfile=/etc/security/access-security-misc.conf" /etc/pam.d/common-account 2>/dev/null)" || true + +## Check if grep matched something. +if [ ! "$grep_result" = "" ]; then + ## Yes, grep matched. + + ## Check if not out commented. + if ! printf '%s\n' "$grep_result" | grep --quiet -- "#" ; then + ## Not out commented indeed. + + ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592 + + console_allowed="" + if id --name --groups --zero -- "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings -- "console"; then + console_allowed=true + fi + if id --name --groups --zero -- "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings -- "console-unrestricted"; then + console_allowed=true + fi + + if [ ! "$console_allowed" = "true" ]; then + printf '%s\n' "\ +$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console' +To unlock, run the following command as superuser: +(If you still have a sudo/root shell somewhere.) + +adduser $PAM_USER console + +However, possibly unlock procedure is required. +First boot into recovery mode at grub boot menu and then run above command. +See also: +https://www.kicksecure.com/wiki/root#console +" >&2 + exit 0 + fi + fi +fi + +if [ "$PAM_USER" = 'sysmaint' ]; then + sysmaint_passwd_info="$(passwd --status sysmaint 2>/dev/null)" || true + sysmaint_lock_info="$(cut -d' ' -f2 <<< "${sysmaint_passwd_info}")" + if [ "${sysmaint_lock_info}" = 'L' ]; then + printf '%s\n' "$0: ERROR: Reboot and choose 'PERSISTENT Mode - SYSMAINT Session' for system maintenance. See https://www.kicksecure.com/wiki/Sysmaint" >&2 + fi +fi + +kernel_cmdline='' +if [ -f /proc/cmdline ]; then + kernel_cmdline="$(cat -- /proc/cmdline)" || true +elif [ -f /proc/1/cmdline ]; then + kernel_cmdline="$(cat -- /proc/1/cmdline)" || true +fi + +if [ "$PAM_USER" != 'sysmaint' ]; then + if [[ "${kernel_cmdline}" =~ 'boot-role=sysmaint' ]]; then + printf '%s\n' "$0: WARNING: Use account 'sysmaint' for system maintenance. See https://www.kicksecure.com/wiki/Sysmaint" >&2 + fi +fi + +## https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698 + +## Does not work (yet) for login, pam_securetty runs before and aborts. +## Also this should only run for login since securetty covers only login. +# if [ "$PAM_USER" = "root" ]; then +# if [ -f /etc/securetty ]; then +# grep_result="$(grep -- "^[^#]" /etc/securetty)" +# if [ "$grep_result" = "" ]; then +# printf '%s\n' "\ +# $0: ERROR: Root login is disabled. +# ERROR: This is because file '/etc/securetty' is empty. +# See also: +# https://www.kicksecure.com/wiki/root#login +# " >&2 +# exit 0 +# fi +# fi +# fi + +## under account "user" +## /usr/sbin/faillock -u user +## faillock: Error opening /var/log/tallylog for update: Permission denied +## /usr/sbin/faillock: Authentication error +## +## xscreensaver runs under account "user", therefore pam_faillock cannot function. +## xscreensaver has its own failed login counter. +## +## https://askubuntu.com/questions/983183/how-lock-the-unlock-screen-after-wrong-password-attempts +## +## https://web.archive.org/web/20200919221439/https://www.whonix.org/pipermail/whonix-devel/2019-September/001439.html +## +## Checking exit code to avoid breaking when read-only disk boot but +## without ro-mode-init or grub-live being used. +## +## end-of-options ("--") unsupported by faillock. +if ! pam_faillock_output="$(faillock --dir "$pam_faillock_state_dir" --user "$PAM_USER")" ; then + true "$0: faillock non-zero exit code." + exit 0 +fi + +if [ "$pam_faillock_output" = "" ]; then + true "$0: no failed login" + exit 0 +fi + +## example pam_faillock_output (stdout): +## user: +## When Type Source Valid +## 2021-08-10 16:26:33 RHOST V +## 2021-08-10 16:26:54 RHOST V + +## example pam_faillock_output (stderr): +## faillock: No user name supplied. +## Usage: faillock [--dir /path/to/tally-directory] [--user username] [--reset] + +## Get first line. +#pam_faillock_output_first_line="$(printf '%s\n' "$pam_faillock_output" | head --lines=1)" +while read -t 10 -r pam_faillock_output_first_line ; do + break +done <<< "$pam_faillock_output" + +true "pam_faillock_output_first_line: '$pam_faillock_output_first_line'" +## example pam_faillock_output_first_line: +## user: + +user_name="$(printf '%s\n' "$pam_faillock_output_first_line" | str_replace ":" "")" +## example user_name: +## user +## root + +if [ "$PAM_USER" != "$user_name" ]; then + printf '%s\n' "\ +$0: ERROR: Variable 'PAM_USER' '$PAM_USER' does not match variable 'user_name' '$user_name'. +ERROR: Please report this bug. +" >&2 + exit 1 +fi + +pam_faillock_output_count="$(printf '%s\n' "$pam_faillock_output" | wc -l)" +## example pam_faillock_output_count: +## 2 +## example pam_faillock_output_count: +## 4 + +if [[ "$pam_faillock_output_count" == *[!0-9]* ]]; then + printf '%s\n' "\ +$0: ERROR: Variable 'pam_faillock_output_count' is not numeric. pam_faillock_output_count: '$pam_faillock_output_count' +ERROR: Please report this bug. +" >&2 + exit 0 +fi + +## Do not count the first two informational textual output lines (starting with "user:" and "When") if present, +failed_login_counter=$(( pam_faillock_output_count - 2 )) + +## example failed_login_counter: +## 2 + +## Ensuring failed_login_counter is not set to a negative value. +## https://github.com/Kicksecure/security-misc/pull/305 +if [ "$failed_login_counter" -lt "0" ]; then + true "$0: WARNING: Failed login counter is negative. Resetting to 0." + failed_login_counter=0 +fi + +if [ "$failed_login_counter" = "0" ]; then + true "$0: INFO: Failed login counter is 0, ok." + exit 0 +fi + +## pam_faillock default if it cannot be determined below. +deny=3 + +if test -f /etc/security/faillock.conf ; then + deny_line=$(grep --invert-match "#" -- /etc/security/faillock.conf | grep -- "deny =") || true + deny="$(printf '%s\n' "$deny_line" | str_replace "=" "" | str_replace "deny" "" | str_replace " " "")" + ## Restore the default if no uncommented 'deny =' line was found; an empty + ## value would slip past the numeric guard below and incorrectly report a + ## lockout. + [ -n "$deny" ] || deny=3 + ## Example: + #deny=50 +fi + +if [[ "$deny" == *[!0-9]* ]]; then + printf '%s\n' "\ +$0: ERROR: Variable 'deny' is not numeric. deny: '$deny' +ERROR: Please report this bug. +" >&2 + exit 0 +fi + +remaining_attempts="$(( deny - failed_login_counter ))" + +if [ "$remaining_attempts" -le "0" ]; then + printf '%s\n' "\ +$0: ERROR: Login blocked after $failed_login_counter attempts. +To unlock, run the following command as superuser: +(If you still have a sudo/root shell somewhere.) + +faillock --dir $pam_faillock_state_dir --reset --user $PAM_USER + +However, most likely unlock procedure is required. +First boot into recovery mode at grub boot menu and then run above command. +See also: +https://www.kicksecure.com/wiki/root#unlock +" >&2 + exit 0 +fi + +printf '%s\n' "\ +$0: WARNING: $failed_login_counter failed login attempts for account '$user_name'. +Login will be blocked after $deny attempts. +You have $remaining_attempts more attempts before unlock procedure is required. +" >&2 + +if [ "$PAM_SERVICE" = "su" ]; then + printf '%s\n' "\ +$0: NOTE: Type the password. When entering the password, no password feedback (no asterisk (\"*\") symbol) will be shown. +" >&2 +fi + +true "$0: END" + +exit 0 diff --git a/usr/libexec/security-misc/pam_faillock_not_if_x b/usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared similarity index 71% rename from usr/libexec/security-misc/pam_faillock_not_if_x rename to usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared index 3fcf10f3..4cb725a8 100755 --- a/usr/libexec/security-misc/pam_faillock_not_if_x +++ b/usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared @@ -1,13 +1,21 @@ #!/bin/bash -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose -true "PAM_SERVICE: $PAM_SERVICE" +PAM_SERVICE="${PAM_SERVICE:-}" + +true "PAM_SERVICE: ${PAM_SERVICE}" ## PAM configuration notes ## @@ -23,8 +31,8 @@ true "PAM_SERVICE: $PAM_SERVICE" ## This list can later be extended as needed. pam_service_exclusion_list="dovecot sshd" -for pam_service_exclusion_item in $pam_service_exclusion_list ; do - if [ "$PAM_SERVICE" = "$pam_service_exclusion_item" ]; then +for pam_service_exclusion_item in ${pam_service_exclusion_list} ; do + if [ "${PAM_SERVICE}" = "${pam_service_exclusion_item}" ]; then ## exit success so [success=1 default=ignore] will result in skipping the ## next PAM module (the pam_faillock module). exit 0 @@ -33,8 +41,4 @@ done ## exit failure so [success=1 default=ignore] will result in running the ## next PAM module (the pam_faillock module). -## -## Causes confusing error message: -## pam_exec(sudo:auth): /usr/libexec/security-misc/pam_faillock_not_if_x failed: exit code 1 -## https://github.com/linux-pam/linux-pam/issues/329 exit 1 diff --git a/usr/libexec/security-misc/pam_only_if_login b/usr/libexec/security-misc/pam_only_if_login deleted file mode 100755 index 11f56d49..00000000 --- a/usr/libexec/security-misc/pam_only_if_login +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files - -set -x - -true "PAM_SERVICE: $PAM_SERVICE" - -if [ "$PAM_SERVICE" = "login" ]; then - ## FIXME: - ## Creates unwanted journal log entry. - ## pam_exec(login:account): /usr/libexec/security-misc/pam_only_if_login failed: exit code 1 - exit 1 -else - ## exit success so [success=1 default=ignore] will result in skipping the - ## next pam module. - exit 0 -fi diff --git a/usr/libexec/security-misc/pam_only_if_login#security-misc-shared b/usr/libexec/security-misc/pam_only_if_login#security-misc-shared new file mode 100755 index 00000000..a462e19a --- /dev/null +++ b/usr/libexec/security-misc/pam_only_if_login#security-misc-shared @@ -0,0 +1,24 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +true "PAM_SERVICE: ${PAM_SERVICE:-}" + +if [ "${PAM_SERVICE:-}" = "login" ]; then + exit 1 +else + ## exit success so [success=1 default=ignore] will result in skipping the + ## next pam module. + exit 0 +fi diff --git a/usr/libexec/security-misc/pam_only_if_su#security-misc-shared b/usr/libexec/security-misc/pam_only_if_su#security-misc-shared new file mode 100755 index 00000000..eeef759e --- /dev/null +++ b/usr/libexec/security-misc/pam_only_if_su#security-misc-shared @@ -0,0 +1,23 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Similar to: +## /usr/libexec/security-misc/pam_only_if_login + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +true "PAM_SERVICE: ${PAM_SERVICE:-}" + +if [ "${PAM_SERVICE:-}" = "su" ]; then + exit 1 +else + exit 0 +fi diff --git a/usr/libexec/security-misc/panic-on-oops b/usr/libexec/security-misc/panic-on-oops deleted file mode 100755 index 20365df8..00000000 --- a/usr/libexec/security-misc/panic-on-oops +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then - ## pre.bsh would `source` the following folders: - ## /etc/panic-on-oops_pre.d/*.conf - ## /usr/local/etc/panic-on-oops_pre.d/*.conf - source /usr/libexec/helper-scripts/pre.bsh -fi - -## Makes the kernel panic on oopses. This prevents the kernel -## from continuing to run a flawed processes. Many kernel exploits -## will also cause an oops which this will make the kernel kill. -sysctl kernel.panic_on_oops=1 diff --git a/usr/libexec/security-misc/panic-on-oops#security-misc-shared b/usr/libexec/security-misc/panic-on-oops#security-misc-shared new file mode 100755 index 00000000..a89bbd0d --- /dev/null +++ b/usr/libexec/security-misc/panic-on-oops#security-misc-shared @@ -0,0 +1,39 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + ## pre.bsh would `source` the following folders: + ## /etc/panic-on-oops_pre.d/*.conf + ## /usr/local/etc/panic-on-oops_pre.d/*.conf + source /usr/libexec/helper-scripts/pre.bsh +fi + +action="${1:-}" + +if [ "${action}" = 'enable' ]; then + ## Makes the kernel immediately panic on both oopses and warnings. + ## These settings force a full system crash rather than continuing + ## to run after an inconsistent state is triggered by a potentially + ## flawed processes. The reasons for the errors could be kernel + ## exploit attempts but may also simply be general software bugs. + ## + ## https://docs.kernel.org/admin-guide/sysctl/kernel.html#oops-limit + sysctl kernel.oops_limit=1 + ## https://docs.kernel.org/admin-guide/sysctl/kernel.html#warn-limit + sysctl kernel.warn_limit=1 +elif [ "${action}" = 'disable' ]; then + sysctl kernel.oops_limit=0 + sysctl kernel.warn_limit=0 +else + printf '%s\n' "ERROR: Unrecognized action '${action}'!" + exit 1 +fi diff --git a/usr/libexec/security-misc/permission-lockdown b/usr/libexec/security-misc/permission-lockdown#security-misc-shared similarity index 86% rename from usr/libexec/security-misc/permission-lockdown rename to usr/libexec/security-misc/permission-lockdown#security-misc-shared index 973c70db..5b226475 100755 --- a/usr/libexec/security-misc/permission-lockdown +++ b/usr/libexec/security-misc/permission-lockdown#security-misc-shared @@ -1,9 +1,16 @@ #!