diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..1996d78e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,24 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows / pkg_install_dependabot_yml. +## Byte-identical across consumers; do not hand-edit. +## See agents/github-actions-consumer-templates.md. + +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 1 + commit-message: + prefix: "ci(deps)" + include: scope + groups: + github-actions: + patterns: + - "*" diff --git a/.github/dm-consumer.yml b/.github/dm-consumer.yml new file mode 100644 index 00000000..b61f2810 --- /dev/null +++ b/.github/dm-consumer.yml @@ -0,0 +1,44 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Per-repo parameter overrides. Read at workflow runtime by the +## reusable workflows in developer-meta-files. Top-level keys +## mirror the consumer-template basename without the +## 'consumer-' prefix. +## +## Spec: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +coverity: + ## scan.coverity.com project name (org-ai-assisted-owned; the "/" is + ## rejected in manual registration so the name is slash-free). + project-name: "org-ai-assisted-security-misc" + canonical-repos: "org-ai-assisted/security-misc" + +cppcheck: + paths: "usr/src/security-misc" + ## genmkfile names the C sources '*.c#security-misc-shared' + ## (cppcheck discovers files by extension; would otherwise miss + ## them). The codeql-prepare.sh script symlinks them to clean + ## '*.c' names. + prepare-command: "ci/codeql-prepare.sh" + +codeql-python: + ## Same prep as cppcheck: codeql-prepare.sh symlinks + ## '*.py#security-misc-shared' to clean '*.py' names so the + ## CodeQL python extractor discovers them. + prepare-command: "ci/codeql-prepare.sh" + +codeql-cpp: + ## codeql-prepare.sh handles both python and c-cpp source + ## symlinks; codeql-build.sh wraps the make invocation under + ## CodeQL's manual build-mode tracing. + prepare-command: "ci/codeql-prepare.sh" + build-command: "ci/codeql-build.sh" + +dist-ai-tests: + ## The ssh-audit config suite (security-misc-tests) stands up a + ## throwaway sshd and drives ssh-audit; python3-pytest is baseline. + apt-packages: "openssh-server openssh-client ssh-audit" diff --git a/.github/workflows/consumer-bandit.yml b/.github/workflows/consumer-bandit.yml new file mode 100644 index 00000000..ed41ac3f --- /dev/null +++ b/.github/workflows/consumer-bandit.yml @@ -0,0 +1,42 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-bandit.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Universal wrapper - no per-repo state required. The reusable +## does its own Python discovery (`.py` extension + shebang +## scan) so consumers don't need a `paths:` or `prepare-command` +## entry. Per-repo suppressions use bandit's `# nosec` inline +## comments. Install only in repos that contain Python (opt-in +## by file presence). +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-bandit.yml + +name: bandit + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + bandit: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-bandit.yml@master + permissions: + contents: read diff --git a/.github/workflows/consumer-codeql-actions.yml b/.github/workflows/consumer-codeql-actions.yml new file mode 100644 index 00000000..8391ed4b --- /dev/null +++ b/.github/workflows/consumer-codeql-actions.yml @@ -0,0 +1,48 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-actions.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Consumer wrapper for the 'actions' CodeQL language - workflow +## YAML security analysis (missing-permissions, script-injection, +## unversioned-immutable-actions, etc.). +## +## Cronless on purpose: byte-identical propagation forbids +## per-repo cron rewrites at propagation time. Push / PR / +## workflow_dispatch triggers cover the scan-on-change cases; +## rule-refresh re-scans can be kicked manually from the Actions +## tab. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml + +name: CodeQL Actions + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + actions: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master + with: + language: actions + permissions: + security-events: write + contents: read diff --git a/.github/workflows/consumer-codeql-cpp.yml b/.github/workflows/consumer-codeql-cpp.yml new file mode 100644 index 00000000..5855781d --- /dev/null +++ b/.github/workflows/consumer-codeql-cpp.yml @@ -0,0 +1,55 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-cpp.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Consumer wrapper for the 'c-cpp' CodeQL language. Cronless on +## purpose: byte-identical propagation forbids per-repo cron +## rewrites. Push / PR / workflow_dispatch triggers cover the +## scan-on-change cases. +## +## Required per-repo state in .github/dm-consumer.yml: +## +## codeql-cpp: +## build-command: "" # required +## prepare-command: "" # optional +## +## build-mode is hardcoded to 'manual' in the wrapper. The +## reusable hard-fails at workflow start if codeql-cpp.build-command +## is missing or empty. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml + +name: CodeQL c-cpp + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + c-cpp: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master + with: + language: c-cpp + build-mode: manual + dm-consumer-section: codeql-cpp + permissions: + security-events: write + contents: read diff --git a/.github/workflows/consumer-codeql-python.yml b/.github/workflows/consumer-codeql-python.yml new file mode 100644 index 00000000..9e038a3c --- /dev/null +++ b/.github/workflows/consumer-codeql-python.yml @@ -0,0 +1,61 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-python.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Consumer wrapper for the 'python' CodeQL language. Cronless +## on purpose (same rationale as consumer-codeql-actions.yml): +## byte-identical propagation forbids per-repo cron rewrites. +## Push / PR / workflow_dispatch triggers cover the +## scan-on-change cases. +## +## Also clears a flaky GHAS behavior: github-advanced-security +## speculatively creates a queued 'CodeQL' check-run when it +## detects Python in the repo. Without a workflow that submits +## Python SARIF, that check-run can stay queued forever and keep +## the PR's mergeable_state as 'unstable'. Installing this +## wrapper gives GHAS the Python analysis it expects. +## +## Install only in repos that contain Python (opt-in by file +## presence). Repos with no Python should not install this; the +## reusable would scan nothing and the GHAS speculative stub +## would not be created in the first place. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml + +name: CodeQL Python + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + python: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master + with: + language: python + ## Read .github/dm-consumer.yml `codeql-python:` section for + ## optional prepare-command (e.g. ci/codeql-prepare.sh for + ## genmkfile-tagged source-tree symlinks). Soft-skip if the + ## file or section is absent. + dm-consumer-section: codeql-python + permissions: + security-events: write + contents: read diff --git a/.github/workflows/consumer-coverity.yml b/.github/workflows/consumer-coverity.yml new file mode 100644 index 00000000..d5679b4f --- /dev/null +++ b/.github/workflows/consumer-coverity.yml @@ -0,0 +1,46 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-coverity.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Per-repo values are read by the reusable from +## .github/dm-consumer.yml at workflow runtime. Required keys: +## coverity.project-name, coverity.canonical-repos. Optional: +## coverity.apt-packages, coverity.build-command. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-coverity.yml + +name: Coverity + +on: + push: + tags: + - '*' + schedule: + - cron: '0 4 * * 5' + workflow_dispatch: + +permissions: + contents: read + +## Coverity singleton policy: G-A-006 in github-actions.md. +## Cancelling mid-flight wastes the daily free-tier slot. +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: false + +jobs: + coverity: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-coverity.yml@master + secrets: + COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }} + COVERITY_SCAN_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }} + permissions: + contents: read diff --git a/.github/workflows/consumer-cppcheck.yml b/.github/workflows/consumer-cppcheck.yml new file mode 100644 index 00000000..134945c4 --- /dev/null +++ b/.github/workflows/consumer-cppcheck.yml @@ -0,0 +1,39 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-cppcheck.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Per-repo values are read by the reusable from +## .github/dm-consumer.yml at workflow runtime. Required keys: +## cppcheck.paths. Optional: cppcheck.prepare-command. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-cppcheck.yml + +name: cppcheck + +on: + pull_request: + branches: [master] + push: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + cppcheck: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-cppcheck.yml@master + permissions: + contents: read diff --git a/.github/workflows/consumer-dist-ai-tests.yml b/.github/workflows/consumer-dist-ai-tests.yml new file mode 100644 index 00000000..f9894d7e --- /dev/null +++ b/.github/workflows/consumer-dist-ai-tests.yml @@ -0,0 +1,38 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-dist-ai-tests.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Runs this package's comprehensive dist-ai regression suites (which +## live in org-ai-assisted/dist-ai, not in-tree) on each PR and on push +## to master. The component is derived from the repo name by the +## reusable, so this wrapper carries no per-repo state. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-dist-ai-tests.yml + +name: dist-ai tests + +on: + pull_request: + branches: [master] + push: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + dist-ai-tests: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-dist-ai-tests.yml@master diff --git a/.github/workflows/local-dbus-fuzz.yml b/.github/workflows/local-dbus-fuzz.yml new file mode 100644 index 00000000..911720ba --- /dev/null +++ b/.github/workflows/local-dbus-fuzz.yml @@ -0,0 +1,93 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Coverage-guided D-Bus surface fuzzing for fm-shim-backend. +## +## fm-shim-backend implements org.freedesktop.FileManager1 on the +## session bus. dfuzzer (Debian-archive-shipped) walks every method +## / signal the service exposes and sends type-correct adversarial +## payloads. Catches the integration surface (D-Bus marshaling +## glue, sd_notify path, signal handlers, leaks across method +## calls) that an in-process libFuzzer harness on the parser alone +## would not catch. +## +## Trigger shape mirrors helper-scripts' local-python-fuzz.yml: +## workflow_dispatch + path-filtered pull_request. PRs that don't +## touch the shim backend, its compile script, the dfuzzer build / +## runner, or this workflow itself are skipped to keep cost bounded. +## +## Workflow body lives in ci/dfuzzer-run.sh (R-100); this file +## carries only the trigger schedule + apt install + invocation. + +name: dfuzzer (D-Bus) + +on: + workflow_dispatch: + inputs: + seconds: + description: 'Per-method dfuzzer time budget (seconds)' + required: false + default: '60' + pull_request: + branches: [master] + paths: + - 'usr/src/security-misc/fm-shim-backend.c#security-misc-shared' + - 'usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared' + - 'ci/dfuzzer-build.sh' + - 'ci/dfuzzer-run.sh' + - 'ci/codeql-prepare.sh' + - '.github/workflows/local-dbus-fuzz.yml' + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + dfuzzer: + name: dfuzzer (org.freedesktop.FileManager1) + runs-on: ubuntu-latest + timeout-minutes: 20 + + ## CI runs only where we enabled it; ANDed with the existing guard. + ## Unset variable -> skipped, no runner, run stays green. + if: >- + vars.CI_ENABLED_ORG_AI_ASSISTED == 'true' + && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') + + permissions: + contents: read + + env: + DFUZZER_SECONDS: ${{ inputs.seconds || '60' }} + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + ## install-deps composite action: apt deps for dfuzzer-build.sh + ## (build + runtime + fm-shim backend compile) plus genmkfile + + ## helper-scripts (org-standard install path; see + ## ci/dfuzzer-build.sh header for per-package rationale). + - name: Install apt deps + genmkfile + helper-scripts + uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master + with: + apt-packages: 'meson ninja-build xsltproc docbook-xsl libglib2.0-dev dbus dbus-x11 libdbus-1-dev libsystemd-dev pkg-config gcc' + + - name: Build dfuzzer from source + ## dfuzzer is not packaged for Ubuntu 24.04; build from + ## pinned upstream tag. See ci/dfuzzer-build.sh. + run: ci/dfuzzer-build.sh + + - name: Prepare extension-clean source paths + run: ci/codeql-prepare.sh + + - name: Run dfuzzer + run: ci/dfuzzer-run.sh diff --git a/.github/workflows/local-dist-ai-ssh-prod.yml b/.github/workflows/local-dist-ai-ssh-prod.yml new file mode 100644 index 00000000..901fd493 --- /dev/null +++ b/.github/workflows/local-dist-ai-ssh-prod.yml @@ -0,0 +1,41 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Hard-gating scan of the live production SSH servers (kicksecure.com, +## whonix.org) against security-misc's shipped ssh-audit server policy, via the +## dist-ai --e2e suite security-misc-tests-e2e (which lives in +## org-ai-assisted/dist-ai, not in-tree). This is NOT the managed +## consumer-dist-ai-tests.yml (--core) template. +## +## It runs on push to master, on a daily schedule, and on demand -- NOT on +## every pull request: a feature PR cannot change the production servers, so +## gating unrelated PRs on live external state would only wedge them. A failure +## here means a production server dropped (or never had) the security-misc SSH +## hardening; fix is on the host. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-dist-ai-tests.yml + +name: dist-ai ssh prod + +on: + push: + branches: [master] + schedule: + - cron: '17 6 * * *' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + dist-ai-ssh-prod: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-dist-ai-tests.yml@master + with: + categories: '--e2e' diff --git a/.github/workflows/local-permission-hardener-test.yml b/.github/workflows/local-permission-hardener-test.yml new file mode 100644 index 00000000..e1d7e320 --- /dev/null +++ b/.github/workflows/local-permission-hardener-test.yml @@ -0,0 +1,64 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Regression test for the permission-hardener config parser. +## +## Scope is intentionally narrow: it exercises load_state()'s +## right-anchored option parsing so a config filename containing a +## space is parsed as one entry instead of being split and silently +## dropped. See ci/tests/permission_hardener/test_whitespace_filename.sh. + +## FIXME: The actual scripts run here should be in dist-ai. + +## WARNING: The new test scripts will not be reviewed by humans as they are +## slated to be moved to dist-ai. This workflow file has been reviewed. + +name: Test permission-hardener + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + test: + name: Test permission-hardener + runs-on: ubuntu-latest + timeout-minutes: 10 + + ## CI runs only where we enabled it; ANDed with the existing guard. + ## Unset variable -> skipped, no runner, run stays green. + if: >- + vars.CI_ENABLED_ORG_AI_ASSISTED == 'true' + && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + ## permission-hardener sources helper-scripts (log_run_die.sh, + ## safe_echo.sh, strings.bsh) at startup; install-deps provides + ## them under /usr/libexec/helper-scripts/. + - name: Install genmkfile + helper-scripts + safe-rm + uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master + with: + apt-packages: 'safe-rm' + + - name: Whitespace-in-filename parser regression test + ## Root: the test writes a temp config under + ## /etc/permission-hardener.d/ and runs 'print-policy'. + run: sudo -E ci/tests/permission_hardener/test_whitespace_filename.sh diff --git a/.github/workflows/local-python-lint.yml b/.github/workflows/local-python-lint.yml new file mode 100644 index 00000000..6ef773d2 --- /dev/null +++ b/.github/workflows/local-python-lint.yml @@ -0,0 +1,107 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Simple Python lint for fm_shim_frontend. +## +## Scope is intentionally narrow: +## - usr/lib/python3/dist-packages/fm_shim_frontend/ (the only +## Python in this repo) +## +## Tools: +## flake8 --select=F Pyflakes-class checks only (F-codes: +## undefined names, unused imports, unused +## local variables, etc.). Skips PEP8 style +## (E/W codes) - the codebase uses '##' block +## comments which would trigger E266 noise. +## flake8 over plain pyflakes because pyflakes +## does not honor '# noqa' (the standard +## escape-hatch for intentional violations); +## flake8 wraps pyflakes and adds that +## support. Pylint was deliberately not +## enabled here because pylint's interaction +## with PyQt5 produces a flood of +## 'no-name-in-module' false positives (PyQt5 +## generates its symbols dynamically; pylint +## cannot see them statically without a +## per-symbol --extension-pkg-allow-list that +## defeats the simplicity of this workflow). +## +## Source files in this repo carry a '#' suffix per +## the genmkfile convention. pyflakes discovers sources by file +## extension; ci/codeql-prepare.sh creates extension-clean symlinks +## that re-use that fix. + +name: Lint Python + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + lint: + name: Lint Python + runs-on: ubuntu-latest + timeout-minutes: 10 + + ## CI runs only where we enabled it; ANDed with the existing guard. + ## Unset variable -> skipped, no runner, run stays green. + if: >- + vars.CI_ENABLED_ORG_AI_ASSISTED == 'true' + && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + ## install-deps composite action installs apt deps + genmkfile + ## + helper-scripts. helper-scripts provides the stdisplay + ## Python module that fm_shim_frontend imports at module top + ## level; with the real package present we run the tests + ## against production modules instead of conftest.py stubs. + ## + ## python3-pyqt5 + python3-pyqt5.sip: runtime deps of + ## fm_shim_frontend's Qt UI; flake8 / python3-pytest / + ## python3-hypothesis: the lint + property-test toolchain. + - name: Install apt deps + genmkfile + helper-scripts + uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master + with: + apt-packages: 'flake8 python3-pytest python3-hypothesis python3-pyqt5 python3-pyqt5.sip' + + - name: Prepare extension-clean Python source paths + run: ci/codeql-prepare.sh + + - name: flake8 (pyflakes checks only) + ## Pass the symlinked clean-name files explicitly. Without + ## the explicit list, flake8 walks the directory and would + ## see each source twice (once via the symlink, once via + ## the original '*.py#tag') - causing duplicate findings. + run: | + flake8 --select=F -- \ + usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py \ + usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py + + - name: Hypothesis property tests + ## Coverage-based property fuzzing of the URI-validation + ## chokepoint (get_path_list_from_uris). Already caught one + ## real ENAMETOOLONG-on-long-path crash bug at introduction + ## (see ci/tests/fm_shim_frontend/test_property.py header). + env: + PYTHONPATH: usr/lib/python3/dist-packages + run: | + python3 -m pytest --import-mode=importlib -q \ + ci/tests/fm_shim_frontend/test_property.py diff --git a/.gitignore b/.gitignore index ef58a2f7..fb2e7236 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ pkgs +**/__pycache__/ diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 00000000..81bfc6b8 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,26 @@ +# Agent Guidelines for security-misc + +## General Guidelines + +- Check `./agents/` for component-specific notes before reviewing or commenting. +- Upstream repository: Kicksecure/security-misc +- No need to mention accepted/fixed/done things unless there is a specific + reason why it is needed in memory. + +## Component Notes + +- [fm-shim](./agents/fm-shim.md) - FileManager1 D-Bus shim (backend + frontend) +- [fuzzing](./agents/fuzzing.md) - Hypothesis property tests under + `ci/tests//`; ClusterFuzzLite / libFuzzer not yet wired up. + +## pkg-config quoting in build script + +`pkg-config` output is designed to be word-split by shells. Quoting it via bash +arrays just reimplements word splitting manually. The unquoted +`$(pkg-config ...)` is intentional. Upstream has a NOTE comment explaining this. +Do not re-propose this change. + +## Accepted Threat Model + +- systemd user manager environment is trusted. +- Python >= 3.13.5 required. diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 00000000..a263c705 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,3 @@ +# CLAUDE.md + +See [AGENTS.md](AGENTS.md). diff --git a/COPYING b/COPYING index 513503af..829d9096 100644 --- a/COPYING +++ b/COPYING @@ -1,73 +1,668 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Files: * -Copyright: 2012 - 2019 ENCRYPTED SUPPORT LP -License: GPL-3+-with-additional-terms-1 - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - . - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - . - You should have received a copy of the GNU General Public License - along with this program. If not, see . - . - On Debian systems, the full text of the GNU General Public - License version 3 can be found in the file - `/usr/share/common-licenses/GPL-3'. - . - ADDITIONAL TERMS APPLICABLE per GNU GPL version 3 section 7 - . - 1. Replacement of Section 15. Section 15 of the GPL shall be deleted in its - entirety and replaced with the following: - . - 15. Disclaimer of Warranty. - . - THE PROGRAM IS PROVIDED WITHOUT ANY WARRANTIES, WHETHER EXPRESSED OR IMPLIED, - INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR - PURPOSE, NON-INFRINGEMENT, TITLE AND MERCHANTABILITY. THE PROGRAM IS BEING - DELIVERED OR MADE AVAILABLE 'AS IS', 'WITH ALL FAULTS' AND WITHOUT WARRANTY OR - REPRESENTATION. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE - PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC +License: AGPL-3+ + +License: AGPL-3+ + GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 + . + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + . + Preamble + . + The GNU Affero General Public License is a free, copyleft license for + software and other kinds of works, specifically designed to ensure + cooperation with the community in the case of network server software. + . + The licenses for most software and other practical works are designed + to take away your freedom to share and change the works. By contrast, + our General Public Licenses are intended to guarantee your freedom to + share and change all versions of a program--to make sure it remains free + software for all its users. + . + When we speak of free software, we are referring to freedom, not + price. Our General Public Licenses are designed to make sure that you + have the freedom to distribute copies of free software (and charge for + them if you wish), that you receive source code or can get it if you + want it, that you can change the software or use pieces of it in new + free programs, and that you know you can do these things. + . + Developers that use our General Public Licenses protect your rights + with two steps: (1) assert copyright on the software, and (2) offer + you this License which gives you legal permission to copy, distribute + and/or modify the software. + . + A secondary benefit of defending all users' freedom is that + improvements made in alternate versions of the program, if they + receive widespread use, become available for other developers to + incorporate. Many developers of free software are heartened and + encouraged by the resulting cooperation. However, in the case of + software used on network servers, this result may fail to come about. + The GNU General Public License permits making a modified version and + letting the public access it on a server without ever releasing its + source code to the public. + . + The GNU Affero General Public License is designed specifically to + ensure that, in such cases, the modified source code becomes available + to the community. It requires the operator of a network server to + provide the source code of the modified version running there to the + users of that server. Therefore, public use of a modified version, on + a publicly accessible server, gives the public access to the source + code of the modified version. + . + An older license, called the Affero General Public License and + published by Affero, was designed to accomplish similar goals. This is + a different license, not a version of the Affero GPL, but Affero has + released a new version of the Affero GPL which permits relicensing under + this license. + . + The precise terms and conditions for copying, distribution and + modification follow. + . + TERMS AND CONDITIONS + . + 0. Definitions. + . + "This License" refers to version 3 of the GNU Affero General Public License. + . + "Copyright" also means copyright-like laws that apply to other kinds of + works, such as semiconductor masks. + . + "The Program" refers to any copyrightable work licensed under this + License. Each licensee is addressed as "you". "Licensees" and + "recipients" may be individuals or organizations. + . + To "modify" a work means to copy from or adapt all or part of the work + in a fashion requiring copyright permission, other than the making of an + exact copy. The resulting work is called a "modified version" of the + earlier work or a work "based on" the earlier work. + . + A "covered work" means either the unmodified Program or a work based + on the Program. + . + To "propagate" a work means to do anything with it that, without + permission, would make you directly or secondarily liable for + infringement under applicable copyright law, except executing it on a + computer or modifying a private copy. Propagation includes copying, + distribution (with or without modification), making available to the + public, and in some countries other activities as well. + . + To "convey" a work means any kind of propagation that enables other + parties to make or receive copies. Mere interaction with a user through + a computer network, with no transfer of a copy, is not conveying. + . + An interactive user interface displays "Appropriate Legal Notices" + to the extent that it includes a convenient and prominently visible + feature that (1) displays an appropriate copyright notice, and (2) + tells the user that there is no warranty for the work (except to the + extent that warranties are provided), that licensees may convey the + work under this License, and how to view a copy of this License. If + the interface presents a list of user commands or options, such as a + menu, a prominent item in the list meets this criterion. + . + 1. Source Code. + . + The "source code" for a work means the preferred form of the work + for making modifications to it. "Object code" means any non-source + form of a work. + . + A "Standard Interface" means an interface that either is an official + standard defined by a recognized standards body, or, in the case of + interfaces specified for a particular programming language, one that + is widely used among developers working in that language. + . + The "System Libraries" of an executable work include anything, other + than the work as a whole, that (a) is included in the normal form of + packaging a Major Component, but which is not part of that Major + Component, and (b) serves only to enable use of the work with that + Major Component, or to implement a Standard Interface for which an + implementation is available to the public in source code form. A + "Major Component", in this context, means a major essential component + (kernel, window system, and so on) of the specific operating system + (if any) on which the executable work runs, or a compiler used to + produce the work, or an object code interpreter used to run it. + . + The "Corresponding Source" for a work in object code form means all + the source code needed to generate, install, and (for an executable + work) run the object code and to modify the work, including scripts to + control those activities. However, it does not include the work's + System Libraries, or general-purpose tools or generally available free + programs which are used unmodified in performing those activities but + which are not part of the work. For example, Corresponding Source + includes interface definition files associated with source files for + the work, and the source code for shared libraries and dynamically + linked subprograms that the work is specifically designed to require, + such as by intimate data communication or control flow between those + subprograms and other parts of the work. + . + The Corresponding Source need not include anything that users + can regenerate automatically from other parts of the Corresponding + Source. + . + The Corresponding Source for a work in source code form is that + same work. + . + 2. Basic Permissions. + . + All rights granted under this License are granted for the term of + copyright on the Program, and are irrevocable provided the stated + conditions are met. This License explicitly affirms your unlimited + permission to run the unmodified Program. The output from running a + covered work is covered by this License only if the output, given its + content, constitutes a covered work. This License acknowledges your + rights of fair use or other equivalent, as provided by copyright law. + . + You may make, run and propagate covered works that you do not + convey, without conditions so long as your license otherwise remains + in force. You may convey covered works to others for the sole purpose + of having them make modifications exclusively for you, or provide you + with facilities for running those works, provided that you comply with + the terms of this License in conveying all material for which you do + not control copyright. Those thus making or running the covered works + for you must do so exclusively on your behalf, under your direction + and control, on terms that prohibit them from making any copies of + your copyrighted material outside their relationship with you. + . + Conveying under any other circumstances is permitted solely under + the conditions stated below. Sublicensing is not allowed; section 10 + makes it unnecessary. + . + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + . + No covered work shall be deemed part of an effective technological + measure under any applicable law fulfilling obligations under article + 11 of the WIPO copyright treaty adopted on 20 December 1996, or + similar laws prohibiting or restricting circumvention of such + measures. + . + When you convey a covered work, you waive any legal power to forbid + circumvention of technological measures to the extent such circumvention + is effected by exercising rights under this License with respect to + the covered work, and you disclaim any intention to limit operation or + modification of the work as a means of enforcing, against the work's + users, your or third parties' legal rights to forbid circumvention of + technological measures. + . + 4. Conveying Verbatim Copies. + . + You may convey verbatim copies of the Program's source code as you + receive it, in any medium, provided that you conspicuously and + appropriately publish on each copy an appropriate copyright notice; + keep intact all notices stating that this License and any + non-permissive terms added in accord with section 7 apply to the code; + keep intact all notices of the absence of any warranty; and give all + recipients a copy of this License along with the Program. + . + You may charge any price or no price for each copy that you convey, + and you may offer support or warranty protection for a fee. + . + 5. Conveying Modified Source Versions. + . + You may convey a work based on the Program, or the modifications to + produce it from the Program, in the form of source code under the + terms of section 4, provided that you also meet all of these conditions: + . + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + . + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + . + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + . + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + . + A compilation of a covered work with other separate and independent + works, which are not by their nature extensions of the covered work, + and which are not combined with it such as to form a larger program, + in or on a volume of a storage or distribution medium, is called an + "aggregate" if the compilation and its resulting copyright are not + used to limit the access or legal rights of the compilation's users + beyond what the individual works permit. Inclusion of a covered work + in an aggregate does not cause this License to apply to the other + parts of the aggregate. + . + 6. Conveying Non-Source Forms. + . + You may convey a covered work in object code form under the terms + of sections 4 and 5, provided that you also convey the + machine-readable Corresponding Source under the terms of this License, + in one of these ways: + . + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + . + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + . + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + . + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + . + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + . + A separable portion of the object code, whose source code is excluded + from the Corresponding Source as a System Library, need not be + included in conveying the object code work. + . + A "User Product" is either (1) a "consumer product", which means any + tangible personal property which is normally used for personal, family, + or household purposes, or (2) anything designed or sold for incorporation + into a dwelling. In determining whether a product is a consumer product, + doubtful cases shall be resolved in favor of coverage. For a particular + product received by a particular user, "normally used" refers to a + typical or common use of that class of product, regardless of the status + of the particular user or of the way in which the particular user + actually uses, or expects or is expected to use, the product. A product + is a consumer product regardless of whether the product has substantial + commercial, industrial or non-consumer uses, unless such uses represent + the only significant mode of use of the product. + . + "Installation Information" for a User Product means any methods, + procedures, authorization keys, or other information required to install + and execute modified versions of a covered work in that User Product from + a modified version of its Corresponding Source. The information must + suffice to ensure that the continued functioning of the modified object + code is in no case prevented or interfered with solely because + modification has been made. + . + If you convey an object code work under this section in, or with, or + specifically for use in, a User Product, and the conveying occurs as + part of a transaction in which the right of possession and use of the + User Product is transferred to the recipient in perpetuity or for a + fixed term (regardless of how the transaction is characterized), the + Corresponding Source conveyed under this section must be accompanied + by the Installation Information. But this requirement does not apply + if neither you nor any third party retains the ability to install + modified object code on the User Product (for example, the work has + been installed in ROM). + . + The requirement to provide Installation Information does not include a + requirement to continue to provide support service, warranty, or updates + for a work that has been modified or installed by the recipient, or for + the User Product in which it has been modified or installed. Access to a + network may be denied when the modification itself materially and + adversely affects the operation of the network or violates the rules and + protocols for communication across the network. + . + Corresponding Source conveyed, and Installation Information provided, + in accord with this section must be in a format that is publicly + documented (and with an implementation available to the public in + source code form), and must require no special password or key for + unpacking, reading or copying. + . + 7. Additional Terms. + . + "Additional permissions" are terms that supplement the terms of this + License by making exceptions from one or more of its conditions. + Additional permissions that are applicable to the entire Program shall + be treated as though they were included in this License, to the extent + that they are valid under applicable law. If additional permissions + apply only to part of the Program, that part may be used separately + under those permissions, but the entire Program remains governed by + this License without regard to the additional permissions. + . + When you convey a copy of a covered work, you may at your option + remove any additional permissions from that copy, or from any part of + it. (Additional permissions may be written to require their own + removal in certain cases when you modify the work.) You may place + additional permissions on material, added by you to a covered work, + for which you have or can give appropriate copyright permission. + . + Notwithstanding any other provision of this License, for material you + add to a covered work, you may (if authorized by the copyright holders of + that material) supplement the terms of this License with terms: + . + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + . + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + . + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + . + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + . + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + . + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + . + All other non-permissive additional terms are considered "further + restrictions" within the meaning of section 10. If the Program as you + received it, or any part of it, contains a notice stating that it is + governed by this License along with a term that is a further + restriction, you may remove that term. If a license document contains + a further restriction but permits relicensing or conveying under this + License, you may add to a covered work material governed by the terms + of that license document, provided that the further restriction does + not survive such relicensing or conveying. + . + If you add terms to a covered work in accord with this section, you + must place, in the relevant source files, a statement of the + additional terms that apply to those files, or a notice indicating + where to find the applicable terms. + . + Additional terms, permissive or non-permissive, may be stated in the + form of a separately written license, or stated as exceptions; + the above requirements apply either way. + . + 8. Termination. + . + You may not propagate or modify a covered work except as expressly + provided under this License. Any attempt otherwise to propagate or + modify it is void, and will automatically terminate your rights under + this License (including any patent licenses granted under the third + paragraph of section 11). + . + However, if you cease all violation of this License, then your + license from a particular copyright holder is reinstated (a) + provisionally, unless and until the copyright holder explicitly and + finally terminates your license, and (b) permanently, if the copyright + holder fails to notify you of the violation by some reasonable means + prior to 60 days after the cessation. + . + Moreover, your license from a particular copyright holder is + reinstated permanently if the copyright holder notifies you of the + violation by some reasonable means, this is the first time you have + received notice of violation of this License (for any work) from that + copyright holder, and you cure the violation prior to 30 days after + your receipt of the notice. + . + Termination of your rights under this section does not terminate the + licenses of parties who have received copies or rights from you under + this License. If your rights have been terminated and not permanently + reinstated, you do not qualify to receive new licenses for the same + material under section 10. + . + 9. Acceptance Not Required for Having Copies. + . + You are not required to accept this License in order to receive or + run a copy of the Program. Ancillary propagation of a covered work + occurring solely as a consequence of using peer-to-peer transmission + to receive a copy likewise does not require acceptance. However, + nothing other than this License grants you permission to propagate or + modify any covered work. These actions infringe copyright if you do + not accept this License. Therefore, by modifying or propagating a + covered work, you indicate your acceptance of this License to do so. + . + 10. Automatic Licensing of Downstream Recipients. + . + Each time you convey a covered work, the recipient automatically + receives a license from the original licensors, to run, modify and + propagate that work, subject to this License. You are not responsible + for enforcing compliance by third parties with this License. + . + An "entity transaction" is a transaction transferring control of an + organization, or substantially all assets of one, or subdividing an + organization, or merging organizations. If propagation of a covered + work results from an entity transaction, each party to that + transaction who receives a copy of the work also receives whatever + licenses to the work the party's predecessor in interest had or could + give under the previous paragraph, plus a right to possession of the + Corresponding Source of the work from the predecessor in interest, if + the predecessor has it or can get it with reasonable efforts. + . + You may not impose any further restrictions on the exercise of the + rights granted or affirmed under this License. For example, you may + not impose a license fee, royalty, or other charge for exercise of + rights granted under this License, and you may not initiate litigation + (including a cross-claim or counterclaim in a lawsuit) alleging that + any patent claim is infringed by making, using, selling, offering for + sale, or importing the Program or any portion of it. + . + 11. Patents. + . + A "contributor" is a copyright holder who authorizes use under this + License of the Program or a work on which the Program is based. The + work thus licensed is called the contributor's "contributor version". + . + A contributor's "essential patent claims" are all patent claims + owned or controlled by the contributor, whether already acquired or + hereafter acquired, that would be infringed by some manner, permitted + by this License, of making, using, or selling its contributor version, + but do not include claims that would be infringed only as a + consequence of further modification of the contributor version. For + purposes of this definition, "control" includes the right to grant + patent sublicenses in a manner consistent with the requirements of + this License. + . + Each contributor grants you a non-exclusive, worldwide, royalty-free + patent license under the contributor's essential patent claims, to + make, use, sell, offer for sale, import and otherwise run, modify and + propagate the contents of its contributor version. + . + In the following three paragraphs, a "patent license" is any express + agreement or commitment, however denominated, not to enforce a patent + (such as an express permission to practice a patent or covenant not to + sue for patent infringement). To "grant" such a patent license to a + party means to make such an agreement or commitment not to enforce a + patent against the party. + . + If you convey a covered work, knowingly relying on a patent license, + and the Corresponding Source of the work is not available for anyone + to copy, free of charge and under the terms of this License, through a + publicly available network server or other readily accessible means, + then you must either (1) cause the Corresponding Source to be so + available, or (2) arrange to deprive yourself of the benefit of the + patent license for this particular work, or (3) arrange, in a manner + consistent with the requirements of this License, to extend the patent + license to downstream recipients. "Knowingly relying" means you have + actual knowledge that, but for the patent license, your conveying the + covered work in a country, or your recipient's use of the covered work + in a country, would infringe one or more identifiable patents in that + country that you have reason to believe are valid. + . + If, pursuant to or in connection with a single transaction or + arrangement, you convey, or propagate by procuring conveyance of, a + covered work, and grant a patent license to some of the parties + receiving the covered work authorizing them to use, propagate, modify + or convey a specific copy of the covered work, then the patent license + you grant is automatically extended to all recipients of the covered + work and works based on it. + . + A patent license is "discriminatory" if it does not include within + the scope of its coverage, prohibits the exercise of, or is + conditioned on the non-exercise of one or more of the rights that are + specifically granted under this License. You may not convey a covered + work if you are a party to an arrangement with a third party that is + in the business of distributing software, under which you make payment + to the third party based on the extent of your activity of conveying + the work, and under which the third party grants, to any of the + parties who would receive the covered work from you, a discriminatory + patent license (a) in connection with copies of the covered work + conveyed by you (or copies made from those copies), or (b) primarily + for and in connection with specific products or compilations that + contain the covered work, unless you entered into that arrangement, + or that patent license was granted, prior to 28 March 2007. + . + Nothing in this License shall be construed as excluding or limiting + any implied license or other defenses to infringement that may + otherwise be available to you under applicable patent law. + . + 12. No Surrender of Others' Freedom. + . + If conditions are imposed on you (whether by court order, agreement or + otherwise) that contradict the conditions of this License, they do not + excuse you from the conditions of this License. If you cannot convey a + covered work so as to satisfy simultaneously your obligations under this + License and any other pertinent obligations, then as a consequence you may + not convey it at all. For example, if you agree to terms that obligate you + to collect a royalty for further conveying from those to whom you convey + the Program, the only way you could satisfy both those terms and this + License would be to refrain entirely from conveying the Program. + . + 13. Remote Network Interaction; Use with the GNU General Public License. + . + Notwithstanding any other provision of this License, if you modify the + Program, your modified version must prominently offer all users + interacting with it remotely through a computer network (if your version + supports such interaction) an opportunity to receive the Corresponding + Source of your version by providing access to the Corresponding Source + from a network server at no charge, through some standard or customary + means of facilitating copying of software. This Corresponding Source + shall include the Corresponding Source for any work covered by version 3 + of the GNU General Public License that is incorporated pursuant to the + following paragraph. + . + Notwithstanding any other provision of this License, you have + permission to link or combine any covered work with a work licensed + under version 3 of the GNU General Public License into a single + combined work, and to convey the resulting work. The terms of this + License will continue to apply to the part which is the covered work, + but the work with which it is combined will remain governed by version + 3 of the GNU General Public License. + . + 14. Revised Versions of this License. + . + The Free Software Foundation may publish revised and/or new versions of + the GNU Affero General Public License from time to time. Such new versions + will be similar in spirit to the present version, but may differ in detail to + address new problems or concerns. + . + Each version is given a distinguishing version number. If the + Program specifies that a certain numbered version of the GNU Affero General + Public License "or any later version" applies to it, you have the + option of following the terms and conditions either of that numbered + version or of any later version published by the Free Software + Foundation. If the Program does not specify a version number of the + GNU Affero General Public License, you may choose any version ever published + by the Free Software Foundation. + . + If the Program specifies that a proxy can decide which future + versions of the GNU Affero General Public License can be used, that proxy's + public statement of acceptance of a version permanently authorizes you + to choose that version for the Program. + . + Later license versions may give you additional or different + permissions. However, no additional obligations are imposed on any + author or copyright holder as a result of your choosing to follow a + later version. + . + 15. Disclaimer of Warranty. + . + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY + APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT + HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY + OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, + THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM + IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. . - 2. Replacement of Section 16. Section 16 of the GPL shall be deleted in its - entirety and replaced with the following: - . - 16. LIMITATION OF LIABILITY. - . - UNDER NO CIRCUMSTANCES SHALL ANY COPYRIGHT HOLDER OR ITS AFFILIATES, OR ANY - OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE - LIABLE TO YOU, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, FOR ANY - DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, DIRECT, INDIRECT, SPECIAL, - INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES ARISING FROM, OUT OF OR IN - CONNECTION WITH THE USE OR INABILITY TO USE THE PROGRAM OR OTHER DEALINGS WITH - THE PROGRAM(INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED - INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE - PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), WHETHER OR NOT ANY COPYRIGHT HOLDER - OR SUCH OTHER PARTY RECEIVES NOTICE OF ANY SUCH DAMAGES AND WHETHER OR NOT SUCH - DAMAGES COULD HAVE BEEN FORESEEN. - . - 3. LEGAL NOTICES; NO TRADEMARK LICENSE; ORIGIN. You must reproduce faithfully - all trademark, copyright and other proprietary and legal notices on any copies - of the Program or any other required author attributions. This license does not - grant you rights to use any copyright holder or any other party's name, logo, or - trademarks. Neither the name of the copyright holder or its affiliates, or any - other party who modifies and/or conveys the Program may be used to endorse or - promote products derived from this software without specific prior written - permission. The origin of the Program must not be misrepresented; you must not - claim that you wrote the original Program. Altered source versions must be - plainly marked as such, and must not be misrepresented as being the original - Program. - . - 4. INDEMNIFICATION. IF YOU CONVEY A COVERED WORK AND AGREE WITH ANY RECIPIENT - OF THAT COVERED WORK THAT YOU WILL ASSUME ANY LIABILITY FOR THAT COVERED WORK, - YOU HEREBY AGREE TO INDEMNIFY, DEFEND AND HOLD HARMLESS THE OTHER LICENSORS AND - AUTHORS OF THAT COVERED WORK FOR ANY DAMAGES, DEMANDS, CLAIMS, LOSSES, CAUSES OF - ACTION, LAWSUITS, JUDGMENTS EXPENSES (INCLUDING WITHOUT LIMITATION REASONABLE - ATTORNEYS' FEES AND EXPENSES) OR ANY OTHER LIABILITY ARISING FROM, RELATED TO OR - IN CONNECTION WITH YOUR ASSUMPTIONS OF LIABILITY. + 16. Limitation of Liability. + . + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING + WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS + THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY + GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE + USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF + DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD + PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), + EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF + SUCH DAMAGES. + . + 17. Interpretation of Sections 15 and 16. + . + If the disclaimer of warranty and limitation of liability provided + above cannot be given local legal effect according to their terms, + reviewing courts shall apply local law that most closely approximates + an absolute waiver of all civil liability in connection with the + Program, unless a warranty or assumption of liability accompanies a + copy of the Program in return for a fee. + . + END OF TERMS AND CONDITIONS + . + How to Apply These Terms to Your New Programs + . + If you develop a new program, and you want it to be of the greatest + possible use to the public, the best way to achieve this is to make it + free software which everyone can redistribute and change under these terms. + . + To do so, attach the following notices to the program. It is safest + to attach them to the start of each source file to most effectively + state the exclusion of warranty; and each file should have at least + the "copyright" line and a pointer to where the full notice is found. + . + + Copyright (C) + . + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + . + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + . + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + . + Also add information on how to contact you by electronic and paper mail. + . + If your software can interact with users remotely through a computer + network, you should also make sure that it provides a way for users to + get its source. For example, if your program is a web application, its + interface could display a "Source" link that leads users to an archive + of the code. There are many ways you could offer source, and different + solutions will be better for different programs; see section 13 for the + specific requirements. + . + You should also get your employer (if you work as a programmer) or school, + if any, to sign a "copyright disclaimer" for the program, if necessary. + For more information on this, and how to apply and follow the GNU AGPL, see + . diff --git a/GPLv3 b/GPLv3 deleted file mode 100644 index 94a9ed02..00000000 --- a/GPLv3 +++ /dev/null @@ -1,674 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 3, 29 June 2007 - - Copyright (C) 2007 Free Software Foundation, Inc. - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The GNU General Public License is a free, copyleft license for -software and other kinds of works. - - The licenses for most software and other practical works are designed -to take away your freedom to share and change the works. By contrast, -the GNU General Public License is intended to guarantee your freedom to -share and change all versions of a program--to make sure it remains free -software for all its users. We, the Free Software Foundation, use the -GNU General Public License for most of our software; it applies also to -any other work released this way by its authors. You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -them if you wish), that you receive source code or can get it if you -want it, that you can change the software or use pieces of it in new -free programs, and that you know you can do these things. - - To protect your rights, we need to prevent others from denying you -these rights or asking you to surrender the rights. Therefore, you have -certain responsibilities if you distribute copies of the software, or if -you modify it: responsibilities to respect the freedom of others. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must pass on to the recipients the same -freedoms that you received. You must make sure that they, too, receive -or can get the source code. And you must show them these terms so they -know their rights. - - Developers that use the GNU GPL protect your rights with two steps: -(1) assert copyright on the software, and (2) offer you this License -giving you legal permission to copy, distribute and/or modify it. - - For the developers' and authors' protection, the GPL clearly explains -that there is no warranty for this free software. For both users' and -authors' sake, the GPL requires that modified versions be marked as -changed, so that their problems will not be attributed erroneously to -authors of previous versions. - - Some devices are designed to deny users access to install or run -modified versions of the software inside them, although the manufacturer -can do so. This is fundamentally incompatible with the aim of -protecting users' freedom to change the software. The systematic -pattern of such abuse occurs in the area of products for individuals to -use, which is precisely where it is most unacceptable. Therefore, we -have designed this version of the GPL to prohibit the practice for those -products. If such problems arise substantially in other domains, we -stand ready to extend this provision to those domains in future versions -of the GPL, as needed to protect the freedom of users. - - Finally, every program is threatened constantly by software patents. -States should not allow patents to restrict development and use of -software on general-purpose computers, but in those that do, we wish to -avoid the special danger that patents applied to a free program could -make it effectively proprietary. To prevent this, the GPL assures that -patents cannot be used to render the program non-free. - - The precise terms and conditions for copying, distribution and -modification follow. - - TERMS AND CONDITIONS - - 0. Definitions. - - "This License" refers to version 3 of the GNU General Public License. - - "Copyright" also means copyright-like laws that apply to other kinds of -works, such as semiconductor masks. - - "The Program" refers to any copyrightable work licensed under this -License. Each licensee is addressed as "you". "Licensees" and -"recipients" may be individuals or organizations. - - To "modify" a work means to copy from or adapt all or part of the work -in a fashion requiring copyright permission, other than the making of an -exact copy. The resulting work is called a "modified version" of the -earlier work or a work "based on" the earlier work. - - A "covered work" means either the unmodified Program or a work based -on the Program. - - To "propagate" a work means to do anything with it that, without -permission, would make you directly or secondarily liable for -infringement under applicable copyright law, except executing it on a -computer or modifying a private copy. Propagation includes copying, -distribution (with or without modification), making available to the -public, and in some countries other activities as well. - - To "convey" a work means any kind of propagation that enables other -parties to make or receive copies. Mere interaction with a user through -a computer network, with no transfer of a copy, is not conveying. - - An interactive user interface displays "Appropriate Legal Notices" -to the extent that it includes a convenient and prominently visible -feature that (1) displays an appropriate copyright notice, and (2) -tells the user that there is no warranty for the work (except to the -extent that warranties are provided), that licensees may convey the -work under this License, and how to view a copy of this License. If -the interface presents a list of user commands or options, such as a -menu, a prominent item in the list meets this criterion. - - 1. Source Code. - - The "source code" for a work means the preferred form of the work -for making modifications to it. "Object code" means any non-source -form of a work. - - A "Standard Interface" means an interface that either is an official -standard defined by a recognized standards body, or, in the case of -interfaces specified for a particular programming language, one that -is widely used among developers working in that language. - - The "System Libraries" of an executable work include anything, other -than the work as a whole, that (a) is included in the normal form of -packaging a Major Component, but which is not part of that Major -Component, and (b) serves only to enable use of the work with that -Major Component, or to implement a Standard Interface for which an -implementation is available to the public in source code form. A -"Major Component", in this context, means a major essential component -(kernel, window system, and so on) of the specific operating system -(if any) on which the executable work runs, or a compiler used to -produce the work, or an object code interpreter used to run it. - - The "Corresponding Source" for a work in object code form means all -the source code needed to generate, install, and (for an executable -work) run the object code and to modify the work, including scripts to -control those activities. However, it does not include the work's -System Libraries, or general-purpose tools or generally available free -programs which are used unmodified in performing those activities but -which are not part of the work. For example, Corresponding Source -includes interface definition files associated with source files for -the work, and the source code for shared libraries and dynamically -linked subprograms that the work is specifically designed to require, -such as by intimate data communication or control flow between those -subprograms and other parts of the work. - - The Corresponding Source need not include anything that users -can regenerate automatically from other parts of the Corresponding -Source. - - The Corresponding Source for a work in source code form is that -same work. - - 2. Basic Permissions. - - All rights granted under this License are granted for the term of -copyright on the Program, and are irrevocable provided the stated -conditions are met. This License explicitly affirms your unlimited -permission to run the unmodified Program. The output from running a -covered work is covered by this License only if the output, given its -content, constitutes a covered work. This License acknowledges your -rights of fair use or other equivalent, as provided by copyright law. - - You may make, run and propagate covered works that you do not -convey, without conditions so long as your license otherwise remains -in force. You may convey covered works to others for the sole purpose -of having them make modifications exclusively for you, or provide you -with facilities for running those works, provided that you comply with -the terms of this License in conveying all material for which you do -not control copyright. Those thus making or running the covered works -for you must do so exclusively on your behalf, under your direction -and control, on terms that prohibit them from making any copies of -your copyrighted material outside their relationship with you. - - Conveying under any other circumstances is permitted solely under -the conditions stated below. Sublicensing is not allowed; section 10 -makes it unnecessary. - - 3. Protecting Users' Legal Rights From Anti-Circumvention Law. - - No covered work shall be deemed part of an effective technological -measure under any applicable law fulfilling obligations under article -11 of the WIPO copyright treaty adopted on 20 December 1996, or -similar laws prohibiting or restricting circumvention of such -measures. - - When you convey a covered work, you waive any legal power to forbid -circumvention of technological measures to the extent such circumvention -is effected by exercising rights under this License with respect to -the covered work, and you disclaim any intention to limit operation or -modification of the work as a means of enforcing, against the work's -users, your or third parties' legal rights to forbid circumvention of -technological measures. - - 4. Conveying Verbatim Copies. - - You may convey verbatim copies of the Program's source code as you -receive it, in any medium, provided that you conspicuously and -appropriately publish on each copy an appropriate copyright notice; -keep intact all notices stating that this License and any -non-permissive terms added in accord with section 7 apply to the code; -keep intact all notices of the absence of any warranty; and give all -recipients a copy of this License along with the Program. - - You may charge any price or no price for each copy that you convey, -and you may offer support or warranty protection for a fee. - - 5. Conveying Modified Source Versions. - - You may convey a work based on the Program, or the modifications to -produce it from the Program, in the form of source code under the -terms of section 4, provided that you also meet all of these conditions: - - a) The work must carry prominent notices stating that you modified - it, and giving a relevant date. - - b) The work must carry prominent notices stating that it is - released under this License and any conditions added under section - 7. This requirement modifies the requirement in section 4 to - "keep intact all notices". - - c) You must license the entire work, as a whole, under this - License to anyone who comes into possession of a copy. This - License will therefore apply, along with any applicable section 7 - additional terms, to the whole of the work, and all its parts, - regardless of how they are packaged. This License gives no - permission to license the work in any other way, but it does not - invalidate such permission if you have separately received it. - - d) If the work has interactive user interfaces, each must display - Appropriate Legal Notices; however, if the Program has interactive - interfaces that do not display Appropriate Legal Notices, your - work need not make them do so. - - A compilation of a covered work with other separate and independent -works, which are not by their nature extensions of the covered work, -and which are not combined with it such as to form a larger program, -in or on a volume of a storage or distribution medium, is called an -"aggregate" if the compilation and its resulting copyright are not -used to limit the access or legal rights of the compilation's users -beyond what the individual works permit. Inclusion of a covered work -in an aggregate does not cause this License to apply to the other -parts of the aggregate. - - 6. Conveying Non-Source Forms. - - You may convey a covered work in object code form under the terms -of sections 4 and 5, provided that you also convey the -machine-readable Corresponding Source under the terms of this License, -in one of these ways: - - a) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by the - Corresponding Source fixed on a durable physical medium - customarily used for software interchange. - - b) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by a - written offer, valid for at least three years and valid for as - long as you offer spare parts or customer support for that product - model, to give anyone who possesses the object code either (1) a - copy of the Corresponding Source for all the software in the - product that is covered by this License, on a durable physical - medium customarily used for software interchange, for a price no - more than your reasonable cost of physically performing this - conveying of source, or (2) access to copy the - Corresponding Source from a network server at no charge. - - c) Convey individual copies of the object code with a copy of the - written offer to provide the Corresponding Source. This - alternative is allowed only occasionally and noncommercially, and - only if you received the object code with such an offer, in accord - with subsection 6b. - - d) Convey the object code by offering access from a designated - place (gratis or for a charge), and offer equivalent access to the - Corresponding Source in the same way through the same place at no - further charge. You need not require recipients to copy the - Corresponding Source along with the object code. If the place to - copy the object code is a network server, the Corresponding Source - may be on a different server (operated by you or a third party) - that supports equivalent copying facilities, provided you maintain - clear directions next to the object code saying where to find the - Corresponding Source. Regardless of what server hosts the - Corresponding Source, you remain obligated to ensure that it is - available for as long as needed to satisfy these requirements. - - e) Convey the object code using peer-to-peer transmission, provided - you inform other peers where the object code and Corresponding - Source of the work are being offered to the general public at no - charge under subsection 6d. - - A separable portion of the object code, whose source code is excluded -from the Corresponding Source as a System Library, need not be -included in conveying the object code work. - - A "User Product" is either (1) a "consumer product", which means any -tangible personal property which is normally used for personal, family, -or household purposes, or (2) anything designed or sold for incorporation -into a dwelling. In determining whether a product is a consumer product, -doubtful cases shall be resolved in favor of coverage. For a particular -product received by a particular user, "normally used" refers to a -typical or common use of that class of product, regardless of the status -of the particular user or of the way in which the particular user -actually uses, or expects or is expected to use, the product. A product -is a consumer product regardless of whether the product has substantial -commercial, industrial or non-consumer uses, unless such uses represent -the only significant mode of use of the product. - - "Installation Information" for a User Product means any methods, -procedures, authorization keys, or other information required to install -and execute modified versions of a covered work in that User Product from -a modified version of its Corresponding Source. The information must -suffice to ensure that the continued functioning of the modified object -code is in no case prevented or interfered with solely because -modification has been made. - - If you convey an object code work under this section in, or with, or -specifically for use in, a User Product, and the conveying occurs as -part of a transaction in which the right of possession and use of the -User Product is transferred to the recipient in perpetuity or for a -fixed term (regardless of how the transaction is characterized), the -Corresponding Source conveyed under this section must be accompanied -by the Installation Information. But this requirement does not apply -if neither you nor any third party retains the ability to install -modified object code on the User Product (for example, the work has -been installed in ROM). - - The requirement to provide Installation Information does not include a -requirement to continue to provide support service, warranty, or updates -for a work that has been modified or installed by the recipient, or for -the User Product in which it has been modified or installed. Access to a -network may be denied when the modification itself materially and -adversely affects the operation of the network or violates the rules and -protocols for communication across the network. - - Corresponding Source conveyed, and Installation Information provided, -in accord with this section must be in a format that is publicly -documented (and with an implementation available to the public in -source code form), and must require no special password or key for -unpacking, reading or copying. - - 7. Additional Terms. - - "Additional permissions" are terms that supplement the terms of this -License by making exceptions from one or more of its conditions. -Additional permissions that are applicable to the entire Program shall -be treated as though they were included in this License, to the extent -that they are valid under applicable law. If additional permissions -apply only to part of the Program, that part may be used separately -under those permissions, but the entire Program remains governed by -this License without regard to the additional permissions. - - When you convey a copy of a covered work, you may at your option -remove any additional permissions from that copy, or from any part of -it. (Additional permissions may be written to require their own -removal in certain cases when you modify the work.) You may place -additional permissions on material, added by you to a covered work, -for which you have or can give appropriate copyright permission. - - Notwithstanding any other provision of this License, for material you -add to a covered work, you may (if authorized by the copyright holders of -that material) supplement the terms of this License with terms: - - a) Disclaiming warranty or limiting liability differently from the - terms of sections 15 and 16 of this License; or - - b) Requiring preservation of specified reasonable legal notices or - author attributions in that material or in the Appropriate Legal - Notices displayed by works containing it; or - - c) Prohibiting misrepresentation of the origin of that material, or - requiring that modified versions of such material be marked in - reasonable ways as different from the original version; or - - d) Limiting the use for publicity purposes of names of licensors or - authors of the material; or - - e) Declining to grant rights under trademark law for use of some - trade names, trademarks, or service marks; or - - f) Requiring indemnification of licensors and authors of that - material by anyone who conveys the material (or modified versions of - it) with contractual assumptions of liability to the recipient, for - any liability that these contractual assumptions directly impose on - those licensors and authors. - - All other non-permissive additional terms are considered "further -restrictions" within the meaning of section 10. If the Program as you -received it, or any part of it, contains a notice stating that it is -governed by this License along with a term that is a further -restriction, you may remove that term. If a license document contains -a further restriction but permits relicensing or conveying under this -License, you may add to a covered work material governed by the terms -of that license document, provided that the further restriction does -not survive such relicensing or conveying. - - If you add terms to a covered work in accord with this section, you -must place, in the relevant source files, a statement of the -additional terms that apply to those files, or a notice indicating -where to find the applicable terms. - - Additional terms, permissive or non-permissive, may be stated in the -form of a separately written license, or stated as exceptions; -the above requirements apply either way. - - 8. Termination. - - You may not propagate or modify a covered work except as expressly -provided under this License. Any attempt otherwise to propagate or -modify it is void, and will automatically terminate your rights under -this License (including any patent licenses granted under the third -paragraph of section 11). - - However, if you cease all violation of this License, then your -license from a particular copyright holder is reinstated (a) -provisionally, unless and until the copyright holder explicitly and -finally terminates your license, and (b) permanently, if the copyright -holder fails to notify you of the violation by some reasonable means -prior to 60 days after the cessation. - - Moreover, your license from a particular copyright holder is -reinstated permanently if the copyright holder notifies you of the -violation by some reasonable means, this is the first time you have -received notice of violation of this License (for any work) from that -copyright holder, and you cure the violation prior to 30 days after -your receipt of the notice. - - Termination of your rights under this section does not terminate the -licenses of parties who have received copies or rights from you under -this License. If your rights have been terminated and not permanently -reinstated, you do not qualify to receive new licenses for the same -material under section 10. - - 9. Acceptance Not Required for Having Copies. - - You are not required to accept this License in order to receive or -run a copy of the Program. Ancillary propagation of a covered work -occurring solely as a consequence of using peer-to-peer transmission -to receive a copy likewise does not require acceptance. However, -nothing other than this License grants you permission to propagate or -modify any covered work. These actions infringe copyright if you do -not accept this License. Therefore, by modifying or propagating a -covered work, you indicate your acceptance of this License to do so. - - 10. Automatic Licensing of Downstream Recipients. - - Each time you convey a covered work, the recipient automatically -receives a license from the original licensors, to run, modify and -propagate that work, subject to this License. You are not responsible -for enforcing compliance by third parties with this License. - - An "entity transaction" is a transaction transferring control of an -organization, or substantially all assets of one, or subdividing an -organization, or merging organizations. If propagation of a covered -work results from an entity transaction, each party to that -transaction who receives a copy of the work also receives whatever -licenses to the work the party's predecessor in interest had or could -give under the previous paragraph, plus a right to possession of the -Corresponding Source of the work from the predecessor in interest, if -the predecessor has it or can get it with reasonable efforts. - - You may not impose any further restrictions on the exercise of the -rights granted or affirmed under this License. For example, you may -not impose a license fee, royalty, or other charge for exercise of -rights granted under this License, and you may not initiate litigation -(including a cross-claim or counterclaim in a lawsuit) alleging that -any patent claim is infringed by making, using, selling, offering for -sale, or importing the Program or any portion of it. - - 11. Patents. - - A "contributor" is a copyright holder who authorizes use under this -License of the Program or a work on which the Program is based. The -work thus licensed is called the contributor's "contributor version". - - A contributor's "essential patent claims" are all patent claims -owned or controlled by the contributor, whether already acquired or -hereafter acquired, that would be infringed by some manner, permitted -by this License, of making, using, or selling its contributor version, -but do not include claims that would be infringed only as a -consequence of further modification of the contributor version. For -purposes of this definition, "control" includes the right to grant -patent sublicenses in a manner consistent with the requirements of -this License. - - Each contributor grants you a non-exclusive, worldwide, royalty-free -patent license under the contributor's essential patent claims, to -make, use, sell, offer for sale, import and otherwise run, modify and -propagate the contents of its contributor version. - - In the following three paragraphs, a "patent license" is any express -agreement or commitment, however denominated, not to enforce a patent -(such as an express permission to practice a patent or covenant not to -sue for patent infringement). To "grant" such a patent license to a -party means to make such an agreement or commitment not to enforce a -patent against the party. - - If you convey a covered work, knowingly relying on a patent license, -and the Corresponding Source of the work is not available for anyone -to copy, free of charge and under the terms of this License, through a -publicly available network server or other readily accessible means, -then you must either (1) cause the Corresponding Source to be so -available, or (2) arrange to deprive yourself of the benefit of the -patent license for this particular work, or (3) arrange, in a manner -consistent with the requirements of this License, to extend the patent -license to downstream recipients. "Knowingly relying" means you have -actual knowledge that, but for the patent license, your conveying the -covered work in a country, or your recipient's use of the covered work -in a country, would infringe one or more identifiable patents in that -country that you have reason to believe are valid. - - If, pursuant to or in connection with a single transaction or -arrangement, you convey, or propagate by procuring conveyance of, a -covered work, and grant a patent license to some of the parties -receiving the covered work authorizing them to use, propagate, modify -or convey a specific copy of the covered work, then the patent license -you grant is automatically extended to all recipients of the covered -work and works based on it. - - A patent license is "discriminatory" if it does not include within -the scope of its coverage, prohibits the exercise of, or is -conditioned on the non-exercise of one or more of the rights that are -specifically granted under this License. You may not convey a covered -work if you are a party to an arrangement with a third party that is -in the business of distributing software, under which you make payment -to the third party based on the extent of your activity of conveying -the work, and under which the third party grants, to any of the -parties who would receive the covered work from you, a discriminatory -patent license (a) in connection with copies of the covered work -conveyed by you (or copies made from those copies), or (b) primarily -for and in connection with specific products or compilations that -contain the covered work, unless you entered into that arrangement, -or that patent license was granted, prior to 28 March 2007. - - Nothing in this License shall be construed as excluding or limiting -any implied license or other defenses to infringement that may -otherwise be available to you under applicable patent law. - - 12. No Surrender of Others' Freedom. - - If conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot convey a -covered work so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you may -not convey it at all. For example, if you agree to terms that obligate you -to collect a royalty for further conveying from those to whom you convey -the Program, the only way you could satisfy both those terms and this -License would be to refrain entirely from conveying the Program. - - 13. Use with the GNU Affero General Public License. - - Notwithstanding any other provision of this License, you have -permission to link or combine any covered work with a work licensed -under version 3 of the GNU Affero General Public License into a single -combined work, and to convey the resulting work. The terms of this -License will continue to apply to the part which is the covered work, -but the special requirements of the GNU Affero General Public License, -section 13, concerning interaction through a network will apply to the -combination as such. - - 14. Revised Versions of this License. - - The Free Software Foundation may publish revised and/or new versions of -the GNU General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - - Each version is given a distinguishing version number. If the -Program specifies that a certain numbered version of the GNU General -Public License "or any later version" applies to it, you have the -option of following the terms and conditions either of that numbered -version or of any later version published by the Free Software -Foundation. If the Program does not specify a version number of the -GNU General Public License, you may choose any version ever published -by the Free Software Foundation. - - If the Program specifies that a proxy can decide which future -versions of the GNU General Public License can be used, that proxy's -public statement of acceptance of a version permanently authorizes you -to choose that version for the Program. - - Later license versions may give you additional or different -permissions. However, no additional obligations are imposed on any -author or copyright holder as a result of your choosing to follow a -later version. - - 15. Disclaimer of Warranty. - - THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY -APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT -HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY -OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, -THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM -IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF -ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - - 16. Limitation of Liability. - - IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS -THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY -GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE -USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF -DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD -PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), -EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMAGES. - - 17. Interpretation of Sections 15 and 16. - - If the disclaimer of warranty and limitation of liability provided -above cannot be given local legal effect according to their terms, -reviewing courts shall apply local law that most closely approximates -an absolute waiver of all civil liability in connection with the -Program, unless a warranty or assumption of liability accompanies a -copy of the Program in return for a fee. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -state the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . - -Also add information on how to contact you by electronic and paper mail. - - If the program does terminal interaction, make it output a short -notice like this when it starts in an interactive mode: - - Copyright (C) - This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, your program's commands -might be different; for a GUI interface, you would use an "about box". - - You should also get your employer (if you work as a programmer) or school, -if any, to sign a "copyright disclaimer" for the program, if necessary. -For more information on this, and how to apply and follow the GNU GPL, see -. - - The GNU General Public License does not permit incorporating your program -into proprietary programs. If your program is a subroutine library, you -may consider it more useful to permit linking proprietary applications with -the library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. But first, please read -. diff --git a/Makefile b/Makefile deleted file mode 100644 index c48a9e73..00000000 --- a/Makefile +++ /dev/null @@ -1,18 +0,0 @@ -#!/usr/bin/make -f - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## genmkfile - Makefile - version 1.5 - -## This is a copy. -## master location: -## https://github.com/Whonix/genmkfile/blob/master/usr/share/genmkfile/Makefile - -GENMKFILE_PATH ?= /usr/share/genmkfile -GENMKFILE_ROOT_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST)))) - -export GENMKFILE_PATH -export GENMKFILE_ROOT_DIR - -include $(GENMKFILE_PATH)/makefile-full diff --git a/README.md b/README.md index 5bf4053d..c92ada13 100644 --- a/README.md +++ b/README.md @@ -1,364 +1,1152 @@ -# enhances misc security settings # +# Enhances miscellaneous security settings -Inspired by Kernel Self Protection Project (KSPP) +Note that all the security features seen in this repository may not yet be incorporated into a public Kicksecure/Whonix release. Refer to the [forums](https://forums.kicksecure.com/c/news/5) with accompanying dates to see what is actually included in the most recent release. -* Implements most if not all recommended Linux kernel settings (sysctl) and -kernel parameters by KSPP. +## Kernel hardening -* https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project +This section is inspired by the Kernel Self Protection Project (KSPP). It +attempts to implement all recommended Linux kernel settings by the KSPP and +many more sources. -kernel hardening: +- https://kspp.github.io/Recommended_Settings +- https://github.com/KSPP/kspp.github.io -* deactivates Netfilter's connection tracking helper -Netfilter's connection tracking helper module increases kernel attack -surface by enabling superfluous functionality such as IRC parsing in -the kernel. (!) Hence, this package disables this feature by shipping the -/etc/modprobe.d/30_nf_conntrack_helper_disable.conf configuration file. +### sysctl -* Kernel symbols in various files in /proc are hidden as they can be -very useful for kernel exploits. +sysctl settings are configured via the `/usr/lib/sysctl.d/990-security-misc.conf` +configuration file and significant hardening is applied to a myriad of components. -* Kexec is disabled as it can be used to load a malicious kernel. -/etc/sysctl.d/30_security-misc.conf +#### Kernel space -* ASLR effectiveness for mmap is increased. +- Restrict access to kernel addresses through the use of kernel pointers regardless + of user privileges. -* The TCP/IP stack is hardened by disabling ICMP redirect acceptance, -ICMP redirect sending and source routing to prevent man-in-the-middle attacks, -ignoring all ICMP requests, enabling TCP syncookies to prevent SYN flood -attacks, enabling RFC1337 to protect against time-wait assassination -attacks and enabling reverse path filtering to prevent IP spoofing and -mitigate vulnerabilities such as CVE-2019-14899. +- Restrict access to the kernel logs to `CAP_SYSLOG` as they often contain + sensitive information. -* Some data spoofing attacks are made harder. +- Prevent kernel information leaks in the console during boot. -* SACK can be disabled as it is commonly exploited and is rarely used by -uncommenting settings in file /etc/sysctl.d/30_security-misc.conf. +- Restrict usage of `bpf()` to `CAP_BPF` to prevent the loading of BPF programs + by unprivileged users. -* Slab merging is disabled as sometimes a slab can be used in a vulnerable -way which an attacker can exploit. +- Restrict loading TTY line disciplines to `CAP_SYS_MODULE`. -* Sanity checks and redzoning are enabled. +- Restrict the `userfaultfd()` syscall to `CAP_SYS_PTRACE`, which reduces the + likelihood of use-after-free exploits. -* Memory zeroing at allocation and free time is enabled. +- Disable `kexec` as it can be used to replace the running kernel. -* Machine checks (MCE) are disabled which makes the kernel panic -on uncorrectable errors in ECC memory that could be exploited. +- Entirely disable the SysRq key so that the Secure Attention Key (SAK) + can no longer be utilized. See [documentation](https://www.kicksecure.com/wiki/SysRq). -* Kernel Page Table Isolation is enabled to mitigate Meltdown and increase -KASLR effectiveness. +- Optional - Disable all use of user namespaces. -* SMT is disabled as it can be used to exploit the MDS and other -vulnerabilities. +- Optional - Restrict user namespaces to `CAP_SYS_ADMIN` as they can lead to substantial + privilege escalation. -* All mitigations for the MDS vulnerability are enabled. +- Restrict kernel profiling and the performance events system to `CAP_PERFMON`. -* Enables mitigations for the L1TF (L1 Terminal Fault) vulnerability. +- Force immediate system reboot on the occurrence of a single kernel panic, reducing the + risk and impact of denial-of-service attacks and both cold and warm boot attacks. -* A systemd service clears System.map on boot as these contain kernel symbols -that could be useful to an attacker. -/etc/kernel/postinst.d/30_remove-system-map -/lib/systemd/system/remove-system-map.service -/usr/lib/security-misc/remove-system.map +- Force the kernel to immediately panic on both "oopses" (which can potentially indicate + and thwart certain kernel exploitation attempts) and kernel warnings in the `WARN()` path. -* Coredumps are disabled as they may contain important information such as -encryption keys or passwords. -/etc/security/limits.d/30_security-misc.conf -/etc/sysctl.d/30_security-misc.conf -/lib/systemd/coredump.conf.d/30_security-misc.conf +- Optional - Force immediate kernel panic on OOM (out of memory) which with the above setting + will force an immediate system reboot as opposed to placing any reliance on the oom_killer + to avoid arbitrarily terminating security features based on their OOM score. Note this + creates the risk of userspace-based denial-of-service attacks that maliciously fill memory. -* The thunderbolt and firewire kernel modules are blacklisted as they can be -used for DMA (Direct Memory Access) attacks. +- Optional - Force immediate kernel panics upon receiving NMIs (Non-Maskable Interrupts) + triggered by serious hardware-level I/O issues, uncorrectable memory and hardware errors, + and undefined or unknown sources in order to prevent data corruption. -* IOMMU is enabled with a boot parameter to prevent DMA attacks. +- Disable the use of legacy TIOCSTI operations which can be used to inject keypresses. -* Bluetooth is blacklisted to reduce attack surface. Bluetooth also has -a history of security concerns. -https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns +- Disable asynchronous I/O as `io_uring` has been the source of numerous kernel exploits. -* A systemd service restricts /proc/cpuinfo, /proc/bus, /proc/scsi and -/sys to the root user only. This hides a lot of hardware identifiers from -unprivileged users and increases security as /sys exposes a lot of information -that shouldn't be accessible to unprivileged users. As this will break many -things, it is disabled by default and can optionally be enabled by running -`systemctl enable hide-hardware-info.service` as root. -/usr/lib/security-misc/hide-hardware-info -/lib/systemd/system/hide-hardware-info.service -/lib/systemd/system/user@.service.d/sysfs.conf -/etc/hide-hardware-info.d/30_default.conf +- Disable 32-bit vDSO mappings as they are a legacy compatibility feature. -* The MSR kernel module is blacklisted to prevent CPU MSRs from being -abused to write to arbitrary memory. +#### User space -* Vsyscalls are disabled as they are obsolete, are at fixed addresses and are -a target for ROP. +- Disable the usage of `ptrace()` by all processes as it enables programs to inspect + and modify other active processes. -* Page allocator freelist randomization is enabled. +- Maximize the bits of entropy used for mmap ASLR across all CPU architectures. -* The vivid kernel module is blacklisted as it's only required for testing -and has been the cause of multiple vulnerabilities. +- Prevent hardlink and symlink TOCTOU races in world-writable directories. -* An initramfs hook sets the sysctl values in /etc/sysctl.conf and -/etc/sysctl.d before init is executed so sysctl hardening is enabled -as early as possible. +- Disallow unintentional writes to files in world-writable directories unless + they are owned by the directory owner to mitigate some data spoofing attacks. -* The kernel panics on oopses to prevent it from continuing to run a flawed -process and to deter brute forcing. +- Randomize the addresses (ASLR) for mmap base, stack, VDSO pages, and heap. -Improve Entropy Collection +- Raise the minimum address a process can request for memory mapping to 64KB to + protect against kernel null pointer dereference vulnerabilities. + +- Increase the maximum number of memory map areas a process is able to utilize to 1,048,576. + +- Optional - Disallow registering interpreters for various (miscellaneous) binary formats based + on a magic number or their file extension to prevent unintended code execution. + See issue: https://github.com/Kicksecure/security-misc/issues/267 + +#### Core dumps + +- Disable core dump files and prevent their creation. If core dump files are + enabled, they will be named based on `core.PID` instead of the default `core`. + +#### Swap space + +- Limit the copying of potentially sensitive content in memory to the swap device. + +#### Networking + +- Enable hardening of the BPF JIT compiler to protect against JIT spraying. + +- Enable TCP SYN cookie protection to assist against SYN flood attacks. + +- Protect against TCP time-wait assassination hazards. + +- Enable reverse path filtering (source validation) of packets received + from all interfaces to prevent IP spoofing. + +- Disable ICMP redirect acceptance and redirect sending messages to prevent + man-in-the-middle attacks and minimize information disclosure. + +- Deny sending and receiving shared media redirects to reduce the risk of IP + spoofing attacks. + +- Enable ARP filtering to mitigate some ARP spoofing and ARP cache poisoning attacks. + +- Respond to ARP requests only if the target IP address is on-link, + preventing some IP spoofing attacks. + +- Drop gratuitous ARP packets to prevent ARP cache poisoning via + man-in-the-middle and denial-of-service attacks. + +- Ignore ICMP echo requests to prevent clock fingerprinting and Smurf attacks. + +- Ignore bogus ICMP error responses. + +- Disable source routing which allows users to redirect network traffic that + can result in man-in-the-middle attacks. + +- Do not accept IPv6 router advertisements (RAs) and solicitations which can result + in both man-in-the-middle and denial-of-service attacks. + +- Optional - Disable SACK and DSACK as they have historically been a known + vector for exploitation. + +- Disable TCP timestamps as they can allow detecting the system time. + +- Disable reuse of `TIME_WAIT` sockets for new outgoing connections as the above + setting disables TCP timestamps. + +- Log packets with impossible source or destination addresses to enable further + inspection and analysis. + +- Optional - Enable IPv6 Privacy Extensions. + +- Documentation: https://www.kicksecure.com/wiki/Networking + +#### CD-ROM/DVD + +- Disable CD-ROM/DVD drive automatic tray closure and ejection functionality to + prevent scripted tray cycling attacks. + +- Disable all CD-ROM/DVD drive debug messages to limit information disclosure. + +- Optional - Restrict CD-ROM/DVD drives by disabling kernel checking and hardware access. + +### Boot parameters + +Mitigations for known CPU vulnerabilities are enabled in their strictest form +and simultaneous multithreading (SMT) is disabled. See the +`/etc/default/grub.d/40_cpu_mitigations.cfg` configuration file. + +Importantly, we do not rely on the use of the already enabled-by-default `mitigations=auto` +kernel boot parameter to perform CPU mitigations like many other distributions. This is +because its use is both totally redundant and it does not apply all hardening settings +to their strictest possible levels. See issue: +https://github.com/Kicksecure/security-misc/issues/199#issuecomment-3327391859. + +Note, to achieve complete protection for known CPU vulnerabilities, the latest +security microcode (BIOS/UEFI) updates must be installed on the system. Furthermore, +if using Secure Boot, the Secure Boot Forbidden Signature Database (DBX) must be kept +up to date through [UEFI Revocation List](https://github.com/microsoft/secureboot_objects) updates. + +CPU mitigations: + +- Disable Simultaneous Multithreading (SMT) + +- Spectre Side Channels (BTI and BHI) + +- Enable Kernel Page Table Isolation (PTI) + +- Meltdown + +- Speculative Store Bypass (SSB) + +- L1 Terminal Fault (L1TF) + +- Microarchitectural Data Sampling (MDS) + +- TSX Asynchronous Abort (TAA) + +- iTLB Multihit + +- Special Register Buffer Data Sampling (SRBDS) + +- L1D Flushing + +- Processor MMIO Stale Data + +- Arbitrary Speculative Code Execution with Return Instructions (Retbleed) + +- Cross-Thread Return Address Predictions + +- Optional - Speculative Return Stack Overflow (SRSO) + +- Gather Data Sampling (GDS) + +- Register File Data Sampling (RFDS) + +- Indirect Target Selection (ITS) + +- VMScape + +Boot parameters relating to kernel hardening, DMA mitigations, and entropy +generation are outlined in the `/etc/default/grub.d/40_kernel_hardening.cfg` +configuration file. + +Kernel space: + +- Disable merging of slabs with similar size, which reduces the risk of + triggering heap overflows and limits influencing slab cache layout. + +- Enable sanity checks and red zoning via slab debugging. This will implicitly + disable kernel pointer hashing, leaking very sensitive information to root. + Re-enabling hashed pointers will be possible when using Linux kernel >= 6.17. + https://github.com/Kicksecure/security-misc/issues/253 + +- Enable memory zeroing at both allocation and free time, which mitigates some + use-after-free vulnerabilities by erasing sensitive information in memory. + +- Enable the kernel page allocator to randomize free lists to limit some data + exfiltration and ROP attacks, especially during the early boot process. + +- Enable randomization of the kernel stack offset on syscall entries to harden + against memory corruption attacks. + +- Disable vsyscalls as they are vulnerable to ROP attacks and have now been + replaced by vDSO. + +- Restrict access to debugfs by not registering the file system since it can + contain sensitive information. + +- Force immediate system reboot on the occurrence of a single kernel panic, reducing the + risk and impact of denial-of-service attacks and both cold and warm boot attacks. + +- Force the kernel to immediately panic on both "oopses" (which can potentially indicate + and thwart certain kernel exploitation attempts) and kernel warnings in the `WARN()` path. + +- Optional - Force the kernel to immediately panic if it becomes tainted. Some reasons include + upon using out of specification hardware, bad page states, ACPI tables being overridden, + severe firmware bugs, in-kernel tests run, or mutating `fwctl` debug operations. It can also + include the loading of proprietary or out-of-tree modules. + +- Prevent sensitive kernel information leaks in the console during boot. + +- Enable the kernel Electric-Fence sampling-based memory safety error detector + which can identify heap out-of-bounds access, use-after-free, and invalid-free errors. + +- Disable 32-bit vDSO mappings as they are a legacy compatibility feature. + +- Use kCFI as the default CFI implementation as it is more resilient to attacks that are + able to write arbitrary executables into memory omitting the necessary hash validation. + +- Disable support for all 32-bit x86 processes and syscalls to reduce attack surface. + +- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs + and other persistent data to either the UEFI variable storage or ACPI ERST backends. + +- Restrict processes from modifying their own memory mappings unless actively done via + `ptrace()` for debugging in order to limit self-modification which can trigger exploits. + +- Optional - Prevent runaway privileged processes from writing to block devices that are mounted by + filesystems to protect against filesystem corruption and kernel crashes. May cause breakages with + disk management operations such as disk resizing and VDI compaction in virtual machines. + +- Optional - On compatible AMD CPUs enable Secure Memory Encryption (SME) to protect against + cold boot attacks and Secure Encrypted Virtualization (SEV) for further guest memory isolation. + +Direct memory access: + +- Enable strict IOMMU translation to protect against some DMA attacks via the use + of both CPU manufacturer-specific drivers and kernel settings. + +- Clear the busmaster bit on all PCI bridges during the EFI hand-off, which disables + DMA before the IOMMU is configured. May cause boot failure on certain hardware. + +Entropy: + +- Do not credit the CPU seeds as an entropy source at boot in order to maximize the + absolute quantity of entropy in the combined pool. This is desirable for all + cryptographic operations to avoid reliance on proprietary RDRAND and RDSEED CPU + instructions for random number generation that have long history of being defective. + +- Do not credit the bootloader seeds as an entropy source at boot to maximize the + absolute quantity of entropy in the combined pool. This is desirable for all + cryptographic operations as seeds passed by the bootloader could be tampered. + +- Obtain more entropy at boot from RAM as the runtime memory allocator is being + initialized to maximize the absolute quantity of entropy in the combined pool. + +Networking: + +- Optional - Disable the entire IPv6 stack to reduce attack surface. + +### mmap ASLR + +- The bits of entropy used for mmap ASLR for all CPU architectures are maxed + out via `/usr/libexec/security-misc/mmap-rnd-bits` (set to the values of + `CONFIG_ARCH_MMAP_RND_BITS_MAX` and `CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX` + that the kernel was built with), therefore improving its effectiveness. + +### Kernel Self Protection Project (KSPP) compliance status + +**Summary:** + +`security-misc` is in full compliance with KSPP recommendations wherever feasible. However, +there are a few cases of partial or non-compliance due to technical limitations. + +- [KSPP Recommended Settings](https://kspp.github.io/Recommended_Settings) + +**Full compliance:** + +More than 30 kernel boot parameters and over 30 sysctl settings are fully aligned with +the KSPP's recommendations. + +**Partial compliance:** + +1. Kernel boot parameter `proc_mem.force_override=never` + +Restrict processes from modifying their own memory mappings by completely disables use of +`/proc/PID/mem` to write to protected pages. Can be enabled easily if required. + +- [security-misc pull request #332](https://github.com/Kicksecure/security-misc/pull/332) + +**Non-compliance:** + +2. `sysctl user.max_user_namespaces=0` + +Disables user namespaces entirely. Not recommended due to the potential for widespread breakages. + +- [security-misc pull request #263](https://github.com/Kicksecure/security-misc/pull/263) + +3. `sysctl fs.binfmt_misc.status=0` + +Disables the registration of interpreters for miscellaneous binary formats. Currently not +feasible due to compatibility issues with Firefox. + +- [security-misc pull request #249](https://github.com/Kicksecure/security-misc/pull/249) +- [security-misc issue #267](https://github.com/Kicksecure/security-misc/issues/267) + +4. Kernel boot parameter `hash_pointers=always` + +Force all exposed pointers to be hashed and must be used in combination with the already enabled +`slab_debug=FZ` kernel boot parameter. Currently is not possible as requires Linux kernel >= 6.17. + +- [security-misc issue #253](https://github.com/Kicksecure/security-misc/issues/253) +- [security-misc pull request #325](https://github.com/Kicksecure/security-misc/pull/325) + +### Kernel Modules + +#### Kernel Module Signature Verification + +Not yet implemented due to issues: + +- https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/64 +- https://github.com/dell/dkms/issues/359 + +See: + +- `/etc/default/grub.d/40_signed_modules.cfg` + +#### Disables the loading of new modules to the kernel after the fact + +Not yet implemented due to issues: + +- https://github.com/Kicksecure/security-misc/pull/152 + +A systemd service dynamically sets the kernel parameter `modules_disabled` to 1, +preventing new modules from being loaded. Since this isn't configured directly +within systemctl, it does not break the loading of legitimate and necessary +modules for the user, like drivers etc., given they are plugged in on startup. + +#### Blacklist and disable kernel modules + +Conntrack: Deactivates Netfilter's connection tracking helper module which +increases kernel attack surface by enabling superfluous functionality such +as IRC parsing in the kernel. See `/etc/modprobe.d/30_security-misc_conntrack.conf`. + +Certain kernel modules are blacklisted by default to reduce attack surface via +`/etc/modprobe.d/30_security-misc_blacklist.conf`. Blacklisting prevents kernel +modules from automatically starting. + +- CD-ROM/DVD: Blacklist modules required for CD-ROM/DVD devices. + +- Miscellaneous: Blacklist an assortment of other modules to prevent them from + automatically loading. + +Specific kernel modules are entirely disabled to reduce attack surface via +`/etc/modprobe.d/30_security-misc_disable.conf`. Disabling prohibits kernel +modules from starting. This approach should not be considered comprehensive; +rather, it is a form of badness enumeration. Any potential candidates for future +disabling should first be blacklisted for a suitable amount of time. + +Hardware modules: + +- Optional - Bluetooth: Disabled to reduce attack surface. + +- Optional - CPU MSRs: Disabled as can be abused to access other trust domains + and write to arbitrary memory. + +- FireWire (IEEE 1394): Disabled as they are often vulnerable to DMA attacks. + +- GPS: Disable GPS-related modules such as those required for Global Navigation + Satellite Systems (GNSS). + +- Optional - Intel Management Engine (ME): Provides some disabling of the interface + between the Intel ME and the OS. May lead to breakages in places such as firmware + updates, security, power management, display, and DRM. See discussion: https://github.com/Kicksecure/security-misc/issues/239 + +- Intel Platform Monitoring Technology (PMT) Telemetry: Disable some functionality + of the Intel PMT components. + +- Thunderbolt: Disabled as they are often vulnerable to DMA attacks. + +File system modules: + +- File Systems: Disable uncommon and legacy file systems. + +- Network File Systems: Disable uncommon and legacy network file systems. + +Networking modules: + +- Network Protocols: A wide array of uncommon and legacy network protocols and drivers + are disabled. + +Miscellaneous modules: + +- Amateur Radios: Disabled to reduce attack surface. + +- Floppy Disks: Disabled to reduce attack surface. + +- Framebuffer (fbdev): Disabled as these drivers are well-known to be buggy, cause + kernel panics, and are generally only used by legacy devices. + +- Joysticks: Disabled to reduce attack surface. + +- Replaced Modules: Disabled legacy drivers that have been entirely replaced and + superseded by newer drivers. + +- RNDIS - Disabled as believed to have unfixable buffer overflow issues. + +- Optional - USB Video Device Class: Disables the USB-based video streaming driver for + devices like some webcams and digital camcorders. + +- Optional - Vivid: Disabled to reduce attack surface given previous vulnerabilities. + +### Other + +- A systemd service clears the System.map file on boot as these contain kernel + pointers. The file is completely overwritten with zeroes to ensure it cannot + be recovered. See: + +`/etc/kernel/postinst.d/30_remove-system-map` + +`/usr/lib/systemd/system/remove-system-map.service` + +`/usr/libexec/security-misc/remove-system.map` + +- Coredumps are disabled as they may contain important information such as + encryption keys or passwords. See: + +`/etc/security/limits.d/30_security-misc.conf` + +`/usr/lib/sysctl.d/30_security-misc.conf` + +`/usr/lib/systemd/coredump.conf.d/30_security-misc.conf` + +- PStore is disabled as crash logs can contain sensitive system data such as + kernel version, hostname, and users. See: + + `/usr/lib/systemd/pstore.conf.d/30_security-misc.conf` + +- An initramfs hook used to set the sysctl values in `/etc/sysctl.conf` and + `/etc/sysctl.d` before init is executed so sysctl hardening is enabled as + early as possible. This was implemented for `initramfs-tools` only because + this is not needed for `dracut` as `dracut` does that by default, at + least on `systemd` enabled systems. Not researched for non-`systemd` systems + by the author of this part of the readme. This is no longer implemented for + `initramfs-tools` as `initramfs-tools` support has been deprecated. + +- Kernel console output is suppressed during boot by setting `loglevel=0` and + `quiet` boot parameters to prevent sensitive kernel information from being + visible to physical observers. Must be paired with the `kernel.printk` sysctl + for complete effect. See: + + `/etc/default/grub.d/41_quiet_boot.cfg` + + `/usr/lib/sysctl.d/30_silent-kernel-printk.conf` + +- Recovery mode is restricted by removing GRUB recovery entries, halting + instead of dropping to an emergency shell during initramfs failures, and + disabling the dracut recovery shell entirely. This prevents physical attackers + from booting into a root shell via recovery options. See: + - `/etc/default/grub.d/41_recovery_restrict.cfg` + - [Recovery Mode](https://www.kicksecure.com/wiki/Recovery#Recovery_Mode) + - [Emergency Recovery Console](https://www.kicksecure.com/wiki/Recovery#Emergency_Recovery_Console) + - Is not an implementation of [Protecting the Kernel Command Line](https://www.kicksecure.com/wiki/Verified_Boot#Protecting_the_Kernel_Command_Line). + +## Network hardening + +Not yet implemented due to issues: + +- https://github.com/Kicksecure/security-misc/pull/145 + +- https://github.com/Kicksecure/security-misc/issues/184 + +- Unlike version 4, IPv6 addresses can provide information not only about the + originating network but also the originating device. We prevent this from + happening by enabling the respective privacy extensions for IPv6. + +- In addition, we deny the capability to track the originating device in the + network at all, by using randomized MAC addresses per connection by + default. + +See: + +- `/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf` +- `/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf` +- `/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf` + +## Bluetooth Hardening + +### Bluetooth Status: Enabled but Defaulted to Off + +- **Default Behavior**: Although Bluetooth capability is 'enabled' in the kernel, + security-misc-desktop deviates from the usual behavior by starting with + Bluetooth turned off at system start. This setting remains until the user + explicitly opts to activate Bluetooth. + +- **User Control**: Users have the freedom to easily switch Bluetooth on and off + in the usual way, exercising their own discretion. This can be done via the + Bluetooth toggle through the usual way, that is either through GUI settings + application or command line commands. + +- **Enhanced Privacy Settings**: We enforce more private defaults for Bluetooth + connections. This includes the use of private addresses and strict timeout + settings for discoverability and visibility. + +- **Security Considerations**: Despite these measures, it's important to note that + Bluetooth technology, by its nature, may still be prone to exploits due to its + history of security vulnerabilities. Thus, we recommend users to opt-out of + using Bluetooth when possible. + +### Configuration Details + +- Bluetooth controllers are not automatically enabled at boot (`AutoEnable=false`). +- Pairable and discoverable modes time out after 30 seconds of inactivity. +- Only one Bluetooth controller is exposed to the system (`MaxControllers=1`). +- Resolvable Private Addresses (RPAs) are enforced (`Privacy=network/on`), + preventing MAC-based tracking. + +See: + +- `/etc/bluetooth/30_security-misc.conf` +- For more information and discussion: [GitHub Pull Request](https://github.com/Kicksecure/security-misc/pull/145) + +### Understanding Bluetooth Terms + +- **Disabling Bluetooth**: This means the absence of the Bluetooth kernel module. + When disabled, Bluetooth is non-existent in the system - it cannot be seen, set, + configured, or interacted with in any way. + +- **Turning Bluetooth On/Off**: This refers to a software toggle. Normally, on + Debian systems, Bluetooth is 'on' when the system boots up. It actively searches + for known devices to auto-connect and may be discoverable or visible under certain + conditions. Our default ensures that Bluetooth is off on startup. However, it + remains 'enabled' in the kernel, meaning the kernel can use the Bluetooth protocol + and has the necessary modules. + +### Quick Toggle Guide + +- **Turning Bluetooth On**: Simply click the Bluetooth button in the settings + application or on the tray, and switch the toggle. It's a straightforward action + that can be completed in less than a second. + +- **Turning Bluetooth Off**: Follow the same procedure as turning it on but switch + the toggle to the off position. + +## Entropy collection improvements + +- The `jitterentropy_rng` kernel module is loaded as early as possible during + boot to gather more entropy via the + `/usr/lib/modules-load.d/30_security-misc.conf` configuration file. + +- Distrusts the CPU for initial entropy at boot as it is not possible to + audit, may contain weaknesses or a backdoor. Similarly, do not credit the + bootloader seed for initial entropy. For references, see: + `/etc/default/grub.d/40_kernel_hardening.cfg` + +- Gathers more entropy during boot if using the linux-hardened kernel patch. + +## Restrictive mount options + +A systemd service is triggered on boot to remount all sensitive partitions and +directories with significantly more secure hardened mount options. Since this +would require manual tuning for a given specific system, we handle it by +creating a very solid configuration file for that very system on package +installation. + +Not enabled by default yet. In development. Help welcome. + +- https://www.kicksecure.com/wiki/Dev/remount-secure +- https://github.com/Kicksecure/security-misc/issues/157 +- https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/ + +## Root access restrictions + +- `su` is restricted to only users within the group `sudo` which prevents + users from using `su` to gain root access or to switch user accounts - + `/usr/share/pam-configs/wheel-security-misc` (which results in a change in + file `/etc/pam.d/common-auth`). + +- Add user `root` to group `sudo`. This is required due to the above + restriction so that logging in from a virtual console is still possible - + `debian/security-misc-shared.preinst` + +- Abort login for users with locked passwords - + `/usr/libexec/security-misc/pam-abort-on-locked-password`. + +- Logging into the root account from a virtual, serial, or other console is + prevented by shipping an existing and empty `/etc/securetty` file (deletion + of `/etc/securetty` has a different effect). + +This package does not yet automatically lock the root account password. It is +not clear if this would be sane in such a package, although it is recommended to +lock and expire the root account. + +In new Kicksecure builds, the root account will be locked by package +dist-base-files. + +See: + +- https://www.kicksecure.com/wiki/Root +- https://www.kicksecure.com/wiki/Dev/Permissions +- https://forums.whonix.org/t/restrict-root-access/7658 -* Load jitterentropy_rng kernel module. -/usr/lib/modules-load.d/30_security-misc.conf - -* Distrusts the CPU for initial entropy at boot as it is not possible to -audit, may contain weaknesses or a backdoor. -* https://en.wikipedia.org/wiki/RDRAND#Reception -* https://twitter.com/pid_eins/status/1149649806056280069 -* For more references, see: -* /etc/default/grub.d/40_distrust_cpu.cfg - -Uncommon network protocols are blacklisted: -These are rarely used and may have unknown vulnerabilities. -/etc/modprobe.d/uncommon-network-protocols.conf -The network protocols that are blacklisted are: - -* DCCP - Datagram Congestion Control Protocol -* SCTP - Stream Control Transmission Protocol -* RDS - Reliable Datagram Sockets -* TIPC - Transparent Inter-process Communication -* HDLC - High-Level Data Link Control -* AX25 - Amateur X.25 -* NetRom -* X25 -* ROSE -* DECnet -* Econet -* af_802154 - IEEE 802.15.4 -* IPX - Internetwork Packet Exchange -* AppleTalk -* PSNAP - Subnetwork Access Protocol -* p8023 - Novell raw IEEE 802.3 -* p8022 - IEEE 802.2 - -user restrictions: - -* remount /home, /tmp, /dev/shm and /run with nosuid,nodev (default) and -noexec (opt-in). To disable this, run "sudo touch /etc/remount-disable". To -opt-in noexec, run "sudo touch /etc/noexec" and reboot (easiest). -Alternatively file /usr/local/etc/remount-disable or file -/usr/local/etc/noexec could be used. -/lib/systemd/system/remount-secure.service -/usr/lib/security-misc/remount-secure - -* A systemd service mounts /proc with hidepid=2 at boot to prevent users from -seeing each other's processes. - -* The kernel logs are restricted to root only. - -* The BPF JIT compiler is restricted to the root user and is hardened. - -* The ptrace system call is restricted to the root user only. - -restricts access to the root account: - -* `su` is restricted to only users within the group `sudo` which prevents -users from using `su` to gain root access or to switch user accounts. -/usr/share/pam-configs/wheel-security-misc -(Which results in a change in file `/etc/pam.d/common-auth`.) - -* Add user `root` to group `sudo`. This is required to make above work so -login as a user in a virtual console is still possible. -debian/security-misc.postinst - -* Abort login for users with locked passwords. -/usr/lib/security-misc/pam-abort-on-locked-password - -* Logging into the root account from a virtual, serial, whatnot console is -prevented by shipping an existing and empty /etc/securetty. -(Deletion of /etc/securetty has a different effect.) -/etc/securetty.security-misc - -* Console Lockdown. -Allow members of group 'console' to use console. -Everyone else except members of group -'console-unrestricted' are restricted from using console using ancient, -unpopular login methods such as using /bin/login over networks, which might -be exploitable. (CVE-2001-0797) Using pam_access. -Not enabled by default in this package since this package does not know which -users shall be added to group 'console' and would break console. -/usr/share/pam-configs/console-lockdown-security-misc -/etc/security/access-security-misc.conf - -Protect Linux user accounts against brute force attacks. -Lock user accounts after 50 failed login attempts using pam_tally2. -/usr/share/pam-configs/tally2-security-misc - -informational output during Linux PAM: - -* Show failed and remaining password attempts. -* Document unlock procedure if Linux user account got locked. -* Point out, that there is no password feedback for `su`. -* Explain locked (root) account if locked. -* /usr/share/pam-configs/tally2-security-misc -* /usr/lib/security-misc/pam_tally2-info -* /usr/lib/security-misc/pam-abort-on-locked-password - -access rights restrictions: - -* Strong Linux User Account Separation. -Removes read, write and execute access for others for all users who have -home folders under folder /home by running for example -"chmod o-rwx /home/user" -during package installation, upgrade or pam mkhomedir. This will be done only -once per -folder in folder /home so users who wish to relax file permissions are free to -do so. This is to protect previously created files in user home folder which -were previously created with lax file permissions prior installation of this -package. -debian/security-misc.postinst -/usr/lib/security-misc/permission-lockdown -/usr/share/pam-configs/mkhomedir-security-misc - -* SUID / GUID removal and permission hardening. -A systemd service removed SUID / GUID from non-essential binaries as these are -often used in privilege escalation attacks. -It is disabled by default for now during testing and can optionally be enabled -by running `systemctl enable permission-hardening.service` as root. -https://forums.whonix.org/t/disable-suid-binaries/7706 -/usr/lib/security-misc/permission-hardening -/lib/systemd/system/permission-hardening.service -/etc/permission-hardening.d/30_default.conf - -access rights relaxations: - -Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with -hidepid. -https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 -https://forums.whonix.org/t/cannot-use-pkexec/8129 -/usr/bin/pkexec.security-misc - -This package does (not yet) automatically lock the root account password. -It is not clear that would be sane in such a package. -It is recommended to lock and expire the root account. -In new Whonix builds, root account will be locked by package -anon-base-files. -https://www.whonix.org/wiki/Root -https://www.whonix.org/wiki/Dev/Permissions -https://forums.whonix.org/t/restrict-root-access/7658 However, a locked root password will break rescue and emergency shell. -Therefore this package enables passwordless resuce and emergency shell. -This is the same solution that Debian will likely addapt for Debian -installer. +Therefore, this package enables passwordless rescue and emergency shell. This is +the same solution that Debian will likely adopt for the Debian installer: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 -Adverse security effects can be prevented by setting up BIOS password -protection, grub password protection and/or full disk encryption. -/etc/systemd/system/emergency.service.d/override.conf -/etc/systemd/system/rescue.service.d/override.conf - -Disables TCP Time Stamps: - -TCP time stamps (RFC 1323) allow for tracking clock -information with millisecond resolution. This may or may not allow an -attacker to learn information about the system clock at such -a resolution, depending on various issues such as network lag. -This information is available to anyone who monitors the network -somewhere between the attacked system and the destination server. -It may allow an attacker to find out how long a given -system has been running, and to distinguish several -systems running behind NAT and using the same IP address. It might -also allow one to look for clocks that match an expected value to find the -public IP used by a user. - -Hence, this package disables this feature by shipping the -/etc/sysctl.d/30_security-misc.conf configuration file. - -Note that TCP time stamps normally have some usefulness. They are -needed for: - -* the TCP protection against wrapped sequence numbers; however, to -trigger a wrap, one needs to send roughly 2^32 packets in one -minute: as said in RFC 1700, "The current recommended default -time to live (TTL) for the Internet Protocol (IP) [45,105] is 64". -So, this probably won't be a practical problem in the context -of Anonymity Distributions. -* "Round-Trip Time Measurement", which is only useful when the user -manages to saturate their connection. When using Anonymity Distributions, -probably the limiting factor for transmission speed is rarely the capacity -of the user connection. - -Application specific hardening: - -* Enables APT seccomp-BPF sandboxing. /etc/apt/apt.conf.d/40sandbox -* Deactivates previews in Dolphin. -* Deactivates previews in Nautilus. -/usr/share/glib-2.0/schemas/30_security-misc.gschema.override -* Deactivates thumbnails in Thunar. -* Enables punycode (`network.IDN_show_punycode`) by default in Thunderbird -to make phising attacks more difficult. Fixing URL not showing real Domain -Name (Homograph attack). - -Want more? Look into these: - -* Linux Kernel Runtime Guard (LKRG). Kills whole Classes of Kernel Exploits. -* tirdad - TCP ISN CPU Information Leak Protection. -* Whonix ™ - Anonymous Operating System -* Kicksecure ™ - A Security-hardened, Non-anonymous Linux Distribution -* SecBrowser ™ - A Security-hardened, Non-anonymous Browser -* And more. -* https://www.whonix.org/wiki/Linux_Kernel_Runtime_Guard_LKRG -* https://github.com/Whonix/tirdad -* https://www.whonix.org -* https://www.whonix.org/wiki/Kicksecure -* https://www.whonix.org/wiki/SecBrowser -* https://github.com/Whonix - -Discussion: - -Happening primarily in Whonix forums. -https://forums.whonix.org/t/kernel-hardening/7296 -## How to install `security-misc` using apt-get ## -1\. Download [Whonix's Signing Key](). +See: -``` -wget https://www.whonix.org/patrick.asc -``` +- `/etc/systemd/system/emergency.service.d/override.conf` +- `/etc/systemd/system/rescue.service.d/override.conf` -Users can [check Whonix Signing Key](https://www.whonix.org/wiki/Whonix_Signing_Key) for better security. +Adverse security effects can be prevented by setting up [BIOS Password](https://www.kicksecure.com/wiki/Protection_Against_Physical_Attacks#BIOS_Password) +protection, [Bootloader Password](https://www.kicksecure.com/wiki/Protection_Against_Physical_Attacks#Bootloader_Password) protection, and/or [Full Disk Encryption (FDE)](https://www.kicksecure.com/wiki/Full_Disk_Encryption). -2\. Add Whonix's signing key. +## Console lockdown -``` -sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc -``` +This uses pam_access to allow members of group `console` to use the console but +restrict everyone else (except members of group `console-unrestricted`) from +using the console with ancient, unpopular login methods such as `/bin/login` over +networks as this might be exploitable. (CVE-2001-0797) -3\. Add Whonix's APT repository. +This is not enabled by default in this package since this package does not know +which users should be added to group 'console' and thus, would break console access. -``` -echo "deb https://deb.whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list -``` +See: -4\. Update your package lists. +- `/usr/share/pam-configs/console-lockdown-security-misc` +- `/etc/security/access-security-misc.conf` -``` -sudo apt-get update -``` +## Brute force attack protection + +User accounts are locked after 50 failed login attempts using `pam_faillock`. + +- The failure tracking window is 7 days (`fail_interval=604800`). +- Locked accounts never auto-unlock (`unlock_time=never`) and require manual + administrator intervention via the `faillock` command. +- The root account can also be locked (`even_deny_root`). +- Faillock is skipped for certain remote services (e.g. `sshd`, `dovecot`) to + prevent remote lockout attacks. + +Informational output during Linux PAM: + +- Show failed and remaining password attempts. +- Document unlock procedure if Linux user account got locked. +- Point out that there is no password feedback for `su`. +- Explain locked root account if locked. + +See: + +- `/usr/share/pam-configs/faillock-preauth-security-misc` +- `/usr/share/pam-configs/unix-faillock-security-misc` +- `/etc/security/faillock.conf.security-misc` +- `/usr/libexec/security-misc/pam-info` +- `/usr/libexec/security-misc/pam-abort-on-locked-password` +- `/usr/libexec/security-misc/pam_faillock_not_if_x` + +## Access rights restrictions + +### Strong user account separation -5\. Install `security-misc`. +#### Permission Lockdown + +Read, write, and execute access for "others" are removed during package +installation, upgrade, or PAM `mkhomedir` for all users who have home folders in +`/home` by running, for example: ``` -sudo apt-get install security-misc +chmod o-rwx /home/user ``` -## How to Build deb Package ## +This will be done only once per folder in `/home` so users who wish to relax +file permissions are free to do so. This is to protect files in a home folder +that were previously created with lax file permissions prior to the installation +of this package. + +See: + +- `debian/security-misc-shared.postinst` +- `/usr/libexec/security-misc/permission-lockdown` +- `/usr/share/pam-configs/mkhomedir-security-misc` + +#### umask + +The default `umask` is set to `027` for files created by non-root users, such +as the account `user`. + +This is done using the PAM module `pam_mkhomedir.so umask=027`. + +This configuration ensures that files created by non-root users cannot be read +by other non-root users by default. While Permission Lockdown already protects +the `/home` folder, this setting extends protection to other folders such as +`/tmp`. + +`group` read permissions are not removed. This is unnecessary due to Debian's +use of User Private Groups (UPGs). See also: +https://wiki.debian.org/UserPrivateGroups + +The default `umask` is unchanged for root because configuration files created +in `/etc` by the system administrator would otherwise be unreadable by +"others," potentially breaking applications. Examples include `/etc/firefox-esr` +and `/etc/thunderbird`. Additionally, the `umask` is set to `022` via `sudoers` +configuration, ensuring that files created as root are world-readable, even +when using commands such as `sudo vi /etc/file` or `sudo -i; touch /etc/file`. + +When using `sudo`, the `umask` is set to `022` rather than `027` to ensure +compatibility with commands such as `sudo vi /etc/configfile` and +`sudo -i; touch /etc/file`. + +See: + +- `/usr/share/pam-configs/umask-security-misc` + +### SUID / SGID removal and permission hardening + +#### SUID / SGID removal + +A systemd service removes SUID / SGID bits from non-essential binaries as these +are often used in privilege escalation attacks. + +#### File permission hardening + +Various file permissions are reset with more secure and hardened defaults. These +include but are not limited to: + +- Limiting `/home` and `/root` to the root only. +- Limiting crontab to root as well as all the configuration files for cron. +- Limiting the configuration for cups and ssh. +- Protecting the information of sudoers from others. +- Protecting various system-relevant files and modules. + +##### permission-hardener + +`permission-hardener` removes SUID / SGID bits from non-essential binaries as +these are often used in privilege escalation attacks. It is enabled by default +and applied at security-misc package installation and upgrade time. + +There is also an optional systemd unit which does the same at boot time that +can be enabled by running `systemctl enable permission-hardener.service` as +root. The hardening at boot time is not the default because this slows down +the boot process too much. + +See: + +- `/usr/bin/permission-hardener` +- `debian/security-misc-shared.postinst` +- `/usr/lib/systemd/system/permission-hardener.service` +- `/usr/lib/permission-hardener.d` +- https://forums.whonix.org/t/disable-suid-binaries/7706 +- https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener + +### Access rights relaxations + +This is not enabled yet because hidepid is not enabled by default. + +Calls to `pkexec` are redirected to `lxqt-sudo` because `pkexec` is +incompatible with `hidepid=2`. + +See: + +- `/usr/bin/pkexec.security-misc` +- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 +- https://forums.whonix.org/t/cannot-use-pkexec/8129 + +## Emergency shutdown + +- Forcibly powers off the system if the drive the system booted from is + removed from the system. +- Forcibly powers off the system if a user-configurable "panic key sequence" + is pressed (Ctrl+Alt+End by default). +- Forcibly powers off the system if + `sudo /run/emerg-shutdown --instant-shutdown` is called. +- Optional - Forcibly powers off the system if shutdown gets stuck for longer + than a user-configurable number of seconds (30 by default). Requires tuning + by the user to function properly, see notes in + `/etc/security-misc/emerg-shutdown/30_security_misc.conf`. + +A dracut module bundles the emergency shutdown binary, its systemd service, +and configuration files into the initramfs so the panic key sequence is +available even during early boot. A udev rule restarts the service whenever +a keyboard is added or removed. See: + +- `/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh` +- `/usr/lib/udev/rules.d/95-emerg-shutdown.rules` + +## File Manager D-Bus shim + +To prevent malicious applications from opening malicious content using D-Bus, +a shim is present that listens for `org.freedesktop.FileManager1` D-Bus method +calls. This shim displays a confirmation window for every request an +application makes to open one or more directories, while also ensuring +applications can only try to open directories (not files), and cannot try to +open directories that the user cannot access. + +See: + +- `/usr/src/security-misc/fm-shim-backend.c` +- `/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py` +- `/usr/bin/fm-shim-frontend` +- `/usr/libexec/security-misc/build-fm-shim-backend` +- `/usr/lib/systemd/user/fm-shim.service` + +## Application-specific hardening + +- `sudo`: Enables "`Defaults !fqdn`", which disables attempts to + determine the local machine's FQDN via DNS as this can leak the machine's + hostname in cleartext to the configured DNS server and cause + `sudo unable to resolve host` errors. `security-misc-desktop` only. Not + enabled on `security-misc-server` since there has been no research yet if + this can break server use cases. +- `apt`: Enables "`apt-get --error-on=any`" which makes apt exit non-zero for + transient failures. - `/etc/apt/apt.conf.d/40error-on-any`. +- `apt`: Enables APT seccomp-BPF sandboxing - `/etc/apt/apt.conf.d/40sandbox`. +- `Dolphin`: Deactivates previews in Dolphin. +- `Nautilus`: Deactivates previews in Nautilus - + `/usr/share/glib-2.0/schemas/30_security-misc.gschema.override`. +- `Thunar`: Deactivates thumbnails, disables automatic volume management, + hides the network bookmark, and sets the date format to ISO in Thunar. + - Rationale: lower attack surface when using the file manager + - https://forums.whonix.org/t/disable-preview-in-file-manager-by-default/18904 +- `gnupg`: Security and privacy enhancements for gnupg's config file + `/etc/skel/.gnupg/gpg.conf`. See also: + - https://raw.github.com/ioerror/torbirdy/master/gpg.conf + - https://github.com/ioerror/torbirdy/pull/11 +- `SSH client`: Hardens the SSH client by restricting key exchange to + post-quantum-hybrid and modern algorithms, limiting host and public key + authentication to Ed25519 only, requiring the use of strong ciphers, and + enforcing encrypt-then-MAC. + `/etc/ssh/ssh_config.d/30_security-misc.conf` +- `SSH server`: Hardens the SSH server with the same cryptographic restrictions + as the client. Additionally disables password and keyboard-interactive + authentication, disables agent/TCP/X11 forwarding, limits authentication + attempts to 3, and suppresses the Debian version banner. + `/etc/ssh/sshd_config.d/30_security-misc.conf` +- `flatpak`: Configures flatpak to require authentication for all software installation + and management tasks including updates. Ships + `/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc`, + diverts/hides `/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules`. +- `git`: Disables symlinks to protect against known CVEs and enables object + integrity checking (`fsckObjects`) on transfer, fetch, and receive operations. + `/etc/gitconfig` + +### Project scope of application-specific hardening + +Added in December 2023. + +Before sending pull requests to harden arbitrary applications, please note the +scope of security-misc is limited to default installed applications in +Kicksecure and Whonix. This includes: + +- VLC Media Player, KeePassXC +- Debian Specific System Components (APT, DPKG) +- System Services (NetworkManager IPv6 privacy options, MAC address + randomization) +- Actually used development utilities such as `git`. + +It will not be possible to review and merge "1500" settings profiles for +arbitrary applications outside of this context. + +The main objective of security-misc is to harden Kicksecure and its derivatives, +such as Whonix, by implementing robust security settings. It's designed to be +compatible with Debian, reflecting a commitment to clean implementation and +sound design principles. However, it's important to note that security-misc is a +component of Kicksecure, not a substitute for it. The intention isn't to +recreate Kicksecure within security-misc. Instead, specific security +enhancements, like recommending a curated list of security-focused +default packages (e.g., `libpam-tmpdir`), should be integrated directly into +those appropriate areas of Kicksecure (e.g. `kicksecure-meta-packages`). + +Discussion: https://github.com/Kicksecure/security-misc/issues/154 + +### Development philosophy + +Added in December 2023. + +Maintainability is a key priority \[1\]. Before modifying settings in the +downstream security-misc, it's essential to first engage with upstream +developers to propose these changes as defaults. This step should only be +bypassed if there's a clear, prior indication from upstream that such changes +won't be accepted. Additionally, before implementing any workarounds, consulting +with upstream is necessary to avoid future unmaintainable complexity. + +If debugging features are disabled, pull requests won't be merged until there is +a corresponding pull request for the debug-misc package to re-enable these. This +is to avoid configuring the system into a corner where it can no longer be +debugged. + +\[1\] https://www.kicksecure.com/wiki/Dev/maintainability + +## Opt-in hardening + +Some hardening is opt-in as it causes too much breakage to be enabled by +default. + +- An optional systemd service mounts `/proc` with `hidepid=2` at boot to + prevent users from seeing another user's processes. This is disabled by + default because it is incompatible with `pkexec`. It can be enabled by + executing `systemctl enable proc-hidepid.service` as root. + +- A systemd service restricts `/proc/cpuinfo`, `/proc/bus`, `/proc/scsi`, and + `/sys` to the root user. This hides a lot of hardware identifiers from + unprivileged users and increases security as `/sys` exposes a lot of + information that shouldn't be accessible to unprivileged users. As this will + break many things, it is disabled by default and can optionally be enabled + by executing `systemctl enable hide-hardware-info.service` as root. + +## USBGuard + +USB device authorization rules are shipped for USBGuard. All unrecognized USB +devices plugged in at runtime are blocked by default +(`ImplicitPolicyTarget=block`), while devices connected at boot time and some +likely-safe devices are allowed. The service is suppressed if the system lacks +a USB controller. + +- Reject USB devices with undefined or non-standard interface classes. +- Reject devices that combine a keyboard/mouse (HID) interface with + non-HID interfaces, which is a common indicator of a BadUSB attack. +- Reject devices with RNDIS interfaces due to suspected protocol-level + buffer overflow vulnerabilities. +- Allow only one keyboard and one mouse at a time. +- Allow USB audio, video, mass storage, and hub devices. +- IPC access is granted to members of the `sudo` and `qubes` groups. + +See: + +- `/etc/usbguard/usbguard-daemon.conf.security-misc` +- `/etc/usbguard/rules.d/30_security-misc.conf` +- `/etc/usbguard/IPCAccessControl.d/` +- `/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf` + +## Systemd preset defaults + +The following services are explicitly disabled by default in the systemd +preset because these are work-in-progress or can severely break functionality. +These can be opted-in by the user: + +- `hide-hardware-info.service` - Restricts `/sys` and `/proc` hardware info. + Testers-only. See [hide-hardware-info.service](https://www.kicksecure.com/wiki/Security-misc#hide-hardware-info.service). + +- `permission-hardener.service` - Applies permission hardening at boot. + See [permission-hardener.service](https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#permission-hardener.service). + +- `remount-secure.service` - Remounts filesystems with hardened options. + In development. See [Remount Secure](https://www.kicksecure.com/wiki/Dev/remount-secure). + +- `proc-hidepid.service` - Mounts `/proc` with `hidepid=2`. + See [hidepid](https://www.kicksecure.com/wiki/Security-misc#hidepid). + +- `harden-module-loading.service` - Disables kernel module loading after boot. + [Harden Module Loading](https://www.kicksecure.com/wiki/Security-misc#Harden_Module_Loading) can cause major breakage. + +- `ensure-shutdown.service` - Forced shutdown watchdog. + In development. + +- `ensure-shutdown-trigger.service` - Companion trigger for forced shutdown. + In development. + +- `memlockd.service` - Memory locking daemon (used internally by `emerg-shutdown`). + Can be enabled if the user intents to use `memlockd.service`. + +See: `/usr/lib/systemd/system-preset/50-security-misc.preset` + +## Miscellaneous + +- Hardened malloc compatibility for haveged workaround + `/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf` + +- Set `dracut` `reproducible=yes` setting. + `/etc/dracut.conf.d/30-security-misc.conf` + +- A `virusforget` script detects unauthorized changes to a set of sensitive + files by comparing them against a stored baseline. Work in progress - the + implementation will likely change significantly. + `/usr/libexec/security-misc/virusforget` + +- A custom `askpass` helper provides a GUI password prompt via `yad` for + superuser actions. + `/usr/libexec/security-misc/askpass` + +- A helper script checks whether a USB controller is present on the system, + used as a conditional for USBGuard services. + `/usr/libexec/security-misc/check-for-usb-controller` + +- A VirtualBox-specific workaround kills the `VBoxDRMClient` process during + shutdown to prevent it from blocking a clean unmount of `/tmp`. Only + activates inside VirtualBox VMs. + `/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service` + +- PAM conditional helpers (`pam_only_if_login`, `pam_only_if_su`) allow + specific PAM rules to apply only to certain services. + `/usr/libexec/security-misc/pam_only_if_login` + `/usr/libexec/security-misc/pam_only_if_su` + +- Unsafe logins (such as logging into non-sysmaint accounts while booted in + sysmaint mode, or elevating privileges from an unprivileged account to a + passwordless privileged account) are blocked. Enforces account/session + separation between `sysmaint` and regular user accounts. + `/usr/libexec/security-misc/block-unsafe-logins` + `/usr/share/pam-configs/block-unsafe-logins-security-misc` + +- `/usr/share/security-misc/` is added to `XDG_CONFIG_DIRS` at login via + `/etc/profile.d/30_security-misc.sh` so that security-misc XDG + configuration overrides (e.g. Dolphin, Thunar) are available system-wide. + +- An AppArmor tunable creates aliases for security-misc's config-package-dev + displaced files (e.g. `common-session`, `login.defs`, `securetty`) so that + AppArmor policies continue to work with the diverted paths. + `/etc/apparmor.d/tunables/home.d/security-misc` + +- A custom `sysinit-post.target` provides a synchronization point between + `sysinit.target` and `basic.target` for services that must run after + early-boot initialization but before general services. + `/usr/lib/systemd/system/sysinit-post.target` + +- A systemd drop-in adds the `sysfs` supplementary group to all user session + managers (`user@.service`), granting users group-based read access to `/sys` + entries restricted by `hide-hardware-info.service`. + `/usr/lib/systemd/system/user@.service.d/sysfs.conf` + +- LKRG (Linux Kernel Runtime Guard) VirtualBox compatibility: automatically + manages LKRG sysctl settings when VirtualBox host software is detected. + `/usr/share/security-misc/lkrg/lkrg-virtualbox` + +## Legal + +`/usr/lib/issue.d/20_security-misc.issue` + +https://github.com/Kicksecure/security-misc/pull/167 + +## Package split + +The `security-misc` source code repository builds three different software packages: + +- `security-misc-shared` +- `security-misc-desktop` +- `security-misc-server` + +The guiding principle has been: if there are no adverse effects, or if it is unclear whether a file belongs in the `desktop` or `server` package, then it will be placed in the `shared` package. + +The hash symbol ("`#`") is used as a separator character. + +Some clear examples where files belong only in `security-misc-desktop`: + +- `/usr/lib/NetworkManager/conf.d/80_ipv6-privacy#security-misc-desktop.conf` +- `/usr/lib/NetworkManager/conf.d/80_randomize-mac#security-misc-desktop.conf` +- `./usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop` + +This is because enabling IPv6 privacy extensions or MAC randomization on a server will not increase privacy but instead carries a high risk of breaking connectivity. + +A less clear example is `/etc/bluetooth/30_security-misc.conf#security-misc-desktop`. Also refer to the above chapter "Bluetooth Hardening". A server usually doesn't have Bluetooth, so on a server it may instead be useful to fully disable Bluetooth. + +Some clear examples where files belong only in `security-misc-shared`: + +`/etc/profile.d/30_security-misc.sh#security-misc-shared` indeed belongs in `security-misc-shared` and not `security-misc-desktop`. For the reason, see below. + +Other considerations have been: + +- Just because it's a server, it does not follow that there is no GUI (graphical user interface) desktop environment. +- Just because it's a desktop computer, it doesn't mean it's a GUI and not a CLI (command line interface). +- Therefore, the split is between `security-misc-desktop` and `security-misc-server`. +- Therefore, the split is not between `security-misc-gui` and `security-misc-cli`. + +\[1\] https://github.com/Kicksecure/security-misc/issues/187 + +## Related + +- [`tirdad` - TCP ISN CPU Information Leak Protection.](https://www.kicksecure.com/wiki/Tirdad) +- [Kicksecure (TM) - a security-hardened Linux Distribution](https://www.kicksecure.com) +- https://github.com/Kicksecure + +## Discussion + +Happening primarily in forums. + +https://forums.whonix.org/t/kernel-hardening/7296 + +## How to install `security-misc` + +See https://www.kicksecure.com/wiki/Security-misc#install + +## How to Build deb Package from Source Code + +Can be built using standard Debian package build tools such as: + + dpkg-buildpackage -b + +See instructions. (Replace `generic-package` with the actual name of this +package `security-misc`.) -Replace `apparmor-profile-torbrowser` with the actual name of this package with `security-misc` and see [instructions](https://www.whonix.org/wiki/Dev/Build_Documentation/apparmor-profile-torbrowser). +- **A)** + [easy](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package/easy), + *OR* +- **B)** [including verifying software + signatures](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package) -## Contact ## +## Contact -* [Free Forum Support](https://forums.whonix.org) -* [Professional Support](https://www.whonix.org/wiki/Professional_Support) +- [Free Forum Support](https://forums.kicksecure.com) +- [Professional Support](https://www.kicksecure.com/wiki/Professional_Support) -## Donate ## +## Donate -`security-misc` requires [donations](https://www.whonix.org/wiki/Donate) to stay alive! +`security-misc` requires [donations](https://www.kicksecure.com/wiki/Donate) to +stay alive! diff --git a/README_generic.md b/README_generic.md new file mode 100644 index 00000000..70edaf08 --- /dev/null +++ b/README_generic.md @@ -0,0 +1,70 @@ +# Enhances Miscellaneous Security Settings # + +https://github.com/Kicksecure/security-misc/blob/master/README.md + +https://www.kicksecure.com/wiki/Security-misc + +Package security-misc-desktop and/or security-misc-server may also be useful. + +Discussion: + +Happening primarily in Whonix forums. +https://forums.whonix.org/t/kernel-hardening-security-misc/7296 + +## How to install `security-misc` using apt-get ## + +1\. Download the APT Signing Key. + +``` +wget https://www.kicksecure.com/keys/derivative.asc +``` + +Users can [check the Signing Key](https://www.kicksecure.com/wiki/Signing_Key) for better security. + +2\. Add the APT Signing Key. + +``` +sudo cp ~/derivative.asc /usr/share/keyrings/derivative.asc +``` + +3\. Add the derivative repository. + +``` +echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com trixie main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list +``` + +4\. Update your package lists. + +``` +sudo apt-get update +``` + +5\. Install `security-misc`. + +``` +sudo apt-get install security-misc +``` + +## How to Build deb Package from Source Code ## + +Can be build using standard Debian package build tools such as: + +``` +dpkg-buildpackage -b +``` + +See instructions. + +NOTE: Replace `generic-package` with the actual name of this package `security-misc`. + +* **A)** [easy](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package/easy), _OR_ +* **B)** [including verifying software signatures](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package) + +## Contact ## + +* [Free Forum Support](https://forums.kicksecure.com) +* [Premium Support](https://www.kicksecure.com/wiki/Premium_Support) + +## Donate ## + +`security-misc` requires [donations](https://www.kicksecure.com/wiki/Donate) to stay alive! diff --git a/agents/fm-shim.md b/agents/fm-shim.md new file mode 100644 index 00000000..3ce7cc59 --- /dev/null +++ b/agents/fm-shim.md @@ -0,0 +1,53 @@ +# fm-shim Notes + +## Accepted Threat Model + +- Local DoS is out of scope. +- Directory replacement / symlink swaps are out of scope (frontend documents this). +- Success replies are returned even on frontend failure (spec safety). + +## Architecture + +- **Backend** (`fm-shim-backend.c`): C daemon that claims `org.freedesktop.FileManager1` + D-Bus name, receives ShowFolders/ShowItems/ShowItemProperties calls, forks a + Python frontend with the URI arguments and systemd's user environment. +- **Frontend** (`fm_shim_frontend.py`): PyQt5 dialog that validates URIs, resolves + paths, shows a confirmation prompt, then opens directories via `gio launch`. +- **Build script** (`build-fm-shim-backend`): Compiles the C backend with + extensive GCC hardening flags. +- **Service** (`fm-shim.service`): systemd user service, Type=notify. + +## D-Bus name acquisition + +The fm-shim-backend intentionally uses `DBUS_NAME_FLAG_REPLACE_EXISTING` +**without** `DBUS_NAME_FLAG_DO_NOT_QUEUE`. When the name cannot be acquired, +the process warns and omits `READY=1` so that systemcheck alerts the user. +Hard-failing (via `errx`) removes the service entirely, which is worse than +running in a degraded-but-monitored state. Do not change this to a fatal error. + +### DBUS_NAME_FLAG_DO_NOT_QUEUE + +The D-Bus name queueing behavior is intentional. The IN_QUEUE case withholds +`READY=1` (triggering a `systemcheck` warning) while remaining in the queue to +reclaim the name ASAP. Exiting immediately would leave the name permanently +unprotected - a worse outcome. Do not re-propose this change. + +## Systemd sandboxing on services that spawn user-facing apps + +Do not add restrictive systemd sandboxing directives (`ProtectHome`, +`MemoryDenyWriteExecute`, `ProtectSystem=strict`, etc.) to the fm-shim +service. These restrictions are inherited by child processes - the file +manager and anything it launches. `MemoryDenyWriteExecute` may break JIT, +`ProtectHome=read-only` breaks normal file manager operations, etc. + +## Closing inherited file descriptors in forked children + +Use the `close_range(3, ~0U, CLOSE_RANGE_UNSHARE)` syscall (requires +`#define _GNU_SOURCE` and `#include `). Do not iterate +`/proc/self/fd` manually. + +## D-Bus error replies + +When sending D-Bus error replies in multiple places, use the shared helper +function `send_error_message_maybe()` rather than duplicating the pattern +inline. diff --git a/agents/fuzzing.md b/agents/fuzzing.md new file mode 100644 index 00000000..56125099 --- /dev/null +++ b/agents/fuzzing.md @@ -0,0 +1,74 @@ + + +# Fuzzing + +## Hypothesis property tests + +Property tests live at `ci/tests//test_property.py` (mirroring +the helper-scripts layout). **Outside** the Python package tree on +purpose: `debian/security-misc-shared.install` ships +`usr/lib/python3/dist-packages/fm_shim_frontend/...`, so keeping the +property tests under `ci/tests/` means they don't end up in the +installed `.deb`. + +Currently covered: + +- `ci/tests/fm_shim_frontend/test_property.py` - Hypothesis + property tests over `get_path_list_from_uris`, the URI-validation + chokepoint between the FileManager1 D-Bus surface and the user- + facing dialog. Six properties (`never_raises`, + `output_paths_absolute`, `output_no_dangerous_chars`, + `output_unique_and_sorted`, `idempotent`, plus a deterministic + regression-suite of nine adversarial inputs). + + At introduction this suite found an exploitable bug: an attacker + who can deliver a URI with a single path component longer than + NAME_MAX (255 bytes on Linux) crashed the process via an + uncaught `OSError(ENAMETOOLONG)` from `Path.exists()`. Fixed in + the same commit that added the suite. + +Test runner: `.github/workflows/lint-python.yml` runs flake8 +followed by `python3 -m pytest` against `ci/tests//`. apt- +installs `python3-pytest`, `python3-hypothesis`, plus PyQt5 +runtime deps required for the source under test to import. + +`ci/tests//conftest.py` stubs out `stdisplay` (helper-scripts +package, not on PyPI / not in apt for the runner) with an identity +function, and stubs PyQt5.QtCore/Gui/Widgets so that the Qt class +inheritance at module level (`class FmShimWindow(QDialog)`) works +without a real display. + +Local run (single package): + +``` +PYTHONPATH=usr/lib/python3/dist-packages python3 -m pytest \ + --import-mode=importlib -q \ + ci/tests/fm_shim_frontend/test_property.py +``` + +When adding a new package, mirror the same structure: +`ci/tests//{test_property.py,conftest.py}`. Keep at least +two properties: `test_never_raises` and one domain-specific +invariant. + +## ClusterFuzzLite (Atheris / libFuzzer) + +Not yet wired up. Helper-scripts has the full +`.clusterfuzzlite/{Dockerfile,build.sh,project.yaml}` + +`fuzz/fuzz_.py` setup; mirror that here when the property- +test suite has been running long enough to catch the easy wins +and the harder, coverage-guided layer is justified. + +## Trust footprint + +- Hypothesis: Debian apt (`python3-hypothesis`). +- pytest: Debian apt (`python3-pytest`). +- PyQt5 + sip: Debian apt (`python3-pyqt5` + `python3-pyqt5.sip`). +- ClusterFuzzLite + Atheris (when added): Google. Per-pin + provenance will live in the future + `.clusterfuzzlite/Dockerfile`. diff --git a/changelog.upstream b/changelog.upstream index aadfc6eb..7d8ff45c 100644 --- a/changelog.upstream +++ b/changelog.upstream @@ -1,3 +1,17186 @@ +commit 7f60beb8bffa344453bd6794f92ff72b6098edf3 +Merge: d80e26de cbba86cb +Author: Patrick Schleizer +Date: Wed Sep 30 04:20:30 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit cbba86cb06d7acd46aaf780f9cd1e5ab4ac97d8d +Author: Aaron Rainbolt +Date: Tue Sep 29 22:57:46 2026 -0400 + + Polish, reintroduce removed ciphers again but keep the requirement to use post-quantum key exchange + +commit 5202e7564b9133ae267c6064c88e69d23d45cd87 +Merge: d80e26de c3b4e219 +Author: Aaron Rainbolt +Date: Tue Sep 29 22:33:57 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit c3b4e219acaf5b853c8a3d71f32360ae5db3aa32 +Merge: 96c0366c d217e28d +Author: assisted-by-ai +Date: Tue Sep 29 04:28:20 2026 -0400 + + Merge arraybolt3/trixie into ai (remaster) + +commit d80e26defda7271a513cb6ba8ddee7c3e9ae83cf +Author: Patrick Schleizer +Date: Tue Sep 29 08:08:57 2026 +0000 + + bumped changelog version + +commit 96c0366cdc53005b5a06104d6c9c325c12c87882 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Mon Sep 28 02:58:45 2026 -0400 + + ssh: fix override advice; sync interop comments + + - OpenSSH is first-wins: a lower-numbered drop-in (or ~/.ssh/config) overrides, not a higher-numbered one + + - server comment no longer claims the client stays broad; the client config is equally strict + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit aba02ec3634c006ea993c4609cf9a31c2e65a2b4 +Merge: 9cb4efa8 d217e28d +Author: Patrick Schleizer +Date: Mon Sep 28 02:40:50 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 802205a4b8e9519ebd04eda34f5428ec8719ed59 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Mon Sep 28 01:19:07 2026 -0400 + + ssh client: post-quantum-only kex + aes256-gcm (match server) + + - The client default now uses the same strictest set as the server: PQ-only + key exchange and the aes256-gcm cipher only (drop curve25519, chacha20, + aes256-ctr). Outbound SSH therefore only reaches post-quantum-capable + servers; override per-host in ~/.ssh/config or a 50_user.conf drop-in for a + server with a narrower algorithm set. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit d217e28daaaa3ef05d3f489180ec920eb2a4e18a +Author: Aaron Rainbolt +Date: Sun Sep 27 21:11:28 2026 -0400 + + Undo dangerous SSH settings changes applied by AI + +commit 6cee7b5659c60bd6e2f995786c178cb575f8c980 +Merge: 9cb4efa8 0a35d857 +Author: Aaron Rainbolt +Date: Sun Sep 27 20:49:32 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit 0a35d857cf38f02e99389bbfc0e299619b4105da +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sun Sep 27 08:22:31 2026 -0400 + + sshd: post-quantum-only kex + aes256-gcm (sshaudit.com A+/100) + + - Server default now offers PQ-only key exchange (drop classical curve25519) + and an AEAD, Terrapin-immune cipher (aes256-gcm, drop chacha20). This is the + A+ / 100-of-100 sshaudit.com profile (verified equivalent to grapheneos.org): + resists harvest-now-decrypt-later and removes chacha20's residual Terrapin + exposure for unpatched peers. + - Interop: requires an OpenSSH 9.0+ (post-quantum) peer. Client config stays + broad so outbound SSH to older servers is unaffected. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit fcbf940c25f57af3ddf2ec8dda1e2f8e95847bda +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sun Sep 27 04:21:49 2026 -0400 + + Move ssh-audit test tool + policies out to dist-ai + + - The ssh-audit-test driver and the server/client ssh-audit policies are test + artifacts, not runtime hardening; they now live in the dist-ai + security-misc-tests suite. security-misc's shipped package stays lean. + - Kept here: only the CI wiring (dm-consumer.yml + the dist-ai-tests / + ssh-prod workflows), which is inherently per-consumer-repo. The dist-ai + drift-guard test keeps the moved policies in sync with the ssh config drop-ins + that remain the source of truth. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 6d70b404e1812ade14912840263bf4671890dcc6 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sat Sep 26 02:54:03 2026 -0400 + + ssh-audit-test: clean error on missing option operand + + - --policy / --port with no value crashed on shift (shift count out of range) + instead of reporting the missing operand; validate and die cleanly. + - Document that the ssh-audit policy check is server-to-client; OpenSSH sets + both directions symmetrically, so it is complete for our OpenSSH targets. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 3ce6b81d5f7f9f1561d33ae0f474d11de8021195 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sat Sep 26 01:46:37 2026 -0400 + + Add ssh-audit hardening policies, test tool and CI wiring + + - ssh-audit-test + server/client policies pin the exact hardened algorithm + set (allow_algorithm_subset_and_reordering = false); a regression that + loosens the ssh config, or a server missing the hardening, now fails loud. + - dist-ai consumer wiring runs the config suite per PR and scans production + SSH on a schedule. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 2bf04eee21a66fed4f3c45556ebd362cfc6f810f +Merge: 00bad984 9cb4efa8 +Author: assisted-by-ai +Date: Thu Sep 24 22:51:46 2026 -0400 + + Merge master into ai (remaster) + +commit 9cb4efa8a716343271e3339fb7e13408146b7943 +Author: Patrick Schleizer +Date: Sat Sep 19 14:09:18 2026 +0000 + + bumped changelog version + +commit f7e4aa5ed2dbf0cd0d9155695ad4fdf315a1181f +Merge: a70c168d 87ff42a1 +Author: Patrick Schleizer +Date: Sat Sep 19 10:00:10 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 87ff42a19c786050471b5350e228a26a82bd61eb +Author: Aaron Rainbolt +Date: Wed Sep 16 00:01:44 2026 -0400 + + Comments, revert an unreliable feature addition in permission-hardener's state file parsing + +commit 3bc6ec2a046f20d292273095c40352ec6d914a52 +Merge: a70c168d 00bad984 +Author: Aaron Rainbolt +Date: Tue Sep 15 23:26:46 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit 00bad98497794d461fe4923e4ff182a61b918df7 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 10:56:10 2026 -0400 + + security-misc: source has.bsh explicitly in preinst + +commit 57a6530574d21307d77a371a1fb53259bfbe22fa +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 10:52:46 2026 -0400 + + security-misc: simplify preinst helper-scripts sourcing + + - helper-scripts is a Pre-Depends, configured before this preinst; strict + options first, then plain source -- errexit turns any load failure into a + hard stop, so the bespoke fail-closed handling + type -t check are redundant + +commit f0ea22f6b0f631485fb8f405eb352d35a3d33d84 +Merge: 888a5f67 a70c168d +Author: assisted-by-ai +Date: Tue Sep 15 10:45:48 2026 -0400 + + Merge master into ai (remaster) + +commit a70c168da6730ce86d1ea12f29bff2448734a8a9 +Author: Patrick Schleizer +Date: Tue Sep 15 14:32:35 2026 +0000 + + bumped changelog version + +commit 0a004b6675d22e4e54f79f07b086cebe78177280 +Author: Patrick Schleizer +Date: Tue Sep 15 10:27:21 2026 -0400 + + output + +commit edbaf1c198cb727ab00ff57ef573edc8c7974fd6 +Author: Patrick Schleizer +Date: Tue Sep 15 12:00:55 2026 +0000 + + bumped changelog version + +commit 888a5f679d816aeb8c50fc14ab604d27d158863d +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 04:27:13 2026 -0400 + + permission-hardener: restore octal-owner filename disambiguation + + - the right-to-left octal scan mis-anchors on a numeric octal-looking owner + (e.g. 0755), folding the real mode into the filename; the nonexistent path is + then silently dropped, leaving a SUID binary un-hardened. + - restore fixed-width tail anchoring + disambiguation by on-disk existence; + test_whitespace_filename.sh (numowner, 'x y') parses again. + +commit c894bbcf75bbe3c63f17b75f0ffc8a0ae2f98ef3 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 02:37:02 2026 -0400 + + preinst: fail closed loudly if helper-scripts library missing + + - source failures were swallowed (errexit not set yet); abort with the real + cause instead. + - a missing group_has_nonroot_member now aborts with the true reason rather + than degrading the lockout check into a misleading 'no account is a member of + sudo' abort. + +commit 239532762966b9fc57f158bb02fb19b04bf1e1bc +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 02:16:06 2026 -0400 + + Pre-Depend on helper-scripts; source accountctl.sh, drop vendored copy + + - helper-scripts moved from Depends to Pre-Depends: it is configured before this + package is unpacked, so the preinst can source its libraries. Reuse the real + group_has_nonroot_member from accountctl.sh instead of a vendored copy (and its + drift guard). + - accountctl.sh pulls in has.bsh, so 'has' is available: use it, drop the + no-has waiver and the command -v fallbacks. + +commit 497a23fbb31e2550fc858e6139e84b595be49d20 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Mon Sep 14 12:49:30 2026 -0400 + + Sync vendored group_has_nonroot_member (reject numeric arg) + +commit 88abbcaa436a86dcd15a37c8ba4f4351b565c050 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Mon Sep 14 11:13:01 2026 -0400 + + Detect primary-GID members in the install checks + + - sudo_users_check / console_users_check now count a non-root account + whose PRIMARY group is sudo/console (via a vendored + group_has_nonroot_member), not only supplementary members; a + supplementary-only scan falsely aborted install for such an admin. + - Revert the qubesdb-read probe to 'command -v' (no-has waiver): a + preinst runs at unpack time, before helper-scripts is guaranteed + configured, so it must not source has.bsh. + - group_has_nonroot_member is VENDORED from helper-scripts accountctl.sh + (same reason it cannot be sourced); a dist-ai drift guard keeps them + in sync. + +commit dc103b260b2dfd8b94ccdd23aaaaa54000d8d56c +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Mon Sep 14 09:35:22 2026 -0400 + + Also skip install checks on dist_build_iso; house-style + + - Skip the sudo/console-user install checks when dist_build_iso=true (an + ISO/live build) in addition to the existing skip_install_check file, so + the derivative-maker build no longer needs to write that marker file. + The manual file-based bypass is kept for non-derivative-maker users. + - Modernize to dist-ai house style: strict-mode block, printf not echo, + has not command -v, braced + nounset-guarded variables. + +commit 4db7b41bda5f7f2a1d0c1f163a070c998a5a284e +Merge: 81d6905a 827e5ee1 +Author: Patrick Schleizer +Date: Mon Sep 14 02:29:46 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 827e5ee1f8a250ba8b04e08c91892b1887e83d61 +Author: Aaron Rainbolt +Date: Sun Sep 13 17:50:16 2026 -0400 + + comments + +commit a85c5b57045e95a840c4059e66d8296b8e51c155 +Merge: d108f60a 28d05b0c +Author: Aaron Rainbolt +Date: Sun Sep 13 17:40:14 2026 -0400 + + Merge branch 'arraybolt3/maybebyte-pam-auth-update' into arraybolt3/trixie + +commit 28d05b0cd17c9f3d77786cf14798c1cdec912d0c +Merge: 86780917 d108f60a +Author: Aaron Rainbolt +Date: Sun Sep 13 17:39:32 2026 -0400 + + Merge branch 'arraybolt3/trixie' into arraybolt3/maybebyte-pam-auth-update + +commit d108f60a20cfc51cbe3d98f6200e8387a47f7488 +Author: Aaron Rainbolt +Date: Sun Sep 13 17:25:53 2026 -0400 + + comment + +commit ac4b5023ae7c0ca034b8e85dda91d34de4e2e920 +Author: Aaron Rainbolt +Date: Sun Sep 13 17:21:40 2026 -0400 + + Polish + +commit 81ed36c2e3e5777ca81e33f8a40edd1cd952e001 +Merge: 439ddce5 db8f36fd +Author: Aaron Rainbolt +Date: Sun Sep 13 17:11:40 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit db8f36fd5ab660ad1c2dd02fffa998a2b3f1ee58 +Merge: e64a2c7d b8e218c6 +Author: claude +Date: Sun Sep 13 06:07:26 2026 -0400 + + Merge branch 'master' into ai + +commit b8e218c6438b862acd881eac9599ff40224fe862 +Merge: c77beac7 b9cf5081 +Author: claude +Date: Sun Sep 13 06:07:25 2026 -0400 + + Merge remote-tracking branch 'upstream/master' + +commit e64a2c7d0481dfd38c8a575a49ddf55248e6230d +Author: claude (dev541 abd2cdfa-632f-4eda-bd69-14b67be2017e) +Date: Sun Sep 13 05:28:23 2026 -0400 + + Python -Bsu shebangs; grep --quiet in tests + +commit 81d6905af8bd14a21163a1ab308c996e38869f74 +Merge: b9cf5081 439ddce5 +Author: Patrick Schleizer +Date: Sat Sep 12 09:49:38 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 439ddce5bf08465710b81bd2353ac105b1e522c4 +Author: Aaron Rainbolt +Date: Fri Sep 11 17:06:29 2026 -0400 + + Revert some faulty changes to style-ok comments (uglier style, excessive verbosity, allow-echo in a script that did not use echo) + +commit d4e50dc6d74b6cf13c3dff2ef2b7d16a2b682ec2 +Merge: b9cf5081 409e0483 +Author: Aaron Rainbolt +Date: Fri Sep 11 16:58:09 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit b9cf508116757b7fff13c199a142742246162877 +Author: Patrick Schleizer +Date: Wed Sep 9 11:05:44 2026 +0000 + + bumped changelog version + +commit 0ba912995c461446bf527cf0c6a9db47e8aaab08 +Merge: fc2afb15 dd05179e +Author: Patrick Schleizer +Date: Wed Sep 9 06:56:30 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 409e0483071c2ca6a313272ec1957aab80a8cc3f +Merge: 24b39b0c c77beac7 +Author: claude (dev490 427cd1a1-bb80-4a36-9e14-2b6cec600780) +Date: Tue Sep 8 23:45:54 2026 -0400 + + Merge branch 'master' into ai + + # Conflicts: + # debian/security-misc-shared.postinst + # usr/bin/remount-secure#security-misc-shared + # usr/libexec/security-misc/check-for-usb-controller#security-misc-shared + # usr/share/lintian/overrides/security-misc-shared#security-misc-shared + # usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared + +commit c77beac7b4db560cd6d58abbc8943b77ee0ae62c +Merge: 6355b72c dd05179e +Author: claude (dev490 427cd1a1-bb80-4a36-9e14-2b6cec600780) +Date: Tue Sep 8 23:43:07 2026 -0400 + + Merge remote-tracking branch 'ab/trixie' + +commit 6355b72c6d9de2002506a3ab797b153f83c92a9d +Merge: 78491468 fc2afb15 +Author: claude (dev490 427cd1a1-bb80-4a36-9e14-2b6cec600780) +Date: Tue Sep 8 23:43:06 2026 -0400 + + Merge remote-tracking branch 'up/master' + +commit dd05179ea3310d0cac4d2de9db220ebbd5224fbf +Author: Aaron Rainbolt +Date: Tue Sep 8 21:24:00 2026 -0400 + + fix + +commit fc2afb158592f8a8ad7270dcb5ee5abb33e1824d +Author: Patrick Schleizer +Date: Tue Sep 8 15:30:04 2026 +0000 + + bumped changelog version + +commit 24b39b0ca1b6c5a0fd35036703f56a2a1f5b9225 +Author: claude (dev474 c7439536-fad8-4884-b71a-d2f3c4c23905) +Date: Mon Sep 7 11:49:54 2026 -0400 + + rename has.sh to has.bsh (bashism convention) + + Sourced helper-scripts lib uses bashisms; .bsh marks it. Scoped to has.sh consumers (repo carries unrelated concurrent WIP). + +commit 24a55b78fe94ef69bb866f71b86d54e3a659b83c +Merge: 94ea3994 aa458bac +Author: Patrick Schleizer +Date: Mon Sep 7 01:11:01 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit aa458bac395d6fd450c749d0934f4a63d4a76c17 +Author: Aaron Rainbolt +Date: Sun Sep 6 23:11:56 2026 -0400 + + Fix coding style, shorten comments + +commit 97f78d8262aeea854cef3d654ab6aeb57e1f08ec +Merge: 94ea3994 077d41a6 +Author: Aaron Rainbolt +Date: Sun Sep 6 22:38:54 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/remove-system-map-readonly-continue' into arraybolt3/trixie + +commit 94ea3994027115b02bdcc8d8246c4c5b5c40a776 +Author: Patrick Schleizer +Date: Sun Sep 6 16:58:23 2026 +0000 + + bumped changelog version + +commit 0088727e4a9ca17d07916a30544ffa6e13890bfc +Author: Patrick Schleizer +Date: Sun Sep 6 12:56:41 2026 -0400 + + cleanup + +commit ebd72d593c81fad95d09a055d4e839b6eecca332 +Merge: 78491468 87506b1e +Author: Patrick Schleizer +Date: Sun Aug 30 10:02:32 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 3e3d7453e3318ac79ea36ae14ed90442ded0c165 +Author: claude (dev371 3fff1819-b77d-4dde-be19-8c01e09d3394) +Date: Fri Aug 28 01:23:45 2026 -0400 + + lintian: drop redundant maintainer-script-ignores-errors override + + Now suppressed globally in genmkfile; the false positive is the same errexit long-form case. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 87506b1eaf45fa7501d54cf83b9be13578f86ecb +Author: Aaron Rainbolt +Date: Fri Aug 28 01:03:22 2026 -0400 + + Polish, add TODOs + +commit 0f1f701b5c413b1ab2229577261fe6e0187d84ca +Merge: eb5b301d bb399ba7 +Author: Aaron Rainbolt +Date: Thu Aug 27 21:02:55 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit bb399ba73704e4c20fbc6965d13bee4f2c63626c +Author: claude (dev352 385b930f-4313-4883-93d5-e6857c3f7ea7) +Date: Thu Aug 27 12:07:58 2026 -0400 + + lintian: override maintainer-script-ignores-errors in the shipped file + + The postinst uses long-form 'set -o errexit' (style R-013); lintian's + scripts check only matches short 'set -e'. Add the false-positive + override to the package's own usr/share/lintian/overrides file -- a + separate debian/*.lintian-overrides displaces it (dh_lintian installs to + the same path), losing the etc-skel and other overrides it carries. + +commit d1b9f4c0517f03936af556445fedd2ee22d14e98 +Merge: cc7a93d1 908cadc6 +Author: claude (dev352 385b930f-4313-4883-93d5-e6857c3f7ea7) +Date: Thu Aug 27 11:22:32 2026 -0400 + + Merge branch 'ai' of ssh://github.com/org-ai-assisted/security-misc into ai + +commit cc7a93d10a30e19631c64437b5c6078ba5d74f77 +Author: claude (dev352 385b930f-4313-4883-93d5-e6857c3f7ea7) +Date: Thu Aug 27 11:21:51 2026 -0400 + + lintian: override false-positive maintainer-script-ignores-errors + + The postinst enables errexit via long-form 'set -o errexit' (project + style, R-013); lintian's check only matches short 'set -e'. Same + override tb-updater already carries. + +commit 908cadc6177c00d4ff3465b33b20b3c971ce246a +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Aug 24 23:31:21 2026 -0400 + + ci: drop orphaned consumer-secrets-audit.yml (reusable decommissioned) + +commit a6d7a3585f8905bc3f898d8dd83c3b07cb04cba9 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Aug 24 23:31:19 2026 -0400 + + ci: drop orphaned consumer-codex-review.yml (reusable decommissioned) + +commit e6a81266555130673dc7d8bcb85ea50bbad9e852 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Aug 24 23:31:16 2026 -0400 + + ci: drop orphaned consumer-claude-code.yml (reusable decommissioned) + +commit 1c9f144b9ebe58daa174de05f5b0c0e42038bfc1 +Author: claude (dev272 e8b76afb-795c-4739-8ebd-023de854021e) +Date: Fri Aug 21 04:41:27 2026 -0400 + + security-misc: source helper-scripts via HELPER_SCRIPTS_PATH, drop SC1091 disable + + - check-for-usb-controller, permission-hardener, lkrg-virtualbox: use + source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/; + drop the dead '# shellcheck disable=SC1091' and the stale sibling note. + - completed pre-existing whole-file style debt: R-010 export LC_ALL=C in + the strict-mode block (dropping the duplicate single-quoted mid-file one). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 78491468a7c209f423f48f74de015f1df2b9a980 +Author: Patrick Schleizer +Date: Sun Aug 16 08:24:20 2026 +0000 + + bumped changelog version + +commit f1e9da8fb911b1e3962f219290df14753794aee8 +Merge: 52e18f72 1fcf4967 +Author: Patrick Schleizer +Date: Sat Aug 15 12:55:45 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit f2c1e7517cf8a8017db91ef7cf42784e93e14ae8 +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 13:28:37 2026 -0400 + + permission-hardener: read spaced paths back from the state DB + + Fresh-claude review of the whitespace feature found the write/read sides + disagree: parsing now accepts space-containing filenames into the policy, but + load_state_without_policy split the dpkg-statoverride DB line on whitespace and + required exactly 4 fields, silently dropping any spaced path. A spaced SUID file + then got hardened but could never be un-hardened ('disable' never found it), and + repeated 'enable' failed with exit 203. + + - Read the three fixed fields (owner group mode) and take the remainder as the + path, matching the DB's 'owner group mode path' format. + - Regression test test_state_spaced_filename.sh: seed a spaced entry, disable, + assert the mode is restored (fails on the old reader: file stays un-restored). + - Test hygiene: print-policy captures modes into the state DB, so the two + print-policy tests now remove the entries they create instead of leaving stale + root-owned overrides for deleted temp files. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 6dcffee4bf717bfac9a4c13153dcaa1a25cdc89f +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 13:12:25 2026 -0400 + + permission-hardener: unify mode anchoring across all field widths + + Fresh-claude follow-up: the field_count==4/5 existence override did not cover a + 6-field line (spaced filename + numeric octal-looking owner + capability), which + anchored the mode on the owner and silently dropped the entry. No hardening + bypass -- numeric owners are rejected later against passwd names -- but a silent + drop instead of a loud rejection, and the ==4 disjunct was dead code. + + Replace the special-case override with one existence-based loop: among the octal + candidates at field_count-3 and field_count-4, pick the one whose recovered + filename exists; a mode at field 1 means no-space (no recovery); fall back to + the rightmost octal candidate when neither name exists. Handles the 3-field, + 4-field, spaced, numeric-owner and 6-field cases uniformly. + + - Regression test: 6-field spaced numeric-owner case; the suite now + distinguishes this fix from all three prior parser iterations. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 73cc7889b271e2f3733daed276ba235dde04dc20 +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 13:00:51 2026 -0400 + + permission-hardener: disambiguate octal-ambiguous entries by file existence + + Fresh-claude review found the earlier field-1 guard reintroduced a symmetric + misparse: a spaced filename whose second component is a bare octal (e.g. + '/srv/a 744 0644 root root') got dropped because the guard mistook the octal + component for the mode. + + The 5-field reading is genuinely ambiguous lexically -- '/a 744 0644 root root' + (spaced name) vs '/foo 0744 1000 root cap' (numeric owner). Resolve by which + candidate filename exists on disk, consistent with the tool skipping + nonexistent targets. Keep the no-recovery reading only when field 1 is an octal + mode and only the un-recovered name exists. + + - Replace the lexical guard with the existence check inside the right-anchor + branch; the whitelist-keyword branch is no longer gated (it was wrongly + skipped for '/x 744 y matchwhitelist'). + - Regression test: spaced octal-second-component case; the assertion now matches + the whole first column (trailing TAB) so '/a 744' cannot substring-match the + '/a 744 name' entry. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 780561e61a6bf1c8d110d1105a5102b59ceb14ea +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 12:49:10 2026 -0400 + + permission-hardener: fix disable-all directive + numeric-owner misparse + + Both surfaced by a fresh-claude review of the right-anchor change. + + - whitelists_disable_all=true was unreachable: the character-class check (which + excludes '=') ran before the directive check, so the documented line tripped + "invalid characters" and aborted the whole run (exit 200). Recognize the + directive first. + - Numeric octal-looking owner in a capability entry (e.g. ' 0744 0755 root + cap'): right-anchoring folded the owner into the mode position, the folded + path did not exist, and the entry was silently dropped -- file left + un-hardened. Skip recovery when the line is already a well-formed no-space + entry (octal mode at field 1, count 4 or 5). + - Correct the stale field-order comment: the tail is + 'filemode user_owner group_owner [capability]', mode first (per add_to_policy). + - Regression tests: numeric-owner case in the whitespace test; new + test_whitelists_disable_all.sh. Both fail on the pre-fix code. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit fca4984733e4aff6b90e8dd248d38b8cbb3889cc +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 12:40:52 2026 -0400 + + permission-hardener confs: correct gst-ptp-helper path/pkg and #8633 fix credit + + - 30_default.conf: gst-ptp-helper ships in libgstreamer1.0-0, not + gstreamer1.0-plugins-base; fix the disabled entry's path to + .../gstreamer1.0/gstreamer-1.0/... (first component was gstreamer-1.0, + which does not exist). Verified via dpkg -S. + - 25_default_whitelist_qubes.conf: the #8633 EoP fix is qfile-unpacker + (qubes-core-agent-linux) refusing a UID change other than the caller's; + libqubes-pure path/symlink sanitization (qubes-linux-utils PR #87) is a + separate layer. The comment credited only PR #87. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 37ad483b25c43b93bb350983c2534f9d775e977a +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 12:34:17 2026 -0400 + + permission-hardener: anchor mode tail from the right for spaced filenames + + - Space filenames are recovered from the option tail; the mode/owner/group + [/capability] tail has a fixed width (3 or 4 fields). + - Old left-to-right octal scan misanchored when a space-delimited filename + chunk was itself a bare octal (e.g. '/path/a 744 name 0744 root root'): the + field-count check then failed and the WHOLE hardener aborted (exit 200), + contradicting the comment that claimed such a line was skipped. + - Anchor the mode from the right (field_count-3, else field_count-4); prefer + the 3-field reading so a filename ending in an octal chunk is not mistaken + for a 4-field capability tail. + - Regression test: config line with a bare-octal filename chunk must parse via + print-policy; fails on the old code (exit 200 / entry missing). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit c2fcb2d893bf26a59c1b25415333fafcad8682dc +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 05:15:00 2026 -0400 + + security-misc: drop versioned bash dependency + + - Revert the bash (>= 4.4) Depends. Supported Debian (trixie+) always + ships bash >= 4.4 and earlier is unsupported, so the inherit_errexit + builtin is always present; the dependency adds nothing. Policy bans it + (bash-style-guide R-010b). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit a66fa50019f95326fef372ec5b3d1cde3b59b4a9 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:55:18 2026 -0400 + + security-misc: fix undo chown empty-arg + emerg fallback (ai-review) + + - undo_policy_for_file: the strict-mode brace pass quoted "${verbose}", + so 'permission-hardener disable all' ran 'chown "" -- ...' (invalid + empty owner) and 'chmod "" ...'. Make verbose an array so an empty + value expands to zero arguments. Canary-verified. + - emerg-shutdown fallback: when the prebuilt binary is absent, compile + straight into /run (tmpfs, writable even if /usr is read-only) rather + than via build-emerg-shutdown into /usr/bin. + - Document the space-filename parser limitations (consecutive spaces + collapse; an octal-looking path chunk can misanchor -> entry skipped). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit c4bf5403d0dbda87b2e1fe165ade7c81bf4e1b30 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:44:07 2026 -0400 + + security-misc: declare bash (>= 4.4) for inherit_errexit + + - Many scripts use 'shopt -s inherit_errexit' (bash 4.4+) in their + strict-mode preamble; ${misc:Depends} does not supply the baseline, so + an older /bin/bash would die in the preamble before the script's logic. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 5b34c9406198a47ce0c8d78a143606056e9d51b0 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:49 2026 -0400 + + security-misc: dfuzzer commit pin, marker rewords, remount-secure cleanup + + - ci/dfuzzer-build.sh: pin dfuzzer to the exact upstream commit and + verify the tag resolves to it (a moved tag now fails loudly). + - grub 40_kernel_hardening + remount-secure hidepid: reword standing + 'TODO' notes to 'REMINDER' (tracking, not pending work). + - remount-secure: replace the echo/true toggle with a printf-array + output helper; bring the file to strict-mode / shellcheck compliance + (6-directive block, braces) as required to touch it. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 9f12941585d5b18ae79f5d8dfd9f94cc0cd2507d +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:35 2026 -0400 + + security-misc: document whitelisted SUID/SGID helpers, flag human-only + + - Replace the bare 'TODO: research' markers on the permission-hardener + whitelist entries (postfix, selinux/utempter, spice, virtualbox, + qubes/qfile-unpacker, pam-tmpdir-helper, gst-ptp-helper) with concise + documentation: what each helper is, why it is SUID/SGID, what breaks if + stripped, and relevant CVE/hardening notes. + - Retag the keep-vs-strip decisions TODO-HUMAN-DEVELOPER-ONLY -- a + security-trust call for a human maintainer, not AI-resolvable. + - 30_default.conf: fix the commented gst-ptp-helper path typo + (gstreamer1.0/grstreamer-1.0 -> gstreamer-1.0/gstreamer-1.0); note that + filenames with spaces are now parsed. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 8aef705e63595beaa90f70e9c8a4f297fd7a08ee +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:20 2026 -0400 + + security-misc: fm-shim frontend calls xdg-mime/gio by absolute path + + - fm-shim-frontend invoked xdg-mime and gio by bare name, depending on + the systemd --user manager's PATH (minimal, profile-derived entries + absent) that fm-shim-backend hands it. Use /usr/bin/xdg-mime and + /usr/bin/gio, matching the existing /usr/bin/unicode-show call. + - Reword the backend TODO: the whole-session PATH fix belongs in + desktop-config-dist's start-lxqt-session (out of this repo); the + frontend absolute-path change is the in-repo mitigation. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 8ba6ca134e52411ce18f29b553dbfedb42b8ed3e +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:08 2026 -0400 + + security-misc: silence expected pam_exec journal noise via quiet_log + + - The [success=1 default=ignore] pam_exec lines run helper scripts that + exit 1 on their expected control-flow path, emitting an alarming + 'pam_exec(...): ... failed: exit code 1' journal line. Plain 'quiet' + suppresses only the user-facing message, not the log. + - Add 'quiet_log' (linux-pam >= 1.5.2, present on bookworm+) to every + skip-logic pam_exec line (console-lockdown, unix-faillock, + faillock-preauth, wheel), leaving the control flow byte-identical. + - Update the scripts' comments to point at the resolution. + + Note: not verified on a live login journal (needs a real PAM stack); + the change is additive and semantics-preserving regardless. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 8c991dd34247e7cc43843a1dff6d5300330646f1 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:39:52 2026 -0400 + + security-misc: compile emerg-shutdown once at postinst, not every boot + + - emerg-shutdown.c was recompiled into /run on every boot. Move the + compile to a standalone build-emerg-shutdown run from postinst, which + installs /usr/bin/emerg-shutdown. Compiling on-target keeps the package + Architecture: all while still producing a correct per-arch static binary. + - Boot-time emerg-shutdown now just copies /usr/bin/emerg-shutdown into + /run (memlockd-resident), with a fallback build if the binary is absent. + - dracut module ships /usr/bin/emerg-shutdown (exists right after install, + fixing the require_binaries /run chicken-and-egg). + - Sandbox-verified: build-emerg-shutdown produces a static ELF in /usr/bin. + - Strict/style compliance on the touched scripts (waivers for the debconf + maintainer script and the dracut-sourced module). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 942ba8a1902c2c8a0d6cd1921f2b540eb413a217 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:39:33 2026 -0400 + + security-misc: permission-hardener parse filenames with spaces + + - load_state() split config lines on every space, so any entry whose + filename contains a space was mis-fielded: silently skipped (a SUID + binary left un-hardened) or mapped to a corrupted policy entry. + - Recover the filename by parsing options from the right -- a trailing + whitelist keyword, or the mode/owner/group[/capability] tail anchored + by the octal mode. Space-free lines unchanged. + - Add regression test (drives the real script via print-policy) plus its + CI workflow. Canary-verified: fails on the pre-fix parser, passes now. + - Bring the file to strict-mode / shellcheck compliance as required to + touch it (6-directive block, printf, braces). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit ec78b99bb1be3be87fb07b3c269d54dc4f1db113 +Merge: a8f26061 1fcf4967 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 03:30:39 2026 -0400 + + Merge branch 'master' into ai + + Absorb upstream + fork-trunk work (merged PRs #23/#26, CI-workflow + propagation, changelog bump) so the PR diff carries only our own commits. + +commit 52e18f723e37b5e5616ae6681f9e3cd28369e88c +Merge: 2da1f21c eb5b301d +Author: Patrick Schleizer +Date: Wed Aug 12 03:02:01 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit a8f26061e0e199b95077aa20696257bddc3db73d +Author: claude (dev182 e09ec5cf-4ebf-4e1b-88e5-55fbac6ef1d3) +Date: Mon Aug 10 13:56:04 2026 -0400 + + Drain input in USB-controller and config-file lookups + + check-for-usb-controller: grep --quiet exits on the first match and closes + the pipe, sending SIGPIPE to lspci. Under pipefail the pipeline then reports + 141, so the guarding if takes the false branch even when a USB controller is + present. Let grep read the whole stream and redirect to /dev/null instead. + + mmap-rnd-bits: head -n 1 has the same early-close hazard against ls; use + sed -n '1p', which consumes all input, for consistency. Drop the redundant + duplicate set -euo pipefail line already covered by the long-form preamble. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit eb5b301db6069a5ccabf327745a000053ece1475 +Merge: a5655e63 2da1f21c +Author: Aaron Rainbolt +Date: Sun Aug 9 12:06:37 2026 -0400 + + Merge branch 'master' into arraybolt3/trixie + +commit a5655e632e2d67a1ef9ff1c1b998d179fc9c71d8 +Author: Aaron Rainbolt +Date: Sun Aug 9 01:46:03 2026 -0400 + + Fixes and TODOs + +commit 21048819c7b1c06c3f7ebee845e2332fa7c93ba8 +Merge: dc1a17c2 1ec153c3 +Author: Aaron Rainbolt +Date: Sun Aug 9 01:04:49 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit 1ec153c3f0db147e82f9d6c4c82b5a1026eada7b +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Fri Aug 7 07:17:03 2026 -0400 + + fix shellcheck directives for an isolated CI checkout + + The gate passed locally but failed (or would fail) in CI. Cause: CI checks + each repo out ALONE, while locally they sit side by side as submodules + under derivative-maker/packages. A '# shellcheck source=' climbing out of + the repo ('../../../../helper-scripts/...') therefore resolves here and + not there, so shellcheck reports SC1091 and the gate fails on a commit + that looked clean. + + The source= paths are kept -- they document where the file actually lives + -- and each is paired with a 'disable=SC1091' so an absent sibling is + tolerated. Same shape already used in security-misc master. + + Follow-on findings from the same isolated run, each with a stated reason + rather than a blanket waiver: + - SC2154 on systemd_notify: assigned by the sourced systemd-notify.bsh, + which shellcheck can no longer follow. + - SC2034 on SCRIPTNAME and output_cmd: genuinely unused. suspend-pre's + output_cmd toggle is vestigial -- unlike suspend-post the script prints + directly -- flagged rather than removed, since wiring it up or dropping + it is a maintainer call. + - SC1090 on the uwt.d conf glob: a dynamic source, which R-081 prescribes + SC1090 for. + + Verified with a new reproducer, ~/strict-pass-tests/ci-repro.sh, which + clones the repo on its own and runs the real gate there -- the condition + CI actually sees. All six repos: gate exit 0. + + Co-Authored-By: Claude Opus 5 (1M context) + +commit 9d6c4634a056c0711d3a42b8c3e4c876b93ec001 +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Wed Aug 5 13:57:59 2026 -0400 + + security-misc: R-010 strict for the remaining standalone scripts + + Covers the eleven remaining standalones, plus the whole-file debt the gate + surfaces on each: echo -> printf (R-034), 'has' instead of 'command -v' + (R-090, sourcing has.sh -- security-misc-shared already Depends on + helper-scripts), safe-rm (R-120), SC2250 braces. + + permission-lockdown needed care. Its loop chmods every home directory and + records a state file per user, and it tolerated per-user failures: a + directory it could not chmod did not stop the ones after it. Under errexit + the first failure aborted the whole loop, so every remaining home directory + silently stayed un-locked-down -- observed in the sandbox as 1 user + processed instead of 11, and the script exiting 1 rather than 0. The two + per-user operations are now explicitly best-effort, restoring the original + behaviour (including that a failed chmod still records the state file -- + arguably wrong, but changing it is not this pass's business). + + mmap-rnd-bits keeps its 'ls -1 -t /boot/config-* | head -n 1' with a + reasoned SC2012 disable: kernel config filenames carry no spaces or + newlines, so the parsing hazard is unreachable, and rewriting newest-file + detection in a security package is risk without gain. + + Not touched, deliberately: the dracut modules under + usr/lib/dracut/modules.d*. 'module-setup.sh' is SOURCED by dracut at + initramfs build time, and remount-secure.sh is installed with 'inst_hook' + and SOURCED by dracut-lib at BOOT. A strict-mode block in either runs in + dracut's own shell; in the boot case that risks an unbootable system. + + Sandbox differential vs the pre-change scripts, comparing output AND exit + code: 36 cases identical. The only two remaining deltas are 'set -x' traces + of the preamble and of echo -> printf, both at unchanged exit codes. + + Co-Authored-By: Claude Opus 5 (1M context) + +commit 59b3e60b2627a9eeda0f4e7cbd4804958cabedd3 +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Wed Aug 5 13:57:39 2026 -0400 + + security-misc: R-010 strict for the PAM helpers, preserving exit codes + + These four scripts are invoked by pam_exec and their EXIT CODE is the + security decision: the PAM stacks use '[success=1 default=ignore]', so the + code selects whether the next module runs. Strict mode must not perturb it. + + PAM_SERVICE and PAM_USER come from pam_exec's environment. Read bare under + nounset they abort the script with a NONZERO status, which PAM then reads + as a control-flow decision. Each is now read as '${VAR:-}', which + reproduces today's semantics exactly (an unset value falls through to the + same branch it already took). + + pam-abort-on-locked-password was the sharp case. It documents "identifiable + exit codes in case stdout / stderr is not logged in journal"; with PAM_USER + absent it returned 3 ("user does not exist"), and a bare read turned that + into 1. Verified restored. + + Exit-code matrix, old vs new, all matching: + PAM_SERVICE=login -> pam_only_if_login 1, pam_only_if_su 0 + PAM_SERVICE=su -> pam_only_if_login 0, pam_only_if_su 1 + PAM_SERVICE=sshd -> both 0 + PAM_SERVICE empty -> both 0 + PAM_SERVICE absent -> pam_only_if_login 0, pam_only_if_su 0, + pam_faillock_not_if_x 1 + PAM_USER root / nonexistent / absent -> pam-abort 3 in every case + + Co-Authored-By: Claude Opus 5 (1M context) + +commit a2b13848b6a2189c0bda2b478f5ac1b0f9c88819 +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Wed Aug 5 13:57:22 2026 -0400 + + security-misc: R-010 strict for the module-disabled alert scripts + + The thirteen disabled-*-by-security-misc scripts are near-identical: they + warn that a kernel module was blocked and exit 1. Add the strict preamble + and convert echo -> printf (R-034). + + The '$@' inside the message becomes '$*' deliberately. Under printf, + "...$@" expands to one argument per positional parameter, so a multi-word + invocation would print one word per line; '$*' joins with spaces, which is + what echo did. + + Sandbox differential vs the pre-change scripts: all thirteen byte-identical + in output and still exit 1. + + Co-Authored-By: Claude Opus 5 (1M context) + +commit 1fcf496705dd9b44ca62d01f737ffb9c6355e715 +Merge: e59019a5 e8e9fd4f +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat Aug 1 05:01:13 2026 -0400 + + Merge pull request #23 from org-ai-assisted/ai-claude-review-mention-only + + consumer-claude-code: mention-only triggers (propagated from template) + +commit e59019a54fb525d7cf884f10d26226efb1d8ab21 +Merge: 2da1f21c 32cb7a2f +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat Aug 1 05:01:08 2026 -0400 + + Merge pull request #26 from org-ai-assisted/ai + + CI: add codeql-actions + secrets-audit scanner workflows + +commit 2da1f21cb66cd52b04c7d25b7053524cd6cd6611 +Author: Patrick Schleizer +Date: Sat Aug 1 08:12:04 2026 +0000 + + bumped changelog version + +commit 32cb7a2f36105a23bed0562293901e3799cd7892 +Author: claude (dev142 b93fb2c6-e15f-4d45-8566-f3ded893b70e) +Date: Fri Jul 31 16:23:30 2026 -0400 + + CI: propagate codeql-actions + secrets-audit consumer workflows + + Byte-identical propagation from developer-meta-files + consumer-templates. Closes scanner-coverage gaps + (bandit already present): + + - consumer-codeql-actions.yml: CodeQL 'actions' language -- + workflow-YAML security analysis (script-injection, missing + permissions, unpinned actions). + - consumer-secrets-audit.yml: manual-dispatch secrets surface + audit (presence flags only, values never emitted). + + Managed files -- do not hand-edit; regenerated on the next + propagation pass. + + ## AI-Assisted + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 83b8f6650bae86e75258e4643ec7c8a273993919 +Merge: f8c82a87 f0478e7b +Author: Patrick Schleizer +Date: Fri Jul 31 13:16:34 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit f0478e7b7cff57d8002501d17c8196889de66a27 +Merge: f8c82a87 4b410ccd +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Fri Jul 31 10:22:34 2026 -0400 + + Merge pull request from org-ai-assisted/ai + + ci: gate the local workflows on CI_ENABLED_ORG_AI_ASSISTED + +commit 4b410ccda527cf1f28d9d5eb8a4ea2a0ad7965ee +Author: claude (dev138 9b889944-0a22-45e7-8fd6-c189113e33b9) +Date: Fri Jul 31 09:38:10 2026 -0400 + + ci: gate the local workflows on CI_ENABLED_ORG_AI_ASSISTED + + Our workflows ran wherever the branch landed. Merged upstream they burn + Kicksecure/Whonix runner quota and post our CI into repos that never + asked for it; on a contributor fork they run the whole suite unbidden. + Only 5 of 136 workflow files across the fleet carried any owner gate. + + Gate: a job-level `vars.CI_ENABLED_ORG_AI_ASSISTED == 'true'`, set once + as an organization variable on org-ai-assisted. Zero runner cost -- a job + whose `if:` is false never allocates one -- and the run still reports + green, so upstream and forks are not handed a red X for a lane they did + not opt into. A fork that WANTS the lane sets the same variable in its + own repo; no patch to these files, no fork of our workflows. + + ANDed in front of any existing fork-PR guard rather than replacing it. + + Verified: the workflow-yaml validator reports 0 findings for this repo. + + Generated with assistance from Claude Code. + +commit e8e9fd4fae34474d5d1a96c516ddfd1913b7fd82 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Thu Jul 30 11:59:15 2026 -0400 + + consumer-claude-code: propagate the corrected template + + Byte-identical to developer-meta-files consumer-templates. + + The github.ref comment was wrong for one of the two events it described: + issue_comment fires with the default branch ref, pull_request_review_comment + with the PR merge ref (refs/pull//merge). No behaviour change -- the + concurrency group reaches github.ref only if neither number field is set, and + one always is for the events this workflow accepts. + + Generated with assistance from Claude Code. + +commit 867809170a265b269a34f6d704c97ec53744cd4d +Author: Ashlen +Date: Wed Jul 15 19:06:42 2026 -0600 + + fix(pam): pass profile names to pam-auth-update --remove + + 'pam-auth-update --remove' matches pam-config filenames under + /usr/share/pam-configs/, but prerm and postrm passed + $DPKG_MAINTSCRIPT_PACKAGE -- the package name security-misc-shared -- + which matches no profile. An unknown target is stored without + validation and simply never matches, so the --remove was inert in + both calls: the prerm call was an effective no-op, while the postrm + call still performed a plain reconciliation. + + The prerm early-disable was therefore dead. On removal + /etc/pam.d/common-* kept referencing helper scripts under + /usr/libexec/security-misc/ that dpkg then deleted; + block-unsafe-logins is a Priority 1100 'requisite' entry, so a + dangling reference fails all authentication until postrm's + reconciliation regenerates common-* -- permanently, if postrm fails + before that point. + + prerm now passes the eight profile filenames explicitly. postrm + drops the ineffective '--remove ' for a plain + reconciliation and guards it with 'command -v': Debian Policy 7.2 + gives no guarantee that dependencies are available when postrm runs + and requires postrm to gracefully skip such actions, and an absent + pam-auth-update would abort the script under 'set -e'. prerm stays + unguarded: Policy names Depends (here libpam-runtime) as the + mechanism prerm scripts rely on, dependencies there normally being + at least unpacked. + + One consequence of a '--remove' that now takes effect: it also drops + the eight names from /var/lib/pam/seen. If a removal is aborted, + postinst's 'pam-auth-update --package' re-enables the seven + 'Default: yes' profiles among them, including any of them an + administrator had deliberately disabled (other packages' profiles + remain in seen and are unaffected), while + console-lockdown-security-misc ('Default: no') stays off until an + administrator re-enables it -- reinstalling does not restore it, + since preinst's enable is behind a do_once stamp. Both are new + relative to the previous inert behavior. + +commit 077d41a6b193787dc31718370c1532d6638569bc +Author: Ashlen +Date: Wed Jul 15 12:54:05 2026 -0600 + + fix(remove-system.map): continue past undeletable files + + The deletion loop called `exit 0` on the first System.map that `[ -w ]` + rejected, so copies in later locations were never shredded. Where + `[ -w ]` passed but shred failed anyway, shred ran as a bare command and + tripped the ERR trap that pre.bsh installs, aborting with a "## Please + report this bug!" banner and exit 1. + + Branch on shred's exit status instead of `[ -w ]`, which does not + predict removability. Unlinking depends on write permission on the + parent directory rather than on the file itself, and an append-only file + passes the test yet cannot be unlinked at all. For a full-capability + root process the check is also true on a mode 444 file, so it only ever + failed on read-only file systems and on files carrying the immutable + attribute. + + Clear the immutable and append-only attributes before each attempt. Per + review, a System.map should never be immutable and `chattr +i` would + possibly complicate kernel package removal; append-only is cleared on + the same grounds, since it blocks removal without affecting `[ -w ]`. + + Report the files that remain once at the end, under a single wiki link + rather than repeating it on every line, and withhold "Done. Success." + when anything failed. A file reachable under two names, such as + /lib/modules//build and the source symlink beside it, is listed + under each, since both matched and both failed. + + Iterate an array rather than word-splitting a string with IFS, which a + /etc/remove-system.map_pre.d drop-in can set; under `IFS=:` the globs + matched nothing, so the script deleted nothing and still exited 0. + + The removal loop no longer exits early on failure and the script ends in + an explicit `exit 0`; a non-zero status would fail the kernel package's + postinst hook and the oneshot unit on every boot. + +commit 5daefde4e8cb4705d8fbe7886f2e003e61e0b974 +Author: claude (dev118 bd22decd-3027-4ab5-9e48-11adfe39b279) +Date: Tue Jul 28 13:50:24 2026 -0400 + + consumer-claude-code: mention-only triggers (propagated from template) + + Byte-identical cp from developer-meta-files/consumer-templates. + + pull_request and workflow_dispatch resolve to claude-code-action's + agent mode, whose trigger is a non-empty 'prompt' input that this + workflow does not pass, so those events could only spin up a runner + and exit without calling the model - a green "Claude Code Review" + check that reviewed nothing. + + Co-Authored-By: Claude + +commit f8c82a87f207eee40dad64e0d090be5cd2858b76 +Author: Patrick Schleizer +Date: Tue Jul 28 13:20:23 2026 +0000 + + bumped changelog version + +commit ec941913e9bf1ad4e33a8146812cfe3c07cde956 +Merge: d1381a0c a5420ffb +Author: Patrick Schleizer +Date: Tue Jul 28 08:12:04 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit d1381a0c16ca62d8ac61fa00dcc5d760b8f5d106 +Merge: 2ac7df95 dc1a17c2 +Author: Patrick Schleizer +Date: Tue Jul 28 07:44:23 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit a5420ffb35edf92c0c953b09cd31580cd74c1d27 +Author: claude +Date: Tue Jul 28 06:17:17 2026 -0400 + + consumer-codex-review: drop OPENAI_API_KEY forward to the disabled reusable + + Propagates org-ai-assisted/developer-meta-files#167. The reusable is a no-op + stub (job 'if: false') and no longer declares an OPENAI_API_KEY secret; + forwarding an undeclared secret is rejected by GitHub at workflow startup + (startup_failure). Dropping the forward lets the no-op run green; Codex review + stays cleanly disabled. + + Co-Authored-By: Claude Opus 4.8 + +commit dc1a17c2c3047cc985a121275792460f1dbb5730 +Merge: 7f55b21b da942f8b +Author: Aaron Rainbolt +Date: Mon Jul 27 21:04:57 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/pam-info-empty-deny-fallback' into arraybolt3/trixie + +commit da942f8b9dcbbc9fd62777181b99d3b6e97b41a0 +Author: Ashlen +Date: Wed Jul 15 13:23:54 2026 -0600 + + fix(pam-info): restore deny default when faillock.conf lacks it + + When /etc/security/faillock.conf has no uncommented "deny =" line + (commented out, or written without spaces), the parse overwrites the + deny=3 default with an empty string. The empty value slips past the + [[ "$deny" == *[!0-9]* ]] numeric guard, then evaluates to 0 in the + remaining-attempts arithmetic, producing a false "Login blocked, boot + into recovery mode" message for users still well below the threshold. + + Fall back to the documented default of 3 when the parse yields empty. + +commit 2ac7df95d287e98bccae5c583f4d3ac33575da36 +Merge: 7f55b21b e645c7c1 +Author: Patrick Schleizer +Date: Thu Jul 23 08:18:02 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit e645c7c17913ca72ed1a4c593d9c6edc95c0457c +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Wed Jul 22 10:21:24 2026 -0400 + + consumer-claude-code: forward CLAUDE_CODE_OAUTH_TOKEN (claude review OAuth port) + +commit b684685bd03755c79b823076d111b29541469491 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue Jul 21 09:05:41 2026 -0400 + + Coverity: point CI at the org-ai-assisted-security-misc project (#22) + + project-name -> org-ai-assisted-security-misc; canonical-repos -> org-ai-assisted/security-misc. Project registered + repo COVERITY_SCAN_TOKEN set. + + AI-Assisted + + Co-Authored-By: Claude Opus 4.8 + +commit 7f55b21b018a8133a2ab5cc82bc5145caa8f0174 +Author: Patrick Schleizer +Date: Tue Jul 21 09:23:19 2026 +0000 + + bumped changelog version + +commit 2b0422a2dab93fd29393b7e400a07dc5b75a8da4 +Merge: f5e6783a 545c9430 +Author: Patrick Schleizer +Date: Tue Jul 21 04:18:24 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 545c94307bd7dcdcefe67c8061b8dd18caf17b79 +Author: Aaron Rainbolt +Date: Sun Jul 19 20:14:13 2026 -0400 + + printf + +commit 46e87db6d5d7d7071d3766a5f9b20b880cd54b10 +Author: Aaron Rainbolt +Date: Sun Jul 19 20:12:46 2026 -0400 + + end-of-options + +commit e9b3374a305ace3d6c40cc5143627e31c38602b2 +Merge: b9a492bb 90b514c7 +Author: Aaron Rainbolt +Date: Sun Jul 19 20:09:33 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/hide-hardware-info-getent' into arraybolt3/trixie + +commit b9a492bb071a4726672f0b0c14a7586c60536e21 +Author: Aaron Rainbolt +Date: Sun Jul 19 19:46:33 2026 -0400 + + Revert "udev: mark optical drives UDISKS_IGNORE (quiet + harden)" + + This reverts commit 41638e64911a7f019b32cacd5a368ec480fcc21a. The change + was made to avoid a spurious error in CI, and the underlying issue has + been fixed in a different way now, so this is no longer needed. + +commit aab24f84e4677d9447d339c5f6ee0699f8e0b97b +Author: Aaron Rainbolt +Date: Sun Jul 19 19:23:52 2026 -0400 + + Don't use required dependencies in emerg-shutdown to keep systemd from terminating it when the boot drive is removed + +commit 097880e26749bc874ba266cadaa84a8a3925dc4a +Merge: 0a4386b1 81096c4b +Author: Aaron Rainbolt +Date: Sun Jul 19 18:03:32 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/emerg-shutdown-fd-leak-sigsys' into arraybolt3/trixie + +commit 0a4386b1927a76f0d3d6010d33bd9f1b5b23af89 +Author: Aaron Rainbolt +Date: Sun Jul 19 18:03:01 2026 -0400 + + Swallow signals in emerg-shutdown's hardware monitor mode too + +commit 7d1553c5136942c38c59d4d5c8cec673e2ba1f06 +Merge: f5e6783a 6dc96859 +Author: Aaron Rainbolt +Date: Sun Jul 19 11:47:42 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/virusforget-error-handling' into arraybolt3/trixie + +commit f5e6783afe645a9bded31e63241d2b76f9945807 +Merge: f9853503 57b0072b +Author: Patrick Schleizer +Date: Sun Jul 19 03:40:40 2026 -0400 + + Merge remote-tracking branch 'org-ai-assisted/master' + +commit f9853503c5847d960d83499c6d8ef02ce8e045fd +Merge: b39215e4 f3a060ed +Author: Patrick Schleizer +Date: Sun Jul 19 03:39:58 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit f3a060ed528a66f3524206a22108b59e3de67ef2 +Merge: 89745aab 6f3f6425 +Author: Aaron Rainbolt +Date: Sun Jul 19 01:28:06 2026 -0400 + + Merge remote-tracking branch 'maybebyte/docs/config-section-numbering' into arraybolt3/trixie + +commit 89745aabf7931aad32ea437b6e644146a63d46a3 +Merge: 27009709 b39215e4 +Author: Aaron Rainbolt +Date: Sun Jul 19 01:19:36 2026 -0400 + + Merge branch 'master' into arraybolt3/trixie + +commit 2700970971f97a732ef1d53c407c8e2e6d2b575d +Author: Aaron Rainbolt +Date: Sun Jul 19 01:08:29 2026 -0400 + + Fix messaging when a file with multiple hardlinks is skipped over + +commit 7a603055bf11f7d0d4162d4c437aa95f034ebb89 +Author: Aaron Rainbolt +Date: Sun Jul 19 00:55:13 2026 -0400 + + Fix output when permission-hardener encounters a file with multiple hardlinks + +commit 9a3e8851404f6e6a1fa1fcfefebe68b17dd6dbb7 +Merge: 98c27d90 1625a3db +Author: Aaron Rainbolt +Date: Sun Jul 19 00:48:40 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/permission-hardener-whitelist-and-errexit' into arraybolt3/trixie + +commit 57b0072b0194848b5bc3816efb4b243bba343141 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat Jul 18 20:00:25 2026 -0400 + + Coverity: point CI at the org-ai-assisted-security-misc project + +commit b39215e47fc127ef41951b7d686237c1e48dc9ba +Merge: 4ed85e1f 26ef321b +Author: Patrick Schleizer +Date: Sat Jul 18 16:26:00 2026 -0400 + + Merge remote-tracking branch 'org-ai-assisted/master' + +commit 4ed85e1f6114fa74debc17b88eeb165c4f8afc15 +Merge: 59decfa2 98c27d90 +Author: Patrick Schleizer +Date: Sat Jul 18 16:24:30 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 98c27d9074f31cfeb006ecce1aef10a90e06a8c7 +Merge: c3ec2119 b076e2c0 +Author: Aaron Rainbolt +Date: Fri Jul 17 21:12:46 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/ensure-shutdown-nounset-default' into arraybolt3/trixie + +commit c3ec2119b2fa7e8c172fe7a63686b98e66b3c35e +Merge: 59decfa2 1a71a3e9 +Author: Aaron Rainbolt +Date: Fri Jul 17 21:02:54 2026 -0400 + + Merge remote-tracking branch 'assisted-by-ai/claude/comment-bdev-allow-write-aYEla' into arraybolt3/trixie + +commit 26ef321b73377254da64007362fdadfa602fb384 +Merge: 55c087cc 41638e64 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Wed Jul 15 23:46:34 2026 -0400 + + Merge pull request #20 from org-ai-assisted/udisks-ignore-optical + + udev: UDISKS_IGNORE optical drives + +commit 41638e64911a7f019b32cacd5a368ec480fcc21a +Author: assisted-by-ai +Date: Wed Jul 15 23:34:07 2026 -0400 + + udev: mark optical drives UDISKS_IGNORE (quiet + harden) + + udisks auto-probing removable optical media (sr*) is noisy -- on a drive with no + or inert media (e.g. a VM CD-ROM) it errors repeatedly ('udisksd: Error probing + device: Error sending ATA command IDENTIFY PACKET DEVICE to /dev/sr0') -- and is + avoidable attack surface: inserted media should not be auto-processed without + user action. Add a udev rule marking optical drives UDISKS_IGNORE. This does NOT + affect booting the live ISO from optical media: rd.live mounts the medium in the + initramfs, not via userspace udisks. (AI-Assisted.) + +commit 90b514c7cdc33fa8237cf19b8e7a49827290de44 +Author: Ashlen +Date: Wed Jul 15 16:43:40 2026 -0600 + + fix(hide-hardware-info): look up group with getent + + The sysfs/cpuinfo whitelist gated its chgrp/chmod on + `grep -q "${1}" /etc/group`, an unanchored substring match over the + whole file. A group whose name merely contains the string, or a user + listed as a member of any group, produced a false positive: the branch + ran chgrp against a group that does not exist (silently swallowed by + `|| true`) and suppressed the "group does not exist" warning, so an + admin who never created the group was told nothing. + + Use `getent group "${1}"` instead. It matches by exact group name or + GID and consults NSS, so groups from non-file sources are recognized + as well. + + Co-Authored-By: Claude Opus 4.8 + +commit 6f3f6425eed69a50fe747262ce8d62d365432273 +Author: Ashlen +Date: Wed Jul 15 12:28:01 2026 -0600 + + docs: correct section numbering in config comments + + The sysctl config header claimed 5 sections while its list + enumerates 6 (through CD-ROM/DVD); update the count to 6. + + The modprobe config's Networking section header read "2.", + duplicating the File Systems section, while its own table of + contents and the following "4. Miscellaneous" section imply 3; + correct it to "3.". + +commit 1625a3db8fbb94da8c5558c52d9b7b481ce031cd +Author: Ashlen +Date: Wed Jul 15 12:15:57 2026 -0600 + + fix(permission-hardener): skip hardlinked files instead of aborting + + output_stat returned 1 for a non-directory SUID/SGID file with a + hardlink count > 1. The four call sites invoke output_stat as a bare + command under `set -o errexit`, so that return propagated and + terminated the whole run instead of skipping the file. The following + `if [ -z "${file_name_from_stat}" ]` guard never caught this case + because file_name_from_stat was already populated. + + The surrounding comment states hardlinked files are meant to be + skipped (scanning a hardlink pool is too costly). Blank the output + vars and return 0, matching the existing nonexistent-file skip path, + so the caller's empty-name check continues past the file. Genuine + error paths (stat failure, parse corruption) still return 1 and fail + loud. + +commit 4af4392bc3f2c37784d11a6b49cb1b9eb7d9c3d9 +Author: Ashlen +Date: Wed Jul 15 12:15:22 2026 -0600 + + fix(permission-hardener): prevent fail-open on empty matchwhitelist + + check_nosuid_whitelist iterated with + "${policy_match_white_list[@]:-}". Under `set -o nounset` the `:-` + default expands an empty array to a single empty-string element, so + the loop ran once with an empty entry. The body test + `[[ "${target_file}" == *""* ]]` matches every string, so the + function returned 1 (whitelisted) for every file. Both callers use + `|| continue`, so an effective config with no `matchwhitelist` line + silently skipped all SUID/SGID hardening with exit 0 -- a fail-open. + + Expand with ${arr[@]+"${arr[@]}"} instead, which yields no elements + when the array is empty and does not trip nounset. + +commit 81096c4b8fd58b42c04c486e89b1ff016365f62a +Author: Ashlen +Date: Wed Jul 15 11:45:21 2026 -0600 + + fix(emerg-shutdown): swallow SIGSYS in signal-ignore loop + + max_sig_num is 31, but the SIG_IGN loop used a strict "<" bound, so it + covered signals 1..30 and never touched signal 31 (SIGSYS on Linux). + The real-time loop starts at SIGRTMIN, leaving SIGSYS covered by neither + loop, so it kept its default terminate disposition despite the "Swallow + all signals that we can." intent. + + Use "<=" so the loop reaches 31; SIGSYS is ignorable, and the bound + still stops before the glibc-reserved signals 32 and 33. This is a + robustness fix, not a hardening gain: SIGKILL and SIGSTOP are unblockable + anyway, so an actor able to send SIGSYS can already kill the monitor -- + the value is surviving an internally generated SIGSYS (e.g. a bad + syscall). + +commit 5bb3f0114bc6941506d432018487c35c3c19032d +Author: Ashlen +Date: Wed Jul 15 11:44:40 2026 -0600 + + fix(emerg-shutdown): close fds for non-panic input devices + + The input-device enumeration loop opens a descriptor for every + /dev/input/eventN but only stores it for devices that support the + panic-key combo. The two early-continue paths -- non-key devices and + keyboards lacking the panic keys -- returned without closing tmp_fd, + leaking one descriptor per non-qualifying device. + + The leak is bounded and one-time (the loop runs once at startup, not in + the poll loop) so impact is low, but the descriptors are held for the + whole process lifetime and never reclaimed -- the daemon never execs, + so O_CLOEXEC does not cover them. Close tmp_fd before both continues. + +commit b076e2c0b3a8a83fe2b11dc1b09b1c9f72301db6 +Author: Ashlen +Date: Wed Jul 15 11:25:07 2026 -0600 + + fix(ensure-shutdown): apply timeout default under nounset + + The script runs under 'set -o nounset'. When no config file assigns + ENSURE_SHUTDOWN_TIMEOUT, the bare "${ENSURE_SHUTDOWN_TIMEOUT}" in the + fallback guard raises an unbound-variable error and aborts before the + guard can apply the default, so ExecStart never starts the shutdown + monitor. Add the ':-' default in the -z test so the guard runs and + falls back to 30. The sibling emerg-shutdown wrapper avoids this by + pre-initializing its config variables before sourcing. + +commit 6dc96859dd7f350673cc917a8c41da8144357e62 +Author: Ashlen +Date: Wed Jul 15 10:59:09 2026 -0600 + + fix(virusforget): exit when --user does not exist + + The nonexistent-user branch printed a warning but, unlike every sibling + validation branch, neither exited nor wrote to stderr, so a mistyped + --user proceeded to operate on a bogus /home/ path. Send the error + to stderr and exit 1. + +commit a39b03ac2e18a83f73e4e320481323fc8ef8a795 +Author: Ashlen +Date: Wed Jul 15 10:58:42 2026 -0600 + + fix(virusforget): skip restore when backup is absent + + An extraneous file (present in the home directory but absent from the + committed backup) is deleted and then unconditionally passed to + restore_file, which runs `cp` from a backup path that does not exist. + Under `set -e` this aborts the entire `--clean` run on the first such + file, leaving the system partially cleaned -- the exact + malware-persistence scenario the tool exists to handle. + + Return early from restore_file when no backup exists. Deleting the + extraneous file is the correct action and is already done by the caller + (which keeps a forensic copy under the dangerous/ folder). The guard is + transparent to the missing-file and modified-file callers, which always + have a backup present. + +commit 55c087cc9bda321db860541f9030207a59505cb7 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Jul 13 11:48:30 2026 -0400 + + codeql-prepare: multi-line case arms (R-070) + complete strict-mode block (#19) + + Expand the two compact case arms to the fully multi-line form per R-070. + The touched file was 4/6 on the R-010 strict-mode block; add the missing + 'shopt -s inherit_errexit' and 'shopt -s shift_verbose' so it is fully green. + No behavior change. + + Co-authored-by: claude (dev71 31548627-e7c1-43cd-bd41-8b0900c72576) + +commit 59decfa257b7a560691183945e9c4ec1830d7241 +Author: Patrick Schleizer +Date: Wed May 20 22:20:10 2026 +0000 + + bumped changelog version + +commit be771dea0be5bf34c13bb4ab0054199934eb4dc8 +Author: Patrick Schleizer +Date: Wed May 20 16:57:12 2026 -0400 + + genmkfile uch + +commit f4d078d00a6e5c34a8c1e066ebd381604e8c0986 +Author: Patrick Schleizer +Date: Mon May 18 10:14:14 2026 +0000 + + bumped changelog version + +commit a93dca3366d99a5088ca9f03080be2c016c2d5bc +Merge: 8da4e1ef 8276e4e2 +Author: Patrick Schleizer +Date: Sun May 17 16:22:55 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 8276e4e2238fb6c8770189f20cbc9aee22e67c87 +Merge: 8da4e1ef 9ebe7128 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 17 14:02:54 2026 -0400 + + Merge pull request #18 from org-ai-assisted/claude/fix-dependabot-action-UnL7w + + dependabot.yml: drop docker block (sync to new canonical) + +commit 9ebe71282f7b4394e87e6db45f7f9219cd322007 +Author: Claude +Date: Sun May 17 17:59:44 2026 +0000 + + trim file commentary + +commit c67f2ea60336a6819b4724836cec426f12b7f5ed +Author: Claude +Date: Sun May 17 17:43:21 2026 +0000 + + dependabot.yml: drop docker block (sync to new canonical) + + The previous canonical at + developer-meta-files/consumer-templates/.github/dependabot.yml + carried a docker package-ecosystem block on the documented theory + that the block was a "harmless no-op" in repos without a + /Dockerfile. That theory was wrong: the dependabot-action errors + with `dependency_file_not_found` and aborts the whole job - + including the github-actions ecosystem run that shares it - so + this repo lost its github-actions Dependabot coverage too. + + Sync to the new canonical, which carries github-actions only. + + See org-ai-assisted/developer-meta-files PR #105 for the + canonical change and the docker-bearing-repo opt-out mechanism. + +commit 8da4e1ef7b5e1dd3c217d9ae59c3d56ab6b052da +Merge: 2b3e644c 493de5e4 +Author: Patrick Schleizer +Date: Sat May 16 17:15:01 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 493de5e4741a5cf6f1adb20a6c9354760b208678 +Merge: 2b3e644c 6627cff0 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat May 16 16:03:37 2026 -0400 + + Merge pull request #17 from org-ai-assisted/claude/security-misc-real-stdisplay-pyqt-and-install-deps + + ci: real stdisplay + PyQt5 + install-deps composite action; drop conftest stubs + +commit 6627cff0563b4f17b49e36bd5dc768e9de0f69ab +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat May 16 13:54:45 2026 -0400 + + ci: real stdisplay + PyQt5 + install-deps composite action; drop conftest stubs + + ci/tests/fm_shim_frontend/conftest.py stubbed two heavy module-level + imports in fm_shim_frontend.fm_shim_frontend to let the property + tests import the URI-validation function without bringing up Qt or + installing the helper-scripts Debian package: + + - stdisplay (helper-scripts Debian package) - identity stub + - PyQt5.{QtCore,QtGui,QtWidgets,sip} - fake module whose + __getattr__ synthesizes a fresh type() per name + + The file already carried a TODO to remove both: "We can install + helper-scripts before running the tests to get stdisplay, and as + long as the test code paths don't call QApplication(), the crash + during test issue should be avoidable." + + This commit does that: + + - local-python-lint.yml switches from apt-install-with-cache to + the developer-meta-files install-deps composite action, which + installs apt deps + genmkfile + helper-scripts (the latter + provides stdisplay). PyQt5 was already in the apt list + (python3-pyqt5 + python3-pyqt5.sip), so the real Qt classes + are available now too. + + - conftest.py is deleted. Property tests now run against the + production modules end-to-end (the QApplication() call only + fires inside fm_shim_frontend's main(), which the test never + invokes - it imports get_path_list_from_uris directly). + + - local-dbus-fuzz.yml also switches to install-deps for + consistency (same composite-action pattern); ci/dfuzzer-build.sh + header comment updated to point at install-deps instead of + apt-install-with-cache. + + Same shape as the recent msgcollector simplification (PR #21): + let install-deps handle apt + genmkfile + helper-scripts in one + step. + +commit 2b3e644c750962592ad87d0c95cdd7bdd8ecbb77 +Author: Patrick Schleizer +Date: Sat May 16 06:08:34 2026 -0400 + + add .github/dependabot.yml + +commit 86ef7582223b9a3a622bc1b9dd5bedc576776c89 +Author: Patrick Schleizer +Date: Sat May 16 06:01:50 2026 -0400 + + update .github/workflows/consumer-bandit.yml + +commit 873ba695c7e74bcef4efbc93a13557adfd01d658 +Merge: 79a9fb9b a4465cd7 +Author: Patrick Schleizer +Date: Sat May 16 05:27:53 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit a4465cd76fc9c05cb75b7d4f4c8ba0cbbcb6a7c6 +Merge: 79a9fb9b e0ed0b33 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat May 16 04:42:50 2026 -0400 + + Merge pull request #16 from org-ai-assisted/claude/fix-cppcheck-tar-error-0qNYv + + ci: use apt-install-with-cache composite action; drop broad restore-keys + +commit e0ed0b331aa8bd983fd0ec6624a6bf4481223682 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Fri May 15 20:02:27 2026 -0400 + + ci: use apt-install-with-cache composite action; drop broad restore-keys + + Both local-dbus-fuzz.yml and local-python-lint.yml used + `path: /var/cache/apt/archives` with `sudo chown -R` on the system + dir + a broad `restore-keys:` prefix. Three problems: + + 1. Same `tar: partial/: Permission denied` cache-save warning as + the developer-meta-files reusables (apt\'s _apt:root 0700 + partial/ subdir is unreadable by the runner; chown doesn\'t + help because apt-get install recreates partial/ 0700 every + run). + + 2. `restore-keys:` violates agents/github-actions.md G-A-007 + ("no broad restore-keys, no pull_request_target + cache" - + cache-poisoning risk). The cache-key already includes + hashFiles() so a config change naturally invalidates; + restore-keys would defeat that. + + 3. Duplicated `Prepare apt cache directory` + `Cache apt packages` + YAML across two workflows. + + Fix: replace those steps with one composite-action call: + + - uses: org-ai-assisted/developer-meta-files/.github/actions/apt-install-with-cache@master + with: + packages: \'\' + cache-key: ${{ runner.os }}-apt--${{ hashFiles(...) }} + + The composite action caches `~/.apt-deb-cache` (runner-owned, no + system-dir permission gymnastics) and sudo-copies .debs in/out of + /var/cache/apt/archives around apt-get install. apt\'s normal + permission model is preserved. + + local-dbus-fuzz.yml additionally: + + - ci/dfuzzer-build.sh is refactored to drop its `Phase 1` apt + install. The package list moves into the workflow (passed to + the composite action), where it lives alongside the cache key + that invalidates on changes. dfuzzer-build.sh now only + does the `Phase 2` build from upstream source. + + Depends on org-ai-assisted/developer-meta-files#92 (which adds + the composite action). This PR\'s CI will pass once #92 merges. + +commit 79a9fb9b7b9640e5a56f798ca3c4057ce8e4accb +Author: Patrick Schleizer +Date: Fri May 15 18:40:53 2026 +0000 + + bumped changelog version + +commit 323f4610b6fbdd0b011aef2d2b42228046d1f0eb +Merge: 899959ae 1c732f20 +Author: Patrick Schleizer +Date: Fri May 15 13:14:54 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 1c732f20949a9e5153b42acbafd925db4853daea +Merge: be8ca04a 91184edd +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 19:56:15 2026 -0400 + + Merge pull request #15 from org-ai-assisted/claude/review-github-actions-IQwcy + + local-python-lint: drop paths filter, always run lint + +commit 91184edd4b6604b005e540cef3d8cb0ca9bf45a4 +Author: Claude +Date: Tue May 12 20:19:31 2026 +0000 + + local-python-lint: drop paths filter, always run lint + + The 3-entry paths filter went stale - the workflow filename + reference and the apt cache key both still pointed at + '.github/workflows/lint-python.yml' from before the G-A-005 + three-prefix rename to 'local-python-lint.yml'. Filter-going- + stale silently skips lint on PRs it should cover. + + Drop the filter so push(master) and pull_request(master) always + run lint. Repo is mixed C/AppArmor/scripts but the lint job is + fast (10-min timeout, ~1 min real). Update the cache hashFiles() + to match the new workflow filename so apt cache invalidates + correctly when this workflow is edited. + +commit be8ca04a9ec12753f5ecf65fe345c7e694535e12 +Merge: fb7ad509 d6b44928 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 16:15:08 2026 -0400 + + local-dbus-fuzz: enable path-filtered pull_request trigger (#14) + + local-dbus-fuzz: enable path-filtered pull_request trigger + +commit d6b4492893bc3032d310db54f5415a2d3cb51e63 +Author: Claude +Date: Tue May 12 20:07:40 2026 +0000 + + local-dbus-fuzz: enable path-filtered pull_request trigger + + dfuzzer (D-Bus) workflow has been verified green via workflow_dispatch + on master. Enable the previously commented-out pull_request trigger + so PRs that touch the fm-shim-backend C source, its compile script, + the dfuzzer build/runner, or this workflow itself get fuzz coverage. + + Also: + - fix stale workflow filename reference (.github/workflows/dfuzzer.yml + -> .github/workflows/local-dbus-fuzz.yml; renamed under G-A-005) + - add ci/dfuzzer-build.sh to the paths filter (it builds the dfuzzer + binary from source - changes here invalidate prior runs) + - rewrite the header comment that described the now-historic + workflow_dispatch-only state. + +commit fb7ad5094fa6b27125c5ea741e0596a235baa50a +Merge: c1139823 d6fc7cff +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 15:28:58 2026 -0400 + + Merge pull request #13 from org-ai-assisted/claude/review-github-actions-IQwcy + + workflow triggers: normalize pull_request to branches: [master] + +commit d6fc7cffb26321ff458dd3980a112448e1bbfe38 +Author: Claude +Date: Tue May 12 19:25:57 2026 +0000 + + workflow triggers: normalize pull_request to branches: [master] + + Propagate dmf canonical updates for consumer-claude-code.yml and + consumer-codex-review.yml: bare `pull_request:` -> + `pull_request: branches: [master]`. Matches the byte-identical + canonical in + developer-meta-files/consumer-templates/.github/workflows/. + + Practical impact: PRs targeting feature branches no longer fire + the AI reviews. The org's typical workflow (feature-branch -> + master PR) is unaffected. + +commit c11398236615009bdad1b039f28073a69a06a4b3 +Merge: 00b6339a 2d503860 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 13:48:31 2026 -0400 + + Merge pull request #12 from org-ai-assisted/claude/review-github-actions-IQwcy + + scorecard: remove consumer-scorecard.yml (org-wide opt-out) + +commit 2d50386036b1db6f074604f4078bf01f1d71daff +Author: Claude +Date: Tue May 12 17:46:00 2026 +0000 + + scorecard: remove consumer-scorecard.yml (org-wide opt-out) + + Per the consumer-template architecture's opt-in-by-file-presence + rule, deleting a consumer-*.yml is the opt-out signal: + pkg_update_consumer_workflows refreshes only files that already + exist on the consumer side; the next propagation pass will not + re-create this. + + Org-wide policy: Scorecard's value-to-noise ratio is low (many + false positives, non-actionable signals). Keeping it only in + derivative-maker (the canonical baseline) where the org-wide + supply-chain signal is most useful. + + Spec: + https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +commit 00b6339a01392db4e0f62143ab0fa08b9177386c +Merge: b128c2b5 bc75ea7d +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 12:47:13 2026 -0400 + + Merge pull request #11 from org-ai-assisted/claude/review-github-actions-IQwcy + + workflows: rename legacy unprefixed to consumer- prefix + +commit bc75ea7d6f0918e89032fa65dcc715217e0a0c5e +Author: Claude +Date: Tue May 12 16:44:41 2026 +0000 + + workflows: align consumer-*.yml byte-identical to dmf canonicals + + Follow-up to the rename commit: in addition to renaming the + files, content must be byte-identical to the canonical wrappers + in developer-meta-files/consumer-templates/.github/workflows/. + + Differences absorbed by this commit: + + - scorecard.yml cron slot: per-repo allocation -> uniform + org-wide '0 6 * * 0' (the canonical's slot). + - Header comments: switched to the standard "Managed by + pkg_update_consumer_workflows" template so contributors see + the propagation contract. + + User-facing `name:` fields unchanged. + + Spec: + https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +commit 2dbf8ade8aa5491b0521a1ed693abc4bca5c7cda +Author: Claude +Date: Tue May 12 16:42:53 2026 +0000 + + workflows: rename legacy unprefixed to consumer- prefix + + Per consumer-template architecture (G-A-005, three-prefix + convention): wrappers around developer-meta-files reusables + carry the `consumer-` prefix. This is the bulk rollout of the + prefix to this repo's universal wrappers. + + Each file is byte-identical to its corresponding canonical in + developer-meta-files/consumer-templates/.github/workflows/. + + User-facing `name:` fields unchanged. cron slots converge on + the org-wide singleton (`0 6 * * 0` for Scorecard) per spec + "Scheduling in byte-identical templates" - GitHub queue + serializes; Scorecard's low value-to-noise ratio makes that + contention acceptable. + + Spec: + https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +commit b128c2b5eabcec49f6de27fa78bc95147505f674 +Merge: d9025962 1abdf11d +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 12:33:30 2026 -0400 + + Merge pull request #10 from org-ai-assisted/claude/review-github-actions-IQwcy + + codeql: migrate to split consumer-codeql-{python,cpp} wrappers + +commit 1abdf11d05d376c716b6114b71702369f398aa53 +Author: Claude +Date: Tue May 12 16:19:47 2026 +0000 + + workflows: rename dfuzzer+lint-python to local- prefix + + Per consumer-template architecture: workflows that live only in + one repo carry the `local-` prefix. Two renames: + + - dfuzzer.yml -> local-dbus-fuzz.yml + (tool name -> surface name; says what's being fuzzed) + - lint-python.yml -> local-python-lint.yml + (reorder to match local-- pattern used in other + repos, e.g. helper-scripts local-python-checks) + + User-facing `name:` fields unchanged. + +commit f6d6f000617268b1c7a0b81c7a859ac900af99e9 +Author: Claude +Date: Tue May 12 16:06:52 2026 +0000 + + bandit: migrate to consumer-bandit wrapper + + Per dmf #69 (reusable-bandit.yml refactor to shebang-aware + discovery). The old bandit.yml passed + `with: paths: usr/lib/python3/dist-packages/fm_shim_frontend` + and `with: prepare-command: ci/codeql-prepare.sh` to symlink + genmkfile-tagged '*.py#tag' files. Both are no longer needed - + the reusable now discovers Python by extension OR by shebang + on its own. + + Changes: + + - Renamed: .github/workflows/bandit.yml -> consumer-bandit.yml, + byte-identical to dmf canonical (no `with:`). + + Behavior change: bandit now scans the whole repo via shebang + discovery (including any Python outside + `usr/lib/python3/dist-packages/fm_shim_frontend`). If new false + positives surface, suppress per-line with `# nosec`. + + ci/codeql-prepare.sh remains in the repo - it's still used by + codeql-python and codeql-cpp jobs (per .github/dm-consumer.yml). + +commit 51cd4202dd5320bcdd71a2db26eb8d5ef0273725 +Author: Claude +Date: Tue May 12 15:59:23 2026 +0000 + + codeql: migrate to split consumer-codeql-{python,cpp} wrappers + + Per dmf #69 (reusable-codeql.yml hard refactor + single-job + per-language wrappers per design decision 3). The old + codeql.yml had two jobs (python + c-cpp) in one workflow; the + new architecture splits these into two separate workflow files. + + Changes: + + - Deleted: .github/workflows/codeql.yml (old multi-job). + - New: .github/workflows/consumer-codeql-python.yml + (byte-identical to dmf canonical). + - New: .github/workflows/consumer-codeql-cpp.yml + (byte-identical to dmf canonical). + - .github/dm-consumer.yml: add + codeql-python.prepare-command: "ci/codeql-prepare.sh" + codeql-cpp.prepare-command: "ci/codeql-prepare.sh" + codeql-cpp.build-command: "ci/codeql-build.sh" + (the values the old codeql.yml passed via `with:` for each + language job). + + Behavior change: python scan and c-cpp scan now run as separate + Actions UI entries (CodeQL Python / CodeQL c-cpp). A failure in + one no longer fails the other. + +commit d9025962aac47ee531e26f31994ae4d98703150c +Merge: 899959ae 83fc14a9 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 11:45:17 2026 -0400 + + Merge pull request #9 from org-ai-assisted/claude/review-github-actions-IQwcy + + coverity: migrate to consumer-template architecture + +commit 83fc14a99ed7ea91672042d832e9363c0ae12185 +Author: Claude +Date: Tue May 12 15:34:15 2026 +0000 + + cppcheck: migrate to consumer-template architecture + + Per dmf #68 (reusable-cppcheck.yml hard refactor). The old + cppcheck.yml wrapper passed inputs (paths, prepare-command) that + no longer exist on the reusable. Without this migration the + next cppcheck run (PR / master push) would fail because the + reusable's runtime config-load step would not find the cppcheck + section in .github/dm-consumer.yml. + + Changes: + + - .github/dm-consumer.yml: add cppcheck.paths + + cppcheck.prepare-command (the values the old wrapper passed + via `with:`). + - Renamed: .github/workflows/cppcheck.yml -> + consumer-cppcheck.yml, byte-identical to dmf canonical (no + `with:`, just the reusable call). + +commit 74eb7cafbd2b9aee63abd2cfcbbb507bc5c770a7 +Author: Claude +Date: Tue May 12 15:21:30 2026 +0000 + + coverity: migrate to consumer-template architecture + + Per dmf #67 (reusable refactor) + #68 (deadlock hotfix): + + - New: .github/dm-consumer.yml with coverity.project-name + + canonical-repos. + - Renamed: .github/workflows/coverity.yml -> consumer-coverity.yml, + byte-identical to dmf canonical (no `with:`, secrets-only). + + Behavior change: + + - Cron slot moves from '30 6 * * 0' (Sunday 06:30) to + '0 4 * * 5' (Friday 04:00) - the org-wide singleton slot in + the canonical template. + +commit 899959ae8831657f5af884ebba3243e5f1858707 +Author: Patrick Schleizer +Date: Mon May 11 20:28:53 2026 +0000 + + bumped changelog version + +commit 02c34b80ccf838436258991e967a026ff718850d +Merge: 4191b49a c2fa29c0 +Author: Patrick Schleizer +Date: Mon May 11 15:14:00 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 4191b49a073728192a0fdd76f640b27cc0d4a00b +Merge: 82a56984 9a701e10 +Author: Patrick Schleizer +Date: Mon May 11 13:20:43 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 9a701e10e877b9eb60c4a59c74e8798cc1221df5 +Author: Aaron Rainbolt +Date: Sun May 10 21:50:35 2026 -0400 + + Misc fixes and TODOs + +commit c2fa29c067a24a81a19ec568f2676aa8b6fc877b +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 20:18:59 2026 -0400 + + workflows: add concurrency blocks (#7) + + 5 cancellable + 1 singleton (coverity). + +commit d0bf18601b3b9158292e1a904e39eaaaba717d57 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 17:59:39 2026 -0400 + + codex-review: forward only OPENAI_API_KEY explicitly (#6) + + Replace secrets: inherit with explicit single-secret map. + +commit 2d46c0027ef104526577ab3e22b25f3c43ae02b7 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 17:22:37 2026 -0400 + + workflows: drop "bash" prefix on ci/ scripts; rely on shebang (#5) + + Apply helper-scripts #19 pattern across 5 security-misc workflows (8 invocations). + +commit 82a56984a6a4270ab4d77199abcbe5b1fa24e6ae +Merge: b4fa999c c2513d3b +Author: Patrick Schleizer +Date: Sun May 10 15:31:44 2026 -0400 + + Merge remote-tracking branch 'org-ai-assisted/master' + +commit c2513d3be3adc9e8079aae91895b4818ae4d4d0b +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 15:29:47 2026 -0400 + + coverity: project-name slash form + explicit secrets map (#4) + + Fix Coverity scan: API requires Kicksecure/security-misc (slash) not Kicksecure-security-misc (dash). Explicit COVERITY_SCAN_{TOKEN,EMAIL} secrets map. + +commit f24b820efae19cd6197757a007af976a2a300eb6 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 15:29:45 2026 -0400 + + re-apply secrets + apt-cache hardening on top of upstream rebase (#3) + + Re-applied PR#2 hardening on top of upstream Kicksecure/security-misc master b4fa999c. + +commit b4fa999cb5f35276e0fc494806a9f7fdbc876145 +Merge: c21437fd ee1b8549 +Author: Patrick Schleizer +Date: Sun May 10 14:46:07 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit ee1b85491e883f6c5ea431e9a3eeb42a39b36ca1 +Author: Claude +Date: Fri May 8 18:48:08 2026 +0000 + + codeql: drop packages: read + + None of our CodeQL builds pull from ghcr.io (kloak runs + 'bash build.sh', security-misc runs 'bash ci/codeql-build.sh', + helper-scripts and msgcollector are pure-Python). Drop the + defensive 'packages: read' grant in favor of least-privilege. + + A future consumer that genuinely authenticates to GitHub + Packages from a CodeQL build step can re-add it locally. + + Reusable docblock notes the rationale so a future maintainer + doesn't reflexively re-add it. + +commit c864386870b0fd5366441d8e62e6e41869eb06ef +Author: Claude +Date: Fri May 8 15:49:01 2026 +0000 + + claude-code: restore id-token: write + + Reverts the earlier 'drop id-token' commit. Verified against a live + workflow log that the action DOES use OIDC federation: + + Requesting OIDC token... + OIDC token successfully obtained + Exchanging OIDC token for app token... + Using GITHUB_TOKEN from OIDC + + The action federates the runner's id-token to an Anthropic-controlled + GitHub App which mints a higher-privilege GITHUB_TOKEN used to post + review comments. Without id-token: write the next run would have + failed with 'Could not fetch an OIDC token'. + +commit 318322481575fcee29a05a693f47e6a4f4e4fa29 +Author: Claude +Date: Fri May 8 15:33:25 2026 +0000 + + dfuzzer-run.sh: bash style guide compliance + + - R-010 strict-mode quintet: add 'shopt -s inherit_errexit' and + 'shopt -s shift_verbose' to outer script and to the inner + heredoc. + - R-030 printf format: drop embedded format strings (e.g. + 'printf 'foo=%s\n' "${x}"'); pass the entire message in the + data string of 'printf '%s\n' ...'