/bin/bash -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Doing this for all users would create many issues. +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + # /usr/libexec/security-misc/permission-lockdown: user: root | chmod o-rwx "/root" # /usr/libexec/security-misc/permission-lockdown: user: daemon | chmod o-rwx "/usr/sbin" # /usr/libexec/security-misc/permission-lockdown: user: bin | chmod o-rwx "/bin" @@ -25,6 +32,7 @@ # /usr/libexec/security-misc/permission-lockdown: user: stunnel4 | chmod o-rwx "/var/run/stunnel4" # /usr/libexec/security-misc/permission-lockdown: user: iodine | chmod o-rwx "/var/run/iodine" # /usr/libexec/security-misc/permission-lockdown: user: apt-cacher-ng | chmod o-rwx "/var/cache/apt-cacher-ng" +# /usr/libexec/security-misc/permission-lockdown: user: approx | chmod o-rwx "/var/cache/approx" # /usr/libexec/security-misc/permission-lockdown: user: statd | chmod o-rwx "/var/lib/nfs" # /usr/libexec/security-misc/permission-lockdown: user: timidity | chmod o-rwx "/etc/timidity" # /usr/libexec/security-misc/permission-lockdown: user: uuidd | chmod o-rwx "/run/uuidd" @@ -35,10 +43,10 @@ home_folder_access_rights_lockdown() { mkdir --parents /var/cache/security-misc/state-files local user for user in $(dir /home); do ## lists directories only - if [ -f "/var/cache/security-misc/state-files/$user" ]; then + if [ -f "/var/cache/security-misc/state-files/${user}" ]; then continue fi - folder_name="/home/$user" + folder_name="/home/${user}" ## chmod: ## The 'g' for 'group' is not needed. ## Debian by default uses USERGROUPS=yes in /etc/adduser.conf. @@ -50,9 +58,9 @@ home_folder_access_rights_lockdown() { ## required to run is sudo addgroup user1 user2. ## See also: user private groups UPGs ## https://wiki.debian.org/UserPrivateGroups - echo "$0: chmod o-rwx \"$folder_name\"" - chmod o-rwx "$folder_name" - touch "/var/cache/security-misc/state-files/$user" + printf '%s\n' "$0: chmod o-rwx \"${folder_name}\"" + chmod o-rwx "${folder_name}" || true + touch "/var/cache/security-misc/state-files/${user}" || true done } diff --git a/usr/libexec/security-misc/placeholder#security-misc-server b/usr/libexec/security-misc/placeholder#security-misc-server new file mode 100755 index 00000000..6cfad57b --- /dev/null +++ b/usr/libexec/security-misc/placeholder#security-misc-server @@ -0,0 +1,14 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +printf '%s\n' "$0: This is just a placeholder until security-misc-server gets implemented." +exit 0 diff --git a/usr/libexec/security-misc/remove-system.map b/usr/libexec/security-misc/remove-system.map deleted file mode 100755 index a5412227..00000000 --- a/usr/libexec/security-misc/remove-system.map +++ /dev/null @@ -1,42 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then - ## pre.bsh would `source` the following folders: - ## /etc/remove-system.map_pre.d/*.conf - ## /usr/local/etc/remove-system.map_pre.d/*.conf - source /usr/libexec/helper-scripts/pre.bsh -fi - -shopt -s nullglob - -system_map_location="/boot/System.map* /usr/src/*/System.map* /lib/modules/*/*/System.map* /System.map*" - -counter=0 -for filename in ${system_map_location} ; do - counter=$(( counter + 1 )) -done - -if [ "$counter" -ge "1" ]; then - echo "INFO: Deleting system.map files..." -fi - -## Removes the System.map files as they are only used for debugging or malware. -for filename in ${system_map_location} ; do - if [ -f "${filename}" ]; then - if [ -w "${filename}" ]; then - ## 'shred' with '--verbose' is too chatty. (7 lines) - shred --force --zero -u "${filename}" - echo "INFO: removed '${filename}'" - else - echo "NOTE: Cannot delete '${filename}' - read-only. For details, see: https://www.kicksecure.com/wiki/security-misc#system_map" - exit 0 - fi - fi -done - -if [ "$counter" -ge "1" ]; then - echo "INFO: Done. Success." -fi diff --git a/usr/libexec/security-misc/remove-system.map#security-misc-shared b/usr/libexec/security-misc/remove-system.map#security-misc-shared new file mode 100755 index 00000000..a0dff730 --- /dev/null +++ b/usr/libexec/security-misc/remove-system.map#security-misc-shared @@ -0,0 +1,60 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + ## pre.bsh would `source` the following folders: + ## /etc/remove-system.map_pre.d/*.conf + ## /usr/local/etc/remove-system.map_pre.d/*.conf + source /usr/libexec/helper-scripts/pre.bsh +fi + +shopt -s nullglob + +system_map_list=( /boot/System.map* /usr/src/*/System.map* /lib/modules/*/*/System.map* /System.map* ) + +if [ "${#system_map_list[@]}" -gt 0 ]; then + printf '%s\n' "INFO: Deleting system.map files..." +fi + +failed_list=() + +## Removes the System.map files as they are only used for debugging or malware. +for filename in "${system_map_list[@]}"; do + if ! [ -f "${filename}" ]; then + continue + fi + ## The immutable and append-only file attributes prevent deletion. + ## System.map files have no reason to have either. + chattr -ia -- "${filename}" >/dev/null 2>&1 || true + + ## 'shred' with '--verbose' is too chatty. (7 lines) + ## 'shred' stderr is suppressed because failure is expected on read-only + ## file systems. + if shred --force --zero -u -- "${filename}" 2>/dev/null; then + printf '%s\n' "INFO: removed '${filename}'" + continue + fi + failed_list+=( "${filename}" ) +done + +if [ "${#failed_list[@]}" -gt 0 ]; then + for filename in "${failed_list[@]}"; do + printf '%s\n' "NOTE: Could not remove '${filename}'." + done + printf '%s\n' "NOTE: For details, see: https://www.kicksecure.com/wiki/security-misc#system_map" +elif [ "${#system_map_list[@]}" -gt 0 ]; then + printf '%s\n' "INFO: Done. Success." +fi + +## Deliberately exits 0 even on partial failure. A non-zero exit code would fail +## the kernel package's postinst hook and the oneshot unit on every boot. +exit 0 diff --git a/usr/libexec/security-misc/virusforget b/usr/libexec/security-misc/virusforget#security-misc-shared similarity index 93% rename from usr/libexec/security-misc/virusforget rename to usr/libexec/security-misc/virusforget#security-misc-shared index 785d0262..dbab06dd 100755 --- a/usr/libexec/security-misc/virusforget +++ b/usr/libexec/security-misc/virusforget#security-misc-shared @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## VirusForget is inspired by Christopher Laprise. @@ -29,7 +29,7 @@ root_check() { parse_cmd_options() { ## Thanks to: - ## http://mywiki.wooledge.org/BashFAQ/035 + ## https://mywiki.wooledge.org/BashFAQ/035 while : do @@ -85,6 +85,10 @@ parse_cmd_options() { echo "ERROR: must set --user username" >&2 exit 1 fi + if ! id -u "$user_name" >/dev/null 2>&1; then + echo "ERROR: User '$user_name' does not appear to exist!" >&2 + exit 1 + fi } variables() { @@ -270,7 +274,7 @@ unexpected_file() { elif [ "$clean" = "true" ]; then echo "unexpected symlink. Removing... unlink '$full_path_original'" >&2 unlink "$full_path_original" - echo "Removed unexpect symlink." >&2 + echo "Removed unexpected symlink." >&2 fi else if [ "$test_mode" = "true" ]; then @@ -294,6 +298,13 @@ unexpected_file() { } restore_file() { + ## An extraneous file has no baseline backup to restore from; the caller + ## has already removed it, which is the correct action. Return early so the + ## 'cp' below does not fail on the missing backup and abort the entire + ## '--clean' run (via 'set -e') on the first extraneous file encountered. + if [ ! -e "$full_path_backup" ]; then + return 0 + fi if [ "$test_mode" = "true" ]; then echo "Simulate restoring file... $full_path_original" >&2 echo cp --no-dereference --archive "$full_path_backup" "$full_path_original" diff --git a/usr/share/doc/security-misc/fstab-vm b/usr/share/doc/security-misc/fstab-vm#security-misc-shared similarity index 100% rename from usr/share/doc/security-misc/fstab-vm rename to usr/share/doc/security-misc/fstab-vm#security-misc-shared diff --git a/usr/share/glib-2.0/schemas/30_security-misc.gschema.override b/usr/share/glib-2.0/schemas/30_security-misc.gschema.override deleted file mode 100644 index 2ee9098a..00000000 --- a/usr/share/glib-2.0/schemas/30_security-misc.gschema.override +++ /dev/null @@ -1,2 +0,0 @@ -[org.gnome.nautilus.preferences] -show-image-thumbnails="never" diff --git a/usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared b/usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared new file mode 100644 index 00000000..2f568050 --- /dev/null +++ b/usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2017 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[org.gnome.nautilus.preferences] +show-image-thumbnails="never" diff --git a/usr/share/lintian/overrides/security-misc b/usr/share/lintian/overrides/security-misc deleted file mode 100644 index 69081ee0..00000000 --- a/usr/share/lintian/overrides/security-misc +++ /dev/null @@ -1,17 +0,0 @@ -## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## The whole point of the package. -security-misc: package-contains-file-in-etc-skel [etc/skel/*] - -## Wrapper script. -security-misc: no-manual-page [usr/bin/pkexec.security-misc] - -## Non-ideal but still a good solution. -security-misc: file-in-unusual-dir [var/cache/security-misc/state-files/placeholder] - -## False-positive. Just a comment mentioning dpkg's folder. -security-misc: uses-dpkg-database-directly [usr/bin/remount-secure] - -## Special target to make sure this runs as non-parallelized as possible to avoid race conditions. -security-misc: systemd-service-file-refers-to-unusual-wantedby-target sysinit-post.target [usr/lib/systemd/system/remount-secure.service] diff --git a/usr/share/lintian/overrides/security-misc-shared#security-misc-shared b/usr/share/lintian/overrides/security-misc-shared#security-misc-shared new file mode 100644 index 00000000..0735aaa3 --- /dev/null +++ b/usr/share/lintian/overrides/security-misc-shared#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## The whole point of the package. +security-misc-shared: package-contains-file-in-etc-skel [etc/skel/*] + +## Wrapper script. +security-misc-shared: no-manual-page [usr/bin/pkexec.security-misc] + +## Non-ideal but still a good solution. +security-misc-shared: file-in-unusual-dir [var/cache/security-misc/state-files/placeholder] + +## False-positive. Just a comment mentioning dpkg's folder. +security-misc-shared: uses-dpkg-database-directly [usr/bin/remount-secure] + +## Special target to make sure this runs as non-parallelized as possible to avoid race conditions. +security-misc-shared: systemd-service-file-refers-to-unusual-wantedby-target sysinit-post.target [usr/lib/systemd/system/remount-secure.service] + +## False-positive. Unit is commented out by default. +security-misc-shared: systemd-service-file-missing-install-key [usr/lib/systemd/system/block-shutdown.service] + +## Minor bug: Unknown. +security-misc-shared: package-contains-empty-directory [usr/share/security-misc-shared/] + +## Lintian doesn't know that set -o errexit is the same as set -e. +security-misc-shared: maintainer-script-ignores-errors [postinst] diff --git a/usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared b/usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared new file mode 100644 index 00000000..eec6702b --- /dev/null +++ b/usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared @@ -0,0 +1,6 @@ +Name: block unsafe passwordless login (by package security-misc-shared) +Default: yes +Priority: 1100 +Auth-Type: Primary +Auth: + requisite pam_exec.so seteuid stdout /usr/libexec/security-misc/block-unsafe-logins diff --git a/usr/share/pam-configs/console-lockdown-security-misc b/usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared similarity index 60% rename from usr/share/pam-configs/console-lockdown-security-misc rename to usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared index df57a853..d760d5fe 100644 --- a/usr/share/pam-configs/console-lockdown-security-misc +++ b/usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared @@ -1,7 +1,7 @@ -Name: allow only members of group console to use login (by package security-misc) +Name: allow only members of group console to use login (by package security-misc-shared) Default: no Priority: 280 Account-Type: Primary Account: - [success=1 default=ignore] pam_exec.so seteuid quiet /usr/libexec/security-misc/pam_only_if_login + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_only_if_login required pam_access.so accessfile=/etc/security/access-security-misc.conf debug diff --git a/usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared b/usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared new file mode 100644 index 00000000..41c61f9a --- /dev/null +++ b/usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared @@ -0,0 +1,8 @@ +Name: lock accounts after 50 failed authentication attempts (preauth component) (by package security-misc-shared) +Default: yes +Priority: 1024 +Auth-Type: Primary +Auth: + optional pam_exec.so debug stdout seteuid /usr/libexec/security-misc/pam-info + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + required pam_faillock.so preauth diff --git a/usr/share/pam-configs/faillock-security-misc b/usr/share/pam-configs/faillock-security-misc deleted file mode 100644 index d3376901..00000000 --- a/usr/share/pam-configs/faillock-security-misc +++ /dev/null @@ -1,11 +0,0 @@ -Name: lock accounts after 50 failed authentication attempts (part 1) (by package security-misc) -Default: yes -Priority: 290 -Auth-Type: Primary -Auth: - optional pam_exec.so debug stdout seteuid /usr/libexec/security-misc/pam-info - [success=1 default=ignore] pam_exec.so seteuid quiet /usr/libexec/security-misc/pam_faillock_not_if_x - required pam_faillock.so preauth -Account-Type: Primary -Account: - requisite pam_faillock.so diff --git a/usr/share/pam-configs/faillock2-security-misc b/usr/share/pam-configs/faillock2-security-misc deleted file mode 100644 index 7bc5fb73..00000000 --- a/usr/share/pam-configs/faillock2-security-misc +++ /dev/null @@ -1,8 +0,0 @@ -Name: lock accounts after 50 failed authentication attempts (part 2) (by package security-misc) -Default: yes -Priority: 245 -Auth-Type: Primary -Auth: - [success=2 default=ignore] pam_exec.so seteuid quiet /usr/libexec/security-misc/pam_faillock_not_if_x - [default=die] pam_faillock.so authfail - sufficient pam_faillock.so authsucc diff --git a/usr/share/pam-configs/mkhomedir-security-misc b/usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared similarity index 64% rename from usr/share/pam-configs/mkhomedir-security-misc rename to usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared index 326013c0..03b11e4e 100644 --- a/usr/share/pam-configs/mkhomedir-security-misc +++ b/usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared @@ -1,4 +1,4 @@ -Name: Create home directory on login (by package security-misc) +Name: Create home directory on login (by package security-misc-shared) Default: yes Priority: 100 Session-Type: Additional diff --git a/usr/share/pam-configs/pam-abort-on-locked-password-security-misc b/usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared similarity index 70% rename from usr/share/pam-configs/pam-abort-on-locked-password-security-misc rename to usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared index 4d2ffa22..02cd2a35 100644 --- a/usr/share/pam-configs/pam-abort-on-locked-password-security-misc +++ b/usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared @@ -1,4 +1,4 @@ -Name: abort on locked password (by package security-misc) +Name: abort on locked password (by package security-misc-shared) Default: yes Priority: 300 Auth-Type: Primary diff --git a/usr/share/pam-configs/umask-security-misc#security-misc-shared b/usr/share/pam-configs/umask-security-misc#security-misc-shared new file mode 100644 index 00000000..3b34c25f --- /dev/null +++ b/usr/share/pam-configs/umask-security-misc#security-misc-shared @@ -0,0 +1,9 @@ +Name: Restrict umask to 027 for non-root users (by package security-misc-shared) +Default: yes +Priority: 100 +Session-Type: Additional +Session: + [success=1 default=ignore] pam_succeed_if.so uid eq 0 + optional pam_umask.so umask=027 + [success=1 default=ignore] pam_succeed_if.so uid ne 0 + optional pam_umask.so umask=022 diff --git a/usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared b/usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared new file mode 100644 index 00000000..0950f2ad --- /dev/null +++ b/usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared @@ -0,0 +1,20 @@ +Name: Unix authentication with faillock (by package security-misc-shared) +Default: yes +Priority: 384 +Auth-Type: Primary +Auth: + [success=3 default=ignore] pam_unix.so nullok try_first_pass + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + [default=die] pam_faillock.so authfail + requisite pam_deny.so + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + optional pam_faillock.so authsucc + required pam_permit.so +Auth-Initial: + [success=3 default=ignore] pam_unix.so nullok + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + [default=die] pam_faillock.so authfail + requisite pam_deny.so + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + optional pam_faillock.so authsucc + required pam_permit.so diff --git a/usr/share/pam-configs/wheel-security-misc b/usr/share/pam-configs/wheel-security-misc#security-misc-shared similarity index 50% rename from usr/share/pam-configs/wheel-security-misc rename to usr/share/pam-configs/wheel-security-misc#security-misc-shared index 323ff72e..12d72100 100644 --- a/usr/share/pam-configs/wheel-security-misc +++ b/usr/share/pam-configs/wheel-security-misc#security-misc-shared @@ -1,6 +1,7 @@ -Name: group sudo membership required to use su (by package security-misc) +Name: group sudo membership required to use su (by package security-misc-shared) Default: yes -Priority: 280 +Priority: 1050 Auth-Type: Primary Auth: + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_only_if_su requisite pam_wheel.so group=sudo debug diff --git a/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared b/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared new file mode 100644 index 00000000..176b14e1 --- /dev/null +++ b/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared @@ -0,0 +1,335 @@ + + + + + The Flatpak Project + https://github.com/flatpak/flatpak + package-x-generic + + + Install signed application + Authentication is required to install software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.app-update org.freedesktop.Flatpak.runtime-install org.freedesktop.Flatpak.runtime-update + + + + Install signed runtime + Authentication is required to install software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-update + + + + Update signed application + Authentication is required to update software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-install org.freedesktop.Flatpak.runtime-update + + + + Update signed runtime + Authentication is required to update software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update remote metadata + Authentication is required to update remote info + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update system repository + Authentication is required to modify a system repository + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Install bundle + Authentication is required to install software from $(path) + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-install org.freedesktop.Flatpak.runtime-update + + + + Uninstall runtime + Authentication is required to uninstall software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Uninstall app + Authentication is required to uninstall $(ref) + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-uninstall + + + + Configure Remote + Authentication is required to configure software repositories + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Configure + Authentication is required to configure software installation + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update appstream + Authentication is required to update information about software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update metadata + Authentication is required to update metadata + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Override parental controls for installs + Authentication is required to install software which is restricted by your parental controls policy + package-x-generic + + auth_admin + auth_admin + auth_admin + + org.freedesktop.Flatpak.override-parental-controls-update + + + + Override parental controls for updates + Authentication is required to update software which is restricted by your parental controls policy + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + diff --git a/usr/share/security-misc/dolphinrc b/usr/share/security-misc/dolphinrc#security-misc-shared similarity index 50% rename from usr/share/security-misc/dolphinrc rename to usr/share/security-misc/dolphinrc#security-misc-shared index 0d4b7396..9028487f 100644 --- a/usr/share/security-misc/dolphinrc +++ b/usr/share/security-misc/dolphinrc#security-misc-shared @@ -1,6 +1,5 @@ -## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions [PreviewSettings] Plugins= - diff --git a/usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared b/usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared new file mode 100644 index 00000000..8de5412f --- /dev/null +++ b/usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared @@ -0,0 +1,21 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file should not be installed on the host system, it is intended for +## inclusion in a dracut initramfs only. + +[Unit] +Description=Emergency shutdown when boot media is removed +Documentation=https://github.com/Kicksecure/security-misc +DefaultDependencies=no +Before=sysinit.target +Requires=systemd-udevd.service +After=systemd-udevd.service + +[Service] +Type=notify +ExecStart=/usr/libexec/security-misc/emerg-shutdown +NotifyAccess=main + +[Install] +WantedBy=sysinit.target diff --git a/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf b/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared similarity index 90% rename from usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf rename to usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared index c94e65ef..87de7e08 100644 --- a/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf +++ b/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## LKRG VirtualBox host configuration @@ -13,7 +13,7 @@ ## /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf ## to: ## /etc/sysctl.d/30-lkrg-virtualbox.conf -## by package security-misc, files: +## by package security-misc-shared, files: ## /usr/share/security-misc/lkrg/lkrg-virtualbox ## /usr/lib/systemd/system/lkrg.service.d/40-virtualbox.conf diff --git a/usr/share/security-misc/lkrg/lkrg-virtualbox b/usr/share/security-misc/lkrg/lkrg-virtualbox deleted file mode 100755 index 022d2dc9..00000000 --- a/usr/share/security-misc/lkrg/lkrg-virtualbox +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2021 - 2023 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -x -set -e - -if ! command -v vboxmanage &>/dev/null ; then - if test -f /etc/sysctl.d/30-lkrg-virtualbox.conf ; then - rm --force --verbose /etc/sysctl.d/30-lkrg-virtualbox.conf - fi - exit 0 -fi - -if ! test -d /etc/sysctl.d ; then - exit 0 -fi - -if ! test -f /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf ; then - exit 0 -fi - -cp --verbose /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf /etc/sysctl.d/30-lkrg-virtualbox.conf diff --git a/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared new file mode 100755 index 00000000..a64cb9fe --- /dev/null +++ b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared @@ -0,0 +1,42 @@ +#!/bin/bash + +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +#set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## security-misc-shared Depends on helper-scripts. +# shellcheck source=../../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh + +## Check if the VirtualBox host software is installed. +if ! has vboxmanage ; then + ## VirtualBox host software is not installed. + if test -f /etc/sysctl.d/30-lkrg-virtualbox.conf ; then + ## Delete using '--verbose' so user is notified. + safe-rm --force --verbose -- /etc/sysctl.d/30-lkrg-virtualbox.conf + fi + exit 0 +fi + +if ! test -d /etc/sysctl.d ; then + exit 0 +fi + +if ! test -f /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf ; then + exit 0 +fi + +if ! package-installed-check "lkrg" ; then + exit 0 +fi + +## Delete using '--verbose' so user is notified. +cp --verbose -- /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf /etc/sysctl.d/30-lkrg-virtualbox.conf diff --git a/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared b/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared new file mode 100644 index 00000000..d40c552c --- /dev/null +++ b/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared @@ -0,0 +1,36 @@ +root root 644 /etc/passwd- +root root 755 /etc/cron.monthly +root root 755 /etc/sudoers.d +root shadow 2755 /usr/bin/expiry +root root 4755 /usr/bin/umount +root root 4755 /usr/bin/gpasswd +root root 755 /usr/lib/modules +root root 644 /etc/issue.net +root root 644 /etc/group- +root root 4755 /usr/bin/newgrp +root root 755 /etc/cron.weekly +root root 644 /etc/hosts.deny +root root 4755 /usr/bin/su +root root 644 /etc/hosts.allow +root root 700 /root +root root 755 /etc/cron.daily +root root 755 /bin/ping +root root 777 /etc/motd.kicksecure +root root 777 /etc/motd.whonix +root root 755 /boot +root root 755 /home +root shadow 2755 /usr/bin/chage +root root 4755 /usr/bin/chsh +root root 4755 /usr/bin/passwd +root root 4755 /usr/bin/chfn +root root 644 /etc/group +root root 755 /etc/permission-hardener.d +root root 644 /etc/passwd +root root 755 /usr/src +root root 4755 /usr/bin/mount +root root 777 /etc/issue.kicksecure +root root 777 /etc/issue.whonix +root root 755 /etc/cron.d +root root 4755 /usr/bin/sudo +root root 4755 /usr/bin/pkexec +root root 4755 /usr/lib/polkit-1/polkit-agent-helper-1 diff --git a/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared b/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared new file mode 100644 index 00000000..d1b3a806 --- /dev/null +++ b/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared @@ -0,0 +1,26 @@ +root root 700 /etc/cron.monthly +root root 700 /etc/sudoers.d +root shadow 744 /usr/bin/expiry +root root 755 /usr/bin/umount +root root 744 /usr/bin/gpasswd +root root 700 /usr/lib/modules +root root 744 /usr/bin/newgrp +root root 700 /etc/cron.weekly +root root 744 /usr/bin/su +root root 700 /etc/cron.daily +root root 755 /bin/ping +root root 644 /etc/motd.kicksecure +root root 644 /etc/motd.whonix +root _ssh 744 /usr/bin/ssh-agent +root root 700 /boot +root shadow 744 /usr/bin/chage +root root 744 /usr/lib/openssh/ssh-keysign +root root 744 /usr/bin/chsh +root root 755 /usr/bin/passwd +root root 744 /usr/bin/chfn +root root 600 /etc/permission-hardener.d +root root 700 /usr/src +root root 755 /usr/bin/mount +root root 644 /etc/issue.kicksecure +root root 644 /etc/issue.whonix +root root 700 /etc/cron.d diff --git a/usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared b/usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared new file mode 100644 index 00000000..12439b3e --- /dev/null +++ b/usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared @@ -0,0 +1,2 @@ +# Lock systemd and all of its library dependencies into memory ++/usr/lib/systemd/systemd diff --git a/usr/src/security-misc/emerg-shutdown.c#security-misc-shared b/usr/src/security-misc/emerg-shutdown.c#security-misc-shared new file mode 100644 index 00000000..95cd3371 --- /dev/null +++ b/usr/src/security-misc/emerg-shutdown.c#security-misc-shared @@ -0,0 +1,1110 @@ +/* + * Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC + * See the file COPYING for copying conditions. + */ + +/* + * This program is designed specifically to immediately and forcibly power off + * the system in the event the device providing the root filesystem is + * abruptly removed from the system. The idea is that a user can shut down + * a portable installation of Kicksecure by simply yanking the USB drive + * containing the installation from the computer. Tails provides essentially + * the same feature, however it is known for occasionally failing to do its + * job properly. + * + * The fact that we're triggering a shutdown when the device containing the + * root filesystem vanishes presents a number of significant challenges: + * + * - The device providing the entire operating system is gone. The only things + * we will still have left are the kernel, files loaded into RAM (for + * instance under /run), and anything that happens to still be in the + * system's disk cache. + * - Virtually any process on the system may abruptly crash at any time. This + * isn't just because applications may be unable to access files. The Linux + * kernel's virtual memory subsystem doesn't just page out RAM contents to a + * swap file, it will sometimes simply erase pages containing executable + * code from memory if it can reload that code from disk later when needed. + * If part of a program isn't present in memory, and then the root device + * vanishes, any attempt to use code in the absent part of the application + * will result in the application crashing. (Attempts to access data in RAM + * that happened to be paged out will result in a similar crash.) + * - We have no control over what is and isn't in the disk cache, which makes + * it unsafe to launch any dynamically linked executable. What happens if we + * need to load a missing part of libc? What if the dynamic linker itself + * needs loaded from disk? + * - Systemd could lock up at any time, since the init process isn't immune to + * having bits of it erased from RAM to free up memory. If systemd receives + * a SIGSEGV, rather than crashing (which would panic the kernel), it goes + * into an "emergency mode" that tries to keep the system as operational as + * possible even though PID 1 is now out of service. + * + * Circumventing this set of difficulties is not easy, and it might not even + * be entirely possible. To give our feature the highest chance of success: + * + * - We use memlockd to lock systemd and all libraries it depends on into + * memory. It can hold its own pretty well in the event of a segfault, but + * if its crash handler ends up re-segfaulting, that could get ugly. + * - We compile the utility at boot time, statically link it against all of + * its dependencies (really only one, glibc), and load it into /run. This + * allows for decent architecture independence while removing any dependency + * on anything that isn't in RAM, thus (hopefully!) making the process + * crash-immune. + * - Because we're static-linking against glibc, we cannot call anything + * defined in stdio.h. This is because glibc uses dlopen() to load iconv + * modules, which are used internally by glibc for locale support. Things + * defined in stdio.h may use iconv, so calling anything there will + * basically make our static-linked executable become dynamically linked, + * which could segfault it since the root filesystem is gone. We can't call + * anything that could touch Name Service Switch (NSS) either, but we have + * no need to do so, so we should be safe there. See + * https://stackoverflow.com/questions/57476533/why-is-statically-linking-glibc-discouraged + * - We can't use udev either because libudev is only available as a dynamic + * library. That means we have to listen to kernel uevents directly to + * determine when the root device vanishes. Thankfully this isn't as much of + * a pain as it might sound like. + * - We don't call out to any external process, since those external processes + * could segfault. + * + * This is likely superior to Tails' implementation, which uses udev (and thus + * dynamic linking), uses an interpreter-driven script to shut down the system + * when the root device vanishes, and calls out to external executables to + * actually shut the system down. These issues are likely why Tails' + * implementation of emergency shutdown occasionally fails. See + * https://www.reddit.com/r/tails/comments/xh8njn/tails_wont_shutdown_when_i_pull_usb_stick/ + * (there are other similar posts as well). + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +//#define fd_stdin 0 +//#define fd_stdout 1 +#define fd_stderr 2 + +#define max_inputs 