. + - R-051 traps as named functions: extract inline EXIT trap + command-strings into named cleanup functions + (dfuzzer_run_cleanup, dfuzzer_inner_cleanup) registered after + the variables they reference are initialized. + - R-061 split combined short flags: 'rm -rf' -> 'rm -r -f'. + - shellcheck SC2317 (unreachable trap-callback) suppressed + inline. + +commit fb9ac8ecb248b3f4777a9ac80da9f01c09fd4200 +Author: Claude +Date: Fri May 8 15:24:19 2026 +0000 + + scorecard: drop inline cron allocation table + + The org-wide allocation table is single-source-of-truth in + developer-meta-files/.github/workflows/reusable-scorecard.yml. Each + consumer should carry only its own cron line with no commentary. + +commit cff945d545ab6d4513b2e4541e74c26bdd9e6df6 +Author: Claude +Date: Fri May 8 15:21:18 2026 +0000 + + claude-code: drop id-token: write + + The reusable workflow no longer needs id-token: write (the action + authenticates to api.anthropic.com via a static ANTHROPIC_API_KEY; + OIDC federation is unused). Drop the permission to honor + least-privilege - an OIDC token, if forged or leaked, can + authenticate to cloud-provider integrations. + +commit b0c55cb8dc406b5e9019d89d7e75b71f3ff565b8 +Author: Claude +Date: Fri May 8 14:28:16 2026 +0000 + + dfuzzer-run.sh: pass --no-suppressions + + dfuzzer 2.6 treats 'no suppression file found at any of the + 3 candidate paths (./dfuzzer.conf, ~/.dfuzzer.conf, + /etc/dfuzzer.conf)' as a fatal error and exits 1 before fuzzing + anything (verified in upstream src/dfuzzer.c main() - the + df_suppression_load() call returns -1, which prints the literal + 'Exit status: 1' and goto cleanup). On a fresh GitHub runner + none of those paths exist, so the workflow always failed + immediately. We don't want suppressions anyway: we want every + crash / unexpected exit reported. + +commit 167222754f61bd7c7908c74d94e8fb7e762f9f25 +Author: Claude +Date: Fri May 8 14:13:34 2026 +0000 + + dfuzzer-run.sh: pass explicit object path + + dfuzzer defaults to object path '/' which has no methods registered + on fm-shim-backend (its methods are at /org/freedesktop/FileManager1). + Without -o the previous runs exited in milliseconds with no fuzzing + performed. + +commit d8dac7a1a2a8ccd01bddff4d405ca195befd489d +Author: Claude +Date: Fri May 8 14:08:24 2026 +0000 + + dfuzzer-run.sh: diagnostic logging + busctl introspect probe + + After two iterations where dfuzzer exits 1 with no usable + diagnostic ('Cannot open suppression file ... Exit status: 1' + - which is dfuzzer's normal idle output, not the actual error), + add three probes that surface the real state of the world: + + 1. fm-shim-backend stdout/stderr captured to a tmpdir log file + and dumped via ::group::. Without a tty its output is block- + buffered and gets lost when the kill-on-EXIT trap fires; + redirecting to a file flushes on close. + + 2. NameHasOwner poll loop (up to 5 attempts at 1s each) that + confirms the well-known name is registered before dfuzzer + tries to talk to it. Fails fast and surfaces the backend's + stdout if the backend dies during startup. + + 3. 'busctl --user introspect' before dfuzzer to verify the + Introspectable wiring (the just-added handle_introspect() + in fm-shim-backend.c). If busctl can't introspect, dfuzzer + won't be able to either - and we'll see exactly where the + chain breaks. + + This is exactly the diagnostic loop helper-scripts' fuzz.yml + went through during its initial Atheris/CFL bring-up; document + the pattern in agents/fuzzing.md once the dust settles. + +commit 0d3a8a120e5c3c7f1f7919c033b52fcc060db81e +Author: Claude +Date: Fri May 8 14:05:50 2026 +0000 + + fm-shim-backend: implement org.freedesktop.DBus.Introspectable.Introspect + + Real bug found while wiring up the dfuzzer workflow: fm-shim- + backend's hardcoded interface filter rejects every method call + that isn't on org.freedesktop.FileManager1, including the + standard org.freedesktop.DBus.Introspectable.Introspect that + every introspection-aware D-Bus client expects. + + Symptoms before this fix: + - 'busctl introspect --user org.freedesktop.FileManager1 + /org/freedesktop/FileManager1' fails with 'Unknown interface'. + - 'd-feet' / 'qdbusviewer' don't enumerate the service's + methods. + - dfuzzer exits 1 with no usable output (can't introspect -> + doesn't know what to fuzz). + + Fix is conventional: implement Introspect to return a static XML + description of the FileManager1 surface plus the standard + Introspectable interface itself. Argument signatures ('as' for + the URI list, 's' for the startup ID) match the freedesktop.org + file-manager-interface spec. Static string + one extra branch + in dispatch; no runtime cost. + + Discovered by: ci/dfuzzer-run.sh first integration run on + master 6ed21ea (2026-05-08). With this patch dfuzzer can + introspect, enumerate the three methods (ShowFolders, + ShowItems, ShowItemProperties), and proceed to fuzz them. + +commit 6ed21ea68d8b8f5eaa6077e9a171d1bb996bebf5 +Author: Claude +Date: Fri May 8 14:02:06 2026 +0000 + + dfuzzer-run.sh: manual backend launch instead of dbus auto-activation + + XDG-local .service file auto-activation isn't reliable inside + dbus-run-session's transient bus (the dbus-daemon spawned there + seems not to read $XDG_DATA_HOME/dbus-1/services/ - dfuzzer + exits 1 with no meaningful error before any fuzzing happens). + + Switched approach: + 1. Inside dbus-run-session, start fm-shim-backend in the + background. It registers the org.freedesktop.FileManager1 + well-known name on the session bus and enters its dispatch + loop. + 2. sleep 1 + kill -0 check to surface 'backend died during + startup' before dfuzzer's misleading 'name not found' error. + 3. Run dfuzzer against the now-registered name. + 4. EXIT-trap kills the backend at the end. + + Also restructured to avoid multi-level shell quoting: the inner + script lives in a tempfile and gets the binary path + seconds + budget as positional args. Easier to read; bug-class found while + debugging. + + dfuzzer flag now '-I 50' (50 iterations per method, default per- + method coverage on the small FileManager1 surface). Total wall- + clock still bounded by 'timeout --preserve-status' wrapper. + +commit 80089f9e7a452dead2fe5b6c2217e2f02426ed8d +Author: Claude +Date: Fri May 8 13:59:36 2026 +0000 + + dfuzzer-run.sh: fix dfuzzer flag set + use shell timeout + + Three corrections after the v2.6 source-code check: + + 1. dfuzzer 2.6 takes '-n BUS_NAME' (long form '--bus' - misnamed + in upstream; semantically a bus-NAME value). The previous + '--name' / '--bus session' invocation produced + 'unrecognized option' and dfuzzer exited 1 before fuzzing + anything. + + 2. dfuzzer has NO time-bounded flag - only iteration counts. + Wrap with shell 'timeout --preserve-status' to enforce a + per-job time budget. Exit code 124 (budget reached) is + treated as success since hitting the budget means we got + the configured amount of fuzzing. + + 3. Removed '--bus session' - dfuzzer auto-detects the bus from + DBUS_SESSION_BUS_ADDRESS (set by dbus-run-session above), + which is what we want. + + The 'set -o errexit' inside the inner bash -c was also dropped + because we now want the wrapper script (not errexit) to drive + the exit-code interpretation; dfuzzer's real exit code reaches + us via 'rc=$?' and is mapped to a friendly outcome string. + +commit 19f88613f2d0b881614615daf4e24e99025e0b34 +Author: Claude +Date: Fri May 8 13:56:47 2026 +0000 + + dfuzzer.yml: fix binary path (build/dfuzzer not build/src/dfuzzer) + +commit e54cf73996fec5a7737ee19bf2701a5385054d87 +Author: Claude +Date: Fri May 8 13:55:13 2026 +0000 + + dfuzzer.yml: bump tag pin v1.7 -> v2.6 (real latest) + +commit 487a08d1caa42bed0f3b821f2bacfcb09fc990f6 +Author: Claude +Date: Fri May 8 13:53:27 2026 +0000 + + dfuzzer.yml: build dfuzzer from source + + dfuzzer is not in the Ubuntu 24.04 (noble) archive (verified + via packages.ubuntu.com - 'No such package'). Switch from + apt-install to a from-source build pinned at the upstream + v1.7 tag. Build deps (meson/ninja/glib/xsltproc/docbook) + added; runtime apt deps (dbus, libdbus-1-dev, libsystemd-dev, + pkg-config, gcc) kept. + +commit 16a684b4a5fddbdd29bda5ddc01ea1f233f98316 +Author: Claude +Date: Fri May 8 13:51:01 2026 +0000 + + fuzzing: add dfuzzer workflow for fm-shim-backend D-Bus surface + + Wires up dfuzzer (Debian-archive-shipped D-Bus service fuzzer) + against the fm-shim-backend binary's org.freedesktop.FileManager1 + surface. Process-level fuzzing complementing the in-process + Hypothesis suite already covering fm_shim_frontend. + + What gets exercised: + - D-Bus marshaling glue (libdbus-1 path). + - Method dispatch in main()'s message loop. + - sd_notify error path under transient session bus. + - Signal handler interactions. + - Resource lifecycle across method calls (fd leaks etc). + + What's NOT exercised here: + - The frontend prompt logic (covered by Hypothesis tests). + - The in-process parser (libFuzzer harness deferred per + AGENTS.md fuzzing notes). + + Workflow body in ci/dfuzzer-run.sh (R-100): + 1. compile-fm-shim-backend -> tmpdir binary + 2. Write XDG-local D-Bus session service file pointing at + the tmpdir binary so dbus auto-activates it on first + method call. + 3. dbus-run-session boots a transient session bus and runs + dfuzzer --bus session --name org.freedesktop.FileManager1 + --max-time $DFUZZER_SECONDS --verbose. + + Trigger: workflow_dispatch only initially (mirrors helper- + scripts/fuzz.yml). Once a green-baseline run lands, the + commented-out path-filtered pull_request trigger can be + enabled. Default per-method budget 60s; overridable via + workflow_dispatch input. + + Note: dfuzzer is in the Ubuntu universe pocket (apt-installable + on ubuntu-latest by default). No third-party action. + +commit e1ff1f8e1a7c3741ee1d6464a16544069fbda822 +Author: Claude +Date: Fri May 8 13:34:19 2026 +0000 + + ci: switch reusable refs to 'reusable-.yml' + + Seven 'uses:' lines (codeql, scorecard, claude-code-review, + codex-review, coverity, cppcheck, bandit) repointed at the + renamed reusable files in developer-meta-files. + +commit 30d58b0fc48797bf6e9269b0d755792b3ebb6b7c +Author: Claude +Date: Fri May 8 13:27:50 2026 +0000 + + ci: gitignore __pycache__; remove the two stray files just committed + + The Hypothesis test commit accidentally checked in two .pyc + files under ci/tests/fm_shim_frontend/__pycache__/ from the + local validation run. Drop them, add **/__pycache__/ to + .gitignore so the next 'git add -A' does not re-include them. + +commit 3f8233b18d05b7d90c137cf1f49e780a2cc0be6c +Author: Claude +Date: Fri May 8 13:27:31 2026 +0000 + + fuzzing: add Hypothesis property tests; fix ENAMETOOLONG crash + + Adds ci/tests/fm_shim_frontend/test_property.py (six property + tests over get_path_list_from_uris, plus a deterministic + regression suite of nine adversarial inputs) wired into + .github/workflows/lint-python.yml. + + The fuzz suite immediately found a real exploitable bug at + introduction: an attacker who can deliver a URI with a single + path component longer than NAME_MAX (255 bytes on Linux) crashed + the process via an uncaught OSError(ENAMETOOLONG=36) from + Path.exists(). Fixed by wrapping the exists() call in + try/except OSError - any OSError is treated as 'non-existent, + skip' (same path the False branch was already handling). + + The bug is reachable from an attacker process via the + FileManager1 D-Bus surface (other desktop apps can pass URI + lists). Severity: local DoS of the fm-shim-frontend prompt. + + Other infrastructure: + + - ci/tests/fm_shim_frontend/conftest.py stubs out 'stdisplay' + (helper-scripts package, not in the runner's apt) and the + PyQt5 Qt* submodules (a real pyqt5 install would still be + needed for live use, but isn't required for property-testing + the URI validator function in isolation). + - agents/fuzzing.md documents the layout and the local-run + invocation, mirroring helper-scripts' agents/fuzzing.md. + - AGENTS.md gains a Component Notes pointer to the new doc. + + ClusterFuzzLite (Atheris coverage-guided fuzzing) is NOT wired + yet; deferred until the property-test suite has been running + long enough to pick the easy wins. + +commit f4ab12218cef102b30a083f206380ba9e4dc1b76 +Author: Claude +Date: Fri May 8 12:38:25 2026 +0000 + + static-analysis: add cppcheck + bandit wrappers + + Free local-runnable extras complementing CodeQL and Coverity: + + cppcheck - C static analyzer over usr/src/security-misc/. + Re-uses ci/codeql-prepare.sh to symlink the + genmkfile-tagged '*.c#security-misc-shared' + files to clean '*.c' names cppcheck discovers + by extension. + + bandit - Python security-focused analyzer over + usr/lib/python3/dist-packages/fm_shim_frontend/. + Same prepare-command for the '*.py#tag' files. + +commit 767088d43fcb62d82c5a0e664ba46b4939632e2d +Author: Claude +Date: Fri May 8 12:07:44 2026 +0000 + + coverity: use real Coverity Scan project name + + The scan.coverity.com project for this repo is registered under + 'Kicksecure-security-misc' (verified at + https://scan.coverity.com/projects/Kicksecure-security-misc). + The reusable wrapper was passing the bare repo name + 'security-misc' which produced HTTP 401 on cov-build download + because the project+token pair did not match. + +commit cebe274c8bb2c82122ebfa88699ea410f55ca788 +Merge: c21437fd 16cc61e5 +Author: assisted-by-ai (Bot Account) +Date: Fri May 8 08:01:49 2026 -0400 + + Merge pull request #1 from org-ai-assisted/claude/test-github-token-access-HVDXY + + codeql: add static-analysis workflow (python + c-cpp) + +commit 16cc61e58fb990b8c78cb402c20161bacfcaea2f +Author: Claude +Date: Fri May 8 12:00:02 2026 +0000 + + lint-python: use flake8 --select=F; add suppressions to fsw line + + Two fixes for the just-added Python lint workflow. + + 1. Switch from plain pyflakes3 to 'flake8 --select=F'. + + pyflakes by design does not honor any suppression comment - not + '# noqa', not '# pylint: disable', nothing. There is no + escape hatch for intentional violations short of a code + rewrite. flake8 wraps pyflakes (same F-class checks) and adds + '# noqa' support, which is the standard pyflakes-aware + suppression. '--select=F' restricts to F-class rules only + (undefined names, unused imports, unused locals, ...) and + skips E/W PEP8 style noise that would clash with the + codebase's '##' block-comment convention (E266). + + 2. Apply '# noqa: F841 # pylint: disable=unused-variable' to the + intentionally-retained QWindow reference in main(). The binding + is required to keep the QWindow alive while app.exec_() is + running (Qt does not always retain Python wrappers for top- + level windows without a parent). Both pyflakes (F841) and + pylint (unused-variable) flagged it as unused; per-tool + pragmas are needed because the two tools do not share a + common 'intentionally unused local' marker. + + Locally verified: 'flake8 --select=F' returns rc=0 against the + prepared (symlinked) source paths after these changes. + +commit 7892d45da7147905dfe1831455a01f732d83ec38 +Author: Claude +Date: Fri May 8 11:55:32 2026 +0000 + + Revert "TEMP: point coverity wrapper at feature branch for end-to-end test" + + End-to-end test requires both this PR and developer-meta-files PR + to land on master first (workflow_dispatch needs the workflow file + on the default branch per G-A-003). The TEMP @feature-branch ref + becomes obsolete once dev-meta-files PR #7 merges and '@master' + resolves to the new reusable. Reverting now to keep the wrapper + clean for merging. + +commit 40cc7953c788bd61bae7abde24bda981fb9f407f +Author: Claude +Date: Fri May 8 11:54:45 2026 +0000 + + TEMP: point coverity wrapper at feature branch for end-to-end test + + Reverts to '@master' once developer-meta-files PR #7 merges. Used + to validate the reusable resolves and the orchestration scripts + (check-secrets, download, build-python, submit) execute cleanly + end-to-end on a real consumer before the reusable is published. + +commit 2950603574573403c2c82a233fe14f5bd32ba42f +Author: Claude +Date: Fri May 8 11:53:27 2026 +0000 + + lint-python: simple Python lint for fm_shim_frontend + + Two error-only checks (no style noise): + + pyflakes3 - undefined names, unused imports, etc. + pylint --errors - E*** rules only (skips C/W/R categories). + + Apt-installs python3-pyqt5 so the linters can resolve the PyQt5 + imports rather than emitting blanket import-error noise. Re-uses + ci/codeql-prepare.sh to symlink the genmkfile-tagged '*.py#' + sources to extension-clean paths the linters discover. + + Triggers are path-filtered to fm_shim_frontend/ + this workflow + + the prepare script, so unrelated changes do not run it. + +commit de73399046061640a48f630e3e8da7b22da90814 +Author: Claude +Date: Fri May 8 11:46:23 2026 +0000 + + coverity: add Python coverity scan via org-wide reusable + + Adds a Coverity Scan wrapper for the Python sources + (usr/lib/python3/dist-packages/fm_shim_frontend/...). C sources + under usr/src/security-misc/ stay covered by CodeQL only for now; + revisit if the C surface grows enough to justify a multi-language + cov-build. + + Cron slot '30 6 * * 0' offset from helper-scripts ('0 6 * * 0'). + +commit 54aec391d63eec0a73751c352f8684b4fb4ee75e +Author: Claude +Date: Fri May 8 11:35:22 2026 +0000 + + workflows: secrets:inherit + add scorecard wrapper + + - ai-review wrappers: replace explicit secret-mapping with + 'secrets: inherit'. Org-wide ANTHROPIC_API_KEY / + OPENAI_API_KEY propagate without per-repo boilerplate. + - scorecard wrapper added; calls the existing reusable in + developer-meta-files. Cron slot '30 5 * * 0' keeps it offset + from the org's other Scorecard slots. + + Note: this commit is unsigned because security-misc is not yet + registered with the org's commit-signing service. + +commit fc643aaa4603ff7e65706ade6b1edea9ba9eb735 +Author: Claude +Date: Fri May 8 11:27:48 2026 +0000 + + ai-reviews: add Claude + Codex review wrappers + + Two minimal consumer wrappers calling the org-wide reusables in + developer-meta-files: + + .github/workflows/claude-code.yml + .github/workflows/codex-review.yml + + Behavior matches the kloak/helper-scripts setup: pull_request + + comment-triggered Claude review; pull_request + workflow_dispatch + (fork-PR override) Codex review. Allow-lists inherit the + reusable's defaults. + + Requires repo secrets ANTHROPIC_API_KEY and OPENAI_API_KEY to be + set before these produce useful output. + + Note: this commit is unsigned because security-misc is not yet + registered with the org's commit-signing service. + +commit 7b5d353109a82246039de6c9c984f58385dccf9a +Author: Claude +Date: Thu May 7 23:09:37 2026 +0000 + + codeql wrapper: trim to minimal; link to centralized docs + + Drop the scope/#tag/cron-allocation prose - those notes belong in + the reusable's header on developer-meta-files master, not duplicated + here. One-line pointer at the URL is enough; readers needing to + understand the prepare-command + build-command shape follow the + link to the centralized doc. + +commit ad0d004561ce5ffc407f53282fd5d4eecac295ba +Author: Claude +Date: Thu May 7 23:07:20 2026 +0000 + + security-misc: extract C compile step into reusable helpers + + Resolves the TODO atop usr/libexec/security-misc/emerg-shutdown: + + > TODO: Move most of this to a build script that will compile + > and place under /usr/bin rather than /run. + + The motivating use case is also that CodeQL's CI compile path + (ci/codeql-build.sh) was duplicating the gcc command, including + ~70 hardening flags. With ~70 flags in two places, drift was a + matter of when, not if. + + New helpers (no '.sh' extension to match the rest of usr/libexec/ + security-misc/): + + usr/libexec/security-misc/compile-fm-shim-backend + usr/libexec/security-misc/compile-emerg-shutdown + + Each is a pure compile - takes (source, output) positionals, runs + gcc with the project's hardening flag set, exits non-zero on + failure. No chmod, no mv, no install - the caller decides what to + do with the binary. + + Consumers: + + build-fm-shim-backend - keeps mktemp/trap/chmod/mv lifecycle, + delegates the gcc invocation. + emerg-shutdown - keeps the dracut/config/memlockd/exec + logic, delegates the gcc invocation. + The hardening flag array and machine- + type branching go away from this file. + ci/codeql-build.sh - drops the inline gcc, calls both + compile- helpers. Single source of + truth: CI's hardening flags == runtime's. + + Also extends ci/codeql-prepare.sh to symlink '*.c#' to clean + '*.c' names (in addition to '*.py#'). gcc selects driver + behavior by file extension - a '*.c#' source is misclassified + as a linker script ('file format not recognized'). Verified + locally: with the symlinks in place, the helpers produce both + binaries (fm-shim-backend dynamic 49 KB, emerg-shutdown static + 875 KB) without warnings under x86_64-linux-gnu. + + Wires the c-cpp CodeQL job to run codeql-prepare.sh too via the + reusable workflow's prepare-command hook. + +commit f03270a46b476f354065f7b56dca523a50a1af8d +Author: Claude +Date: Thu May 7 22:55:39 2026 +0000 + + codeql: align ci helpers with bash-style-guide + + Per developer-meta-files agents/bash-style-guide.md and pre-push- + checklist: + + - R-002: add the 'AI-Assisted' header marker on the new bash + scripts and the workflow YAML. + - R-010: add 'set -o errtrace' to both ci/codeql-*.sh. + - pkg-config: keep the unquoted '\$(pkg-config ...)' subshells + matching the upstream pattern in build-fm-shim-backend; add a + NOTE comment and a 'shellcheck disable=SC2046' since the rule + fires on the intentional shape (AGENTS.md 'pkg-config quoting + in build script' rule). + +commit 80ce8c9e8d47ee0d27465e69db6425d3ff18ee4a +Author: Claude +Date: Thu May 7 22:50:17 2026 +0000 + + codeql: add static-analysis workflow (python + c-cpp) + + Adds .github/workflows/codeql.yml as a thin wrapper around the + org-wide reusable workflow in developer-meta-files. Two jobs - one + per language - matching the source mix actually present in the + repo: + + python: usr/lib/python3/dist-packages/fm_shim_frontend/ + c-cpp: usr/src/security-misc/{emerg-shutdown,fm-shim-backend}.c + + Source files in this repo carry a '#' suffix per the + genmkfile installable-routing convention; that suffix hides them + from CodeQL's Python extractor (which discovers by file extension). + Two helper scripts handle this: + + ci/codeql-prepare.sh - run via the reusable's pre-init hook; + creates extension-clean symlinks for each '*.py#tag' source. + ci/codeql-build.sh - manual build for c-cpp; installs build + deps and runs gcc -c on each .c file. The C extractor traces + compiler invocations rather than scanning by extension, so + the tagged paths can be passed to gcc verbatim. + + Cron slot picked to avoid collision with the org's existing + CodeQL slots (helper-scripts '17 4 * * 0', kloak '25 3 * * 5'). + + Note: this commit is unsigned because security-misc is not yet + registered with the org's commit-signing service. + +commit c21437fd83c5a86e6573ed76c2ecadcbfddacd45 +Author: Patrick Schleizer +Date: Sat May 2 08:48:24 2026 +0000 + + bumped changelog version + +commit 66d509f1995be49919c6f9d67cb25111678b1172 +Author: Patrick Schleizer +Date: Fri May 1 16:45:03 2026 -0400 + + add CLAUDE.md + +commit 48ba0017a14e3d3084aaf0ee42cc2542d7563cb1 +Author: Patrick Schleizer +Date: Sat Apr 25 09:26:49 2026 +0000 + + bumped changelog version + +commit e085afa9e56144feb1e5d80429341a464aa08d04 +Merge: 11a5c33a 1765046c +Author: Patrick Schleizer +Date: Sat Apr 25 05:13:22 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 1765046c7731cab90a320833763412b288e85930 +Author: Aaron Rainbolt +Date: Fri Apr 24 20:05:15 2026 -0400 + + Bash arithmetic hardening + +commit 11a5c33a566cc5280ee0b5984850ba05c716c106 +Author: Patrick Schleizer +Date: Wed Apr 22 13:16:46 2026 +0000 + + bumped changelog version + +commit 324ee4fdf63a8945af3f1125fab1403bdf87b5e4 +Merge: e5df9643 b43e11e5 +Author: Patrick Schleizer +Date: Wed Apr 22 06:35:15 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit b43e11e59e9f7b50fd1e84d5630c4c10a3f6cf69 +Author: Aaron Rainbolt +Date: Sun Apr 19 19:23:58 2026 -0400 + + Add better Unicode handling to fm-shim-frontend + +commit 9b058e0618062b345e9bd29e5c51f7b5e0df3191 +Author: Aaron Rainbolt +Date: Sun Apr 19 01:23:59 2026 -0400 + + Add better logging to fm_shim_frontend + +commit e5df9643ad2b060f74ed519dd7acc913692724d8 +Author: Patrick Schleizer +Date: Thu Apr 16 12:27:58 2026 +0000 + + bumped changelog version + +commit 36438ea84e610895c7bdd7de8a556f7c5a0c86aa +Author: Patrick Schleizer +Date: Thu Apr 16 01:53:02 2026 -0400 + + readme + +commit a0a6ef0ab92da68460b53b3c304f3c200ee2576e +Author: Patrick Schleizer +Date: Thu Apr 16 01:50:33 2026 -0400 + + readme + +commit 766710a05a83edf128c02041ce5a18a9a76cc9e1 +Author: Patrick Schleizer +Date: Thu Apr 16 01:43:35 2026 -0400 + + readme + +commit d44d9caac299a35d22d2240c2cfd42cefec22850 +Author: Patrick Schleizer +Date: Thu Apr 16 01:30:01 2026 -0400 + + agents + +commit ec3fd3bf2abd81f546b08c351b868218dbffcc68 +Merge: f511bb92 019e8415 +Author: Patrick Schleizer +Date: Thu Apr 16 01:22:03 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 019e84154a516e9a97bc284f2dc90ecf677e8531 +Author: Aaron Rainbolt +Date: Wed Apr 15 01:07:45 2026 -0400 + + Prevent using systemd-journald to write text to other user's terminals + +commit 187129cdebecae9c4906483f01f2d7341c1071f3 +Author: Aaron Rainbolt +Date: Wed Apr 15 00:47:52 2026 -0400 + + Add more compiler hardening flags + +commit b9d5480d9d7ee90c75523548bc69e9d467fda7b0 +Author: Aaron Rainbolt +Date: Mon Apr 13 18:51:43 2026 -0400 + + Remove unused AppArmor aliases + +commit f7a432f4e12407d920e787fcdd1937ae2100b3c9 +Author: Aaron Rainbolt +Date: Sun Apr 12 20:53:09 2026 -0400 + + Fix sysinit-post.target description + +commit fcefea6d468a7f4524c0f78e17bd9311692ce3bc +Author: Aaron Rainbolt +Date: Sun Apr 12 20:52:10 2026 -0400 + + Remove preset block on emerg-shutdown.service + + The block didn't actually work, and the bug that kept emerg-shutdown + from being usable with Calamares appears to no longer be a problem. + +commit 0e8f654d3af4613ca0346d8c9524fb1d116468b7 +Author: Aaron Rainbolt +Date: Sun Apr 12 20:48:24 2026 -0400 + + Documentation updates (mostly from Claude Code) + +commit 1baaaea4bc40e0e67d47ff904fea74f2b241dcdb +Author: Aaron Rainbolt +Date: Sun Apr 12 19:27:00 2026 -0400 + + Modified and squashed commit of the following: + + commit 518290c64b01d3890639b7b22cf90ababb163565 + Author: Claude + Date: Fri Apr 10 10:33:35 2026 +0000 + + Add agents docs for fm-shim security review notes + + Document fm-shim architecture, accepted threat model, and rejected + review suggestions to preserve context for future security reviews. + + https://claude.ai/code/session_01HJPNe7hjMrPvPtuJmPBhNa + +commit b6f5cf1787d2ab12832892ab38b79825a1748e9b +Author: Aaron Rainbolt +Date: Sun Apr 12 15:30:06 2026 -0400 + + Modified and squashed commit of the following: + + commit 63606cd8a818570143ea73211a74bbb5db38242a + Author: Claude + Date: Fri Apr 10 11:03:29 2026 +0000 + + Add AGENTS.md with fm-shim review guidelines + + Captures lessons from PR #358 review feedback to prevent repeating + rejected patterns in future contributions. + + https://claude.ai/code/session_01CgrrFhhVWtqtfhvJdEcBWm + +commit f511bb9218a68c2c027107f5b898eb795302e9c9 +Author: Patrick Schleizer +Date: Sun Apr 12 14:03:30 2026 +0000 + + bumped changelog version + +commit e9d672a5e6a2c76a3668aebd46dcb42c04b97fdc +Author: Patrick Schleizer +Date: Sun Apr 12 03:35:31 2026 -0400 + + comments + +commit 232b01e7df376225ed895bf04ebe02b0943b6074 +Author: Patrick Schleizer +Date: Fri Apr 10 09:21:40 2026 +0000 + + bumped changelog version + +commit 1e23d62307d17fc6ecc86ae923332c07bfc52d60 +Merge: f64fc3e1 972f4c95 +Author: Patrick Schleizer +Date: Fri Apr 10 04:21:34 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 972f4c95fb31d41140d3a30fbdba5c49dbd6bd73 +Author: Aaron Rainbolt +Date: Thu Apr 9 23:37:21 2026 -0400 + + Document fm-shim in README.md + +commit 61dd797310b257fd7614b1769b84d62ce62ef80b +Author: Aaron Rainbolt +Date: Thu Apr 9 23:29:26 2026 -0400 + + Standardize on one form of bullets in README.md + +commit 1a71a3e954060aaf06a3daf491168bdf31942dc5 +Author: Claude +Date: Thu Apr 9 12:06:54 2026 +0000 + + comment out bdev_allow_write_mounted=0 + + Causes breakages with disk management operations such as disk + resizing and VDI compaction in virtual machines. + + https://github.com/Kicksecure/security-misc/pull/334 + https://forums.whonix.org/t/kernel-hardening-security-misc/7296/609 + https://forums.whonix.org/t/how-to-compress-and-prevent-vdi-from-ballooning-after-each-update-deleting-large-files/22675/9 + https://forums.kicksecure.com/t/resizing-disk-for-guest-in-kvm/1657 + + https://claude.ai/code/session_01Cd9ka8sC7zLUvB31V4kxMk + +commit f64fc3e1645ec2661b518e64f4454dc9ef85cf49 +Author: Patrick Schleizer +Date: Thu Apr 9 11:57:57 2026 +0000 + + bumped changelog version + +commit 4c3d4267a19ef56c488779ad28d82eef87b967d9 +Merge: 46c171e4 e718203d +Author: Patrick Schleizer +Date: Thu Apr 9 07:53:33 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit e718203d075ba73ecb7a89e31db6ca4ac588cf78 +Author: Aaron Rainbolt +Date: Wed Apr 8 17:20:10 2026 -0400 + + Add additional compiler hardening flags for fm-shim-backend + +commit cf518cbabae41c6608006adcdf38128c902486c2 +Author: Aaron Rainbolt +Date: Wed Apr 8 17:19:19 2026 -0400 + + Add additional compiler hardening flags for emerg-shutdown + +commit 83b360edf6c3d8a0d1714a3f2d6e9865ae225b64 +Author: Aaron Rainbolt +Date: Wed Apr 8 17:06:00 2026 -0400 + + Fix dead code in emerg-shutdown.c + +commit 46c171e42ab66b0ec3bc10e715e6c54974966a8e +Author: Patrick Schleizer +Date: Wed Apr 8 17:51:28 2026 +0000 + + bumped changelog version + +commit 7b443582fe845d2a6c76c74f96df837bb56ef624 +Author: Patrick Schleizer +Date: Wed Apr 8 10:07:01 2026 -0400 + + remove trailing space + +commit cbcf722f5a895697364891f15d37349d68f8054e +Merge: 3949bf35 17a9da5b +Author: Patrick Schleizer +Date: Wed Apr 8 10:06:09 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 17a9da5bada135774ff71cf094e56d2557048540 +Author: Aaron Rainbolt +Date: Mon Apr 6 22:21:51 2026 -0400 + + More emerg-shutdown bugfixes (from Claude Code) + +commit 55e42610c2949c1f15bc6802dab1006f8d74159e +Author: Aaron Rainbolt +Date: Mon Apr 6 21:28:28 2026 -0400 + + Document reason for not quoting pkg-config subshells + +commit 5c0641795a33a9bd0a01dbbce66fa243978bb59a +Author: Aaron Rainbolt +Date: Mon Apr 6 20:29:12 2026 -0400 + + Minor fixes on fm-shim-backend + +commit af4f229046b8ff64eeea599bc72fe47bd35784fc +Author: Aaron Rainbolt +Date: Sun Apr 5 19:21:41 2026 -0400 + + Improve fm-shim-backend security and D-Bus error handling (mostly from Claude Code) + +commit 83fba23b6f95cda25c7839ac43ae2e02e52b59a1 +Author: Aaron Rainbolt +Date: Sun Apr 5 18:33:50 2026 -0400 + + Only allow the primary fm-shim-backend process to use sd_notify + +commit 3b3b5862cd168d75c768220408314040562cf020 +Author: Aaron Rainbolt +Date: Sun Apr 5 18:15:31 2026 -0400 + + Security hardening: fix buffer handling, input validation, misc bugs (mostly taken from Claude Code) + +commit 4d0ccf65acec9c2ee15608d8b6b601293b8f98da +Author: Aaron Rainbolt +Date: Sun Apr 5 15:45:06 2026 -0400 + + Add user existence check to virusforget (inspired by Claude Code) + +commit 3949bf35e90a50b8ebc534b71fd3ece834f23b8b +Author: Patrick Schleizer +Date: Sun Mar 22 11:13:50 2026 +0000 + + bumped changelog version + +commit 92f6f30f565b1b8598199ac7d1bc35e01bf5a082 +Author: Patrick Schleizer +Date: Sun Mar 22 05:45:45 2026 -0400 + + comment + +commit 140c9cbc8a487585a92eca7acbbdfe18b92e0da9 +Merge: c913e3be 8a81ab4a +Author: Patrick Schleizer +Date: Sun Mar 22 05:44:46 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 8a81ab4af5182a124686857104118c0701e93357 +Author: Aaron Rainbolt +Date: Thu Mar 19 22:17:47 2026 -0400 + + Comments, hardening on fm-shim frontend and backend + +commit 144d04cd84084508a7f1ce892ef1d00296f693de +Merge: 58192e68 c913e3be +Author: Aaron Rainbolt +Date: Thu Mar 19 20:39:37 2026 -0400 + + Merge branch 'master' into arraybolt3/trixie + +commit c913e3bead0dfffee0a46049d30dc8d91e47f5ca +Author: Patrick Schleizer +Date: Thu Mar 19 18:30:25 2026 +0000 + + bumped changelog version + +commit 89908e0938929c6ee6f39dbd510f4bc889ca31c1 +Author: Patrick Schleizer +Date: Thu Mar 19 11:24:36 2026 -0400 + + copyright + +commit 58192e688c0ea32bf6bb9806eb619413d26c2b12 +Author: Aaron Rainbolt +Date: Wed Mar 18 20:28:20 2026 -0400 + + Avoid unintentional HTML rendering in fm-shim-frontend, fix path resolution, fix wrong D-Bus protocol handling in backend, slightly harden backend + +commit 6c0b8dbc50840950756b4d28c5bb7622e035b11d +Author: Patrick Schleizer +Date: Tue Mar 17 13:57:12 2026 -0400 + + remove trailing spaces + +commit 58555692e771846548282dd55e696117d95abff4 +Merge: ce5034d9 b34ee621 +Author: Patrick Schleizer +Date: Tue Mar 17 13:55:43 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit b34ee6216809232cc09453f10437fd14e34ea318 +Author: Aaron Rainbolt +Date: Sun Mar 15 21:03:44 2026 -0400 + + Further fm-shim frontend and backend hardening and bugfixes following ChatGPT code review + +commit c96fb114c820625536a32be406b923055a073081 +Author: Aaron Rainbolt +Date: Sun Mar 15 13:54:30 2026 -0400 + + Integrate hardening suggestions from ChatGPT into fm-shim-backend.c + +commit ce5034d9612488728b3ed7b2a61e009762c33e63 +Author: Patrick Schleizer +Date: Sat Mar 14 12:08:52 2026 +0000 + + bumped changelog version + +commit a6c8ba2c5e348ebc419d8ae8148108fba36f6fed +Author: Patrick Schleizer +Date: Sat Mar 14 07:03:41 2026 -0400 + + remove superfluous file + +commit f9a182cb87d16a498e65fb9cb40a3c174683fe75 +Merge: 0da8cad9 76734023 +Author: Patrick Schleizer +Date: Sat Mar 14 07:03:11 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 767340233fa3b305ac53f56c843c348c44695bf3 +Author: Aaron Rainbolt +Date: Tue Mar 10 00:17:29 2026 -0400 + + Fix unused variable in fm-shim-backend.c + +commit 0bf666a87bcfb6f452a16a37d90c813e372fea89 +Author: Aaron Rainbolt +Date: Mon Mar 9 22:28:52 2026 -0400 + + Add work-in-progress D-Bus shim for org.freedesktop.FileManager1 + +commit 0da8cad962683701a77c29b6ba49a2f80e125690 +Author: Patrick Schleizer +Date: Mon Feb 23 13:34:15 2026 +0000 + + bumped changelog version + +commit ff99577a0aef5b52619fdccc9e933ce8af5aaf2b +Merge: 196ff190 df6ca04d +Author: Patrick Schleizer +Date: Mon Feb 23 06:31:32 2026 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit df6ca04de8c47b83e58f0c35b4736305e41f1645 +Merge: 196ff190 ad1d64fc +Author: Patrick Schleizer +Date: Mon Feb 23 06:30:40 2026 -0500 + + Merge pull request #351 from raja-grewal/cdrom + + Add CD-ROM/DVD hardening settings + +commit ad1d64fc4ffe53ffc0710b5d9654dfff5ff6f617 +Merge: f99e5c48 196ff190 +Author: raja-grewal +Date: Fri Feb 20 11:04:39 2026 +1100 + + Merge branch 'Kicksecure:master' into cdrom + +commit 196ff19056dcaf3bf31174d18be728e4a29159a0 +Merge: 7df34854 c17f2404 +Author: Patrick Schleizer +Date: Thu Feb 19 07:10:42 2026 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit f99e5c48c03b6b7e9e3995e5c61c996a05108e03 +Merge: fe1d9242 c17f2404 +Author: raja-grewal +Date: Wed Feb 18 09:15:23 2026 +1100 + + Merge branch 'Kicksecure:master' into cdrom + +commit c17f2404c4b690ba9315b396408b33c2b8eb449d +Merge: 7df34854 7477128e +Author: Patrick Schleizer +Date: Tue Feb 17 11:03:30 2026 -0500 + + Merge pull request #344 from raja-grewal/docs_update + + Update various docs + +commit fe1d92429d34f66cd9e2cdd085700e6a373bea5f +Author: raja-grewal +Date: Tue Feb 17 07:31:42 2026 +0000 + + sysctl: add cd-rom/dvd hardening settings + +commit 7477128e3e1255156b1e18bb5c049cd74468e9cf +Author: raja-grewal +Date: Mon Feb 16 21:52:39 2026 +0000 + + Simplify links + +commit 32513594d775ecb1817636cccd9b43b5f30d863c +Author: raja-grewal +Date: Mon Feb 16 06:33:58 2026 +0000 + + README: add line + +commit 5a6002d9580373408798511807941ec37ef4aa20 +Author: raja-grewal +Date: Mon Feb 16 04:09:01 2026 +0000 + + Update docs + +commit 369c14ab0231fe605a821d96b3f4ca80fe61854a +Merge: 73d3da10 7df34854 +Author: raja-grewal +Date: Mon Feb 16 14:26:59 2026 +1100 + + Merge branch 'Kicksecure:master' into docs_update + +commit 7df348544fc4bb484d2b955864ff0f598b1aca0b +Author: Patrick Schleizer +Date: Tue Feb 10 12:17:16 2026 +0000 + + bumped changelog version + +commit fb2d44fe2315aa467af733634c5c0bb59a5da65a +Author: Patrick Schleizer +Date: Sun Feb 8 05:14:38 2026 -0500 + + Do not run emerg-shutdown.service in case 'rd.live.ram' or 'rd.live.ram=1' is set. + + https://forums.kicksecure.com/t/how-to-run-iso-live-mode-from-ram/1542/9 + +commit 34440d7cdf662426b147ac8fde65573927b9bfe0 +Author: Patrick Schleizer +Date: Sun Jan 11 16:40:08 2026 +0000 + + bumped changelog version + +commit cbd91974b162cec0144804190f807976ee2788e5 +Author: Patrick Schleizer +Date: Sun Jan 11 10:51:46 2026 -0500 + + typo + +commit a0fd435751e666b72b59afb6658e41ba21e892b4 +Author: Patrick Schleizer +Date: Sun Jan 11 07:09:36 2026 -0500 + + readme + +commit 6c4e7458a10c3a262ecfc0c2f53d1b6181b80ddf +Author: Patrick Schleizer +Date: Mon Jan 5 10:28:53 2026 +0000 + + bumped changelog version + +commit 74533a7efab3f740028d04330752ce18b92dc8fa +Merge: 8a132749 84408cb1 +Author: Patrick Schleizer +Date: Mon Jan 5 03:09:53 2026 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 84408cb1a5228355526815814d2e01ce8d40a175 +Merge: 8a132749 52ef679c +Author: Patrick Schleizer +Date: Mon Jan 5 03:05:02 2026 -0500 + + Merge pull request #345 from Nurmagoz/patch-1 + + debian/control URL fix + +commit 8a132749e0976803173c416cd5f8d4879b7dee3f +Author: Patrick Schleizer +Date: Thu Jan 1 17:28:25 2026 +0000 + + bumped changelog version + +commit e2d31a5b818342037a54e5c3a71ef92df95b9a32 +Author: Patrick Schleizer +Date: Thu Jan 1 12:28:03 2026 -0500 + + genmkfile debinstfile + +commit 6e15c683ab4a682a8ed652559632d7d1e93963c4 +Merge: 97640a9b 436308ae +Author: Patrick Schleizer +Date: Thu Jan 1 12:01:19 2026 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 52ef679c2cd95548e1f0edf48283f0ea5e3a444c +Author: Nurmagoz <11895339+Nurmagoz@users.noreply.github.com> +Date: Wed Dec 31 20:51:34 2025 +0000 + + debian/control URL fix + +commit 436308ae4ec243c80262f3b43dcade0f9ca83859 +Author: Aaron Rainbolt +Date: Mon Dec 29 22:30:00 2025 -0600 + + Minor comment fixes + +commit f8ac896b87e6661704f9b13f775941ea8b4eda06 +Merge: 97640a9b ab98da95 +Author: Aaron Rainbolt +Date: Mon Dec 29 22:23:34 2025 -0600 + + Merge remote-tracking branch 'raja/log_martians' into arraybolt3/trixie-raja-merge + +commit 73d3da104b03c967c56d90d0905336caa802e416 +Author: raja-grewal +Date: Tue Dec 30 03:51:49 2025 +0000 + + Sort file + +commit d0512e4f25ed78d0b27a62e305812dec3e00873a +Author: raja-grewal +Date: Tue Dec 30 03:47:47 2025 +0000 + + Update links to kernel docs + +commit 56df8b624c88b56905d945a0b247714152321c9b +Author: raja-grewal +Date: Mon Dec 29 07:52:15 2025 +0000 + + Re-order boot params as introduced + The ordering was changed due to different merge times. + +commit 8fd95a0b97f339f2609de7e7614fa8a3e86e3157 +Author: raja-grewal +Date: Mon Dec 29 07:44:15 2025 +0000 + + Sort new split package install script for easier readability + +commit e3765131b067083c6a9a7f373cfb154a806e57ad +Author: raja-grewal +Date: Mon Dec 29 07:36:55 2025 +0000 + + Add reference on IOMMU vulnerabilities + +commit 31e268d6246a98d62c23a5bb9e7e4282d0fad282 +Author: raja-grewal +Date: Mon Dec 29 07:34:53 2025 +0000 + + README: typos + +commit cd0a59fd1495db21b8da4b3e8484df61858e7f80 +Author: raja-grewal +Date: Mon Dec 29 07:24:32 2025 +0000 + + Merge Meltdown mitigtions for ARM64 and X86_64 CPUs + +commit 61170e1c6a4869120413cf5236a2d995af26422d +Author: raja-grewal +Date: Mon Dec 29 07:16:54 2025 +0000 + + Reorder panic settings + +commit 6a92e956f3fd41fe416c1e41203687619c7011bc +Author: raja-grewal +Date: Mon Dec 29 07:02:24 2025 +0000 + + Add minor notices to panic on oopses and warnings + +commit 4d49ab56a4be29b03746b99cf6254ef15c93ed74 +Author: raja-grewal +Date: Mon Dec 29 06:52:35 2025 +0000 + + Update docs on `proc_mem.force_override` + +commit 1472d41f030d02aba6576ef481ace35554908e8d +Author: raja-grewal +Date: Mon Dec 29 06:41:33 2025 +0000 + + Add KSPP partial compliance notice for `proc_mem.force_override=ptrace` + +commit 97640a9b5768b7565daf153fbdc9a0655001b790 +Author: Patrick Schleizer +Date: Sun Dec 28 06:36:59 2025 +0000 + + bumped changelog version + +commit c54d6a2258a09867e5b72a8bc1b47df67de6497d +Author: Patrick Schleizer +Date: Sun Dec 28 01:30:43 2025 -0500 + + readme + +commit 7477a6711ad2020fc9a7af19fd98fb88da5b840f +Author: Patrick Schleizer +Date: Sun Dec 28 01:29:26 2025 -0500 + + readme + +commit 885358794f2f4f196e37e6c39b6d95f3b48e325f +Author: Patrick Schleizer +Date: Sun Dec 28 00:55:20 2025 -0500 + + readme + +commit 44837c12bbf63f7e0fd41afad11e19646fd53074 +Author: Patrick Schleizer +Date: Sun Dec 28 00:48:37 2025 -0500 + + genmkfile debinstfile + +commit 7b37965c5c6689533b10e0e592100ee5b94858ee +Merge: d2796afe dddf7979 +Author: Patrick Schleizer +Date: Sun Dec 28 00:47:49 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit dddf79798cb2f2f76bf4432aa90c8a3c61402db1 +Author: Aaron Rainbolt +Date: Sat Dec 27 19:46:55 2025 -0600 + + Document why we disable sudo DNS + +commit 5e45248eb63ecb4b7f924ff9fcba6b40f5bf1244 +Author: Aaron Rainbolt +Date: Sat Dec 27 19:38:19 2025 -0600 + + genmkfile debinstfile + +commit 1b07fd2e73fdfc0d83bd36919080442a14a5ffdf +Author: Aaron Rainbolt +Date: Sat Dec 27 19:38:02 2025 -0600 + + Disable sudo DNS lookups on desktop systems + +commit d2796afe8e4cf5dd55d549adf972e68f86903609 +Author: Patrick Schleizer +Date: Fri Dec 19 11:38:31 2025 +0000 + + bumped changelog version + +commit 68c89cced39a5d2138e22661f4132118628aba64 +Author: Patrick Schleizer +Date: Fri Dec 19 06:30:00 2025 -0500 + + comment + +commit 8aef71c2548807f39a104529e0b6cdf67c201185 +Author: Patrick Schleizer +Date: Fri Dec 19 06:27:14 2025 -0500 + + fix + +commit 55a9755d90d27325010ab19a35b611a9a1df82ae +Author: Patrick Schleizer +Date: Fri Dec 19 06:26:16 2025 -0500 + + refactoring + +commit 6927a5d1adb3dbb96d630e42679c01a6d589232e +Author: Patrick Schleizer +Date: Fri Dec 19 09:56:05 2025 +0000 + + bumped changelog version + +commit 29c12808682fbbd5bd63f1bb821821f5adbfdbc5 +Author: Patrick Schleizer +Date: Fri Dec 19 04:55:41 2025 -0500 + + genmkfile debinstfile + +commit 7ed2d25def0f143dc4cb3695f0e8c5b74682a743 +Merge: b366c5e6 0bf0a73e +Author: Patrick Schleizer +Date: Fri Dec 19 03:42:20 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 0bf0a73eb4683bd7205eaafa692237c57e7d18ae +Author: Aaron Rainbolt +Date: Mon Dec 15 20:18:14 2025 -0600 + + Add a missing quote mark for panic_on_taint + +commit 2106ed5aa651d9910df9965d68cb632808423e77 +Merge: b9d4f0aa 969d4d82 +Author: Aaron Rainbolt +Date: Mon Dec 15 19:41:36 2025 -0600 + + Merge remote-tracking branch 'raja/amd_encrypt_sev' into arraybolt3/trixie-raja-merge + +commit 969d4d82139b1c1793786b7a24c9eee3f4a1101c +Author: raja-grewal +Date: Tue Dec 16 11:49:21 2025 +1100 + + Add references for AMD SME + +commit b9d4f0aaa565ab478a8e0ef4cef27bc49457da42 +Author: Aaron Rainbolt +Date: Sun Dec 14 14:24:33 2025 -0600 + + Add minor clarifications + +commit 005b66c265654514b6450908a75615b71003f372 +Merge: 3f097a35 eaf0f814 +Author: Aaron Rainbolt +Date: Sun Dec 14 14:05:36 2025 -0600 + + Merge remote-tracking branch 'raja/panic_taint' into arraybolt3/trixie-raja-merge + +commit 3f097a35f21582300a87ddf7c70b2698df90e5ff +Author: Aaron Rainbolt +Date: Sun Dec 14 14:03:26 2025 -0600 + + Split up a line in README.md + +commit e7e6d6d3739bebfb8a92f6666e5f2f43ecbc2b52 +Merge: 8e56772c b8f78062 +Author: Aaron Rainbolt +Date: Sun Dec 14 14:01:54 2025 -0600 + + Merge remote-tracking branch 'raja/incomplete_cpu_mitigations' into arraybolt3/trixie-raja-merge + +commit b8f78062673ec3675ff31a0f7d34b853e9f97f04 +Author: raja-grewal +Date: Sun Dec 14 12:38:47 2025 +0000 + + Update usage of `mitigations=auto,nosmt` + +commit eaf0f814bdbe52739d3b3270bb2549bbdc2753f2 +Author: raja-grewal +Date: Sun Dec 14 11:18:08 2025 +0000 + + Update option to `panic_on_taint` + +commit 8e56772c2f0d26b7266403c0dfc5b7ef6d86d1fc +Author: Aaron Rainbolt +Date: Sat Dec 13 19:22:50 2025 -0600 + + README.md typo fix + +commit 4d0a126955e48d790c063b218540a63b514bbd24 +Merge: 39ce5919 8040ba75 +Author: Aaron Rainbolt +Date: Sat Dec 13 18:44:03 2025 -0600 + + Merge remote-tracking branch 'raja/modprobe_refresh' into arraybolt3/trixie-raja-merge + +commit 39ce5919765b7cadac07dfeadb6cbbd29261b81c +Merge: b366c5e6 7d901213 +Author: Aaron Rainbolt +Date: Sat Dec 13 18:27:22 2025 -0600 + + Merge remote-tracking branch 'raja/amd_encrypt_sev' into arraybolt3/trixie-raja-merge + +commit 650b923c7a88820d3a899596e32016e1c3f6cc57 +Author: raja-grewal +Date: Sat Dec 13 04:35:02 2025 +0000 + + Update option to `panic_on_taint` + +commit b366c5e62ad375cef608f5fc435d444de52b056d +Author: Patrick Schleizer +Date: Fri Dec 12 13:17:09 2025 +0000 + + bumped changelog version + +commit 68de32e43e5597c5bda5449cf78eeed94895a63c +Merge: 725565c4 135ee804 +Author: Patrick Schleizer +Date: Fri Dec 12 04:35:53 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 8040ba7579735cafee5fcd9ddf60ca4c88080f70 +Author: raja-grewal +Date: Fri Dec 12 02:04:38 2025 +0000 + + Minor fixes to docs + +commit fe1cfcd1a0f42b4e4938f7b327c33e89936aff76 +Author: raja-grewal +Date: Fri Dec 12 02:03:23 2025 +0000 + + Update docs on CPU MSRs + +commit ab2d44677a3198d6e421bb1c630a18fc4e85065c +Author: raja-grewal +Date: Fri Dec 12 02:01:20 2025 +0000 + + Correct script addition + +commit 5684a12d9db65474392dc9e1ebdc4646e34569eb +Author: raja-grewal +Date: Fri Dec 12 01:59:23 2025 +0000 + + Whitelist `9p` module + +commit 135ee80450c7f7e4c3d71be861fe1b5a6c135d02 +Author: Aaron Rainbolt +Date: Thu Dec 11 18:47:42 2025 -0600 + + Move kernel.panic=-1 setting to sysctl, allow turning panic-on-oops off with systemctl + +commit 7d901213029f17e7d0a4dccc671b3bfd476bab13 +Author: raja-grewal +Date: Thu Dec 11 14:12:18 2025 +0000 + + Add reference for AMD SEV + +commit 72f295a3f04e43307dea9af29657ee96fb1c47a5 +Author: raja-grewal +Date: Thu Dec 11 14:11:47 2025 +0000 + + Provide option to enable AMD SEV-SNP + +commit 6a17255307c1d3b397ad38ab8f3bb8a14a3c5ca5 +Author: raja-grewal +Date: Thu Dec 11 14:11:26 2025 +0000 + + Provide option to enable AMD SEV-ES + +commit 22b1e3dc92c8bffca20f5d70920b6b9be042658e +Merge: 30068ec8 725565c4 +Author: raja-grewal +Date: Thu Dec 11 18:15:35 2025 +1100 + + Merge branch 'master' into panic_taint + +commit 53c4fdbeea0a44ca9e7ab739d80393b9c655482c +Merge: f75e9873 725565c4 +Author: raja-grewal +Date: Thu Dec 11 12:52:14 2025 +1100 + + Merge branch 'Kicksecure:master' into modprobe_refresh + +commit 725565c42e7b3e1bb5036d160cc0388cc001901b +Author: Patrick Schleizer +Date: Tue Dec 9 14:06:55 2025 +0000 + + bumped changelog version + +commit b7b6b6e5fbeba0cfab141bf05d7fb657879ba8e9 +Author: Patrick Schleizer +Date: Mon Dec 8 09:42:59 2025 -0500 + + output + +commit 8f99672cb24242d6cb86d985384ab4ad7d1aca54 +Author: Patrick Schleizer +Date: Fri Dec 5 11:39:12 2025 +0000 + + bumped changelog version + +commit ac128dd873968b1815e4113b30ea69f34fa0b088 +Merge: 17dd7af7 85761a41 +Author: Patrick Schleizer +Date: Fri Dec 5 06:35:03 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 85761a4153a4f19e7b18e91062e97d3376451884 +Author: Aaron Rainbolt +Date: Thu Dec 4 23:27:18 2025 -0600 + + permission-hardener: Fix undo warning logic, minor improvements suggested by ChatGPT Codex + +commit 17dd7af7d1cf37ff30a17e2eaee06732d627ed34 +Author: Patrick Schleizer +Date: Wed Dec 3 08:31:22 2025 +0000 + + bumped changelog version + +commit c44678f92df924e4c10f08960426c526e0292aba +Merge: 6f9732be 0534a34e +Author: Patrick Schleizer +Date: Wed Dec 3 03:22:44 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 0534a34ed7246793db384518cfbecb3adfcb7f3e +Author: Aaron Rainbolt +Date: Tue Dec 2 19:06:30 2025 -0600 + + Fix block-unsafe-logins when running as non-root, add swaylock to list of safe auth services + +commit 6f9732be98cbc344076b89d57491c423368172d5 +Merge: 2089b3a9 b3eb739f +Author: Patrick Schleizer +Date: Tue Dec 2 06:04:07 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit b3eb739fe2662acfbd844de8d87af4720727fc7a +Author: Aaron Rainbolt +Date: Sun Nov 30 00:20:21 2025 -0600 + + Link fix, change some wording + +commit 5f34b4146e895bb935b719071ab2762278944995 +Merge: 2c253b13 29176d2e +Author: Aaron Rainbolt +Date: Sun Nov 30 00:12:18 2025 -0600 + + Merge remote-tracking branch 'raja/docs' into arraybolt3/trixie + +commit 2c253b1312c034cb8395039803380c1157967061 +Merge: 17ab1bb0 c5f91eb3 +Author: Aaron Rainbolt +Date: Sat Nov 29 21:01:51 2025 -0600 + + Merge remote-tracking branch 'raja/vsyscall32' into arraybolt3/trixie + +commit 17ab1bb00fe287c4c941d9cd3813ee3a3ae89ade +Author: Aaron Rainbolt +Date: Sat Nov 29 20:44:30 2025 -0600 + + Documentation fix + +commit 2b2d30afce3d40eb9c2177ad67fd7d89cd4602a0 +Merge: f0d069c7 3fdfebc4 +Author: Aaron Rainbolt +Date: Sat Nov 29 20:23:09 2025 -0600 + + Merge remote-tracking branch 'raja/limit_full_force' into arraybolt3/trixie + +commit f0d069c7968e2ee10d7104ce1ba502d3122b0ab2 +Author: Aaron Rainbolt +Date: Sat Nov 29 20:15:03 2025 -0600 + + Minor README.md corrections + +commit b73a830b0f62fe43b38cc89d56d997bed355570c +Merge: e54cb007 53d90b11 +Author: Aaron Rainbolt +Date: Sat Nov 29 19:59:35 2025 -0600 + + Merge remote-tracking branch 'raja/kpti' into arraybolt3/trixie + +commit e54cb007f9fc351c25c292ffd68abe974be56bb0 +Merge: 84e193c4 e43d4d7f +Author: Aaron Rainbolt +Date: Sat Nov 29 19:54:10 2025 -0600 + + Merge remote-tracking branch 'raja/limit_bdev_writes' into arraybolt3/trixie + +commit 84e193c44ec9ebf676d1fb4a32d6e2f68afd3d0d +Merge: 65c45fc3 5ac02d2d +Author: Aaron Rainbolt +Date: Fri Nov 28 14:21:59 2025 -0600 + + Merge remote-tracking branch 'raja/stop_tw_reuse' into arraybolt3/trixie + +commit 65c45fc3d799cdf6402328cc61cbdd1949a12945 +Author: Aaron Rainbolt +Date: Fri Nov 28 00:13:45 2025 -0600 + + Minor fixes to NMI panic docs + +commit 37b1d055f18c6335e96c41c06174b66e43e4a8ff +Merge: 7280d886 ebc011e6 +Author: Aaron Rainbolt +Date: Fri Nov 28 00:09:43 2025 -0600 + + Merge remote-tracking branch 'raja/panic_nmi' into arraybolt3/trixie + +commit 7280d8867da50e05dd7d3071123d49b15660051d +Merge: 2089b3a9 62dc2d44 +Author: Aaron Rainbolt +Date: Thu Nov 27 23:28:53 2025 -0600 + + Merge remote-tracking branch 'raja/amd_encrypt_ram' into arraybolt3/trixie + +commit 2089b3a9b8e9d10c06850f0329f7e2eb8a8a12cc +Author: Patrick Schleizer +Date: Mon Nov 24 08:44:10 2025 +0000 + + bumped changelog version + +commit cbd35502f19e74b6f95ff40bf03f02806eef3cdc +Author: Patrick Schleizer +Date: Mon Nov 24 03:18:25 2025 -0500 + + comment + +commit cac73c3154b3278ad71edc0fd159afc71d5dbc45 +Author: Patrick Schleizer +Date: Mon Nov 24 03:17:38 2025 -0500 + + minor + +commit d68988e76cda939ce200d970e19310cadba5d08e +Author: Patrick Schleizer +Date: Mon Nov 24 03:17:25 2025 -0500 + + comments + +commit c1ca36d75888b95835b953c3a8a122954c1e5929 +Merge: ec116795 a3417e99 +Author: Patrick Schleizer +Date: Mon Nov 24 03:11:19 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit a3417e997d26e9a88d30da408d470fab98f58d79 +Author: Aaron Rainbolt +Date: Sun Nov 23 16:27:59 2025 -0600 + + Add pkexec remembered permissions fix for permission-hardener, fix some postinst bugs + +commit edda37809fb186f6d85511e774957b701483ca66 +Author: Aaron Rainbolt +Date: Sun Nov 23 14:54:02 2025 -0600 + + Remove obsolete migration code for permission-hardener, add initial permission-hardener state installation code + +commit ec11679514d54c9a61e7c4e35ce81467b12333f4 +Author: Patrick Schleizer +Date: Sun Nov 23 10:26:13 2025 +0000 + + bumped changelog version + +commit 5c4d3162ab3c5178502c1f48e6288dc86cc45bb1 +Author: Patrick Schleizer +Date: Sun Nov 23 05:25:13 2025 -0500 + + fix + +commit 30068ec8cdaa7a6778f0ba0b423f7ab3c3391759 +Author: raja-grewal +Date: Sat Nov 22 15:01:47 2025 +1100 + + Correct bitmask + +commit f75e9873375d187fbbe4b5bfd135d0cd26a93fe6 +Author: raja-grewal +Date: Fri Nov 21 13:06:42 2025 +0000 + + Relabel some disabled module headings + +commit 79be87ec5f2cb22a98ada179b3aa97dfd58299e0 +Author: raja-grewal +Date: Fri Nov 21 13:05:13 2025 +0000 + + Move (optional) CPU MSR module disable list + +commit 1a7b0a9122cc6b6e755a540dd62fd018a1a7536d +Author: raja-grewal +Date: Fri Nov 21 12:43:05 2025 +0000 + + Disable more file systems + +commit 1865cafe446c6a525bc63caa7ce1097ce573b877 +Author: raja-grewal +Date: Fri Nov 21 12:42:10 2025 +0000 + + Move joydev from blacklist to disable + +commit 28476d3d53a0e4796b4396a925c44ccf32f4fe90 +Author: raja-grewal +Date: Fri Nov 21 12:40:12 2025 +0000 + + Update docs on GrapheneOS blacklisted modules + +commit 446d3771bf8c42aba61d248bccfe9fad4eacc88d +Author: raja-grewal +Date: Fri Nov 21 12:38:44 2025 +0000 + + Update docs on CD-ROM/DVD blacklisting + +commit 3646a2fefeaa774aea068d7c6e761c5b76479f55 +Author: raja-grewal +Date: Fri Nov 21 12:37:57 2025 +0000 + + Move superseded brcm80211 to disabled + Split and replaced by brcmsmac and brcmfmac in kernel 2.6.39 + +commit 66ba273d448ff92c249abe9dd0f83a64cc1ee823 +Author: raja-grewal +Date: Fri Nov 21 12:36:57 2025 +0000 + + Add CPU MSR modules + +commit e6aa648d54f076c5c75d45bcd7658d502b701982 +Author: raja-grewal +Date: Fri Nov 21 12:36:32 2025 +0000 + + Update docs on CPU MSR disabling + +commit 59869979bbc2fb16da6b3435276e4930b4088f59 +Author: raja-grewal +Date: Fri Nov 21 12:35:51 2025 +0000 + + Update docs on Vivid disabling + +commit 4597fd16a9b94ebd6b4fae152a64288b665d9c36 +Author: raja-grewal +Date: Fri Nov 21 12:35:03 2025 +0000 + + Sort RDNIS disabling and add docs + +commit 5adc007536578c1e70a8cc6784fbced2033b7a5c +Author: raja-grewal +Date: Fri Nov 21 12:33:15 2025 +0000 + + Update docs on Intel PMT disabling + +commit 31e3aa0c3add48ad26e43e4b83358571843f28de +Author: raja-grewal +Date: Fri Nov 21 12:32:30 2025 +0000 + + Update docs on Bluetooth disabling + +commit 9f85a78c9919d71c3e92099cac8525ac385aea5c +Author: Patrick Schleizer +Date: Wed Nov 19 07:02:14 2025 +0000 + + bumped changelog version + +commit 4e7cfb0d061810ec7c3139379a65db83abc39efc +Merge: d267cf67 936c799c +Author: Patrick Schleizer +Date: Wed Nov 19 01:55:10 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 936c799cb5f48376fa259bb3b92b653526a00509 +Author: Aaron Rainbolt +Date: Tue Nov 18 23:53:03 2025 -0600 + + Don't break passwordless sudo in unrestricted admin mode + +commit 68025d3624e7543deec2fbe43ea0f010344e4160 +Author: raja-grewal +Date: Wed Nov 19 01:16:46 2025 +0000 + + Provide option to `panic_on_taint` + +commit ebc011e67bff659778cbca2240c5e57d663f3f41 +Author: raja-grewal +Date: Wed Nov 19 11:35:04 2025 +1100 + + Typo + +commit 62dc2d448366d190812773ec9eeadd38e1223cbc +Author: raja-grewal +Date: Tue Nov 18 20:31:46 2025 +1100 + + Add note about Intel TME + +commit 29176d2ed29b07c4da9b9c0df1eefd2bda70b984 +Author: raja-grewal +Date: Sat Nov 15 06:30:11 2025 +0000 + + Remove the option to reduce the MCE tolerance level + +commit 9f897c5ccda781d010077446abb3d176cf929c94 +Author: raja-grewal +Date: Sat Nov 15 05:48:33 2025 +0000 + + Update docs on reducing the MCE tolerance level + +commit b6fe1a5a6e164c7a7505b5e27ece582a1b928d82 +Author: raja-grewal +Date: Sat Nov 15 04:51:01 2025 +0000 + + Make panic related settings consistent + Ensures the `sysctl` and boot parameters are equivalent in settings and in description. This should prevent future questions regarding having omitted boot parameters that were actually redundant. + +commit 99e993b885ca1fa30a871120b545f9334371cd5a +Author: raja-grewal +Date: Sat Nov 15 03:16:07 2025 +0000 + + Provide options to enable AMD SME and SEV + +commit d267cf6761076092c299508a0c356c05d0ee713d +Author: Patrick Schleizer +Date: Fri Nov 14 06:21:34 2025 +0000 + + bumped changelog version + +commit efa06a1eae52b15978eb84f6ab4153ae88eb8d6a +Author: Patrick Schleizer +Date: Fri Nov 14 00:44:50 2025 -0500 + + port to package-installed-check + +commit abf5852ebabec81d553a60139fe5a15972d14ab5 +Author: Patrick Schleizer +Date: Wed Nov 12 06:13:05 2025 +0000 + + bumped changelog version + +commit 3af891645503c62ff5510b78e5cbe73774ad72a2 +Merge: fb587f78 3070aa5d +Author: Patrick Schleizer +Date: Tue Nov 11 23:59:50 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit d891313d57b469c28c08993b05d355b29ea08397 +Author: raja-grewal +Date: Tue Nov 11 11:39:21 2025 +0000 + + Provide options to panic upon receiving NMIs + +commit 0b9b9ffb1e87850e3296d0420c305062b66868d5 +Author: raja-grewal +Date: Tue Nov 11 11:32:47 2025 +0000 + + Improve clarity for panic on OOM + +commit 3070aa5d1f988b199030b31baa2fabc2db7b289f +Author: Aaron Rainbolt +Date: Mon Nov 10 22:40:15 2025 -0600 + + Fix passwordless login for sensitive accounts, only deny passwordless privilege escalation + +commit ab98da957c732340ddb7bb43ed445835220c21d1 +Author: raja-grewal +Date: Tue Nov 11 04:28:56 2025 +0000 + + Re-set `net.ipv4.conf.*.log_martians=1` + +commit fb587f78fd11e471b3169f8c67c1772c1ba3729d +Author: Patrick Schleizer +Date: Mon Nov 10 08:00:06 2025 +0000 + + bumped changelog version + +commit fc1b865dd7a7663cbea8948c06ce45e69269a3b1 +Author: Patrick Schleizer +Date: Mon Nov 10 02:21:27 2025 -0500 + + debugging + +commit 45126cede6563a3bfe9c700543fdec09442f1cb3 +Author: Patrick Schleizer +Date: Mon Nov 10 02:19:29 2025 -0500 + + end-of-options + +commit 61637a5ff06b69210f293bed91735a2bf80e8946 +Author: Patrick Schleizer +Date: Mon Nov 10 02:15:30 2025 -0500 + + refactoring + +commit ddb59a3b01444762c7a9da68d2cc34d98f3d8f96 +Author: Patrick Schleizer +Date: Mon Nov 10 02:13:48 2025 -0500 + + comment + +commit ae1e2e3b52ea4c18ed1d4bb2e7cf3c2adf06711c +Author: Patrick Schleizer +Date: Mon Nov 10 02:10:25 2025 -0500 + + output + +commit f2b765854203cfb5be15ad63a260fec860ed0620 +Author: Patrick Schleizer +Date: Mon Nov 10 02:09:54 2025 -0500 + + use long option names + +commit 71ca68bd4aab5adad9a8c1dd20df4dc6990885e7 +Author: Patrick Schleizer +Date: Mon Nov 10 02:09:00 2025 -0500 + + end-of-options + +commit e9e6c12b03fd6f440232221cdf7f34e9bc7661a2 +Author: Patrick Schleizer +Date: Mon Nov 10 02:08:04 2025 -0500 + + output + +commit f5db916bf728f8d09ee48cec5cb0a0a3ee520e33 +Author: Patrick Schleizer +Date: Mon Nov 10 02:06:55 2025 -0500 + + fix + +commit bb0a23fcc80b7963e0fc80f6e7da6931aa88c300 +Author: Patrick Schleizer +Date: Mon Nov 10 02:05:47 2025 -0500 + + chmod +x + +commit 39a6ce002e9ff696104906be252afffce70dd959 +Author: Patrick Schleizer +Date: Mon Nov 10 02:05:03 2025 -0500 + + genmkfile debinstfile + +commit 94de949a4797be1706378a10324ec9c2522834a7 +Merge: 0939883f 5fbd42bb +Author: Patrick Schleizer +Date: Mon Nov 10 02:04:15 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 5ac02d2d528a37fe1c162c4808b3d874a8c53159 +Author: raja-grewal +Date: Mon Nov 10 06:13:35 2025 +0000 + + Set `net.ipv4.tcp_tw_reuse=0` + +commit b89aaea61e83aea6b23ea34a01dbb1e6bce1e2df +Author: raja-grewal +Date: Mon Nov 10 06:03:33 2025 +0000 + + Add docs on logging martian packets + +commit 5fbd42bbec55d66197b70789b10f7cb6705207fb +Author: Aaron Rainbolt +Date: Sun Nov 9 18:38:54 2025 -0600 + + Add kill-vboxdrmclient-on-shutdown.service + +commit 9d86379f5624a6c2b20645c34e1621977c1d4db9 +Author: Aaron Rainbolt +Date: Sun Nov 9 17:46:22 2025 -0600 + + Prevent non-sysmaint logins in sysmaint mode and unsafe passwordless logins in user mode + +commit a3830db09e3f567237caefb687ef2da877573b03 +Author: raja-grewal +Date: Sun Nov 9 13:42:31 2025 +0000 + + Update docs relating to panic on OOM + +commit 0aa0b67df6a33b84a656cfb7055c4af5ca583439 +Merge: a46f678c 0939883f +Author: raja-grewal +Date: Mon Nov 10 00:20:48 2025 +1100 + + Merge branch 'master' into docs + +commit 0939883f0b5e1232e9aa85e61c0cbef551a59357 +Author: Patrick Schleizer +Date: Sun Nov 9 10:47:45 2025 +0000 + + bumped changelog version + +commit 039141188558931b73a9b5897ea3422bbb201dad +Author: Patrick Schleizer +Date: Sun Nov 9 05:47:00 2025 -0500 + + revert Force immediate kernel panic on OOM. + + https://github.com/Kicksecure/security-misc/issues/324#issuecomment-3507949741 + +commit 26b96ce2800e794104e6d3c113c3c2c121795b39 +Author: Patrick Schleizer +Date: Sun Nov 9 08:12:42 2025 +0000 + + bumped changelog version + +commit 1ef974300a157235da6a6c4d1379b62acf0c4c61 +Author: Patrick Schleizer +Date: Sat Nov 8 04:00:47 2025 -0500 + + readme + +commit 48ce12eba38aec099b4afe42e4d42b1d41dcb97f +Author: Patrick Schleizer +Date: Sat Nov 8 07:44:43 2025 +0000 + + bumped changelog version + +commit 69419357e1bb2d0842ecd5db3e42bcaa011f5c11 +Author: Patrick Schleizer +Date: Sat Nov 8 02:42:25 2025 -0500 + + genmkfile debinstfile + +commit d50e6afc8fb0a925e07fc54b7ecc1f450d9aa176 +Author: Patrick Schleizer +Date: Sat Nov 8 01:34:32 2025 -0500 + + sanity test + +commit 12679608428e6927da480ca721b34bab75108687 +Author: Patrick Schleizer +Date: Sat Nov 8 01:32:45 2025 -0500 + + comments + +commit 1e48886c7e77fa7bccfdee3cca6f0fbdba74e4a1 +Author: Patrick Schleizer +Date: Sat Nov 8 01:31:02 2025 -0500 + + long option name + +commit d6c949c791bcc2c76b4f2e81eb0ffd370f8f1a37 +Merge: 5b97e7bd fa32ba6c +Author: Patrick Schleizer +Date: Sat Nov 8 01:29:48 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit fa32ba6c4fccf35111f85ec3819e718963359d7c +Author: Aaron Rainbolt +Date: Fri Nov 7 17:09:22 2025 -0600 + + Suppress usbguard startup unless a USB controller is visible to lspci + +commit 635c216d4e55eb0c6463c543202aea629c572f5e +Author: raja-grewal +Date: Wed Nov 5 01:44:36 2025 +0000 + + Update docs on CPU mitigations + +commit a46f678c7f8715fd1cedd1102f9815b9d845ccb3 +Author: raja-grewal +Date: Wed Nov 5 00:05:17 2025 +0000 + + Update docs on latent entropy + +commit 37b493826ec60397c6019959abb7e0631dd33ed4 +Author: raja-grewal +Date: Wed Nov 5 00:03:54 2025 +0000 + + Spit distrusting entropy settings for clarity + +commit 019a0cf72c99f9f10fd42afbfed96c283e17e458 +Author: raja-grewal +Date: Wed Nov 5 00:03:19 2025 +0000 + + Update docs on entropy + +commit 4c88b911415cbf57eecc93a22c6674322662db50 +Merge: d175d1be 5b97e7bd +Author: raja-grewal +Date: Wed Nov 5 10:10:10 2025 +1100 + + Merge branch 'Kicksecure:master' into docs + +commit e43d4d7f7110de0b23996373e9462aa900b314a6 +Author: raja-grewal +Date: Mon Nov 3 05:46:07 2025 +0000 + + Set `bdev_allow_write_mounted=0` + +commit 53d90b1128d55e352b3eef8ae680a07a825b1ecf +Author: raja-grewal +Date: Mon Nov 3 04:32:49 2025 +0000 + + Update docs on `ssbd=force-on` + +commit 322584db3346aaa1e3d1f9782b3d22ca2153c7da +Author: raja-grewal +Date: Mon Nov 3 04:31:59 2025 +0000 + + Update docs on `pti=on` + +commit 5e87c9bea49b5a06c1400cb8b632f344cccb6db6 +Author: raja-grewal +Date: Mon Nov 3 04:30:58 2025 +0000 + + Set `kpti=1` + +commit 3fdfebc4646d7c1f48806d02810de44fd53482bb +Author: raja-grewal +Date: Mon Nov 3 00:48:49 2025 +0000 + + Set `proc_mem.force_override=ptrace` + +commit 5b97e7bd277038b3b04c80a78ce05bb52277d4f6 +Author: Patrick Schleizer +Date: Sun Nov 2 11:41:51 2025 +0000 + + bumped changelog version + +commit 58d5f738e63d4c18048fab4e2fd134d68722d0fd +Merge: 5121f80f 7beb19b6 +Author: Patrick Schleizer +Date: Sun Nov 2 06:08:46 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 5121f80f28d374d78bb3897a46fe924d750f4643 +Author: Patrick Schleizer +Date: Sun Nov 2 06:00:24 2025 -0500 + + comment + +commit 29685938bdfd5c14828091342dbe21283ed45fd1 +Author: Patrick Schleizer +Date: Sun Nov 2 05:57:52 2025 -0500 + + move usbguard reject rules to the top + +commit c5f91eb33a2ad745af7a6278cf49419d0b366343 +Author: raja-grewal +Date: Sun Nov 2 06:15:06 2025 +0000 + + Add another method to disable 32-bit legacy vsyscalls + +commit d175d1be525edd8fb6140680c31425c8a89cc244 +Author: raja-grewal +Date: Sun Nov 2 15:54:34 2025 +1100 + + Add doc on entropy related failure on AMD Zen 5 CPUs + +commit 7beb19b64a33cb86771488ab558756fa86b577d3 +Author: Aaron Rainbolt +Date: Sat Nov 1 22:06:44 2025 -0500 + + Update README.md with info about flatpak auth hardening + +commit 5a6730450af6e3d1ab76d6e26d4fb1d7175be946 +Author: Patrick Schleizer +Date: Sat Nov 1 10:13:50 2025 +0000 + + bumped changelog version + +commit 7de05e88f57a343ac358ddbd6a8b3a5f0aa68a51 +Author: Patrick Schleizer +Date: Sat Nov 1 06:13:37 2025 -0400 + + fix + +commit fe8b7fda3d16195b7a7e7a6218e2bc12d808bcb8 +Author: Patrick Schleizer +Date: Sat Nov 1 06:08:20 2025 -0400 + + chmod +x + +commit ad0053d93797aaba2f242f8e7c142eee064c1bca +Author: Patrick Schleizer +Date: Sat Nov 1 09:41:23 2025 +0000 + + bumped changelog version + +commit 94918eeefbf962dbd66cbb052f2304496b1e2814 +Author: Patrick Schleizer +Date: Sat Nov 1 05:24:31 2025 -0400 + + lintian + +commit 6cc5eebe22d9af3591a0bd32e3ca7e9c0849fc44 +Author: Patrick Schleizer +Date: Sat Nov 1 09:18:12 2025 +0000 + + bumped changelog version + +commit 81a279ee1f23706c2309c02da536b68f00e3eff3 +Author: Patrick Schleizer +Date: Sat Nov 1 05:10:05 2025 -0400 + + genmkfile debinstfile + +commit e24eee361d1f810b2ba23b257903fe2824e7d703 +Author: Patrick Schleizer +Date: Sat Nov 1 04:10:17 2025 -0400 + + remove unicode + +commit 53d380989185b5040f94dbb628e2bae5556ed0e1 +Merge: dcccad92 8b766fc3 +Author: Patrick Schleizer +Date: Sat Nov 1 04:02:46 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit dcccad926679c10355aac53326f8fd1b79c735b7 +Author: Patrick Schleizer +Date: Sat Nov 1 03:58:33 2025 -0400 + + no longer depend on sudo + +commit cfaa953373f3bf8de1b51be723f210069655eb74 +Author: Patrick Schleizer +Date: Sat Nov 1 03:42:33 2025 -0400 + + output + +commit 8b766fc3ad6b0c9675670f38e886beb6b769494b +Author: Aaron Rainbolt +Date: Fri Oct 31 15:23:12 2025 -0500 + + Lock down flatpak software management + +commit 948c96afe93bcc87cea203dd7b45a741d46543d1 +Author: Patrick Schleizer +Date: Fri Oct 31 14:38:30 2025 +0000 + + bumped changelog version + +commit aae472d9cfb2f42a861af8a886c28acd640da545 +Author: Patrick Schleizer +Date: Fri Oct 31 10:24:31 2025 -0400 + + Revert "Move apparmor-info, apparmor-watch to security-misc, enable systemd-journald audit transport" + + This reverts commit d1e148eba72ff5a095e31842a70afec7f28c8724. + +commit 3b2092ee764fe3ab8d72b912f0dcc4726ba76f4e +Merge: b168c37e d1e148eb +Author: Patrick Schleizer +Date: Fri Oct 31 10:19:08 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit d1e148eba72ff5a095e31842a70afec7f28c8724 +Author: Aaron Rainbolt +Date: Thu Oct 30 23:05:19 2025 -0500 + + Move apparmor-info, apparmor-watch to security-misc, enable systemd-journald audit transport + +commit b168c37e841d971743a8f2fe2d64ab4187e4029b +Author: Patrick Schleizer +Date: Mon Oct 27 11:48:10 2025 +0000 + + bumped changelog version + +commit c9d48ef7fdd2b691a7abd880d5e695c6296332b6 +Author: Patrick Schleizer +Date: Mon Oct 27 07:07:25 2025 -0400 + + readme + +commit 2dda826e02a10a9cebabe3896fc4c850221cc423 +Author: Patrick Schleizer +Date: Sun Oct 26 12:30:29 2025 +0000 + + bumped changelog version + +commit cb70f198375c5b68058a3705258e78464786922b +Author: Patrick Schleizer +Date: Sun Oct 26 08:06:26 2025 -0400 + + more robust, standardized kernel_cmdline variable detection + +commit 53db63196432e3fdf8fc031f0e78b4666b0f1514 +Author: Patrick Schleizer +Date: Thu Oct 23 06:03:26 2025 +0000 + + bumped changelog version + +commit f2b33b1ad54ac94aca200c001311e0794634e6f9 +Author: Patrick Schleizer +Date: Thu Oct 23 01:08:38 2025 -0400 + + update + +commit 1f093f817527d168ede3a682651088a051f40cb9 +Author: Patrick Schleizer +Date: Wed Oct 22 00:37:36 2025 -0400 + + do not start usbguard-notifier if /sys/bus/usb does not exist + +commit 8f78269949217ac11163cc8b6f17147621fef6eb +Author: raja-grewal +Date: Mon Oct 20 05:36:54 2025 +0000 + + Add docs on slab_debug + +commit 7969ffd4a52786f4a92f74931fff85430906a629 +Author: Patrick Schleizer +Date: Sun Oct 19 08:43:36 2025 +0000 + + bumped changelog version + +commit f555c48c51dab3eefc99085eace277f15ef72c33 +Author: Patrick Schleizer +Date: Sun Oct 19 04:42:24 2025 -0400 + + fix USBGuard-notifier `accept` / `reject` buttons + + https://forums.kicksecure.com/t/usbguard-what-should-we-allow-or-disallow-by-default/1248/49 + +commit 9f7480e20adf148dcb7dbe80e704f3f79691b657 +Author: raja-grewal +Date: Sun Oct 19 01:41:58 2025 +0000 + + Make terminology consistent + +commit f2c3eba4f06c38fda7843427c352022a0f869f66 +Merge: 11d9b940 929421bd +Author: raja-grewal +Date: Sun Oct 19 12:23:13 2025 +1100 + + Merge branch 'Kicksecure:master' into docs + +commit 929421bd258a3c0c1f142f707aeff479f2ea3c49 +Author: Patrick Schleizer +Date: Sat Oct 18 09:19:07 2025 +0000 + + bumped changelog version + +commit f5b7aab87ec6640eb1969bb4be05bb5b0ff04a3c +Author: Patrick Schleizer +Date: Sat Oct 18 05:18:55 2025 -0400 + + update + +commit 806eec423a7a6acb0d5eabc5872c9a5d121a4dc3 +Merge: 6cc1c27f 70fbbc23 +Author: Patrick Schleizer +Date: Sat Oct 18 04:44:41 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 70fbbc230c0c5366b7a09d531012d18b1e88e07b +Author: Aaron Rainbolt +Date: Fri Oct 17 15:49:42 2025 -0500 + + Set USBGuard settings to permit USB hubs and Qubes USB passthrough + +commit 11d9b9403854ae7cd2638765e8350257580be35f +Author: raja-grewal +Date: Fri Oct 17 01:01:28 2025 +0000 + + Add docs on entropy + +commit 708e1358dfbc21444f2bf39dfa81ea5053f2bb10 +Author: raja-grewal +Date: Fri Oct 17 00:48:57 2025 +0000 + + Add docs relating `extra_latent_entropy` + +commit 3d5e659b78cf2588f95280c13b1ebdf24060fb6f +Author: Aaron Rainbolt +Date: Wed Oct 15 19:02:48 2025 -0500 + + Remove trailing spaces + +commit 29639fe69e12ff71ec422a0137b5dbaade9179c3 +Merge: 026d55ac 0c8f2f1b +Author: Aaron Rainbolt +Date: Wed Oct 15 19:01:08 2025 -0500 + + Merge remote-tracking branch 'raja/bad_ipv6_ra' into arraybolt3/trixie + +commit 026d55ac410bf747db03c0cf9475b3408bce7f8e +Author: Aaron Rainbolt +Date: Wed Oct 15 18:30:52 2025 -0500 + + Typo fixes + +commit 35fce26476b20eda81544f583bd2b2124b8e96b0 +Merge: 4f63af42 23041741 +Author: Aaron Rainbolt +Date: Wed Oct 15 18:18:33 2025 -0500 + + Merge remote-tracking branch 'raja/stop_ptrace' into arraybolt3/trixie + +commit 4f63af4200de23e2216be6d3e7f1055af02dbc3b +Author: Aaron Rainbolt +Date: Wed Oct 15 17:53:26 2025 -0500 + + Allow listing USB devices via usbguard + +commit f690b58870bd90582018cec51046f4ed67a414d4 +Author: raja-grewal +Date: Mon Oct 13 02:08:44 2025 +0000 + + Add docs relating to panic on OOM + +commit 9db63d97770e62749c0b602dd9e7d2d4d6a1128b +Author: raja-grewal +Date: Mon Oct 13 01:01:14 2025 +0000 + + README: Update KSSP compliance status + +commit 23041741715cc5f3d16378d6bb34719ceaa1642c +Author: raja-grewal +Date: Sun Oct 12 02:32:45 2025 +0000 + + Insert empty new line + +commit 7161430a6000c4ff5e15a9a8c9519529655a1444 +Author: raja-grewal +Date: Sun Oct 12 02:27:48 2025 +0000 + + Seperate `ptrace()` disabling into own file + +commit 6cc1c27fb376d02adc6c5cddf64b030e2e694711 +Author: Patrick Schleizer +Date: Fri Oct 10 12:08:28 2025 +0000 + + bumped changelog version + +commit 4d9c3dc357ae92b735cf96f121491f7eed1be9f5 +Author: Patrick Schleizer +Date: Fri Oct 10 08:08:10 2025 -0400 + + minor + +commit 968de33c659f971fc62b2a6a63cceb7462c3d0f8 +Author: Patrick Schleizer +Date: Fri Oct 10 08:03:03 2025 -0400 + + Force immediate kernel panic on OOM. + This is to avoid security features such as the screen locker, kloak, emerg-shutdown + from being arbitrarily terminated when the system starts running out of memory. + + https://forums.whonix.org/t/screen-locker-in-security-can-we-disable-these-at-least-4-backdoors/8128/14 + + https://github.com/Kicksecure/security-misc/issues/324 + + `vm.panic_on_oom=2` + + implements https://github.com/Kicksecure/security-misc/issues/324 + +commit 98f27c3b2e1420f6d29cabe7d0c60a92989d06e1 +Author: Patrick Schleizer +Date: Fri Oct 10 06:53:04 2025 -0400 + + comment + +commit 28a88c70914ac2ce8c4cfc5b9ed558e026a6d7a9 +Author: Patrick Schleizer +Date: Fri Oct 10 06:52:13 2025 -0400 + + comment + +commit f4a87e77488c9034611c750d018603326cb42067 +Merge: 685070bd 6cf8a623 +Author: Patrick Schleizer +Date: Fri Oct 10 06:51:31 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 6cf8a623feda09abc72a19b3e4c74c3f37b64d26 +Merge: 685070bd e89c7ae0 +Author: Patrick Schleizer +Date: Fri Oct 10 06:50:46 2025 -0400 + + Merge pull request #325 from raja-grewal/hash_pointers + + Docs detailing future improvements to `slab_debug` + +commit e89c7ae0254d41ac1696e23f8b2d4a425413d888 +Author: raja-grewal +Date: Wed Oct 8 02:39:20 2025 +0000 + + Update docs on `slab_debug` for future improvements + +commit 685070bd026e52f007e27428e5479e2f1c2413fe +Author: Patrick Schleizer +Date: Tue Oct 7 08:40:32 2025 +0000 + + bumped changelog version + +commit ba6ec919f0804bf8bbfaf057c86a067683cbb826 +Merge: dd961b84 718772ea +Author: Patrick Schleizer +Date: Tue Oct 7 04:34:51 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 718772ea7824cd879d36e5eeff8270457df9ad33 +Author: Aaron Rainbolt +Date: Mon Oct 6 15:03:31 2025 -0500 + + Remove unsafe sanitizer compiler flags from emerg-shutdown + +commit 0c8f2f1b44049b676251775d64e23651e9225d00 +Author: raja-grewal +Date: Thu Oct 2 07:05:00 2025 +0000 + + Add docs about the risks associated with IPv6 RAs + +commit 4340bf50b7bf9112703d78fae4e8ca4f5e458ab6 +Author: raja-grewal +Date: Mon Sep 29 15:46:06 2025 +1000 + + Warnings about using `mitigations=auto,nosmt` + +commit dd961b84272247f4e8f01d3042d8ca256ccf50d2 +Author: Patrick Schleizer +Date: Sun Sep 28 21:09:46 2025 +0000 + + bumped changelog version + +commit e6ba4dad46ba2e451fd586357913b68ad25d6004 +Merge: 22c98634 60f8153f +Author: Patrick Schleizer +Date: Sun Sep 28 17:00:24 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 60f8153f64667718edbf9c048d5fa1d3c2ca1980 +Author: Aaron Rainbolt +Date: Sun Sep 28 15:05:21 2025 -0500 + + Fix emerg-shutdown gcc build, remove AddressSanitizer from hardening options since it is incompatible with static builds + +commit 7e016b563239e31c650aece115bb19af0395ec52 +Author: Aaron Rainbolt +Date: Sun Sep 28 14:11:10 2025 -0500 + + Allow users in the qubes group to access USBGuard IPC + +commit 194b8fce4e5a8e9c642171853d7b0491debced55 +Author: raja-grewal +Date: Sun Sep 28 03:20:24 2025 +0000 + + Disable the usage of `ptrace()` by all processes + +commit 22c9863493b326d8ec730ecdf721593b836baf99 +Author: Patrick Schleizer +Date: Fri Sep 26 08:40:20 2025 +0000 + + bumped changelog version + +commit 08199dfe9471c5bff1af3e5f065810c47cfa7a12 +Merge: 590aaec7 58cc6731 +Author: Patrick Schleizer +Date: Fri Sep 26 04:31:02 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 58cc6731f27446c3bfbd5df1e669b625af922efe +Author: Aaron Rainbolt +Date: Thu Sep 25 23:55:03 2025 -0500 + + Additional hardening on emerg-shutdown + +commit 78492e0e5656990ecec7ad2641d5f7e46a264aab +Author: raja-grewal +Date: Thu Sep 25 15:35:34 2025 +1000 + + README: Do not rely on `mitigations=auto` + +commit b9deefed61b40127bbb7aaad8dd83f256b68f896 +Author: raja-grewal +Date: Thu Sep 25 15:34:54 2025 +1000 + + Incompleteness of `mitigations=auto,nosmt` + +commit 590aaec73d389ecfa2610cbf7931a2e380af3e8d +Author: Patrick Schleizer +Date: Wed Sep 24 14:32:35 2025 +0000 + + bumped changelog version + +commit 253688039447d69eb6eaf2d8d2e1c6ed04e2f839 +Merge: 275eecc4 17ee63ac +Author: Patrick Schleizer +Date: Wed Sep 24 10:32:12 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 17ee63aca445d0e41af05eb9807849fc3c0f62d3 +Merge: 275eecc4 d31f63fb +Author: Patrick Schleizer +Date: Wed Sep 24 10:31:31 2025 -0400 + + Merge pull request #319 from raja-grewal/release_notice + + Notice on public releases + +commit d31f63fb1052adb186c323349aa4e36fb6fc8551 +Author: raja-grewal +Date: Tue Sep 23 05:47:45 2025 +0000 + + README: Notice on public releases + +commit 275eecc4f8100fe62e64a382c0ba5e8503ad0482 +Author: Patrick Schleizer +Date: Mon Sep 22 17:25:48 2025 +0000 + + bumped changelog version + +commit c45a4ffdd221964cee5ee5e5b70a0e4ba02eec11 +Merge: 5738bb61 2a39d599 +Author: Patrick Schleizer +Date: Mon Sep 22 13:04:33 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 2a39d5997c410da2cf314f82826d1281879f8a6c +Author: Aaron Rainbolt +Date: Sun Sep 21 16:06:11 2025 -0500 + + security-misc split string changes + +commit 5738bb61045fb00d570c61cefd4c80fbc31d92e3 +Author: Patrick Schleizer +Date: Fri Sep 19 18:43:36 2025 +0000 + + bumped changelog version + +commit 9acdfc741b1b9da243d22ec6fed84f241c446b79 +Author: Patrick Schleizer +Date: Fri Sep 19 14:42:35 2025 -0400 + + description + +commit 62ea7e50410cb354d13600a26de27eaa3af8e309 +Author: Patrick Schleizer +Date: Fri Sep 19 14:41:05 2025 -0400 + + `security-misc` -> `security-misc-shared` package migration + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 02d0ba49bb187f46dbc5969fa00d26f668446a71 +Author: Patrick Schleizer +Date: Fri Sep 19 18:10:09 2025 +0000 + + bumped changelog version + +commit 0c7bee33a79dcd4c96cf374203418c83e1f7ca51 +Author: Patrick Schleizer +Date: Fri Sep 19 14:01:16 2025 -0400 + + comment + +commit 35830047961e2648add789bd44bd2f61cad0dc9a +Author: Patrick Schleizer +Date: Fri Sep 19 16:18:37 2025 +0000 + + bumped changelog version + +commit 67b1cb319ddcb94232ee385d5e67a9cec33b2567 +Author: Patrick Schleizer +Date: Fri Sep 19 12:05:29 2025 -0400 + + `Replaces: security-misc` + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 4bd08f8c818cc862ffb45cd47b7346f7cf89dd4f +Author: Patrick Schleizer +Date: Fri Sep 19 12:05:03 2025 -0400 + + wrap-and-sort + +commit 068750543aef8a74e7168cc58c667c940560a92a +Author: Patrick Schleizer +Date: Fri Sep 19 11:59:22 2025 -0400 + + update link + +commit ca90feb8d5cfa91e7ba3e13dd66d7df0c8343c58 +Author: Patrick Schleizer +Date: Fri Sep 19 11:54:04 2025 -0400 + + security-misc-server placeholder + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 4eb9ec15e11548bd472977c411fecd2bd1c527c0 +Author: Patrick Schleizer +Date: Fri Sep 19 11:51:14 2025 -0400 + + packaging + + https://github.com/Kicksecure/security-misc/issues/187 + +commit c2594a022e86c79a44e2023e518da3f1294346aa +Author: Patrick Schleizer +Date: Fri Sep 19 11:29:55 2025 -0400 + + rename + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 41ba668d23efb5f052394cfd9ab494e595058c17 +Author: Patrick Schleizer +Date: Fri Sep 19 11:23:10 2025 -0400 + + rename + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 1b194f9fd6de847b3450ea5b9b3cd51a3fbfb81f +Author: Patrick Schleizer +Date: Fri Sep 19 10:59:23 2025 -0400 + + adjust lintian overrides file + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 80562557ef5ac360aea2ea7c7a5c6faf76bdb2f0 +Author: Patrick Schleizer +Date: Fri Sep 19 10:53:25 2025 -0400 + + make install files executable + + https://github.com/Kicksecure/security-misc/issues/187 + +commit c99ea95410ef8fd8fd5d6134a914c344c8eea174 +Author: Patrick Schleizer +Date: Fri Sep 19 10:49:17 2025 -0400 + + genmkfile debinstfile + +commit 13e926207c606b0d009613fd41759d9f683cfea4 +Author: Patrick Schleizer +Date: Fri Sep 19 10:30:42 2025 -0400 + + packaging + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 55a8ec685d87a1327ac73d942370409b38e9ad3a +Author: Patrick Schleizer +Date: Thu Sep 18 10:53:21 2025 -0400 + + packaging split + + https://github.com/Kicksecure/security-misc/issues/187 + +commit b4a7d84bf507600cd181081fa85aaab26a3c7c59 +Author: Patrick Schleizer +Date: Thu Sep 18 10:53:10 2025 -0400 + + genmkfile debinstfile + +commit 43ed739479f0e764bf4ecc485094a926a1a4634e +Author: Patrick Schleizer +Date: Thu Sep 18 10:38:50 2025 -0400 + + genmkfile debinstfile + +commit ea878c351f73185411defa7e3f7980e85e8e91ae +Author: Patrick Schleizer +Date: Thu Sep 18 10:27:48 2025 -0400 + + genmkfile debinstfile + +commit 06c045f70ffc9b3c6a195dc900f3a6a16a39c4b1 +Author: Patrick Schleizer +Date: Thu Sep 18 10:00:33 2025 -0400 + + genmkfile debdistfile + +commit f70550d0150793874f8bf30e8aecb090b60fa8e5 +Author: Patrick Schleizer +Date: Wed Sep 17 14:49:28 2025 -0400 + + Split the `security-misc` into `security-misc-shared`, `security-misc-desktop` and `security-misc-server`: rename files + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 2de10d5b7b7589a6da03a6554b231ab55f7cc83c +Merge: ad367c0b 24424bcb +Author: Patrick Schleizer +Date: Wed Sep 17 13:32:44 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 24424bcbc072bbb7ad9c00371a3a2adc27432532 +Merge: 2d3b4ee1 21c605e2 +Author: Patrick Schleizer +Date: Wed Sep 17 13:31:27 2025 -0400 + + Merge pull request #318 from raja-grewal/vmscape + + Enable `vmscape=force` + +commit 2d3b4ee12425182c88f1bf7ac632f7672b25e00c +Merge: ad367c0b 7b32e933 +Author: Patrick Schleizer +Date: Wed Sep 17 13:27:13 2025 -0400 + + Merge pull request #317 from raja-grewal/srso_docs + + Update SRSO docs + +commit ad367c0bbc230357098d246f0fa88d19dad412a1 +Author: Patrick Schleizer +Date: Sat Sep 13 08:33:02 2025 +0000 + + bumped changelog version + +commit 95eeb579a6af3079b79a954351ab69646ec8ec09 +Merge: d262db2e 90b6486f +Author: Patrick Schleizer +Date: Sat Sep 13 04:04:10 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 21c605e27efaf10b3fd182e102c49135843ad21f +Author: raja-grewal +Date: Sat Sep 13 03:41:59 2025 +0000 + + Enable `vmscape=force` + +commit 90b6486ffe95bf50bbf1fa60964c80853917c3c8 +Author: Aaron Rainbolt +Date: Fri Sep 12 18:08:00 2025 -0500 + + Allow users in the sudo group to use usbguard-notifier + +commit 7b32e9339e1da769df38ff9afb849a975b1c1668 +Author: raja-grewal +Date: Fri Sep 12 23:10:34 2025 +1000 + + Update SRSO docs + +commit d262db2e6cc88cd58d73f5b53481ac43fa1ebee7 +Author: Patrick Schleizer +Date: Tue Sep 2 15:25:49 2025 +0000 + + bumped changelog version + +commit 75306a3f96038038958aa7e7adee3952e692ad91 +Author: Patrick Schleizer +Date: Sat Aug 30 14:19:31 2025 +0000 + + bumped changelog version + +commit ac6bc65e3c77f4bcbada69525e8cb1d4c273da8a +Merge: 78b66ba1 2319bd91 +Author: Patrick Schleizer +Date: Sat Aug 30 08:01:26 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 2319bd91648f30b85b49aed2ce7ee7864582495d +Author: Aaron Rainbolt +Date: Thu Aug 28 17:34:41 2025 -0500 + + Allow USB devices that are connected at USBGuard start time + +commit 85fd8ea52b6614cb416514e1c541c46da708f502 +Author: Aaron Rainbolt +Date: Thu Aug 28 16:42:16 2025 -0500 + + Enable USB video and audio devices, reject USB RNDIS devices + +commit b95598b6f7536da08026af37ab3c9fb2ba2f2bb3 +Author: Aaron Rainbolt +Date: Thu Aug 28 16:18:14 2025 -0500 + + Disable RNDIS due to unfixable security issues + +commit 78b66ba159d41dc0559a09c038002c702aaa43c2 +Author: Patrick Schleizer +Date: Wed Aug 27 19:31:06 2025 +0000 + + bumped changelog version + +commit 28d695fd2ddbf91b43dcbf8087c3a852f5ab86a9 +Author: Patrick Schleizer +Date: Wed Aug 27 04:29:48 2025 -0400 + + fix + +commit 0a61107b5adf053db71cad63c40b1c8362e9162b +Merge: ef458ce0 94ebb5c8 +Author: Patrick Schleizer +Date: Wed Aug 27 04:28:25 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 94ebb5c84ca278a840e2158a5d4207fbfed90a22 +Merge: 893faa98 ef458ce0 +Author: Aaron Rainbolt +Date: Tue Aug 26 19:20:41 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit ef458ce0d338009387999789259a3e644861b9d3 +Author: Patrick Schleizer +Date: Tue Aug 26 09:16:15 2025 +0000 + + bumped changelog version + +commit 893faa98223cee2f6c90f0224c94724e32f6e014 +Author: Aaron Rainbolt +Date: Fri Aug 22 19:48:47 2025 -0500 + + Remove initramfs-tools support + +commit cd44a7e1369cd798b06595fdb118e0c7bea52194 +Author: Aaron Rainbolt +Date: Fri Aug 22 16:00:25 2025 -0500 + + Disable memlockd service by default, fix systemd path + +commit 28f44d2e1d54da990cf203d2965431bc12a5d008 +Author: Aaron Rainbolt +Date: Fri Aug 22 15:50:28 2025 -0500 + + Disable emerg-shutdown and ensure-shutdown on Qubes OS + +commit 53e930b4cc30a8857348758ab65d1a5687ed94a1 +Merge: df8a323d 5898a645 +Author: Aaron Rainbolt +Date: Thu Aug 21 20:09:48 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit df8a323d03747858b55d905465c1f9415bbb8022 +Author: Aaron Rainbolt +Date: Thu Aug 21 18:39:28 2025 -0500 + + Fix XDG handling, replace Xfce with LXQt where appropriate, make USBGuard configuration work + +commit 5898a6457a99ab0036b3e62ded09eeb9cdd9522a +Author: Patrick Schleizer +Date: Thu Aug 21 06:45:04 2025 -0400 + + typo + +commit f713dceff42c6c79a5718ba69358d2fe66ad3245 +Merge: f6f4fd77 8cdbbf82 +Author: Patrick Schleizer +Date: Thu Aug 21 06:44:35 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 8cdbbf8292c354224e2d22fad9087d9f542687e2 +Merge: 2baf5cfc e48897cc +Author: Patrick Schleizer +Date: Thu Aug 21 06:43:07 2025 -0400 + + Merge pull request #313 from raja-grewal/panic_limits + + Upgrade `sysctl` settings and docs on kernel panics + +commit 2baf5cfc0bf061b2cc772dfceadaef84a36d9c1e +Merge: f6f4fd77 45fcd163 +Author: Patrick Schleizer +Date: Thu Aug 21 06:42:28 2025 -0400 + + Merge pull request #314 from raja-grewal/trixie_docs + + Update documentation + +commit f6f4fd77e5bd3a7a7d00c33543fc4ce5a685a3d1 +Merge: 81d437fe 7f211209 +Author: Patrick Schleizer +Date: Thu Aug 21 06:40:39 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 7f211209f7942a332e0568a60eba8a78f3a8a15b +Merge: 81d437fe 19b7e4b4 +Author: Patrick Schleizer +Date: Thu Aug 21 06:40:11 2025 -0400 + + Merge pull request #311 from nrz-21/master + + Set soft limit for core dumps to 0 + +commit 19b7e4b4d0b625b8505de122e790a14de63fafdf +Author: Patrick Schleizer +Date: Thu Aug 21 06:39:56 2025 -0400 + + newline + +commit 3229dd8967d15edc6066ab6148df4738774f36b0 +Merge: 8dcd3493 81d437fe +Author: Patrick Schleizer +Date: Thu Aug 21 06:39:13 2025 -0400 + + Merge branch 'master' into master + +commit 81d437fe3efca99b0d1a29b2a1a3e486e91716c1 +Author: Patrick Schleizer +Date: Wed Aug 20 21:40:39 2025 -0400 + + fix + +commit e48897cc44eef10779a28bdadc7e7bbfe007064a +Merge: add05493 c2d5bf38 +Author: raja-grewal +Date: Thu Aug 21 10:27:44 2025 +1000 + + Merge branch 'master' into panic_limits + +commit add054933b69e97e0f856d7cf04d88290d4b1b7c +Author: raja-grewal +Date: Thu Aug 21 00:24:28 2025 +0000 + + Update docs on instant reboot when kernel panic + +commit c2d5bf38f539703c4858818f29d73b21d5776c80 +Author: Patrick Schleizer +Date: Wed Aug 20 10:44:10 2025 -0400 + + comment + +commit 812f05f847de0f1cb5586ccfd4c5b684d507dd46 +Author: Patrick Schleizer +Date: Wed Aug 20 10:11:49 2025 -0400 + + comments + +commit 2b876c74a3ed9ec91954c8d4f776dc803d212fd0 +Author: Patrick Schleizer +Date: Wed Aug 20 10:09:10 2025 -0400 + + readme + +commit 0e4664daa0267fe62888a9559db2b14d5e1ae8ea +Author: Patrick Schleizer +Date: Wed Aug 20 10:07:58 2025 -0400 + + cleanup + +commit 31fd316e72a87323f83e7e63d6a3440bf77cb350 +Author: Patrick Schleizer +Date: Wed Aug 20 09:48:20 2025 -0400 + + comments + +commit 5d67277c9f27a54d373e683a1d4e1ddf8c16ac25 +Author: Patrick Schleizer +Date: Wed Aug 20 09:46:43 2025 -0400 + + comments + +commit f77c71dd15b38db6f1c33602dd0c5623e501c3eb +Merge: e15bdd2d 37c0bc0c +Author: Patrick Schleizer +Date: Wed Aug 20 09:44:37 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit e15bdd2de513fbdcdb3b0fed4c1c1c5f74652291 +Author: Patrick Schleizer +Date: Wed Aug 20 06:57:29 2025 -0400 + + bumped Standards-Version + +commit 312586307b2999d46e4673079fb1538f76ff329e +Author: Patrick Schleizer +Date: Wed Aug 20 06:25:35 2025 -0400 + + readme + +commit a4710693783b8817a6a5c9f17b4268b654c4c0c9 +Author: raja-grewal +Date: Tue Aug 19 11:03:05 2025 +1000 + + Remove link + +commit c0ad57779342c138ade0d6ddff0898f75411157a +Author: raja-grewal +Date: Tue Aug 19 11:01:06 2025 +1000 + + Update docs on oops boot parameter + +commit 45fcd163d1422b43ec033166c889a237301ad83d +Author: raja-grewal +Date: Mon Aug 18 20:23:50 2025 +1000 + + Add reference on conntrack helpers + +commit 37c0bc0c5ddfb901d016f8a4edae16840a58f1fa +Merge: b5a36e02 f175d196 +Author: Aaron Rainbolt +Date: Sun Aug 17 14:02:01 2025 -0500 + + Merge remote-tracking branch 'raja/block_32bit' into arraybolt3/trixie + +commit b5a36e02f1be901da1695056877471398deedf1e +Merge: 210aa976 6df3e3cd +Author: Aaron Rainbolt +Date: Sun Aug 17 13:52:01 2025 -0500 + + Merge remote-tracking branch 'raja/panic_limits' into arraybolt3/trixie + +commit 210aa97650b760acb207f29b1e99e1bb2e65e168 +Merge: 7a8dfa52 3de9cd56 +Author: Aaron Rainbolt +Date: Sun Aug 17 13:50:25 2025 -0500 + + Merge remote-tracking branch 'raja/trixie_docs' into arraybolt3/trixie + +commit f175d1961e4e028539f5a90c0db1fcd1f760cdba +Author: raja-grewal +Date: Sun Aug 17 07:08:08 2025 +0000 + + Enable `ia32_emulation=0` + +commit 3de9cd5646ad45fe745711b83f79f4d469fc8473 +Author: raja-grewal +Date: Sun Aug 17 07:06:55 2025 +0000 + + Remove whitespace + +commit e06b78a52225db02415aeafb833160c9ea0280d9 +Author: raja-grewal +Date: Sun Aug 17 07:05:32 2025 +0000 + + Temporarily revert IA32 doc updates + +commit 6df3e3cde8053d6b2771f510457da774336546bf +Author: raja-grewal +Date: Sun Aug 17 06:32:11 2025 +0000 + + Update kernel panic service description + +commit 247015bcc6e924e24874d16ed7ad78165ace58a3 +Author: raja-grewal +Date: Sun Aug 17 06:27:44 2025 +0000 + + Set `sysctl kernel.panic=-1` + +commit 7a8dfa528c629aa0023943dcd34025ef56a1b1e1 +Merge: cba16879 1f75426f +Author: Aaron Rainbolt +Date: Sat Aug 16 21:10:19 2025 -0500 + + Merge remote-tracking branch 'raja/trixie_docs' into arraybolt3/trixie + +commit 8dcd3493f851f78933f9dbf6d4e9f04f741bed5a +Author: nexus$ +Date: Sat Aug 16 09:39:42 2025 +0000 + + Update 30_security-misc.conf + +commit f1de0da69b46f91ea7fd34db601393d23599b3bb +Author: raja-grewal +Date: Sat Aug 16 04:01:12 2025 +0000 + + Clarify description on panics on oopses and warns + +commit c33f7d04e2cef477b675fbf6c2a91583ba3bf808 +Author: raja-grewal +Date: Sat Aug 16 03:32:48 2025 +0000 + + Remove duplicate comment + +commit 1f75426f079d6e0aecd8fac22088ad36a7c16398 +Author: raja-grewal +Date: Sat Aug 16 02:20:00 2025 +0000 + + Clarify docs for disabling 32-bit x86 support + +commit cba16879eff9d3d998c127e41c38d2067cdf04cc +Author: Aaron Rainbolt +Date: Fri Aug 15 17:16:42 2025 -0500 + + Polish USBGuard configuration + +commit b4086b8e779366127c22eb0a43d1b77fe534ef0e +Merge: 66ec5bda 4cae74d6 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:57:34 2025 -0500 + + Merge remote-tracking branch 'monsieuremre/patch-3' into arraybolt3/trixie + +commit 66ec5bda5872bbf51eb480836d3ffb3bb2f934cf +Author: Aaron Rainbolt +Date: Fri Aug 15 16:51:07 2025 -0500 + + Remove obsolete Thunderbird configuration hardening + +commit 94668b2e93c37a3879968f455575c631f9f8bcac +Author: Aaron Rainbolt +Date: Fri Aug 15 16:46:35 2025 -0500 + + Set hard and soft limits on core file size at the same time + +commit e2c65a2a6fcb246cb5925394f00ec2d8401c2dda +Merge: 65afc31b 28ce7064 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:45:18 2025 -0500 + + Merge remote-tracking branch 'nrz/master' into arraybolt3/trixie + +commit 65afc31ba7f8c5ee6dc14627de82a122b4992d21 +Merge: a2a9e844 00c660d4 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:31:50 2025 -0500 + + Merge branch 'kcfi' into arraybolt3/trixie + +commit a2a9e8440b812b07546722f5842e3ddb16ee5bc2 +Merge: c33ea7be 4166d6d1 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:06:35 2025 -0500 + + Merge branch 'trixie_docs' into arraybolt3/trixie + +commit 00c660d40dce06d979fc7b9dbf7a6e952a9e51cc +Author: raja-grewal +Date: Fri Aug 15 11:29:27 2025 +1000 + + Typo + +commit fce86dccb67db0a37601899bf3115bd9f4fa714a +Author: raja-grewal +Date: Wed Aug 13 10:44:40 2025 +1000 + + Typo + +commit c33ea7be6d2a82462042cf482a32bf259bf51bd5 +Author: Aaron Rainbolt +Date: Sun Aug 10 15:23:48 2025 -0500 + + Move security-misc/apt-get-update* to helper-scripts + +commit 51d5ba29df44d021cfeab1dea6f00919d246388e +Merge: 7aa38245 c7bdca32 +Author: Aaron Rainbolt +Date: Sun Aug 10 14:09:41 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit c7bdca32c05ddc70b785a28ebe5be13614407dc8 +Author: Patrick Schleizer +Date: Sun Aug 10 06:34:30 2025 +0000 + + bumped changelog version + +commit 3629f2c3a59d44e265f0c66389435de1b2414998 +Merge: 5dc251c5 c59a3b23 +Author: Patrick Schleizer +Date: Sun Aug 10 02:25:48 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 7aa38245dedab28cce4c96fd9f533a60c9d05ac4 +Merge: 4930703b c59a3b23 +Author: Aaron Rainbolt +Date: Sat Aug 9 23:31:55 2025 -0500 + + Merge branch 'arraybolt3/emerg-shutdown' into arraybolt3/trixie + +commit c59a3b233bd8893d466c020a2e2695ab545c6e60 +Author: Aaron Rainbolt +Date: Sat Aug 9 21:55:03 2025 -0500 + + Fix unexpected shutdowns when booting Kicksecure from optical media + +commit 4930703b8c90766304122e6e74ccd29e87800714 +Merge: 2ada07cf 5dc251c5 +Author: Aaron Rainbolt +Date: Sat Aug 9 21:30:45 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit 5dc251c5da724092d264481740e4f6ed347aa0a7 +Author: Patrick Schleizer +Date: Sat Aug 9 09:45:35 2025 +0000 + + bumped changelog version + +commit 046c932898290d250a7900e3c59973a698e5c55f +Author: Patrick Schleizer +Date: Sat Aug 9 05:40:11 2025 -0400 + + `disable emerg-shutdown.service`: + + Disabled due to bug: breaks ISO Live Mode Calamares installer + +commit 2ada07cf66727ea66283c55c0ba078489b3db94e +Author: Aaron Rainbolt +Date: Thu Aug 7 22:23:03 2025 -0500 + + Add SSH hardening config + +commit 0cc0a8310020afc10de6512095336e55559a84d9 +Author: Patrick Schleizer +Date: Thu Aug 7 07:08:19 2025 +0000 + + bumped changelog version + +commit 505a2b7d7995ad48a17add86513ced3499f64ee9 +Merge: 42941653 3a77abe5 +Author: Patrick Schleizer +Date: Thu Aug 7 03:08:02 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 5f2425ba6f747bf65b5beb4336d1e7bf6b8cdf71 +Merge: 86f44063 3a77abe5 +Author: Aaron Rainbolt +Date: Wed Aug 6 20:21:01 2025 -0500 + + Merge branch 'arraybolt3/emerg-shutdown' into arraybolt3/trixie + +commit 3a77abe5c9807caec530e69c41d5cf803b625e70 +Author: Aaron Rainbolt +Date: Wed Aug 6 20:05:57 2025 -0500 + + Port hardening options from kloak to emerg-shutdown, fix new compiler warnings + +commit 0c1af00aae50dba2983c3736744e0da320bb9330 +Author: Aaron Rainbolt +Date: Wed Aug 6 19:33:38 2025 -0500 + + Implement paranoid mode in emerg-shutdown + +commit 29480df770047c8ada3e993cf28f87ffbfd71dec +Author: Aaron Rainbolt +Date: Wed Aug 6 19:24:34 2025 -0500 + + Improve emerg-shutdown usage documentation + +commit 2a3bc39eba317d5f9b0e710dd3663c82d92add94 +Author: Aaron Rainbolt +Date: Wed Aug 6 19:10:37 2025 -0500 + + Use Ctrl+Alt+End as the default panic key rather than Ctrl+Alt+Delete + +commit 44e7d3059a5618991a1408f77707132bfea86fef +Author: Aaron Rainbolt +Date: Wed Aug 6 19:10:14 2025 -0500 + + Integrate emerg-shutdown into the initramfs + +commit 42941653621311187650f12e8d7aa39c45cb6984 +Author: Patrick Schleizer +Date: Wed Aug 6 08:27:15 2025 +0000 + + bumped changelog version + +commit 784ff8af3616765a9c22febf66b522376ecedf12 +Merge: c2690efc 5a17e67c +Author: Patrick Schleizer +Date: Wed Aug 6 04:26:37 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 4166d6d1e60d564be4c3fb2ad530e7a180638e6a +Author: raja-grewal +Date: Wed Aug 6 15:53:49 2025 +1000 + + Update docs on recovery restrictions + +commit 86f44063eb753fe1bbdd754ce104670d26aed6ca +Author: Aaron Rainbolt +Date: Tue Aug 5 22:58:06 2025 -0500 + + Port to Trixie. + +commit 498551536c71f1c1ac33f3c1992e18c9277e6618 +Author: raja-grewal +Date: Wed Aug 6 03:12:06 2025 +0000 + + Update docs + +commit 45d20dd972e6501237d35d1605c81d4e3fde43b1 +Author: raja-grewal +Date: Wed Aug 6 02:35:15 2025 +0000 + + Upgrade sysctls and docs on kernel panics + +commit 1f7525722e7027b5c3379460eee5f62669631dee +Author: raja-grewal +Date: Wed Aug 6 01:48:47 2025 +0000 + + Enable `cfi=kcfi` + +commit 5a17e67c0a7678300f6342d5c90ded5494ebc838 +Author: Aaron Rainbolt +Date: Tue Aug 5 20:14:07 2025 -0500 + + Fix local-fs.target dependency in emerg-shutdown.service + +commit c2690efcacbf7be7c57751ba1cee7f910d350cfc +Author: Patrick Schleizer +Date: Mon Aug 4 09:27:11 2025 +0000 + + bumped changelog version + +commit 166bc257b0b2eea87d684cc847bf6da1fba7c4b4 +Merge: d1bca020 63f29093 +Author: Patrick Schleizer +Date: Mon Aug 4 05:26:55 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 63f29093416a5f21ae14b398cf805c864b5541d7 +Author: Aaron Rainbolt +Date: Sun Aug 3 15:00:14 2025 -0500 + + Fix emerg-shutdown and ensure-shutdown libexec scripts, start emerg-shutdown and ensure-shutdown earlier + +commit d1bca0204fa1dac9ec3fb6e9b121af9526778181 +Author: Patrick Schleizer +Date: Sun Aug 3 11:33:03 2025 +0000 + + bumped changelog version + +commit 92bcd824e4af8a90a18a7726d4a5715c0b20e2ca +Author: Patrick Schleizer +Date: Sun Aug 3 07:17:25 2025 -0400 + + also parse /usr/local/etc + +commit 4da810c8fa4fd40b8701e7dfe217125d965ee03e +Author: Patrick Schleizer +Date: Sun Aug 3 07:16:00 2025 -0400 + + comment + +commit b9416fa77a1e8850c5f579314875671799a55c60 +Author: Patrick Schleizer +Date: Sun Aug 3 07:15:41 2025 -0400 + + validate configuration file + +commit 4ba029471e8c12d5691f7ee94897137fb3cbe15f +Merge: c1e76aa5 1a60da71 +Author: Patrick Schleizer +Date: Sun Aug 3 07:04:20 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 28ce70644147f637e91bd4941bcbc139d875e5e7 +Author: nexus$ +Date: Fri Aug 1 15:03:26 2025 +0000 + + Set soft limit for core dumps to 0 + +commit 1a60da71eddfcc6fb72a34596c770cd754146887 +Author: Aaron Rainbolt +Date: Tue Jul 29 21:16:51 2025 -0500 + + emerg-shutdown: Add shutdown timeout for preventing stuck shutdowns, briefly document feature set and usage + +commit e42078e90d7d7e5339a7c4682eb93c844fd38580 +Author: Aaron Rainbolt +Date: Mon Jul 28 20:42:14 2025 -0500 + + emerg-shutdown: fix the hang-on-shutdown bug, add autodetection of new keyboards, shutdown key configuration, and instant shutdown option + +commit a1d1c5603300106f06c1a798088521b77430ff95 +Merge: 5889d134 c1e76aa5 +Author: Aaron Rainbolt +Date: Sun Jul 27 21:43:43 2025 -0500 + + Merge branch 'master' into arraybolt3/emerg-shutdown + +commit c1e76aa52cd28f38c1ab6550e0f4de0010a9ea14 +Author: Patrick Schleizer +Date: Mon Jul 21 10:00:25 2025 +0000 + + bumped changelog version + +commit 36114e29a2ce1045b5f5d82372fcf0463efc5ca7 +Merge: e3ce9c38 f851886f +Author: Patrick Schleizer +Date: Mon Jul 21 06:00:11 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit f851886ffd0fc82ba0b0add501964d1c812c6c15 +Merge: e3ce9c38 6f9763f5 +Author: Patrick Schleizer +Date: Mon Jul 21 05:58:44 2025 -0400 + + Merge pull request #310 from raja-grewal/its + + Enable `indirect_target_selection=force` + +commit 5889d134a23b3d4f8db5d81171ea12907bb10d4d +Author: Aaron Rainbolt +Date: Sun Jul 20 14:14:09 2025 -0500 + + emerg-shutdow: Improve recvmsg handling, call reboot syscall directly + +commit 6f9763f525097b8f8ad5f9864c1694a2642e1bd6 +Author: raja-grewal +Date: Sat Jul 19 05:19:27 2025 +0000 + + Enable `indirect_target_selection=force` + +commit b745c8ddae74d5e1684919442fa74d64e95263b8 +Author: Aaron Rainbolt +Date: Mon Jul 14 21:51:52 2025 -0500 + + emerg-shutdown: Enable actual shutdown code, fix infinite loop when started too early + +commit e387086de4b6e6b90b23d4c32ddf8a566beb858c +Author: Aaron Rainbolt +Date: Mon Jul 14 21:05:16 2025 -0500 + + Allow specifying alternative keys in panic key combo, fix optical disk eject handling + +commit dfb6f143f0324d0903ae2dd106bc0fb6907c1cb0 +Author: Aaron Rainbolt +Date: Sun Jul 13 20:53:29 2025 -0500 + + Add panic key handling to emergency shutdown utility + +commit 2a7071055f94f984398fe2ec49c32b206913bea2 +Merge: f3d46ee5 e3ce9c38 +Author: Aaron Rainbolt +Date: Sun Jul 13 15:21:34 2025 -0500 + + Merge branch 'master' into arraybolt3/emerg-shutdown + +commit e3ce9c38c5b241f789945de7229c0ee15fa0a266 +Author: Patrick Schleizer +Date: Wed Jul 2 20:52:17 2025 +0000 + + bumped changelog version + +commit b06fb5428051518390439ce95c9d6894e6338951 +Merge: 115b6f6a 468cf40e +Author: Patrick Schleizer +Date: Wed Jul 2 13:47:12 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 468cf40e2a216625d02066b609b0991e37c50ebc +Merge: 865a052b bb208fb1 +Author: Patrick Schleizer +Date: Wed Jul 2 13:45:28 2025 -0400 + + Merge pull request #306 from raja-grewal/erst + + Set `erst_disable` + +commit 865a052bf47f28c0084b2bbd51e3c606df9eda96 +Merge: 115b6f6a e3c45191 +Author: Patrick Schleizer +Date: Wed Jul 2 13:44:17 2025 -0400 + + Merge pull request #309 from RebornRider/patch-1 + + remove TemporaryTimeout=0 in Bluetooth config + +commit bb208fb134fe25fc3539494f331072a851369064 +Merge: 4314b1e8 115b6f6a +Author: raja-grewal +Date: Wed Jul 2 11:35:50 2025 +1000 + + Merge branch 'Kicksecure:master' into erst + +commit 4314b1e85bd5495832b4398bdbd358c41703dcc9 +Author: raja-grewal +Date: Tue Jul 1 13:36:39 2025 +1000 + + Add comment + +commit e3c451917931aa4e63056fb03470c203694d399f +Author: Kevin Agwaze <7119346+RebornRider@users.noreply.github.com> +Date: Mon Jun 16 10:35:16 2025 +0100 + + remove misleading TemporaryTimeout=0 in Bluetooth config + +commit 115b6f6aa2a4d00ad5690c2c0889e142540c01ca +Author: Patrick Schleizer +Date: Sat Jun 14 11:51:44 2025 +0000 + + bumped changelog version + +commit 4639d1aab572bb4ad751bd1da5b936b9d73d3264 +Merge: 5159de63 109c0134 +Author: Patrick Schleizer +Date: Fri Jun 13 15:09:52 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/approx' + +commit 109c0134677d991c449aa009773cb22babeee8db +Author: Aaron Rainbolt +Date: Thu Jun 12 01:08:34 2025 -0500 + + Add comment related to approx package caching proxy + +commit 72613203b9692d1098b13ff98119499a5a30a6da +Author: raja-grewal +Date: Fri Jun 6 13:07:52 2025 +0000 + + Add reference + +commit dd0b55cc45f9ccd64d0075ba37ab6a4723d94a02 +Author: raja-grewal +Date: Tue Jun 3 12:32:17 2025 +1000 + + Add reference + +commit 5159de63438e8c1274658e7175a80fb693d6554a +Author: Patrick Schleizer +Date: Wed May 28 13:48:11 2025 +0000 + + bumped changelog version + +commit 3e102df76583a14b5efc18238aefbf539ab0d8a1 +Author: Patrick Schleizer +Date: Wed May 28 08:37:03 2025 -0400 + + fix + +commit d5edc243ac2db861f1600d3906a02494eaf9a824 +Author: Patrick Schleizer +Date: Wed May 28 12:12:00 2025 +0000 + + bumped changelog version + +commit eda1d0aef640af1ea73c72d6caa876733de4e5a0 +Merge: e9667748 5a10ad03 +Author: Patrick Schleizer +Date: Wed May 28 07:22:16 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 5a10ad031d67acc8fa4c16f9e2db191bde559caa +Merge: e9667748 3559bc86 +Author: Patrick Schleizer +Date: Wed May 28 07:21:31 2025 -0400 + + Merge pull request #307 from maybebyte/ssh-agent-to-allowlist + + fix(permission-hardener): ssh-agent gets 2755 perms + +commit 3559bc86b7aed8122ff7996ce0ab4a65bdaf05c0 +Author: Ashlen +Date: Tue May 27 15:32:41 2025 -0600 + + fix(permission-hardener): ssh-agent gets 2755 perms + + Change from exactwhitelist to matchwhitelist. Discussion revealed that + there's a good reason to leave setgid in here, which is essentially + defense-in-depth (sometimes users may want to revert Kicksecure's + default of kernel.yama.ptrace_scope=2, e.g. to debug a program, and + Kicksecure should not be less secure than vanilla Debian in that + situation). + +commit c59b2e4bc53cad4c9cc90ddd5abaca0705ccff90 +Merge: 017ee29e e9667748 +Author: maybebyte <99762926+maybebyte@users.noreply.github.com> +Date: Tue May 27 20:33:07 2025 +0000 + + Merge branch 'Kicksecure:master' into ssh-agent-to-allowlist + +commit e96677486201ebddc145af7962ad5e89f6fa253b +Author: Patrick Schleizer +Date: Tue May 27 19:41:25 2025 +0000 + + bumped changelog version + +commit 017ee29eb39d84edc89f128a633a619cad852241 +Merge: 7a079c3d abb22073 +Author: maybebyte <99762926+maybebyte@users.noreply.github.com> +Date: Tue May 27 18:25:47 2025 +0000 + + Merge branch 'Kicksecure:master' into ssh-agent-to-allowlist + +commit 5195977be474e29a29b6392306e909e9f2d05ada +Author: Patrick Schleizer +Date: Tue May 27 11:57:21 2025 -0400 + + protect against grep pipefail + +commit abb2207313810966dad381c3a9f637c445a5834d +Author: Patrick Schleizer +Date: Tue May 27 15:51:50 2025 +0000 + + bumped changelog version + +commit 45016146f7c77d383f2254d19dc66ba9b883b8f2 +Merge: ace45d7c 395169fb +Author: Patrick Schleizer +Date: Tue May 27 11:03:23 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 395169fbce1854bfed727d1784f4e5c0d8e7c6ff +Merge: ace45d7c e14b81b1 +Author: Patrick Schleizer +Date: Tue May 27 10:58:50 2025 -0400 + + Merge pull request #308 from maybebyte/permission-hardener-speedboost + + perf(permission-hardener): optimize string match + +commit 1c353032046f556bb11c32506019310c9f6d47c0 +Merge: 35fa32e4 ace45d7c +Author: raja-grewal +Date: Fri May 23 20:20:19 2025 +1000 + + Merge branch 'Kicksecure:master' into erst + +commit ace45d7c95ed6b83c1897f76da5af4a0c97cab10 +Author: Patrick Schleizer +Date: Wed May 21 22:06:02 2025 +0000 + + bumped changelog version + +commit 142ea2118989faddafa17db48efed379c4ac3f45 +Author: Patrick Schleizer +Date: Wed May 21 12:42:16 2025 -0400 + + fix + +commit a969fa350e28ca296966509821a7c62b68f09a5a +Author: Patrick Schleizer +Date: Wed May 21 12:40:27 2025 -0400 + + fix + +commit f023651c984c52a997bc241f99f118255cf60809 +Author: Patrick Schleizer +Date: Wed May 21 12:35:37 2025 -0400 + + nounset + +commit f086787464191a07e028dd92649c48b145023858 +Author: Patrick Schleizer +Date: Wed May 21 12:35:23 2025 -0400 + + fix + +commit d7643954d184846c8b7fb5eda7200779126274eb +Author: Patrick Schleizer +Date: Wed May 21 12:33:50 2025 -0400 + + minor + +commit aa905fc8875c5c56351f10f4e40e6d2a7dd6d918 +Author: Patrick Schleizer +Date: Wed May 21 12:32:16 2025 -0400 + + further validation of output of `faillock` + +commit 92d3a36a0f43615db622c6b0daa7064b8e8ebbbb +Author: Patrick Schleizer +Date: Wed May 21 12:29:01 2025 -0400 + + fix + +commit 2c1abb23e03cfe449347ba692d35f5ba1f33cff4 +Author: Patrick Schleizer +Date: Wed May 21 12:26:46 2025 -0400 + + output + +commit 0801b96ae74256f36dcf8757d0ba8abc66ea0b9b +Author: Patrick Schleizer +Date: Wed May 21 12:25:49 2025 -0400 + + output + +commit ef8515ba82996b137c386eeb91e6f853d58a515f +Author: Patrick Schleizer +Date: Wed May 21 12:23:45 2025 -0400 + + improve error handling + +commit 784867e24b4d6f2899fa9b215ec9e3c4e2fb9d84 +Author: Patrick Schleizer +Date: Wed May 21 12:21:45 2025 -0400 + + fix + +commit 0eea681ce893a259563f8e9d5a2ec9722fbc635d +Author: Patrick Schleizer +Date: Wed May 21 15:52:16 2025 +0000 + + bumped changelog version + +commit e1bae1c68aabc424924b6386fe4980d657dc2cdf +Author: Patrick Schleizer +Date: Wed May 21 11:50:59 2025 -0400 + + fix + +commit bd01a683054b1f7d5a5f6cc4848da73b1b1ef5ff +Author: Patrick Schleizer +Date: Wed May 21 13:58:18 2025 +0000 + + bumped changelog version + +commit 14cf205579ff65fa765d7574e5d0e301a30a1904 +Author: Patrick Schleizer +Date: Wed May 21 08:36:16 2025 -0400 + + fix + +commit ff6bc5d5b6097bcdddd8e66c2541106c2cbabbaf +Author: Patrick Schleizer +Date: Wed May 21 11:23:39 2025 +0000 + + bumped changelog version + +commit 353b6e83c55d52b47a2a35063406324cec7237c4 +Author: Patrick Schleizer +Date: Wed May 21 07:20:13 2025 -0400 + + test that `wc` is functional + + https://github.com/Kicksecure/security-misc/pull/305#issuecomment-2892378246 + +commit 5930e270521e0e5d6a0a3877c813accbf5253051 +Author: Patrick Schleizer +Date: Wed May 21 07:05:25 2025 -0400 + + pam-info: improve error handling + + https://github.com/Kicksecure/security-misc/pull/305#issuecomment-2892378246 + +commit 5c981e0891ef009c5c2355f5f6383aca22c45638 +Author: Patrick Schleizer +Date: Wed May 21 06:55:09 2025 -0400 + + pam-info: fix, consistently write errors and warnings to stderr + +commit e14b81b15e479afbc4820a2b9bb60f3cf65bfb12 +Author: Ashlen +Date: Tue May 20 21:34:03 2025 -0600 + + perf(permission-hardener): optimize string match + + Replace subprocess grep calls with bash substring matching in + check_nosuid_whitelist function. This eliminates ~10k unneeded + subprocess spawns that were causing significant performance + degradation. + + In testing, it improves overall script execution speed by an + order of magnitude: + + Before patch: + $ sudo hyperfine -- './permission-hardener enable' + Benchmark 1: ./permission-hardener enable + Time (mean _ _): 11.906 s _ 0.974 s [User: 3.639 s, System: 8.728 s] + Range (min _ max): 10.430 s _ 14.090 s 10 runs + + After patch: + $ sudo hyperfine -- './permission-hardener enable' + Benchmark 1: ./permission-hardener enable + Time (mean _ _): 802.8 ms _ 178.5 ms [User: 283.0 ms, System: 471.9 ms] + Range (min _ max): 639.4 ms _ 1092.3 ms 10 runs + +commit 7a079c3de8bd8b4e026a1bd1b932a04610a1e386 +Author: Ashlen +Date: Tue May 20 18:41:48 2025 -0600 + + fix(permission-hardener): add exactwhitelist here + + Without this, the permissions for ssh-agent won't be changed properly. + +commit 94dc9da4ab8fb93760dbb3b325bdeaa155e492cb +Author: Ashlen +Date: Tue May 20 17:07:51 2025 -0600 + + fix(permission-hardener): ssh-agent gets 755 perms + + Replace the commented-out matchwhitelist entry for ssh-agent with an + explicit permission entry (755) for /usr/bin/ssh-agent. + + When ssh-agent's matchwhitelist entry was commented out in commit + 7a5f8b87af, permission-hardener began resetting it to restrictive + defaults (744), preventing non-root users from executing ssh-agent. This + broke split SSH functionality in Qubes OS for me because I was using + Kicksecure in the vault qube, and ssh-agent runs under a non-root user in + that configuration (see https://forum.qubes-os.org/t/split-ssh/19060). + + As noted in the comment, Debian installs with 2755 permissions as a way + to mitigate ptrace attacks, but this rationale doesn't apply due to + kernel.yama.ptrace_scope=2 being set in Kicksecure. + +commit 19d7e1af5d7acf6eb3a20fe3ebf5f14cef041f92 +Author: Patrick Schleizer +Date: Tue May 20 11:40:27 2025 +0000 + + bumped changelog version + +commit 405880e63b92319626332d083a6c5ad5101dbf77 +Author: Patrick Schleizer +Date: Sun May 18 06:44:42 2025 -0400 + + handle case of non-existence of /proc/cmdline + +commit 88235cc97b8b54f3fe78d6ad76f64326e8b53f3e +Author: Patrick Schleizer +Date: Sun May 18 06:44:04 2025 -0400 + + refactoring + +commit 601ea77b005d18b57a85e0701f3981edd61b7881 +Author: Patrick Schleizer +Date: Sun May 18 06:42:39 2025 -0400 + + end-of-options + +commit d8feca12768441b0499ead7cc9f9bce4e89b1edf +Author: Patrick Schleizer +Date: Sun May 18 06:41:41 2025 -0400 + + printf + +commit 7f2ba0980d17360fc014c6a412fc4ee57e1032fd +Author: Patrick Schleizer +Date: Sun May 18 06:40:50 2025 -0400 + + refactoring + +commit 4d1f8c44d28895587abce586ed5b2fe354544f6a +Merge: 341dce33 e4787508 +Author: Patrick Schleizer +Date: Sun May 18 06:36:08 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e478750814798f3d9aa60354b6cecbb84769ed53 +Merge: 341dce33 91a76db6 +Author: Patrick Schleizer +Date: Sun May 18 06:35:23 2025 -0400 + + Merge pull request #305 from DMHalford/pam-info-failed_login_counter-fix + + Prevent erroneous "Login blocked after [negative number] attempts" errors + +commit 35fa32e4ed6333f3ab87d09828f13155aa1e7a72 +Author: raja-grewal +Date: Sat May 17 15:06:49 2025 +1000 + + Reword + +commit a1bde21ccb475fc21a084559dbe766f6315d9287 +Author: raja-grewal +Date: Sat May 17 04:41:06 2025 +0000 + + Set `erst_disable` + +commit 91a76db66bb496ba4650ada38df31636297738cf +Author: DMHalford <161769419+DMHalford@users.noreply.github.com> +Date: Thu May 15 15:42:50 2025 -0400 + + Prevent erroneous "Login blocked after [negative number] attempts" errors + + For root, faillock appears to always* return an empty string (i.e. no table headers are present), yielding a zero-initialized pam_faillock_output_count and thus resulting in the calculation of a negative failed_login_counter value. + + This can cause erroneous errors of the form "ERROR: Login blocked after [negative number] attempts" during sudo-ing and screen unlocking. + + This commit modifies the initialization of failed_login_counter such that it cannot be negative and prevents the display of these incorrect warnings. + + * Only rudimentary local tests were conducted + +commit 6c3be9ced071e73e78451c82e8def9c5a5b02598 +Author: DMHalford <161769419+DMHalford@users.noreply.github.com> +Date: Thu May 15 15:06:10 2025 -0400 + + Prevent erroneous "Login blocked after [negative number] attempts" errors + + For root, faillock appears to always* return an empty string (i.e. no table headers are present), yielding a zero-initialized pam_faillock_output_count and thus resulting in the calculation of a negative failed_login_counter value. + + This can cause erroneous errors of the form "ERROR: Login blocked after [negative number] attempts" during sudo-ing and screen unlocking. + + This commit modifies the initialization of failed_login_counter such that it cannot be negative and prevents the display of these incorrect warnings. + + * Only rudimentary tests were conducted + +commit f3d46ee56233c4ef0552c20304413d137e90acfe +Author: Aaron Rainbolt +Date: Fri May 9 18:46:41 2025 -0500 + + Add emergency shutdown feature, triggered by root device removal + +commit 341dce33fb806ab03822470e6af91604662c22dd +Author: Patrick Schleizer +Date: Fri Apr 25 09:54:23 2025 +0000 + + bumped changelog version + +commit 06e1e44b0039807baa862102b12fc5e199c3ccb3 +Author: Patrick Schleizer +Date: Fri Apr 25 05:51:21 2025 -0400 + + comments + +commit ba1012ca8767baf34ed762d80b25b03bb70e6765 +Author: Patrick Schleizer +Date: Fri Apr 25 08:19:35 2025 +0000 + + bumped changelog version + +commit a8f6132bec1a6f4a639d58295b3e50faf5494d98 +Author: Patrick Schleizer +Date: Fri Apr 25 03:11:27 2025 -0400 + + output + +commit 1d14a9f32435b8131c251e03bff2af5c929bbf49 +Merge: e154d0af 612f5f92 +Author: Patrick Schleizer +Date: Fri Apr 25 02:59:09 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/fix-pkexec-umask' + +commit 612f5f92fde236b86928428fd0247c8e971b0460 +Author: Aaron Rainbolt +Date: Thu Apr 24 20:01:35 2025 -0500 + + Fix umask for pkexec-run commands + +commit e154d0af6dd41e392122fbe3d09219734c5ad588 +Author: Patrick Schleizer +Date: Mon Apr 21 10:21:54 2025 +0000 + + bumped changelog version + +commit 4bf0e3a63667c284d053e5b8517440a884a42441 +Author: Patrick Schleizer +Date: Mon Apr 21 04:57:07 2025 -0400 + + comments + +commit 502f5953c734346edc680a0b898b435e6c6f6e27 +Author: Patrick Schleizer +Date: Mon Apr 21 04:55:19 2025 -0400 + + comments + +commit abb0c83619b820b7b66258efa9e141850eaa8b6c +Author: Patrick Schleizer +Date: Mon Apr 21 04:54:06 2025 -0400 + + comments + +commit efa2967fca36c776d43419dd5bf12696bc61c426 +Author: Patrick Schleizer +Date: Mon Apr 21 04:53:04 2025 -0400 + + comments + +commit dc7e8579040a96630ab1bbf7b4b901e3e3abe8c7 +Author: Patrick Schleizer +Date: Sat Apr 19 17:33:56 2025 +0000 + + bumped changelog version + +commit 9948ae114d4c6bbd650022c9985137c0fdea5675 +Author: Patrick Schleizer +Date: Sat Apr 19 13:24:17 2025 -0400 + + fix + +commit 4aca622706f33e85832e67650259a7751ba87a72 +Author: Patrick Schleizer +Date: Sat Apr 19 13:23:26 2025 -0400 + + fix + +commit 701f4a0e88a32e4c9312fd92b73cef5d4f755f0a +Author: Patrick Schleizer +Date: Sat Apr 19 13:20:04 2025 -0400 + + output + +commit a670c0d873eba8d84bde90ebbeecc7aecc22349e +Author: Patrick Schleizer +Date: Sat Apr 19 13:18:23 2025 -0400 + + comment + +commit 4799f3ce02e5683dad0fff13f5d7fe0aadb0a0db +Author: Patrick Schleizer +Date: Sat Apr 19 13:17:28 2025 -0400 + + make `/usr/libexec/security-misc/apt-get-update` more reliable + +commit c4f0e1d16f6999b055b0fa310456870f12a6dbea +Author: Patrick Schleizer +Date: Sat Apr 19 12:57:14 2025 -0400 + + refactoring + +commit 81634930fa13a240b9fff9a878dd84af1dccc6b3 +Author: Patrick Schleizer +Date: Sat Apr 19 12:55:32 2025 -0400 + + refactoring + +commit 90330a1ec958f82f9322ecc62bcfb7169d641af4 +Author: Patrick Schleizer +Date: Sat Apr 19 12:49:18 2025 -0400 + + refactoring + +commit ce2c9a21a357b3981335336eaf7ac8a6a3bcb052 +Author: Patrick Schleizer +Date: Sat Apr 19 12:47:40 2025 -0400 + + /usr/libexec/security-misc/apt-get-update: use `/run/helper-scripts` folder for pid file instead of `$TMP` + + to avoid permission issues + +commit 96ff7c8dc67809a3199d0b7f22d9e50483634a9c +Author: Patrick Schleizer +Date: Sat Apr 19 12:45:06 2025 -0400 + + refactoring + +commit 5a37790e6bd80ffd4f74d9596523ef72366d35d9 +Author: Patrick Schleizer +Date: Sat Apr 19 12:43:15 2025 -0400 + + cleanup + +commit 7512aa67572c97267fd176e63ae4862b6d37f8ae +Author: Patrick Schleizer +Date: Tue Apr 15 20:59:37 2025 +0000 + + bumped changelog version + +commit e0e2a9b61c61b34a6fe10782e294d58adff15cfe +Merge: 5e88dfe8 9f2836d2 +Author: Patrick Schleizer +Date: Tue Apr 15 15:27:10 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 9f2836d2baae900222cbae74d7a32bcdc69e589f +Merge: 5e88dfe8 aa0ffff4 +Author: Patrick Schleizer +Date: Tue Apr 15 15:17:25 2025 -0400 + + Merge pull request #304 from raja-grewal/stop_pstore + + Disable PStore + +commit 5e88dfe809a762aeebf62ea2de131cfbdea9ae32 +Author: Patrick Schleizer +Date: Thu Apr 10 11:38:17 2025 +0000 + + bumped changelog version + +commit c0a18c5a7122fe3c7b52d0e02ca5e8817efb3996 +Merge: da9dd3c3 74ca63d1 +Author: Patrick Schleizer +Date: Thu Apr 10 06:07:55 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/rename-boot-modes' + +commit 74ca63d12c716017d022f5dfc5348ae7b787e220 +Author: Aaron Rainbolt +Date: Wed Apr 9 21:01:41 2025 -0500 + + Mass-change "PERSISTENCE mode USERNAME" to "PERSISTENCE Mode - USERNAME Session" + +commit aa0ffff42753f68e67bc92680a22986a5b9ef9e0 +Author: raja-grewal +Date: Thu Apr 10 11:49:45 2025 +1000 + + README.md: Revert error + +commit da9dd3c3f14103701ad82af775b4fb547f5b3e2e +Author: Patrick Schleizer +Date: Wed Apr 9 15:16:00 2025 +0000 + + bumped changelog version + +commit 163d51f32a1888a52ea78ba32a4e4a2d72aea87d +Author: Patrick Schleizer +Date: Wed Apr 9 09:47:52 2025 -0400 + + newline at the end + +commit 4d2b2e65468522b1d1beda63b0b16cfa12b1d535 +Author: Patrick Schleizer +Date: Tue Apr 8 14:08:24 2025 +0000 + + bumped changelog version + +commit 39f4f5b60739c387f02970018e14f1ae93677e00 +Author: Patrick Schleizer +Date: Tue Apr 8 06:53:08 2025 -0400 + + comments + +commit 173606891ad0c064a22b4ec0aee772105d8be54a +Author: Patrick Schleizer +Date: Tue Apr 8 06:48:29 2025 -0400 + + output + +commit f0d17c7e4134d8a54ce7331c1e9d3ce932278987 +Author: raja-grewal +Date: Sun Mar 16 03:31:24 2025 +0000 + + README: Fix a few links + +commit df2fc2cf6b0437d23c7641118ebd24d2e3a670ce +Author: raja-grewal +Date: Sun Mar 16 03:30:04 2025 +0000 + + Set `efi_pstore.pstore_disable=1` + +commit f643ebc2f923ba4d7231e5aeaf1d91d1a9d1d0df +Author: raja-grewal +Date: Sun Mar 16 03:28:39 2025 +0000 + + Disable pstore processing by systemd-pstore service + +commit d927fe238cc5369f7fe1632a4173fe4bdf0ffdfb +Author: Patrick Schleizer +Date: Mon Mar 3 11:00:38 2025 +0000 + + bumped changelog version + +commit cd0ba94ac5e7e8360183ac6f440d941b4067025b +Author: Patrick Schleizer +Date: Mon Mar 3 05:57:59 2025 -0500 + + no longer disable `vivid` kernel module by default, + because it breaks Qubes Video Companion + + Thanks to @marmarek for the bug report! + + https://forums.whonix.org/t/testing-qubes-video-companion-on-whonix/21393 + + fixes https://github.com/Kicksecure/security-misc/issues/298 + +commit 3e7d1b4e23e1e8ef4ad138dbe4119eee7e72511c +Author: Patrick Schleizer +Date: Sun Feb 9 23:04:36 2025 +0000 + + bumped changelog version + +commit 0615e6e995eb25d8e1bff181ecc49ff51e4029cc +Merge: 2a4a228b 4d62ee3a +Author: Patrick Schleizer +Date: Sun Feb 9 18:01:43 2025 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 4d62ee3ab31bde80eebde265c2513233f10f751a +Merge: 2a4a228b ce4b57d1 +Author: Patrick Schleizer +Date: Sun Feb 9 18:00:59 2025 -0500 + + Merge pull request #297 from raja-grewal/warn_path + + Update docs on kernel panics + +commit ce4b57d1cb179f18c1ac41681626d01054355fe6 +Author: raja-grewal +Date: Mon Feb 3 00:31:45 2025 +0000 + + Update docs on kernel panics + +commit 2a4a228b150e06c7ff796315719d41e825dd8ad3 +Author: Patrick Schleizer +Date: Fri Jan 31 19:38:42 2025 +0000 + + bumped changelog version + +commit 041caf286b343268e6db69f2957f23c1dd20812a +Author: Patrick Schleizer +Date: Fri Jan 31 14:33:54 2025 -0500 + + update pkg_installed function + +commit ac1493fcfc194b8d1a680d7e8bf53a90caa984ac +Author: Patrick Schleizer +Date: Fri Jan 31 14:33:17 2025 -0500 + + comment + +commit c0f2f110146410428fc12815b30aaba67ff16126 +Author: Patrick Schleizer +Date: Thu Jan 30 12:58:48 2025 +0000 + + bumped changelog version + +commit 9f5e522b83ba969112abf6a9fba77c1eff31b14d +Author: Patrick Schleizer +Date: Thu Jan 30 07:53:04 2025 -0500 + + LC_ALL=C + +commit 7c150d116d1d1f95e2fb729934906eb4391a389a +Author: Patrick Schleizer +Date: Thu Jan 30 07:45:08 2025 -0500 + + LANG=C str_replace: no longer requires LANG=C, therefore removed + +commit 6aaf7082177fe4d02415aac4317cde74665f495c +Author: Patrick Schleizer +Date: Wed Jan 29 14:36:41 2025 +0000 + + bumped changelog version + +commit 10508cb5801c28f8fff306957e867a1626aa6489 +Merge: 6b4fa1ef b9dee263 +Author: Patrick Schleizer +Date: Wed Jan 29 09:36:28 2025 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit b9dee2633128577245763bad41cf3cb6b49751f3 +Merge: 6b4fa1ef 4b1e5306 +Author: Patrick Schleizer +Date: Wed Jan 29 09:35:50 2025 -0500 + + Merge pull request #296 from raja-grewal/cpu_details + + Hardware-related Documentation + +commit 6b4fa1ef0055d36a45d65481129dabfee77027e4 +Author: Patrick Schleizer +Date: Thu Jan 23 16:28:58 2025 +0000 + + bumped changelog version + +commit b10f5489a3e3317f01339ea34a0e5c7bfb850a01 +Author: Patrick Schleizer +Date: Thu Jan 23 11:12:26 2025 -0500 + + copyright + +commit 3c18734db32b2d19c3a30e282435f083d307d86e +Author: Patrick Schleizer +Date: Wed Jan 22 14:11:21 2025 +0000 + + bumped changelog version + +commit f90ffacac3d3c12f62f62106a69cb6caeca69041 +Author: Patrick Schleizer +Date: Wed Jan 22 09:09:56 2025 -0500 + + bump permission hardner migration code version + +commit 3a056c9d9c17ed3968f48ac332cee94f714320c7 +Author: Patrick Schleizer +Date: Wed Jan 22 09:05:50 2025 -0500 + + bump permission hardner migration code version + +commit d5ad29a7324dfbece3185026a3f4c58121c453b6 +Author: Patrick Schleizer +Date: Wed Jan 22 09:04:44 2025 -0500 + + add /usr/lib/polkit-1/polkit-agent-helper-1 to permission hardener hardcoded statoverride file + +commit c8a2483cf6735b29ef9b265cc09b58b00b14b6f0 +Author: Patrick Schleizer +Date: Wed Jan 22 13:52:29 2025 +0000 + + bumped changelog version + +commit 80bd314436b99b723359f25e52bbd14683929b56 +Author: Patrick Schleizer +Date: Wed Jan 22 08:25:14 2025 -0500 + + add `.whonix` files to hardcoded files + +commit 9b012bdeee03e73de537e7fe65c0bb8d16b38e79 +Merge: 507130a1 42f34f5a +Author: Patrick Schleizer +Date: Wed Jan 22 08:23:49 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-symlink-fix' + +commit 507130a1cc0592bd4a4b280da7496dade470e637 +Merge: f1b6bff3 ed767e00 +Author: Patrick Schleizer +Date: Wed Jan 22 08:21:39 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-diag' + +commit 42f34f5a4ccf95d504e28a26aeb0747fef4685ba +Author: Aaron Rainbolt +Date: Tue Jan 21 21:49:03 2025 -0600 + + Don't handle files with multiple hardlinks + +commit 5e60416c864a7d06f635161a185864fc36d5685c +Author: Aaron Rainbolt +Date: Tue Jan 21 21:05:03 2025 -0600 + + Make permission-hardener always apply changes to real files, not symlinks + +commit ed767e00b0260d29c18c710efe07d68a9beffb34 +Author: Aaron Rainbolt +Date: Tue Jan 21 16:41:30 2025 -0600 + + Add some local variable declarations + +commit 4b1e530674146d4d2b62ff4a87fe3add5667403c +Author: raja-grewal +Date: Tue Jan 21 12:39:06 2025 +0000 + + README.md: List CPU mitigations + +commit 15d13a8571d1f38b2bc36387f61bce24c86be97b +Author: raja-grewal +Date: Tue Jan 21 12:36:04 2025 +0000 + + Add info on DBX updates via the UEFI Revocation List + +commit a97620a2e491cc039adb15af94958f26b39319a2 +Author: Aaron Rainbolt +Date: Mon Jan 20 22:43:55 2025 -0600 + + Add print-diagnostics command to permission-hardener + +commit f1b6bff30b1891bfbe870de9edd78fa7dbd66e7c +Author: Patrick Schleizer +Date: Mon Jan 20 11:35:08 2025 +0000 + + bumped changelog version + +commit df9d058ed9635b168508ded20277c174a24cf3f5 +Author: Patrick Schleizer +Date: Mon Jan 20 06:28:16 2025 -0500 + + usrmerge + +commit 8ff5f3b22125488f64cd384ffbfcbd8f2ecd61a6 +Author: Patrick Schleizer +Date: Mon Jan 20 10:11:43 2025 +0000 + + bumped changelog version + +commit 4e0d5a196ccb8ef3fdf2b67d974f28d02a532f91 +Author: Patrick Schleizer +Date: Mon Jan 20 04:30:26 2025 -0500 + + delete comment only configuration file (moved to user-sysmaint-split) + +commit 1b4d1edfc316f125ff5039bf17897802205750e2 +Author: Patrick Schleizer +Date: Mon Jan 20 04:29:42 2025 -0500 + + comments + +commit 51c7010e8f47ce6e6a28e6267c735e897dcfb053 +Author: Patrick Schleizer +Date: Fri Jan 17 13:35:28 2025 +0000 + + bumped changelog version + +commit 876d596a071ac916f7d220ee2449358aedba7efe +Author: Patrick Schleizer +Date: Fri Jan 17 07:55:54 2025 -0500 + + comment + +commit c9e2f82bd01813682998c775f75bac0841239e5e +Merge: 59718697 bf73f1f2 +Author: Patrick Schleizer +Date: Fri Jan 17 07:53:59 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/master' + +commit bf73f1f2b5e429caaf01bfbcdc7d5d032e3c0efb +Author: Aaron Rainbolt +Date: Wed Jan 15 19:10:41 2025 -0600 + + Avoid impossible-to-satisfy dependency on helper-scripts, improve string handling robustness in postinst + +commit 597186972e463ce7a0b44662f7656f351ddf1030 +Author: Patrick Schleizer +Date: Wed Jan 15 15:02:44 2025 +0000 + + bumped changelog version + +commit ca257164105c4f66576024b64c52a42921455d16 +Author: Patrick Schleizer +Date: Wed Jan 15 09:44:48 2025 -0500 + + improve permission hardener migration code + +commit 2dfd30a44ae332faa50bc4920486cdd9480c7e5d +Merge: a84d3ba7 328f7471 +Author: Patrick Schleizer +Date: Wed Jan 15 09:33:57 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/more-permission-hardener' + +commit 328f747179ffb2e7705a73bc9a0c5133a17da829 +Author: Aaron Rainbolt +Date: Tue Jan 14 20:35:28 2025 -0600 + + Restore permission-hardener's notice about how to compare old and new states + +commit c6f09748f383fdf7c1b07441c73477b3f18d2768 +Author: Aaron Rainbolt +Date: Tue Jan 14 20:27:53 2025 -0600 + + Handle de-corruption of new_mode a bit better + +commit a0f81958dfb020d311d86cbd00d4f86f678d8be9 +Author: Aaron Rainbolt +Date: Tue Jan 14 19:25:15 2025 -0600 + + De-corrupt the new_mode permission-hardener statoverride database too + +commit 396372c1295e2a09d596f3e23fccc26794a26f05 +Author: Aaron Rainbolt +Date: Tue Jan 14 18:50:24 2025 -0600 + + Avoid scanning unnecessary packages for modified permission-hardener config + +commit a84d3ba732bcbd2fb93ea2bc145a0db0f33f1b77 +Author: Patrick Schleizer +Date: Tue Jan 14 14:32:13 2025 +0000 + + bumped changelog version + +commit 709036c79f8efc9fefa9e7709780a75f9f5004d2 +Author: Patrick Schleizer +Date: Tue Jan 14 09:31:58 2025 -0500 + + debconf-updatepo + +commit 659c7037c6956f6d905e55a1ebb13ebe6a273dee +Author: Patrick Schleizer +Date: Tue Jan 14 14:30:58 2025 +0000 + + bumped changelog version + +commit 86d3db15bf94dc0f4547105e18ef5f26ca124fa8 +Author: Patrick Schleizer +Date: Tue Jan 14 09:30:46 2025 -0500 + + output + +commit 876c0b618785fc71d1d399ff7ab649382104a714 +Author: Patrick Schleizer +Date: Tue Jan 14 09:29:35 2025 -0500 + + output + +commit c46178dee46f88e8d0007a12a48addc2493faab7 +Author: Patrick Schleizer +Date: Tue Jan 14 09:27:37 2025 -0500 + + output + +commit f3c07a2451fd2818daca6bc248cbbcba213516e7 +Author: Patrick Schleizer +Date: Tue Jan 14 09:24:06 2025 -0500 + + update link + +commit bbc4ad7c2a0827d079ccbb18dce4aaae042a2253 +Author: Patrick Schleizer +Date: Tue Jan 14 14:16:45 2025 +0000 + + bumped changelog version + +commit 9bb92e91a8f364a9d9e5d69e907fe8ed8a3c58a2 +Author: Patrick Schleizer +Date: Tue Jan 14 09:16:25 2025 -0500 + + debhelper + +commit 95dd8f419fc7e9832d8ce6f74d35af9b36752f3f +Author: Patrick Schleizer +Date: Tue Jan 14 14:07:50 2025 +0000 + + bumped changelog version + +commit 0a2f06b456854f1cec3ff93952edef928ac7a184 +Author: Patrick Schleizer +Date: Tue Jan 14 09:07:32 2025 -0500 + + use pre.bsh + +commit 6a4f9c1bd8c48bb1a711eee077ea7a05646b0598 +Author: Patrick Schleizer +Date: Tue Jan 14 14:06:50 2025 +0000 + + bumped changelog version + +commit e60183ec073d278f8d69a5475aa52d75870cd9b0 +Author: Patrick Schleizer +Date: Tue Jan 14 09:06:41 2025 -0500 + + output + +commit a812961beabacca052b4b25b78ecd2c35184d5d5 +Author: Patrick Schleizer +Date: Tue Jan 14 09:06:12 2025 -0500 + + verbose + +commit 0e4dfc59dd9c06dd732affd8ca7f72a1a70a95b0 +Author: Patrick Schleizer +Date: Tue Jan 14 13:53:49 2025 +0000 + + bumped changelog version + +commit cdf179f1277bcae3ef681d35aeca6289d55b3a6a +Author: Patrick Schleizer +Date: Tue Jan 14 08:53:38 2025 -0500 + + fix + +commit 41cd09933a506d55bab1f8bf101840cf4bbbf028 +Author: Patrick Schleizer +Date: Tue Jan 14 09:26:05 2025 +0000 + + bumped changelog version + +commit eec2e2c8ee621c6ebb152abbfe3951fa0322a0d0 +Author: Patrick Schleizer +Date: Tue Jan 14 04:13:39 2025 -0500 + + comment + +commit 6d282226ef653accf1de32582b999ff31775f60f +Author: Patrick Schleizer +Date: Tue Jan 14 04:12:12 2025 -0500 + + comment + +commit 466308e4f9ebd496ff54dd9f77881ce10a558802 +Author: Patrick Schleizer +Date: Tue Jan 14 04:09:57 2025 -0500 + + permission hardener: disable SUID for `chrome-sandbox` + +commit 7a5f8b87af7142ce973bd88abf98279ce15559a9 +Author: Patrick Schleizer +Date: Tue Jan 14 04:06:44 2025 -0500 + + permission hardener: disable SUID for `ssh-agent`, `ssh-keysign`, `/lib/openssh/*` + + This might break SSH host-based authentication. + +commit d89ffcde30f6115c25c1bc807eb30b18c21e2b6e +Author: Patrick Schleizer +Date: Tue Jan 14 04:04:09 2025 -0500 + + comment + +commit 9f1759ba0ea7ecee87c8777226eb8a56482deeb5 +Author: Patrick Schleizer +Date: Tue Jan 14 03:56:55 2025 -0500 + + comment + +commit 0ac85ea9f56abdf621ec1b4f2acf08a2450067ba +Author: Patrick Schleizer +Date: Tue Jan 14 03:54:35 2025 -0500 + + comment + +commit fce6a5f8303cd891efd8bbfef861e357dc90e88e +Author: Patrick Schleizer +Date: Tue Jan 14 03:51:43 2025 -0500 + + comment + +commit 1e9940481318d8d7a443b98f0906089759f27a5d +Author: Patrick Schleizer +Date: Tue Jan 14 03:50:16 2025 -0500 + + comment + +commit b198591537a01f5b35c9301ca28a24c70864bcbd +Author: Patrick Schleizer +Date: Tue Jan 14 03:49:42 2025 -0500 + + comment + +commit 7d44db2cb268c4eb31b50bbd44b87b8001dc068c +Author: Patrick Schleizer +Date: Tue Jan 14 03:49:15 2025 -0500 + + usrmerge + +commit 7e7632a55396e10e20a6e9d8d563011694cccc85 +Author: Patrick Schleizer +Date: Tue Jan 14 08:24:05 2025 +0000 + + bumped changelog version + +commit 420cb3f86f69c4505702a8f38271fb095316cb6f +Author: Patrick Schleizer +Date: Tue Jan 14 03:19:21 2025 -0500 + + refactoring + +commit b7e7b2767eb957dd1401f5abcff07bfcb47a4c00 +Author: Patrick Schleizer +Date: Tue Jan 14 03:18:17 2025 -0500 + + refactoring + +commit b2a1a0ec9f8db1d84c222e734737b7ed149f6d92 +Author: Patrick Schleizer +Date: Tue Jan 14 03:17:00 2025 -0500 + + refactoring + +commit 69ae2d9ea0826aa81c70e957bb5a9241a84346ad +Merge: de1f31e3 de9ebabd +Author: Patrick Schleizer +Date: Tue Jan 14 03:15:45 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-migrate' + +commit de9ebabd46798ff2afa259907b6a7b976070e7f0 +Author: Aaron Rainbolt +Date: Mon Jan 13 21:57:10 2025 -0600 + + Fix minor migration bugs, don't run the migration code on new image builds + +commit a9e87e9d308f5e61a2d2054fa038dae6faadad3a +Author: Aaron Rainbolt +Date: Sun Jan 12 21:13:43 2025 -0600 + + Prevent installation failures when installing non-interactively + +commit 5570d3e5b9f97f14c772facff16dc45df66d42e9 +Author: Aaron Rainbolt +Date: Sun Jan 12 20:40:41 2025 -0600 + + Add a forgotten set -e + +commit 07786de03953b91310588e0b37b9e150bf1b4736 +Author: Aaron Rainbolt +Date: Sun Jan 12 19:34:41 2025 -0600 + + Enable smooth migration from permission-hardener-v1 to permission-hardener-v2 + +commit de1f31e3df1a0fba0a4c6e41b9b46e076266cfd4 +Author: Patrick Schleizer +Date: Sun Jan 12 11:47:18 2025 +0000 + + bumped changelog version + +commit b0baa8baa57937358dc988b88adab4858a1d8cae +Author: Patrick Schleizer +Date: Sun Jan 12 05:38:35 2025 -0500 + + add link + +commit d6a7cd3e0d1e677c1fa8c1fb3b307cdbe0f45031 +Author: Patrick Schleizer +Date: Sun Jan 12 05:36:16 2025 -0500 + + formatting. + + use chapter to make allow for deep linking + +commit 485d9abd1d14e445b48f0fd63290a985b05a5ac7 +Author: Patrick Schleizer +Date: Fri Jan 10 15:34:21 2025 +0000 + + bumped changelog version + +commit c17485baa118e76cc8074ce3e72ac3ac38c577cd +Merge: 482960d0 e9ef3602 +Author: Patrick Schleizer +Date: Fri Jan 10 10:32:26 2025 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e9ef3602dd1661de0c0c3781d7e0246720643354 +Merge: 1b33e835 cf435a8f +Author: Patrick Schleizer +Date: Fri Jan 10 10:30:34 2025 -0500 + + Merge pull request #292 from raja-grewal/cpu_table + + Add link to tabular comparison of CPU mitigations + +commit 1b33e83529d652dab4468e0b386e333b3ca4745b +Merge: 486757bf 2e6e1701 +Author: Patrick Schleizer +Date: Fri Jan 10 10:29:30 2025 -0500 + + Merge pull request #291 from raja-grewal/drop_gratuitous_arp + + Drop gratuitous ARP packets + +commit 486757bfae5e7ecc389b16c49704e742fd267565 +Merge: 17ff2491 c37f4efa +Author: Patrick Schleizer +Date: Fri Jan 10 10:29:12 2025 -0500 + + Merge pull request #290 from raja-grewal/arp_ignore + + Respond to ARP requests only if the target IP address is on-link + +commit 17ff24915062736a32d4d54da7163fe34aa70fd3 +Merge: 27d19ba5 1f8eee47 +Author: Patrick Schleizer +Date: Fri Jan 10 10:28:48 2025 -0500 + + Merge pull request #289 from raja-grewal/arp_filter + + Enable ARP filtering + +commit 27d19ba568e601c37035a310ae6cdd7d953be286 +Merge: 482960d0 5e3785d7 +Author: Patrick Schleizer +Date: Fri Jan 10 10:28:05 2025 -0500 + + Merge pull request #288 from raja-grewal/shared_media + + Deny sending and receiving shared media redirects + +commit 482960d056ec8d624f127bfe9b1c69a4c30c7e34 +Author: Patrick Schleizer +Date: Fri Jan 10 10:21:12 2025 -0500 + + permission-hardener: move to new state folder `/var/lib/permission-hardener-v2` without migration + + https://github.com/Kicksecure/security-misc/pull/294 + +commit cf435a8fa8e6f795a25ef004cf44a65d461dd32c +Author: raja-grewal +Date: Fri Jan 10 13:22:21 2025 +1100 + + README.md: Note importance of microcode updates + +commit 3a31cc99b34617cdd3c5f8e8950a37158849cb56 +Merge: c4cfb859 5941195e +Author: Patrick Schleizer +Date: Thu Jan 9 09:30:58 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/usrmerge' + +commit 538b312349a97bcecb12e62519d77840afcd6ca3 +Author: raja-grewal +Date: Thu Jan 9 15:28:56 2025 +1100 + + Add comment about microcode updates + +commit 1f8eee47200221e2e38291a31e852e9c222d8c64 +Author: raja-grewal +Date: Wed Jan 8 18:36:00 2025 +1100 + + Add missing sentence full stop + +commit 5e3785d76e616f49407e720b37138f35a50fe4fb +Author: raja-grewal +Date: Wed Jan 8 18:35:52 2025 +1100 + + README.md: Remove double space + +commit 5941195e96880b8beb2a791d3c21f3a4c6d429eb +Author: Aaron Rainbolt +Date: Tue Jan 7 14:10:46 2025 -0600 + + Don't worry about files under /bin anymore, Bookworm uses a merged /usr directory + +commit c4cfb8597d1a8631a4cbfa7e88212b798e2bc514 +Merge: c6be6219 93ebf176 +Author: Patrick Schleizer +Date: Mon Jan 6 08:43:54 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-refactor' + +commit c6be621968c898f792ef1a450d2e1be5cd6056da +Author: Patrick Schleizer +Date: Mon Jan 6 10:31:40 2025 +0000 + + bumped changelog version + +commit 6e0787957b53a64132b64e2a29bafe3e4b66d178 +Author: Patrick Schleizer +Date: Mon Jan 6 05:29:40 2025 -0500 + + increase priority of pam wheel so it is checked even before faillock + + in case of attemtping to use `su` without being a member of the required group `sudo`, it's useful to abort the PAM stack as early as possible to avoid needlessly propmting for a password to later + be rejected tu to lack of group membership + +commit d4767b75206b46f1a006cd91b00239a7b828fc89 +Author: Patrick Schleizer +Date: Mon Jan 6 04:24:44 2025 -0500 + + fix: apply PAM wheal only to `su` PAM service + +commit 93ebf176c5f38bd268e5394e01421e46b9ae7dff +Author: Aaron Rainbolt +Date: Thu Jan 2 20:41:40 2025 -0500 + + Make the main field count check in permission-hardener a bit more elegant + +commit 895c0f541fb34f9ebfee9c7ef79c053d5af4a7cc +Merge: 717e6fcf 40b23cfa +Author: Aaron Rainbolt +Date: Wed Jan 1 15:04:01 2025 -0600 + + Merge branch 'master' into arraybolt3/permission-hardener-refactor + +commit 40b23cfad40825eefc3686e562d78250b58bbc82 +Author: Patrick Schleizer +Date: Tue Dec 31 18:42:01 2024 +0000 + + bumped changelog version + +commit 33114f771aaeb4dccb0b465861d1239129deb8b2 +Author: Patrick Schleizer +Date: Tue Dec 31 13:26:21 2024 -0500 + + copyright + +commit bb24bff2965ca31de6337820eafd787a11a44a2b +Author: Patrick Schleizer +Date: Tue Dec 31 14:09:34 2024 +0000 + + bumped changelog version + +commit 0640964c35b0d977ba718629d4a8791e67700202 +Author: Patrick Schleizer +Date: Tue Dec 31 06:14:29 2024 -0500 + + readme + +commit 717e6fcfbea38cef9d3e201cf2e2b725e3da2267 +Author: Aaron Rainbolt +Date: Mon Dec 30 19:23:20 2024 -0600 + + Post-review improvements to permission-hardener + +commit dbcb612517abbf8d162cfb31ba0585c518df8817 +Author: Aaron Rainbolt +Date: Wed Dec 25 19:48:28 2024 -0600 + + Polish permission-hardener refactor + +commit 397b476a822c9f7e41ec911f5d689b67026660ad +Author: Patrick Schleizer +Date: Thu Dec 26 04:12:02 2024 +0000 + + bumped changelog version + +commit 66f8c18c65f33676d242b57ebb1d4410876461b3 +Merge: aa82202e 6602fb10 +Author: Patrick Schleizer +Date: Wed Dec 25 22:43:04 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sysmaint' + +commit 83d386795940099e0835c51f3522aae3d9217dc8 +Author: Aaron Rainbolt +Date: Tue Dec 24 20:14:57 2024 -0600 + + Refactor permission-hardener to be more idempotent + +commit 6602fb102dedc21300ae4c4519f3d9ef4e668045 +Author: Aaron Rainbolt +Date: Tue Dec 24 20:52:34 2024 -0600 + + Adjust pam-info messaging for sysmaint mode + +commit aa82202e701167eacb63eac208469844e983ca43 +Author: Patrick Schleizer +Date: Tue Dec 24 05:16:22 2024 +0000 + + bumped changelog version + +commit 27d015d58ebc5e750d9d06f042b761720473941d +Merge: 3c73c0cd 2f3a2bce +Author: Patrick Schleizer +Date: Tue Dec 24 00:08:58 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sysmaint' + +commit 2f3a2bce7756efe75cd8aaf5066b599b4c49bbdc +Author: Aaron Rainbolt +Date: Fri Dec 20 11:04:22 2024 -0600 + + Add warning about using non-sysmaint accounts in sysmaint mode + +commit 3c73c0cd3a845d1a484551ff50f59e5f2ef56a68 +Author: Patrick Schleizer +Date: Fri Dec 20 06:01:27 2024 +0000 + + bumped changelog version + +commit a4c76c617a18a49168e0ffdba2d8b0ae834f2877 +Author: Patrick Schleizer +Date: Fri Dec 20 01:01:13 2024 -0500 + + syntax fix + +commit b40bc0a2c9b17b3569918a6839bce1c67af5c9df +Author: Patrick Schleizer +Date: Fri Dec 20 05:58:24 2024 +0000 + + bumped changelog version + +commit b21c394ea52401c0d77b6ec396af6a49335f5e0b +Author: Patrick Schleizer +Date: Fri Dec 20 00:56:20 2024 -0500 + + Trigger permission hardener when new configuration files are being installed. + +commit cd027b86e710b6f6b8fac6dd0ebcdcd691e86dd3 +Author: Patrick Schleizer +Date: Fri Dec 20 05:48:48 2024 +0000 + + bumped changelog version + +commit ad6e1f5ad490e12fc5e69b82da5dc1830cc41c96 +Author: Patrick Schleizer +Date: Fri Dec 20 00:41:06 2024 -0500 + + move from `/etc/permission-hardener.d` to `/usr/lib/permission-hardener.d` + +commit a2c1e8c218117a47ef70dd767d753be5d084adfa +Author: Patrick Schleizer +Date: Fri Dec 20 00:39:51 2024 -0500 + + clean up old files in `/etc/permission-hardener.d` + because will be moved to `/usr/lib/permission-hardener.d` + +commit 6de5d2d0763539d6d0d4b19b501bb316ed3b2c94 +Author: Patrick Schleizer +Date: Fri Dec 20 00:37:44 2024 -0500 + + permission hardener: also parse `/usr/lib/permission-hardener.d/*.conf` folder + +commit 721b100fb64136b7c36c8d43c90c716a1fed42d0 +Author: Patrick Schleizer +Date: Thu Dec 19 10:58:50 2024 +0000 + + bumped changelog version + +commit 642b4eeedc43e69bb82ea259b52c0946ce638983 +Author: raja-grewal +Date: Thu Dec 19 21:57:25 2024 +1100 + + Add link to tabular comparison of CPU mitigations + +commit 175b442d5bb9dfcb4e9b524ec2077e72c74598cc +Author: Patrick Schleizer +Date: Thu Dec 19 05:56:50 2024 -0500 + + use long option name + +commit c99021bb0c1d5b6bf361cc483449330cdd218ee6 +Merge: 95b53576 9d69cd19 +Author: Patrick Schleizer +Date: Thu Dec 19 05:56:01 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sysmaint' + +commit 2e6e1701a052ef32711f6c3abaad693a773323f6 +Author: raja-grewal +Date: Thu Dec 19 10:35:08 2024 +0000 + + Set `net.ipv4.conf.*.drop_gratuitous_arp=1` + +commit c37f4efadf8f046168732871172cb66f58eb7c78 +Author: raja-grewal +Date: Thu Dec 19 10:33:49 2024 +0000 + + Set `net.ipv4.conf.*.arp_ignore=2` + +commit af1d06973bdd46af3e39b0bdfda81b950ccac996 +Author: raja-grewal +Date: Thu Dec 19 10:31:43 2024 +0000 + + Set `net.ipv4.conf.*.arp_filter=1` + +commit 750367a9066ca2a0ff819b438a92cb1f6c325edb +Author: raja-grewal +Date: Thu Dec 19 10:29:56 2024 +0000 + + Set `net.ipv4.conf.*.shared_media=0` + +commit 95b535764c8a98b67a71ee1fd57b7f01da464106 +Author: Patrick Schleizer +Date: Thu Dec 19 09:43:26 2024 +0000 + + bumped changelog version + +commit daf0a0900b780a9d44d0d9b49b3fca6ddbd20d18 +Author: Patrick Schleizer +Date: Thu Dec 19 04:39:34 2024 -0500 + + fix apt-get-update for non-English locale + + https://forums.kicksecure.com/t/systemcheck-reports-warning-debian-package-update-check-result-apt-get-reports-that-packages-can-be-updated-but-system-is-already-fully-upgraded/785 + +commit e9a5b14a0db6f071424c19e6f4b006386afb6ab4 +Author: Patrick Schleizer +Date: Thu Dec 19 06:57:42 2024 +0000 + + bumped changelog version + +commit 3135a03e21f9e5816097e25aaa7f4a1671f8f87d +Merge: f0c611d9 c7f71964 +Author: Patrick Schleizer +Date: Thu Dec 19 00:34:56 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit c7f7196471b07a580c6d4a5d86739215508142cd +Merge: e5b67e04 3749f8ff +Author: Patrick Schleizer +Date: Thu Dec 19 00:31:25 2024 -0500 + + Merge pull request #287 from raja-grewal/patch + + Refactor and add two CPU mitigations + +commit f0c611d9edb5fd7a3e00d13b248c65abda2c9d8a +Author: Patrick Schleizer +Date: Thu Dec 19 00:18:25 2024 -0500 + + comment + +commit 4f681be77429984695a1b0f689065051884e7bf7 +Merge: 4c3ca684 4cf57575 +Author: Patrick Schleizer +Date: Thu Dec 19 00:17:44 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e5b67e044bb5011dd667879a73a670f2c5f74057 +Merge: 4cf57575 c1167968 +Author: Patrick Schleizer +Date: Thu Dec 19 00:15:02 2024 -0500 + + Merge pull request #279 from raja-grewal/arp + + Provide network-related hardening options via `sysctl`'s + +commit 4cf5757575c1257a14331f0169a9d8d163e1326d +Merge: 9d06341c 1708a03e +Author: Patrick Schleizer +Date: Thu Dec 19 00:08:56 2024 -0500 + + Merge pull request #282 from ArrayBolt3/arraybolt3/umask + + Enable umask hardening + +commit 9d69cd1912ab657e7916b38f56b477c2b7abd0a3 +Author: Aaron Rainbolt +Date: Wed Dec 18 21:34:16 2024 -0600 + + Add sysmaint account lock detection + +commit 3749f8ff097551a843e5ed80de52c6770a32e0c6 +Author: raja-grewal +Date: Wed Dec 18 03:36:09 2024 +0000 + + Update presentation on user namespaces + +commit 0dff2cd28fd769955757cdef1b7f9d637a1180c5 +Author: raja-grewal +Date: Wed Dec 18 03:32:35 2024 +0000 + + Minor additions + +commit 3e96fdd9ccb6268403d6c4f9a061c4a33e6f6dd2 +Author: raja-grewal +Date: Tue Dec 17 11:44:11 2024 +0000 + + Enable `kvm.mitigate_smt_rsb=1` + +commit 45355aabdc180a6a2fdd4a374c6f7d72f4d36240 +Author: raja-grewal +Date: Tue Dec 17 11:42:52 2024 +0000 + + Enable `kvm-intel.vmentry_l1d_flush=always` + +commit defba1f2450b2c8bbc668bf5f6f6f0d101338cc7 +Author: raja-grewal +Date: Tue Dec 17 11:42:03 2024 +0000 + + Refactor CPU mitigations + +commit 943c421889ce5dfe3869380e4587ca22724f2ce7 +Author: raja-grewal +Date: Tue Dec 17 11:40:38 2024 +0000 + + Minor refactoring + +commit ca3a73ac13d805515f71f1be7ecedc33d3a1b519 +Author: raja-grewal +Date: Tue Dec 17 11:37:10 2024 +0000 + + Typo + +commit 4c3ca68453b44074025a1ec9f31451c57344f3cf +Author: Aaron Rainbolt +Date: Mon Dec 9 12:37:11 2024 -0600 + + Disable unnecessary sudoers exceptions + +commit 9d06341c91b51f9c737fe67457045924323635f0 +Merge: a9dd592a 5b88e92e +Author: Patrick Schleizer +Date: Sat Dec 14 15:18:56 2024 -0500 + + Merge pull request #285 from Kicksecure/permission-hardener-mount + + Permission Hardener: treat mount same as umount + +commit c1167968542a62d0677517e11505f6e9222ec378 +Author: raja-grewal +Date: Thu Dec 12 06:36:47 2024 +0000 + + `arp_ignore`: Add reference to 2024-12-10 Mullvad VPN audit details + +commit a9dd592a8b49226f326e90111178aebba3cc144f +Author: Patrick Schleizer +Date: Tue Dec 10 19:19:10 2024 +0000 + + bumped changelog version + +commit 58722324ec0be98c3e44938df8cb60ca9b261210 +Merge: 518224b8 439fa7f3 +Author: Patrick Schleizer +Date: Tue Dec 10 14:18:50 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/no-recovery-mode' + +commit 518224b8cf9e99a830b584d8d54b5dea2925c8f5 +Author: Patrick Schleizer +Date: Tue Dec 10 19:17:10 2024 +0000 + + bumped changelog version + +commit 439fa7f3be74f5eba4b98f73c0bb50fd37e8b0e1 +Author: Aaron Rainbolt +Date: Sun Dec 8 03:21:27 2024 -0600 + + Harden/disable recovery mode options + +commit 7902311c570edd4286ba36f0cb85223d1e909a03 +Author: Patrick Schleizer +Date: Sat Dec 7 04:54:47 2024 -0500 + + do not create /etc/sysctl.d/30-lkrg-virtualbox.conf if LKRG is not installed + +commit 1ce37d42cd2c132eca8c45ddb04fdb594349d08f +Author: Patrick Schleizer +Date: Sat Dec 7 04:50:40 2024 -0500 + + . + +commit 5b88e92e5c4b951e659e1574fc248bd11158dfb2 +Author: Patrick Schleizer +Date: Fri Dec 6 09:48:58 2024 -0500 + + permission hardner: treat `mount` the same way we treat `umount` + + Thanks to @the-moog for the bug report! + + fixes https://github.com/Kicksecure/security-misc/issues/284 + +commit 93b51819d4693955936456916188b4118fe68a66 +Author: Patrick Schleizer +Date: Fri Dec 6 09:47:08 2024 -0500 + + permission hardener mount chmod change from `745` to `755` + + https://github.com/Kicksecure/security-misc/issues/284 + +commit 1708a03e1edda821ef091f10c46d32f740511d38 +Author: Aaron Rainbolt +Date: Thu Nov 28 15:20:57 2024 -0600 + + Enable umask hardening + +commit 59299a6639fef31565b8f3cef857c9faa331e0f7 +Author: Patrick Schleizer +Date: Mon Nov 25 21:07:42 2024 +0000 + + bumped changelog version + +commit 98d7c245ee11f16e566422a17543aaed2c155d88 +Author: Patrick Schleizer +Date: Mon Nov 25 15:57:30 2024 -0500 + + "|| exit 1" no longer required thanks to errexit + +commit f9b5d7d3f4f2ed8d1baae67d8427f13cf26aee8d +Author: Patrick Schleizer +Date: Mon Nov 25 15:48:01 2024 -0500 + + use strict shell options + +commit d32cb8c95b09721e52c4d682a0ddd39d590a4368 +Author: Patrick Schleizer +Date: Mon Nov 25 15:44:00 2024 -0500 + + use TMP, sponge, refactoring + +commit 62a551cfe39a6a640f32e6e97f3e915aa8673514 +Merge: af43472d d7475e25 +Author: Patrick Schleizer +Date: Mon Nov 25 15:38:01 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sudoers' + +commit d7475e252a64e296913ed8893261e52e72163d55 +Author: Aaron Rainbolt +Date: Thu Nov 21 20:03:42 2024 -0600 + + Make apt-get-update able to be terminated securely + +commit af43472d0ccdecb1725a200d10aeeb1b8d51f31a +Author: Patrick Schleizer +Date: Thu Nov 14 22:24:50 2024 +0000 + + bumped changelog version + +commit c7e9460b2ae8dcb96196fef69a7e0ed992c1b43b +Author: Patrick Schleizer +Date: Thu Nov 14 16:31:12 2024 -0500 + + output + +commit 31804e30ecc9c5a1c5a8e1e014d3dcb85cee4f36 +Author: Patrick Schleizer +Date: Thu Nov 14 20:46:26 2024 +0000 + + bumped changelog version + +commit ef95b3f9a5aed9652c541cf4bf05b20011718466 +Author: Patrick Schleizer +Date: Thu Nov 14 14:41:14 2024 -0500 + + Revert "fix `panic-on-oops.service`" + + This reverts commit 862d23cb10b7687084f8e7e207d1e2c9c1ef6751. + +commit 412b371e85044962f6620386b767369b9e25d71e +Merge: 141b84c4 57e1edde +Author: raja-grewal +Date: Wed Nov 13 16:47:57 2024 +1100 + + Merge branch 'Kicksecure:master' into arp + +commit 141b84c40de76988ec78bdccf1c1d67fc4367b3f +Author: raja-grewal +Date: Wed Nov 13 05:42:56 2024 +0000 + + Provide option to deny sending and receiving shared media redirects + +commit 18aec201bfb0477fee8800ad1388099e11920016 +Author: raja-grewal +Date: Wed Nov 13 05:41:25 2024 +0000 + + Provide option to harden response to ARP requests + +commit a25d4f8df88908e83e56049204aa625f1196a948 +Author: raja-grewal +Date: Wed Nov 13 05:40:21 2024 +0000 + + Provide option to enable ARP filtering + +commit c2aae73ce161811571e4c85609a0b043399c1b65 +Author: raja-grewal +Date: Wed Nov 13 05:38:03 2024 +0000 + + Add reference and move text + +commit 57e1edde23aa3f313ce087e00ebc14d158356d6c +Author: Patrick Schleizer +Date: Tue Nov 12 09:11:57 2024 +0000 + + bumped changelog version + +commit 7987a3914d364e674eb7479b15708c450041af02 +Author: Patrick Schleizer +Date: Tue Nov 12 02:29:42 2024 -0500 + + deleted no longer used and out-commented `/etc/sudoers.d/xfce-security-misc` leftover + +commit 8c2e8e69798e5255529ab3dbee6ca07b8b293100 +Author: Patrick Schleizer +Date: Tue Nov 12 01:41:12 2024 -0500 + + deleted no longer used and out-commented `etc/sudoers.d/pkexec-security-misc` leftover + +commit 65fc0419a84d62e07c61d7e37ef27d144b6b6794 +Author: Patrick Schleizer +Date: Mon Nov 11 11:07:57 2024 +0000 + + bumped changelog version + +commit 50161f5d79eea2ab796863e4eb30eccc17e0b41d +Author: Patrick Schleizer +Date: Mon Nov 11 05:48:11 2024 -0500 + + moved /etc/dkms/framework.conf.d/30_security-misc.conf (renamed) to usability-misc + +commit 7c06e22c7d11c345428f3ad42ba43805ebc8d810 +Author: Patrick Schleizer +Date: Mon Nov 11 05:43:25 2024 -0500 + + deleted `/usr/bin/pkexec.security-misc` + + This was not used anymore for anything. In the past, we used to `config-package-dev` `replace` `/usr/bin/pkexec` with `/usr/bin/pkexec.security-misc` for the purpose of: + + > Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with hidepid. + + * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 + * https://forums.whonix.org/t/cannot-use-pkexec/8129 + + This was a worthwhile effort, interesting approach but ultimately a dead-end. + +commit ef05b1a160b24d5aa42da9cc15009d94a37cf120 +Author: Patrick Schleizer +Date: Mon Nov 11 05:40:41 2024 -0500 + + disable legacy matroxfb_base framebuffer driver + + fix typo matroxfb_bases -> matroxfb_base + + Thanks to @ArrayBolt3 for the bug report! + +commit 862d23cb10b7687084f8e7e207d1e2c9c1ef6751 +Author: Patrick Schleizer +Date: Mon Nov 11 05:36:41 2024 -0500 + + fix `panic-on-oops.service` + + remove `After=multi-user.target` because already using `WantedBy=multi-user.target` + + Thanks to @ArrayBolt3 for the bug report! + +commit 29ae5f5980d521f6a4b468f5bf41210f78fdf10a +Author: Patrick Schleizer +Date: Mon Nov 11 05:28:31 2024 -0500 + + fix optional opt-in `harden-module-loading.service` + + by making `/usr/libexec/security-misc/disable-kernel-module-loading` executable + + Thanks to @ArrayBolt3 for the bug report! + +commit 4c649577f053af12bcd02c20576bf2d8aec1476d +Author: Patrick Schleizer +Date: Sun Nov 10 11:52:42 2024 +0000 + + bumped changelog version + +commit 29b1f1ec5f3a4bf3991fc1b862751c8eb9769ecd +Merge: 5bd0a277 238f32e8 +Author: Patrick Schleizer +Date: Sun Nov 10 06:32:30 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 5bd0a277bf39812c6adf40a7a3ef6390935fa08e +Author: Patrick Schleizer +Date: Sun Nov 10 06:29:17 2024 -0500 + + fix permission-hardener issue "Removing capabilities failed. File: '/bin/ping'" + + no longer user end-of-options marker (`--`) for `setcap` + since setcap does not support it + + Fixes https://github.com/QubesOS/qubes-issues/issues/9569 + + https://forums.whonix.org/t/permission-hardener-error/20719 + +commit 238f32e81d835e5b9d3bc43a0654d05efa4c4313 +Merge: 3af26841 8107782f +Author: Patrick Schleizer +Date: Fri Nov 8 07:39:40 2024 -0500 + + Merge pull request #280 from raja-grewal/ssbd + + Enable `ssbd=force-on` + +commit 8107782fa54ec0e21893e6bd4a6baabb71eb864b +Author: raja-grewal +Date: Fri Nov 8 15:36:04 2024 +1100 + + Enable `ssbd=force-on` + +commit a1d1f97955fd9fd3cee77dc04e2eb5e5fa29d243 +Author: raja-grewal +Date: Fri Nov 8 03:58:23 2024 +0000 + + Provide option to drop gratuitous ARP packets + +commit 3af2684134279ba6f5b18b40986f02a50baa5604 +Author: Patrick Schleizer +Date: Wed Oct 30 09:43:05 2024 +0000 + + bumped changelog version + +commit 71c58442ca6d57cd95b72a76ed87f8c248cdbd98 +Author: Patrick Schleizer +Date: Mon Oct 28 05:10:19 2024 -0400 + + minor + +commit cfe19e31d858d7899f4d95e21117c992d236d328 +Author: Patrick Schleizer +Date: Mon Oct 28 05:09:53 2024 -0400 + + shell options + +commit 0d506156587f87a303184f22259ffb57dd92cbc8 +Author: Patrick Schleizer +Date: Mon Oct 28 05:07:00 2024 -0400 + + local + +commit ef0eb5f7a0c5a62c5d26bf6dc534f6aa3decc4b0 +Author: Patrick Schleizer +Date: Mon Oct 28 05:06:26 2024 -0400 + + refactoring + +commit fdd1f4b7f88efc22bb57c2ad3e83c0c2e8cbb064 +Author: Patrick Schleizer +Date: Mon Oct 28 05:06:05 2024 -0400 + + refactoring + +commit d00235897d686895a7e2e7da7435832fee008164 +Author: Patrick Schleizer +Date: Mon Oct 28 05:03:59 2024 -0400 + + hide-hardware-info: also parse `/usr/local/etc/hide-hardware-info.d/*.conf` + +commit 6c2e808b9f34900840bd2857fed10d1ffd4cc4c2 +Author: Patrick Schleizer +Date: Mon Oct 28 05:03:20 2024 -0400 + + refactoring + +commit b44e507900defe3db68f31f3e110b1c3e5aa684c +Author: Patrick Schleizer +Date: Wed Oct 23 09:56:05 2024 +0000 + + bumped changelog version + +commit 566cda5e4bc69f54d63d72f1e30703074fdf0ce8 +Author: Patrick Schleizer +Date: Mon Oct 21 05:47:38 2024 -0400 + + output + +commit 5991a23049491dd04c19d9ea80f7d7381dd494a0 +Author: Patrick Schleizer +Date: Mon Oct 21 05:47:25 2024 -0400 + + comment + +commit fd34baff8ff17ed572469d9d6d884e6c0d881d20 +Merge: b6433309 690e8dd8 +Author: Patrick Schleizer +Date: Mon Oct 21 05:43:53 2024 -0400 + + Merge remote-tracking branch 'ArrayBolt3/master' + +commit 690e8dd826d1cb39c0c12c03792781862cc2dd23 +Author: Aaron Rainbolt +Date: Sat Oct 19 23:49:07 2024 -0500 + + Avoid faillock lock/tally reset on reboot or timeout + +commit b6433309fd7d6839cfba89e1197590e1ff62ef58 +Author: Patrick Schleizer +Date: Fri Oct 18 12:45:02 2024 -0400 + + use end-of-options + +commit 0cfcdf4f89dc75f2a8e3f8a9e8c69dc3ba3da78a +Author: Patrick Schleizer +Date: Wed Oct 16 10:57:20 2024 +0000 + + bumped changelog version + +commit 0adb9b7c0609a51d503b61ab40ae7d8e55635043 +Merge: 263335f7 e50ad807 +Author: Patrick Schleizer +Date: Wed Oct 16 06:31:09 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e50ad807c01b5753c67d579126d7b79d38070c0a +Merge: 263335f7 eb72163d +Author: Patrick Schleizer +Date: Wed Oct 16 06:29:25 2024 -0400 + + Merge pull request #276 from raja-grewal/KSPP_header + + Clarify KSPP compliance header + +commit eb72163d5707c7673db1f12405d2e04261bd43c8 +Author: raja-grewal +Date: Mon Oct 14 03:01:15 2024 +0000 + + README.md: Make line lengths consistent + +commit a9f238fe048acfeff49f96c00570acc6ca4c37e8 +Author: raja-grewal +Date: Mon Oct 14 02:57:31 2024 +0000 + + README.md: Split optional setting to new line + +commit 09fe46adc956e8c6de232f1093c37cdd30933acd +Author: raja-grewal +Date: Mon Oct 14 02:54:30 2024 +0000 + + Clarify KSPP compliance header for the undocumented case + +commit 263335f74ea0f050f9c259e20141c3345e7fa789 +Author: Patrick Schleizer +Date: Tue Oct 8 11:24:56 2024 +0000 + + bumped changelog version + +commit 9169611645d0cd5a308ff48862f351ef5ea5f7e8 +Merge: 8a2d432f 8227a3dd +Author: Patrick Schleizer +Date: Tue Oct 8 05:54:50 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 8227a3dde2995ceb113164baf49591d52c2b53e1 +Merge: 8a2d432f 0c0774f6 +Author: Patrick Schleizer +Date: Tue Oct 8 05:53:48 2024 -0400 + + Merge pull request #273 from raja-grewal/text_2 + + Documentation update 2 + +commit 0c0774f6c0927ed1cc599f931175985b8f01ec30 +Merge: dc470cac 8a2d432f +Author: raja-grewal +Date: Sun Oct 6 10:48:52 2024 +0000 + + Merge branch 'master' into text_2 + +commit dc470cac1d93656354aeaaac0a6f8cbbd39f9f0f +Author: raja-grewal +Date: Sun Oct 6 10:46:05 2024 +0000 + + Remmove deprecated link + +commit 8a2d432ffe6d4eb661026b6e7dbf534bb1db971b +Author: Patrick Schleizer +Date: Thu Oct 3 07:22:23 2024 +0000 + + bumped changelog version + +commit 0e3ffa3f11a0049e57803c8f2e75dbb7d8ceb22c +Author: Patrick Schleizer +Date: Thu Oct 3 02:58:58 2024 -0400 + + no longer set `kernel.unprivileged_userns_clone=0` + + because it breaks too much + + fixes https://github.com/Kicksecure/security-misc/issues/274 + +commit f401d94d5e0d0f26e93be55deda440fe565a6b22 +Author: Patrick Schleizer +Date: Thu Oct 3 02:44:06 2024 -0400 + + expand documentation on `kernel.unprivileged_userns_clone=0` sysctl + + https://github.com/Kicksecure/security-misc/issues/274 + +commit ac1378743c7448c9a7e7e02bebcf3270592d42a5 +Author: raja-grewal +Date: Mon Sep 30 16:56:18 2024 +1000 + + Consistent formatting + +commit eae38e72f30ff9b9f8d0b8b0b33182a918333e48 +Author: raja-grewal +Date: Thu Sep 26 13:10:36 2024 +0000 + + README.md: Show the current max_map_count + +commit f3b50a23c976ba4feff34eee721c50f698ecc5bf +Author: raja-grewal +Date: Thu Sep 26 13:10:01 2024 +0000 + + Add reference on unprivileged_userns_restriction + +commit 39d063d494cb540f45747f6253ab896200ba03c3 +Author: raja-grewal +Date: Thu Sep 26 13:09:21 2024 +0000 + + Add KSPP=no definition + +commit 5572eb897a10455041df8abec6b6be6de29431a0 +Author: Patrick Schleizer +Date: Wed Sep 25 01:03:42 2024 +0000 + + bumped changelog version + +commit e04f9cd4c17305d5201aa973c34778e81508734b +Merge: 18d426f5 65aa9105 +Author: Patrick Schleizer +Date: Tue Sep 24 20:16:06 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 65aa910503c07f708abf20f78be2f519ef58764a +Merge: 18d426f5 870ff886 +Author: Patrick Schleizer +Date: Tue Sep 24 20:15:03 2024 -0400 + + Merge pull request #272 from raja-grewal/text + + Documentation update + +commit 870ff88605b8167c8882162cc3da005d71ca0cd3 +Author: raja-grewal +Date: Wed Sep 25 10:01:45 2024 +1000 + + Comment on Flatpak requiring unprivileged user namespaces + +commit 769767a96a5de2a8bc05e70ca490d8340b553061 +Author: raja-grewal +Date: Wed Sep 25 09:54:49 2024 +1000 + + Update mmap ASLR docs + +commit 18d426f521b2b1369fe68e143dc8a0be064d0dcc +Author: Patrick Schleizer +Date: Sat Sep 14 02:56:09 2024 +0000 + + bumped changelog version + +commit 3280dbd5d562d7f6b50118ac0da36c3285493be6 +Author: Patrick Schleizer +Date: Fri Sep 13 22:52:47 2024 -0400 + + Fix VirtualBox audio device ICH AC97. + + no longer `blacklist snd_intel8x0` + + Breaks VirtualBox audio device ICH AC97, which is unfortunately still required by some users. + https://www.kicksecure.com/wiki/Dev/audio + + Fixes https://github.com/Kicksecure/security-misc/issues/271 + +commit 1bc694fa124eaeb6e1517d2191a8fd97446872c4 +Author: Patrick Schleizer +Date: Sun Sep 8 17:41:30 2024 +0000 + + bumped changelog version + +commit 01908d505a59e7ec37cc3de3e1d49ff35ba127aa +Author: Patrick Schleizer +Date: Thu Sep 5 07:00:11 2024 -0400 + + readme + +commit e914028be7a48a3bfdf86e09c029011807f080d7 +Author: Patrick Schleizer +Date: Thu Sep 5 06:03:05 2024 -0400 + + add KSPP compliance status to readme based on comment by @raja-grewal + + https://github.com/Kicksecure/security-misc/issues/256#issuecomment-2330376651 + +commit 40fb14c654df94e9bdfb30ae55fc3bc4f0a0aef4 +Author: Patrick Schleizer +Date: Wed Sep 4 14:13:15 2024 +0000 + + bumped changelog version + +commit 5a255d4831470449a26b324a8f16594432bf834b +Merge: d618f9f3 563a8980 +Author: Patrick Schleizer +Date: Wed Sep 4 10:12:34 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 563a8980133e15e33ac95a631e37ecfff88f6f8f +Merge: 175945ec e61027a4 +Author: Patrick Schleizer +Date: Wed Sep 4 10:11:48 2024 -0400 + + Merge pull request #265 from raja-grewal/mmap_min_addr + + Set `sysctl vm.mmap_min_addr=65536` + +commit d618f9f35b8e8c6eee1e164a6ec300d63b1ee797 +Merge: 59374ce9 175945ec +Author: Patrick Schleizer +Date: Wed Sep 4 10:07:50 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 175945ec9a28bf1e5b0fa0d2ae2bd6546d6c6172 +Merge: b0a85441 3101035a +Author: Patrick Schleizer +Date: Wed Sep 4 10:05:47 2024 -0400 + + Merge pull request #268 from raja-grewal/panic_on_warn + + Enable `panic_on_warn=1` + +commit b0a8544182f6ff3c8c3f1068176ff5e9e4f557ef +Merge: 59374ce9 7393ba15 +Author: Patrick Schleizer +Date: Wed Sep 4 10:04:45 2024 -0400 + + Merge pull request #270 from raja-grewal/typo + + Small typo + +commit 7393ba159192fdfc45ef31a3fa60786f899dbf25 +Author: raja-grewal +Date: Wed Sep 4 23:23:24 2024 +1000 + + Typo + +commit 59374ce902127e2125addc2ebb57d0d856a63671 +Author: Patrick Schleizer +Date: Thu Aug 29 09:49:51 2024 +0000 + + bumped changelog version + +commit 7e2838ec077b53e41d468d5655290152761c8745 +Merge: 9c918eb4 0762794f +Author: Patrick Schleizer +Date: Thu Aug 29 05:06:07 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0762794ff684049a62b5b92b61177615a5376ad7 +Merge: 9c918eb4 6294729c +Author: Patrick Schleizer +Date: Thu Aug 29 04:46:26 2024 -0400 + + Merge pull request #269 from raja-grewal/tidy + + Minor correction + +commit 6294729c8ef24077cd342b4557653806c3aacd34 +Author: Raja Grewal +Date: Thu Aug 29 15:34:24 2024 +1000 + + Follow-up on https://github.com/Kicksecure/security-misc/commit/f70fe308a9f65873d34de2d1906d825f3a56e272 + +commit 3101035a3fd5fbe87c79e95e51dc2da39fee93d5 +Author: Raja Grewal +Date: Thu Aug 29 01:57:32 2024 +1000 + + Enable `panic_on_warn=1` + +commit 9c918eb4313b60dc15aa9fa4474a7977602030c1 +Author: Patrick Schleizer +Date: Wed Aug 28 11:01:37 2024 +0000 + + bumped changelog version + +commit f70fe308a9f65873d34de2d1906d825f3a56e272 +Author: Patrick Schleizer +Date: Wed Aug 28 06:49:50 2024 -0400 + + no longer set sysctl `fs.binfmt_misc.status=0` / + no longer disallow registering interpreters for miscellaneous binary formats + + causing file/folder permissions issue `d????????? ? ? ? ? ? .