255 +#define input_path_size 20 +#define key_flags_len 12 + +#define hw_monitor_val 1 +#define fifo_monitor_val 2 + +#define max_sig_num 31 + +int console_fd = -1; + +/* Adapted from kloak/src/keycodes.c */ +struct name_value { + const char *name; + const uint32_t value; +}; +static struct name_value key_table[] = { + {"KEY_ESC", KEY_ESC}, + {"KEY_1", KEY_1}, + {"KEY_2", KEY_2}, + {"KEY_3", KEY_3}, + {"KEY_4", KEY_4}, + {"KEY_5", KEY_5}, + {"KEY_6", KEY_6}, + {"KEY_7", KEY_7}, + {"KEY_8", KEY_8}, + {"KEY_9", KEY_9}, + {"KEY_0", KEY_0}, + {"KEY_MINUS", KEY_MINUS}, + {"KEY_EQUAL", KEY_EQUAL}, + {"KEY_BACKSPACE", KEY_BACKSPACE}, + {"KEY_TAB", KEY_TAB}, + {"KEY_Q", KEY_Q}, + {"KEY_W", KEY_W}, + {"KEY_E", KEY_E}, + {"KEY_R", KEY_R}, + {"KEY_T", KEY_T}, + {"KEY_Y", KEY_Y}, + {"KEY_U", KEY_U}, + {"KEY_I", KEY_I}, + {"KEY_O", KEY_O}, + {"KEY_P", KEY_P}, + {"KEY_LEFTBRACE", KEY_LEFTBRACE}, + {"KEY_RIGHTBRACE", KEY_RIGHTBRACE}, + {"KEY_ENTER", KEY_ENTER}, + {"KEY_LEFTCTRL", KEY_LEFTCTRL}, + {"KEY_A", KEY_A}, + {"KEY_S", KEY_S}, + {"KEY_D", KEY_D}, + {"KEY_F", KEY_F}, + {"KEY_G", KEY_G}, + {"KEY_H", KEY_H}, + {"KEY_J", KEY_J}, + {"KEY_K", KEY_K}, + {"KEY_L", KEY_L}, + {"KEY_SEMICOLON", KEY_SEMICOLON}, + {"KEY_APOSTROPHE", KEY_APOSTROPHE}, + {"KEY_GRAVE", KEY_GRAVE}, + {"KEY_LEFTSHIFT", KEY_LEFTSHIFT}, + {"KEY_BACKSLASH", KEY_BACKSLASH}, + {"KEY_Z", KEY_Z}, + {"KEY_X", KEY_X}, + {"KEY_C", KEY_C}, + {"KEY_V", KEY_V}, + {"KEY_B", KEY_B}, + {"KEY_N", KEY_N}, + {"KEY_M", KEY_M}, + {"KEY_COMMA", KEY_COMMA}, + {"KEY_DOT", KEY_DOT}, + {"KEY_SLASH", KEY_SLASH}, + {"KEY_RIGHTSHIFT", KEY_RIGHTSHIFT}, + {"KEY_KPASTERISK", KEY_KPASTERISK}, + {"KEY_LEFTALT", KEY_LEFTALT}, + {"KEY_SPACE", KEY_SPACE}, + {"KEY_CAPSLOCK", KEY_CAPSLOCK}, + {"KEY_F1", KEY_F1}, + {"KEY_F2", KEY_F2}, + {"KEY_F3", KEY_F3}, + {"KEY_F4", KEY_F4}, + {"KEY_F5", KEY_F5}, + {"KEY_F6", KEY_F6}, + {"KEY_F7", KEY_F7}, + {"KEY_F8", KEY_F8}, + {"KEY_F9", KEY_F9}, + {"KEY_F10", KEY_F10}, + {"KEY_NUMLOCK", KEY_NUMLOCK}, + {"KEY_SCROLLLOCK", KEY_SCROLLLOCK}, + {"KEY_KP7", KEY_KP7}, + {"KEY_KP8", KEY_KP8}, + {"KEY_KP9", KEY_KP9}, + {"KEY_KPMINUS", KEY_KPMINUS}, + {"KEY_KP4", KEY_KP4}, + {"KEY_KP5", KEY_KP5}, + {"KEY_KP6", KEY_KP6}, + {"KEY_KPPLUS", KEY_KPPLUS}, + {"KEY_KP1", KEY_KP1}, + {"KEY_KP2", KEY_KP2}, + {"KEY_KP3", KEY_KP3}, + {"KEY_KP0", KEY_KP0}, + {"KEY_KPDOT", KEY_KPDOT}, + {"KEY_ZENKAKUHANKAKU", KEY_ZENKAKUHANKAKU}, + {"KEY_102ND", KEY_102ND}, + {"KEY_F11", KEY_F11}, + {"KEY_F12", KEY_F12}, + {"KEY_RO", KEY_RO}, + {"KEY_KATAKANA", KEY_KATAKANA}, + {"KEY_HIRAGANA", KEY_HIRAGANA}, + {"KEY_HENKAN", KEY_HENKAN}, + {"KEY_KATAKANAHIRAGANA", KEY_KATAKANAHIRAGANA}, + {"KEY_MUHENKAN", KEY_MUHENKAN}, + {"KEY_KPJPCOMMA", KEY_KPJPCOMMA}, + {"KEY_KPENTER", KEY_KPENTER}, + {"KEY_RIGHTCTRL", KEY_RIGHTCTRL}, + {"KEY_KPSLASH", KEY_KPSLASH}, + {"KEY_SYSRQ", KEY_SYSRQ}, + {"KEY_RIGHTALT", KEY_RIGHTALT}, + {"KEY_LINEFEED", KEY_LINEFEED}, + {"KEY_HOME", KEY_HOME}, + {"KEY_UP", KEY_UP}, + {"KEY_PAGEUP", KEY_PAGEUP}, + {"KEY_LEFT", KEY_LEFT}, + {"KEY_RIGHT", KEY_RIGHT}, + {"KEY_END", KEY_END}, + {"KEY_DOWN", KEY_DOWN}, + {"KEY_PAGEDOWN", KEY_PAGEDOWN}, + {"KEY_INSERT", KEY_INSERT}, + {"KEY_DELETE", KEY_DELETE}, + {"KEY_MACRO", KEY_MACRO}, + {"KEY_MUTE", KEY_MUTE}, + {"KEY_VOLUMEDOWN", KEY_VOLUMEDOWN}, + {"KEY_VOLUMEUP", KEY_VOLUMEUP}, + {"KEY_POWER", KEY_POWER}, + {"KEY_POWER2", KEY_POWER2}, + {"KEY_KPEQUAL", KEY_KPEQUAL}, + {"KEY_KPPLUSMINUS", KEY_KPPLUSMINUS}, + {"KEY_PAUSE", KEY_PAUSE}, + {"KEY_SCALE", KEY_SCALE}, + {"KEY_KPCOMMA", KEY_KPCOMMA}, + {"KEY_HANGEUL", KEY_HANGEUL}, + {"KEY_HANGUEL", KEY_HANGUEL}, + {"KEY_HANJA", KEY_HANJA}, + {"KEY_YEN", KEY_YEN}, + {"KEY_LEFTMETA", KEY_LEFTMETA}, + {"KEY_RIGHTMETA", KEY_RIGHTMETA}, + {"KEY_COMPOSE", KEY_COMPOSE}, + {"KEY_F13", KEY_F13}, + {"KEY_F14", KEY_F14}, + {"KEY_F15", KEY_F15}, + {"KEY_F16", KEY_F16}, + {"KEY_F17", KEY_F17}, + {"KEY_F18", KEY_F18}, + {"KEY_F19", KEY_F19}, + {"KEY_F20", KEY_F20}, + {"KEY_F21", KEY_F21}, + {"KEY_F22", KEY_F22}, + {"KEY_F23", KEY_F23}, + {"KEY_F24", KEY_F24}, + {"KEY_UNKNOWN", KEY_UNKNOWN}, + {NULL, 0} +}; +uint32_t lookup_keycode(const char *name) { + struct name_value *p; + for (p = key_table; p->name != NULL; ++p) { + if (strcmp(p->name, name) == 0) { + return p->value; + } + } + return 0; +} + +/* Adapted from systemd/src/login/logind-button.c */ +bool bitset_get(const uint64_t *bits, uint32_t i) { + return (bits[i / 64] >> (i % 64)) & 1UL; +} + +void print(int fd, const char *str) { + size_t len = strlen(str); + while (len > 0) { + ssize_t write_len = write(fd, str, len); + if (write_len < 0) { + /* File descriptor was closed, continue regardless */ + return; + } + len -= (size_t)write_len; + str += write_len; + } +} + +void print_usage(void) { + print(fd_stderr, "Usage:\n"); + print(fd_stderr, " emerg-shutdown [OPTIONS...]\n"); + print(fd_stderr, "Options:\n"); + print(fd_stderr, " --devices=DEVICE1[,DEVICE2...]\n"); + print(fd_stderr, " A comma-separated list of devices. If any of these devices are\n"); + print(fd_stderr, " removed from the system, an emergency shutdown will occur.\n"); + print(fd_stderr, " --keys=KEY_1[,KEY_2|KEY_3...]\n"); + print(fd_stderr, " A comma-separated list of keys. If all of the specified keys are\n"); + print(fd_stderr, " pressed at the same time, an emergency shutdown will occur.\n"); + print(fd_stderr, " Keys separated with a pipe will be treated as aliases of each\n"); + print(fd_stderr, " other.\n"); + print(fd_stderr, " --paranoid\n"); + print(fd_stderr, " Watches for the removal of any removable device whatsoever. An\n"); + print(fd_stderr, " emergency shutdown will be triggered if any device is removed.\n"); + print(fd_stderr, " Cannot be combined with --devices.\n"); + print(fd_stderr, " --instant-shutdown\n"); + print(fd_stderr, " Immediately triggers an emergency shutdown. Cannot be combined\n"); + print(fd_stderr, " with other options.\n"); + print(fd_stderr, " --monitor-fifo\n"); + print(fd_stderr, " Used internally to implement the ensure-shutdown service. Do\n"); + print(fd_stderr, " not use.\n"); + print(fd_stderr, " --timeout=TIMEOUT\n"); + print(fd_stderr, " Used internally to implement the ensure-shutdown service. Do\n"); + print(fd_stderr, " not use.\n"); + print(fd_stderr, "Example:\n"); + print(fd_stderr, " emerg-shutdown --devices=/dev/sda3 --keys=KEY_POWER\n"); + print(fd_stderr, "See /etc/security-misc/emerg-shutdown/30_security-misc.conf to\n"); + print(fd_stderr, "configure the emerg-shutdown service.\n"); +} + +void *safe_calloc(size_t nmemb, size_t size) { + void *ret_buf = calloc(nmemb, size); + if (ret_buf == NULL) { + print(fd_stderr, "Out of memory!\n"); + exit(1); + } + return ret_buf; +} + +void *safe_reallocarray(void *ptr, size_t nmemb, size_t size) { + void *ret_buf = reallocarray(ptr, nmemb, size); + if (ret_buf == NULL) { + print(fd_stderr, "Out of memory!\n"); + exit(1); + } + return ret_buf; +} + +/* Inspired by https://www.strudel.org.uk/itoa/ */ +char *int_to_str(uint32_t val) { + static char buf[11]; + int8_t i; + char *rslt = NULL; + const char *digits = "0123456789"; + + buf[10] = '\0'; + + for (i = 9; i >= 0; i--) { + buf[i] = digits[val % 10]; + val /= 10; + if (val == 0) { + break; + } + } + assert(i >= 0); + + rslt = safe_calloc(1, 11 - (uint8_t)(i)); + memcpy(rslt, buf + i, 11 - (uint8_t)(i)); + return rslt; +} + +void load_list(const char *arg, size_t *result_list_len_ref, char ***result_list_ref, const char *sep, bool parse_opt) { + char **result_list = NULL; + size_t result_list_len = 0; + size_t arg_copy_len = strlen(arg) + 1; + char *arg_copy = safe_calloc(1, arg_copy_len); + char *arg_val; + char *arg_part; + + memcpy(arg_copy, arg, arg_copy_len); + if (parse_opt) { + /* returns "--whatever" */ + arg_val = strtok(arg_copy, "="); + /* returns everything after the = sign */ + arg_val = strtok(NULL, ""); + } else { + arg_val = arg_copy; + } + + arg_part = strtok(arg_val, sep); + if (arg_part == NULL) { + free(arg_copy); + return; + } + + do { + result_list_len++; + result_list = safe_reallocarray(result_list, result_list_len, sizeof(char *)); + result_list[result_list_len - 1] = safe_calloc(1, strlen(arg_part) + 1); + strcpy(result_list[result_list_len - 1], arg_part); + } while ((arg_part = strtok(NULL, sep)) != NULL); + + *result_list_len_ref = result_list_len; + *result_list_ref = result_list; + free(arg_copy); +} + +void kill_system(void) { + /* + * It isn't safe to simply call the reboot syscall here - there is a + * graphics driver bug in the i915 driver on Bookworm that will throw a + * kernel warning during shutdown. Kicksecure sets panic_on_oops and + * panic_on_warn to 1 during bootup, which means this bug will cause a + * kernel panic and thus hang the system rather than shutting down. + * + * To mitigate this, we do two things: + * + * - We disable the panic_on_oops and panic_on_warn kernel settings before + * calling the reboot syscall. This way if a warn or oops does occur, at + * least it isn't as likely to block shutdown. + * - We switch virtual terminals before initiating the shutdown. This should + * hopefully keep whatever is going wrong from going wrong in the first + * place. + * + * This is probably a good idea for any system, because switching TTYs is a + * rather basic operation that is likely to work, while forcibly shutting + * down while X11 or Wayland still has control of the display is probably + * not as well tested (if it's been tested at all). + * + * Above all else though, we want to at least *try* to shutdown. Even if all + * our attempts to switch VTs fail and /proc isn't available for us to tweak + * kernel settings, we still need to try. Therefore we absolutely do not + * crash or block, except when waiting for a VT to become activated. (If VT + * activation blocks forever, the kernel is probably horribly broken and + * would probably panic imminently anyway.) + */ + + const char *panic_on_oops_path = "/proc/sys/kernel/panic_on_oops"; + const char *panic_on_warn_path = "/proc/sys/kernel/panic_on_warn"; + + int ret = 0; + int tgt_vt = 0; + int sysctl_fd = 0; + + /* Turn off panic_on_oops. */ + sysctl_fd = open(panic_on_oops_path, O_WRONLY); + if (sysctl_fd != -1) { + /* We intentionally ignore the return from `write` here. */ +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wunused-result" + write(sysctl_fd, "0", 1); +#pragma GCC diagnostic pop + close(sysctl_fd); + } + + /* Turn off panic_on_warn. */ + sysctl_fd = open(panic_on_warn_path, O_WRONLY); + if (sysctl_fd != -1) { + /* We intentionally ignore the return from `write` here. */ +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wunused-result" + write(sysctl_fd, "0", 1); +#pragma GCC diagnostic pop + close(sysctl_fd); + } + + /* Determine which VT to switch to. Anything that isn't open yet will do. */ + ret = ioctl(console_fd, VT_OPENQRY, &tgt_vt); + if (ret == -1) { + goto trykill; + } + + /* Try to switch to it. */ + ret = ioctl(console_fd, VT_ACTIVATE, tgt_vt); + if (ret == -1) { + goto trykill; + } + + /* Wait for it to become active. */ + ioctl(console_fd, VT_WAITACTIVE, tgt_vt); + +trykill: + syscall(SYS_reboot, LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, + LINUX_REBOOT_CMD_POWER_OFF, NULL); + /* + * This syscall can return, and if we exit after it returns but before the + * system shuts down, the system may not shut down. Wait for shutdown to + * occur. + */ + sleep(60); + exit(0); +} + +/* Ignore all signals, except SIGSEGV and (optionally) SIGTERM. */ +void ignore_signals(bool also_sigterm) { + struct sigaction sigact_swallow = { 0 }; + int sig_idx = 0; + + /* Swallow all signals that we can. */ + sigact_swallow.sa_handler = SIG_IGN; + for (sig_idx = 1; sig_idx <= max_sig_num; sig_idx++) { + if (sig_idx == SIGSTOP) { + continue; + } + if (sig_idx == SIGKILL) { + continue; + } + if (sig_idx == SIGSEGV) { + continue; + } + if (sig_idx == SIGTERM && !also_sigterm) { + continue; + } + if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) { + print(fd_stderr, "Failed to set up signal ignores!