` + + Firefox no longer starting (probably not not a Firefox issue) + + https://github.com/Kicksecure/security-misc/issues/267 + +commit 463aa58f28b6389d0925fed87096b348b652cc16 +Merge: cf824ddb 328840c9 +Author: Patrick Schleizer +Date: Wed Aug 28 06:42:49 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 328840c933a583adc5458aa08c63fb627b31b298 +Merge: cf824ddb 9e91c98c +Author: Patrick Schleizer +Date: Wed Aug 28 06:38:57 2024 -0400 + + Merge pull request #264 from raja-grewal/kspp_compliance + + Add KSPP compliance notices to corresponding parameters and `sysctls` + +commit 9e91c98cc926e7a166458cd78e3c1d1ced23c753 +Author: Raja Grewal +Date: Mon Aug 26 12:40:04 2024 +1000 + + Add details on BPF hardening and split the `sysctl`s + +commit 2c356e8b0ef7db56e7b453535c8cb6c83fc2e3c6 +Author: Raja Grewal +Date: Mon Aug 26 11:34:12 2024 +1000 + + Add KSPP notice definitions + +commit 2841d789bebbd43f855b6ffb92a3a6f017007a72 +Author: Raja Grewal +Date: Mon Aug 26 11:21:26 2024 +1000 + + README: Update + +commit ac6602ac3531ae57603e8a9e5ac2ee1652164b23 +Author: Raja Grewal +Date: Mon Aug 26 11:19:20 2024 +1000 + + Add detail on disabling user namespaces breaking UPower + +commit 9dbd200be415c86e7039463c6269fad8395a4373 +Merge: 32de5e7c cf824ddb +Author: raja-grewal +Date: Mon Aug 26 11:08:21 2024 +1000 + + Merge branch 'Kicksecure:master' into kspp_compliance + +commit cf824ddb248957fd9e542c1a5adc5e90381f684c +Author: Patrick Schleizer +Date: Sun Aug 25 15:34:55 2024 +0000 + + bumped changelog version + +commit 500568e322b2e3623fc649209d671c7b9d9fa097 +Merge: 43d13b70 73900b59 +Author: Patrick Schleizer +Date: Sun Aug 25 11:01:58 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 73900b59db37d77bc24bd5088aae3cc760aacc69 +Merge: 43d13b70 1f51d4ee +Author: Patrick Schleizer +Date: Sun Aug 25 11:00:51 2024 -0400 + + Merge pull request #263 from raja-grewal/max_user_namespaces + + Provide option to disable user namespaces + +commit 43d13b70f12d2198a800054ce4d1ff901cc474f9 +Merge: 83537641 fae586c3 +Author: Patrick Schleizer +Date: Sun Aug 25 10:55:52 2024 -0400 + + Merge remote-tracking branch 'raja/syntax' + +commit 835376418d616699023f8e638666f43d34241863 +Merge: ae85fd5b 342caf82 +Author: Patrick Schleizer +Date: Sun Aug 25 10:48:25 2024 -0400 + + Merge remote-tracking branch 'raja/mod' + +commit ae85fd5b4ce6f4716f95332c19b79d3daa8f7220 +Author: Patrick Schleizer +Date: Sun Aug 25 14:33:40 2024 +0000 + + bumped changelog version + +commit 433b15f985545f531b87d09659bbbb89993b5a67 +Author: Raja Grewal +Date: Wed Aug 21 12:51:51 2024 +1000 + + README.md: Organise `sysctl`s + +commit af87a84b4f40b2ad9ac05dd9bce837665f239454 +Author: Raja Grewal +Date: Wed Aug 21 12:52:48 2024 +1000 + + README.md: Organise kernel boot parameters + +commit 32de5e7c49d301b62b838ba88550f58b02b6562b +Author: Raja Grewal +Date: Sun Aug 25 12:57:22 2024 +1000 + + Add details on oopses and warnings + +commit e4909b5e28e16f09de0e548c9221578ebe1190a3 +Author: Raja Grewal +Date: Sun Aug 25 12:47:04 2024 +1000 + + Add details on kernel panics + +commit 342caf82b20acc2931563449fafe9a98cbedaba2 +Author: Raja Grewal +Date: Wed Aug 21 12:52:48 2024 +1000 + + README.md: Organise kernel boot parameters + +commit b87a18d4050bbf2add5cc4920684876a440e65bb +Author: Raja Grewal +Date: Wed Aug 21 12:51:51 2024 +1000 + + README.md: Organise `sysctl`s + +commit 18ed77ecc93e9ee759a4990a32edb3dd671b8c26 +Author: Raja Grewal +Date: Wed Aug 21 12:50:14 2024 +1000 + + Refactor modprobe.d to minimise potential future merge conflicts + +commit 56b28e38264fe742b8d694176f1057c15574fc08 +Author: Raja Grewal +Date: Mon Aug 19 11:50:08 2024 +1000 + + Typo + +commit e61027a40e2ab82fac3ae4cfd5f91fd0a47f31e5 +Author: Raja Grewal +Date: Mon Aug 19 11:32:20 2024 +1000 + + Set `sysctl vm.mmap_min_addr=65536` + +commit 94dab1b7c503429e2fa91019a0183b2f36c6693f +Author: Raja Grewal +Date: Mon Aug 19 10:53:05 2024 +1000 + + Partial compliance with the KSPP on kernel panics + +commit 683110e7f02fa5fc6415354386552640cdb8758b +Author: Raja Grewal +Date: Mon Aug 19 01:34:14 2024 +1000 + + Correction + +commit 1f51d4eeb2b0c6e23ce64fb272eecb97e089324d +Author: Raja Grewal +Date: Sun Aug 18 13:53:11 2024 +1000 + + Add details on user namespaces + +commit 248e094b8e0bbf7892f79ad1c3ec77c7ed00d008 +Author: Raja Grewal +Date: Sat Aug 17 01:06:21 2024 +1000 + + Include KSPP compliance notices + +commit 759aee8150a2d1258d73217c071b25432d47496f +Author: Raja Grewal +Date: Fri Aug 16 22:54:57 2024 +1000 + + Provide option to disable user namespaces + +commit fae586c3c5e8382ca01c60f810b26d88189a5514 +Author: Raja Grewal +Date: Fri Aug 16 19:23:48 2024 +1000 + + Patch bug in existing `rp_filter` `sysctl` + +commit e962153f84c4cb8e13fb0cc25d611ae481c7a0c7 +Author: Patrick Schleizer +Date: Fri Aug 16 08:38:12 2024 +0000 + + bumped changelog version + +commit 40b12f5a2a4a40d7033569b11ad4e1c228e7389b +Merge: 12296c68 305467c6 +Author: Patrick Schleizer +Date: Fri Aug 16 04:30:29 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 305467c652af933bb5aa5a677b10a992a5f19cab +Merge: 12296c68 a5373afc +Author: Patrick Schleizer +Date: Fri Aug 16 04:25:43 2024 -0400 + + Merge pull request #245 from raja-grewal/blacklist_to_disable + + Update `/etc/modprobe.d/*` + +commit 12296c68dc0aaa3703e1c36f854a02de8db412fe +Merge: 4bc12b07 036bcea4 +Author: Patrick Schleizer +Date: Fri Aug 16 04:22:43 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 036bcea4e6757de094fcafdadcf56aaa90729d79 +Merge: ef60c5b1 81bf7a8f +Author: Patrick Schleizer +Date: Fri Aug 16 04:20:32 2024 -0400 + + Merge pull request #262 from raja-grewal/docs + + Miscellaneous updates to presentation + +commit 81bf7a8f90098a7107dcb3c783b87a168f5c090f +Merge: cea8e753 ef60c5b1 +Author: raja-grewal +Date: Fri Aug 16 16:57:01 2024 +1000 + + Merge branch 'Kicksecure:master' into docs + +commit ef60c5b153a521e1cfd522ac471a8ca6dc076d90 +Merge: 4bc12b07 b552b924 +Author: Patrick Schleizer +Date: Fri Aug 16 02:43:57 2024 -0400 + + Merge pull request #249 from raja-grewal/binfmt_misc + + Disallow registering interpreters for miscellaneous binary formats + +commit cea8e753786d100ebe961ad74a99925e54d47771 +Author: Raja Grewal +Date: Fri Aug 16 14:55:22 2024 +1000 + + Consistent formating + +commit 84376d23fc17d2ced890ffca0b05d15907d42a6f +Author: Raja Grewal +Date: Fri Aug 16 13:39:11 2024 +1000 + + Add details on ASLR and move to user space section + +commit a13298002350a39491a509d15633edb95a2e3edd +Author: Raja Grewal +Date: Fri Aug 16 13:24:25 2024 +1000 + + Update README.md + +commit 9212a4e93754a4505be3fcf0ff4b029c073d2f07 +Author: Raja Grewal +Date: Fri Aug 16 13:12:07 2024 +1000 + + Typos + +commit 23a77d4973ec20b2aaab6a9c3a9fd8a98034923e +Author: Raja Grewal +Date: Fri Aug 16 12:46:51 2024 +1000 + + Simplify syntax of some network-related `sysctl`'s + +commit e3a3207a4447568a17129afe9dde34debc465e21 +Author: Raja Grewal +Date: Fri Aug 16 12:41:36 2024 +1000 + + Clarify DMA hardening + +commit be9308e490f79a7b7788a744524d1d91cc870726 +Merge: 73db68db 4bc12b07 +Author: raja-grewal +Date: Fri Aug 16 11:45:43 2024 +1000 + + Merge branch 'Kicksecure:master' into docs + +commit 4bc12b07b42def786862b938e3f63c18cf874158 +Author: Patrick Schleizer +Date: Thu Aug 15 17:51:18 2024 +0000 + + bumped changelog version + +commit 9e61e37c17524b57f185b796f2ac19ba193205a8 +Merge: 89e816dd dfd1c971 +Author: Patrick Schleizer +Date: Thu Aug 15 13:47:33 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit dfd1c97168249b229495cbd873d4d8493e244663 +Merge: 89e816dd ec3038c7 +Author: Patrick Schleizer +Date: Thu Aug 15 13:46:30 2024 -0400 + + Merge pull request #248 from raja-grewal/secure_redirects + + Re-enable (default) `secure_redirects` for ICMP redirect messages + +commit b552b92401f67d59e12ac6fda2f7fe1c54b0c8a7 +Author: Raja Grewal +Date: Thu Aug 15 11:54:21 2024 +1000 + + Add references on `fs.binfmt_misc.status` + +commit 326d82a9beee130956dd817812016a6ee16fccbc +Author: Raja Grewal +Date: Thu Aug 15 11:46:56 2024 +1000 + + Revert "Provide optional `sysctl fs.binfmt_misc.status=0`" + + This reverts commit debd7a7b7ae8b03e04d2c8597bcccf2c79000570. + +commit 73db68dbf9a1f9ded95a593db36a4960ce06a173 +Author: Raja Grewal +Date: Fri Aug 9 14:27:30 2024 +1000 + + Add details on KFENCE + +commit f8fa89b245d929aee9884937fdcf44a6551df4cf +Author: Raja Grewal +Date: Fri Aug 9 14:21:59 2024 +1000 + + Add details on `tcp_timestamps` + +commit 3456f1c1d7725846ec201c28dd693bf9b07bab89 +Author: Raja Grewal +Date: Fri Aug 9 13:39:25 2024 +1000 + + Minor consistency update in README.md + +commit 15c638acad64cc3dcc7b5c43d9a6be2fa2350654 +Author: Raja Grewal +Date: Fri Aug 9 13:36:47 2024 +1000 + + Add reference on RDRAND + +commit 077bc48a26d1d3f5d1f758d7e251edccba64742b +Author: Raja Grewal +Date: Fri Aug 9 13:35:33 2024 +1000 + + Add reference on `rp_filter` + +commit d8bcec881f66604e29d6e0c1426635e2ad4979f1 +Author: Raja Grewal +Date: Fri Aug 9 13:33:32 2024 +1000 + + Add some notices for future Debian 13 rebase + +commit 0b0683499a6a21e3995a115c377eb19008bc4cd1 +Author: Raja Grewal +Date: Fri Aug 9 13:30:39 2024 +1000 + + Consistent line length formatting + +commit e5a38fc856c66d2bd6abc35fc08d4f2083ea8e54 +Author: Raja Grewal +Date: Fri Aug 9 13:30:15 2024 +1000 + + Typo + +commit a5373afc55e789f4657f3d843243e878e4afffa2 +Author: Raja Grewal +Date: Wed Aug 7 14:44:14 2024 +1000 + + Details on disabled `fbdev` kernel modules + +commit e98dc8c4f8af32dd3b10c034477fd2154df189ac +Author: Raja Grewal +Date: Wed Aug 7 14:14:47 2024 +1000 + + Update notifications for disabled kernel modules + +commit 50fa721fd54cd696ae90a35bc7df7c8f1eb17a13 +Author: Raja Grewal +Date: Wed Aug 7 14:01:49 2024 +1000 + + Update docs regarding Intel module disabling + +commit ec3038c7bc625f6c8eddb753ffe295ff2697a717 +Author: Raja Grewal +Date: Wed Aug 7 13:48:53 2024 +1000 + + Clarify `secure_redirects` + +commit debd7a7b7ae8b03e04d2c8597bcccf2c79000570 +Author: Raja Grewal +Date: Wed Aug 7 13:33:44 2024 +1000 + + Provide optional `sysctl fs.binfmt_misc.status=0` + +commit 89e816dda6c5a00512b276071c4d9fe108ee63b5 +Author: Patrick Schleizer +Date: Tue Aug 6 14:01:39 2024 +0000 + + bumped changelog version + +commit 967f9e257b09bc73ddb579292d507f7cb9832643 +Merge: fa909186 a25aaf90 +Author: Patrick Schleizer +Date: Tue Aug 6 09:57:56 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit a25aaf900a12666046278a9fab6933b3d5670679 +Merge: 6bc039a4 85590793 +Author: Patrick Schleizer +Date: Tue Aug 6 09:55:20 2024 -0400 + + Merge pull request #260 from raja-grewal/vdso32 + + Enable `vdso32=0` + +commit 6bc039a430289342f06857a52a5f13829d6e50f5 +Merge: ce60d561 d102ec19 +Author: Patrick Schleizer +Date: Tue Aug 6 09:52:56 2024 -0400 + + Merge pull request #259 from raja-grewal/kfence + + Enable `kfence.sample_interval=100` + +commit ce60d5615fe99e41c48d459f562d581a688c295a +Merge: b0278428 c0d140f2 +Author: Patrick Schleizer +Date: Tue Aug 6 09:48:08 2024 -0400 + + Merge pull request #258 from raja-grewal/legacy_tiocsti + + Enable `dev.tty.legacy_tiocsti=0` + +commit b0278428a73cd3d329aaa36626005e0c593331f0 +Merge: fa909186 aa34d865 +Author: Patrick Schleizer +Date: Tue Aug 6 09:39:04 2024 -0400 + + Merge pull request #257 from raja-grewal/slab_debug + + Enable `slab_debug=FZ` + +commit 8559079312adb4ed92e5f478120b408dfe7a1124 +Author: Raja Grewal +Date: Mon Aug 5 15:10:02 2024 +1000 + + Enable `vdso32=0` + +commit d102ec19972865032f12f90bffe3e592546f0267 +Author: Raja Grewal +Date: Mon Aug 5 15:07:56 2024 +1000 + + Enable `kfence.sample_interval=100` + +commit c0d140f2211e6490d13e3cd327005027c668905f +Author: Raja Grewal +Date: Mon Aug 5 15:06:34 2024 +1000 + + Enable `dev.tty.legacy_tiocsti=0` + +commit aa34d86598f5b846b007730104e4c99c59f9984d +Author: Raja Grewal +Date: Mon Aug 5 14:27:17 2024 +1000 + + Enable `slab_debug=FZ` + +commit 4f7f82016015f61002ac8f778b61968c572dc7dc +Author: Raja Grewal +Date: Mon Aug 5 14:16:33 2024 +1000 + + Add reference + +commit fa9091869d417c6494840d0cb32623037d70c8be +Merge: 06f0c271 725118c5 +Author: Patrick Schleizer +Date: Sun Aug 4 16:20:36 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 725118c5759b45118bbd2804492526ea2a7c1a81 +Merge: 6d97408a 6d211faf +Author: Patrick Schleizer +Date: Sun Aug 4 16:19:52 2024 -0400 + + Merge pull request #243 from raja-grewal/namespaces + + Restrict unprivileged user namespaces + +commit 06f0c27128a66c1074f405de3139651519e48204 +Merge: 8abc5ae8 6d97408a +Author: Patrick Schleizer +Date: Sun Aug 4 16:15:01 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 6d97408a6d2f002461ae6ca1d647fbf24bf1b99e +Merge: 8abc5ae8 6f14d68c +Author: Patrick Schleizer +Date: Sun Aug 4 16:11:46 2024 -0400 + + Merge pull request #255 from raja-grewal/SLUB + + Restore option to enable `slub_debug=FZ` + +commit 8abc5ae8f0f152c68f855f0e8d993880589c5d5c +Merge: de6f3ea7 eab66dad +Author: Patrick Schleizer +Date: Sun Aug 4 16:09:52 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit eab66dad0994e408c1beaade3fdcf2cd1d605b31 +Merge: de6f3ea7 ca2179bb +Author: Patrick Schleizer +Date: Sun Aug 4 16:08:32 2024 -0400 + + Merge pull request #254 from raja-grewal/patch + + Updates to kernel and `sysctl` hardening + +commit 6f14d68cdcad3784311e33029eba6906ea0784c2 +Author: Raja Grewal +Date: Sat Aug 3 15:12:15 2024 +1000 + + Update legacy name `slub_debug` -> `slab_debug` + +commit 22b6cee80c74aff3d0f9cd36822ae88f8fa8e601 +Author: Raja Grewal +Date: Sat Aug 3 15:11:14 2024 +1000 + + Add details about `slub_debug` + +commit b77d1a2b980ae20158aa628eec67b016282d0a40 +Author: Raja Grewal +Date: Sat Aug 3 14:49:48 2024 +1000 + + Revert "Remove the optional `slub_debug` parameter since it is no longer recommended" + + This reverts commit 48e1ac416314d2c66f3a0d5044a3c51cb6fb4093. + +commit ca2179bb6a01e3ebbb1e04e3507cc305f25bca4e +Author: Raja Grewal +Date: Sat Aug 3 00:25:49 2024 +1000 + + Provide the option to disable legacy TIOCSTI operation + +commit 52aeacb4da4a8458b0ffdc1ade4094a178def6f4 +Author: Raja Grewal +Date: Sat Aug 3 00:13:38 2024 +1000 + + Provide option to disable 32 bit vDSO mappings + +commit 9099ecce8ae12352f2b739d3d7adf6069488ff49 +Author: Raja Grewal +Date: Sat Aug 3 00:12:50 2024 +1000 + + Provide option to enable the kernel Electric-Fence + +commit f6a16258a116ce5c5f4f6bad9d8ab9b6e1ec6bb7 +Author: Raja Grewal +Date: Sat Aug 3 00:11:06 2024 +1000 + + Add references to KSPP + +commit e53d24fc48b51a21fc182cc59890e97a1d7ac647 +Author: Raja Grewal +Date: Sat Aug 3 00:09:42 2024 +1000 + + Add missing GRUB command lines for disabled boot parameters + +commit de6f3ea74a5a1408e4351c955ecb7010825364c5 +Author: Patrick Schleizer +Date: Sun Jul 28 20:50:22 2024 +0000 + + bumped changelog version + +commit d036094089e3e3a74df981c50882481273fcb6c0 +Merge: e60ce50d 0f86fbd8 +Author: Patrick Schleizer +Date: Sun Jul 28 15:44:40 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0f86fbd8ceea3157ee035eb9f4a0ff13024f1bc9 +Merge: e60ce50d 73979d43 +Author: Patrick Schleizer +Date: Sun Jul 28 15:43:54 2024 -0400 + + Merge pull request #242 from raja-grewal/ptrace + + Disable the usage of `ptrace()` by all processes + +commit 9cabaa1bd15a0639c87bf2e965755d06ff0a7bb4 +Author: Raja Grewal +Date: Sun Jul 28 22:04:30 2024 +1000 + + Typo + +commit d2d024ebe9a371eaf90b7b72f8a227e5d2e9babe +Author: Raja Grewal +Date: Sun Jul 28 22:03:33 2024 +1000 + + Typo + +commit 9fbee9fc82768c3b436307459d174378ee471335 +Author: Raja Grewal +Date: Sun Jul 28 21:57:25 2024 +1000 + + Clarify + +commit e60ce50d30c8981f13d8bab1d6ca8b8efb9d8928 +Author: Patrick Schleizer +Date: Sat Jul 27 16:13:35 2024 +0000 + + bumped changelog version + +commit e86b2e7f8fcda5727b158579610cb6a0354e89cf +Author: Patrick Schleizer +Date: Sat Jul 27 12:13:18 2024 -0400 + + output + +commit 144545762674e914046bb94100237329320e8ece +Author: Raja Grewal +Date: Sat Jul 27 14:00:30 2024 +1000 + + Show details regarding `secure_redirects` (again) + +commit 73979d4342dae2017be52d5182bb66fa28be398d +Author: Raja Grewal +Date: Sat Jul 27 13:28:59 2024 +1000 + + Link to `ptrace()` discussion + +commit 1c9f33f90606fb930744f1b9afc11caf87626194 +Author: Raja Grewal +Date: Sat Jul 27 13:24:08 2024 +1000 + + Revert "Disable the usage of `ptrace()` by all processes" + + This reverts commit b04828f858fa6d101099773d3156841fd6d33b6f. + +commit 330cf14eab248d035fa467dba4f7bc3eb92a33bb +Author: Patrick Schleizer +Date: Fri Jul 26 15:40:24 2024 +0000 + + bumped changelog version + +commit 62bb4bc6269a0603c15f1efaad7ca365ea15c9d7 +Merge: 7969e860 886f6095 +Author: Patrick Schleizer +Date: Fri Jul 26 11:10:25 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 886f6095dba71d76d5fd98277374417657e0cd31 +Merge: 7969e860 ed333669 +Author: Patrick Schleizer +Date: Fri Jul 26 11:08:30 2024 -0400 + + Merge pull request #250 from raja-grewal/Panik-Kalm + + Add details on "oopes" and kernel panics + +commit 7969e8607160eae0cb5a3adddeec8d07c1d6e097 +Merge: e2ae93a9 0318f577 +Author: Patrick Schleizer +Date: Fri Jul 26 11:06:13 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0318f577ab554ae2ac0f9417b18134723ea2b580 +Merge: e2ae93a9 4397de01 +Author: Patrick Schleizer +Date: Fri Jul 26 11:04:29 2024 -0400 + + Merge pull request #246 from raja-grewal/cfi + + Provide the option to change the default CFI implementation in the future + +commit e2ae93a9571f2f0c9077ea61436a540a3be5a894 +Author: Patrick Schleizer +Date: Fri Jul 26 10:30:45 2024 -0400 + + port to safe_echo + +commit 8ec23ed7128580ed0092df43945ba55e94163a6d +Author: Patrick Schleizer +Date: Fri Jul 26 10:28:57 2024 -0400 + + echo does not support end-of-options + +commit 6096ed1109a0d5a62a844552fee500ebe66071c8 +Author: Patrick Schleizer +Date: Fri Jul 26 10:26:43 2024 -0400 + + comment + +commit ac41d1cfff8b722248a5ef1dfe38a8c704f04134 +Author: Patrick Schleizer +Date: Fri Jul 26 10:25:59 2024 -0400 + + comment + +commit 3b033ceba24e5e14056d54710d782397e5c669df +Author: Patrick Schleizer +Date: Fri Jul 26 10:17:24 2024 -0400 + + shellcheck + +commit 04d9ca1ebe79cae5cce04b6533285b8d1299d692 +Author: Patrick Schleizer +Date: Fri Jul 26 10:16:20 2024 -0400 + + use `find` with `safe_echo_nonewline` + +commit 20454fb81157f1f962f36d9c37d34f4ac650a1e6 +Merge: 28b25bda 6bbf176e +Author: raja-grewal +Date: Sat Jul 27 00:09:30 2024 +1000 + + Merge branch 'Kicksecure:master' into blacklist_to_disable + +commit 6bbf176e3b91f842cf4cdeaf8cb1f4c60e159a0c +Author: Patrick Schleizer +Date: Fri Jul 26 09:33:45 2024 -0400 + + consider end-of-options for `find` + +commit 794f6a25fa87a9d6d796b07ee06b690ea0badc92 +Author: Patrick Schleizer +Date: Fri Jul 26 09:08:29 2024 -0400 + + comment + +commit 7e0f1a87010674c63963b70c87e903cf27b288ef +Author: Patrick Schleizer +Date: Fri Jul 26 09:08:04 2024 -0400 + + dpkg-statoverride can actually handle '--file-name'. + +commit ee037c01a1208b9247c3ae144fa3faa68657ffdb +Author: Patrick Schleizer +Date: Fri Jul 26 08:58:44 2024 -0400 + + Skip file names starting with '--', + + because this would be interpreted by dpkg-statoverride as an option. + +commit 82d401a7de58b74448113bed36c8f0cc073c7f82 +Author: Patrick Schleizer +Date: Fri Jul 26 08:52:42 2024 -0400 + + sanity test + +commit 0e661bc688c7222840c9d83fb3ccab6549b3ac11 +Author: Patrick Schleizer +Date: Fri Jul 26 08:49:14 2024 -0400 + + output + +commit d144f68d1a06a1153c4178b2f6ba9643dededbb8 +Author: Patrick Schleizer +Date: Fri Jul 26 08:46:08 2024 -0400 + + output + +commit 05504b9ab251ae6e48b5d28eb5fdcd12d730ea8a +Author: Patrick Schleizer +Date: Fri Jul 26 08:40:10 2024 -0400 + + minor + +commit d96c0633d431dafd034ae8d1ae0ffbb59c49be4a +Author: Patrick Schleizer +Date: Fri Jul 26 08:39:11 2024 -0400 + + more use of end of options + +commit 8e40c10c319a76e0256c8f135182b0ca7f532f85 +Author: Patrick Schleizer +Date: Fri Jul 26 08:31:17 2024 -0400 + + comment + +commit f2c9c2f5d1b59127b22fae4dd4b8bb7a6f98a485 +Author: Patrick Schleizer +Date: Fri Jul 26 08:26:16 2024 -0400 + + output + +commit 2b40ea75e9c3f679fd09ae331a56f294c3ac7607 +Author: Patrick Schleizer +Date: Fri Jul 26 08:24:23 2024 -0400 + + cleanup + +commit 6f0551b944cbf83d82f7a1a554c4461bc971520b +Author: Patrick Schleizer +Date: Fri Jul 26 08:23:54 2024 -0400 + + refactoring + +commit aac450f80836b03478b9e2632afc5a4519f9b37a +Author: Patrick Schleizer +Date: Fri Jul 26 08:22:04 2024 -0400 + + refactoring + +commit 30f46790a4df7662926fa43d44ac34c3286dd590 +Author: Patrick Schleizer +Date: Fri Jul 26 08:21:21 2024 -0400 + + use end of options whenever possible + +commit 95722d6d7902367afb44175263a8628df9ad01b2 +Author: Patrick Schleizer +Date: Fri Jul 26 08:13:33 2024 -0400 + + use long option name + +commit 19f131c7426aaa5199504e75aba180a7771a2520 +Author: Patrick Schleizer +Date: Fri Jul 26 08:07:08 2024 -0400 + + code simplification + + https://github.com/Kicksecure/security-misc/pull/251 + +commit 9694cf0cd1a225c68d45814e0f4d6995659a0066 +Author: Patrick Schleizer +Date: Fri Jul 26 07:43:59 2024 -0400 + + output + +commit bdfe764f9d805b14dca4196e623e81ce95145d9b +Merge: 9f135231 652a06c8 +Author: Patrick Schleizer +Date: Fri Jul 26 07:19:05 2024 -0400 + + Merge remote-tracking branch 'ben-grande/stat-dedup' + +commit 9f135231ccdc3f6eba27db2e1794eff23f03fc0f +Author: Patrick Schleizer +Date: Fri Jul 26 06:43:01 2024 -0400 + + no longer disable Intel ME related kernel modules + + because that might break firmware updates + + This reverts commit 64f8b2eb5870664fca06aa060f2f50af358ced55. + + https://github.com/Kicksecure/security-misc/issues/239 + +commit f616da7c0690fc0dffc21be59174ed8754ec55fb +Author: Patrick Schleizer +Date: Fri Jul 26 09:40:59 2024 +0000 + + bumped changelog version + +commit 4397de0138dac47aee66570fcfe4ef38c8179321 +Author: Raja Grewal +Date: Fri Jul 26 11:30:46 2024 +1000 + + Update description of `cfi=kcfi` kerenel parameter + +commit 652a06c8e9f841e043cc5b5fb030b149cb70dc85 +Author: Ben Grande +Date: Thu Jul 25 12:37:21 2024 +0200 + + Only print SUID or SGID values when set + +commit 3b8a3f9b832ee1eee959fbcce8b5eed417d4712e +Author: Ben Grande +Date: Thu Jul 25 12:20:16 2024 +0200 + + Unduplicate stat call + +commit 28b25bda3f51c7d5a6ee6d28446cb5f731f452d0 +Author: Raja Grewal +Date: Thu Jul 25 15:51:32 2024 +1000 + + Partial inclusion of GrapheneOS infrastructure blacklist + +commit ed3336694ce35614ab47db42bce29d3c69d46752 +Author: Raja Grewal +Date: Thu Jul 25 10:28:27 2024 +1000 + + Provide the option to immediately reboot on a kernel panics + +commit 3926b91dcf371377d38c747e5c7718ac2fed3c83 +Author: Raja Grewal +Date: Thu Jul 25 10:26:23 2024 +1000 + + Add documentation on `sysctl kernel.panic_on_oops=1` + +commit f699eb02a27ef54b9ced5866447b63152984af66 +Author: Raja Grewal +Date: Thu Jul 25 10:11:33 2024 +1000 + + Set `sysctl fs.binfmt_misc.status=0` + +commit 9231f058911ab9059e91c4c0c1677ef66b5bb666 +Author: Patrick Schleizer +Date: Wed Jul 24 13:31:49 2024 -0400 + + todo + +commit 4cc1289e89b341e15725d65e405e607ea4784f9f +Author: Patrick Schleizer +Date: Wed Jul 24 13:30:30 2024 -0400 + + output + +commit 10c73b326f824f783169383888b9464965a53cbb +Author: Patrick Schleizer +Date: Wed Jul 24 12:07:26 2024 -0400 + + fix delimiter parsing + +commit a16dd8474bf72c2b8c63adc7500140e89d19fedb +Author: Patrick Schleizer +Date: Wed Jul 24 11:50:30 2024 -0400 + + sanity test + +commit cc2b335ee692cc04a2c4e298902f3503927b2c50 +Author: Patrick Schleizer +Date: Wed Jul 24 11:48:32 2024 -0400 + + cleanup + +commit 6cadc70a96cd709fb7a94abcb14e7dd97c57fdb8 +Author: Patrick Schleizer +Date: Wed Jul 24 11:47:52 2024 -0400 + + output + +commit cda0d26af7c057dab8edf4897f98c2e8f83e3d56 +Author: Patrick Schleizer +Date: Wed Jul 24 11:45:13 2024 -0400 + + cannot use NULL inside a bash variable + + use custom delimiter instead + +commit 4a5312b3a9419c8b3e07dda2b650d5fbf9a38d34 +Author: Patrick Schleizer +Date: Wed Jul 24 11:27:51 2024 -0400 + + output + +commit 3bf1f26c0bb271d63c16b314e4da040abf5b3713 +Author: Patrick Schleizer +Date: Wed Jul 24 11:20:26 2024 -0400 + + downgrade warning of non-existing folders to info + + to avoid all users by default getting a warning for expected non-existing folders + +commit 151ca659a9f5565744ff57f3b581c8c051def148 +Author: Patrick Schleizer +Date: Wed Jul 24 11:19:15 2024 -0400 + + output + +commit c9fd2ceb61ea176c731432f02a9fa40652fbddc8 +Author: Patrick Schleizer +Date: Wed Jul 24 11:13:35 2024 -0400 + + downgrade warning of non-existing files to info + + to avoid all users by default getting a warning for expected non-existing files + +commit 721392901be384014298f59deb57747b825c8b37 +Author: Patrick Schleizer +Date: Wed Jul 24 11:12:39 2024 -0400 + + remove duplicate test + +commit 9712b5b4e3cff3eac8ef03b5e562ff89d74ef4b8 +Author: Patrick Schleizer +Date: Wed Jul 24 11:12:18 2024 -0400 + + output + +commit 00911df5c1de24960ad6d21b4cd99450f2d08a88 +Author: Patrick Schleizer +Date: Wed Jul 24 11:10:56 2024 -0400 + + modify call of stat to use NUL delimiter + + for more robust string parsing + +commit d5366835112cc5fabef7ec46a9c582c08121cb14 +Author: Patrick Schleizer +Date: Wed Jul 24 11:03:28 2024 -0400 + + local clean_output_prefix clean_output + +commit a6e517736b83c124cf8cec52bac184612a29ad0d +Author: Patrick Schleizer +Date: Wed Jul 24 11:02:25 2024 -0400 + + local stat_output + +commit ced02fb9e03e12c7d51923511e7d6a54b09a6274 +Author: Patrick Schleizer +Date: Wed Jul 24 11:01:24 2024 -0400 + + add sanity test for file_name output from stat + +commit b9dfe70a016e46e1f275918be19890526182cfa2 +Author: Patrick Schleizer +Date: Wed Jul 24 10:58:05 2024 -0400 + + check first if file_name is empty + +commit 1cbda7998196dc04e83c48526d15f9ad5f11e6c9 +Author: Patrick Schleizer +Date: Wed Jul 24 10:57:13 2024 -0400 + + check first if array is empty before parsing further + +commit a077ae54ea050af8828813b781738cba24e27624 +Author: Patrick Schleizer +Date: Wed Jul 24 10:56:08 2024 -0400 + + modify call of stat to use NUL delimiter + + for more robust string parsing + +commit 1135d34ab334c9b39e51a147dc94df568f982512 +Author: Raja Grewal +Date: Wed Jul 24 23:33:36 2024 +1000 + + Reword description of `cfi=kcfi` kerenel parameter + +commit 7200e9bd8c793f5ea30c3448fd03fbd38c6292b5 +Author: Patrick Schleizer +Date: Wed Jul 24 09:15:02 2024 -0400 + + output + +commit 1b6161c2dcd9a0686503c84cda4c9f6a29fe4e02 +Merge: d2563ed9 8be21b6e +Author: Patrick Schleizer +Date: Wed Jul 24 09:13:48 2024 -0400 + + Merge remote-tracking branch 'ben-grande/fuzz' + +commit 88c88187f2909322211cc08598717068ea7cf1d1 +Author: Raja Grewal +Date: Wed Jul 24 17:26:50 2024 +1000 + + Re-enable (default) `secure_redirects` for ICMP redirect messages + +commit 8be21b6eff40fdd3909ef63468463fc52e8bf45f +Author: Ben Grande +Date: Tue Jul 23 19:36:12 2024 +0200 + + Handle newlines in file names + +commit aa99de68d307cd88462665424996d9b730ab5087 +Author: Ben Grande +Date: Tue Jul 23 18:46:47 2024 +0200 + + Log output with defined levels + +commit 06fbcdac1de6f1830d911f05a4f7c14fd522fad4 +Author: Ben Grande +Date: Tue Jul 23 09:55:02 2024 +0200 + + Prettify log messages + +commit fb494c2ba5b7fd0f864a59896710d9cddf92b458 +Author: Raja Grewal +Date: Tue Jul 23 13:12:13 2024 +1000 + + Update docs relating to the `cfi=kcfi` kernel parameter + +commit 7ee1ea2cc7dd62feee3243d64b414130e68d35e9 +Author: Ben Grande +Date: Mon Jul 22 17:06:07 2024 +0200 + + Unify functions that evaluate commands + +commit 9c3566f524f748b9f7c98a36b3f2b1064cdba3ed +Author: Ben Grande +Date: Mon Jul 22 16:01:14 2024 +0200 + + Delimit file names with null terminator + +commit d6fc71dba78a9c871015ebdde3bef61943369b47 +Author: Raja Grewal +Date: Mon Jul 22 17:26:00 2024 +1000 + + Add option to switch (back) to using kCFI in the future + +commit f582e543434ba20a2fb7f7300058f7c8a7d62878 +Merge: a189956a d2563ed9 +Author: raja-grewal +Date: Mon Jul 22 15:12:00 2024 +1000 + + Merge branch 'Kicksecure:master' into blacklist_to_disable + +commit d2563ed92317a029340dbb83f30da008b01325f2 +Author: Patrick Schleizer +Date: Sun Jul 21 10:40:14 2024 +0000 + + bumped changelog version + +commit 64f8b2eb5870664fca06aa060f2f50af358ced55 +Author: Patrick Schleizer +Date: Sun Jul 21 06:36:22 2024 -0400 + + Revert "no longer disable Intel ME related kernel modules" + + This reverts commit 6157e328f40a7f3780208489b1ffecef8e6d738a. + + https://www.kicksecure.com/wiki/Out-of-band_Management_Technology#Intel_ME_Kernel_Modules + + https://github.com/Kicksecure/security-misc/issues/239 + +commit 4cae74d610ad37066e8a334019cfa5c82f088a2e +Author: monsieuremre +Date: Sun Jul 21 11:19:32 2024 +0200 + + Update 30_security-misc.conf + +commit 04fb00572f2e4c9bdfaaa0f6da8007999daab641 +Author: Patrick Schleizer +Date: Sat Jul 20 17:02:05 2024 +0000 + + bumped changelog version + +commit f0a478c7c91697988926a73d3a1880dd8caaca68 +Author: Patrick Schleizer +Date: Sat Jul 20 12:57:56 2024 -0400 + + permission hardener: allow postfix + + postqueue matchwhitelist + postdrop matchwhitelist + +commit a189956adc2cf5a1c8311d0e0e9c7cfbc6e4afe3 +Author: Raja Grewal +Date: Sat Jul 20 20:11:09 2024 +1000 + + Typo + +commit 3c720a0715191c858e8d1df9795dddfea5dbdcf1 +Author: Raja Grewal +Date: Sat Jul 20 15:03:21 2024 +1000 + + Disable some legacy drivers + These were all previously blacklisted for over 2 years. + +commit c4965ed838b1df93ddb9e947fb2f0d23fa8ffc17 +Author: Raja Grewal +Date: Sat Jul 20 14:55:10 2024 +1000 + + Disable legacy framebuffer drivers + These were all previously blacklisted for over 2 years. + +commit 9f53a0182b5f6a7cf8228bf19b04661d39c7a2fe +Author: Patrick Schleizer +Date: Fri Jul 19 07:20:59 2024 -0400 + + undo io_uring related changes + + as these should be done in a separate pull request (if apprpriate) + + https://github.com/Kicksecure/security-misc/pull/244#issuecomment-2238889062 + +commit 8791aecb38a41aa0b0c108505726bc6a1ace903e +Merge: 2d114364 06894d1c +Author: Patrick Schleizer +Date: Fri Jul 19 07:19:09 2024 -0400 + + Merge remote-tracking branch 'raja/fixes' + +commit 06894d1c98e91f43af58cc438559ea76b6a361e3 +Author: Raja Grewal +Date: Fri Jul 19 18:30:42 2024 +1000 + + Typo + +commit 2d11436432d3b2b75f84b05550de06cd77ec6e79 +Author: Patrick Schleizer +Date: Thu Jul 18 18:05:07 2024 +0000 + + bumped changelog version + +commit cac5bbad99a9c083c5b5f85f07c7368287c64f72 +Author: Patrick Schleizer +Date: Thu Jul 18 14:04:00 2024 -0400 + + comment + +commit a5eed00eba76f83c310f62d000830f38b0e87d21 +Author: Patrick Schleizer +Date: Thu Jul 18 14:02:38 2024 -0400 + + cleanup comments + +commit 21efacf1b111d9599e72cef23b791cf4961c04c3 +Author: Patrick Schleizer +Date: Thu Jul 18 14:00:28 2024 -0400 + + cleanup duplicate comments which are already in `/etc/dkms/framework.conf` + +commit 61628c2baf58ca2859bc5fc99782985ef0822750 +Author: Patrick Schleizer +Date: Thu Jul 18 14:11:35 2024 +0000 + + bumped changelog version + +commit 05cf438199ca75f96cf8e67131f4a409b465e7e7 +Author: Patrick Schleizer +Date: Thu Jul 18 10:11:03 2024 -0400 + + no comments / copyright allowed in .displace-extension + +commit 2ccc95f6d44bacd3da97d586542695f33d5faf38 +Author: Patrick Schleizer +Date: Thu Jul 18 14:05:23 2024 +0000 + + bumped changelog version + +commit 95286df50274953326accb615487e21d409b652a +Author: Raja Grewal +Date: Thu Jul 18 15:28:31 2024 +1000 + + Update README.md regarding secure ICMP redirects + +commit 13cc1f0986033855a399b50442a86a8d8552eb96 +Author: Raja Grewal +Date: Thu Jul 18 12:25:00 2024 +1000 + + Clarify (future) disabling of `io_uring` + +commit 9e6facda7017498e8310a9c39403e95e81c5a903 +Author: Raja Grewal +Date: Thu Jul 18 12:21:37 2024 +1000 + + Update module disabling presentation + +commit faa9181a6c0c78b9471c9a4e6bdd3291aec704f6 +Author: Raja Grewal +Date: Thu Jul 18 12:19:27 2024 +1000 + + Typos + +commit 6d211faf591608ea6e7f484e8bc69dd567877abf +Author: Raja Grewal +Date: Thu Jul 18 11:04:54 2024 +1000 + + Restrict unprivileged user namespaces + +commit b04828f858fa6d101099773d3156841fd6d33b6f +Author: Raja Grewal +Date: Thu Jul 18 11:01:41 2024 +1000 + + Disable the usage of `ptrace()` by all processes + +commit d454f36c63bd653e47353fb1c93107b2d5584fe2 +Author: Patrick Schleizer +Date: Wed Jul 17 11:52:29 2024 -0400 + + spelling + +commit f4da582aa31b869413aef6f4e252b7985e961339 +Author: Patrick Schleizer +Date: Wed Jul 17 11:44:17 2024 -0400 + + spelling + +commit 9e976474d5d620be9e4f8d8a97f73c6cc3e64573 +Author: Patrick Schleizer +Date: Wed Jul 17 11:40:51 2024 -0400 + + spelling + +commit b569fc02a4650187e69b62b95439c05ee2611e91 +Author: Patrick Schleizer +Date: Wed Jul 17 11:38:53 2024 -0400 + + spelling + +commit a2e26f441b6f44831c7b1bf3bf9dc2cf6f06e176 +Author: Patrick Schleizer +Date: Wed Jul 17 11:04:03 2024 -0400 + + spelling + +commit c8be4ac83c2563798ee35d56200eb8d11a2c32e3 +Author: Patrick Schleizer +Date: Wed Jul 17 10:56:14 2024 -0400 + + comment + +commit 24cd70a014b221b25669755b955bc114fe083643 +Author: Patrick Schleizer +Date: Wed Jul 17 10:55:12 2024 -0400 + + spelling + +commit 5cec685cf9b0845838f17fba78ac65d6c2e63386 +Author: Patrick Schleizer +Date: Wed Jul 17 10:49:21 2024 -0400 + + spelling + +commit 821a416fe39e11ca030c63f25a5220772d80eae5 +Author: Patrick Schleizer +Date: Wed Jul 17 10:43:16 2024 -0400 + + spelling + +commit 9a387f95e9346030e2adc3252a45942949561b52 +Merge: fd41acdc 4afe257a +Author: Patrick Schleizer +Date: Wed Jul 17 10:32:26 2024 -0400 + + Merge remote-tracking branch 'raja/miscellaneous' + +commit fd41acdc721a6463813bc347cb965b6211fb9447 +Merge: 0da22c20 1087387b +Author: Patrick Schleizer +Date: Wed Jul 17 10:27:31 2024 -0400 + + Merge remote-tracking branch 'raja/fack_off' + +commit 4afe257a42576158a54a68948440a2b4c043b67c +Author: Raja Grewal +Date: Thu Jul 18 00:14:13 2024 +1000 + + minor + +commit d0a59617f6b8a90fd5c758699e910af9d7496c98 +Author: Raja Grewal +Date: Thu Jul 18 00:13:30 2024 +1000 + + Add missing Copyright (C) statements + +commit 8f3896c3dac13b604e36d4249f976598f271a215 +Author: Raja Grewal +Date: Wed Jul 17 23:44:37 2024 +1000 + + Upgrade hyperlinks to HTTPS + +commit 1087387b362d5598e44262db07ab0fff9118b064 +Author: Raja Grewal +Date: Wed Jul 17 23:35:25 2024 +1000 + + Remove obsolete `#net.ipv4.tcp_fack=0` + +commit 0da22c20316c8f0f574e0127926506e52ccbc269 +Author: Patrick Schleizer +Date: Wed Jul 17 09:07:31 2024 -0400 + + minor + +commit c336b266f61528cce27e1cafac6377370927a787 +Merge: afe3c25a df803852 +Author: Patrick Schleizer +Date: Wed Jul 17 09:06:44 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit df80385289717fee0266436d056c9aedd0fb06af +Merge: afe3c25a 724435e5 +Author: Patrick Schleizer +Date: Wed Jul 17 09:04:18 2024 -0400 + + Merge pull request #237 from raja-grewal/intel_pmt + + Disable some Intel PMT kernel modules + +commit afe3c25a49940f7f322414c08e8dbd631e696215 +Author: Patrick Schleizer +Date: Wed Jul 17 08:58:00 2024 -0400 + + update readme + + https://github.com/Kicksecure/security-misc/issues/239 + +commit f7772fb85a1fe6d3c0749e5f34fc29111b6a8125 +Author: Patrick Schleizer +Date: Wed Jul 17 08:57:35 2024 -0400 + + minor + +commit 6157e328f40a7f3780208489b1ffecef8e6d738a +Author: Patrick Schleizer +Date: Wed Jul 17 08:52:11 2024 -0400 + + no longer disable Intel ME related kernel modules + + https://github.com/Kicksecure/security-misc/issues/239 + +commit daee8b900b3057235aedc17b1231c3c05599140c +Merge: 954ff1be a4ba6e48 +Author: Patrick Schleizer +Date: Wed Jul 17 08:47:55 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit a4ba6e485d94512fdf737b9f66137c3f692c9904 +Merge: 9a751356 abafb194 +Author: Patrick Schleizer +Date: Wed Jul 17 08:46:27 2024 -0400 + + Merge pull request #236 from raja-grewal/intel_me + + Disable more Intel ME kernel modules + +commit 954ff1be41288b5fa2e50d492d92544915f93bb5 +Merge: d29a6161 9a751356 +Author: Patrick Schleizer +Date: Wed Jul 17 08:42:52 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 9a75135633ad172f7cbf318e1206865493c28bb4 +Merge: d29a6161 a3408990 +Author: Patrick Schleizer +Date: Wed Jul 17 08:41:43 2024 -0400 + + Merge pull request #238 from raja-grewal/uvcvideo_2 + + Minor additions to `30_security-misc_disable.conf` + +commit d29a616142562492db6c45c299f002100e905828 +Author: Patrick Schleizer +Date: Wed Jul 17 08:39:20 2024 -0400 + + minor + +commit a2802f352fc7021ead0d431c665cc16b2821ae0b +Merge: 0b873b76 81a3715c +Author: Patrick Schleizer +Date: Wed Jul 17 08:38:23 2024 -0400 + + Merge remote-tracking branch 'raja/kargs' + +commit 0b873b765e20b06113d808075fa95c8acbb1e0fc +Author: Patrick Schleizer +Date: Wed Jul 17 08:05:27 2024 -0400 + + minor + +commit 070bb46a08afcd84fb638472c39bd543bad4fb17 +Merge: 6d6e5473 25fd532c +Author: Patrick Schleizer +Date: Wed Jul 17 08:02:45 2024 -0400 + + Merge remote-tracking branch 'raja/sysctl' + +commit 6d6e5473f2778a2a5b1ca7826d0a3a5a63cff08a +Author: Patrick Schleizer +Date: Wed Jul 17 08:00:24 2024 -0400 + + minor + +commit cf5f0edbb85589a72ec891e9c3e090f9e81c4fda +Merge: fe5c840b 693b47e6 +Author: Patrick Schleizer +Date: Wed Jul 17 07:59:35 2024 -0400 + + Merge remote-tracking branch 'raja/sysctl' + +commit 25fd532ce62399d5bb42d844ad32b5128eaf748d +Author: Raja Grewal +Date: Wed Jul 17 21:56:40 2024 +1000 + + Update README.md relating to `sysctl`'s + +commit 39fd125eb0f0c16c8a64933bbd04709287a2686a +Author: Raja Grewal +Date: Wed Jul 17 21:44:44 2024 +1000 + + Provide explanation on the disabling of IPv6 Privacy Extensions + +commit a3408990ab439e6edbf8691cf7d65fb16c0d24df +Author: Raja Grewal +Date: Wed Jul 17 15:03:39 2024 +1000 + + Uncomment disabling of already disabled ATM modules + +commit 693b47e6235528ab7a9032818cce22fd63a4f5ea +Author: Raja Grewal +Date: Wed Jul 17 14:58:30 2024 +1000 + + Clarify ICMP redirect acceptance and sending + +commit 81a3715c7c0b73796a62297ebe55e861a46f7686 +Author: Raja Grewal +Date: Wed Jul 17 13:32:08 2024 +1000 + + Add info regarding the downsides of disabling SMT + +commit abafb1945cace774429fefd0c1a037fb2ec3f774 +Author: Raja Grewal +Date: Wed Jul 17 13:26:03 2024 +1000 + + Add Intel ME references + +commit f317aaebab126bafe3cfaef8159bf0820c392c87 +Author: Raja Grewal +Date: Wed Jul 17 01:09:02 2024 +1000 + + Disable two network modules + These were previously blacklisted for two years in https://github.com/Kicksecure/security-misc/commit/61ef9bd59f9ff39c140f782ff5b41d0a3c6d97bc. + +commit d69fe88091c7212a9af86306c797aed40398584b +Author: Raja Grewal +Date: Wed Jul 17 01:08:01 2024 +1000 + + Provide option to disable `uvcvideo` driver + +commit 49594ccb223c09d70f00434e5875c9dae1a2360d +Author: Raja Grewal +Date: Wed Jul 17 00:49:25 2024 +1000 + + Partially revert https://github.com/raja-grewal/security-misc/commit/f4d652fa7b5dd350b577521c6bba22c9eb3c13f1 + +commit 824d9b82e53485eed8eaf24e9815ac07ad0f2406 +Author: Raja Grewal +Date: Wed Jul 17 00:36:18 2024 +1000 + + Uncomment redundant disabling of TCP FACK` + +commit d1119c38b6ad4193919d4b800de0a3cb014f92c1 +Author: Raja Grewal +Date: Wed Jul 17 00:31:23 2024 +1000 + + Apply changes from code review + +commit fe5c840b79c4aabd5c21a286d3ce1a3ee460812c +Author: Patrick Schleizer +Date: Mon Jul 15 21:18:55 2024 +0000 + + bumped changelog version + +commit 6e63fc8985b97902dbae2553ded51950168dc222 +Merge: fe0846c8 b7796a53 +Author: Patrick Schleizer +Date: Mon Jul 15 17:14:25 2024 -0400 + + Merge remote-tracking branch 'ben-grande/fuzz' + +commit fe0846c8c2bdfc0534850b1e9bf9c4130381def9 +Author: Patrick Schleizer +Date: Mon Jul 15 12:30:38 2024 -0400 + + fix + + https://github.com/Kicksecure/security-misc/pull/234#discussion_r1678065395 + +commit 94df2e3d244f5e6e8e4320c1f28cc11dba00dd36 +Author: Patrick Schleizer +Date: Mon Jul 15 12:29:52 2024 -0400 + + further discussion required + + https://github.com/Kicksecure/security-misc/pull/234#issuecomment-2228909249 + +commit 41f0b53dd62d2968a6ff88a6fd907ca42f581847 +Merge: 5ba5a85a 9300c208 +Author: Patrick Schleizer +Date: Mon Jul 15 12:28:03 2024 -0400 + + Merge remote-tracking branch 'raja/kernel_modules' + +commit 73f6d4b26f51f0c920fe020677f464c536d75410 +Author: Raja Grewal +Date: Tue Jul 16 01:03:41 2024 +1000 + + Fix transcription error + +commit 724435e56ea059183241044a4fc09423187533eb +Author: Raja Grewal +Date: Mon Jul 15 22:38:43 2024 +1000 + + Disable some Intel Platform Monitoring Technology Telemetry (PMT) modules + +commit 61941da37509a4bb809212536b79f461a209f584 +Author: Raja Grewal +Date: Mon Jul 15 22:38:09 2024 +1000 + + Create `disabled-intelpmt-by-security-misc` + +commit 22ba7a7c393a8c9005dfe26aea396815a4d54803 +Author: Raja Grewal +Date: Mon Jul 15 22:21:20 2024 +1000 + + Disable more Intel Management Engine (ME) modules + +commit 9300c208e25d936f2c633a0904126566afc1c275 +Author: Raja Grewal +Date: Mon Jul 15 21:36:25 2024 +1000 + + Fix script + +commit f2db11269e89d4c945642b661aa9cbe356f89037 +Author: Raja Grewal +Date: Mon Jul 15 21:18:32 2024 +1000 + + Fix script + +commit 382f1e9ec00ab5f012f028fa324d6cf73040c37d +Author: Raja Grewal +Date: Mon Jul 15 21:13:25 2024 +1000 + + Fix error + +commit a8bc1144c32b4b4f20904af5f813da1051fe4c9c +Author: Raja Grewal +Date: Mon Jul 15 21:10:13 2024 +1000 + + Updated wording of error files for disabled modules + +commit fda3832eaf293915ab77ce73a0be2caec15e21fa +Author: Raja Grewal +Date: Mon Jul 15 21:08:45 2024 +1000 + + Replace bash file presented for disabling of miscellaneous modules + +commit 8219a1e257525d487a49e7b3a6b14c1e180a7b52 +Author: Raja Grewal +Date: Mon Jul 15 21:02:10 2024 +1000 + + Update README.md relating to disabled miscellaneous modules + +commit cb2fb95b81efa2ebb2bd80aeaacad9122f0f073c +Author: Raja Grewal +Date: Mon Jul 15 21:01:36 2024 +1000 + + Disable more miscellaneous drivers + +commit c52b1a3fd269ef4f98028dd5eead476abe5d138d +Author: Raja Grewal +Date: Mon Jul 15 20:58:45 2024 +1000 + + Create `disabled-miscellaneous-by-security-misc` + +commit 96aa63267a6fcee03f252f0791f37b7b6222a7c1 +Author: Raja Grewal +Date: Mon Jul 15 20:57:14 2024 +1000 + + Disable more Thunderbolt modules + +commit 51f7776bc8722752d53fc503b0c79564d8715d4c +Author: Raja Grewal +Date: Mon Jul 15 20:56:12 2024 +1000 + + Disable more network protocols/drivers + +commit 9e40ff055195b1e8637d1e957c3f8db01f99bbc1 +Author: Raja Grewal +Date: Mon Jul 15 20:54:18 2024 +1000 + + Disable more network file systems + +commit 82c5a93f7cf2846490120c5262a146a313a5ce47 +Author: Raja Grewal +Date: Mon Jul 15 20:53:07 2024 +1000 + + Disable another GPS module + +commit 99b0ce7948213e7f7adf42ddd7c7beb229374bd4 +Author: Raja Grewal +Date: Mon Jul 15 20:47:56 2024 +1000 + + Disable more file systems + +commit 4476a477a77c98cf4334fbcb866bc8f113f568ac +Author: Raja Grewal +Date: Mon Jul 15 20:47:07 2024 +1000 + + Provide option to disable more Bluetooth modules + +commit e0696d02a234e6f7ab9fb601ffe58e7d953846a2 +Author: Raja Grewal +Date: Mon Jul 15 20:46:04 2024 +1000 + + Update `security-misc.maintscript` + Due to previous splitting IN https://github.com/Kicksecure/security-misc/commit/b02230a783941da412be72fb52053db0c6b8010f. + +commit b2657bc61fb15bb89d62f0743a36835c1f0dda8a +Author: Raja Grewal +Date: Mon Jul 15 15:05:00 2024 +1000 + + Improve docs + +commit 1c2afc1f253e15d2605d1bef0e323e6e972a2484 +Author: Raja Grewal +Date: Mon Jul 15 15:01:48 2024 +1000 + + Update presentation of the `kernel.printk` sysctl + +commit c8385d82fbd6ba16ba1f0b4969661474966b74f1 +Author: Raja Grewal +Date: Mon Jul 15 14:57:40 2024 +1000 + + Clarify instructions for increasing log verbosity + +commit d229e8b04d914803fa66c3a695022cfb2d9b2a25 +Author: Raja Grewal +Date: Mon Jul 15 14:50:29 2024 +1000 + + Fix link + +commit fbfdb0fa99087e4160979b612db04e63a1d3e3b1 +Author: Raja Grewal +Date: Mon Jul 15 14:40:03 2024 +1000 + + Update `security-misc.maintscript` relating to grub + +commit f4d652fa7b5dd350b577521c6bba22c9eb3c13f1 +Author: Raja Grewal +Date: Mon Jul 15 14:39:12 2024 +1000 + + Update presentation of `quiet loglevel=0` + +commit 69c8e849270393537d3e024137bc20a42c848333 +Author: Raja Grewal +Date: Mon Jul 15 14:38:21 2024 +1000 + + Fix typos + +commit 48e1ac416314d2c66f3a0d5044a3c51cb6fb4093 +Author: Raja Grewal +Date: Mon Jul 15 02:04:25 2024 +1000 + + Remove the optional `slub_debug` parameter since it is no longer recommended + +commit 99038c7a0621f5c9852638c1706c5306b42e6480 +Author: Raja Grewal +Date: Mon Jul 15 02:02:01 2024 +1000 + + Add option to disable support for x86 processes and syscalls in the future + +commit f550fbe07cafb75112e98268730d1bcc511489e2 +Author: Raja Grewal +Date: Mon Jul 15 01:59:04 2024 +1000 + + Add option to disable the entire IPv6 stack functionality + +commit a33d4cd099b8cbf569ff35627eeacf3562a4371e +Author: Raja Grewal +Date: Mon Jul 15 01:56:25 2024 +1000 + + Refactor existing kernel parameters for clarity + +commit acd60e45d8cbc98ea935c9bf035f2840622ab58d +Author: Raja Grewal +Date: Sun Jul 14 20:07:31 2024 +1000 + + Add comment about enabling core dump files + +commit 5cf9afc21563712b851850e2041141807503807c +Author: Raja Grewal +Date: Sun Jul 14 17:05:49 2024 +1000 + + Include optional `sysctl`'s in README.md + +commit 2b9e174c9db69f2c30828aae236c631d46255e07 +Author: Raja Grewal +Date: Sun Jul 14 16:22:52 2024 +1000 + + Remove empty lines + +commit dd1741c4a1cd18f34f69437c00f3a78a9ebd402a +Author: Raja Grewal +Date: Sun Jul 14 13:40:53 2024 +1000 + + Some documentation additions and fixes + +commit 565597c9a282b08697d04204f5eb9c22153e77bd +Author: Raja Grewal +Date: Sun Jul 14 01:21:24 2024 +1000 + + Minor documentation changes and fixes + +commit 5ba5a85ad09b74a29c5ed0e5c265d54d93da9d32 +Author: Patrick Schleizer +Date: Sat Jul 13 15:01:16 2024 +0000 + + bumped changelog version + +commit ad860063aba0443a8ac8b9cf191d008617d6d904 +Merge: f34b9d7c 9f582665 +Author: Patrick Schleizer +Date: Sat Jul 13 10:55:45 2024 -0400 + + Merge remote-tracking branch 'raja/modprobe' + +commit 9f582665467fd4fdf20c83841305785024bceedf +Author: Raja Grewal +Date: Sat Jul 13 23:32:01 2024 +1000 + + Move nf_conntrack_helper disabling into separate file + +commit 8f2ec75f8173b6ab970a5ef213dcf5a3f67aa84a +Author: Raja Grewal +Date: Sat Jul 13 23:30:55 2024 +1000 + + Clarify README.mmd relating to module disabling + +commit 98580bb39a495a141e7b40792fd9d232fcf29d23 +Author: Raja Grewal +Date: Sat Jul 13 23:29:52 2024 +1000 + + Update modprobe presentation + +commit 2de3a795990234134be15be90aa55f547c064d92 +Author: Raja Grewal +Date: Sat Jul 13 22:41:40 2024 +1000 + + Refactor existing sysctl for clarity + +commit f34b9d7c45cd723535eedd3df99896ee7f852388 +Merge: 05c1711b 5f10cc8b +Author: Patrick Schleizer +Date: Sat Jul 13 06:14:43 2024 -0400 + + Merge remote-tracking branch 'raja/modules' + +commit 5f10cc8bcf11654f5e0f97c07e0a7ff198013c1e +Author: Raja Grewal +Date: Fri Jul 12 16:22:10 2024 +1000 + + Update README.md relating to modprobe + +commit 41a3bf92fbdac88a1884dee735600cafa35134bf +Author: Raja Grewal +Date: Fri Jul 12 16:21:41 2024 +1000 + + Sort `30_security-misc_disable.conf` + +commit f31dc8aebc652b2037c375351fc478d9b5ba4c27 +Author: Raja Grewal +Date: Fri Jul 12 16:21:03 2024 +1000 + + Fix error in error script + +commit b02230a783941da412be72fb52053db0c6b8010f +Author: Raja Grewal +Date: Fri Jul 12 02:42:37 2024 +1000 + + Split modprobe into blacklisted and disabled configurations + +commit fc792ff23234399ed299c3fdc086d47c87d9b4a3 +Author: Raja Grewal +Date: Fri Jul 12 02:29:36 2024 +1000 + + Alphabetically sort existing modprobe + +commit fe20f3240e2f31099bcaa9f9e2045320df810edf +Author: Raja Grewal +Date: Fri Jul 12 02:28:48 2024 +1000 + + Refactor existing modprobe for clarity + +commit 275a4ffc1114856cbd9a1cd49701dcb25d87bfb5 +Author: Raja Grewal +Date: Fri Jul 12 02:27:56 2024 +1000 + + Remove redundant disabled modules + +commit b7796a5334075d5fa538d7579003fde6287d7e6d +Author: Ben Grande +Date: Thu Jul 11 11:04:22 2024 +0200 + + Unify method to find SUID files + +commit 05c1711b16c96a221c13a011a6666fe6b385ec1e +Author: Patrick Schleizer +Date: Tue Jun 11 12:56:56 2024 +0000 + + bumped changelog version + +commit e48115588caae8e51bb980ac84b1f0f415ca0d17 +Merge: b316352e cad8d857 +Author: Patrick Schleizer +Date: Tue Jun 11 07:25:47 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit cad8d857556e29544f742fdac8fe82758a4f885c +Merge: b316352e e1984478 +Author: Patrick Schleizer +Date: Tue Jun 11 07:25:07 2024 -0400 + + Merge pull request #227 from 3uryd1ce/fix-pam.d-path + + fix(etc): delete typo in /etc/apparmor.d tunables + +commit e1984478662fc51e6eacc989bc6bba0ca1fc07cd +Author: Ashlen +Date: Sat Jun 8 22:17:05 2024 -0600 + + fix(etc): delete typo in /etc/apparmor.d tunables + + /etc/pam.d was present twice in a row ("/etc/pam.d//etc/pam.d") in this + file: /etc/apparmor.d/tunables/home.d/security-misc. + +commit b316352ede379d96cff4813735b93eb59506fe42 +Author: Patrick Schleizer +Date: Sat Jun 1 18:13:08 2024 +0000 + + bumped changelog version + +commit c815304026d30f7774f804498d20431ccdf8dc7f +Author: Patrick Schleizer +Date: Sat Jun 1 14:12:57 2024 -0400 + + readme + +commit 641e98e57714f7d38962bfd12d673500b8114356 +Author: Patrick Schleizer +Date: Sat Jun 1 17:35:04 2024 +0000 + + bumped changelog version + +commit e0cd9579d64e6d16667832de51f77a3091ef213e +Author: Patrick Schleizer +Date: Sat Jun 1 13:32:13 2024 -0400 + + remove duplicate `fsckobjects = true` from `/etc/gitconfig` + +commit bbe64a0b7992610dfef6002271718a2aee115cae +Author: Patrick Schleizer +Date: Tue May 28 12:04:53 2024 +0000 + + bumped changelog version + +commit ae24a97d4d0ffcfb3d1cc92edb61e7ecf4535ee7 +Merge: bfca98ea a7358578 +Author: Patrick Schleizer +Date: Tue May 28 08:02:21 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit a7358578520294b51e1001199670a0bbeeb43eb1 +Merge: bfca98ea 4efa293f +Author: Patrick Schleizer +Date: Tue May 28 07:55:31 2024 -0400 + + Merge pull request #226 from Kicksecure/gitconfig + + add `/etc/gitconfig` by default for better `git` security + +commit 4efa293f3b76814bc5399a959482d7db6e7431ec +Author: Patrick Schleizer +Date: Tue May 28 07:51:06 2024 -0400 + + add `/etc/gitconfig` by default for better `git` security + + ``` + [core] + symlinks = false + + [transfer] + fsckobjects = true + fsckobjects = true + [fetch] + fsckobjects = true + fsckobjects = true + [receive] + fsckobjects = true + fsckobjects = true + ``` + + + additional suggestions as comments + + fixes https://github.com/Kicksecure/security-misc/issues/225 + +commit bfca98ea89cea0f8604ecca0c8640860320e8e33 +Author: Patrick Schleizer +Date: Sat May 18 20:45:12 2024 +0000 + + bumped changelog version + +commit eb82884fb2e3d3bb4fa5555d8212146042ba8aa4 +Merge: 5867b1b0 12e006ef +Author: Patrick Schleizer +Date: Sat May 18 16:42:41 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 12e006ef9cabbbcbe9cb45d9a6631e9a7a47cf3a +Merge: 5867b1b0 2f716050 +Author: Patrick Schleizer +Date: Sat May 18 16:30:07 2024 -0400 + + Merge pull request #222 from raja-grewal/text + + Update Readme and Copyright + +commit 2f716050d17016be6f550a7de8e0c1030e869e8f +Author: raja-grewal +Date: Sun May 12 01:06:34 2024 +0000 + + Update README.md + +commit 1bb843ec3863696170242c57668d0b3f44f41d7b +Author: Raja Grewal +Date: Sat May 11 13:18:36 2024 +1000 + + Update Copyright (C) to 2024 + +commit dddac1dc4015a28fc6b12244809685295272edd1 +Author: Raja Grewal +Date: Sat May 11 13:15:42 2024 +1000 + + Update README.md + +commit 5867b1b014f450acdf70c203ffe2f27831f1d9b0 +Author: Patrick Schleizer +Date: Fri May 10 11:20:36 2024 +0000 + + bumped changelog version + +commit 9b589bc3116c8f9d6d574021bcec7b5dec3888b8 +Author: Patrick Schleizer +Date: Fri May 10 06:49:34 2024 -0400 + + comment + +commit 8d01fc2d351285c9c2f810bf5cf10797c9b9eb41 +Author: Patrick Schleizer +Date: Fri May 10 06:48:26 2024 -0400 + + chmod +x + +commit 8a28c1bc38b87bf55f25764c96a0e81e22137232 +Merge: a9886a31 0f1119f3 +Author: Patrick Schleizer +Date: Fri May 10 06:48:04 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0f1119f326cd769db8995e8eb54ff35503c70562 +Merge: 547757f4 677f75ae +Author: Patrick Schleizer +Date: Fri May 10 06:45:57 2024 -0400 + + Merge pull request #221 from raja-grewal/firewire + + Disable Firewire Module + +commit 547757f4514a54437d044656c5e2b6d413a4cc30 +Merge: 7b9fe44a 06f13bb7 +Author: Patrick Schleizer +Date: Fri May 10 06:45:34 2024 -0400 + + Merge pull request #220 from raja-grewal/block_gps + + Block Several GPS-related Modules + +commit 7b9fe44a20f3caf67f386969a5fc7c980e5f0282 +Merge: 62ea4dc1 132b41ae +Author: Patrick Schleizer +Date: Fri May 10 06:43:43 2024 -0400 + + Merge pull request #219 from raja-grewal/logging_martians + + Revert Logging of Martians + +commit 62ea4dc1768f69bb28a69c20e55c87ae692cc0c8 +Merge: a9886a31 4694268b +Author: Patrick Schleizer +Date: Fri May 10 06:43:15 2024 -0400 + + Merge pull request #218 from raja-grewal/secure_cpu + + More CPU Mitigations and Additional References + +commit 677f75ae8ed64af599f837ced15f34990df498e5 +Author: raja-grewal +Date: Thu May 9 02:34:02 2024 +0000 + + Disable `firewire-net` module + +commit 06f13bb766bd84182331aeb1632b917de4b36020 +Author: raja-grewal +Date: Thu May 9 02:28:53 2024 +0000 + + Disable GPS modules like GNSS + +commit f3800a4e2b7bef87cc3bd8791f9e7f654f8d782a +Author: raja-grewal +Date: Thu May 9 02:25:46 2024 +0000 + + Create disabled-gps-by-security-misc + +commit 132b41ae73e9ea72bc3d8aff22ae75fc622758a3 +Author: raja-grewal +Date: Thu May 9 02:16:50 2024 +0000 + + Revert logging of martians + +commit 4694268b8f779c1a0a56546dc6d12bf9f23a7cdd +Author: raja-grewal +Date: Sun May 5 12:52:51 2024 +0000 + + Remove a word + +commit 8f7768ce96e32e3f1ec52118afffc2a44a160976 +Author: raja-grewal +Date: Sun May 5 12:50:39 2024 +0000 + + Add vendor links + +commit 0c031a29d33d13d9106746d61b87f9d98a80b5cd +Author: raja-grewal +Date: Wed May 1 13:55:09 2024 +1000 + + RFDS mitigation on Intel Atom CPUs (including E-cores) + +commit 1122b3402c0856a087415d7ba1a313048b7e3eea +Author: raja-grewal +Date: Wed May 1 13:50:42 2024 +1000 + + GDS mitigation for CPUs + +commit c002bd62e8584a19e73b3f42673a3f9bafba6a2c +Author: raja-grewal +Date: Wed May 1 13:49:34 2024 +1000 + + Clarify use of `mitigations=auto` + +commit d89d7e8ef8ee3fd45456e82e8f649f7f28c93e80 +Author: raja-grewal +Date: Wed May 1 13:49:00 2024 +1000 + + Add reference for RETBleed + +commit 015dcc4212736417a2202ea0e0a92e5c2e58d6a5 +Author: raja-grewal +Date: Wed May 1 13:48:13 2024 +1000 + + Add reference for SSB + +commit de4f4be94762c9751ea62f744d7d6ede3ef30e88 +Author: raja-grewal +Date: Wed May 1 13:47:40 2024 +1000 + + Merge spectre mitigations + +commit 965c8641fd28e0ee592b50605edb7494fe9c3a28 +Author: raja-grewal +Date: Wed May 1 13:47:02 2024 +1000 + + Update BHI mitigation reference + +commit a9886a3119f9b662b15fc26d28a7fedf316b72c4 +Author: Patrick Schleizer +Date: Fri Apr 12 06:56:39 2024 +0000 + + bumped changelog version + +commit 5cbdf3c1262d26ae03b28baee87b1d268329da40 +Merge: 7fba04d1 ab8b6da4 +Author: Patrick Schleizer +Date: Fri Apr 12 02:54:17 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit ab8b6da484a90e9a62f8ba515c757aa3758baf48 +Merge: 7fba04d1 49357683 +Author: Patrick Schleizer +Date: Fri Apr 12 02:53:08 2024 -0400 + + Merge pull request #216 from raja-grewal/spectre_bhi + + BHI mitigation on Intel CPUs + +commit 493576836c90653f9c3514fcd5b3bf816e56d689 +Author: raja-grewal +Date: Fri Apr 12 00:17:06 2024 +1000 + + BHI mitigation on Intel CPUs + +commit 7fba04d1485187fe648f3d3ab44cd834b0eb9791 +Author: Patrick Schleizer +Date: Mon Apr 1 06:56:45 2024 +0000 + + bumped changelog version + +commit 7dba3fb7bebd4fdc7f168df378c2d505971f2c04 +Author: Patrick Schleizer +Date: Mon Apr 1 02:55:59 2024 -0400 + + no longer disable MSR by default + + fixes https://github.com/Kicksecure/security-misc/issues/215 + +commit d9ac01ba5c26f9730feb17fe573d447e625e59f8 +Author: Patrick Schleizer +Date: Mon Mar 18 15:10:10 2024 +0000 + + bumped changelog version + +commit ecaa024f226f4f45ac9d2a4f38bcdb82a6e35a2f +Author: Patrick Schleizer +Date: Mon Mar 18 11:01:56 2024 -0400 + + lower debugging + +commit 357ea5deab85debb9dff5d9e4e80a972954249c8 +Author: Patrick Schleizer +Date: Mon Mar 11 15:07:50 2024 +0000 + + bumped changelog version + +commit 0a018bdebca167d671d8bda81a2b0d929d396945 +Merge: 57fc487e 0b813163 +Author: Patrick Schleizer +Date: Mon Mar 11 10:13:57 2024 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 0b8131630041dbd80f1aa61dcedde446208c06f7 +Merge: 57fc487e 03ed546c +Author: Patrick Schleizer +Date: Mon Mar 11 10:12:46 2024 -0400 + + Merge pull request #211 from wryMitts/patch-1 + + Create proc group on install + +commit 03ed546cd8992b29855ca1c2748ed988dd3c765d +Author: wryMitts <158655396+wryMitts@users.noreply.github.com> +Date: Sun Mar 10 16:55:10 2024 -0400 + + Create proc group on install + + Fixes https://github.com/Kicksecure/security-misc/issues/210 + +commit 57fc487e5e5ffad765f1418236744319cc666871 +Author: Patrick Schleizer +Date: Sun Mar 10 13:19:26 2024 +0000 + + bumped changelog version + +commit a5206bde336c159be065345e7dd5cb86b2b6a27f +Author: Patrick Schleizer +Date: Sun Mar 10 08:44:53 2024 -0400 + + `proc-hidepid.service` add `gid=proc` + + This allows users that are a member of the `proc` group to be excluded from `hidepid` protections. + + https://github.com/Kicksecure/security-misc/issues/208 + +commit 0f0d9ca2a42cf9fc04e405ae90f3d67bc0794e12 +Author: Patrick Schleizer +Date: Mon Mar 4 11:48:30 2024 +0000 + + bumped changelog version + +commit 6b76373395622bac0e701c6d15c6656658febced +Author: Patrick Schleizer +Date: Mon Mar 4 06:44:26 2024 -0500 + + fix panic-on-oops started every 10s in Qubes-Whonix + + by changing from a /etc/profile.d etc. related mechanism to start to a systemd unit file based approach + + Thanks to @marmarek for the bug report! + + https://forums.whonix.org/t/panic-on-oops-started-every-10s/19450 + +commit af6c6971a741c69a584ba3f92dbfed12e40784dc +Author: Patrick Schleizer +Date: Mon Mar 4 06:33:51 2024 -0500 + + comment + +commit e013070e0bfc43d006e09ae1c5ae3533f7bebc5f +Author: Patrick Schleizer +Date: Mon Mar 4 06:33:21 2024 -0500 + + newline + +commit a5cc1774f2fbf6475e7b56601fbcd84a2a63fed0 +Author: Patrick Schleizer +Date: Mon Feb 26 13:32:44 2024 +0000 + + bumped changelog version + +commit 808e72f24bf30b3476ab6b87f96eb636632c195c +Author: Patrick Schleizer +Date: Mon Feb 26 08:11:26 2024 -0500 + + use long options + + https://github.com/Kicksecure/security-misc/issues/172 + +commit 2d1d1b246f3fe061d4f817da5cecf46010839e1d +Author: Patrick Schleizer +Date: Mon Feb 26 08:07:29 2024 -0500 + + improve output + + https://github.com/Kicksecure/security-misc/issues/172 + +commit d8f5376c4f36f5deb734e6dead42a62566d13480 +Author: Patrick Schleizer +Date: Mon Feb 26 07:58:06 2024 -0500 + + improve output + + https://github.com/Kicksecure/security-misc/issues/172 + +commit cf84762a3a84d2be3b9510dddb32bdc433170dfa +Author: Patrick Schleizer +Date: Mon Feb 26 07:52:41 2024 -0500 + + improve output + + https://github.com/Kicksecure/security-misc/issues/172 + +commit f2958bbfa5e67ee10380a25d996826233469080a +Author: Patrick Schleizer +Date: Mon Feb 26 07:49:30 2024 -0500 + + comment + +commit bc8f9edc3197e33e75ea1d691834d9abbdcdefd0 +Merge: 02d6f677 b23d1673 +Author: Patrick Schleizer +Date: Mon Feb 26 07:48:19 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit b23d167342ef242a1e9d4e91b6a4b945e80c3e7e +Merge: 02d6f677 ef44ecea +Author: Patrick Schleizer +Date: Mon Feb 26 07:46:02 2024 -0500 + + Merge pull request #204 from DanWin/sysfs-mount + + Make /sys hardening optional and allow access to /sys/fs to make polkit work + +commit 02d6f67741ef93d9ab39e02ac56b27c551a19dca +Author: Patrick Schleizer +Date: Thu Feb 22 20:08:17 2024 +0000 + + bumped changelog version + +commit d13d1aa7ec7e9ac9f1aa87e4b36228bfd3af6eb2 +Author: Patrick Schleizer +Date: Thu Feb 22 15:07:53 2024 -0500 + + comments + +commit a1f898e3b317f49a5bb9507c8b9d3bd3c4e23abf +Author: Patrick Schleizer +Date: Thu Feb 22 19:58:01 2024 +0000 + + bumped changelog version + +commit c3dd178b19be8c078ed6a2f46a072bef3d144c06 +Author: Patrick Schleizer +Date: Thu Feb 22 14:57:50 2024 -0500 + + output + +commit ef44ecea44ee516b1ba92175eb78b2e8143c4502 +Author: Daniel Winzen +Date: Thu Feb 22 16:51:23 2024 +0100 + + Add option to disabe /sys hardening + +commit 3bc1765dbbd333a1d607ab6962281b4d0a5c4b60 +Author: Daniel Winzen +Date: Wed Feb 21 20:37:34 2024 +0100 + + Allow access to /sys/fs for polkit + +commit 6b73e6c2a9ff1efe211e41e005e4ecaa63731d82 +Author: Patrick Schleizer +Date: Thu Feb 22 16:07:16 2024 +0000 + + bumped changelog version + +commit 37a7abdf0c1e6d8179bd09d3c1bd0363e8bc0a96 +Author: Patrick Schleizer +Date: Thu Feb 22 11:07:01 2024 -0500 + + ConditionKernelCommandLine=!remountsecure=0 + +commit eb3e0b9292f71a5dba312500508f893779fb1b9c +Author: Patrick Schleizer +Date: Thu Feb 22 14:52:55 2024 +0000 + + bumped changelog version + +commit c0924321b84874ae7fc72c59fd58e4c4ae8bc6d9 +Author: Patrick Schleizer +Date: Thu Feb 22 09:52:36 2024 -0500 + + fix systemd unit ExecStart + +commit d148a769b7106831c0b27a7ad63d91ab42257678 +Author: Patrick Schleizer +Date: Thu Feb 22 14:50:05 2024 +0000 + + bumped changelog version + +commit 6d7cf3c12a8a772fee1cd893d5504767690b3b77 +Author: Patrick Schleizer +Date: Thu Feb 22 09:49:48 2024 -0500 + + output + +commit f7831db197b2fff33b66eeb44efd749e482315e0 +Author: Patrick Schleizer +Date: Thu Feb 22 09:17:41 2024 -0500 + + do not exit non-zero if folder does not exist + +commit 5bdd7b8475bdfde8dbee5318fb43d0c2a236e3b0 +Author: Patrick Schleizer +Date: Thu Feb 22 09:14:52 2024 -0500 + + output + +commit 44a15cd97da3066e39d2d7df1f456e703036a6e9 +Author: Patrick Schleizer +Date: Thu Feb 22 09:13:56 2024 -0500 + + mount --make-private + + https://github.com/Kicksecure/security-misc/issues/172 + +commit c0f98b05b609c7c8ac6f86e123af9e0642d82697 +Author: Patrick Schleizer +Date: Thu Feb 22 06:03:59 2024 -0500 + + comment + + https://github.com/Kicksecure/security-misc/pull/202 + +commit 1e1613aa93dca1e7fe7f24dbd32028a0cadd21fd +Author: Patrick Schleizer +Date: Thu Feb 22 06:02:28 2024 -0500 + + allow /opt exec as usually optional binaries are placed there such as firefox + + https://github.com/Kicksecure/security-misc/pull/202 + +commit 7c7b4b24b4959f3ef96ff7ef0b11fa4c0bd48c8e +Author: Patrick Schleizer +Date: Thu Feb 22 06:01:00 2024 -0500 + + fix home_noexec_maybe -> most_noexec_maybe + + https://github.com/Kicksecure/security-misc/pull/202 + +commit 38783faf60b85c4e855bf78c87e1c07765776b50 +Author: Patrick Schleizer +Date: Thu Feb 22 05:58:53 2024 -0500 + + add more bind mounts of mount options hardening + + as suggested in https://github.com/Kicksecure/security-misc/pull/202 + +commit ad9d913902d7e696f1114da74d84f9cdcb22bc25 +Author: Patrick Schleizer +Date: Sat Feb 3 18:28:27 2024 +0000 + + bumped changelog version + +commit 02090da08cfd411314ffeeb6df95f73c701f06c6 +Merge: 8037ce52 ba13657d +Author: Patrick Schleizer +Date: Sat Feb 3 12:51:07 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit ba13657d894f2f30d8deb7c08b85e5fbc1dcea21 +Merge: 8037ce52 b16c99ab +Author: Patrick Schleizer +Date: Sat Feb 3 12:50:28 2024 -0500 + + Merge pull request #197 from raja-grewal/mitigations + + Additional Explicit CPU Mitigations + +commit b16c99ab62a902b1f61b9d4fe63273cd614e757c +Author: raja-grewal +Date: Mon Jan 29 13:39:40 2024 +0000 + + Remove hardcoded `spec_rstack_overflow` setting + +commit 139b10a9aad85018f87bdc4bb227e938f7955235 +Author: raja-grewal +Date: Mon Jan 29 12:59:13 2024 +0000 + + Control RAS overflow mitigation on AMD Zen CPUs + +commit 6c54e35027e86ec045102cd1d95f84aa30bc55c9 +Author: raja-grewal +Date: Mon Jan 29 12:58:51 2024 +0000 + + Enable mitigations for RETBleed vulnerability and disable SMT + +commit 4509a5fc95204080f2855849d22c7e05393455d9 +Author: raja-grewal +Date: Mon Jan 29 12:58:14 2024 +0000 + + Enable known mitigations for CPU vulnerabilities and disable SMT + +commit 4231155efa0970d2456b67cc89c8828b0766cf7f +Author: raja-grewal +Date: Mon Jan 29 12:57:48 2024 +0000 + + Add reference for kernel parameters + +commit 8037ce52f96dcc6f8007c1567daf38ff013352d6 +Author: Patrick Schleizer +Date: Thu Jan 25 13:59:29 2024 +0000 + + bumped changelog version + +commit 185bfe749787a8c6e93103ae8c6b0751a169e276 +Author: Patrick Schleizer +Date: Thu Jan 25 06:54:36 2024 -0500 + + use `interest-noawait` instead of `interest-await` + + fixes https://github.com/Kicksecure/security-misc/issues/196 + +commit 64e41b113cae893d1f27f441f99340389ba8b9b3 +Author: Patrick Schleizer +Date: Thu Jan 18 14:10:51 2024 +0000 + + bumped changelog version + +commit 1855fa08b1386b1ea8697767104e7ad0f1521c9c +Author: Patrick Schleizer +Date: Thu Jan 18 08:54:39 2024 -0500 + + readme + +commit f0e2a82b558f64611f037424c6f8f12de32737f6 +Author: Patrick Schleizer +Date: Wed Jan 17 19:18:25 2024 +0000 + + bumped changelog version + +commit 314e5b490c6864b745fbf5fd6d9bb2c724d478b8 +Author: Patrick Schleizer +Date: Wed Jan 17 14:03:09 2024 -0500 + + use wildcards + + instead of outdated, incomplete list + + https://github.com/Kicksecure/security-misc/issues/160 + +commit 08619d6a7307b6ab05a3ba7e71ea33b00db20b27 +Author: Patrick Schleizer +Date: Wed Jan 17 13:59:36 2024 -0500 + + minor RPM updates + + https://github.com/Kicksecure/security-misc/issues/160 + +commit 3048e0ac76e4eba1c53b43ba2424157505578cdd +Author: Patrick Schleizer +Date: Wed Jan 17 13:54:07 2024 -0500 + + usrmerge + + https://github.com/Kicksecure/security-misc/issues/190 + +commit 5a6cd4c2abd243c91575e9477a921aa290c68ba5 +Author: Patrick Schleizer +Date: Wed Jan 17 13:51:30 2024 -0500 + + remove now empty /bin from copying since it is empty after usrmerge + + https://github.com/Kicksecure/security-misc/issues/190 + +commit 071b984a1eaaa8a8ea6a40e4ee36eabcde2d630d +Author: Patrick Schleizer +Date: Wed Jan 17 13:49:05 2024 -0500 + + `sort -d` + + https://github.com/Kicksecure/security-misc/issues/190 + +commit 011e55e3e52485ccd728b4bb249efbc816f38806 +Author: Patrick Schleizer +Date: Wed Jan 17 13:45:17 2024 -0500 + + remove duplicates after usrmerge + + https://github.com/Kicksecure/security-misc/issues/190 + +commit 0efee2f50fd38feade7700c2f033cc3d4c200d34 +Author: Patrick Schleizer +Date: Wed Jan 17 13:39:56 2024 -0500 + + usrmerge + + fixes https://github.com/Kicksecure/security-misc/issues/190 + +commit 18a06935e0cca3dc090643aad406d861e4583085 +Author: Patrick Schleizer +Date: Wed Jan 17 13:23:20 2024 -0500 + + run permission hardener when new packages are install files to /usr or /opt + + (basically anywhere) + + fixes https://github.com/Kicksecure/security-misc/issues/189 + +commit 66e6371221c3395a0523e30e8ef1a051d3e6cdd0 +Author: Patrick Schleizer +Date: Tue Jan 16 14:26:34 2024 +0000 + + bumped changelog version + +commit 0d78ecaee37536379ad2f230f45904f57425cb19 +Author: Patrick Schleizer +Date: Tue Jan 16 09:26:21 2024 -0500 + + README + +commit 3ba8fe586e1abe133bd41076278f8663aba7e641 +Author: Patrick Schleizer +Date: Tue Jan 16 09:23:54 2024 -0500 + + update permission-hardener.service + + Which is now only an additional opt-in systemd unit, + because permission-hardener is run by default at security-misc + package installation time. + + https://github.com/Kicksecure/security-misc/pull/181 + +commit 186f6015da7b3314c95c2833032c6fe953a71afd +Author: Patrick Schleizer +Date: Tue Jan 16 14:14:18 2024 +0000 + + bumped changelog version + +commit 6aa55698ab2a0f3771d28293d7ad14da2763a16f +Author: Patrick Schleizer +Date: Tue Jan 16 09:10:59 2024 -0500 + + delete legacy folder /etc/permission-hardening.d if empty + + https://github.com/Kicksecure/security-misc/pull/181 + +commit 9cafd78fe21baa3c2a36853f57e0638b2facfe5c +Author: Patrick Schleizer +Date: Tue Jan 16 09:05:09 2024 -0500 + + rm_conffile /etc/permission-hardening.d + + https://github.com/Kicksecure/security-misc/pull/181 + +commit fa53848b5cda135fbb8a3855e8508692084fc7e9 +Author: Patrick Schleizer +Date: Tue Jan 16 13:58:55 2024 +0000 + + bumped changelog version + +commit 4f7973bc5628cdc24f5224bd98858249307635d3 +Author: Patrick Schleizer +Date: Tue Jan 16 08:56:26 2024 -0500 + + comment + +commit ed7c09fc46b26440439adf748f597da277a3f1e4 +Author: Patrick Schleizer +Date: Tue Jan 16 08:45:13 2024 -0500 + + permission-hardening -> permission-hardener migration + + mv --verbose /var/lib/permission-hardening /var/lib/permission-hardener + + https://github.com/Kicksecure/security-misc/pull/181 + +commit a90cd43631216f28a18a1b3f066b9f6ef3301ac4 +Author: Patrick Schleizer +Date: Tue Jan 16 08:32:52 2024 -0500 + + fix postinst for new permission-hardener + + https://github.com/Kicksecure/security-misc/pull/181 + +commit 862bf6b5ab29917138325023eb3507f5fbd5653c +Merge: dc8d9eec bc02c720 +Author: Patrick Schleizer +Date: Tue Jan 16 08:19:28 2024 -0500 + + Merge remote-tracking branch 'ben-grande/clean' + +commit dc8d9eece32dec06e63c580c886a240019b3f33e +Author: Patrick Schleizer +Date: Tue Jan 9 05:52:49 2024 +0000 + + bumped changelog version + +commit 1199871d7bbc7316a7e5822d77eee0666b55b203 +Author: Patrick Schleizer +Date: Sun Jan 7 06:37:34 2024 -0500 + + undo IPv6 privacy due to potential server issues + + https://github.com/Kicksecure/security-misc/issues/184 + +commit 128bb01b35d20e97351dfb53768f35482f9756a2 +Author: Patrick Schleizer +Date: Sun Jan 7 06:36:25 2024 -0500 + + undo IPv6 privacy due to potential server issues + + https://github.com/Kicksecure/security-misc/issues/184 + +commit df0f9d3267644c4aea87add2dcade86044c496f0 +Author: Patrick Schleizer +Date: Sat Jan 6 09:19:57 2024 -0500 + + README + +commit 86f91e3030ef0b08000fc28a3a172e6a47918e4e +Author: Patrick Schleizer +Date: Sat Jan 6 09:10:45 2024 -0500 + + revert umask 027 by default + + because broken because this also happens for root while it should not + + https://github.com/Kicksecure/security-misc/issues/185 + +commit 3f1304403fbf04f15dac01963c66f82cd84452d4 +Author: Patrick Schleizer +Date: Sat Jan 6 08:15:31 2024 -0500 + + disable MAC randomization in Network Manager (NM) because it breaks VirtualBox DHCP + + https://github.com/Kicksecure/security-misc/issues/184 + +commit e8f8dcd0fb1c23a62974849f55516da9dce5948e +Author: Patrick Schleizer +Date: Thu Jan 4 02:03:26 2024 +0000 + + bumped changelog version + +commit 70a86fa994c0a894643e876fc86226ad0443a741 +Merge: db0503e7 71060f1f +Author: Patrick Schleizer +Date: Wed Jan 3 05:12:48 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 71060f1f53ca7a275f10c4b6ab3e6c25585d5440 +Merge: db0503e7 74afcc9c +Author: Patrick Schleizer +Date: Wed Jan 3 05:00:41 2024 -0500 + + Merge pull request #182 from raja-grewal/io_uring + + Clarify validity of disabling io_uring + +commit 74afcc9c63ad064f20778ad2870690925c3cee81 +Author: Raja Grewal +Date: Wed Jan 3 17:52:23 2024 +1100 + + Clarify validity of disabling io_uring + +commit bc02c72018d6458d4c1852dd441287b277421514 +Author: Ben Grande +Date: Tue Jan 2 17:08:45 2024 +0100 + + Fix unbound variable + + - Run messages preceded by INFO; + - Comment unknown unused variables; + - Remove unnecessary variables; and + - Deal with unbound variable due to subshell by writing to a file; + +commit db0503e71d5c37865cbb0a01cb8fa00af2a4e574 +Author: Patrick Schleizer +Date: Tue Jan 2 14:55:13 2024 +0000 + + bumped changelog version + +commit abf72c2ee4286ec069f75e66acf05a42f3645c89 +Author: Ben Grande +Date: Tue Jan 2 13:34:29 2024 +0100 + + Rename file permission hardening script + + Hardener as the script is the agent that is hardening the file + permissions. + +commit f138cf0f78c03e3952801d01d25d5f8065ff1457 +Author: Ben Grande +Date: Tue Jan 2 12:17:16 2024 +0100 + + Refactor permission-hardener + + - Organize comments from default configuration; + - Apply and undo changes from a single file controlled by parameters; + - Arrays should be evaluated as arrays and not normal variables; + - Quote variables; + - Brackets around variables; + - Standardize test cases to "test" command; + - Test against empty or non-empty variables with "-z" and "-n"; + - Show a usage message when necessary; + - Require root to run the script with informative message; + - Permit the user to see the help message without running as root; + - Do not create root directories without passing root check; + - Use long options for "set" command; + +commit a94f2a3f4626a9292660bc7f98a6513f34d0f5b2 +Merge: 94c0e26a 8daf97ab +Author: Patrick Schleizer +Date: Tue Jan 2 05:30:49 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 8daf97ab0181a9cbb9e9dec57f1f00270dbb3a50 +Merge: 94c0e26a f055fe5d +Author: Patrick Schleizer +Date: Tue Jan 2 05:29:35 2024 -0500 + + Merge pull request #178 from raja-grewal/io_uring + + Disable asynchronous I/O + +commit 94c0e26a082f61f71e89b1fb7386a58166ffa411 +Author: Patrick Schleizer +Date: Fri Dec 29 20:15:50 2023 +0000 + + bumped changelog version + +commit 5b36599c0ce35857239c82459828db1ec4215411 +Author: Patrick Schleizer +Date: Fri Dec 29 14:57:38 2023 -0500 + + /dev/, /dev/shm, /tmp + + https://github.com/Kicksecure/security-misc/issues/157#issuecomment-1869073716 + +commit e15596e7af6fc645dd652c043397baaa91954915 +Author: Patrick Schleizer +Date: Mon Dec 25 16:28:10 2023 +0000 + + bumped changelog version + +commit f64a869bfdd4c746afd206367885851946deb692 +Author: Patrick Schleizer +Date: Mon Dec 25 11:03:22 2023 -0500 + + readme + +commit c86c83cef760906a0d1c56ee8a8c744b2e07f212 +Author: Patrick Schleizer +Date: Mon Dec 25 10:31:58 2023 -0500 + + formatting + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 971ff687b1423499c54495a03e5e6fafcbfefb2a +Author: Patrick Schleizer +Date: Mon Dec 25 10:30:35 2023 -0500 + + do not mount /dev/cdrom by default + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 9fce67fcd942a7e3e0dd2e874226fcdab5e33ba3 +Author: Patrick Schleizer +Date: Mon Dec 25 10:28:47 2023 -0500 + + remove superfluous, broken `remount` mount option + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 40fd8cb6081512e2bc0ef1a7a1ee17cd317024c2 +Author: Patrick Schleizer +Date: Mon Dec 25 09:51:09 2023 -0500 + + no `nofail` mount option to avoid breaking the boot of a system + + unit testing belongs elsewhere + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 4aa645f29ff741b6e5cdf629deade1923fdcc234 +Author: Patrick Schleizer +Date: Mon Dec 25 09:46:33 2023 -0500 + + comment + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 2b7aeedb4a543d0a43a35918999338097d13bb16 +Author: Patrick Schleizer +Date: Mon Dec 25 09:44:51 2023 -0500 + + mount /dev/cdrom to /mnt/cdrom (instead of /mnt/cdrom0) and + nodev,nosuid,noexec + + as per: + https://www.debian.org/doc/manuals/securing-debian-manual/ch04s10.en.html + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 0d9e9780daca563a726470a3a5d6fa8c20487240 +Author: Patrick Schleizer +Date: Mon Dec 25 09:37:14 2023 -0500 + + formatting + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 00f9ab43947795c1144d797547968c7c149d6f21 +Author: Patrick Schleizer +Date: Mon Dec 25 09:36:05 2023 -0500 + + /dev devtmpfs + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 55709b3aa0acd6cad0c9fedb8782c49fbea79689 +Author: Patrick Schleizer +Date: Mon Dec 25 09:30:57 2023 -0500 + + /tmp tmpfs + + https://github.com/Kicksecure/security-misc/issues/157 + +commit b0dd967611c27f5b8e2472bb74a664aead7a229e +Author: Patrick Schleizer +Date: Mon Dec 25 09:27:45 2023 -0500 + + usrmerge + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 269fada14a616c53d7421e88e662f6893eb1fd88 +Author: Patrick Schleizer +Date: Mon Dec 25 09:25:14 2023 -0500 + + combine bind lines + + https://github.com/Kicksecure/security-misc/issues/157 + +commit 0810c1ce3c9e19c745b8f0d2cd9410353b172779 +Author: Patrick Schleizer +Date: Mon Dec 25 09:10:31 2023 -0500 + + fix bluetooth in readme + + fixes https://github.com/Kicksecure/security-misc/issues/180 + +commit 37b4ab15a823134e616a2a0fe1dda18d5ebfa3c0 +Author: Patrick Schleizer +Date: Mon Dec 25 09:04:10 2023 -0500 + + readme + +commit 79f398d219b9c4cdf8ea0f9e3135a08fa32659a8 +Author: Patrick Schleizer +Date: Mon Dec 25 08:45:20 2023 -0500 + + formatting + +commit c90ada3c398205227d906e2b2108d36d92edcf3c +Author: Patrick Schleizer +Date: Mon Dec 25 08:37:23 2023 -0500 + + pandoc -f markdown -t markdown --wrap=auto --columns=80 README.md -o README.md + +commit 34bf297bd17af2adf59804bd133a00b7dc1942b7 +Author: Patrick Schleizer +Date: Mon Dec 25 08:32:34 2023 -0500 + + formatting + +commit d5fc9f620169b6975c8d3ef685f47e62cb6b9262 +Author: Patrick Schleizer +Date: Mon Dec 25 08:26:03 2023 -0500 + + improve bluetooth in readme + + as suggested by @monsieuremre + + https://github.com/Kicksecure/security-misc/issues/180 + +commit 7fa597deca7ff2b2932a5f5fad56be57bd78b6cf +Author: Patrick Schleizer +Date: Fri Dec 22 16:31:58 2023 +0000 + + bumped changelog version + +commit f70a034da2b4b615855504e7080baf1a7e7b461c +Author: Patrick Schleizer +Date: Fri Dec 22 08:31:58 2023 -0500 + + exclude hardened malloc from SUID disabler + + fixes https://github.com/Kicksecure/security-misc/issues/179 + +commit f055fe5da2219b68f46c3c577d79fcfd7e79cfc6 +Author: Raja Grewal +Date: Fri Dec 15 08:33:36 2023 +0000 + + Disable asynchronous I/O + + io_uring creation is disabled for all processes. io_uring_setup always fails with -EPERM. Existing io_uring instances can still be used. + +commit 99f2edd4f685cdc9a47b32107125408e12a294c2 +Author: Patrick Schleizer +Date: Tue Dec 12 16:51:21 2023 +0000 + + bumped changelog version + +commit 039de1dc9bd6f3cc6595d66f54d0d88d9b537b17 +Author: Patrick Schleizer +Date: Tue Dec 12 11:50:11 2023 -0500 + + add hardened fstab `/usr/share/doc/security-misc/fstab-vm` + + to the documentation folder as an example + + not directly used by security-misc + + will later be used by Kicksecure VM build process + + https://github.com/Kicksecure/security-misc/issues/157 + +commit dcaafa6c8bf380dd990942e9c10e280943b442a6 +Author: Patrick Schleizer +Date: Mon Dec 4 17:06:45 2023 +0000 + + bumped changelog version + +commit 5a73817a9575fe5bcaf3fd354e5f175db7d45ba4 +Author: Patrick Schleizer +Date: Mon Dec 4 11:38:49 2023 -0500 + + move to `/usr/lib/issue.d/20_security-misc.issue` + + https://github.com/Kicksecure/security-misc/pull/167 + +commit dfaea492c76a277b9cbe84982a135cb4f03a557c +Author: Patrick Schleizer +Date: Mon Dec 4 11:37:02 2023 -0500 + + remove `etc/issue.net.d/20_security-misc` + + since not mentioned on debian.org + +commit 69c895af09f05000ace5f273f3e5032aabf8c64e +Merge: c9ea7a4d 36850f89 +Author: Patrick Schleizer +Date: Mon Dec 4 11:27:53 2023 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 36850f89fb07678ca24eb580a18247e593eac608 +Merge: c9ea7a4d 0d7af970 +Author: Patrick Schleizer +Date: Mon Dec 4 11:27:16 2023 -0500 + + Merge pull request #167 from monsieuremre/patch-4 + + Non-Identifiable and Generic Issue Banners that include the Recommended Keywords + +commit c9ea7a4dca6e985c3a1044a3b4ddda83909fbc51 +Author: Patrick Schleizer +Date: Mon Dec 4 11:02:55 2023 -0500 + + use `amd_iommu=force_isolation` instead of `amd_iommu=force_enable` + + because we set `iommu=force` already anyhow + + fixes https://github.com/Kicksecure/security-misc/issues/175 + +commit e83c1d7ed662bb0533c670dd5b7a6745a75e9ca4 +Merge: c4e21ca5 befd21e0 +Author: Patrick Schleizer +Date: Mon Dec 4 11:01:02 2023 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit befd21e0c0c38eaf91c7096e9f60120f533a5842 +Merge: c4e21ca5 f2ad8383 +Author: Patrick Schleizer +Date: Mon Dec 4 11:00:29 2023 -0500 + + Merge pull request #176 from monsieuremre/patch-1 + + Iommu Kernel Parameters + +commit c4e21ca5f49fbc2d67853eebca647539acbca815 +Author: Patrick Schleizer +Date: Mon Dec 4 10:58:16 2023 -0500 + + added development philosophy + + https://github.com/Kicksecure/security-misc/issues/154 + +commit feab1432f9d0966118ca233c9f88270b98c3f120 +Author: Patrick Schleizer +Date: Mon Dec 4 10:48:27 2023 -0500 + + clarify scope + + https://github.com/Kicksecure/security-misc/issues/154 + +commit dc04040cb3644c9e3be9b44a34da4a5f7b61f2cc +Author: Patrick Schleizer +Date: Mon Dec 4 10:36:48 2023 -0500 + + typo + +commit 2634dbff2bd9d7482e7b02be2b5b6fa1c58ef6c7 +Author: Patrick Schleizer +Date: Mon Dec 4 10:36:21 2023 -0500 + + shuffle + +commit f2ad8383cfea4bba42e8b246b05b85101d707641 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sun Dec 3 19:51:38 2023 +0000 + + fix + +commit dd15823a97e953750d7a8288c7d3b8d5f554d6f9 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sun Dec 3 19:50:07 2023 +0000 + + undo superfluousness + +commit 83e13bb62d028cfeea7a4d3f3def3bff8d2b5eaa +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sun Dec 3 19:42:34 2023 +0000 + + Update 40_enable_iommu.cfg + +commit 0d7af9707f802fb600d9eb39bbe0b3bd4a65e3b0 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sun Dec 3 19:31:12 2023 +0000 + + Update 20_security-misc + +commit 04d27a10b0cd1c22cb166c9fccb93a09d5f388f0 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sun Dec 3 19:30:55 2023 +0000 + + Update 20_security-misc + +commit 7963f811e1bb6f5e0e2ba41e96b14e4a3a70f847 +Merge: c8b9f5a9 82bd9138 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sun Dec 3 19:30:22 2023 +0000 + + Merge branch 'Kicksecure:master' into patch-4 + +commit 82bd9138de750a3590be9c91c898cbd04c550e7e +Author: Patrick Schleizer +Date: Mon Nov 20 13:13:10 2023 +0000 + + bumped changelog version + +commit c2b3ff5243c69c4e1ba28e9966bf0ffd3ce550ce +Author: Patrick Schleizer +Date: Mon Nov 20 04:40:28 2023 -0500 + + moved libpam-tmpdir dependency to kicksecure-meta-packages + + https://github.com/Kicksecure/security-misc/pull/147 + +commit c8b9f5a917e6c415575d6763a65930f1a91a7c78 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sat Nov 18 10:03:19 2023 +0000 + + net + +commit 3b614f3753608bd62ff6bc6e56e15f280994c646 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sat Nov 18 10:02:16 2023 +0000 + + 20_security-misc + +commit 7c8b9b294678056d684fd3dc22f012d75da40426 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Nov 17 17:14:01 2023 +0000 + + 30_security-misc.conf + +commit 7d31e17fc5a8fe3055568c1a0f541dea064f30a0 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Nov 17 17:02:41 2023 +0000 + + usbguard + +commit 4e4df5dd7c6b5cf1deb179a2c3f8fe7a8844884d +Author: Patrick Schleizer +Date: Sat Nov 11 22:29:57 2023 +0000 + + bumped changelog version + +commit a51674410cb8a7ac2119ea7c85f986223ce8fc25 +Author: Patrick Schleizer +Date: Sat Nov 11 17:29:37 2023 -0500 + + fix + +commit 8d58077d68e6363313cdc62f7fac14840f5d9a8e +Author: Patrick Schleizer +Date: Sat Nov 11 20:22:34 2023 +0000 + + bumped changelog version + +commit 5b85a0b34d30d191654158506e0209b34a8f9fe8 +Author: Patrick Schleizer +Date: Sat Nov 11 14:46:35 2023 -0500 + + license + +commit 7757080519858492a7fcbf735ec854029b29d67a +Author: Patrick Schleizer +Date: Sat Nov 11 13:41:28 2023 -0500 + + change license to AGPL-3+ + + https://forums.whonix.org/t/license-change-to-agplv3/17455 + +commit 20f804f19c046e3ef2b38c367de9d5c80cccccd9 +Author: Patrick Schleizer +Date: Mon Nov 6 17:28:21 2023 -0500 + + bumped changelog version + +commit a1e00be0e09a7271a3fae9e9abdbe9a2279b7197 +Author: Patrick Schleizer +Date: Mon Nov 6 16:58:23 2023 -0500 + + update link + +commit 5bb357cac02c7217f4e897a0625f531602ac69cf +Author: Patrick Schleizer +Date: Mon Nov 6 16:55:00 2023 -0500 + + spice-client-glib-usb-acl-helper matchwhitelist + +commit 7309445ee518c093ba3f9aec56197e391e0a194a +Author: Patrick Schleizer +Date: Mon Nov 6 16:52:27 2023 -0500 + + comment + +commit f09d97fc9efc98d8b197a497e2ce4c5965be531a +Author: Patrick Schleizer +Date: Mon Nov 6 16:50:19 2023 -0500 + + whitelist VirtualBox + +commit 64c8c7a8d5a42d2e3da9ce243bc708d1bcbe6039 +Author: Patrick Schleizer +Date: Mon Nov 6 16:47:31 2023 -0500 + + whitelist SSH + +commit 9682b51d548396717867a0c336f1fb1677ccfe2b +Author: Patrick Schleizer +Date: Mon Nov 6 16:44:36 2023 -0500 + + whitelist virtualbox + +commit a40b9bc095bb0f363911dacee050234b3a555744 +Author: Patrick Schleizer +Date: Mon Nov 6 16:40:22 2023 -0500 + + comments + +commit 2c1a3da433b8dc96039caab17e81666896ade58c +Author: Patrick Schleizer +Date: Mon Nov 6 16:38:50 2023 -0500 + + VirtualBoxVM matchwhitelist + +commit 4e96ffaabb7c2e73bf686e56bcaa220f4d2e9e93 +Author: Patrick Schleizer +Date: Mon Nov 6 16:37:19 2023 -0500 + + chrome-sandbox matchwhitelist + +commit df5f3e80566da210ee5d807cc1b5dd53678fdae0 +Author: Patrick Schleizer +Date: Mon Nov 6 16:36:22 2023 -0500 + + output + +commit 72f6e6bb9c2426535bfc48175d88707331ec5346 +Author: Patrick Schleizer +Date: Mon Nov 6 16:28:23 2023 -0500 + + output + +commit 3bc831a1f71a80a178601bdd5c7f06b22ada75ab +Author: Patrick Schleizer +Date: Mon Nov 6 16:27:29 2023 -0500 + + lintian + +commit fd1f38b2ebe31aec04b22d968b38305504f7f935 +Author: Patrick Schleizer +Date: Mon Nov 6 16:22:42 2023 -0500 + + remount-secure systemd unit + + https://github.com/Kicksecure/security-misc/pull/152 + +commit 79f9c1fb3adac319342a22c099401cb21af4429f +Author: Patrick Schleizer +Date: Mon Nov 6 15:48:09 2023 -0500 + + add sysinit-post.target + + https://github.com/Kicksecure/security-misc/pull/152 + +commit 2de5ab41201c561a2684f15196ce37b0f34038a9 +Author: Patrick Schleizer +Date: Mon Nov 6 13:47:30 2023 -0500 + + clarify scope of application specific hardening + + fixes https://github.com/Kicksecure/security-misc/issues/154 + +commit 5a96616b39e7188903bd0d35c9812a02fddc02f9 +Author: Patrick Schleizer +Date: Sun Nov 5 21:13:14 2023 -0500 + + bumped changelog version + +commit ad079ac5cc4d7ce2270e9abf21fa520fc9b2761f +Author: Patrick Schleizer +Date: Sun Nov 5 20:55:55 2023 -0500 + + readme + + https://github.com/Kicksecure/security-misc/pull/152 + +commit be023c77223c4ec0e26ffe2a88acd94653efee9a +Author: Patrick Schleizer +Date: Sun Nov 5 20:54:43 2023 -0500 + + readme + + https://github.com/Kicksecure/security-misc/issues/159 + +commit e1f413c1ee5107468cb2a9c4aa8bd061d0dc911b +Author: Patrick Schleizer +Date: Sun Nov 5 20:53:26 2023 -0500 + + disable harden-module-loading.service for now + + due to issues + + https://github.com/Kicksecure/security-misc/issues/159 + +commit f2ea1abc9b3efc035f4d1381bece458de9b89ff3 +Author: Patrick Schleizer +Date: Sun Nov 5 20:53:03 2023 -0500 + + comment + +commit 95d1cfb4a03afc987cf89bb0f4cd6d2f1ad431b1 +Author: Patrick Schleizer +Date: Sun Nov 5 20:49:36 2023 -0500 + + Revert "remove no longer required remount-service systemd unit" + + This reverts commit 479ab61a1d0c91d26c2cd200d97b39b2b786e073. + + https://github.com/Kicksecure/security-misc/pull/152 + +commit 24b4d59ce41bc95e0b0aadf401223dc40b0f9c8f +Author: Patrick Schleizer +Date: Sun Nov 5 20:14:33 2023 -0500 + + bumped changelog version + +commit 4482f1841cfc6caa063e2274db890cfa01944811 +Author: Patrick Schleizer +Date: Sun Nov 5 20:13:14 2023 -0500 + + newline + +commit c5167c8f0d398946fdfae56fa78b32fade4cb451 +Author: Patrick Schleizer +Date: Sun Nov 5 20:12:03 2023 -0500 + + fix systemd unit + + https://github.com/Kicksecure/security-misc/issues/159 + +commit 2571bbf315693f65f564ef4ad1b2ff4941f2ebc3 +Author: Patrick Schleizer +Date: Sun Nov 5 18:42:25 2023 -0500 + + duplicate + +commit aa170878838b2218da8295be8b6898bc86056cec +Author: Patrick Schleizer +Date: Sun Nov 5 18:42:08 2023 -0500 + + update path + +commit d203e539aa975b042cd6ec9608a0cc16b3314372 +Author: Patrick Schleizer +Date: Sun Nov 5 18:17:59 2023 -0500 + + bumped changelog version + +commit 4ebab940c750154a396c4ffdbde61367e12c72f8 +Author: Patrick Schleizer +Date: Sun Nov 5 17:56:35 2023 -0500 + + description too long, fixed + +commit ad010ef5b4c90e4abbd1c88724f99450740fb2eb +Author: Patrick Schleizer +Date: Sun Nov 5 17:52:44 2023 -0500 + + debugging + +commit 826e76d037f88636fdde7d4ef1eb72f29ac5f4a5 +Author: Patrick Schleizer +Date: Sun Nov 5 17:43:33 2023 -0500 + + bumped changelog version + +commit 3130a39d8c280d913fb632a40562438b82a499bb +Author: Patrick Schleizer +Date: Sun Nov 5 17:43:07 2023 -0500 + + set -e + +commit 18a2d814cc0c477599b276bb319ed8bdd34499ea +Merge: 4fda9d2e 36f3c304 +Author: Patrick Schleizer +Date: Sun Nov 5 17:42:28 2023 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 36f3c30440e73c8bf4946742095f0495994fed99 +Merge: 4fda9d2e 2e64d89b +Author: Patrick Schleizer +Date: Sun Nov 5 17:41:56 2023 -0500 + + Merge pull request #148 from monsieuremre/module-loading-hardening + + Harden the loading of new modules to the kernel after install + +commit 4fda9d2e8459c043ec27178ceb87483229b45d5f +Author: Patrick Schleizer +Date: Sun Nov 5 16:46:18 2023 -0500 + + bumped changelog version + +commit 4219347f0a739ed1ea93a596968295ddcd3a940f +Author: Patrick Schleizer +Date: Sun Nov 5 16:43:44 2023 -0500 + + fix permission-hardener config parsing issue + +commit e72f79236b7b704c60c6920b51c86832f4fda9e3 +Author: Patrick Schleizer +Date: Sun Nov 5 16:41:41 2023 -0500 + + refactoring + +commit dea0d9a78a99c441a1738f88cef2cd3c5f433454 +Author: Patrick Schleizer +Date: Sun Nov 5 16:40:49 2023 -0500 + + fix permission-hardener config parsing issue + +commit 017ae18ad7a757a18c5a7a92677f24053280e8b5 +Author: Patrick Schleizer +Date: Sun Nov 5 16:39:10 2023 -0500 + + fix permission-hardener config parsing issue + +commit 65e3c14643ca2b5167e0f5bc30a6bbc45cb4f645 +Author: Patrick Schleizer +Date: Sun Nov 5 16:35:11 2023 -0500 + + fix permission-hardener config parsing issue + +commit 40e536a9beb48f1938e67ae2010fc34f80e3bd1f +Author: Patrick Schleizer +Date: Sun Nov 5 16:04:03 2023 -0500 + + bumped changelog version + +commit 51decff2fd48c2437b08136e97d4211e5eaccd89 +Author: Patrick Schleizer +Date: Sun Nov 5 16:03:36 2023 -0500 + + exclude qfile-unpacker from permission hardener + +commit 52b6e92e002987952c908eeb05a293dd401ee9be +Author: Patrick Schleizer +Date: Sun Nov 5 15:58:21 2023 -0500 + + bumped changelog version + +commit 1900c1ab07e4d55577815b942b34457596a1d703 +Author: Patrick Schleizer +Date: Sun Nov 5 15:57:49 2023 -0500 + + pam exclude from permission-hardener + +commit 76e3a3c5f9fa5e95b90e4ea3f3ba7019615a3d1a +Author: Patrick Schleizer +Date: Sun Nov 5 15:29:38 2023 -0500 + + bumped changelog version + +commit d4494fd3c341796081dd8c114c8cc97e627c236c +Author: Patrick Schleizer +Date: Sun Nov 5 15:27:09 2023 -0500 + + disable remount-secure dracut modules + + pending new systemd based implementation + + https://github.com/Kicksecure/security-misc/pull/152 + +commit 949c1633701ac168e908794d4dd74c5a9b09a437 +Author: Patrick Schleizer +Date: Sun Nov 5 15:14:43 2023 -0500 + + bumped changelog version + +commit 4a19fbae0be2ab99c1f21826eca2ec3cef605a0e +Author: Patrick Schleizer +Date: Sun Nov 5 15:13:01 2023 -0500 + + move permission-hardening to /usr/bin to make it more easily accessible + +commit c75f80b29f2fee3f2ead579390b8d3a8ff86b9d2 +Author: Patrick Schleizer +Date: Sun Nov 5 15:09:29 2023 -0500 + + lower verbosity of permission hardener + + fixes https://github.com/Kicksecure/security-misc/issues/158 + +commit 0544657123100b333211a91ef32054dc7e14c7db +Author: Patrick Schleizer +Date: Sun Nov 5 14:56:06 2023 -0500 + + bumped changelog version + +commit 42be6310237bdb663f38982b221327a337251e0a +Author: Patrick Schleizer +Date: Sun Nov 5 14:54:05 2023 -0500 + + readme + +commit 55ba5d48321ec4224bcbf03cf2bf51226cf34e50 +Author: Patrick Schleizer +Date: Sun Nov 5 14:51:31 2023 -0500 + + renamed: usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf -> usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf + renamed: usr/lib/NetworkManager/conf.d/99_randomize-mac.conf -> usr/lib/NetworkManager/conf.d/80_randomize-mac.conf + renamed: usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf -> usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf + +commit eab5d7d4ec58baaf7eedc777e250ad9f00e4b71b +Author: Patrick Schleizer +Date: Sun Nov 5 14:50:13 2023 -0500 + + cleanup + +commit 811d1cd0dd0dcb9021d2f72638dd6c12b734964c +Merge: 93437952 5a75bcfb +Author: Patrick Schleizer +Date: Sun Nov 5 14:49:43 2023 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 5a75bcfb19ac6c555a52cb1600e4efd13a8cfc06 +Merge: 93437952 229032d6 +Author: Patrick Schleizer +Date: Sun Nov 5 14:49:00 2023 -0500 + + Merge pull request #145 from monsieuremre/wifi-and-bluetooth + + Wifi and Bluetooth Patch | Security and Privacy + +commit 93437952b4f64866dfe6067d8caf19415112418d +Author: Patrick Schleizer +Date: Sun Nov 5 14:41:01 2023 -0500 + + readme + +commit f32b5438872ad0b9e10cb7b0519f1f18fce1913e +Merge: 56b90eec 4946f85d +Author: Patrick Schleizer +Date: Sun Nov 5 14:38:20 2023 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 4946f85d43083c64bc3f8f02e26b08f79b622bfe +Merge: 817ca116 1abac794 +Author: Patrick Schleizer +Date: Sun Nov 5 14:37:47 2023 -0500 + + Merge pull request #146 from monsieuremre/thunderbird + + Thunderbird Hardening + +commit 56b90eecbfb21e546d52d1f41ce9361f2843cd71 +Merge: 31786775 817ca116 +Author: Patrick Schleizer +Date: Sun Nov 5 14:35:23 2023 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 817ca116f693893e6dcb69254ee91815d200b8a1 +Merge: d9b5d770 fbd9e5d0 +Author: Patrick Schleizer +Date: Sun Nov 5 14:34:13 2023 -0500 + + Merge pull request #153 from monsieuremre/readme + + Updated Readme + +commit 317867758478619fe1df4ebdb5e22240c40104c0 +Merge: dcead44c d9b5d770 +Author: Patrick Schleizer +Date: Sun Nov 5 14:32:21 2023 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit d9b5d770cfd5f7747f1d606f3136a93034928f30 +Merge: dcead44c ac224b27 +Author: Patrick Schleizer +Date: Sun Nov 5 14:31:26 2023 -0500 + + Merge pull request #150 from monsieuremre/sysreq + + Disable SysRq by default + +commit dcead44cc6d4272b0966562046f9dab1792845b6 +Author: Patrick Schleizer +Date: Sun Nov 5 11:32:46 2023 -0500 + + output + +commit f6bf69b41fa3e1168c2c49884197770e1a78b888 +Author: Patrick Schleizer +Date: Sun Nov 5 11:31:09 2023 -0500 + + update link + +commit 2e64d89b042227fe5f38bb6d6a859deb4c5183b7 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sat Nov 4 21:18:45 2023 +0000 + + undo unnecessary manual activation + +commit 19eceaa8108879ee5477b157fb2175993c487959 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sat Nov 4 20:56:46 2023 +0000 + + more fix + +commit a187d23c4187fd08611e5cba85d09666dfd9f735 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sat Nov 4 20:56:08 2023 +0000 + + big fix + +commit fbd9e5d017c4b00d838e9f225c7748c4b362f023 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Sat Nov 4 14:33:35 2023 +0000 + + README.md + +commit 97054b2b1076d6d428996967304b29620923eff4 +Author: Patrick Schleizer +Date: Fri Nov 3 15:55:17 2023 -0400 + + revert enabling kernel module signature enforcement + + due to issues + + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/63 + + https://github.com/dell/dkms/issues/359 + +commit 978e3e4abd8f55a877dfe0d6e39b45ee9f58ba6d +Author: Patrick Schleizer +Date: Fri Nov 3 14:53:40 2023 -0400 + + readme + +commit 0242c04dc26638dc1250e3f681b46d15459cf8aa +Author: Patrick Schleizer +Date: Fri Nov 3 14:51:14 2023 -0400 + + port to DKMS drop-in folder + + undisplace /etc/dkms/framework.conf.security-misc + moved to /etc/dkms/framework.conf.d/30_security-misc.conf + +commit d1b5a3ffd525ec92554ffc9c666f8007c8522aac +Author: Patrick Schleizer +Date: Fri Nov 3 12:55:34 2023 -0400 + + /usr/sbin/pam-tmpdir-helper exactwhitelist + + https://github.com/Kicksecure/security-misc/pull/147 + +commit 48adb44c6fd157673cdf7fab3b86ecf7c6b31966 +Author: Patrick Schleizer +Date: Fri Nov 3 12:17:24 2023 -0400 + + bumped changelog version + +commit b6d53f698d0ad21a31da6bf74a44577a0c8869fc +Author: Patrick Schleizer +Date: Fri Nov 3 12:17:00 2023 -0400 + + Revert "allow loading unsigned modules due to issues" + + This reverts commit 661bcd8603425934188cf139f33e20675ff4b765. + +commit 04b210ee88589ef9e6e214d3a5a614780244abc9 +Author: Patrick Schleizer +Date: Fri Nov 3 12:10:48 2023 -0400 + + bumped changelog version + +commit 5e73f78ed9282bf0895b01d44d9c261ea0050cce +Merge: ceffd2b3 8e66a417 +Author: Patrick Schleizer +Date: Fri Nov 3 12:10:33 2023 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 8e66a4177868ee7b51dafdb06062b0cb7cbc7415 +Merge: ceffd2b3 7dc99d54 +Author: Patrick Schleizer +Date: Fri Nov 3 12:10:00 2023 -0400 + + Merge pull request #147 from monsieuremre/PAM-tmp-files-hardening + + Depend on libpam-tmpdir for very solid extra security + +commit 7dc99d54c0358842745ee48c7cc24f589fd63d14 +Author: Patrick Schleizer +Date: Fri Nov 3 12:09:39 2023 -0400 + + fix + +commit 2a602e78d6ca0f87f11de9a30ae2114468243075 +Merge: 3ee4be65 ceffd2b3 +Author: Patrick Schleizer +Date: Fri Nov 3 12:08:50 2023 -0400 + + Merge branch 'master' into PAM-tmp-files-hardening + +commit ceffd2b3ee453122e66f594ec31dde6ec3bb7187 +Author: Patrick Schleizer +Date: Fri Nov 3 12:06:43 2023 -0400 + + bumped changelog version + +commit cdd66ee3762c441843d421a9e6b11a20580ed7ac +Author: Patrick Schleizer +Date: Fri Nov 3 10:48:46 2023 -0400 + + wrap-and-sort + +commit c33a3d9aadcc4c0ff90f330239eff4b7c905a022 +Author: Patrick Schleizer +Date: Fri Nov 3 10:44:48 2023 -0400 + + readme + +commit d71ac03d96c9861513ff56c68aec9090ef5c50bb +Author: Patrick Schleizer +Date: Fri Nov 3 10:36:15 2023 -0400 + + comment + +commit 8326aecdb460fffa450bbf3ec0b051010f87ee2a +Author: Patrick Schleizer +Date: Fri Nov 3 10:33:02 2023 -0400 + + bumped changelog version + +commit b85d48eb83005da8fd9edc658c71493f407e3670 +Author: Patrick Schleizer +Date: Fri Nov 3 10:31:59 2023 -0400 + + do not change default umask for root + + since this causes permission issues in `/etc/` + + https://github.com/Kicksecure/security-misc/pull/151 + +commit 07540db90d60b10cbd10881b0024d8e8871330de +Author: Patrick Schleizer +Date: Fri Nov 3 09:45:12 2023 -0400 + + Revert "Revert "set default umask to 027"" + + This reverts commit f8913ceb2e2fdd274011377c41b5d08e7459e4af. + +commit f8913ceb2e2fdd274011377c41b5d08e7459e4af +Author: Patrick Schleizer +Date: Fri Nov 3 09:43:44 2023 -0400 + + Revert "set default umask to 027" + + This reverts commit cd216095eb8d9387437e653d7764ec765ce42a10. + +commit 43bd789c30a562aa60349d019107277a428aece8 +Author: Patrick Schleizer +Date: Fri Nov 3 09:28:08 2023 -0400 + + bumped changelog version + +commit cd216095eb8d9387437e653d7764ec765ce42a10 +Author: Patrick Schleizer +Date: Fri Nov 3 09:12:24 2023 -0400 + + set default umask to 027 + + using package libpam-umask + + https://www.debian.org/doc/manuals/securing-debian-manual/ch04s11.en.html#id-1.5.14.19 + + https://github.com/Kicksecure/security-misc/pull/151 + +commit ac224b270a3a0945d187202f8cca89af0e71a166 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Nov 2 13:01:55 2023 +0000 + + disable sysrq + +commit 07882f61a8003026a9e4c135a6e18a8fd204060f +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Nov 2 10:44:19 2023 +0000 + + enable service on install + + not sure if this would be the right way to do it + +commit 9f063584c1f96267b04f8f7fe0eee773f9345370 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Nov 2 10:28:41 2023 +0000 + + disable-kernel-module-loading + +commit 3e604618a8ba2531553af4f9af00470bd9629615 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Nov 2 10:24:35 2023 +0000 + + harden-module-loading.service + +commit 3ee4be652b28201ba208757ce5144e51c453ad70 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Nov 2 09:36:58 2023 +0000 + + depend on libpam-tmpdir + +commit 1abac794b564d178df37a385cf0d25bac5842c3c +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Nov 2 09:15:20 2023 +0000 + + very secure and private defaults + +commit 5a583ca48ce608fee4fe55c1d6948505e83a98d8 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Nov 2 08:30:26 2023 +0000 + + typo in file name + +commit 229032d691c614a926cf3cf96b44752364e4e087 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Wed Nov 1 17:54:05 2023 +0000 + + Rename etc/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf to usr/lib/systemd/networkd.conf.d/99_ipv6-privacy-extensions.conf + +commit 1049298e7bfa4ca0e8f02b4086f8aa086d51c725 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Wed Nov 1 17:52:40 2023 +0000 + + Update and rename etc/NetworkManager/conf.d/99_randomize-mac.conf to usr/lib/NetworkManager/conf.d/99_randomize-mac.conf + +commit 76e684cc0ac0544219d200eeefae1356864fe702 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Wed Nov 1 17:51:27 2023 +0000 + + Update and rename etc/NetworkManager/conf.d/99_ipv6-privacy.conf to usr/lib/NetworkManager/conf.d/99_ipv6-privacy.conf + +commit a768f1f1ebfc29b0c0105f2965a4290f8dfd8e63 +Author: Patrick Schleizer +Date: Wed Nov 1 12:26:21 2023 -0400 + + bumped changelog version + +commit bb14a058520b13e242fea9f3022c439c4677bd1d +Merge: 5ed2a5ce 44906e8f +Author: Patrick Schleizer +Date: Wed Nov 1 11:11:54 2023 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 44906e8f398aae6e9565b131b82124e738e2d0d1 +Merge: 5ed2a5ce f2c23a28 +Author: Patrick Schleizer +Date: Wed Nov 1 11:11:27 2023 -0400 + + Merge pull request #142 from monsieuremre/patch-5 + + ssh config + +commit 5ed2a5ce4a24a1a9c3e722a30aa9c6af1dc5d78a +Author: Patrick Schleizer +Date: Wed Nov 1 11:10:36 2023 -0400 + + bumped changelog version + +commit bb1161986b6d108c4fc5a16a48cdac55f98ab35d +Merge: 7d576842 b7cddd6e +Author: Patrick Schleizer +Date: Wed Nov 1 10:31:04 2023 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit b7cddd6e552cb5f5139de91ef2aeae6fde691136 +Merge: 7d576842 c975c3c0 +Author: Patrick Schleizer +Date: Wed Nov 1 10:30:26 2023 -0400 + + Merge pull request #143 from monsieuremre/patch-6 + + new lines 990-security-misc.conf + +commit fc8e201e84e4c777c087fd113c539ca368fd3a31 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Oct 27 14:49:24 2023 +0000 + + rename + +commit 90a88225a4fde2f09cc14b24f8467bb1ded90c9d +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Oct 27 14:38:31 2023 +0000 + + security-misc.maintscript + +commit 13b4ddbb627d2279b41d1dcbe5c8ce1ac384b088 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Oct 27 14:34:21 2023 +0000 + + 30_security-misc.conf + +commit b298d152fc10c66892698d9dcae769a44a32037b +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Oct 27 14:32:08 2023 +0000 + + 30_security-misc.conf + +commit 3d4b04fddc16067ed345074683281e74f41eeadf +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Oct 27 12:35:39 2023 +0000 + + 99_ipv6-privacy.conf + +commit e90f62eaabfeee7483af573ef8e9d015ba1977dc +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Oct 27 12:34:15 2023 +0000 + + 99_randomize_mac.conf + +commit 604d839537c409604ed2c4c88992ea1a31368f6f +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Oct 27 12:30:26 2023 +0000 + + 99_ipv6-privacy-extensions.conf + +commit c975c3c0ff7cc5a1e29b651c2db6c27e3f952870 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Oct 27 11:07:53 2023 +0000 + + new lines 990-security-misc.conf + + added new recommended hardening settings with comments + +commit f2c23a28319e359c642da2dde424456a1064763f +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Oct 27 10:53:45 2023 +0000 + + ssh config + +commit 7d576842fb6f3c124db2b6deb5abfc095974a67f +Author: Patrick Schleizer +Date: Thu Oct 26 20:08:41 2023 -0400 + + bumped changelog version + +commit 7cff267002485fd0abca98d12b0024e061f4ba51 +Author: Patrick Schleizer +Date: Thu Oct 26 19:31:14 2023 -0400 + + remove duplicates + +commit 928cdb81d43dfd337c82917182d2914d9c9d0915 +Merge: a330a9fd 39fed058 +Author: Patrick Schleizer +Date: Thu Oct 26 19:29:55 2023 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 39fed058f4734029b303fac4ea9a1b11f652fab4 +Merge: 92a6ecc4 99355c61 +Author: Patrick Schleizer +Date: Thu Oct 26 19:27:41 2023 -0400 + + Merge pull request #140 from monsieuremre/patch-3 + + New lines in default permission config + +commit a330a9fd75314931639e7e873adc31c5cc65d555 +Author: Patrick Schleizer +Date: Thu Oct 26 19:20:21 2023 -0400 + + refactor permission-lockdown + +commit 8bf5ff82be706599f33228ecd6df42be0dc29f39 +Merge: 1123d231 92a6ecc4 +Author: Patrick Schleizer +Date: Thu Oct 26 19:15:04 2023 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 92a6ecc40a4d3bd4d8f3cec7dd9b1334c72399dc +Merge: ca9603af 91c44524 +Author: Patrick Schleizer +Date: Thu Oct 26 19:13:34 2023 -0400 + + Merge pull request #141 from monsieuremre/patch-4 + + New permission-lockdown + +commit 1123d23114201988ac3f5f50ab6e74a5307d3d52 +Author: Patrick Schleizer +Date: Thu Oct 26 18:45:07 2023 -0400 + + remount-secure: disable debugging to save space in initrd + +commit 91c445244c47c163e2466f8c4dff710eda20c337 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Oct 26 19:41:07 2023 +0000 + + actually we do it once indeed + +commit 88f396264ca9d072e4e5de4e1acaee54f3b39749 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Oct 26 19:35:59 2023 +0000 + + avoiding /etc/passwd + +commit b5ba03247a5b5bb1f4e010130e4a575ad1397117 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Oct 26 19:31:25 2023 +0000 + + readability + +commit f487752ba1b469eb0b2f85657e2ee0860f58496b +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Oct 26 19:30:58 2023 +0000 + + not limiting ourselves. we do not do this not just once. + +commit 88cd5a905d8aa0f6033ac4ba72903fbad4a90b4b +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Oct 26 19:25:24 2023 +0000 + + strip unnecessary + +commit d9f10c221a2b6794f0a3c5bcd1c15e2a4f352751 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Oct 26 18:17:50 2023 +0000 + + new permission-lockdown + +commit 99355c616974d167e3a5424d63cd56b1f64f0eaf +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Thu Oct 26 17:45:28 2023 +0000 + + new lines 30_default.conf + +commit ca9603af1713ff37392662c9d1b4251052e7b983 +Author: Patrick Schleizer +Date: Thu Oct 26 12:23:48 2023 -0400 + + bumped changelog version + +commit 5f4222c1c3d7fa057b31bba7b0b5c2e83c92a7be +Author: Patrick Schleizer +Date: Thu Oct 26 12:20:48 2023 -0400 + + enable SUID Disabler and Permission Hardener by default + + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener + + https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706 + +commit e5d989af5ac2899985c48d60311856fb86e0ddeb +Author: Patrick Schleizer +Date: Thu Oct 26 12:04:13 2023 -0400 + + comment + +commit 8557e0963ed6159f7f6c816ad4e009cc7323a760 +Author: Patrick Schleizer +Date: Wed Oct 25 17:55:37 2023 -0400 + + bumped changelog version + +commit b7e2d49f5f3f49fab2e1c0647f10bda1921e0a80 +Author: Patrick Schleizer +Date: Wed Oct 25 17:41:05 2023 -0400 + + comment + +commit 5d71217e597aa3366658524ec5395c9f76dd527b +Merge: 6a22351d a2f811af +Author: Patrick Schleizer +Date: Wed Oct 25 17:40:13 2023 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 6a22351d298e475ecae22bb99249a308b294ff9a +Author: Patrick Schleizer +Date: Wed Oct 25 17:30:07 2023 -0400 + + renamed: usr/lib/sysctl.d/30_security-misc.conf -> usr/lib/sysctl.d/990-security-misc.conf + +commit b7c52800f4c16b1573e372089704a68fd47c5906 +Author: Patrick Schleizer +Date: Wed Oct 25 17:28:43 2023 -0400 + + renamed: etc/sysctl.d/30_security-misc.conf -> usr/lib/sysctl.d/30_security-misc.conf + renamed: etc/sysctl.d/30_security-misc_kexec-disable.conf -> usr/lib/sysctl.d/30_security-misc_kexec-disable.conf + renamed: etc/sysctl.d/30_silent-kernel-printk.conf -> usr/lib/sysctl.d/30_silent-kernel-printk.conf + +commit a2f811aff0cb4e73c3975093012c223127495707 +Merge: 3317332c ee6716e1 +Author: Patrick Schleizer +Date: Wed Oct 25 17:26:46 2023 -0400 + + Merge pull request #135 from monsieuremre/kernel-fix + + Kernel hardening fix + +commit ee6716e178806912da08b671ae31504ed2f3ac56 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Tue Oct 24 20:43:10 2023 +0000 + + security-misc.maintscript + +commit 3317332cb431115f81d832ba974181c74427c884 +Author: Patrick Schleizer +Date: Tue Oct 24 05:51:11 2023 -0400 + + bumped changelog version + +commit 42c802cd1eca3d2586abde871e4842cdf83490c4 +Merge: f3b40f12 5320c11f +Author: Patrick Schleizer +Date: Tue Oct 24 05:30:15 2023 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 5320c11f3f92b66b7dcab7ca1f67fcba2de5deba +Merge: f3b40f12 f0857fd5 +Author: Patrick Schleizer +Date: Tue Oct 24 05:22:33 2023 -0400 + + Merge pull request #134 from monsieuremre/patch-1 + + Fix double mount issue for /var/log and /var/tmp + +commit 1f489719efb37492b9c040ba4e332e8dd70fde1f +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Mon Oct 23 16:38:58 2023 +0000 + + rename + +commit 9dda6f69a7df792966005f9c6feb057483cd9ea4 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Mon Oct 23 16:38:40 2023 +0000 + + more rename + +commit 89381fe7abcc2f4418b95c3eb290c975bf6d612c +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Mon Oct 23 16:38:23 2023 +0000 + + rename + +commit f0857fd5608525115bd8a96c2f75368263f6f830 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Mon Oct 23 15:33:05 2023 +0000 + + Fix double mount issue for /var/log and /var/tmp + + Mounting var with bind and mounting a subdirectory causes /var/tmp and /var/log bind mounted twice each. can be checked with lsblk. When we bind mount var only after having mounted the subdirectories, everything is mounted only one. + +commit f3b40f12cb4bad0f2f00d4ba2dec59fb315c0798 +Author: Patrick Schleizer +Date: Sun Oct 22 19:23:22 2023 -0400 + + bumped changelog version + +commit d2e8a6dad3b94d574cb9c043303160b06893ab97 +Author: Patrick Schleizer +Date: Sun Oct 22 19:21:51 2023 -0400 + + debugging + +commit e7aafd64d4418d43426b310653861f9024a54255 +Author: Patrick Schleizer +Date: Sun Oct 22 19:16:12 2023 -0400 + + refactoring + +commit ee15f749bb4e68350498e52e8505bed43c98cbaf +Author: Patrick Schleizer +Date: Sun Oct 22 16:54:58 2023 -0400 + + bumped changelog version + +commit d521662d04892fb6d5477fa4450fb5488892a87a +Author: Patrick Schleizer +Date: Sun Oct 22 16:49:36 2023 -0400 + + comment + +commit 0e80acf38d430784fbb779f4f10c81bfe8a3813f +Author: Patrick Schleizer +Date: Sun Oct 22 16:45:10 2023 -0400 + + fix + +commit a1c3b87fcee07496af4b42e387b46488b58b73a0 +Author: Patrick Schleizer +Date: Sun Oct 22 16:29:08 2023 -0400 + + bumped changelog version + +commit f6d1346e2bde51cd70bc60246c0bfba923c00c3d +Author: Patrick Schleizer +Date: Sun Oct 22 16:22:08 2023 -0400 + + fix + +commit 9a649ddd091b116c9091f3fa582d411b5186375a +Author: Patrick Schleizer +Date: Sun Oct 22 16:16:40 2023 -0400 + + bumped changelog version + +commit 11382881b56556741fad5f0291ccb57a24e9c617 +Author: Patrick Schleizer +Date: Sun Oct 22 16:12:26 2023 -0400 + + comments + +commit 5182d7502b34a95fd751c69c4bc3f01d5f5e02b9 +Author: Patrick Schleizer +Date: Sun Oct 22 16:08:21 2023 -0400 + + improve remount-secure + +commit 555d83792df9aa599ae9e0e7c41af49b0601c1c1 +Author: Patrick Schleizer +Date: Sun Oct 22 15:44:47 2023 -0400 + + bumped changelog version + +commit a88c0a3ad2d83fe72612faf97866e255c5527384 +Author: Patrick Schleizer +Date: Sun Oct 22 15:44:30 2023 -0400 + + fix + +commit 316282952f7d2470c89f268beea01b8bac9bb4bb +Author: Patrick Schleizer +Date: Sun Oct 22 15:40:59 2023 -0400 + + bumped changelog version + +commit a7629b98cf4e7f86bab07c2b75fa712adcd63ee5 +Author: Patrick Schleizer +Date: Sun Oct 22 15:40:49 2023 -0400 + + fix + +commit 7112eac3be014938f757e0c0def74bb04dc72d2f +Author: Patrick Schleizer +Date: Sun Oct 22 15:37:21 2023 -0400 + + output + +commit f80b5fe3767502f6890bdfb7bc32a602c94828d6 +Author: Patrick Schleizer +Date: Sun Oct 22 15:36:16 2023 -0400 + + fix + +commit ce0babce215dc4ec08101cff5e0d25ad6ec87e70 +Author: Patrick Schleizer +Date: Sun Oct 22 15:35:03 2023 -0400 + + comment + +commit fa0804b7ae46ecfc1e9e82ca83342c9d456aa9c3 +Author: Patrick Schleizer +Date: Sun Oct 22 15:33:21 2023 -0400 + + bumped changelog version + +commit 70cbe4daaa5cd857c49f2f9b9241f24e2867ab5a +Author: Patrick Schleizer +Date: Sun Oct 22 15:33:11 2023 -0400 + + fix + +commit 36f2acb93f65958b27bae030f1d2bd66a278e073 +Author: Patrick Schleizer +Date: Sun Oct 22 15:28:04 2023 -0400 + + bumped changelog version + +commit 9b9e9ce1c0feb4ca854189754c47ca826eef1c32 +Author: Patrick Schleizer +Date: Sun Oct 22 15:27:01 2023 -0400 + + fix + +commit 3731716a497c233127bff3febbe22d5cf088aad8 +Author: Patrick Schleizer +Date: Sun Oct 22 15:14:22 2023 -0400 + + fix + +commit eec87a0508a6242430a1f0b8ad341f4c3ea43059 +Author: Patrick Schleizer +Date: Sun Oct 22 15:11:26 2023 -0400 + + fix + +commit f3286cf440992661ba85b5c7e41b92ffaca62cf3 +Author: Patrick Schleizer +Date: Sun Oct 22 15:10:21 2023 -0400 + + fix + +commit eb90d38d8ca6d6292dbb8013bb9bca8ec26f4792 +Author: Patrick Schleizer +Date: Sun Oct 22 15:05:33 2023 -0400 + + fix + +commit f44020973897d98fdc21ced748ad64106979829e +Author: Patrick Schleizer +Date: Sun Oct 22 14:46:42 2023 -0400 + + bumped changelog version + +commit 7f03c2b13742e583e426c91ff4e111b6c0e7da43 +Author: Patrick Schleizer +Date: Sun Oct 22 14:45:45 2023 -0400 + + fix + +commit c85db586cadbe781704e62405a76e43650046d2c +Author: Patrick Schleizer +Date: Sun Oct 22 14:44:58 2023 -0400 + + improve + +commit 7c0ea4324aa1713f365f7352a3e4db1b703d9750 +Author: Patrick Schleizer +Date: Sun Oct 22 14:39:52 2023 -0400 + + fix + +commit b29b626b41545fd49b67631820ae40d0fe000f22 +Author: Patrick Schleizer +Date: Sun Oct 22 14:30:28 2023 -0400 + + bumped changelog version + +commit 6198ae317c4d8cbd06d95d5e2a585892f455cab6 +Author: Patrick Schleizer +Date: Sun Oct 22 14:29:02 2023 -0400 + + fix + +commit 245fad09868c2d84bee66d65ecca32704786919b +Author: Patrick Schleizer +Date: Sun Oct 22 14:00:06 2023 -0400 + + fix + +commit 619f1705e13232680f38bc630f19f2ace32f48ad +Author: Patrick Schleizer +Date: Sun Oct 22 13:58:55 2023 -0400 + + output + +commit 52fa7db0874be85a3db296499ab76f84a5f518db +Author: Patrick Schleizer +Date: Sun Oct 22 13:57:38 2023 -0400 + + output + +commit 8a592c2e371de1136d566e707ba56ce89309230a +Author: Patrick Schleizer +Date: Sun Oct 22 13:56:17 2023 -0400 + + fix remountsecure kernel parameter logic + +commit 3c183294cd8a402418eafc1e657c6524be49c487 +Author: Patrick Schleizer +Date: Sun Oct 22 13:31:55 2023 -0400 + + bumped changelog version + +commit e689f38ad0ba9727d482dbab25ea5d88e67a8edf +Author: Patrick Schleizer +Date: Sun Oct 22 13:31:44 2023 -0400 + + todo + +commit 6675a2e93194ea15daeb22bee707cf49563f69fe +Author: Patrick Schleizer +Date: Sun Oct 22 13:30:50 2023 -0400 + + fix + +commit 4288e10554f854d6dd9be092ddbf6a62686b1549 +Author: Patrick Schleizer +Date: Sun Oct 22 13:25:31 2023 -0400 + + fix, rework remount-secure kernel parameters parsing + +commit b0181af099a2bc20a6d8cc20e6e27371ecc50bf1 +Author: Patrick Schleizer +Date: Sun Oct 22 13:12:25 2023 -0400 + + fix + +commit 28cb53341d48ece9e042caea03e7159b0f93c2ee +Author: Patrick Schleizer +Date: Sun Oct 22 13:11:44 2023 -0400 + + remount-secure dracut module: improve output + +commit f70f36e6cfead0038075d715e430e15aedae459f +Author: Patrick Schleizer +Date: Sun Oct 22 12:55:41 2023 -0400 + + bumped changelog version + +commit 479ab61a1d0c91d26c2cd200d97b39b2b786e073 +Author: Patrick Schleizer +Date: Sun Oct 22 12:55:20 2023 -0400 + + remove no longer required remount-service systemd unit + +commit 84ca0ac8a0b6a72a28e030081299b402749b9348 +Author: Patrick Schleizer +Date: Sun Oct 22 12:54:25 2023 -0400 + + improve remount-secure + +commit 1696c37251fe6158118ac3a694c2e11439de5c46 +Author: Patrick Schleizer +Date: Sun Oct 22 11:28:18 2023 -0400 + + bumped changelog version + +commit e7d30955e88b0a052e9159c11f4c1e1a47dadb49 +Author: Patrick Schleizer +Date: Sun Oct 22 11:28:08 2023 -0400 + + debugging + +commit 975a017dec26f671b7869ba4ad94b3a4d2faf999 +Author: Patrick Schleizer +Date: Sun Oct 22 11:13:05 2023 -0400 + + bumped changelog version + +commit 8eb4607a0e8c3db10f64e4ed5a02e87fd3ee8903 +Author: Patrick Schleizer +Date: Sun Oct 22 11:12:54 2023 -0400 + + improve + +commit f1da0ce7461fab2eeb421daa886ddd9856c9fd52 +Author: Patrick Schleizer +Date: Sun Oct 22 11:11:10 2023 -0400 + + fix + +commit 26826e8398c4d3feed07e8e3e095a87bbde9907a +Author: Patrick Schleizer +Date: Sun Oct 22 11:06:34 2023 -0400 + + fix + +commit a423b85f81e0c066271ad7db78902ccddbeabb5a +Author: Patrick Schleizer +Date: Sun Oct 22 10:50:30 2023 -0400 + + bumped changelog version + +commit 233fa4625bb60ef65c707d28e7c8a51ef5a1d66e +Author: Patrick Schleizer +Date: Sun Oct 22 10:49:53 2023 -0400 + + output + +commit 3ebe8cf4de5c77f26f93ac40bdc596c0c38451f5 +Author: Patrick Schleizer +Date: Sun Oct 22 10:41:42 2023 -0400 + + refactoring + +commit 24d2e26397e8f1e8e350fb60206ab1c5b597cbe6 +Author: Patrick Schleizer +Date: Sun Oct 22 10:40:19 2023 -0400 + + no longer reproducible + +commit fcba70df2e4e6c71fd29852d6f0b20f80e2e2d5e +Author: Patrick Schleizer +Date: Sun Oct 22 10:38:48 2023 -0400 + + refactoring + +commit a05bd3dd0e7319807fa7ea523407ec82ce8aa39c +Author: Patrick Schleizer +Date: Sun Oct 22 10:37:02 2023 -0400 + + /home last because most likely to fail + +commit 41077c94fbc1a0c90ee870292fe82e16a70b52f1 +Author: Patrick Schleizer +Date: Sun Oct 22 10:32:24 2023 -0400 + + improve remount-secure + +commit ef69e512bd2e2eba0e292470bfef6336216e2605 +Author: Patrick Schleizer +Date: Sun Oct 22 10:25:57 2023 -0400 + + refactoring + +commit d5cb7ecec9d10069e2e37a2f88680dff6d3f6eb6 +Author: Patrick Schleizer +Date: Sun Oct 22 10:22:21 2023 -0400 + + use findmnt + +commit 1120d0652ddead556801958973d61502b75f9fc7 +Author: Patrick Schleizer +Date: Sun Oct 22 10:16:53 2023 -0400 + + bumped changelog version + +commit 45ce0ff74d8f42d6a424e0742989008403891f8a +Author: Patrick Schleizer +Date: Sun Oct 22 10:16:43 2023 -0400 + + debugging + +commit b81a991731e912fa0f7d4ca59b0531bafb02a25a +Author: Patrick Schleizer +Date: Sun Oct 22 10:15:11 2023 -0400 + + fix + +commit 292a5c3a8a37bc9dd807913bd76826e57e978b67 +Author: Patrick Schleizer +Date: Sun Oct 22 10:11:31 2023 -0400 + + fix + +commit bb57b1a289cc64cc5b2ab5518c151df5355a9f29 +Author: Patrick Schleizer +Date: Sun Oct 22 10:10:51 2023 -0400 + + fix + +commit 4f6f45fb3902f6c49d01b5ccb33a4e24804cd02a +Author: Patrick Schleizer +Date: Sun Oct 22 10:01:54 2023 -0400 + + bumped changelog version + +commit 181a6424796b1cafc87a8d74aad197135381a389 +Author: Patrick Schleizer +Date: Sun Oct 22 10:01:38 2023 -0400 + + root check + +commit 84fd41931ce3ba4d6e3785dc8052ee14ce62b80e +Author: Patrick Schleizer +Date: Sun Oct 22 09:44:17 2023 -0400 + + /var/run -> /run + +commit 33d97a2560fe4aaab24f90057e825802541a408b +Author: Patrick Schleizer +Date: Sun Oct 22 09:39:54 2023 -0400 + + improve output of remount-secure dracut module + +commit c409e3221e179437ed0b162dde1e72cd116ba795 +Author: Patrick Schleizer +Date: Sun Oct 22 09:36:03 2023 -0400 + + implement remount-secure + +commit f472ce690ae350085d40cfd5ec46084dc559a51d +Author: Patrick Schleizer +Date: Sun Oct 22 08:57:35 2023 -0400 + + comments + +commit 90f2b5e11c341c38bb0b11db603ceeba28e14b1c +Author: Patrick Schleizer +Date: Sun Oct 22 08:51:37 2023 -0400 + + code simplification + +commit 167683ce763e97838e62950f00313b63d7c968b0 +Author: Patrick Schleizer +Date: Sun Oct 22 08:50:57 2023 -0400 + + code simplification + +commit 05e9accf64a3a6bfa24aac7aaa62620f814b05d1 +Author: Patrick Schleizer +Date: Sun Oct 22 08:12:30 2023 -0400 + + bumped changelog version + +commit e065f85c8809d04a9a4c041dd8b9b81bacd04e24 +Author: Patrick Schleizer +Date: Sun Oct 22 08:10:48 2023 -0400 + + add remount-secure dracut module + +commit f0ee470ecd0fc37125165dd6a5cefb47339b14b4 +Author: Patrick Schleizer +Date: Sun Oct 22 07:51:05 2023 -0400 + + comment + +commit e257f2a3806ba7013e8e47005fde1385044bc8d9 +Author: Patrick Schleizer +Date: Sun Oct 22 07:50:14 2023 -0400 + + remount-secure: + no longer use /usr/libexec/helper-scripts/pre.bsh as not simple with dracut + +commit 27b3ba8bdf2556066a4be02cd1be9a4451a591b2 +Author: Patrick Schleizer +Date: Sun Oct 22 07:06:00 2023 -0400 + + bumped changelog version + +commit ed11c68ac64c1ec4eaa590dbb56734d450c89b04 +Author: Patrick Schleizer +Date: Sun Oct 22 06:51:52 2023 -0400 + + move remount-secure to /usr/bin/remount-secure to make it easier to manually run + +commit 6f4bf57ff2bc878f03a50d91a5db0afaf897d70e +Author: Patrick Schleizer +Date: Sun Oct 22 06:48:56 2023 -0400 + + `remount-secure`: add support for `--force`; output + +commit 6dec5cb1d6b841bc6ea92986d6567902109f5ed0 +Author: Patrick Schleizer +Date: Sun Oct 22 06:32:19 2023 -0400 + + debugging + +commit bc768aa196a08218aac0b6ef1c4ca013f2034122 +Author: Patrick Schleizer +Date: Sun Oct 22 06:31:57 2023 -0400 + + output + +commit c069c73109b45fbb8fa230ad4f90f4252db730f2 +Author: Patrick Schleizer +Date: Sun Oct 22 06:29:38 2023 -0400 + + refactoring + +commit abc35927345e14bbe4b9f13d205a648ce7a8bd8d +Author: Patrick Schleizer +Date: Sun Oct 22 06:23:48 2023 -0400 + + remount-secure: stricter error handling + +commit 59a5fea25d0b0c39a6e7b3b11f9242ebe5eaa462 +Author: Patrick Schleizer +Date: Sun Oct 22 05:41:56 2023 -0400 + + documentation + +commit ac63b0eb3db3d168908459fecd6b3275cce015bc +Author: Patrick Schleizer +Date: Sun Oct 22 05:41:11 2023 -0400 + + remove duplicate + +commit ef3f1575733c668f652326cdb4f4fba8c71bf0ed +Author: Patrick Schleizer +Date: Sat Oct 21 14:19:24 2023 -0400 + + bumped changelog version + +commit ae2c1c5a7a02a5f3f6a8bcd4a90fdc9e3b512e62 +Author: Patrick Schleizer +Date: Sat Oct 21 14:18:50 2023 -0400 + + fix xession environment variable + +commit 43375fa1f4d32f04907edf1297fef737342b49ea +Author: Patrick Schleizer +Date: Sat Oct 21 12:34:59 2023 -0400 + + bumped changelog version + +commit d543825d85a5d84274c21cd85db6df777948606e +Author: Patrick Schleizer +Date: Sat Oct 21 12:24:59 2023 -0400 + + comments + +commit dd43ab634d9ab0a59234798e1b14ba99099c65c9 +Author: Patrick Schleizer +Date: Fri Oct 13 15:22:58 2023 -0400 + + bumped changelog version + +commit 645ee814e4f3dc330dd6fb24ec4fac0e278c4f42 +Author: Patrick Schleizer +Date: Fri Oct 13 15:22:48 2023 -0400 + + fix + +commit 13a4f37e50805a0e51b8f63808e166318e39a074 +Author: Patrick Schleizer +Date: Thu Oct 12 12:51:37 2023 -0400 + + bumped changelog version + +commit 2d4524108445829d7ac80e828e9a1442cf038a6b +Author: Patrick Schleizer +Date: Thu Oct 12 11:37:01 2023 -0400 + + avoid duplicate environment variables + +commit e96e6aa38e29888a64fa35f85becc1596118a812 +Author: Patrick Schleizer +Date: Thu Oct 12 10:43:40 2023 -0400 + + bumped changelog version + +commit fa820e897895eda93011a0f2bbd915ffffcb1459 +Author: Patrick Schleizer +Date: Thu Oct 12 10:40:27 2023 -0400 + + refactoring environment variables loading mechanism + +commit 358e4226f1b3db32e560e4bbe1c663828eac7059 +Author: Patrick Schleizer +Date: Mon Jul 17 11:48:35 2023 -0400 + + bumped changelog version + +commit 81ad786dfcdd416056c6ae8a9d02231bda6fcbde +Author: Patrick Schleizer +Date: Mon Jul 17 11:19:07 2023 -0400 + + Kicksecure + +commit ab56b7ca0cf1a2cb6bc19514750ca618f4ebb7fe +Author: Patrick Schleizer +Date: Mon Jul 17 11:10:05 2023 -0400 + + Kicksecure + +commit 29aaf13c13ec1023d33e84442db0f5afeaa4436d +Author: Patrick Schleizer +Date: Fri Jun 23 08:18:12 2023 +0000 + + bumped changelog version + +commit 8a6baea99017fd971ae4a5e89599b87bc945b276 +Author: Patrick Schleizer +Date: Thu Jun 22 16:16:15 2023 +0000 + + comment + +commit 609c8c0697ecf3414e38de9d32dc367a25172802 +Author: Patrick Schleizer +Date: Wed Jun 21 09:36:44 2023 +0000 + + bumped changelog version + +commit 94a326ec7ff8704be224e76b2f3f9c2a12cbd4a7 +Author: Patrick Schleizer +Date: Wed Jun 21 09:11:31 2023 +0000 + + bookworm + +commit b610cdcbcd85ee4c433a3df0662e225b52b592cd +Author: Patrick Schleizer +Date: Fri Jun 16 11:09:02 2023 +0000 + + bumped changelog version + +commit 0c56d3d9d2dd1b40b07226b70d3d1b9343757d1a +Author: Patrick Schleizer +Date: Fri Jun 16 10:49:05 2023 +0000 + + readme + +commit 63599a09d795d82b0f069f88d73fd607129af0ef +Author: Patrick Schleizer +Date: Wed Jun 14 09:59:20 2023 +0000 + + bumped changelog version + +commit 25760f70246dd07376465d9a4222098fd24b8516 +Author: Patrick Schleizer +Date: Tue Jun 13 08:34:41 2023 +0000 + + bookworm + +commit be990188f56f059585cf70589de03afb992b9ea2 +Author: Patrick Schleizer +Date: Mon Jun 12 18:01:55 2023 +0000 + + bumped changelog version + +commit 07b3ce0bcdb6ddb72c7064f527ff4d6250b54ad2 +Author: Patrick Schleizer +Date: Mon Jun 12 16:22:32 2023 +0000 + + Standards-Version: 4.6.1.0 + +commit 4e28ace103e11373d1b5cf5de8be6b1f94c567ce +Author: Patrick Schleizer +Date: Mon May 15 17:31:59 2023 +0000 + + bumped changelog version + +commit b11a336b4ff6c748d20aade6e98b25c251bd8c8e +Merge: c921d4e9 b0b73db3 +Author: Patrick Schleizer +Date: Mon May 15 16:58:11 2023 +0000 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit b0b73db3c84f8cc7594b6b181e0e495cd7e92571 +Merge: c921d4e9 cf003dfa +Author: Patrick Schleizer +Date: Mon May 15 12:57:46 2023 -0400 + + Merge pull request #126 from raja-grewal/Comment + + Update comments + +commit cf003dfad85434f5a52524fdd97a7f619ba82429 +Author: Raja Grewal +Date: Tue May 16 02:11:44 2023 +1000 + + Update comments + +commit c921d4e915af50dd1773016b0015be584e1e3f5f +Author: Patrick Schleizer +Date: Mon May 15 11:56:30 2023 +0000 + + bumped changelog version + +commit 39676395f814007f74ce1edb0aee0ada4d4fa478 +Merge: 6511dac1 1f38fcfe +Author: Patrick Schleizer +Date: Mon May 15 11:34:57 2023 +0000 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 1f38fcfefa1ccd732e4500522cc0978bda69ab0b +Merge: d66a9bac 6ab400c9 +Author: Patrick Schleizer +Date: Mon May 15 07:34:16 2023 -0400 + + Merge pull request #125 from JeremyRand/typo + + mmap-rnd-bits: Fix typo in error message + +commit d66a9bac551e7544eed592a69f576d27880e2bf3 +Merge: 6511dac1 9d23717b +Author: Patrick Schleizer +Date: Mon May 15 07:34:00 2023 -0400 + + Merge pull request #124 from JeremyRand/doc-aslr + + README: Document mmap-rnd-bits + +commit 6ab400c9d982bde16271052f181c87255046037e +Author: Jeremy Rand +Date: Tue May 9 10:55:31 2023 +0000 + + mmap-rnd-bits: Fix typo in error message + +commit 9d23717b6d3f94d8fad5ab00628dcbf41fa2cab5 +Author: Jeremy Rand +Date: Mon May 8 13:45:18 2023 +0000 + + README: Document mmap-rnd-bits + +commit 6511dac1d4aea1800ce8e51d1f6cdbae4d31e10c +Author: Patrick Schleizer +Date: Sat May 6 12:00:12 2023 +0000 + + bumped changelog version + +commit 0c10b3f0383d69c2d504b3e346da68b056d1dca8 +Author: Patrick Schleizer +Date: Sat May 6 11:59:59 2023 +0000 + + output + +commit a815c9b9867b0ec56737e60eb1dfeec6a57af6f1 +Author: Patrick Schleizer +Date: Sat May 6 11:54:31 2023 +0000 + + bumped changelog version + +commit 5d4d04a2ebeeea7e096c1680779f2897a03838c6 +Author: Patrick Schleizer +Date: Sat May 6 11:54:00 2023 +0000 + + output + +commit 2d465c624975cc2ca308878e0ef1508316d3316e +Author: Patrick Schleizer +Date: Sat May 6 11:51:25 2023 +0000 + + refactoring + +commit b756314eb894dde4d017e0aec5876b56f0178de4 +Author: Patrick Schleizer +Date: Fri May 5 15:09:32 2023 +0000 + + bumped changelog version + +commit 014a28ba07406e5d69f86e90ddb8a27b3778c3a8 +Author: Patrick Schleizer +Date: Fri May 5 15:04:21 2023 +0000 + + comment + +commit ec01c1a99630f44a73763b019a1bad6dc52bbf4e +Author: Patrick Schleizer +Date: Fri May 5 15:02:31 2023 +0000 + + minor mmap-rnd-bits improvements + +commit 3dc406f138ee3dc81b54db2c8c4b795fc6b7c9d5 +Author: Patrick Schleizer +Date: Fri May 5 15:01:22 2023 +0000 + + minor + +commit 40e940ec58928049bb38b85d15beaead80740192 +Author: Patrick Schleizer +Date: Fri May 5 14:54:24 2023 +0000 + + minor mmap-rnd-bits improvements + +commit f4fd0f90120e8983b37bc5822cf98a215d25990e +Author: Patrick Schleizer +Date: Fri May 5 14:53:07 2023 +0000 + + minor mmap-rnd-bits improvements + +commit a8e4121befe19bb7d2f74582655a14bded23a37d +Author: Patrick Schleizer +Date: Fri May 5 14:52:07 2023 +0000 + + minor mmap-rnd-bits improvements + +commit 9184e6bb921a9c7356e8d2c7216a1da91f963304 +Author: Patrick Schleizer +Date: Fri May 5 14:51:19 2023 +0000 + + fix + +commit 89168ef40ce713b27974e4e38f6e3e63646d78bc +Author: Patrick Schleizer +Date: Fri May 5 14:49:56 2023 +0000 + + minor mmap-rnd-bits improvements + +commit d6d79e96c9a3f25b75d92a46dc97d6191d6ac691 +Author: Patrick Schleizer +Date: Fri May 5 14:44:29 2023 +0000 + + minor mmap-rnd-bits improvements + +commit 15d0ee100834e01e3f17ee179c3120f37eb3cae5 +Merge: 1137e6c9 2d40bbc8 +Author: Patrick Schleizer +Date: Fri May 5 14:37:34 2023 +0000 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 2d40bbc8fec7ceea47b64fdebc9e751b26e0cf27 +Merge: 5c6db288 48a68ba2 +Author: Patrick Schleizer +Date: Fri May 5 10:14:43 2023 -0400 + + Merge pull request #120 from JeremyRand/aslr-ppc64le + + vm.mmap_rnd_bits: Fix ppc64le + +commit 48a68ba237895c0c6c24ebd256ae6a9adec2628f +Author: Jeremy Rand +Date: Sat Apr 22 04:43:41 2023 +0000 + + mmap-rnd-bits: Handle unwritable /etc/sysctl.d/ + +commit 434cfb427f739258bd3280ce148cdbe85c800f8a +Author: Jeremy Rand +Date: Sat Apr 22 04:36:05 2023 +0000 + + mmap-rnd-bits: Check that configs are valid integers + +commit 76ca8a27f94d89ed783b900257934c0749e631ce +Author: Jeremy Rand +Date: Sat Apr 22 04:29:14 2023 +0000 + + mmap-rnd-bits: Handle missing kernel config file + +commit 2cf105700a98297f65026e43b435fe017a04ba07 +Author: Jeremy Rand +Date: Sat Apr 22 04:08:20 2023 +0000 + + postinst: Don't fail if mmap-rnd-bits fails + +commit 61f63255acdf942e52af35d7f6d1c271a671e6f7 +Author: Jeremy Rand +Date: Fri Mar 24 12:32:58 2023 +0000 + + vm.mmap_rnd_bits: Fix ppc64le + + Probably fixes a bunch of other non-x86_64 arches too. + +commit 5c6db28881463e8c764872a8cd268c23ac64b8f1 +Merge: 8a34d6c0 ed5f8be9 +Author: Patrick Schleizer +Date: Fri Mar 31 04:52:55 2023 -0400 + + Merge pull request #122 from raja-grewal/tcp + + Remove outdated comment about SACK, DSACK, and FACK + +commit 8a34d6c067bdebc513f34cd3c434b0675f118e10 +Merge: 1137e6c9 7a4212dd +Author: Patrick Schleizer +Date: Fri Mar 31 04:52:18 2023 -0400 + + Merge pull request #121 from raja-grewal/copyright + + Update Copyright + +commit ed5f8be9ebd4f34c8b8de78abe0a8df0775b80aa +Author: Raja Grewal +Date: Thu Mar 30 19:17:43 2023 +1100 + + Remove outdated comment about SACK, DSACK, and FACK + +commit 7a4212dd76c866e1db4dd4875e51c0d49bb3574d +Author: Raja Grewal +Date: Thu Mar 30 17:08:47 2023 +1100 + + Update copyright + +commit 1137e6c9104565b8f7546a9a5450ec2c2330efb7 +Author: Patrick Schleizer +Date: Mon Jan 30 05:58:47 2023 -0500 + + bumped changelog version + +commit 8c3204a5e42b0c4dc6ff9c66568ac78abc4dbd47 +Author: Patrick Schleizer +Date: Wed Jan 25 15:20:30 2023 -0500 + + comment + +commit 65c29f493b56798bc67de7ea451f8f65d99d3093 +Author: Patrick Schleizer +Date: Wed Jan 25 15:13:19 2023 -0500 + + move kexec disabling to dedicated file `/etc/sysctl.d/30_security-misc_kexec-disable.conf` + + so ram-wipe can `config-package-dev` `hide` this config file + +commit 56c7c57b3a3929f57c9173f9156b2b9f7f7f854e +Author: Patrick Schleizer +Date: Tue Jan 24 07:09:40 2023 -0500 + + bumped changelog version + +commit b87d9eb86544a7f06772a0db803711b49ec3f554 +Author: Patrick Schleizer +Date: Tue Jan 24 07:08:13 2023 -0500 + + lintian + +commit a4820086508a64156aa222d61d5f0f88bf56fb3e +Author: Patrick Schleizer +Date: Tue Jan 24 07:05:53 2023 -0500 + + bumped changelog version + +commit 7bda2ad3e8f30668428e054f57613d7c2ed2a4d6 +Author: Patrick Schleizer +Date: Tue Jan 24 06:34:17 2023 -0500 + + move ram-wipe scripts to dedicated ram-wipe package + +commit 11d0bb2c006eb7add5f9b0e70a199098972af25e +Author: Patrick Schleizer +Date: Mon Jan 9 07:05:18 2023 -0500 + + bumped changelog version + +commit c50665218776733919845044b39466c57117542d +Author: Patrick Schleizer +Date: Mon Jan 9 07:05:06 2023 -0500 + + fix + +commit b3d85f115cf486f4a2805d954ba6dd741817dd71 +Author: Patrick Schleizer +Date: Mon Jan 9 07:02:01 2023 -0500 + + bumped changelog version + +commit 6faa050dd8d26bd6436688b32bbc7a6515f9cb14 +Author: Patrick Schleizer +Date: Mon Jan 9 06:54:04 2023 -0500 + + migrate ram-wipe to dedicated package + +commit ad5d0d4b12e73b74166aafb5c34252f1e1af1854 +Author: Patrick Schleizer +Date: Mon Jan 9 06:37:45 2023 -0500 + + disable kexec (revert enabling kexec) + + remove kexec-utils for ram-wipe since moved to its own package + +commit 87c4e77c017aba7d57ae1fc7cf41a1f3143f1a04 +Author: Patrick Schleizer +Date: Mon Jan 9 06:23:00 2023 -0500 + + migrate to ram-wipe package + +commit 3867acf723f26416a047260010518829adcefc03 +Author: Patrick Schleizer +Date: Mon Jan 9 05:34:48 2023 -0500 + + bumped changelog version + +commit d769099db1dbf90350838430cda2de7196076c5d +Author: Patrick Schleizer +Date: Mon Jan 9 05:34:07 2023 -0500 + + use warn instead of info for now + + because dracut does not show info messages when kernel parameter quiet is set + +commit 7fa6946694a997e04b17ecb3a167d767543093a2 +Author: Patrick Schleizer +Date: Sun Jan 8 07:17:02 2023 -0500 + + bumped changelog version + +commit f3b84e15be40ef64969b70bc62ab4bf8d40352b6 +Author: Patrick Schleizer +Date: Sun Jan 8 07:16:18 2023 -0500 + + refactoring + +commit 96d6ca7ae01d537ab972798417b9453d57c03cd7 +Author: Patrick Schleizer +Date: Sun Jan 8 07:09:09 2023 -0500 + + improve kernel and initrd file detection + +commit 8367b27a0df2e6ea5bc2d57d1520cfdd2f4d35e2 +Author: Patrick Schleizer +Date: Sun Jan 8 07:08:18 2023 -0500 + + output + +commit da0fc9f5bd5d1551f46fb5625010b317d30274b3 +Author: Patrick Schleizer +Date: Sun Jan 8 07:07:43 2023 -0500 + + improve kernel and initrd file detection + +commit 5b11eecaecdec7487224b90708da82c10ccc4d63 +Author: Patrick Schleizer +Date: Sun Jan 8 06:45:10 2023 -0500 + + refactoring + +commit e81dd6cd25f58871c1f6b4a082f81eec34a518b5 +Author: Patrick Schleizer +Date: Sat Jan 7 18:13:57 2023 -0500 + + bumped changelog version + +commit 938b87d26c195b6804796d4fa6050a453278700c +Author: Patrick Schleizer +Date: Sat Jan 7 18:06:10 2023 -0500 + + comment + +commit 0b1310a21944939d94de18d8ac6d494446d23d0c +Author: Patrick Schleizer +Date: Sat Jan 7 18:05:47 2023 -0500 + + output + +commit 2fd302f580509842d290b2b0a27079dca445d5cd +Author: Patrick Schleizer +Date: Sat Jan 7 18:02:21 2023 -0500 + + output + +commit 921bc3e867411e5a96ca3e4641a7501038cf5139 +Author: Patrick Schleizer +Date: Sat Jan 7 17:49:24 2023 -0500 + + bumped changelog version + +commit 080abe574ba10b8365587a1c89085efe88f210ee +Author: Patrick Schleizer +Date: Sat Jan 7 17:48:21 2023 -0500 + + output + +commit 5689c07f97d2775b9445f75a10554e70875a5636 +Author: Patrick Schleizer +Date: Sat Jan 7 17:37:46 2023 -0500 + + comment + +commit 8e2db269b01e5d3c28346dd7713074a346fa3e72 +Author: Patrick Schleizer +Date: Sat Jan 7 17:36:51 2023 -0500 + + cleanup + +commit a07af631559e9c9312c263826969b5b028509a2e +Author: Patrick Schleizer +Date: Sat Jan 7 17:35:56 2023 -0500 + + output + +commit 1d22ebde08984968deb143dab244a2b6e30d45e9 +Author: Patrick Schleizer +Date: Sat Jan 7 17:23:35 2023 -0500 + + bumped changelog version + +commit 539156c0dad74c584adb02beacdcf7a3a9b8b982 +Author: Patrick Schleizer +Date: Sat Jan 7 17:23:25 2023 -0500 + + drop_caches + +commit 02f44459ad194444122e98a9f743c2725edb4e43 +Author: Patrick Schleizer +Date: Sat Jan 7 17:22:45 2023 -0500 + + DRACUT_QUIET=no + +commit abbaea582de898e48a852a0a153fe336341afe17 +Author: Patrick Schleizer +Date: Sat Jan 7 17:16:23 2023 -0500 + + bumped changelog version + +commit ab89d0e06e68fa47fa4058416a6c8700551f1b9a +Author: Patrick Schleizer +Date: Sat Jan 7 16:59:00 2023 -0500 + + cleanup + +commit 2e833b40a1af1f194ec392ff0c05b0060bb27fe8 +Author: Patrick Schleizer +Date: Sat Jan 7 16:43:09 2023 -0500 + + prevent "wait: pid 55 is not a child of this shell" + +commit 3777ecba8568cf5458b05b3eeedf98f0ba51cd69 +Author: Patrick Schleizer +Date: Sat Jan 7 16:34:19 2023 -0500 + + comment + +commit e0ded5e69d38a02f9896277a67c0d209e4ee4ad4 +Author: Patrick Schleizer +Date: Sat Jan 7 16:34:04 2023 -0500 + + comment + +commit 996c6af2d84cf23f323ca80c04fab26beea2aa1b +Author: Patrick Schleizer +Date: Sat Jan 7 16:31:23 2023 -0500 + + lower debugging + +commit 4fca8f4225f134316e734d5f85d12b9e39b99b0f +Author: Patrick Schleizer +Date: Sat Jan 7 16:28:11 2023 -0500 + + comment + +commit fa579cad8980c8d9231a9e2682267910544be175 +Author: Patrick Schleizer +Date: Sat Jan 7 16:20:48 2023 -0500 + + bumped changelog version + +commit c9107bb044e3038d837e371aa7467edcedbbdb16 +Author: Patrick Schleizer +Date: Sat Jan 7 16:11:48 2023 -0500 + + debugging + +commit b7bb24f984cb5669d9cc9b3522ee57a05070cef9 +Author: Patrick Schleizer +Date: Sat Jan 7 16:09:11 2023 -0500 + + description + +commit 2bd9cc5bc1ac94d039a7e515d3a839af820fb4be +Author: Patrick Schleizer +Date: Sat Jan 7 16:08:12 2023 -0500 + + output + +commit 2456fed3614268abfb238f3a0783719adb45b711 +Author: Patrick Schleizer +Date: Sat Jan 7 16:00:42 2023 -0500 + + output + +commit c0b5fea6806ea07b667a341b2400aacb7191b27f +Author: Patrick Schleizer +Date: Sat Jan 7 15:59:52 2023 -0500 + + protect against wipe RAM reboot loop + +commit c1b87d250c4e5decd726e7fd67b482ff1eaecbf1 +Author: Patrick Schleizer +Date: Sat Jan 7 15:37:47 2023 -0500 + + bumped changelog version + +commit 91aedb234aa7c516dca8016f6b82536cfe25f410 +Author: Patrick Schleizer +Date: Sat Jan 7 15:36:36 2023 -0500 + + output + +commit 368ad8e636ae30eb60c8f2c6ce7117970a77c021 +Author: Patrick Schleizer +Date: Sat Jan 7 15:36:05 2023 -0500 + + cleanup + +commit d8bf40f7a28f53f2f51c41b77663e5a40a5d8fb4 +Author: Patrick Schleizer +Date: Sat Jan 7 15:35:45 2023 -0500 + + refactoring + +commit 166a6863a1c249e68e3f38109b115503bc5663ec +Author: Patrick Schleizer +Date: Sat Jan 7 15:35:15 2023 -0500 + + output + +commit 20596488be39f92f069523a3d86c0e6b6ec15399 +Author: Patrick Schleizer +Date: Sat Jan 7 15:34:20 2023 -0500 + + long options + +commit 1e19c2cbad8cdf97f6bb460c90cfa330492b8019 +Author: Patrick Schleizer +Date: Sat Jan 7 15:32:25 2023 -0500 + + Depends: kexec-tools + + required for cold boot attack defense second RAM wipe after reboot + +commit b0630f58c136d6c7a964447806ec8ee603a73aa8 +Author: Patrick Schleizer +Date: Sat Jan 7 15:24:05 2023 -0500 + + debugging + +commit dde01f36634337a24d0cd37cfe5a456ff77e8b0e +Author: Patrick Schleizer +Date: Sat Jan 7 15:23:23 2023 -0500 + + long options + +commit 6e0926eece54a55502fa67c2abedf5b718e306e6 +Author: Patrick Schleizer +Date: Sat Jan 7 15:22:58 2023 -0500 + + long options + +commit 51a5f68c7654774d37986916029607da588189ab +Author: Patrick Schleizer +Date: Sat Jan 7 15:22:25 2023 -0500 + + refactoring + +commit 83800fcb4fd365aab58a5f70f78f39af7d9371dc +Author: Patrick Schleizer +Date: Sat Jan 7 15:18:58 2023 -0500 + + --no-legend + +commit 822cf646182f8ff649ea08da2fd4365022871a61 +Author: Patrick Schleizer +Date: Sat Jan 7 15:13:36 2023 -0500 + + output + +commit bb2f0a3c4421e3686477a6dff81bb87d5dcd836f +Author: Patrick Schleizer +Date: Sat Jan 7 15:12:15 2023 -0500 + + minor + +commit c3a822af0e9c8bb6c9b34b732ba48710e3ee1974 +Author: Patrick Schleizer +Date: Sat Jan 7 15:09:25 2023 -0500 + + test if readable + +commit 227871c12c57ecc5ff6d4075ea59a7dc9eca3dd3 +Author: Patrick Schleizer +Date: Sat Jan 7 15:07:34 2023 -0500 + + output + +commit c09f4da1922f40f666dae0570295b5ab5c02e8a9 +Author: Patrick Schleizer +Date: Sat Jan 7 15:06:56 2023 -0500 + + code simplification + +commit 01fee8a7b4a12c8c2be4173337decc37ec3e6019 +Author: Patrick Schleizer +Date: Sat Jan 7 15:06:31 2023 -0500 + + refactoring + +commit f675f8da0d33ab18efa782ee155a8632e9a3dc0f +Author: Patrick Schleizer +Date: Sat Jan 7 15:05:58 2023 -0500 + + quotes + +commit d0daf75db3529e206565604a63e11ee1268ed39b +Author: Patrick Schleizer +Date: Sat Jan 7 15:05:24 2023 -0500 + + quotes + +commit 8bcf7e3c235c1193f3a6d43a7c8b23b50e972de7 +Author: Patrick Schleizer +Date: Sat Jan 7 15:04:57 2023 -0500 + + minor + +commit 2cc3c6c59ca88cf44751bc2e9bb7055b46102284 +Author: Patrick Schleizer +Date: Sat Jan 7 15:04:42 2023 -0500 + + lower debugging + +commit 10932bb5d83c469f556b46f42ee517e882d87a4f +Author: Patrick Schleizer +Date: Sat Jan 7 15:04:23 2023 -0500 + + minor + +commit c88e95ce33f30f67726ac086c1b8d020b1024ebc +Author: Patrick Schleizer +Date: Sat Jan 7 15:04:07 2023 -0500 + + output + +commit 06034d2e4f97712fc84ad75e3fa8ba6bf4fccfee +Author: Patrick Schleizer +Date: Sat Jan 7 15:03:06 2023 -0500 + + fix + +commit 059ebb212d03f5d01d46362530702dbeaefdce5e +Author: Patrick Schleizer +Date: Sat Jan 7 14:35:30 2023 -0500 + + comment + +commit c0304ec029198665aaf63c843f5b7d5567f95208 +Author: Patrick Schleizer +Date: Sat Jan 7 14:35:09 2023 -0500 + + minor + +commit d5271d6250f0f6ea5adf7bc71fc48fddab1a9af4 +Author: Patrick Schleizer +Date: Sat Jan 7 14:31:40 2023 -0500 + + bumped changelog version + +commit d31c17ea047fbbd698ad9f074a00d6fba2aaf283 +Author: Patrick Schleizer +Date: Sat Jan 7 14:31:14 2023 -0500 + + fix + +commit 41d116aa2f6d5ab33a1d5889f6ae251e5b8b5538 +Author: Patrick Schleizer +Date: Sat Jan 7 14:30:12 2023 -0500 + + lintian + +commit e83ba18553832134b2f6da6ce98b0ee0c852961e +Author: Patrick Schleizer +Date: Sat Jan 7 14:29:12 2023 -0500 + + minor + +commit 53ab93d8f6553eab1682290d42faf0d466f06219 +Author: Patrick Schleizer +Date: Sat Jan 7 14:27:42 2023 -0500 + + bumped changelog version + +commit bb121e52bbab151b2104f1a333cabc3889ef47b0 +Author: Patrick Schleizer +Date: Sat Jan 7 14:27:22 2023 -0500 + + chmod +x + +commit 42ab341a58de4c54b20b8f6dc4e048ce61068cf4 +Author: Patrick Schleizer +Date: Sat Jan 7 12:57:36 2023 -0500 + + bumped changelog version + +commit d37b19fb6bb3cadbb74d011be026fd8d2653ac17 +Author: Patrick Schleizer +Date: Sat Jan 7 12:55:05 2023 -0500 + + comment + +commit 0367250dc74f9e6ec38f9da5809ff661493134a8 +Author: Patrick Schleizer +Date: Sat Jan 7 12:54:35 2023 -0500 + + comment + +commit c1df2fd601f3445a0a811a679efa7d2176026558 +Author: Patrick Schleizer +Date: Sat Jan 7 12:52:14 2023 -0500 + + comment + +commit c2b20603fdd62a3f82c842c7ebeaad0f70e005d0 +Author: Patrick Schleizer +Date: Sat Jan 7 12:49:18 2023 -0500 + + output + +commit 999a82ed946c8fd57654a0a90e2a2e53ef98a788 +Author: Patrick Schleizer +Date: Sat Jan 7 12:46:21 2023 -0500 + + output + +commit 2860560edb7951a8ac9de1c23c9655c655b40f23 +Author: Patrick Schleizer +Date: Sat Jan 7 12:43:07 2023 -0500 + + minor + +commit 450ff378b067070618e4a972f8131acac5b292e0 +Merge: 929f49f3 b8e82fff +Author: Patrick Schleizer +Date: Sat Jan 7 12:38:14 2023 -0500 + + Merge remote-tracking branch 'friedy10/master' + +commit b8e82fffca0138afaf20e1b2faf755ce1533af45 +Author: Friedrich Doku +Date: Sat Jan 7 11:31:02 2023 -0500 + + Get rid of /dev/kmsg + +commit 78a4fad6674bb11fa682b908e0d3bc63705e7d20 +Author: Friedrich Doku +Date: Sat Jan 7 11:14:31 2023 -0500 + + Change echo to info. Included more reliable way of getting initrd and kernel. Allow user custom kexec + +commit 8da3b9c40c6ee073addcc06d5227b3043438b768 +Author: Friedrich Doku +Date: Fri Jan 6 21:40:17 2023 -0500 + + fix last line + +commit 7cf51a1b433bfb2ccf4fa14b7807184e9e3681c5 +Author: Friedrich Doku +Date: Fri Jan 6 21:32:57 2023 -0500 + + Checking job queue instead of dbus + +commit 4b7053a6353cf0e092a6ef712e955b4318671bfc +Author: Friedrich Doku +Date: Fri Jan 6 13:53:28 2023 -0500 + + Update wipe-ram.sh + +commit 779ad24b573b83c08e89569e5213e018377d1535 +Author: Friedrich Doku +Date: Fri Jan 6 13:53:18 2023 -0500 + + Update wipe-ram-needshutdown.sh + +commit d45ba826bca6f5efef846de01a34a0a8c7936442 +Author: Friedrich Doku +Date: Fri Jan 6 13:53:10 2023 -0500 + + Update module-setup.sh + +commit b3d4314a069a608380ca9dd01d76c653bdb87078 +Author: Friedrich Doku +Date: Fri Jan 6 13:52:51 2023 -0500 + + Update wipe-ram.sh + +commit 33877250172349cccb2c776c1fa7aed2e8ad716f +Author: Friedrich Doku +Date: Fri Jan 6 13:52:42 2023 -0500 + + Update wipe-ram-needshutdown.sh + +commit ec68ee6ded7294c161b3d0793bf8874b12262190 +Author: Friedrich Doku +Date: Fri Jan 6 13:52:32 2023 -0500 + + Update module-setup.sh + +commit 014d10b9778907a9282ec337023f8c2b01b0ca6b +Author: Friedrich Doku +Date: Fri Jan 6 13:52:09 2023 -0500 + + Update cold-boot-attack-defense-kexec-prepare.service + +commit 62dcdcf7649175e0587a84708e8f0aa318a45d30 +Author: Friedrich Doku +Date: Fri Jan 6 13:51:45 2023 -0500 + + Update cold-boot-attack-defense-kexec-prepare + +commit f4637509205c11eddaa13151b93c961e9d345be6 +Author: Friedrich Doku +Date: Fri Jan 6 13:48:22 2023 -0500 + + Update cold-boot-attack-defense-kexec-prepare.service + +commit 14abfbfccdd3403d90a16dd5b2a1057ccf4da3d5 +Author: Friedrich Doku +Date: Fri Jan 6 13:48:03 2023 -0500 + + Update cold-boot-attack-defense-kexec-prepare + +commit 37a5264696797c0807570606361e04cb8dcb2395 +Author: Friedrich Doku +Date: Fri Jan 6 13:47:34 2023 -0500 + + Update wipe-ram.sh + +commit 7ac45acd0f3e3e0a68e3fc4036787e8e7d4ebe9f +Author: Friedrich Doku +Date: Fri Jan 6 13:47:23 2023 -0500 + + Update wipe-ram-needshutdown.sh + +commit 114a37fcd39ff20ddd9e8cca829763a9b96a8115 +Author: Friedrich Doku +Date: Fri Jan 6 13:47:14 2023 -0500 + + Update module-setup.sh + +commit 1eeb32b7b96ab1df63d808b6715fef7a6e1a9482 +Author: Friedrich Doku +Date: Fri Jan 6 13:47:01 2023 -0500 + + Update wipe-ram.sh + +commit c5accc5ad191fe54a96e12cd1f1286508da8243c +Author: Friedrich Doku +Date: Fri Jan 6 13:46:51 2023 -0500 + + Update wipe-ram-needshutdown.sh + +commit f9ebc3cfa86674025ccd65c22cde2427ea2f4ae3 +Author: Friedrich Doku +Date: Fri Jan 6 13:46:40 2023 -0500 + + Update module-setup.sh + +commit 28687092ef4f57afab5e8d32f68492799694a379 +Author: Friedrich Doku +Date: Fri Jan 6 12:52:36 2023 -0500 + + Update cold-boot-attack-defense-kexec-prepare + +commit d67d3c1d7d788fff589806457ff140e8f82089a0 +Author: Friedrich Doku +Date: Fri Jan 6 12:51:18 2023 -0500 + + Update wipe-ram.sh + +commit 7fa64d68423d24668e44eb0d7e19ccf4845ee711 +Author: Friedrich Doku +Date: Fri Jan 6 12:50:58 2023 -0500 + + Update wipe-ram-needshutdown.sh + +commit 14c7239681300edc4f715bc96c5235cddf677c60 +Author: Friedrich Doku +Date: Fri Jan 6 12:50:42 2023 -0500 + + Update module-setup.sh + +commit 73913ea5afef8354f433f7cf87c7cd64c16be0a0 +Author: Friedrich Doku +Date: Fri Jan 6 12:49:34 2023 -0500 + + Added checks + +commit a7015f4ddff892cab17f96713ddb0a720ebb7901 +Author: Friedrich Doku +Date: Fri Jan 6 10:50:34 2023 -0500 + + added files + +commit 929f49f333fc88d91ed4cef849921b0b4a69bfea +Author: Patrick Schleizer +Date: Sun Dec 18 14:37:51 2022 -0500 + + bumped changelog version + +commit 75beb52bd5b7cee4a48eead53dbbe7fac9f6cc9e +Merge: 98f753d8 58b622f0 +Author: Patrick Schleizer +Date: Sun Dec 18 06:24:41 2022 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 58b622f0fe373b6e2fb30b9564b22f1064f690b0 +Merge: 98f753d8 f81714be +Author: Patrick Schleizer +Date: Sun Dec 18 06:23:26 2022 -0500 + + Merge pull request #114 from raja-grewal/framebuffer + + Add some framebuffer drivers into blacklist + +commit f81714be506d1b15c0e79cbe8378bf8a18a2256f +Merge: d67845fe 98f753d8 +Author: Raja Grewal +Date: Tue Dec 13 05:14:56 2022 +0000 + + Merge branch 'Kicksecure:master' into framebuffer + +commit d67845fea89f4a74ed4b0a6eefbf2bf228b13a1b +Author: Raja Grewal +Date: Tue Dec 13 16:11:24 2022 +1100 + + Typo + +commit 98f753d8ffcf6673a3130d45c23b84a4c35917b1 +Author: Patrick Schleizer +Date: Thu Nov 24 07:21:58 2022 -0500 + + bumped changelog version + +commit 6d7a78262464c054c46df155605a480f1b32f22c +Author: Patrick Schleizer +Date: Thu Nov 24 07:21:46 2022 -0500 + + fix + +commit 421f03ae9e648d366146415532d4dd9dda106980 +Author: Patrick Schleizer +Date: Thu Nov 24 07:20:56 2022 -0500 + + fix + +commit ad1e722879ef049ef421f0062ee383770d66bfee +Author: Patrick Schleizer +Date: Thu Nov 24 07:00:33 2022 -0500 + + bumped changelog version + +commit a806c782d78d691617dd650808a0403ce72d4a1a +Author: Patrick Schleizer +Date: Thu Nov 24 07:00:23 2022 -0500 + + fix + +commit 4601e106c4823f2cb0dc7a8ba601670395c96326 +Author: Patrick Schleizer +Date: Thu Nov 24 06:49:26 2022 -0500 + + bumped changelog version + +commit 39b35ef9ac7489685df5486334a0acf5936e9b47 +Author: Patrick Schleizer +Date: Thu Nov 24 06:49:15 2022 -0500 + + fix + +commit 73963a9e6847fd8099093da1253267d79db7d261 +Author: Patrick Schleizer +Date: Thu Nov 24 06:31:37 2022 -0500 + + bumped changelog version + +commit d05c10172178d04781976026243297fa153125a0 +Author: Patrick Schleizer +Date: Thu Nov 24 06:31:24 2022 -0500 + + debugging + +commit 36454c2dbf43de4805f2f156b05d263c37b9615a +Author: Patrick Schleizer +Date: Thu Nov 24 06:25:47 2022 -0500 + + debugging + +commit e06b173a1be8c0e3e47a9c4bab2d94fe88d422e0 +Author: Patrick Schleizer +Date: Thu Nov 24 06:24:14 2022 -0500 + + debugging + +commit 97722d1926bc106a0645783fcb55b7d5691c873b +Author: Patrick Schleizer +Date: Thu Nov 24 06:14:15 2022 -0500 + + bumped changelog version + +commit 497b5b45442b1293b130fef63de1b84d091d27eb +Author: Patrick Schleizer +Date: Thu Nov 24 06:14:04 2022 -0500 + + fix + +commit 6f695902fb70cbbc95b71f827216ab84edcfeb83 +Author: Raja Grewal +Date: Wed Nov 23 23:53:40 2022 +1100 + + Add comment about legacy Apple fiesystems + +commit d7222b5678aa182866c389d8a88f55b6488e74e0 +Author: Patrick Schleizer +Date: Tue Nov 22 06:03:13 2022 -0500 + + bumped changelog version + +commit e5255a630ad3c9c99b6b7ffa4c7be43a44dffba9 +Author: Patrick Schleizer +Date: Tue Nov 22 05:57:30 2022 -0500 + + pam-info: support non-root environments (such as during graphical display manager login and xscreensaver) + +commit d419898ee494fb159ed6811a719dbb4a5ffb469a +Author: Patrick Schleizer +Date: Thu Nov 17 10:15:36 2022 -0500 + + bumped changelog version + +commit 09e6af5c080f776d56d7e2390f88c4ae7e01bdb7 +Author: Patrick Schleizer +Date: Wed Nov 16 02:01:23 2022 -0500 + + pam-info refactoring + +commit caf0099064747a2048363e3600a53af51df549ad +Author: Patrick Schleizer +Date: Wed Nov 16 02:00:32 2022 -0500 + + pam-info refactoring + +commit 487f63bb01c6dfc71d0e4efef2c70dae94093dce +Author: Patrick Schleizer +Date: Wed Nov 16 01:56:01 2022 -0500 + + comment + +commit f59f959a8d43ebd80a4037e65ec26df7143bcaf5 +Author: Patrick Schleizer +Date: Wed Nov 16 01:55:14 2022 -0500 + + pam-info fix + +commit ae113442a162969561a24fcf17718ceb6a11d928 +Author: Patrick Schleizer +Date: Wed Nov 16 01:49:45 2022 -0500 + + pam-info refactoring + +commit bb6b509d06a1ae34ee407cb309c530e5dddfedfd +Author: Patrick Schleizer +Date: Wed Nov 16 01:44:21 2022 -0500 + + pam-info refactoring + +commit e5d7ab7082908e64596ccd1da835a781cae22456 +Author: Patrick Schleizer +Date: Tue Nov 15 12:44:12 2022 -0500 + + comment + +commit 23b936b573c8989222a50d1ef8c35dc95589bb0e +Author: Patrick Schleizer +Date: Tue Nov 15 12:31:14 2022 -0500 + + also support /usr/local/etc/pam-info-debug + +commit 95487346dbb18c4ac9133fc21b4abed12dc346b3 +Author: Patrick Schleizer +Date: Tue Nov 15 12:29:41 2022 -0500 + + pam-info: create debug log file ~/pam-info-debug.txt + + when file /etc/pam-info-debug exists + +commit 2872c2ab52ae9a1eaa25ea8b9852401e82d5616a +Author: Patrick Schleizer +Date: Tue Nov 15 12:00:59 2022 -0500 + + comments + +commit 6033de78152cb5d7a9659f58aa8035ae2a7d6532 +Author: Patrick Schleizer +Date: Tue Nov 15 11:58:50 2022 -0500 + + debugging + +commit daa30d4e7830ba38ed52f83e6ac93c3a4e03ee33 +Author: Raja Grewal +Date: Wed Nov 9 20:43:59 2022 +1100 + + Include several framebuffer drivers into blacklist + + These were previously commented out to test for compatibility issues. + +commit 2319458e9f1a0ae2b60cf5786122c19459bbaea1 +Author: Patrick Schleizer +Date: Wed Aug 24 18:28:39 2022 -0400 + + bumped changelog version + +commit cdfc175953a8ab358bb8e6db2610df11733ba258 +Merge: ff845146 ae4d4989 +Author: Patrick Schleizer +Date: Mon Aug 22 06:09:30 2022 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit ae4d4989b0e8ea79b5661f098e9814379ff9401e +Merge: ff845146 d500205f +Author: Patrick Schleizer +Date: Mon Aug 22 06:09:40 2022 -0400 + + Merge pull request #113 from raja-grewal/master + + Comment out machine check exception + +commit d500205f556ba896417eb0bae1df0144b00ef7b9 +Author: Raja Grewal +Date: Sun Aug 21 23:03:13 2022 +1000 + + Update README.md + +commit 92669dba186c6ac40ff601fd39639945cd7633c6 +Author: Raja Grewal +Date: Sun Aug 21 23:02:44 2022 +1000 + + Comment out machine check exception + +commit ff8451469ad3b9cbd101ca4b93d72a2ac6cebe37 +Author: Patrick Schleizer +Date: Sat Aug 13 11:40:04 2022 -0400 + + bumped changelog version + +commit 272a33fe2c3c7666de96f9037094db8e9ab8e09e +Author: Patrick Schleizer +Date: Sat Aug 13 11:35:25 2022 -0400 + + addgroup -> adduser fix + +commit 7d5246693c5c07f76e3f2e29c3ed39d4910673ff +Author: Patrick Schleizer +Date: Fri Aug 12 07:52:26 2022 -0400 + + bumped changelog version + +commit 82da4ed18f5682c0cc76cd435b6de2459c7b5f83 +Author: Patrick Schleizer +Date: Thu Jul 28 09:56:24 2022 -0400 + + comments + +commit a6bee1493d4113ab63f8d0671f97989b00d23544 +Author: Patrick Schleizer +Date: Thu Jul 28 09:55:12 2022 -0400 + + cold-boot-attack-defense wait longer to make messages readable by user + +commit 109594952335f94c2a21f22d6a517ecc8b864d81 +Author: Patrick Schleizer +Date: Tue Jul 26 10:00:53 2022 -0400 + + bumped changelog version + +commit 053142cdb57f23172fd0155dde4ff4c0183c4f65 +Author: Patrick Schleizer +Date: Tue Jul 26 10:00:21 2022 -0400 + + fix + +commit 73f6523e09f12fc56da0ed3555d050686ff441f3 +Author: Patrick Schleizer +Date: Sat Jul 23 08:07:37 2022 -0400 + + bumped changelog version + +commit 0c5b1e9f577d52e2c056e786e32c14ff37db344b +Author: Patrick Schleizer +Date: Sat Jul 23 07:49:56 2022 -0400 + + undo `"force kernel to panic on "oopses"` + + because implemented differently already + + https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713 + +commit c1c04b4619eea4c79a0dbb5cced3ebb77482877c +Merge: 465775c9 bfe6b888 +Author: Patrick Schleizer +Date: Sat Jul 23 07:43:19 2022 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit bfe6b888395abf554623a9e530fe7e6605047e12 +Merge: 465775c9 ca764d8d +Author: Patrick Schleizer +Date: Sat Jul 23 07:27:24 2022 -0400 + + Merge pull request #111 from raja-grewal/harden + + Increased kernel hardening at boot + +commit ca764d8de0f17bb7e6d44e3d79ea1805276fc521 +Author: Raja Grewal +Date: Wed Jul 20 04:06:35 2022 +1000 + + force kernel to panic on "oopses" + +commit 1660aaa6dd1013ede105baebbb8ff3e1afc7b268 +Author: Raja Grewal +Date: Tue Jul 19 03:38:41 2022 +1000 + + update details around disabling SMT + +commit bfd78a2c06153ebadfee39190055edf0a13958f4 +Author: Raja Grewal +Date: Tue Jul 19 03:16:08 2022 +1000 + + update SRBDS mitigation + +commit c3ebb9160ffbbd2972cc898e3c1c0055d89beb5c +Author: Raja Grewal +Date: Tue Jul 19 02:33:16 2022 +1000 + + CPU mitigation - MMIO Stale Data + +commit 59e90ff1226bd6330d85244cf7c73ecf7fd5fdf1 +Author: Raja Grewal +Date: Tue Jul 19 02:32:41 2022 +1000 + + CPU mitigation - L1D FLushing + +commit 8531fbf99dea1b4cd806babd6072a8a1f0506eb3 +Author: Raja Grewal +Date: Tue Jul 19 02:30:49 2022 +1000 + + CPU mitigation - SRBDS + +commit 73f1e233327cc0edec83eac322b7f03bcb7fba22 +Author: Raja Grewal +Date: Tue Jul 19 02:29:46 2022 +1000 + + shuffle and rewording + +commit 39314b291263a93fcb11756ce12bd8691a1fa0f6 +Merge: bb831d57 c4a10947 +Author: Raja Grewal +Date: Tue Jul 19 00:49:08 2022 +1000 + + Merge branch 'harden' of https://github.com/raja-grewal/security-misc into harden + +commit bb831d57bcdcc8195a4b8169a4ddc25fb0c61173 +Author: Raja Grewal +Date: Tue Jul 19 00:38:32 2022 +1000 + + delete repeated commands + +commit c77a2a78bc48df2af7653a306bd1b046a8f99a6b +Author: Raja Grewal +Date: Tue Jul 19 00:37:31 2022 +1000 + + enforce default net.ipv6.icmp_ignore_bogus_error_responses + +commit c4a10947608b0d5508ef5b18e0ab34a2ee4f35de +Merge: 2b237039 465775c9 +Author: Raja Grewal +Date: Mon Jul 18 13:36:23 2022 +0000 + + Merge branch 'Kicksecure:master' into harden + +commit 465775c9dc1b97c98a5470acaffabb103ea7239f +Author: Patrick Schleizer +Date: Sat Jul 16 08:00:16 2022 -0400 + + bumped changelog version + +commit 1fafb5f53bbec57812f535e79bfb475628cc58e3 +Merge: 24d6a93e 27aa5231 +Author: Patrick Schleizer +Date: Fri Jul 15 08:09:16 2022 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 27aa5231e2d1dafd89ba19c8d6becf461e781605 +Merge: 24d6a93e a72bbb18 +Author: Patrick Schleizer +Date: Fri Jul 15 08:06:08 2022 -0400 + + Merge pull request #112 from raja-grewal/blacklist + + Corrected kernel module disabling + +commit a72bbb1883613ee56be29949c153e0edb2d72a29 +Author: Raja Grewal +Date: Wed Jul 13 23:42:13 2022 +1000 + + Corrected kerenl module disabling + +commit 24d6a93eacf5b41cfb9133471049776a16a07b03 +Author: Patrick Schleizer +Date: Wed Jul 13 08:28:34 2022 -0400 + + bumped changelog version + +commit 2b237039cf1db66100f7f0bb4880981ee0489abf +Author: Raja Grewal +Date: Wed Jul 13 22:25:53 2022 +1000 + + Update README.md + +commit 8f31e5d1d172eb117bde63702f63081da182d5c5 +Merge: 6aa9a947 c410890a +Author: Patrick Schleizer +Date: Wed Jul 13 07:26:58 2022 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit c410890a8ade6d4be13dc99a7003f03ebded8153 +Merge: 6aa9a947 fe0cc108 +Author: Patrick Schleizer +Date: Wed