\n"); + exit(1); + } + } + for (sig_idx = SIGRTMIN; sig_idx <= SIGRTMAX; sig_idx++) { + if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) { + print(fd_stderr, "Failed to set up real-time signal ignores!\n"); + exit(1); + } + } +} + +/* Monitor for device removal and emergency shutdown key combos. */ +void hw_monitor(int argc, char **argv) { + /* Working variables */ + size_t target_dev_list_len = 0; + char **target_dev_name_raw_list = NULL; + size_t panic_key_list_len = 0; + char **panic_key_str_list = NULL; + char **target_dev_list = NULL; + uint32_t **panic_key_list = NULL; + bool *panic_key_active_list = NULL; + size_t event_fd_list_len = 0; + int *event_fd_list = NULL; + char input_path_buf[input_path_size]; + struct pollfd *pollfd_list = NULL; + struct input_event ie_buf[64]; + bool paranoid_mode = false; + + /* Index variables */ + int arg_idx = 0; + size_t tdl_idx = 0; + size_t tdp_char_idx = 0; + size_t pkl_idx = 0; + uint32_t input_idx = 0; + size_t efl_idx = 0; + int ie_idx = 0; + size_t kg_idx = 0; + + /* Socket management */ + struct sockaddr_nl sa = { 0 }; + int ns = 0; + int ret = 0; + + for (arg_idx = 1; arg_idx < argc; arg_idx++) { + if (strncmp(argv[arg_idx], "--devices=", strlen("--devices=")) == 0) { + if (target_dev_name_raw_list != NULL) { + print(fd_stderr, "--devices cannot be passed more than once!\n"); + print_usage(); + exit(1); + } + load_list(argv[arg_idx], &target_dev_list_len, &target_dev_name_raw_list, ",", true); + } else if (strcmp(argv[arg_idx], "--paranoid") == 0) { + paranoid_mode = true; + } else if (strncmp(argv[arg_idx], "--keys=", strlen("--keys=")) == 0) { + if (panic_key_str_list != NULL) { + print(fd_stderr, "--keys cannot be passed more than once!\n"); + print_usage(); + exit(1); + } + load_list(argv[arg_idx], &panic_key_list_len, &panic_key_str_list, ",", true); + } else { + print(fd_stderr, "Unrecognized argument '"); + print(fd_stderr, argv[arg_idx]); + print(fd_stderr, "' passed!\n"); + print_usage(); + exit(1); + } + } + if (target_dev_name_raw_list != NULL && paranoid_mode) { + print(fd_stderr, "--devices and --paranoid are mutually exclusive!\n"); + print_usage(); + exit(1); + } + + ignore_signals(false); /* ignore all but SIGTERM */ + + console_fd = open("/dev/console", O_RDWR); + if (console_fd == -1) { + print(fd_stderr, "Could not open /dev/console!\n"); + exit(1); + } + + target_dev_list = safe_calloc(target_dev_list_len, sizeof(char *)); + panic_key_list = safe_calloc(panic_key_list_len, sizeof(uint32_t *)); + panic_key_active_list = safe_calloc(panic_key_list_len, sizeof(bool)); + + for (tdl_idx = 0; tdl_idx < target_dev_list_len; tdl_idx++) { + char *target_dev_path = target_dev_name_raw_list[tdl_idx]; + size_t device_path_slash_count = 0; + char *target_dev_parse = safe_calloc(1, strlen(target_dev_path) + 1); + char *target_dev_name = NULL; + + if (access(target_dev_path, F_OK) != 0) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' does not exist!\n"); + print_usage(); + exit(1); + } + + if (strncmp(target_dev_path, "/dev/sr", strlen("/dev/sr")) != 0 + && strncmp(target_dev_path, "/dev/nvme", strlen("/dev/nvme")) != 0 + && strncmp(target_dev_path, "/dev/sd", strlen("/dev/sd")) != 0 + && strncmp(target_dev_path, "/dev/mmc", strlen("/dev/mmc")) != 0 + && strncmp(target_dev_path, "/dev/vd", strlen("/dev/vd")) != 0 + && strncmp(target_dev_path, "/dev/xvd", strlen("/dev/xvd")) != 0 + && strncmp(target_dev_path, "/dev/hd", strlen("/dev/hd")) != 0) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' is not supported!\n"); + print_usage(); + exit(1); + } + + for (tdp_char_idx = 0; tdp_char_idx < strlen(target_dev_path); tdp_char_idx++) { + if (target_dev_path[tdp_char_idx] == '/') { + device_path_slash_count++; + } + } + if (device_path_slash_count != 2) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' is not supported!\n"); + print_usage(); + exit(1); + } + + memcpy(target_dev_parse, target_dev_path, strlen(target_dev_path) + 1); + + /* returns "dev" */ + target_dev_name = strtok(target_dev_parse, "/"); + /* returns the actual device name we want */ + target_dev_name = strtok(NULL, "/"); + if (target_dev_name == NULL) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' is not supported!\n"); + print_usage(); + exit(1); + } + + target_dev_list[tdl_idx] = calloc(1, strlen(target_dev_name) + 1); + memcpy(target_dev_list[tdl_idx], target_dev_name, strlen(target_dev_name) + 1); + free(target_dev_parse); + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + size_t keygroup_str_list_len = 0; + char **keygroup_str_list = NULL; + uint32_t *pkl_element = NULL; + + load_list(panic_key_str_list[pkl_idx], &keygroup_str_list_len, &keygroup_str_list, "|", false); + pkl_element = safe_calloc(keygroup_str_list_len + 1, sizeof(uint32_t)); + + pkl_element[keygroup_str_list_len] = 0; + for (kg_idx = 0; kg_idx < keygroup_str_list_len; kg_idx++) { + uint32_t keycode = lookup_keycode(keygroup_str_list[kg_idx]); + if (keycode == 0) { + print(fd_stderr, "Invalid key code '"); + print(fd_stderr, keygroup_str_list[kg_idx]); + print(fd_stderr, "'!\n"); + print_usage(); + exit(1); + } + pkl_element[kg_idx] = keycode; + free(keygroup_str_list[kg_idx]); + } + + free(keygroup_str_list); + panic_key_list[pkl_idx] = pkl_element; + } + + /* Device event listener setup */ + sa.nl_family = AF_NETLINK; + sa.nl_pad = 0; + sa.nl_pid = (uint32_t)getpid(); + sa.nl_groups = NETLINK_KOBJECT_UEVENT; + ns = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_KOBJECT_UEVENT); + if (ns < 0) { + print(fd_stderr, "Failed to create netlink socket!\n"); + exit(1); + } + ret = bind(ns, (struct sockaddr *) &sa, sizeof(sa)); + if (ret < 0) { + print(fd_stderr, "Failed to bind netlink socket!\n"); + exit(1); + } + + /* Keyboard event listener setup + * Heavily inspired by systemd/src/login/logind-button.c and + * kloak/src/main.c */ + for (input_idx = 0; input_idx <= max_inputs; input_idx++) { + int tmp_fd = 0; + uint64_t key_flags[key_flags_len]; + bool supports_panic = true; + char *loop_str = NULL; + + strcpy(input_path_buf, "/dev/input/event"); + loop_str = int_to_str(input_idx); + strcat(input_path_buf, loop_str); + free(loop_str); + + tmp_fd = open(input_path_buf, O_RDONLY | O_CLOEXEC | O_NOCTTY | O_NONBLOCK); + if (tmp_fd < 0) { + continue; + } + + if (ioctl(tmp_fd, EVIOCGBIT(EV_SYN, sizeof(key_flags)), key_flags) < 0) { + print(fd_stderr, "Failed to query properties of input device '"); + print(fd_stderr, input_path_buf); + print(fd_stderr, "'!\n"); + exit(1); + } + + if (!bitset_get(key_flags, EV_KEY)) { + close(tmp_fd); + continue; + } + + if (ioctl(tmp_fd, EVIOCGBIT(EV_KEY, sizeof(key_flags)), key_flags) < 0) { + print(fd_stderr, "Failed to query keys available on input device '"); + print(fd_stderr, input_path_buf); + print(fd_stderr, "'!\n"); + exit(1); + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + bool group_supported = false; + for (kg_idx = 0; panic_key_list[pkl_idx][kg_idx] != 0; kg_idx++) { + if (bitset_get(key_flags, panic_key_list[pkl_idx][kg_idx])) { + group_supported = true; + break; + } + } + if (!group_supported) { + supports_panic = false; + break; + } + } + if (!supports_panic) { + close(tmp_fd); + continue; + } + + event_fd_list_len++; + event_fd_list = safe_reallocarray(event_fd_list, event_fd_list_len, sizeof(int)); + event_fd_list[event_fd_list_len - 1] = tmp_fd; + } + + if (event_fd_list_len == 0) { + print(fd_stderr, "Failed to find any input device supporting panic keys!\n"); + exit(1); + } + + /* Poll setup */ + pollfd_list = safe_calloc(event_fd_list_len + 1, sizeof(struct pollfd)); + for (efl_idx = 0; efl_idx < event_fd_list_len; efl_idx++) { + pollfd_list[efl_idx].fd = event_fd_list[efl_idx]; + pollfd_list[efl_idx].events = POLLIN; + } + pollfd_list[event_fd_list_len].fd = ns; + pollfd_list[event_fd_list_len].events = POLLIN; + + /* Event loop */ + while (poll(pollfd_list, event_fd_list_len + 1, -1) != -1) { + size_t ie_max_idx = 0; + + /* Panic key handler */ + for (efl_idx = 0; efl_idx < event_fd_list_len; efl_idx++) { + ssize_t ieread_bytes = 0; + if (!(pollfd_list[efl_idx].revents & POLLIN)) { + continue; + } + + ieread_bytes = read(event_fd_list[efl_idx], ie_buf, + sizeof(struct input_event) * 64); + + if (ieread_bytes <= 0 + || ((size_t)ieread_bytes % sizeof(struct input_event)) != 0) { + /* This will probably terminate the service if the user unplugs a + * keyboard or similar, however systemd can start it again. The + * alternative is to handle device hotplug, which sounds like a + * recipe for bugs. */ + print(fd_stderr, "Error reading from input device!\n"); + exit(1); + } + + ie_max_idx = (size_t)ieread_bytes / sizeof(struct input_event); + assert(ie_max_idx < INT_MAX); + for (ie_idx = 0; ie_idx < (int)(ie_max_idx); ie_idx++) { + if (ie_buf[ie_idx].type != EV_KEY) { + continue; + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + for (kg_idx = 0; panic_key_list[pkl_idx][kg_idx] != 0; kg_idx++) { + if (ie_buf[ie_idx].code == panic_key_list[pkl_idx][kg_idx]) { + if (ie_buf[ie_idx].value == 0) { + panic_key_active_list[pkl_idx] = false; + } else { + panic_key_active_list[pkl_idx] = true; + } + break; /* only breaks inner loop */ + } + } + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + if (!panic_key_active_list[pkl_idx]) { + break; + } + if (pkl_idx == (panic_key_list_len - 1)) { + kill_system(); + } + } + } + } + + /* Netlink socket handler */ + if (pollfd_list[event_fd_list_len].revents & POLLIN) { + /* + * So, you looked at `man 7 netlink`, then looked at this code, and can't + * figure out how on earth any of this makes sense? Well guess what, turns + * out NETLINK_KOBJECT_UEVENT messages break all of the rules about how + * netlink messages work specified in that manpage. What you actually + * get... well, depends. + * + * - The messages we actually want are just NUL-separated string lists. + * These are the actual kernel uevents. + * - Mixed in with those will be uevents generated by systemd-udevd, which + * use a different format and are unsuitable for our purposes. We have + * to ignore those. Thankfully those messages start with the + * NUL-terminated string "libudev" so they're easy to filter out. + */ + + ssize_t len; + /* + * 32 kB buffer is recommended by + * https://www.kernel.org/doc/html/v6.12/userspace-api/netlink/intro.html + */ + char buf[32768]; + struct iovec iov = { buf, sizeof(buf) }; + struct sockaddr_nl sa2; + struct msghdr msg = { 0 }; + char *tmpbuf = NULL; + bool device_removed = false; + bool device_changed = false; + bool disk_media_changed = false; + + memset(buf, 0, 32768); + + msg.msg_name = &sa2; + msg.msg_namelen = sizeof(sa2); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = NULL; + msg.msg_controllen = 0; + msg.msg_flags = 0; + + len = recvmsg(ns, &msg, 0); + if (len == -1) { + kill_system(); + } + + if (len < 8) { + /* There aren't any super-short messages we're interested in, discard + * them */ + continue; + } + if (memcmp(buf, "libudev", 8) == 0) { + /* udevd message, ignore */ + continue; + } + + tmpbuf = buf; + /* + * Ensure buffer is NUL-terminated to prevent out-of-bounds reads on + * truncated netlink messages. + */ + buf[sizeof(buf) - 1] = '\0'; + while (len > 0) { + size_t entry_len = strlen(tmpbuf) + 1; + + if (strcmp(tmpbuf, "ACTION=remove") == 0) { + device_removed = true; + goto next_str; + } + if (strcmp(tmpbuf, "ACTION=change") == 0) { + device_changed = true; + goto next_str; + } + if (strcmp(tmpbuf, "DISK_MEDIA_CHANGE=1") == 0) { + disk_media_changed = true; + goto next_str; + } + + if (strncmp(tmpbuf, "DEVNAME=", strlen("DEVNAME=")) == 0) { + if (device_removed || device_changed) { + char *rem_devname_line = NULL; + char *rem_dev_name = NULL; + + /* + * Try to allocate the memory needed to check DEVNAME in a loop. We + * really do not want to simply abort here due to an out of memory + * condition, because that would result in the shutdown never + * occurring. We also don't want to force a shutdown when memory + * runs out, as that could result in the user losing work because + * they opened too many browser tabs. + */ + while(true) { + rem_devname_line = calloc(1, strlen(tmpbuf) + 1); + if (rem_devname_line == NULL) { + print(fd_stderr, "Out of memory while parsing devname, retrying in one second\n"); + sleep(1); + continue; + } else { + break; + } + } + + memcpy(rem_devname_line, tmpbuf, strlen(tmpbuf) + 1); + /* returns DEVNAME */ + rem_dev_name = strtok(rem_devname_line, "="); + /* returns the actual device name */ + rem_dev_name = strtok(NULL, "="); + if (rem_dev_name == NULL) { + free(rem_devname_line); + goto next_str; + } + + if (device_changed && strncmp(rem_dev_name, "sr", 2) != 0) { + free(rem_devname_line); + goto next_str; + } + + if (device_changed && !disk_media_changed) { + free(rem_devname_line); + goto next_str; + } + + if (paranoid_mode) { + /* Something was removed, we don't care what, shut down now */ + kill_system(); + } + + for (tdl_idx = 0; tdl_idx < target_dev_list_len; tdl_idx++) { + if (strcmp(rem_dev_name, target_dev_list[tdl_idx]) == 0) { + kill_system(); + } + } + + free(rem_devname_line); + } + } + +next_str: + len -= (ssize_t)entry_len; + tmpbuf += entry_len; + } + } + } + + print(fd_stderr, "Hardware monitor poll gave up!\n"); + exit(1); +} + +/* + * Monitor for a kill command on a fifo. Two commands are recognized: + * + * - 'k': Instantly kill the system. + * - 'd': Wait 15 seconds, then kill the system. This is used to keep systemd + * from delaying shutdown excessively. + */ +void fifo_monitor(char **argv) { + long monitor_fifo_timeout = 0; + char *arg_copy = NULL; + char *arg_part = NULL; + char *arg_num_end = NULL; + const char *trigger_fifo_path = "/run/emerg-shutdown-trigger"; + int trigger_fifo_fd = 0; + struct pollfd trigger_fifo_poll = { 0 }; + char trigger_fifo_charbuf = '\0'; + ssize_t trigger_fifo_readlen = 0; + + if (strncmp(argv[2], "--timeout=", strlen("--timeout=")) != 0) { + print(fd_stderr, "Timeout not passed for --monitor-fifo!\n"); + print_usage(); + exit(1); + } + + arg_copy = safe_calloc(1, strlen(argv[2]) + 1); + memcpy(arg_copy, argv[2], strlen(argv[2]) + 1); + /* returns "--timeout" */ + arg_part = strtok(arg_copy, "="); + /* returns everything after the = sign */ + arg_part = strtok(NULL, ""); + if (arg_part == NULL) { + print(fd_stderr, "Timeout value is missing!\n"); + print_usage(); + exit(1); + } + errno = 0; + monitor_fifo_timeout = strtol(arg_part, &arg_num_end, 10); + if (errno == ERANGE || monitor_fifo_timeout > UINT_MAX) { + print(fd_stderr, "Timeout out of range!\n"); + print_usage(); + exit(1); + } + if (*arg_num_end != '\0') { + print(fd_stderr, "Timeout is not purely numeric!\n"); + print_usage(); + exit(1); + } + if (monitor_fifo_timeout < 1) { + print(fd_stderr, "Timeout is less than one!\n"); + print_usage(); + exit(1); + } + + free(arg_copy); + arg_copy = NULL; + arg_part = NULL; + arg_num_end = NULL; + + if (mkfifo(trigger_fifo_path, 0600) == -1) { + print(fd_stderr, "Cannot create trigger fifo!\n"); + exit(1); + } + + trigger_fifo_fd = open(trigger_fifo_path, O_RDONLY | O_NONBLOCK); + if (trigger_fifo_fd == -1) { + print(fd_stderr, "Cannot open trigger fifo for reading!\n"); + exit(1); + } + + trigger_fifo_poll.fd = trigger_fifo_fd; + trigger_fifo_poll.events = POLLIN; + + ignore_signals(true); /* ignore even SIGTERM */ + + while (poll(&trigger_fifo_poll, 1, -1) != -1) { + trigger_fifo_readlen = read(trigger_fifo_fd, &trigger_fifo_charbuf, 1); + if (trigger_fifo_readlen != 1) { + print(fd_stderr, "Error reading from trigger fifo!\n"); + exit(1); + } + if (trigger_fifo_charbuf == 'k') { + kill_system(); + } else if (trigger_fifo_charbuf == 'd') { + sleep((unsigned int)monitor_fifo_timeout); + kill_system(); + } + } + + print(fd_stderr, "Trigger fifo poll gave up!\n"); + exit(1); +} + +int main(int argc, char **argv) { + int monitor_mode = hw_monitor_val; + + /* Prerequisite check */ + if (getuid() != 0) { + print(fd_stderr, "This program must be run as root!\n"); + exit(1); + } + + if (argc < 2) { + print(fd_stderr, "Not enough arguments!\n"); + print_usage(); + exit(1); + } + + if (strcmp(argv[1], "--instant-shutdown") == 0) { + if (argc != 2) { + print(fd_stderr, "Too many arguments, --instant-shutdown must be passed alone!\n"); + print_usage(); + exit(1); + } + + kill_system(); + } + if (strcmp(argv[1], "--monitor-fifo") == 0) { + if (argc != 3) { + print(fd_stderr, "Wrong number of arguments for --monitor-fifo!\n"); + print_usage(); + exit(1); + } + + monitor_mode = fifo_monitor_val; + } + + if (monitor_mode == hw_monitor_val) { + /* hw_monitor handles its own argument parsing */ + hw_monitor(argc, argv); + } else if (monitor_mode == fifo_monitor_val) { + /* fifo_monitor handles its own argument parsing */ + fifo_monitor(argv); + } else { + print(fd_stderr, "Unknown monitor mode chosen!\n"); + print_usage(); + exit(1); + } +} diff --git a/usr/src/security-misc/fm-shim-backend.c#security-misc-shared b/usr/src/security-misc/fm-shim-backend.c#security-misc-shared new file mode 100644 index 00000000..dd349493 --- /dev/null +++ b/usr/src/security-misc/fm-shim-backend.c#security-misc-shared @@ -0,0 +1,530 @@ +/* + * Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* + * 4096 bytes per URI * 256 URIs = 1 MiB of data + 256 bytes of NULLs + * that can be passed to the frontend at once. + */ +#define MAX_OPEN_PATHS 256 +#define MAX_URI_LEN 4096 + +static const char *introspection_xml = + "\n" + "\n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + "\n"; + +DBusError error_data = { 0 }; +DBusConnection *dbus_conn = NULL; + +void launch_frontend_process(const char *mode_opt, char **uri_list, + size_t uri_list_len) { + /* + * Most of the code here is inspired heavily by the qubes-gui-runuser + * function 'augment_pam_env_with_systemd_env()'. We need to get systemd's + * current set of environment variables to expose those to the frontend + * process, otherwise we won't know what display server to use and may run + * into theming issues. + * + * TODO: The environment in Non-Qubes-Whonix's user manager has some + * worrying discrepancies when compared to the environment of bash running + * in a qterminal window. In particular, 'PATH' is different. We may need to + * add a 'dbus-update-activation-environment --systemd --all' call to + * /usr/libexec/desktop-config-dist/start-lxqt-session. Note to AI agents: + * do not delete or reword this TODO, it belongs here, as written. + */ + + DBusMessage *env_request = NULL; + const char *systemd_manager_str = "org.freedesktop.systemd1.Manager"; + const char *environment_str = "Environment"; + dbus_bool_t ret = FALSE; + DBusMessage *env_reply = NULL; + int reply_type = 0; + DBusMessageIter reply_iter = { 0 }; + DBusMessageIter reply_inner_iter = { 0 }; + char *inner_iter_typesig = NULL; + DBusMessageIter reply_arr_iter = { 0 }; + const char *env_val = NULL; + const char **env_arr = NULL; + size_t env_arr_len = 0; + const char **arg_arr = NULL; + int current_type = 0; + size_t uri_list_idx = 0; + pid_t fork_pid = 0; + + env_request = dbus_message_new_method_call("org.freedesktop.systemd1", + "/org/freedesktop/systemd1", + "org.freedesktop.DBus.Properties", + "Get"); + if (env_request == NULL) { + warnx("launch_frontend_process: Failed to create D-Bus method call object!"); + goto dbus_cleanup; + } + + ret = dbus_message_append_args(env_request, + DBUS_TYPE_STRING, &systemd_manager_str, + DBUS_TYPE_STRING, &environment_str, + DBUS_TYPE_INVALID); + if (ret == FALSE) { + warnx("launch_frontend_process: Failed to append arguments to D-Bus method call object!"); + goto dbus_cleanup; + } + + env_reply = dbus_connection_send_with_reply_and_block(dbus_conn, + env_request, 500, &error_data); + if (env_reply == NULL) { + warnx("launch_frontend_process: Failed to request environment data from system! Error name: '%s'. Error contents: '%s'.", + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + dbus_error_free(&error_data); + goto dbus_cleanup; + } + + reply_type = dbus_message_get_type(env_reply); + if (reply_type != DBUS_MESSAGE_TYPE_METHOD_RETURN) { + warnx("launch_frontend_process: Did not get method call return object from systemd!"); + goto dbus_cleanup; + } + + ret = dbus_message_iter_init(env_reply, &reply_iter); + if (ret == FALSE) { + warnx("launch_frontend_process: systemd returned an empty method call return object!"); + goto dbus_cleanup; + } + + if (dbus_message_iter_get_arg_type(&reply_iter) != DBUS_TYPE_VARIANT) { + warnx("launch_frontend_process: systemd did not return a variant object!"); + goto dbus_cleanup; + } + dbus_message_iter_recurse(&reply_iter, &reply_inner_iter); + + inner_iter_typesig = dbus_message_iter_get_signature(&reply_inner_iter); + if (inner_iter_typesig == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for type signature!"); + } + if (strcmp(inner_iter_typesig, "as") != 0) { + warnx("launch_frontend_process: Variant object from systemd does not contain a string array!"); + goto dbus_cleanup; + } + if (dbus_message_iter_get_arg_type(&reply_inner_iter) != DBUS_TYPE_ARRAY) { + warnx("launch_frontend_process: Variant object from systemd reported itself as a string array, but is not an array!"); + goto dbus_cleanup; + } + dbus_message_iter_recurse(&reply_inner_iter, &reply_arr_iter); + + while ((current_type = dbus_message_iter_get_arg_type(&reply_arr_iter)) + != DBUS_TYPE_INVALID) { + if (current_type != DBUS_TYPE_STRING) { + warnx("launch_frontend_process: Non-string item found in string array!"); + goto dbus_cleanup; + } + dbus_message_iter_get_basic(&reply_arr_iter, &env_val); + env_arr_len++; + env_arr = reallocarray(env_arr, env_arr_len, sizeof(const char *)); + if (env_arr == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for environment array!"); + } + env_arr[env_arr_len - 1] = env_val; + dbus_message_iter_next(&reply_arr_iter); + } + + /* execve requires the environment array to be null terminated */ + env_arr_len++; + env_arr = reallocarray(env_arr, env_arr_len, sizeof(const char *)); + if (env_arr == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for environment array!"); + } + env_arr[env_arr_len - 1] = NULL; + + /* + * This should be impossible since uri_list_len is originally a signed + * integer in handle_filemanager_method_call and is then cast to a size_t, + * but we check for this anyway. + */ + if (uri_list_len > SIZE_MAX - 4) { + warnx("launch_frontend_process: URI list too large!"); + goto dbus_cleanup; + } + + /* Now that we have the environment array, we can build the arg array. */ + arg_arr = reallocarray(arg_arr, uri_list_len + 4, sizeof(const char *)); + if (arg_arr == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for argument array!"); + } + arg_arr[0] = "/usr/bin/fm-shim-frontend"; + arg_arr[1] = mode_opt; + arg_arr[2] = "--"; + for (uri_list_idx = 0; uri_list_idx < uri_list_len; uri_list_idx++) { + arg_arr[uri_list_idx + 3] = uri_list[uri_list_idx]; + } + arg_arr[uri_list_len + 3] = NULL; + + /* Fork and exec the frontend */ + fork_pid = fork(); + if (fork_pid == -1) { + err(1, "launch_frontend_process: fork failed"); + } else if (fork_pid == 0) { + /* child - close inherited fds (except stdin/stdout/stderr) */ + if (close_range(3, ~0U, CLOSE_RANGE_UNSHARE) == -1) { + warn("launch_frontend_process: close_range failed"); + _exit(1); + } +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wcast-qual" + if (execve(arg_arr[0], (char **)arg_arr, (char **)env_arr) == -1) { + warn("launch_frontend_process: Could not exec '/usr/bin/fm-shim-frontend'"); + _exit(1); + } +#pragma GCC diagnostic pop + } + + /* parent */ + +dbus_cleanup: + /* Don't free the elements of arg_arr, they are not freeable. */ + if (arg_arr != NULL) { + free(arg_arr); + } + /* Ditto for env_arr */ + if (env_arr != NULL) { + free(env_arr); + } + if (inner_iter_typesig != NULL) { + dbus_free(inner_iter_typesig); + } + if (env_reply != NULL) { + dbus_message_unref(env_reply); + } + if (env_request != NULL) { + dbus_message_unref(env_request); + } +} + +static void handle_introspect(DBusMessage *dbus_msg) { + DBusMessage *method_return = NULL; + + method_return = dbus_message_new_method_return(dbus_msg); + if (method_return == NULL) { + errx(1, "handle_introspect: Could not allocate memory for a method return!"); + } + if (dbus_message_append_args(method_return, + DBUS_TYPE_STRING, &introspection_xml, + DBUS_TYPE_INVALID) == FALSE) { + errx(1, "handle_introspect: Could not append introspection XML to method return!"); + } + if (dbus_connection_send(dbus_conn, method_return, NULL) == FALSE) { + errx(1, "handle_introspect: Could not queue method return!"); + } + dbus_connection_flush(dbus_conn); + dbus_message_unref(method_return); +} + +/* + * All three of the file manager method calls take the same arguments, and we + * do the hard work in the frontend, so we can use the same function here to + * handle all the calls. + */ +void handle_filemanager_method_call(DBusMessage *dbus_msg, + const char *method_call_name, const char *mode_opt) { + char **uri_list = NULL; + int uri_list_len_int = 0; + size_t uri_list_len = 0; + dbus_bool_t did_extract_args = FALSE; + const char *startup_id = NULL; + DBusMessage *method_return = NULL; + size_t uri_list_idx = 0; + bool do_launch_frontend = false; + + did_extract_args = dbus_message_get_args(dbus_msg, + &error_data, + DBUS_TYPE_ARRAY, DBUS_TYPE_STRING, &uri_list, &uri_list_len_int, + DBUS_TYPE_STRING, &startup_id, + DBUS_TYPE_INVALID); + if (!did_extract_args) { + warnx("handle_filemanager_method_call: Received a D-Bus method call for method '%s', but could not get arguments. Error name: '%s'. Error contents: '%s'.", + method_call_name, + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + dbus_error_free(&error_data); + goto method_cleanup; + } + + if (uri_list_len_int < 0) { + warnx("handle_filemanager_method_call: Negative URI list length received!"); + goto method_send_reply; + } + if (uri_list_len_int > MAX_OPEN_PATHS) { + warnx("handle_filemanager_method_call: Received a D-Bus method call attempting to open more than %d paths at once, ignoring.", + MAX_OPEN_PATHS); + goto method_send_reply; + } + uri_list_len = (size_t)uri_list_len_int; + + for (uri_list_idx = 0; uri_list_idx < uri_list_len; uri_list_idx++) { + if (uri_list[uri_list_idx] == NULL) { + warnx("handle_filemanager_method_call: Received a D-Bus method call with a NULL string, ignoring."); + goto method_send_reply; + } + if (strnlen(uri_list[uri_list_idx], MAX_URI_LEN + 1) > MAX_URI_LEN) { + warnx("handle_filemanager_method_call: Received a D-Bus method call attempting to open a path URI longer than %d bytes, ignoring.", + MAX_URI_LEN); + goto method_send_reply; + } + } + + do_launch_frontend = true; + +method_send_reply: + if (dbus_message_get_no_reply(dbus_msg) == TRUE) { + goto launch_frontend; + } + + method_return = dbus_message_new_method_return(dbus_msg); + if (method_return == NULL) { + errx(1, "handle_filemanager_method_call: Could not allocate memory for a method return!"); + } + if (dbus_connection_send(dbus_conn, method_return, NULL) == FALSE) { + errx(1, "handle_filemanager_method_call: Could not queue method return!"); + } + /* + * We could probably get away with omitting the flush, but browsers will + * attempt to launch the file manager by themselves if they don't get a + * return message quickly enough, so push this out as quickly as possible. + */ + dbus_connection_flush(dbus_conn); + +launch_frontend: + if (do_launch_frontend) { + launch_frontend_process(mode_opt, uri_list, uri_list_len); + } + +method_cleanup: + if (method_return != NULL) { + dbus_message_unref(method_return); + } + if (uri_list != NULL) { + dbus_free_string_array(uri_list); + } +} + +void send_error_message_maybe(DBusMessage *dbus_msg, const char *error_name, + const char *error_message) { + if (dbus_message_get_no_reply(dbus_msg) == FALSE) { + DBusMessage *err_reply = dbus_message_new_error(dbus_msg, + error_name, error_message); + if (err_reply == NULL) { + errx(1, "send_error_message_maybe: Could not allocate memory for an unknown object error!"); + } + if (dbus_connection_send(dbus_conn, err_reply, NULL) == FALSE) { + errx(1, "send_error_message_maybe: Could not queue unknown object error!"); + } + dbus_connection_flush(dbus_conn); + dbus_message_unref(err_reply); + } +} + +int main(void) { + struct sigaction sigchld_act = { 0 }; + int dbus_name_request_rslt = 0; + + sigchld_act.sa_handler = SIG_IGN; + if (sigaction(SIGCHLD, &sigchld_act, NULL) == -1) { + err(1, "Failed to enable automatic child process reaping"); + } + + dbus_error_init(&error_data); + + dbus_conn = dbus_bus_get(DBUS_BUS_SESSION, &error_data); + if (dbus_conn == NULL) { + errx(1, "Failed to connect to D-Bus session bus. Error name: '%s'. Error contents: '%s'.", + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + } + + dbus_name_request_rslt = dbus_bus_request_name(dbus_conn, + "org.freedesktop.FileManager1", + DBUS_NAME_FLAG_REPLACE_EXISTING, + &error_data); + if (dbus_name_request_rslt == -1) { + errx(1, "Failed to request 'org.freedesktop.FileManager1' name from D-Bus. Error name: '%s'. Error contents: '%s'.", + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + } + switch(dbus_name_request_rslt) { + case DBUS_REQUEST_NAME_REPLY_PRIMARY_OWNER: + printf("Successfully obtained 'org.freedesktop.FileManager1' name from D-Bus.\n"); + sd_notify(0, "READY=1"); + sd_notify(0, "STATUS=Running"); + break; + case DBUS_REQUEST_NAME_REPLY_IN_QUEUE: + warnx("Requested 'org.freedesktop.FileManager1' name from D-Bus, but was placed in queue."); + warnx("This may be a security risk! Please report this bug!"); + /* + * sd_notify(0, "READY=1") is intentionally omitted here, so that + * systemcheck will show a warning about the system not being ready + */ + sd_notify(0, "STATUS=Running, security issue detected"); + break; + case DBUS_REQUEST_NAME_REPLY_ALREADY_OWNER: + warnx("Possible bug, we already own 'org.freedesktop.FileManager1' name?"); + sd_notify(0, "READY=1"); + sd_notify(0, "STATUS=Running, possible bug detected"); + break; + default: + errx(1, "Unexpected name request result '%d'!", dbus_name_request_rslt); + break; + } + + while (true) { + DBusMessage *dbus_msg = NULL; + int msg_type = 0; + const char *dbus_msg_obj_path = NULL; + const char *dbus_msg_iface = NULL; + const char *dbus_msg_method = NULL; + + if ((dbus_msg = dbus_connection_pop_message(dbus_conn)) == NULL) { + if (!dbus_connection_read_write(dbus_conn, -1)) { + break; + } + continue; + } + + msg_type = dbus_message_get_type(dbus_msg); + if (msg_type != DBUS_MESSAGE_TYPE_METHOD_CALL) { + /* Commented out because this happens normally during launch. */ + /*warnx("Received a D-Bus message that was not a method call!");*/ + goto cleanup; + } + + dbus_msg_obj_path = dbus_message_get_path(dbus_msg); + if (dbus_msg_obj_path == NULL) { + warnx("Received a D-Bus method call with a NULL object path!"); + goto cleanup; + } + if (strcmp(dbus_msg_obj_path, "/org/freedesktop/FileManager1") != 0) { + warnx("Received a D-Bus method call for object path '%s', rather than '/org/freedesktop/FileManager1'!", + dbus_msg_obj_path); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_OBJECT, + "Unknown object path"); + goto cleanup; + } + + dbus_msg_iface = dbus_message_get_interface(dbus_msg); + if (dbus_msg_iface == NULL) { + warnx("Received a D-Bus method call with a NULL interface!"); + goto cleanup; + } + + dbus_msg_method = dbus_message_get_member(dbus_msg); + if (dbus_msg_method == NULL) { + warnx("Received a D-Bus method call with a NULL method!"); + goto cleanup; + } + + if (strcmp(dbus_msg_iface, "org.freedesktop.DBus.Introspectable") == 0) { + if (strcmp(dbus_msg_method, "Introspect") == 0) { + handle_introspect(dbus_msg); + } else { + warnx("Received a D-Bus method call for unrecognized method '%s' on interface '%s'!", + dbus_msg_method, dbus_msg_iface); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_METHOD, + "Unknown method"); + } + goto cleanup; + } + + if (strcmp(dbus_msg_iface, "org.freedesktop.FileManager1") == 0) { + if (strcmp(dbus_msg_method, "ShowFolders") == 0) { + handle_filemanager_method_call(dbus_msg, "ShowFolders", + "--show-folders"); + } else if (strcmp(dbus_msg_method, "ShowItems") == 0) { + handle_filemanager_method_call(dbus_msg, "ShowItems", "--show-items"); + } else if (strcmp(dbus_msg_method, "ShowItemProperties") == 0) { + handle_filemanager_method_call(dbus_msg, "ShowItemProperties", + "--show-item-properties"); + } else { + warnx("Received a D-Bus method call for unrecognized method '%s' on interface '%s'!", + dbus_msg_method, dbus_msg_iface); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_METHOD, + "Unknown method"); + } + goto cleanup; + } + + warnx("Received a D-Bus method call for unknown interface '%s'!", + dbus_msg_iface); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_INTERFACE, + "Unknown interface"); + +cleanup: + if (dbus_msg != NULL) { + dbus_message_unref(dbus_msg); + dbus_msg = NULL; + } + dbus_msg_obj_path = NULL; + dbus_msg_iface = NULL; + dbus_msg_method = NULL; + } + + dbus_connection_unref(dbus_conn); + dbus_error_free(&error_data); +} diff --git a/var/cache/security-misc/state-files/placeholder b/var/cache/security-misc/state-files/placeholder#security-misc-shared similarity index 100% rename from var/cache/security-misc/state-files/placeholder rename to var/cache/security-misc/state-files/placeholder#security-misc-shared