Jul 13 07:24:12 2022 -0400 + + Merge pull request #110 from raja-grewal/master + + Incorporated Ubuntu_s kernel module blacklists and more verbose errors + +commit 4e93b4d37e4c6d23a0ac76ddb2144c6504a66ad1 +Author: Raja Grewal +Date: Wed Jul 13 21:10:39 2022 +1000 + + Revert "enforce defualt net.ipv4.ip_forward" + + This reverts commit 57b5b2145c4e6779f0b879ee4199d46938f20965. + +commit a47922ad28fc9ebba93615a6ffdaaeb4887cc140 +Author: Raja Grewal +Date: Wed Jul 13 04:47:07 2022 +1000 + + enforce of IOMMU TLB invalidation + +commit 33df16af805597057c7aad0d5a4fb135ed9e286b +Author: Raja Grewal +Date: Wed Jul 13 04:37:03 2022 +1000 + + disables random.trust_bootloader + +commit d0779a96fc054df925523a76510c1aae5d672f96 +Author: Raja Grewal +Date: Wed Jul 13 04:36:34 2022 +1000 + + add reference + +commit 74858d257b8de40f082ce21241e680a5eeaf4053 +Author: Raja Grewal +Date: Wed Jul 13 04:34:35 2022 +1000 + + enable randomize_kstack_offset + +commit f572332108c06eb77d24e776910463e69d49acd3 +Author: Raja Grewal +Date: Wed Jul 13 04:32:03 2022 +1000 + + disable slub_debug + +commit 57b5b2145c4e6779f0b879ee4199d46938f20965 +Author: Raja Grewal +Date: Wed Jul 13 04:30:43 2022 +1000 + + enforce defualt net.ipv4.ip_forward + +commit 79156262c9e3fe92344847b627afc64b2c7f7717 +Author: Raja Grewal +Date: Wed Jul 13 04:29:42 2022 +1000 + + enforce default net.ipv4.icmp_ignore_bogus_error_responses + +commit dabcaf22e1006cc60297c55e3e254f080562d552 +Author: Raja Grewal +Date: Wed Jul 13 04:28:03 2022 +1000 + + enforce default kernel.randomize_va_space + +commit fe0cc1089086273794bd6b54df3528ff78c10f6a +Author: Raja Grewal +Date: Tue Jul 12 17:18:47 2022 +1000 + + Updated README.md + +commit 48089e5ba43b0b72449f888b98b63119ed57e2fd +Author: Raja Grewal +Date: Tue Jul 12 17:02:12 2022 +1000 + + More verbose kernel module blocking error logs + +commit 40ec791774f2a6ae7d42ccf2bfbe4a98a9963f08 +Author: Raja Grewal +Date: Tue Jul 12 16:58:16 2022 +1000 + + Updated comments + +commit ef1ef9917d896f1cd837f399def6a75704e9bfd2 +Author: Raja Grewal +Date: Sun Jul 10 04:53:25 2022 +1000 + + Blacklist automatic loading of CD-ROM modules + +commit 61ef9bd59f9ff39c140f782ff5b41d0a3c6d97bc +Author: Raja Grewal +Date: Sun Jul 10 04:52:00 2022 +1000 + + Incorporated Ubuntu_s kernel module blacklists + +commit 6aa9a9472f10d4d6270dd59fbcd94d9001aca9e6 +Author: Patrick Schleizer +Date: Sat Jul 9 11:42:24 2022 -0400 + + bumped changelog version + +commit 3b844eaab25fecf90292c88291be77abf0be694c +Author: Patrick Schleizer +Date: Sat Jul 9 11:42:11 2022 -0400 + + output + +commit 73d2c9d921c5c75ef3cca5461acc350c648f26d2 +Author: Patrick Schleizer +Date: Sat Jul 9 11:40:15 2022 -0400 + + output + +commit adfdac6dea0e8f971c59557b383d116cd51619fd +Author: Patrick Schleizer +Date: Sat Jul 9 11:40:01 2022 -0400 + + output + +commit 1df2cfd1add8b2277cb37499ced4fbb713c17668 +Author: Patrick Schleizer +Date: Sat Jul 9 11:38:37 2022 -0400 + + comment + +commit fede41e6e03c33f2f6569f03593f76edb9969e6a +Author: Patrick Schleizer +Date: Sat Jul 9 11:38:04 2022 -0400 + + fix + +commit 52c46e4706d5799d452f260616a3909c9a3bc78f +Merge: 1b8500cc dc41a581 +Author: Patrick Schleizer +Date: Sat Jul 9 11:37:41 2022 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit dc41a58102a114e21209aabeef9ad6b851365898 +Merge: 1b8500cc e5f8004a +Author: Patrick Schleizer +Date: Sat Jul 9 11:37:57 2022 -0400 + + Merge pull request #108 from Krish-sysadmin/master + + Continue for loop if unable to change one directory's permission + +commit 1b8500cc22fdd6a51ec66ae1b04abccb9a529150 +Author: Patrick Schleizer +Date: Thu Jul 7 17:41:13 2022 -0400 + + bumped changelog version + +commit 277749f27b2da8d33b70fb6f88c6757fab77e636 +Author: Patrick Schleizer +Date: Thu Jul 7 15:49:08 2022 -0400 + + genmkfile debinstfile + +commit eb8535fe870e79a5c818a38c414147819d32346d +Author: Patrick Schleizer +Date: Thu Jul 7 15:48:39 2022 -0400 + + renamed: usr/bin/disabled-by-security-misc -> bin/disabled-by-security-misc + +commit 26b2c9727f5ba6f78f5cd10c28c3561a97c81be9 +Author: Patrick Schleizer +Date: Thu Jul 7 15:39:40 2022 -0400 + + not blacklist CD-ROM / DVD yet + + https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31 + +commit d5c16503411bee4199c35a51226fc59924d6e142 +Author: Patrick Schleizer +Date: Thu Jul 7 15:28:09 2022 -0400 + + shuffle + +commit ca19d78d48ca88f5b00dcceb18ac4803c7893ca4 +Author: Patrick Schleizer +Date: Thu Jul 7 15:27:15 2022 -0400 + + shuffle + +commit d018bdaf73e109a61c0687a171af843c890729e0 +Merge: 1b287a64 780dc8ee +Author: Patrick Schleizer +Date: Thu Jul 7 15:26:08 2022 -0400 + + Merge remote-tracking branch 'raja-gerwal/master' + +commit 780dc8eec99915a7466249e219ad59c5db5f0364 +Author: Raja Grewal +Date: Fri Jul 8 04:11:25 2022 +1000 + + replace /bin/false -> /bin/disabled-by-security-misc + +commit fa2e30f5125e438250acfdc52107a936ecb7b1b4 +Author: Raja Grewal +Date: Fri Jul 8 03:04:37 2022 +1000 + + Updated descriptions of disabled modules + +commit da389d6682f6eb1d0c0172c50a4b529152384415 +Author: Raja Grewal +Date: Fri Jul 8 02:12:04 2022 +1000 + + Revert "replace /bin/false -> /bin/true" + + This reverts commit f0511635a9725f79863c41a7b8d9f8a077ba8788. + +commit 28381e81d4a57c59929a37745fa8ba5f3e0b25cb +Author: raja-grewal +Date: Thu Jul 7 09:28:30 2022 +0000 + + Update README.md + +commit f0511635a9725f79863c41a7b8d9f8a077ba8788 +Author: raja-grewal +Date: Thu Jul 7 09:27:53 2022 +0000 + + replace /bin/false -> /bin/true + +commit 18d67dbc5309a2403bece92881e671f46dc27f86 +Author: raja-grewal +Date: Thu Jul 7 09:26:55 2022 +0000 + + Blacklist more modules + +commit 1b287a6430527c762f9bf909bcda58ab52041668 +Author: Patrick Schleizer +Date: Tue Jul 5 11:16:33 2022 -0400 + + bumped changelog version + +commit 92ff868ecefed4377c5f1e99eb5e5eecbb021564 +Author: Patrick Schleizer +Date: Tue Jul 5 11:05:36 2022 -0400 + + readme + +commit b8ba6085357631fb1f346a613d7e354aaf780560 +Author: Patrick Schleizer +Date: Tue Jul 5 10:57:28 2022 -0400 + + readme + +commit 949edf3e1753fcd403015c2d0dc8f3503a7f62d2 +Author: Patrick Schleizer +Date: Tue Jul 5 10:48:58 2022 -0400 + + readme + +commit 1c0e0719483c68ce04b5c14159ad09a87c386deb +Author: Patrick Schleizer +Date: Tue Jul 5 10:45:55 2022 -0400 + + comments + +commit 5d47f5f74cc9f5e186de8db5305a44029ebbb362 +Author: Patrick Schleizer +Date: Tue Jul 5 10:45:09 2022 -0400 + + comments + +commit 435c689cf9ee9e94dec42ab3c45bc02beb8f9c40 +Author: Patrick Schleizer +Date: Tue Jul 5 10:44:28 2022 -0400 + + comments + +commit c20d588d7871bce1b8a02d46e6f658844a014572 +Author: Patrick Schleizer +Date: Tue Jul 5 10:42:37 2022 -0400 + + comments + +commit 8f03ce049a1f48bb088cf92f4f39cceb2e3a5ae6 +Author: Patrick Schleizer +Date: Tue Jul 5 10:41:55 2022 -0400 + + readme + +commit b342ce930ea14a365ba23f37642cc9c098470362 +Author: Patrick Schleizer +Date: Tue Jul 5 10:28:22 2022 -0400 + + add `/etc/default/grub.d/40_cold_boot_attack_defense.cfg` + +commit e5f8004a9401727f1be2db492ea756bc19090866 +Author: Krish-sysadmin +Date: Tue Jul 5 03:37:40 2022 +0200 + + Update hide-hardware-info + +commit 69af8be7b80dcc30e3a5d1b0a1d1aa198528b876 +Author: Patrick Schleizer +Date: Sat Jul 2 19:10:55 2022 -0400 + + drop_caches before and after sdmem + +commit 67bdd58bf2a8090a29e35b85fb4a25d42a8f8a1a +Author: Patrick Schleizer +Date: Sat Jul 2 19:07:06 2022 -0400 + + sync + +commit 01b82bf0f0b96b3e08e272b8b2e69c1b3f0dcc16 +Author: Patrick Schleizer +Date: Sat Jul 2 18:30:06 2022 -0400 + + bumped changelog version + +commit 973f117aa6a7418ea29125753f6c6b6f7e7986a4 +Author: Patrick Schleizer +Date: Sat Jul 2 18:12:36 2022 -0400 + + wipe RAM at shutdown: Ensure any remaining disk cache is erased by Linux' memory poisoning + + by running: + `echo 3 > /proc/sys/vm/drop_caches` + + Inspired by Tails: + https://gitlab.tails.boum.org/tails/tails/-/blob/master/config/chroot_local-includes/usr/local/lib/initramfs-pre-shutdown-hook + +commit e783ddc71e5e528051e1bd0fda3f60decc0af9bf +Author: Patrick Schleizer +Date: Sat Jul 2 17:37:16 2022 -0400 + + bumped changelog version + +commit 95187bd357e6f2f855afbf546da42c6229a8394e +Author: Patrick Schleizer +Date: Sat Jul 2 17:21:33 2022 -0400 + + fix + +commit 3bd87d019fb08644578d2ee73d2ac7185687f115 +Author: Patrick Schleizer +Date: Sat Jul 2 16:03:52 2022 -0400 + + bumped changelog version + +commit 148a050468658c254b67de2de61cad3e147e2178 +Author: Patrick Schleizer +Date: Sat Jul 2 16:03:45 2022 -0400 + + fix + +commit 82e7863d5b1efff2c558204bfdf04812af10660b +Author: Patrick Schleizer +Date: Sat Jul 2 16:02:28 2022 -0400 + + improvement + +commit aebca1b3dce026bbccefa38381e62f30904e5a6d +Author: Patrick Schleizer +Date: Sat Jul 2 15:52:08 2022 -0400 + + bumped changelog version + +commit 1144b39e5efcb318ad92413f623b6f039fd7a5fa +Author: Patrick Schleizer +Date: Sat Jul 2 15:50:59 2022 -0400 + + debugging + +commit c29b21c08a839d8dafe2c9654a58f2b178055935 +Author: Patrick Schleizer +Date: Sat Jul 2 15:45:19 2022 -0400 + + output + +commit ed8ce9a7d0869d62eecea7ffc59c176bec061d08 +Author: Patrick Schleizer +Date: Sat Jul 2 15:32:51 2022 -0400 + + bumped changelog version + +commit d34fe21963442c6025b56209d0ba10479cde09a6 +Author: Patrick Schleizer +Date: Sat Jul 2 15:32:42 2022 -0400 + + fix + +commit 7a448e01a1f2be432c763678742301b64739b920 +Author: Patrick Schleizer +Date: Sat Jul 2 14:27:04 2022 -0400 + + bumped changelog version + +commit 32fdcf522be994e693f39c347ab1063ccd94255b +Author: Patrick Schleizer +Date: Thu Jun 30 14:47:45 2022 -0400 + + - introduce `wiperam=skip` kernel parameter to skip wipe ram + - introduce `wiperam=force` kernel parameter to force wipe ram inside VMs + +commit 036f518ddc067461979f5b61a576b7f74b7c6e65 +Author: Patrick Schleizer +Date: Thu Jun 30 13:56:29 2022 -0400 + + improvement + +commit 0e2fae2b693d6c45344cfdf592bac0adf3338d58 +Author: Patrick Schleizer +Date: Thu Jun 30 13:50:18 2022 -0400 + + skip ram wipe inside VMs + + https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596/40 + +commit e06405c7be683450e6c6f737171b4f10513254e7 +Author: Patrick Schleizer +Date: Wed Jun 29 16:56:16 2022 -0400 + + undo + +commit 1b97d9cb766b00914769e5add699a8bdbcf1e7aa +Author: Patrick Schleizer +Date: Wed Jun 29 16:30:31 2022 -0400 + + fix + +commit 26be74bfe5c51a8ae41bb736847d3e93e7ae27d7 +Author: Patrick Schleizer +Date: Wed Jun 29 16:25:07 2022 -0400 + + bumped changelog version + +commit 92c543e71ff5386f4458102e1795132399292328 +Author: Patrick Schleizer +Date: Wed Jun 29 16:24:52 2022 -0400 + + output + +commit d4161b2748665ca3b67e5ced5ae576acb93cda46 +Author: Patrick Schleizer +Date: Wed Jun 29 16:23:42 2022 -0400 + + output + +commit 1ce7b27297bce446fb5726eba1cbb0cd3746fa85 +Author: Patrick Schleizer +Date: Wed Jun 29 16:23:12 2022 -0400 + + improvement + +commit aae4fdcffd0e3ed168975bc84db149843ffdfe47 +Author: Patrick Schleizer +Date: Wed Jun 29 16:06:33 2022 -0400 + + bumped changelog version + +commit 8b584c570af5d9ada8083af9bd80f3f992e3dceb +Author: Patrick Schleizer +Date: Wed Jun 29 16:06:22 2022 -0400 + + lintian + +commit a1f752ad00563b61a62a2dd33058365f1b6027de +Author: Patrick Schleizer +Date: Wed Jun 29 16:03:58 2022 -0400 + + bumped changelog version + +commit f5e0c1742abc009b1af95f0d106a5e1cd90d1ef4 +Author: Patrick Schleizer +Date: Wed Jun 29 16:02:05 2022 -0400 + + credits + +commit 42e24f3c241471d91af6f16b74b5bf85dfad85d7 +Author: Patrick Schleizer +Date: Wed Jun 29 15:54:49 2022 -0400 + + update file names + +commit 52aaac9b6d3a9611317e919d78840554bfce9778 +Author: Patrick Schleizer +Date: Wed Jun 29 15:53:52 2022 -0400 + + rename + +commit 619bb3cf4d347c1575c58c74adbbede94d60f79b +Author: Patrick Schleizer +Date: Wed Jun 29 15:53:24 2022 -0400 + + rename + +commit 2a8504cf1bd2a4d7e373bde3f34f6f22e3d5ebc4 +Author: Patrick Schleizer +Date: Wed Jun 29 15:51:14 2022 -0400 + + move + +commit af8b211c238f6fe83db5990dc0984d1c532456ae +Author: Patrick Schleizer +Date: Wed Jun 29 15:50:20 2022 -0400 + + improvements + +commit 0b0cda8f8f2ff1da256473115df37456273cdcdd +Author: Patrick Schleizer +Date: Wed Jun 29 15:24:40 2022 -0400 + + bumped changelog version + +commit e9cd5d934b04f7d06a14616ef52a914198f03b97 +Author: Patrick Schleizer +Date: Wed Jun 29 15:24:27 2022 -0400 + + copyright + +commit 1c51d156494e743c7ad89f76510209a97eef5e45 +Author: Patrick Schleizer +Date: Wed Jun 29 15:23:53 2022 -0400 + + lintian + +commit 4b0cd53fee691f68dd6292869b6f6870bc0b6cbe +Author: Patrick Schleizer +Date: Wed Jun 29 15:22:41 2022 -0400 + + bumped changelog version + +commit 9ab81d45810b71374520603c32812e22685f59cb +Author: Patrick Schleizer +Date: Wed Jun 29 15:22:00 2022 -0400 + + do not power off too fast so wipe ram messages can be read + +commit 19439033de840ed39039f04db7b13f6e168a627e +Author: Patrick Schleizer +Date: Wed Jun 29 15:19:56 2022 -0400 + + copyright + +commit fc202ede16ee41aceeec356ba35ba71cc7fc821d +Author: Patrick Schleizer +Date: Wed Jun 29 15:18:28 2022 -0400 + + delete no longer required `usr/lib/dracut/modules.d/40sdmem-security-misc/README.md` + +commit 6d3a08a9365207923edd2f0b6f8aebdc635d3b33 +Author: Patrick Schleizer +Date: Wed Jun 29 15:17:40 2022 -0400 + + improvements + +commit 87e5f49f8dc72f14e96cc06b924566668991037f +Author: Patrick Schleizer +Date: Wed Jun 29 14:18:02 2022 -0400 + + bumped changelog version + +commit 6eba53767f3af2436fd00b807e71a94dff813dfc +Author: Patrick Schleizer +Date: Wed Jun 29 14:17:52 2022 -0400 + + lintian + +commit 81c15e88afd11d3359ae748d5c43e7bcc8b9a855 +Author: Patrick Schleizer +Date: Wed Jun 29 14:15:48 2022 -0400 + + bumped changelog version + +commit 8a072437cc6478757a8f21f3a6a0ea51a97b978b +Author: Patrick Schleizer +Date: Wed Jun 29 14:13:30 2022 -0400 + + ram wipe on shutdown: fix, added `need_shutdown` hook + + Otherwise dracut does not run on shutdown. + + Without `need_shutdown` file `/run/initramfs/.need_shutdown` does not get created. + And without that file `/usr/lib/dracut/dracut-initramfs-restore`, + which itself is started by `/lib/systemd/system/dracut-shutdown.service` does nothing. + +commit 4d937f551f6cccf40f933576a7fa210066f1fc8a +Author: Patrick Schleizer +Date: Wed Jun 29 13:03:35 2022 -0400 + + bumped changelog version + +commit 924077e04cd0d5b06a410b2a9289047286500e8a +Author: Patrick Schleizer +Date: Wed Jun 29 13:02:53 2022 -0400 + + verbose + +commit db301dfd7feb07799a00871f0e1f8fdccef0b777 +Author: Patrick Schleizer +Date: Wed Jun 29 13:02:39 2022 -0400 + + comment + +commit 73d2ada0deb98064979ea1feedb01c6312c4b4d5 +Author: Patrick Schleizer +Date: Wed Jun 29 13:02:01 2022 -0400 + + comment + +commit 67eaf8c9167da545189390b6f0f58b0b5b20976c +Author: Patrick Schleizer +Date: Wed Jun 29 11:40:38 2022 -0400 + + comments + +commit 72908d6b0dd65d6c9691977047b2bfdaa16ba147 +Author: Patrick Schleizer +Date: Wed Jun 29 11:34:55 2022 -0400 + + comments + +commit 43ea4dbb8363c511270fd704b138633da9ad088a +Author: Patrick Schleizer +Date: Wed Jun 29 11:18:59 2022 -0400 + + bumped changelog version + +commit 295811a88f9505687447ebf605fa108bc795da46 +Author: Patrick Schleizer +Date: Wed Jun 29 11:14:52 2022 -0400 + + improvements + +commit e5d85d69efefdfcee63c8c7d4ced1ed1bf1aeee7 +Author: Patrick Schleizer +Date: Wed Jun 29 10:02:18 2022 -0400 + + bumped changelog version + +commit af8ff65f8404ac1d423ad3c28342d8fe7bc3a018 +Author: Patrick Schleizer +Date: Wed Jun 29 10:01:51 2022 -0400 + + comment + +commit cfae7de6a842b77e50f9e6f5cb1eed0eac63ff2f +Author: Patrick Schleizer +Date: Wed Jun 29 09:58:37 2022 -0400 + + lintian + +commit 83519a58c7c1eccee7544fbc3ec0cf67bda976a7 +Author: Patrick Schleizer +Date: Wed Jun 29 09:54:27 2022 -0400 + + bumped changelog version + +commit 024d52a67ebb6028d5df890e469fec5dc42be00a +Author: Patrick Schleizer +Date: Wed Jun 29 09:52:53 2022 -0400 + + improve usr/lib/dracut/modules.d/40sdmem-security-misc/module-setup.sh + +commit 29253004b6be7c7d2b3fce6cceff2df3e845f15a +Author: Patrick Schleizer +Date: Wed Jun 29 09:38:18 2022 -0400 + + minor + +commit 6f19af1542d3b6d2d6af89136ce909f7f7335ff1 +Author: Patrick Schleizer +Date: Wed Jun 29 09:35:08 2022 -0400 + + add shebang /bin/sh + + to fix lintian warning + security-misc: executable-not-elf-or-script usr/lib/dracut/modules.d/40sdmem-security-misc/wipe.sh + +commit 38cdf2722bc0aa224e1ec253e77728d4e00b9be0 +Author: Patrick Schleizer +Date: Wed Jun 29 09:32:55 2022 -0400 + + - Wipe LUKS Disk Encryption Key for Root Disk from RAM during Shutdown to defeat Cold Boot Attacks + - Confirm in console output if encrypted mounts (root disk) is unmounted. (Because that is a pre-condition for wiping the LUKS full disk encryption key from RAM.) + + Thanks to @friedy10! + + https://github.com/friedy10/dracut/tree/master/modules.d/40sdmem + + https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596 + +commit adca1ebdf6c83c5c1c846cdb29f3e16ea9cdf32f +Author: Patrick Schleizer +Date: Wed Jun 8 11:05:07 2022 -0400 + + bumped changelog version + +commit d7dd188651a5227be6b1d95e7ae9a97e0cbb34f0 +Author: Patrick Schleizer +Date: Wed Jun 8 09:27:02 2022 -0400 + + remove unicode + +commit 55d16e1602c0221dbe00996a206d0691ef93ae71 +Author: Patrick Schleizer +Date: Wed Jun 8 09:04:03 2022 -0400 + + remove unicode + +commit fcaec49675ce7e240bdd049aab184fbee0945c7d +Merge: 5c43197f 995e4ba7 +Author: Patrick Schleizer +Date: Wed Jun 8 08:20:24 2022 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 995e4ba7fafc1bf4f691b83dde415c57cebed63d +Merge: 616fe857 6e8f584d +Author: Patrick Schleizer +Date: Wed Jun 8 08:19:03 2022 -0400 + + Merge pull request #104 from ntninja/patch-1 + + Fix issues found with permission-hardening on my system + +commit 5c43197f10df3a49704a66ef3e3d56f122be4775 +Author: Patrick Schleizer +Date: Wed Jun 8 08:11:28 2022 -0400 + + minor + +commit 6e8f584d88333d3a6fec1318ba92f76e328bf7ce +Author: Kuri Schlarb <246386+ntninja@users.noreply.github.com> +Date: Wed Jun 8 05:29:42 2022 +0000 + + permission-hardening: Keep `pam_unix.so` password checking helper SetGID shadow + +commit 2bdda9d0a0a289dafb260c926d29df274c9a67da +Author: Kuri Schlarb <246386+ntninja@users.noreply.github.com> +Date: Tue Jun 7 08:18:05 2022 +0000 + + permssion-hardening: Do not skip config file lines without trailing newline (ancient bash bug) + +commit 3910e4ee159d8b5f80c5086915583e4e20ecd6fe +Author: Kuri Schlarb <246386+ntninja@users.noreply.github.com> +Date: Tue Jun 7 08:11:51 2022 +0000 + + permission-hardening: Keep `passwd` executable but non-SetUID + +commit 9fd8e1c9b0250c9e00b555838bd381f162dfd8c4 +Author: Kuri Schlarb <246386+ntninja@users.noreply.github.com> +Date: Tue Jun 7 08:03:56 2022 +0000 + + permission-hardening: Fix issue with pipelining failures causing incorrect user/group lookup results + +commit 616fe857f7a5cde1f4ad0d31e03876dcd2ab7f0f +Author: Patrick Schleizer +Date: Wed May 25 06:07:17 2022 -0400 + + bumped changelog version + +commit 7e2efe0155b97955428e64181c9a6b32402ee9db +Author: Patrick Schleizer +Date: Fri May 20 15:27:10 2022 -0400 + + readme + +commit 2d37e3a1af3739eedd9191a0f0c78a2762c5fa38 +Author: Patrick Schleizer +Date: Fri May 20 14:46:38 2022 -0400 + + copyright + +commit 78a9956b73498bad471ee1cb0fa0993f2e5ce3c0 +Merge: 4a3ed171 76513087 +Author: Patrick Schleizer +Date: Thu May 19 19:41:33 2022 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 76513087872943442df32451de5af158c2bbe944 +Merge: 4a3ed171 93efa506 +Author: Patrick Schleizer +Date: Thu May 19 19:39:42 2022 -0400 + + Merge pull request #103 from 0xC0ncord/bugfix/selinuxfs_restrictions + + hide-hardware-info: re-enable restrictions on sysfs when using SELinux + +commit 4a3ed17160c14ba7122d770665b53bde96038307 +Author: Patrick Schleizer +Date: Thu May 19 17:25:58 2022 -0400 + + readme + +commit bb0307290b59d0273f9ad585e881c91071e3edea +Author: Patrick Schleizer +Date: Sat Apr 16 14:18:35 2022 -0400 + + update link + +commit 2677db34baeb120a402b684d4a62ccf616b5528c +Author: Patrick Schleizer +Date: Sun Apr 10 12:40:16 2022 -0400 + + readme + +commit 93efa506dac6135f1a5c260ec95d985e7fedc53d +Author: 0xC0ncord +Date: Thu Mar 17 11:41:57 2022 -0400 + + hide-hardware-info: disable selinux whitelist by default + +commit 0051a6935acd2f452a9189d1581ccac7377dd23d +Author: Patrick Schleizer +Date: Thu Feb 10 14:06:54 2022 -0500 + + bumped changelog version + +commit b0a0004a85387a4f7520a688f6d2a9826d8e68fb +Author: Patrick Schleizer +Date: Thu Feb 10 13:47:10 2022 -0500 + + output + +commit 4f6f588fb53d2756d867ac7e29fb42f4f8fdb335 +Author: Patrick Schleizer +Date: Thu Feb 10 13:44:55 2022 -0500 + + fix, skip deletion of system.map files on read-only filesystems + + This is required for Qubes /lib/modules read-only implementation at time of writing. + + Thanks to @marmarek for the bug report! + + https://forums.whonix.org/t/remove-system-map-cannot-work-lib-modules-is-mounted-read-only/13324 + +commit 356232677a036cd1a673d805caa4d74a327ea096 +Author: Patrick Schleizer +Date: Tue Nov 9 14:32:33 2021 -0500 + + readme + +commit 4172232eb75aaca301e51529e49df76ca86b93b3 +Author: 0xC0ncord +Date: Fri Oct 8 22:17:12 2021 -0400 + + hide-hardware-info: make indentation consistent + +commit 060d7d890a0292addaa1e85bb1b2ff7eece23378 +Author: 0xC0ncord +Date: Fri Oct 8 22:11:58 2021 -0400 + + hide-hardware-info: re-enable restrictions on sysfs when using SELinux + + When using SELinux, restrict the parts of sysfs explicitly to ensure + restrictions are working as expected. + +commit 96026a5e90a56cade2dff5f3dfc3687687e92c56 +Author: Patrick Schleizer +Date: Tue Sep 14 14:18:52 2021 -0400 + + bumped changelog version + +commit c72567dbd215fcd60c4719fe1ebc9a0f350a2b97 +Author: Patrick Schleizer +Date: Tue Sep 14 14:18:44 2021 -0400 + + fix + +commit 03276fbec502df9e9fc228a0c05f3c85fd1483af +Author: Patrick Schleizer +Date: Sun Sep 12 11:57:20 2021 -0400 + + bumped changelog version + +commit d62bbaab82a33a485a82d42d8db5674d200a1c3d +Author: Patrick Schleizer +Date: Sun Sep 12 11:40:58 2021 -0400 + + fix, unduplicate kernel command line + +commit fb0540650c26689165b2fd0558b87ef7c3154a6e +Author: Patrick Schleizer +Date: Sat Sep 11 16:33:14 2021 -0400 + + readme + +commit 64e9f0016aa5804740a099890a5ef648dde07883 +Author: Patrick Schleizer +Date: Thu Sep 9 12:35:37 2021 -0400 + + bumped changelog version + +commit bd31b4085c853d8b182e3a13534827a695f5493a +Author: Patrick Schleizer +Date: Thu Sep 9 12:16:18 2021 -0400 + + remove Debian buster support in /etc/default/grub.d + +commit d16d9a545502af1ec25a165a27bdbc1033b97d59 +Author: Patrick Schleizer +Date: Mon Sep 6 09:46:20 2021 -0400 + + bumped changelog version + +commit ac0c492663b9d90f99e5969193b35b53d4175d1d +Author: Patrick Schleizer +Date: Mon Sep 6 08:22:55 2021 -0400 + + do not set kernel parameter `quiet loglevel=0` for recovery boot option + + for easier debugging + +commit 49902b8c56512c3ee8b3d16b0ca513e44349c66d +Author: Patrick Schleizer +Date: Mon Sep 6 08:19:41 2021 -0400 + + move grub quiet to separate config file /etc/default/grub.d/41_quiet.cfg + +commit bb3a3178f17d1b882f38ba18db7835833f758805 +Author: Patrick Schleizer +Date: Mon Sep 6 04:55:23 2021 -0400 + + bumped changelog version + +commit f5b0e4b5b856ba6fa0dea7fa18c38221d972e8a3 +Author: Patrick Schleizer +Date: Mon Sep 6 04:55:16 2021 -0400 + + debugging + +commit a67d1754d459a221930cb92754b51bec348f8035 +Author: Patrick Schleizer +Date: Sun Sep 5 16:04:28 2021 -0400 + + bumped changelog version + +commit 6257bfa926f960b3b772dd528fe6004f81d990ea +Author: Patrick Schleizer +Date: Sun Sep 5 15:54:20 2021 -0400 + + debugging + +commit 1b09d5671829c51bd17f44410d4122b6de7aa6e9 +Author: Patrick Schleizer +Date: Sat Sep 4 18:29:00 2021 -0400 + + bumped changelog version + +commit a4e18a2ae8c19a664bb1be5bc4ec43f10a876969 +Author: Patrick Schleizer +Date: Sat Sep 4 18:28:37 2021 -0400 + + `dracut` `reproducible=yes` + +commit 1a10293b0408a4197620ce78cffb62cb8c00908c +Author: Patrick Schleizer +Date: Sat Sep 4 12:00:55 2021 -0400 + + bumped changelog version + +commit e2810f348b413bb307449a911c12a46924686a9f +Author: Patrick Schleizer +Date: Sat Sep 4 11:50:31 2021 -0400 + + Depends: libpam-modules-bin + +commit 3c64ec8f917ed1237454d1526647a84bf00c9e83 +Author: Patrick Schleizer +Date: Thu Sep 2 14:36:53 2021 -0400 + + bumped changelog version + +commit be8c10496f26d33378deb2427e56892771456ee5 +Author: Patrick Schleizer +Date: Wed Sep 1 15:55:53 2021 -0400 + + fix faillock implementation + + dovecot / ssh are exempted + +commit 8b104f544a9e4e8da1691659fefa4999a4f6f085 +Author: Patrick Schleizer +Date: Wed Sep 1 15:45:36 2021 -0400 + + fix, add sshd to pam_service_exclusion_list + + to avoid faillock + +commit 224ae730c13f4add672fffaf58206eeb7ae24090 +Author: Patrick Schleizer +Date: Sun Aug 22 05:32:18 2021 -0400 + + bumped changelog version + +commit db43cedcfdf918556ae3989209a4d984527a6416 +Author: Patrick Schleizer +Date: Sun Aug 22 05:23:24 2021 -0400 + + LANG=C str_replace + +commit ef2b067c0385dbae7b16bc79a10582995d8ba5fe +Author: Patrick Schleizer +Date: Tue Aug 17 15:24:12 2021 -0400 + + bumped changelog version + +commit 08adf4a07d97940ef924f53863ec4aa62f88fb04 +Author: Patrick Schleizer +Date: Tue Aug 17 15:23:49 2021 -0400 + + readme + +commit 7d73b3ffa0bf13ba78debfb7f099758b0d0fbef3 +Author: Patrick Schleizer +Date: Tue Aug 17 15:21:26 2021 -0400 + + add hardened malloc compatibility for haveged workaround + + `/lib/systemd/system/haveged.service.d/30_security-misc.conf` + + `SystemCallFilter=getrandom` + + Otherwise haveged will exit with a core dump. + +commit 8676beef90040bdf0782e0a9c683c6463ddb48b5 +Author: Patrick Schleizer +Date: Tue Aug 10 18:26:32 2021 -0400 + + bumped changelog version + +commit 582492d6d8c5f756be4d809898707cb196c5c765 +Author: Patrick Schleizer +Date: Tue Aug 10 17:13:00 2021 -0400 + + port from pam_tally2 to pam_faillock + + since pam_tally2 was deprecated upstream + +commit 2bf0e7471cbd3b813ce385d994e43e48636f7a0b +Author: Patrick Schleizer +Date: Tue Aug 10 15:11:01 2021 -0400 + + port from pam_tally2 to pam_faillock + + since pam_tally2 was deprecated upstream + +commit 2aea74bd715d865f44f91aaab6ca1bf0a00a2b0b +Author: Patrick Schleizer +Date: Tue Aug 10 15:06:04 2021 -0400 + + renamed: usr/libexec/security-misc/pam_tally2-info -> usr/libexec/security-misc/pam-info + renamed: usr/libexec/security-misc/pam_tally2_not_if_x -> usr/libexec/security-misc/pam_faillock_not_if_x + renamed: usr/share/pam-configs/tally2-security-misc -> usr/share/pam-configs/faillock-security-misc + +commit 6376bbff801f79dbb154611c3ad330b4cd863f69 +Author: Patrick Schleizer +Date: Thu Aug 5 17:03:43 2021 -0400 + + bumped changelog version + +commit 3756016f42d97c6bf32c9bf5fed02904a63f4a5c +Author: Patrick Schleizer +Date: Tue Aug 3 13:04:34 2021 -0400 + + `lintian --suppress-tags obsolete-command-in-modprobe.d-file` + + https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/24 + +commit 50bdd097df4c87cd4507311df9c0b14d237c534b +Author: Patrick Schleizer +Date: Tue Aug 3 12:56:31 2021 -0400 + + move /usr/lib/security-misc to /usr/libexec/security-misc as per lintian FHS + +commit 4fadaad8c0a79df5996372c05db635d500e41fee +Author: Patrick Schleizer +Date: Tue Aug 3 12:52:10 2021 -0400 + + lintian FHS + +commit 6607c1e4bd085ee952952e6db17714326df4b7f6 +Author: Patrick Schleizer +Date: Tue Aug 3 12:48:57 2021 -0400 + + move /usr/lib/helper-scripts and /usr/lib/curl-scripts to /usr/libexec/helper-scripts as per lintian FHS + +commit 0492f28aa10dc93063ff3b46107fa705c5ee0d7e +Author: Patrick Schleizer +Date: Tue Aug 3 12:37:39 2021 -0400 + + enable "`apt-get --error-on=any`" by default + + makes apt exit non-zero for transient failures + + `/etc/apt/apt.conf.d/40error-on-any` + + https://forums.whonix.org/t/debian-bullseye-apt-get-error-on-any/12068 + +commit 240ec7672a4d513e7e6cca280aca3d67c265d1cc +Author: Patrick Schleizer +Date: Tue Aug 3 12:19:26 2021 -0400 + + replace no longer required `/usr/lib/security-misc/apt-get-wrapper` with `apt-get --error-on=any` + +commit 8eae6356684052415f8bc494db077e033653d971 +Author: Patrick Schleizer +Date: Tue Aug 3 11:51:31 2021 -0400 + + update lintian tag name + +commit 5e3338f8d3ff799a2da4257e24b57bd55541187f +Author: Patrick Schleizer +Date: Tue Aug 3 05:48:25 2021 -0400 + + bullseye + +commit bb3e65f7a80770238bda3733bed89c15a9c76852 +Author: Patrick Schleizer +Date: Tue Aug 3 03:25:35 2021 -0400 + + bullseye + +commit c94281121e20289b718f24c13e399e5e8cac0ebd +Author: Patrick Schleizer +Date: Sun Aug 1 16:37:02 2021 -0400 + + comment + +commit 3599e8e2dabf13ad76901a9c282469f23d4d1308 +Author: Patrick Schleizer +Date: Sun Aug 1 16:24:41 2021 -0400 + + readme + +commit 82f3961a7165cc1e778be785950f1a255af43b4f +Author: Patrick Schleizer +Date: Sun Aug 1 13:12:08 2021 -0400 + + bumped changelog version + +commit 5a65c35479f267b026c03e195658ef9d98ee519c +Author: Patrick Schleizer +Date: Sun Aug 1 13:11:18 2021 -0400 + + port LKRG compatibility settings automation for VirtualBox hosts from systemd to dpkg trigger + +commit f03c7978c7c12eb0efed1d9298f52149a8149cb3 +Author: Patrick Schleizer +Date: Sun Jul 25 11:31:45 2021 -0400 + + bumped changelog version + +commit b3e34f7f43346c123d20e9a1606b1023b535f669 +Author: Patrick Schleizer +Date: Sun Jul 25 11:27:07 2021 -0400 + + comment + +commit 7e128636b3a4ea7fe5dfa12018685ab7b5dda706 +Author: Patrick Schleizer +Date: Sun Jul 25 11:26:20 2021 -0400 + + improve LKRG VirtualBox host configuration + + as per https://github.com/openwall/lkrg/issues/82#issuecomment-886188999 + +commit 3ebe9e7c530b39f1b0429a97eab2627f2bbd1635 +Author: Patrick Schleizer +Date: Sat Jul 24 18:10:06 2021 -0400 + + bumped changelog version + +commit 257cef24baa038b21ef511e9d95c4229a5e16f68 +Author: Patrick Schleizer +Date: Sat Jul 24 18:03:40 2021 -0400 + + add LKRG compatibility settings automation for VirtualBox hosts + + https://github.com/openwall/lkrg/issues/82 + +commit 0f86ffef04e533be1c88584b6419c276d176fc05 +Author: Patrick Schleizer +Date: Wed Jun 23 11:20:39 2021 -0400 + + bumped changelog version + +commit 74e39cbf690dae2bf72bd9f152ea91c364f5feff +Author: Patrick Schleizer +Date: Sun Jun 20 11:18:56 2021 -0400 + + pam-abort-on-locked-password: more descriptive error handling + + https://forums.whonix.org/t/restrict-root-access/7658/1 + +commit 0f3dbfc4a1fb08b5542e265dfbeab4e7f401549d +Author: Patrick Schleizer +Date: Sun Jun 20 10:16:57 2021 -0400 + + bumped changelog version + +commit eff5af03184f52181894884b90a8d867a1f10956 +Author: Patrick Schleizer +Date: Sun Jun 20 10:16:33 2021 -0400 + + https://forums.whonix.org/t/restrict-root-access/7658/116 + +commit 419f1d89c25ca833ac63f2e174beeb9afb0cce00 +Author: Patrick Schleizer +Date: Mon Jun 7 12:13:37 2021 -0400 + + bumped changelog version + +commit 30d1ce36af7835d47e0b53af475f3a7e99617b77 +Merge: 0305baf2 70a1eb25 +Author: Patrick Schleizer +Date: Mon Jun 7 12:11:58 2021 -0400 + + Merge remote-tracking branch 'github-whonix/master' + +commit 70a1eb25a5976e0461056ff2c56bd82ab5df6c2c +Merge: 0305baf2 97d8db3f +Author: Patrick Schleizer +Date: Sat Jun 5 15:55:41 2021 -0400 + + Merge pull request #101 from madaidan/sudo + + Restrict sudo's file permissions + +commit 97d8db3f74b9fc00c8f4416cb72966e62c7de88e +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Sat Jun 5 19:16:42 2021 +0000 + + Restrict sudo's file permissions + +commit 0305baf21173f0ee292986200f1242ca0395c74d +Author: Patrick Schleizer +Date: Tue Jun 1 07:36:59 2021 -0400 + + bumped changelog version + +commit d87bee37f788fb7605626cd4a8d61ed9e6fee252 +Author: Patrick Schleizer +Date: Tue Jun 1 07:21:18 2021 -0400 + + comment + +commit 809930c0212aa41d60b1a498bd4ce85f06668bae +Author: Patrick Schleizer +Date: Tue Jun 1 05:36:01 2021 -0400 + + comment + +commit 5bd59991cbf72ba9ebd8feadd4da397bbcd9d469 +Author: Patrick Schleizer +Date: Wed May 5 08:37:56 2021 -0400 + + bumped changelog version + +commit 6e759f9196412b1742db1e4c68a70867e1ad8629 +Author: Patrick Schleizer +Date: Thu Apr 29 11:17:30 2021 -0400 + + config-package-dev displace /etc/dkms/framework.conf + + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 + +commit e2afd00627b097f75467cd0e2fe7e15977141026 +Author: Patrick Schleizer +Date: Thu Apr 29 11:14:30 2021 -0400 + + modify DKMS configuration file `/etc/dkms/framework.conf` + + Lower parallel compilation jobs to 1 if less than 2 GB RAM to avoid freezing of virtual machines. + + `parallel_jobs=1` + + This does not necessarily belong into security-misc, however likely + security-misc will need to modify `/etc/dkms/framework.conf` in the future to + enable kernel module signing. + + https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/26 + + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 + +commit 3ba3b371873d221db6845fb0fe52191b8b349b0a +Author: Patrick Schleizer +Date: Thu Apr 29 11:08:30 2021 -0400 + + add `/etc/dkms/framework.conf.security-misc` + + original, from + - https://github.com/dell/dkms/blob/master/dkms_framework.conf + - https://raw.githubusercontent.com/dell/dkms/master/dkms_framework.conf + + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 + +commit 1d35bdf2912d1dfd0b49ce727338f86d17decd72 +Author: Patrick Schleizer +Date: Mon Apr 5 11:58:47 2021 -0400 + + bumped changelog version + +commit 41734ec523eb3cd233fe4651b9807222c8ccb1d5 +Author: Patrick Schleizer +Date: Sat Apr 3 11:44:13 2021 -0400 + + systemd RemainAfterExit=yes + + for better usability + + https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/33 + +commit e8ea94325b1df7bc0c47eabdfbd7c24b2fe51539 +Author: Patrick Schleizer +Date: Wed Mar 17 12:31:34 2021 -0400 + + bumped changelog version + +commit a67007f4b7b7763a0b131acb246cfe84ac65540f +Author: Patrick Schleizer +Date: Wed Mar 17 09:45:21 2021 -0400 + + copyright + +commit 0c4a7207e46933a504badfb9c1ce26a9ef82d370 +Author: Patrick Schleizer +Date: Thu Mar 4 07:09:01 2021 -0500 + + bumped changelog version + +commit a1819e8cabc45ea197da7e3a4a94ffbab1376423 +Author: Patrick Schleizer +Date: Mon Mar 1 09:15:44 2021 -0500 + + comment + +commit 3382192b89de3891d45261f138652bdb48c5674b +Merge: 7f30d702 2e8e3c07 +Author: Patrick Schleizer +Date: Mon Mar 1 09:12:18 2021 -0500 + + Merge remote-tracking branch 'github/master' + +commit 2e8e3c07c4dda7f8500237dfa7a1d2bc7aecef5d +Merge: 7f30d702 4db7d6be +Author: Patrick Schleizer +Date: Mon Mar 1 14:11:28 2021 +0000 + + Merge pull request #100 from 0xC0ncord/bugfix/selinuxfs_restrictions + + hide-hardware-info: allow unrestricting selinuxfs + +commit 7f30d702953b2e46255e3e8e71ee47af3f5a5725 +Author: Patrick Schleizer +Date: Sat Feb 6 06:31:45 2021 -0500 + + bumped changelog version + +commit 83c0be5177929b67e3c9eba18c02904498d378cb +Author: Patrick Schleizer +Date: Sat Feb 6 06:27:54 2021 -0500 + + readme + +commit 4db7d6be643f9e7c9c3b81d3945b8d2c3e4c5269 +Author: Kenton Groombridge +Date: Sat Feb 6 03:02:08 2021 -0500 + + hide-hardware-info: allow unrestricting selinuxfs + + On SELinux systems, the /sys/fs/selinux directory must be visible to + userspace utilities in order to function properly. + +commit 3120ff3ec98edecdc2855261d3ba26cad8803c74 +Author: Patrick Schleizer +Date: Fri Jan 29 23:37:03 2021 -0500 + + bumped changelog version + +commit af3244741dba7425148378aacf853e82deddee1f +Author: Patrick Schleizer +Date: Fri Jan 29 23:15:52 2021 -0500 + + comment + +commit d9aaf5910553b04b965ea729476b586d72043aea +Author: Patrick Schleizer +Date: Thu Jan 28 02:15:46 2021 -0500 + + bumped changelog version + +commit b0b7f569ee7da1101c9100c1b053b910f8660436 +Author: Patrick Schleizer +Date: Thu Jan 28 02:11:54 2021 -0500 + + comment + +commit f2595cc2542b326a74d4c651897160c04bd1e162 +Author: Patrick Schleizer +Date: Wed Jan 27 05:50:16 2021 -0500 + + bumped changelog version + +commit 9622f28e255a101ee7239e3ffd42d8d80637654a +Author: Patrick Schleizer +Date: Wed Jan 27 05:49:34 2021 -0500 + + skip counting failed login attempts from dovecot + + Failed dovecot logins should not result in account getting locked. + + revert "use pam_tally2 only for login" + +commit 480f74cab6d79886fe29eeecc5b7ebc1f138f8dd +Author: Patrick Schleizer +Date: Sun Jan 24 05:10:36 2021 -0500 + + bumped changelog version + +commit 6757104aa4d1e661b046e71f7bda511d73e83d61 +Author: Patrick Schleizer +Date: Sun Jan 24 05:04:48 2021 -0500 + + use pam_tally2 only for login + + to skip counting failed login attempts over ssh and mail login + +commit 126c31c37d17a55b0980dcae8c546aeed4282a99 +Author: Patrick Schleizer +Date: Tue Jan 19 19:41:43 2021 -0500 + + bumped changelog version + +commit 14d13fb03ed627cfb378873ad46f4d3ac795a9f6 +Author: Patrick Schleizer +Date: Tue Jan 19 19:41:42 2021 -0500 + + readme + +commit 611fbe2c619d9b5fab748faf2b0f59274a914187 +Author: Patrick Schleizer +Date: Mon Jan 18 05:39:34 2021 -0500 + + description + +commit 0e8ea5eb727d609d70e8f639dde62583a3ff47f3 +Author: Patrick Schleizer +Date: Thu Jan 14 02:36:49 2021 -0500 + + bumped changelog version + +commit ddd62c1eef031c2befc626acbe4d48d8cdbea1d0 +Author: Patrick Schleizer +Date: Tue Jan 12 03:24:11 2021 -0500 + + readme + +commit 468d8b600dda7cce87bbdf972244ef2f610935d5 +Author: Patrick Schleizer +Date: Tue Jan 12 03:20:58 2021 -0500 + + readme + +commit b5cee63999a7277b32f3850a5d8821c73ed05933 +Author: Patrick Schleizer +Date: Tue Jan 12 03:19:31 2021 -0500 + + new file: README_generic.md + +commit 94627f0875e69c9314faab8b0dc2dbe22af5c88f +Merge: 353e74fb 79876f7b +Author: Patrick Schleizer +Date: Tue Jan 12 03:18:41 2021 -0500 + + Merge remote-tracking branch 'github/master' + +commit 79876f7b1261006885a713dbfda97609c8e81f3f +Merge: 353e74fb 3066b5ad +Author: Patrick Schleizer +Date: Tue Jan 12 08:17:04 2021 +0000 + + Merge pull request #99 from madaidan/docs + + Overhaul documentation + +commit 3066b5ad972f16069361999afbca0978986db862 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Tue Jan 12 02:17:13 2021 +0000 + + Overhaul documentation + +commit 353e74fb5f0c150b9de3554b88619480c338ef59 +Author: Patrick Schleizer +Date: Tue Jan 5 08:30:37 2021 -0500 + + bumped changelog version + +commit a258f35f385aff7b6fef71e23b94c4681e52bed2 +Author: Patrick Schleizer +Date: Tue Jan 5 02:11:08 2021 -0500 + + comment + +commit a4d7e4614174e6f0357a068af0b7fd46e963a89f +Author: Patrick Schleizer +Date: Thu Dec 10 05:20:57 2020 -0500 + + bumped changelog version + +commit c5097ed599078091aef1fcb63b237d9835040c34 +Author: Patrick Schleizer +Date: Sun Dec 6 04:23:09 2020 -0500 + + comment + +commit b2b614ed2a1a62ff4c917aba80eeef505810dbf8 +Author: Patrick Schleizer +Date: Sun Dec 6 04:15:52 2020 -0500 + + cover more folders in /usr/local + +commit 5bd267d7747521fa5bb053da19dc79991e2c4bb5 +Author: Patrick Schleizer +Date: Sun Dec 6 04:10:50 2020 -0500 + + refactoring + +commit 11cdce02a048b323c6f56cb15f98e6060aab8346 +Author: Patrick Schleizer +Date: Sun Dec 6 04:10:10 2020 -0500 + + refactoring + +commit f73c55f16c10ee2cd0532f4032cec56c484bd4d5 +Author: Patrick Schleizer +Date: Sun Dec 6 04:08:58 2020 -0500 + + /opt + + https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706/68 + +commit 261ef85c14ff9c13d3d7734d8c9eba5a54497187 +Author: Patrick Schleizer +Date: Tue Dec 1 05:53:06 2020 -0500 + + bumped changelog version + +commit c031f22995a1e073bd81189ee97a3de32a2b278f +Author: Patrick Schleizer +Date: Tue Dec 1 05:14:48 2020 -0500 + + SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists + + `whitelists_disable_all=true` + +commit b09cc0de6af2d7e12110a0f3030234539288abad +Author: Patrick Schleizer +Date: Tue Dec 1 05:10:26 2020 -0500 + + Revert "SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists" + + This reverts commit 36a471ebce883f7a1660977f486b21ece320d0c2. + +commit 704f0500ba4e23a1e5b33688db02e03b1169046d +Author: Patrick Schleizer +Date: Tue Dec 1 05:03:16 2020 -0500 + + fix, rename 40_default_whitelist_[...].conf to 25_default_whitelist_[...].conf + + since whitelist needs to be defined before SUID removal commands + +commit 36a471ebce883f7a1660977f486b21ece320d0c2 +Author: Patrick Schleizer +Date: Tue Dec 1 05:02:34 2020 -0500 + + SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists + + `whitelists_disable_all=true` + +commit 318ab570aacd48b7f163331dc2ba8b012e0d2336 +Author: Patrick Schleizer +Date: Tue Dec 1 04:28:15 2020 -0500 + + simplify disabling of SUID Disabler and Permission Hardener whitelist + + split `/etc/permission-hardening.d/30_default.conf` into multiple files + + `/etc/permission-hardening.d/40_default_whitelist_[...].conf` + + therefore make it easier to delete any whitelisted SUID binaries + +commit cf07e977bd6697af7a4326d7705447d500d35593 +Author: Patrick Schleizer +Date: Sun Nov 29 09:09:42 2020 -0500 + + add `/bin/pkexec exactwhitelist` for consistency + + since there is already `/usr/bin/pkexec exactwhitelist` + +commit fe274838861ada125eccdca11ba044123fdae663 +Author: Patrick Schleizer +Date: Sat Nov 28 06:08:10 2020 -0500 + + bumped changelog version + +commit 28a326a8a14f56d588ed6f2b4d7d748d53120109 +Author: Patrick Schleizer +Date: Sat Nov 28 05:31:12 2020 -0500 + + add feature `/usr/lib/security-misc/permission-hardening-undo /path/to/filename` + + to allow removing 1 SUID + + fix, show INFO message if file does not exist during removal rather than ERROR + +commit 0ef35f877066ddac21737e707829c4571bb76abd +Author: Patrick Schleizer +Date: Fri Nov 6 10:18:09 2020 -0500 + + bumped changelog version + +commit abae787186d48b2cccf220cbf7b553f8478e60be +Author: Patrick Schleizer +Date: Thu Nov 5 06:47:16 2020 -0500 + + usability: pam abort when attempting to login to root when root password is locked + +commit 581e31af81015fb85ee1bdd81586dbea13804955 +Author: Patrick Schleizer +Date: Thu Nov 5 06:46:57 2020 -0500 + + comment + +commit dfe9b0f6c7364e4d3cc3bf13ad7c0fccc2cb7e10 +Author: Patrick Schleizer +Date: Thu Nov 5 06:42:47 2020 -0500 + + fix, no longer unconditionally abort pam for user accounts with locked passwords + + as locked user accounts might have valid sudoers exceptions + + Thanks to @mimp for the bug report! + + https://forums.whonix.org/t/pam-abort-on-locked-password-and-running-privileged-command-from-web-browser/10521 + +commit 211769dc65a5c98cbdb55ce62e83c9e2a9fa1540 +Author: Patrick Schleizer +Date: Thu Nov 5 06:41:51 2020 -0500 + + comment + +commit 79521397310f5e4e200291b2e2380e8e58953f18 +Author: Patrick Schleizer +Date: Thu Nov 5 06:39:32 2020 -0500 + + comment + +commit bb72c1278dd02a48a631d8e798cd78100576a1a8 +Author: Patrick Schleizer +Date: Thu Nov 5 06:36:39 2020 -0500 + + copyright + +commit f4843b1deb95948f9fe2a2870ecbe61c1cab798a +Author: Patrick Schleizer +Date: Sat Oct 31 06:29:25 2020 -0400 + + bumped changelog version + +commit c1e0bb831025854afbd88e5c353a000c4dadaede +Author: Patrick Schleizer +Date: Sat Oct 31 06:11:49 2020 -0400 + + shebang + +commit b06d4ca29983938fa81acfc379366e6c1516c69a +Author: Patrick Schleizer +Date: Sat Oct 31 06:09:22 2020 -0400 + + bumped changelog version + +commit 3f656be5746ec4d219371fb0d67c222df7fe52d1 +Author: Patrick Schleizer +Date: Sat Oct 31 05:48:10 2020 -0400 + + chmod +x /etc/X11/Xsession.d/50panic_on_oops + chmod +x /etc/X11/Xsession.d/50security-misc + +commit 881d695bff7d65c66bbf8e0973f883c75a3d1ebb +Author: Patrick Schleizer +Date: Mon Oct 5 07:03:37 2020 -0400 + + bumped changelog version + +commit 3adb2c92d9551f649b177753fede18da3cc4b0eb +Merge: feb7cea4 58560138 +Author: Patrick Schleizer +Date: Sat Oct 3 14:10:32 2020 -0400 + + Merge remote-tracking branch 'github/master' + +commit 58560138cdc36fa5f6142f75f0fed53bcad96363 +Merge: feb7cea4 06ffd5d2 +Author: Patrick Schleizer +Date: Sat Oct 3 18:09:07 2020 +0000 + + Merge pull request #77 from madaidan/debugfs + + Restrict access to debugfs + +commit 06ffd5d2201152c60eb4309860b8c42be386dccb +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Mon Sep 28 19:21:20 2020 +0000 + + Restrict access to debugfs + +commit feb7cea4c508a94d1140bc08856d0fe586da694e +Author: Patrick Schleizer +Date: Mon Sep 28 10:30:42 2020 -0400 + + bumped changelog version + +commit da1ac48cde8ea5057d1606a2fba42ea179677378 +Author: Patrick Schleizer +Date: Mon Sep 28 10:29:50 2020 -0400 + + unblacklist squashfs as this would likely break Whonix-Host ISO + + https://github.com/Whonix/security-misc/pull/75#issuecomment-700044182 + +commit 4070133ed65af409adeb6f8c7970d3bc7074b02b +Author: Patrick Schleizer +Date: Mon Sep 28 10:25:57 2020 -0400 + + unblacklist vfat + + https://github.com/Whonix/security-misc/pull/75#issuecomment-695201068 + +commit 77d461ec08ffdf0eb6a5d124927d9f9748c0dd3c +Merge: 5fc7b791 3684ab58 +Author: Patrick Schleizer +Date: Mon Sep 28 10:24:59 2020 -0400 + + Merge remote-tracking branch 'github/master' + +commit 3684ab585eeab46ff17a1d410ce1bcff1a63968c +Merge: ae90107e a813e7da +Author: Patrick Schleizer +Date: Mon Sep 28 14:24:15 2020 +0000 + + Merge pull request #75 from flawedworld/patch-1 + + Blacklist more modules (based on OpenSCAP for RHEL 8) + +commit ae90107e6df4d312a6734985df38b8533d1283c8 +Merge: 5fc7b791 8f7727e8 +Author: Patrick Schleizer +Date: Mon Sep 28 14:23:42 2020 +0000 + + Merge pull request #76 from flawedworld/patch-2 + + Add IPv6 sysctl options and enforce kernel.perf_event_paranoid=3 + +commit a813e7da07a39e96e0cd7937aee7568307a00287 +Author: flawedworld <38294951+flawedworld@users.noreply.github.com> +Date: Sat Sep 19 20:46:19 2020 +0100 + + Blacklist more modules + +commit 5fc7b791db473c22ea43ff899e2dbe232c42a2b7 +Author: Patrick Schleizer +Date: Sat Sep 19 09:28:27 2020 -0400 + + bumped changelog version + +commit bff6ce7abb920d55edc49b19340a1e9251a4cd8c +Merge: 98c0deca 9239c8b8 +Author: Patrick Schleizer +Date: Sat Sep 19 06:54:50 2020 -0400 + + Merge remote-tracking branch 'github/master' + +commit 9239c8b8074018090d4fa1381aa06e66a99359cc +Merge: 98c0deca 8dfdec1d +Author: Patrick Schleizer +Date: Sat Sep 19 10:54:21 2020 +0000 + + Merge pull request #71 from onions-knight/patch-1 + + Update thunar.xml + +commit 8f7727e823a86a1826686d5c95d0070721c7acba +Author: flawedworld <38294951+flawedworld@users.noreply.github.com> +Date: Fri Sep 18 23:36:30 2020 +0100 + + Add some IPv6 options + +commit 944fed3c459dd55820cb1eca68f86816bdf8469f +Author: flawedworld <38294951+flawedworld@users.noreply.github.com> +Date: Fri Sep 18 23:29:04 2020 +0100 + + Disallow kernel profiling by users without CAP_SYS_ADMIN + + It's the default on a lot of stuff, but still nice to have. + +commit 98c0decaa46c6fb839062ff9af0556d821c254e6 +Author: Patrick Schleizer +Date: Mon Aug 3 09:43:43 2020 -0400 + + bumped changelog version + +commit 7e267ab49850362c02374a15fdba2409a5487a0f +Author: Patrick Schleizer +Date: Mon Aug 3 08:12:19 2020 -0400 + + fix, allow group `sudo` and `console` to use consoles + + fix /etc/security/access-security-misc.conf syntax error + + Thanks to @81a989 for the bug report! + + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/31 + +commit b09f5ddc154d6561fd97b436feeb6a6225f89206 +Author: Patrick Schleizer +Date: Wed Jul 29 08:33:07 2020 -0400 + + bumped changelog version + +commit ac8bc4f006dbc1583e35ba033e38dac8392127e9 +Author: Patrick Schleizer +Date: Wed Jul 29 06:30:07 2020 -0400 + + readme + +commit 861f9d1022e61766c7474d9eb79489ba64ac2055 +Author: Patrick Schleizer +Date: Thu May 14 13:57:32 2020 -0400 + + bumped changelog version + +commit 3cd7b144bba1a92ca771b16fc5215073c7561a1a +Author: Patrick Schleizer +Date: Thu May 14 13:47:58 2020 -0400 + + move "kernel.printk = 3 3 3 3" to separate file /etc/sysctl.d/30_silent-kernel-printk.conf + + so package debug-misc can easily disable it + + https://phabricator.whonix.org/T950 + +commit 81cb6ad2462a900f9c5193278de70ada62a5585b +Author: Patrick Schleizer +Date: Thu Apr 23 12:27:25 2020 -0400 + + bumped changelog version + +commit 6485df8126b52a2072824fa442e8d1dd5cb18981 +Author: Patrick Schleizer +Date: Thu Apr 23 12:26:31 2020 -0400 + + Prevent kernel info leaks in console during boot. + + add kernel parameter `quiet loglevel=0` + + https://phabricator.whonix.org/T950 + +commit aa5631b02b0127b4681ae08c973b08b23befd701 +Author: Patrick Schleizer +Date: Thu Apr 16 08:43:40 2020 -0400 + + bumped changelog version + +commit 8d2e4b68dcae87b27f519196488e0ed7e8b95ef2 +Author: Patrick Schleizer +Date: Thu Apr 16 08:00:31 2020 -0400 + + Prevent kernel info leaks in console during boot. + + By setting `kernel.printk = 3 3 3 3`. + + https://phabricator.whonix.org/T950 + + Thanks to @madaidan for the suggestion! + +commit 4898a9e753e9399e83e4a39d8fa340e1ad9d4f6d +Author: Patrick Schleizer +Date: Thu Apr 16 07:54:33 2020 -0400 + + fix, sysctl-initramfs: switch log to /run/initramfs/sysctl-initramfs-error.log + + since ephemeral, in RAM, not written to disk, no conflict with grub-live + + https://forums.whonix.org/t/kernel-hardening/7296/435 + +commit 701da5f6cc911e3946904c152078dc6c637e5070 +Author: Patrick Schleizer +Date: Thu Apr 16 07:24:44 2020 -0400 + + formatting + +commit cb51847085c1b62c99ab160373c52a388bdfe300 +Author: Patrick Schleizer +Date: Wed Apr 15 14:05:37 2020 -0400 + + readme + +commit df218ad6582ab88be16e66cf13951d0a5271411b +Author: Patrick Schleizer +Date: Tue Apr 14 12:40:31 2020 -0400 + + bumped changelog version + +commit 8851c9ed29e79d2ef5df9c7b7086878e69b90bd4 +Author: Patrick Schleizer +Date: Tue Apr 14 12:39:34 2020 -0400 + + fix: disable proc-hidepid.service + +commit b6dde34bfb696218cc14ac89d169ec0e37814bff +Author: Patrick Schleizer +Date: Mon Apr 13 06:56:34 2020 -0400 + + bumped changelog version + +commit e0b8640fb9d03feb6b01fed4469d901e3f9a5dc0 +Author: Patrick Schleizer +Date: Mon Apr 13 06:56:34 2020 -0400 + + readme + +commit 253578afdf9a4aeb8c5495ca815d0326086dc986 +Author: Patrick Schleizer +Date: Mon Apr 13 06:50:32 2020 -0400 + + /etc/security/access-security-misc.conf white list ttyS0 etc. + + ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9 + + Thanks to @subpar_marlin for the bug report and helping to fix this! + + https://forums.whonix.org/t/how-do-i-enter-the-whonix-shell-from-cli/7271/43 + + https://forums.whonix.org/t/etc-security-hardening/8592 + +commit b3ce18f0f9f1da0552a4a1bd882a5b5dda13626e +Author: Patrick Schleizer +Date: Sun Apr 12 16:54:10 2020 -0400 + + disable proc-hidepid by default because incompatible with pkexec + + and undo pkexec wrapper + +commit 442931529121e9e402e7ac56e27df3dcec43167b +Author: Patrick Schleizer +Date: Sun Apr 12 16:52:55 2020 -0400 + + disable proc-hidepid by default because incompatible with pkexec + + and undo pkexec wrapper + +commit 72be31e870057b035651c1b5a7e9a9db149e9d25 +Author: Patrick Schleizer +Date: Sun Apr 12 16:48:13 2020 -0400 + + disable proc-hidepid by default because incompatible with pkexec + + and undo pkexec wrapper + +commit 938e929f39ff68296ab01a4b619f963ad3bdf535 +Author: Patrick Schleizer +Date: Sun Apr 12 16:37:51 2020 -0400 + + add pkexec to suid default whitelist + + /usr/bin/pkexec exactwhitelist + /usr/bin/pkexec.security-misc-orig exactwhitelist + +commit 695ad5b83d0e89b1c3b8a5f09f2d7d0a17d8e72f +Author: Patrick Schleizer +Date: Thu Apr 9 09:45:30 2020 +0000 + + bumped changelog version + +commit 67b9d06b25a651b89e35abdd227a1740871395cd +Author: Patrick Schleizer +Date: Thu Apr 9 09:45:29 2020 +0000 + + readme + +commit 565ff136e5f1e714b4094fcd9cfdf99a0fb99850 +Author: Patrick Schleizer +Date: Wed Apr 8 21:04:02 2020 +0000 + + vm.swappiness=1 + + import from swappiness-lowest + + https://forums.whonix.org/t/vm-swappiness-1-set-swapiness-to-lowest-setting-still-useful-swappiness-lowest/9278 + +commit 642d4d8d939f33c19564dcc5a0ed46d85feb80aa +Author: Patrick Schleizer +Date: Wed Apr 8 17:13:21 2020 +0000 + + bumped changelog version + +commit a9d0baffe600b9ac5bb7d6ee4e7c5c5830bc60ba +Author: Patrick Schleizer +Date: Wed Apr 8 16:57:32 2020 +0000 + + python -> python3 + +commit 4153d8d08874256647d3200333d6754baac2ea63 +Author: Patrick Schleizer +Date: Wed Apr 8 16:51:22 2020 +0000 + + apparmor-profile-anondist -> apparmor-profile-dist + +commit 72228946dca93b5c8257ac5a6ad59e54b7b14d11 +Author: Patrick Schleizer +Date: Wed Apr 8 16:46:11 2020 +0000 + + fix etc/default/grub.d/40_kernel_hardening.cfg + + in Qubes if no kernel package is installed + +commit bfd6018d8d108ee8691556529121fe2a679de1d2 +Author: Patrick Schleizer +Date: Wed Apr 8 12:51:11 2020 +0000 + + bumped changelog version + +commit 0441f2ed7ad01585c11c9fb6a05cd3884408c9d6 +Author: Patrick Schleizer +Date: Wed Apr 8 12:30:05 2020 +0000 + + readme + +commit 663811a8192d7d08769eaf5e9c057b9dcca34562 +Author: Patrick Schleizer +Date: Wed Apr 8 12:04:13 2020 +0000 + + anon-base-files -> dist-base-files + +commit cc8489df2ff655276be31073ec2fff57a9e8b448 +Author: Patrick Schleizer +Date: Mon Apr 6 13:29:23 2020 -0400 + + bumped changelog version + +commit 350a15dfbf9186c4bd81159b7656b5707a95c5db +Author: Patrick Schleizer +Date: Mon Apr 6 13:22:32 2020 -0400 + + readme + +commit 5c81e1f23fa07a0e3c96d15dc3cc24d41332fe3c +Author: Patrick Schleizer +Date: Mon Apr 6 09:25:45 2020 -0400 + + import from anon-gpg-conf + +commit 1b2a34ea80fa9efeb02acaa8595e3c38fd9d06ca +Author: Patrick Schleizer +Date: Sat Apr 4 16:51:42 2020 -0400 + + bumped changelog version + +commit 1188a44f47602248911d81f4dc3af08b830b65b9 +Author: Patrick Schleizer +Date: Sat Apr 4 16:49:30 2020 -0400 + + port to python 3.7 + +commit a2c932aa5a354798ce1383e988519f9a2cb69374 +Author: Patrick Schleizer +Date: Thu Apr 2 07:58:51 2020 -0400 + + bumped changelog version + +commit ae8c5fff3c70c00931b95cd04b8729d2c1bd2a60 +Author: Patrick Schleizer +Date: Thu Apr 2 07:22:47 2020 -0400 + + readme + +commit a7f2a2a3b6b408a0545f55b8fed9cc17fbd8f843 +Author: Patrick Schleizer +Date: Thu Apr 2 06:04:45 2020 -0400 + + console lockdown: allow members of group `sudo` to use console + + https://forums.whonix.org/t/etc-security-hardening/8592 + + https://github.com/Whonix/security-misc/pull/74#issuecomment-607748407 + + https://www.whonix.org/wiki/Dev/Strong_Linux_User_Account_Isolation#Console_Lockdown + +commit 7764ee0d202193dc67f5805fc23be2b804962186 +Author: Patrick Schleizer +Date: Thu Apr 2 05:58:16 2020 -0400 + + comments + +commit d9f2a0e4a1837ef1604e4cd17ce8ae60996c9782 +Author: Patrick Schleizer +Date: Wed Apr 1 17:34:59 2020 -0400 + + remove 'Build-Depends: ronn' since no longer required + +commit eda9c57a628ebf1083f87789842d5403c6e05122 +Author: Patrick Schleizer +Date: Wed Apr 1 16:57:33 2020 -0400 + + remove genmkfile + +commit 2609fe9c3efff611dc5bce20d62580dace02757b +Author: Patrick Schleizer +Date: Wed Apr 1 16:33:29 2020 -0400 + + add debian install file + +commit d4b2baa9b66d480d5e45c628f8bc4ff11fab765f +Author: Patrick Schleizer +Date: Wed Apr 1 10:58:16 2020 -0400 + + bumped changelog version + +commit 2ceea8d1fe9f2425488c6696f75f2ecfd9ff2235 +Author: Patrick Schleizer +Date: Wed Apr 1 08:49:59 2020 -0400 + + update copyright year + +commit b6de867dec85efb03cf38aa85494607edb4500f4 +Author: Patrick Schleizer +Date: Wed Apr 1 08:26:44 2020 -0400 + + bumped changelog version + +commit ad022fc0b703f28f24665d28b072f1a993978370 +Author: Patrick Schleizer +Date: Wed Apr 1 08:21:06 2020 -0400 + + fix + +commit 354af7085be7e266913c3ae79701cd1abc729d06 +Author: Patrick Schleizer +Date: Tue Mar 31 07:41:45 2020 -0400 + + bumped changelog version + +commit 814f613a2fac12b892dfb6dcf53ee628e340c7b2 +Author: Patrick Schleizer +Date: Tue Mar 31 07:08:25 2020 -0400 + + When using systemd-nspawn (chroot) then `login` requires console 'console' to be permitted. + +commit a369a0a94dca7fff68234e4f75d74a4e9d63df5b +Author: Patrick Schleizer +Date: Mon Mar 30 18:42:02 2020 -0400 + + bumped changelog version + +commit c22adbd92fcab45fb3b1d3e98528c4790bb20a6a +Author: Patrick Schleizer +Date: Mon Mar 30 18:39:23 2020 -0400 + + notify if security-misc installation is forced + +commit 7ee5fc1b760dff0f86d8cf07a77cbd42d40f7a53 +Author: Patrick Schleizer +Date: Mon Mar 30 17:16:46 2020 -0400 + + bumped changelog version + +commit f663b5eff8a6f2fa406039ced4441c5a4a9c1477 +Author: Patrick Schleizer +Date: Mon Mar 30 17:15:02 2020 -0400 + + skip check if any non-root user is a member of group sudo and console if + environment variable `SECURITY_MISC_INSTALL` is set to `force` + +commit bc22fc9fdba834d0a2d8fdc75b86934e56b317c9 +Author: Patrick Schleizer +Date: Mon Mar 30 17:12:43 2020 -0400 + + skip check if any non-root user is a member of group sudo and console if file + /var/lib/security-misc/skip_install_check exists + +commit d7a69628b1def631b04219da7aee764eebea37df +Author: Patrick Schleizer +Date: Sat Mar 21 14:56:48 2020 -0400 + + bumped changelog version + +commit 5f0dd8270ba6311018e654cca3b8b86818af5a82 +Author: Patrick Schleizer +Date: Sat Mar 21 14:14:35 2020 -0400 + + consistent use of quotes + +commit 66ea1a3a127642c5515ac6fd80952a56568620bc +Author: Patrick Schleizer +Date: Sat Mar 21 14:14:15 2020 -0400 + + minor + +commit 23bd7ead59c0bdd793a955aaa613552b37a38dab +Author: Patrick Schleizer +Date: Sat Mar 21 14:12:42 2020 -0400 + + remove trailing space + +commit 7c25fc517e6f42d4364a55407f6bf0c84d130c8e +Merge: 20f0c574 1cbc7f6b +Author: Patrick Schleizer +Date: Sat Mar 21 14:12:25 2020 -0400 + + Merge remote-tracking branch 'origin/master' + +commit 1cbc7f6bed8acc112b610e05f527cffc6e9e1e87 +Merge: 20f0c574 89ada11c +Author: Patrick Schleizer +Date: Sat Mar 21 18:11:57 2020 +0000 + + Merge pull request #73 from madaidan/sysctl-initramfs + + Only remount in sysctl-initramfs if already mounted read-only + +commit 89ada11cf9a76cf02b3d5f92fd5c66194fe40ff0 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Sat Mar 21 17:49:07 2020 +0000 + + Only remount if already mounted read-only + +commit 20f0c574d5424c78ab6b4d3829a6662615967ba5 +Merge: e4118cb2 2938182c +Author: Patrick Schleizer +Date: Sat Mar 21 13:28:43 2020 -0400 + + Merge remote-tracking branch 'origin/master' + +commit 2938182ce6303e6e55086e2e9e82f8263a3c8e76 +Merge: e4118cb2 c8826d67 +Author: Patrick Schleizer +Date: Sat Mar 21 17:26:37 2020 +0000 + + Merge pull request #72 from madaidan/master + + Fix sysctl-initramfs logs + +commit c8826d6702ebaf280994effb22aea39b4cfd2dac +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Sat Mar 21 17:15:25 2020 +0000 + + Fix sysctl-initramfs logs + +commit 8dfdec1d3b0fde7b2836b38e5aefab1b6b6df9f2 +Author: onions-knight <38859709+onions-knight@users.noreply.github.com> +Date: Tue Mar 17 16:38:53 2020 +0000 + + Update thunar.xml + + Adding Delete option for thunar on right mouse click (removed in Debian 10). See https://forums.whonix.org/t/whonix-host-calamares-branding-suggestion/7772/26 + +commit e4118cb21eb8765bc8f4e7b5e05d464d72575824 +Author: Patrick Schleizer +Date: Thu Mar 12 04:43:08 2020 -0400 + + bumped changelog version + +commit e6e7886a6e3dca1a75943c5a04c4d29ab8682cec +Merge: 04a87f70 711e786b +Author: Patrick Schleizer +Date: Wed Mar 11 09:08:41 2020 -0400 + + Merge remote-tracking branch 'origin/master' + +commit 711e786be504179c832172acb39d567b323520e6 +Merge: 04a87f70 4d0de87f +Author: Patrick Schleizer +Date: Wed Mar 11 13:06:23 2020 +0000 + + Merge pull request #70 from madaidan/userfaultfd + + Fix unprivileged_userfaultfd + +commit 4d0de87f799d8032731140e9a5815d4773d91baa +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Sun Mar 8 17:49:49 2020 +0000 + + Disable unprivileged userfaultfd use again + +commit efb2683cfc168c3b110c6664ee61eabcf85f3f30 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Sun Mar 8 17:49:12 2020 +0000 + + Hide unprivileged_userfaultfd error + +commit 04a87f7029736e5ce66f18bb6c42cadf3500b26b +Author: Patrick Schleizer +Date: Sun Mar 8 09:43:24 2020 -0400 + + bumped changelog version + +commit 284a49110030b21aa3136447217273337a12acaf +Author: Patrick Schleizer +Date: Sun Mar 8 08:07:10 2020 -0400 + + disable `vm.unprivileged_userfaultfd=0` for now + + because broken + + https://forums.whonix.org/t/kernel-hardening/7296/406 + + reverts "Restrict the userfaultfd() syscall to root as it can make heap sprays easier." + + https://duasynt.com/blog/linux-kernel-heap-spray + +commit 44351ec9b78d59aeeef44675e8e203c7ace243f0 +Author: Patrick Schleizer +Date: Sat Mar 7 21:44:19 2020 -0500 + + remove no longer needed code for installation of apparmor profiles + +commit 71ae6239168d829e25670ffa856ee0f011a168a9 +Author: Patrick Schleizer +Date: Thu Mar 5 08:36:27 2020 -0500 + + bumped changelog version + +commit 76eb9579a3038982301fc622c84cd48fa3d88ffd +Author: Patrick Schleizer +Date: Thu Mar 5 08:33:00 2020 -0500 + + readme + +commit 15dde15a36c3cac0088773670b84f7e1e2b1423f +Author: Patrick Schleizer +Date: Tue Mar 3 09:42:24 2020 -0500 + + typo + +commit 8887af26d6a82613ee1f9c3a10ba42fdd2444d1c +Author: Patrick Schleizer +Date: Tue Mar 3 09:19:49 2020 -0500 + + bumped changelog version + +commit 1dea4dbcf6fa3299e513d01005b514e42bf51538 +Author: Patrick Schleizer +Date: Tue Mar 3 09:18:38 2020 -0500 + + readme + +commit cd19c2da006d38cd0cd3653b31e398d16396d825 +Author: Patrick Schleizer +Date: Tue Mar 3 09:18:24 2020 -0500 + + fix lintian warning + +commit 7e3fedefb234e584d900c036c424ac083a9efa3d +Author: Patrick Schleizer +Date: Tue Mar 3 09:12:50 2020 -0500 + + bumped changelog version + +commit 201d6b5efc355b08b5f94f9284d2242dec9c56b8 +Author: Patrick Schleizer +Date: Tue Mar 3 09:07:42 2020 -0500 + + readme + +commit 63c6405ab74f0dd5f3ec3838135b29304a3d1fc8 +Merge: e3e39f22 453aa8a4 +Author: Patrick Schleizer +Date: Sat Feb 29 07:34:46 2020 -0500 + + Merge remote-tracking branch 'origin/master' + +commit 453aa8a4eb76fe56ad67f1aea8abfeb122e68a9c +Merge: e3e39f22 60fbf8b0 +Author: Patrick Schleizer +Date: Sat Feb 29 12:28:32 2020 +0000 + + Merge pull request #65 from madaidan/userfaultfd + + Restrict the userfaultfd() syscall to root + +commit e3e39f22354595c9f21c243d7bdadc1487374db8 +Merge: 649ec5df bd7678c5 +Author: Patrick Schleizer +Date: Sat Feb 29 05:01:41 2020 -0500 + + Merge remote-tracking branch 'origin/master' + +commit 649ec5dfa1d2c0e324d8054b4c7402ab2b462d93 +Author: Patrick Schleizer +Date: Sat Feb 29 04:59:56 2020 -0500 + + pkexec wrapper: fix gdebi / synaptic + + but at cost of checking for passwordless sudo /etc/suders /etc/sudoers.d + exceptions. + + http://forums.whonix.org/t/cannot-use-pkexec/8129/53 + +commit 32269d32b63e549f76b4090b675dd53256fbc42d +Author: Patrick Schleizer +Date: Sat Feb 29 04:59:15 2020 -0500 + + description + +commit b31caefdeb8b76537982e359e708b57081d7b381 +Author: Patrick Schleizer +Date: Sat Feb 29 04:59:02 2020 -0500 + + description + +commit bd7678c574819298b364185fe7e3362c7e8d4930 +Merge: d04d4bf0 42d3b986 +Author: Patrick Schleizer +Date: Fri Feb 28 12:04:05 2020 +0000 + + Merge pull request #66 from madaidan/mce + + Fix docs + +commit 42d3b986c41854fc2990557d2333874e9379793b +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Thu Feb 27 17:41:14 2020 +0000 + + Update control + +commit d04d4bf0950b60b8e5bf51b2303bbecdbc5fe326 +Author: Patrick Schleizer +Date: Tue Feb 25 02:08:10 2020 -0500 + + description + +commit 4043d2af3f8239a2056610363fc9d53770ebc336 +Author: Patrick Schleizer +Date: Tue Feb 25 02:06:48 2020 -0500 + + description + +commit 0e5187ff249c686908506896e01125e37d194543 +Author: Patrick Schleizer +Date: Tue Feb 25 02:00:27 2020 -0500 + + description + +commit 60fbf8b0de8a631d8a63c64f7e8181fee501c237 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Mon Feb 24 18:24:07 2020 +0000 + + Update control + +commit 6b64b36b0190198f5edfda6c704a9efe3ea5b9a6 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Mon Feb 24 18:23:15 2020 +0000 + + Restrict the userfaultfd() syscall to root + +commit 221000db5b184664c09dfe9cb7055de45331a7e1 +Merge: 01eaee99 c7f25379 +Author: Patrick Schleizer +Date: Mon Feb 17 03:17:11 2020 -0500 + + Merge remote-tracking branch 'origin/master' + +commit c7f2537930925e3ec250db81791a107af003079b +Merge: 01eaee99 8ea4e50c +Author: Patrick Schleizer +Date: Mon Feb 17 08:16:34 2020 +0000 + + Merge pull request #64 from madaidan/extra_latent_entropy + + Gather more entropy during boot + +commit 8ea4e50c8e9c3c9ee650b665a32b78f67aedc1aa +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Sun Feb 16 19:52:40 2020 +0000 + + Update control + +commit f6b6ab374ea2b24dfd4ac49bc1a595b50ab3d952 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Sun Feb 16 19:51:32 2020 +0000 + + Gather more entropy during boot + +commit 01eaee997e34aa73a11dffe032ace5ef23c37e28 +Author: Patrick Schleizer +Date: Sat Feb 15 15:35:44 2020 -0500 + + bumped changelog version + +commit 412a83923dd09f36a25ebf9ce1991369d09c5e34 +Merge: dce54d5d 4399a512 +Author: Patrick Schleizer +Date: Sat Feb 15 15:30:32 2020 -0500 + + Merge remote-tracking branch 'origin/master' + +commit dce54d5d0f7c6017037b5fb6a5851dd90ce5d762 +Author: Patrick Schleizer +Date: Sat Feb 15 15:29:38 2020 -0500 + + bumped changelog version + +commit 3df008f0b9aa08c8b92c89439abeb029f5d1f316 +Author: Patrick Schleizer +Date: Sat Feb 15 15:28:30 2020 -0500 + + readme + +commit 4399a512bef77ddec428bd4150cacebb77fc22da +Merge: 757df8fc a79ce7fa +Author: Patrick Schleizer +Date: Sat Feb 15 19:43:05 2020 +0000 + + Merge pull request #63 from madaidan/ldisc_autoload + + Document ldisc_autoload better + +commit a79ce7fa68c22048d3e10789fe209b14b818d0fb +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Sat Feb 15 17:30:21 2020 +0000 + + Document ldisc_autoload better + +commit 757df8fceb29d9b6143cf26e73cb31dde69d0a71 +Merge: 9bbae903 a9a15817 +Author: Patrick Schleizer +Date: Sat Feb 15 05:43:43 2020 -0500 + + Merge remote-tracking branch 'origin/master' + +commit a9a1581720739966e94f18be556552e9d75d63b1 +Merge: 9bbae903 1e5946c7 +Author: Patrick Schleizer +Date: Sat Feb 15 10:42:20 2020 +0000 + + Merge pull request #60 from madaidan/sysrq + + Restrict the SysRq key + +commit 1e5946c795e3962fdc2229146b9331d36a1d6c41 +Merge: 0f497369 9bbae903 +Author: Patrick Schleizer +Date: Sat Feb 15 10:41:52 2020 +0000 + + Merge branch 'master' into sysrq + +commit 9bbae903fe5ee58d4a22dfeab51cbb179b8cfb14 +Author: Patrick Schleizer +Date: Sat Feb 15 05:29:48 2020 -0500 + + remove-system.map: lower verbosity output + +commit cce35e5109489df44916a08722d9016bb1e578ec +Merge: 14140ad4 e4035179 +Author: Patrick Schleizer +Date: Sat Feb 15 05:27:52 2020 -0500 + + Merge remote-tracking branch 'origin/master' + +commit e40351796e297673e1ec45dee7483079e96d9639 +Merge: 5124f8ce 31009f0b +Author: Patrick Schleizer +Date: Sat Feb 15 10:25:15 2020 +0000 + + Merge pull request #62 from madaidan/shred + + Shred System.map files + +commit 5124f8cebcf6113547d11fc5193f83af1a2b6f84 +Merge: ac8757a0 9b767139 +Author: Patrick Schleizer +Date: Sat Feb 15 10:18:56 2020 +0000 + + Merge pull request #61 from madaidan/disable_early_pci_dma + + Avoid holes in IOMMU + +commit ac8757a031a02c6cbad564e6a857954c0cf01a54 +Merge: ad6b7668 ace62111 +Author: Patrick Schleizer +Date: Sat Feb 15 10:09:46 2020 +0000 + + Merge pull request #59 from madaidan/ldisc + + Restrict loading line disciplines to CAP_SYS_MODULE + +commit 31009f0bfa10e7b67f5823a5be92273e5414fff3 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Fri Feb 14 23:46:19 2020 +0000 + + Shred System.map files + +commit 9b767139ef82279e00d86f7f1e1e8bf73d795651 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Fri Feb 14 18:52:01 2020 +0000 + + Avoid holes in IOMMU + +commit 0f497369574811b0e7fb832636a5618e62618619 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Fri Feb 14 18:18:18 2020 +0000 + + Update control + +commit d251c43344a04e1dd8afbf12352432810874e021 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Fri Feb 14 18:17:20 2020 +0000 + + Restrict the SysRq key + +commit ace62111761451a13c446767dfd3c32b9b70a7f8 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Fri Feb 14 17:51:17 2020 +0000 + + Update control + +commit 0ea7dd161b3e643c23624e6dcb450116824b6301 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Fri Feb 14 17:50:19 2020 +0000 + + Restrict loading line disciplines to CAP_SYS_MODULE + +commit ad6b76688677cd4f9f0b2f2524c0f6b0a381bf29 +Merge: 14140ad4 14f84583 +Author: Patrick Schleizer +Date: Thu Feb 13 18:40:58 2020 +0000 + + Merge pull request #57 from madaidan/sysctl + + Prevent symlink/hardlink TOCTOU races + +commit 14140ad41ba45b2457570a7df28b42cfd3bf3155 +Author: Patrick Schleizer +Date: Thu Feb 13 13:39:45 2020 -0500 + + bumped changelog version + +commit d1fa191bc0ad58ea4fbb5b4db383311f87319dfe +Author: Patrick Schleizer +Date: Thu Feb 13 13:38:21 2020 -0500 + + readme + +commit 76a51a3b45113b4f771397bf32daae3fb38af6a6 +Merge: 163e20b8 5ebab397 +Author: Patrick Schleizer +Date: Thu Feb 13 13:37:34 2020 -0500 + + Merge remote-tracking branch 'origin/master' + +commit 5ebab397b201f431e3d0ca3bebfb71fa61a7ed2b +Merge: 163e20b8 2796c2dd +Author: Patrick Schleizer +Date: Thu Feb 13 18:36:41 2020 +0000 + + Merge pull request #58 from madaidan/mitigations + + Improve CPU mitigations documentation + +commit 2796c2dd00fca0bb458bdb4ea5c2cdbd35854bef +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Wed Feb 12 18:43:19 2020 +0000 + + Update control + +commit 700c7ed9085f2c9f0f271ddf8781f119e8ac5714 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Wed Feb 12 18:42:13 2020 +0000 + + Create 40_cpu_mitigations.cfg + +commit ba0043b8a7249e55e0a0d3b87f6c54de5283f057 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Wed Feb 12 18:36:05 2020 +0000 + + Update 40_kernel_hardening.cfg + +commit 14f845837476810f1eb3038d9d41f9ad8088b916 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Wed Feb 12 18:05:32 2020 +0000 + + Update control + +commit 5cb21d0d4d36fd516f17a9b5378443859f497027 +Author: madaidan <50278627+madaidan@users.noreply.github.com> +Date: Wed Feb 12 18:03:23 2020 +0000 + + Prevent symlink/hardlink TOCTOU races + +commit 163e20b886f298cb9d3aca54c14f66991001b396 +Author: Patrick Schleizer +Date: Wed Feb 5 06:31:48 2020 -0500 + + bumped changelog version + +commit 3024006f63be34f0c9d2968b1839a855419792dd +Merge: 8c5cd865 024576e3 +Author: Patrick Schleizer +Date: Tue Feb 4 00:24:50 2020 -0500 + + Merge remote-tracking branch 'origin/master' + +commit 024576e3307e45c90b97ed8658ee82ceb1ed00aa +Merge: 8c5cd865 e4c6e897 +Author: Patrick Schleizer +Date: Tue Feb 4 05:24:05 2020 +0000 + + Merge pull request #56 from HulaHoop0/patch-1 + + kvm.nx_huge_pages=force + +commit e4c6e897cf37cbf5de6d90888a0ddbe56db11c2f +Author: HulaHoop0 <55955185+HulaHoop0@users.noreply.github.com> +Date: Mon Feb 3 16:06:46 2020 +0000 + + kvm.nx_huge_pages=force + +commit 8c5cd865f49cea986cdfc00a4cb4f0f913d4d3e6 +Author: Patrick Schleizer +Date: Mon Feb 3 09:23:13 2020 -0500 + + bumped changelog version + commit 1f6ed2cc7047e1144e811d94dddc7306ee93b61e Author: Patrick Schleizer Date: Mon Feb 3 08:55:20 2020 -0500 @@ -45,16 +17228,16 @@ Author: Patrick Schleizer Date: Thu Jan 30 05:55:13 2020 -0500 unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...) - + this might reduce performance - + * `spectre_v2=on` * `spec_store_bypass_disable=on` * `tsx=off` * `tsx_async_abort=full,nosmt` - + Thanks to @madaidan for the suggestion! - + https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647 commit 2711d0f7f08362f97383fbae81ce9d520b19dcbc @@ -74,7 +17257,7 @@ Author: Patrick Schleizer Date: Thu Jan 30 00:46:48 2020 -0500 set kernel boot parameter `l1tf=full,force` and `nosmt=force` - + https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 commit efc40da4fb1fffcc760685cda0e49dc04da4c5fe @@ -142,9 +17325,9 @@ Author: Patrick Schleizer Date: Fri Jan 24 04:30:36 2020 -0500 merge the many modprobe.d config files into 1 - + and use a name starting with double digits - + to make it easier to disable settings using a lexically higher config file commit 6a4c493213929b354a3c8d2acf2325473ae63cfd @@ -152,9 +17335,9 @@ Author: Patrick Schleizer Date: Fri Jan 24 04:26:36 2020 -0500 merge the many sysctl config files into 1 - + and use a name starting with double digits - + to make it easier to disable settings using a lexically higher config file commit f653b94e7747436323e2083d416ab86560e3cd71 @@ -192,7 +17375,7 @@ Author: Patrick Schleizer Date: Wed Jan 22 07:08:08 2020 -0500 add update initramfs trigger - + https://github.com/Whonix/security-misc/pull/53 commit df0b2afda1e1d5a3fddfd8c48b62a5de8295d687 @@ -218,10 +17401,10 @@ Author: Patrick Schleizer Date: Mon Jan 20 08:49:02 2020 -0500 fix Whonix / Kicksecure - + /var/lib/dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted. /var/lib/dpkg/tmp.ci/preinst: ERROR: You probably want to run: - + sudo adduser user console commit 960e1ff6e82f8593c2d242a6a0f1e1cf5805c85b @@ -243,19 +17426,19 @@ Date: Wed Jan 15 15:54:06 2020 -0500 error handling commit 7211f6e0199d2ccb50437c7a5b0842050590b5dc -Merge: e110ea0 f6cc76a +Merge: e110ea0b f6cc76ac Author: Patrick Schleizer Date: Wed Jan 15 15:53:36 2020 -0500 Merge remote-tracking branch 'origin/master' commit f6cc76acd729428f83d3497a2e83bfc4b14f1ff8 -Merge: e110ea0 1df48a2 +Merge: e110ea0b 1df48a22 Author: Patrick Schleizer Date: Wed Jan 15 20:52:33 2020 +0000 Merge pull request #55 from madaidan/sysctl.conf - + Process sysctl.conf in initramfs commit 1df48a226d83b98dadc8bfb8dbc479dd656e2313 @@ -301,23 +17484,23 @@ Date: Wed Jan 15 10:08:57 2020 -0500 readme commit 8ab4623f8e81ad1b67858b458f2ae4085e7c8e65 -Merge: 8015954 087465a +Merge: 80159545 087465a0 Author: Patrick Schleizer Date: Wed Jan 15 06:06:39 2020 -0500 Merge remote-tracking branch 'origin/master' commit 087465a0cdecc4765f7b659256cdd5e8cdef73ab -Merge: 8015954 528c5fc +Merge: 80159545 528c5fc4 Author: Patrick Schleizer Date: Wed Jan 15 11:02:30 2020 +0000 Merge pull request #53 from madaidan/sysctl-initramfs - + Set sysctl values in initramfs commit 528c5fc4c41026396a63ac91af7c156dd0d4f191 -Merge: 9dc43ea 8015954 +Merge: 9dc43eae 80159545 Author: Patrick Schleizer Date: Wed Jan 15 11:02:03 2020 +0000 @@ -328,11 +17511,11 @@ Author: Patrick Schleizer Date: Wed Jan 15 02:42:10 2020 -0500 fix xfce4-power-manager xfpm-power-backlight-helper pkexec lxsudo popup - + https://forums.whonix.org/t/xfce4-power-manager-xfpm-power-backlight-helper-pkexec-lxsudo-popup/8764 - + do show lxqt-sudo password prompt if there is a sudoers exceptoin - + improved pkexec wrapper logging commit d90ca4b1ad18289d6bcfcef51cfb032a0b4423eb @@ -384,19 +17567,19 @@ Date: Tue Jan 14 09:18:30 2020 -0500 readme commit c377c5ff83437a5447ecc9c873150421f4f1e691 -Merge: 8341242 539f24b +Merge: 8341242a 539f24b6 Author: Patrick Schleizer Date: Tue Jan 14 09:01:38 2020 -0500 Merge remote-tracking branch 'origin/master' commit 539f24b65ee7739487d8038fcb1fdfb1ed62ab22 -Merge: 8341242 0953bbe +Merge: 8341242a 0953bbe1 Author: Patrick Schleizer Date: Tue Jan 14 14:01:17 2020 +0000 Merge pull request #54 from madaidan/panic_on_oops - + Document panic_on_oops commit 0953bbe1d7f3e789aef2218a65c14c586dab4bcb @@ -436,19 +17619,19 @@ Date: Sat Jan 11 15:15:12 2020 -0500 lintian commit 3fae8e771ffbdd3023921b296e46cf982034d2ac -Merge: 13a1e13 e9f4dbd +Merge: 13a1e132 e9f4dbdd Author: Patrick Schleizer Date: Sat Jan 11 15:14:43 2020 -0500 Merge remote-tracking branch 'origin/master' commit e9f4dbdda579db83f330054253100bc7c5d1e2be -Merge: 13a1e13 6088444 +Merge: 13a1e132 6088444c Author: Patrick Schleizer Date: Sat Jan 11 20:14:10 2020 +0000 Merge pull request #52 from madaidan/vivid - + Blacklist the vivid kernel module commit 6088444c371f021ca23daa3a0ab1ee431d429a61 @@ -498,7 +17681,7 @@ Author: Patrick Schleizer Date: Tue Dec 31 05:55:44 2019 -0500 add user "user" to group "console" in Whonix and Kicksecure - + enable Console Lockdown in Whonix and Kicksecure commit b5a2d1dc581b53974aaa148f6d8f3054c9d1c5fe @@ -518,7 +17701,7 @@ Author: Patrick Schleizer Date: Tue Dec 31 02:46:32 2019 -0500 group ssh check was removed - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/27 commit 06ed728d791abe0ad3c93091fd8ebc088f73c4ef @@ -532,15 +17715,15 @@ Author: Patrick Schleizer Date: Mon Dec 30 06:39:24 2019 -0500 Protect /bin/mount from 'chmod -x'. - + /bin/mount exactwhitelist /usr/bin/mount exactwhitelist - + Remove SUID from 'mount' but keep executable. - + /bin/mount 745 root root /usr/bin/mount 745 root root - + https://forums.whonix.org/t/disable-suid-binaries/7706/61 commit e4e9c4e3b09138af25e94a6db81b0f759ddb4d1b @@ -614,7 +17797,7 @@ Author: Patrick Schleizer Date: Sun Dec 29 04:35:46 2019 -0500 exit with error if a config line cannot be processed rather than skipping - + https://forums.whonix.org/t/disable-suid-binaries/7706/59 commit d5c99f3a60372a00ded4b1b4340775aab1421d31 @@ -640,9 +17823,9 @@ Author: Patrick Schleizer Date: Thu Dec 26 05:44:35 2019 -0500 /fusermount matchwhitelist - + unbreak AppImages such as electrum Bitcoin wallet - + https://forums.whonix.org/t/disable-suid-binaries/7706/57 commit 507a30d6e39f17fcb09b92033fe1d831e7d4baf4 @@ -682,37 +17865,37 @@ Date: Tue Dec 24 06:00:41 2019 -0500 no longer hardcode amd64 commit d03a3d9ac03bc29ba349107855936dd194e12271 -Merge: 9d77d88 27a42a9 +Merge: 9d77d88a 27a42a9d Author: Patrick Schleizer Date: Tue Dec 24 05:57:24 2019 -0500 Merge remote-tracking branch 'origin/master' commit 27a42a9da82bc1f22135ffa509925f63177f25d9 -Merge: ac49c55 79241c5 +Merge: ac49c55d 79241c5d Author: Patrick Schleizer Date: Tue Dec 24 10:55:11 2019 +0000 Merge pull request #50 from madaidan/modules - + Make /lib/modules unreadable commit ac49c55d1fafff5f36bd7c595f50db295ff616a2 -Merge: 0c3d4ad 98e88d1 +Merge: 0c3d4ad2 98e88d14 Author: Patrick Schleizer Date: Tue Dec 24 10:55:03 2019 +0000 Merge pull request #49 from madaidan/kver - + Detect kernel upgrades commit 0c3d4ad255de75b57a2e316bf8a7fd77a2fc0d4d -Merge: 9d77d88 d1a0650 +Merge: 9d77d88a d1a0650f Author: Patrick Schleizer Date: Tue Dec 24 10:54:23 2019 +0000 Merge pull request #48 from madaidan/kernel-hardening - + Use only one slub_debug parameter commit 79241c5d09c4a7123cf90b45289b53d893135efb @@ -788,7 +17971,7 @@ Date: Mon Dec 23 03:38:49 2019 -0500 description: lockdown not enabled yet commit b05669accfe6fac8070003bbd57939ca2c621445 -Merge: 11b4192 1ff51ee +Merge: 11b4192f 1ff51ee0 Author: Patrick Schleizer Date: Mon Dec 23 03:38:04 2019 -0500 @@ -835,9 +18018,9 @@ Author: Patrick Schleizer Date: Mon Dec 23 02:29:47 2019 -0500 rename keyword whitelist to exactwhitelist - + add new keyword disablewhitelist - + refactoring commit 175d1c284552a08881286e8c3ca5d8eb9b97a144 @@ -857,7 +18040,7 @@ Author: Patrick Schleizer Date: Mon Dec 23 01:42:03 2019 -0500 polkit-agent-helper-1 matchwhitelist to match both - + - /usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist - /lib/policykit-1/polkit-agent-helper-1 @@ -866,7 +18049,7 @@ Author: Patrick Schleizer Date: Mon Dec 23 01:38:31 2019 -0500 matchwhitelist /qubes/qfile-unpacker to match both - + - /usr/lib/qubes/qfile-unpacker whitelist - /lib/qubes/qfile-unpacker @@ -947,7 +18130,7 @@ Author: Patrick Schleizer Date: Mon Dec 23 00:47:49 2019 -0500 fix capability removal error handling - + https://forums.whonix.org/t/disable-suid-binaries/7706/45 commit b631e2ecd8ae0e08850edd81bf64b02666fb6234 @@ -967,14 +18150,14 @@ Author: Patrick Schleizer Date: Sun Dec 22 19:42:40 2019 -0500 Remove suid / gid and execute permission for 'group' and 'others'. - + Similar to: chmod og-ugx /path/to/filename - + Removing execution permission is useful to make binaries such as 'su' fail closed rather than fail open if suid was removed from these. - + Do not remove read access since no security benefit and easier to manually undo for users. - + chmod 744 commit 58a4e0bc7d1b87d4d169f31dc5935c75e929c0b4 @@ -994,26 +18177,26 @@ Author: Patrick Schleizer Date: Sun Dec 22 18:56:36 2019 -0500 suid utempter/utempter matchwhitelist - + to cover both: - + /usr/lib/x86_64-linux-gnu/utempter/utempter /lib/x86_64-linux-gnu/utempter/utempter commit 9409209b48fb8f803b88d72c0e7febaa74f5bd2c -Merge: 008ce48 bce02ff +Merge: 008ce481 bce02ffd Author: Patrick Schleizer Date: Sun Dec 22 10:29:08 2019 -0500 Merge remote-tracking branch 'origin/master' commit bce02ffdc01c22c8d5528eb5eaa7729a6b3137dd -Merge: 008ce48 8f11a52 +Merge: 008ce481 8f11a520 Author: Patrick Schleizer Date: Sun Dec 22 15:26:07 2019 +0000 Merge pull request #47 from madaidan/msr - + Blacklist CPU MSRs commit 8f11a520f4c406fa3187ad530f945a564b78a28c @@ -1063,23 +18246,23 @@ Author: Patrick Schleizer Date: Sat Dec 21 14:06:10 2019 -0500 no longer remount /lib - + https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25 commit 10c19d6a8fc6b6bc03067dc3be88f486aa78d438 -Merge: b2260f4 fffdf50 +Merge: b2260f48 fffdf509 Author: Patrick Schleizer Date: Sat Dec 21 13:00:41 2019 -0500 Merge remote-tracking branch 'origin/master' commit fffdf5090c707c698de4adacfd5837809b33aa99 -Merge: 1c99b56 f5a52ae +Merge: 1c99b56c f5a52aed Author: Patrick Schleizer Date: Sat Dec 21 17:59:56 2019 +0000 Merge pull request #46 from madaidan/remount-secure - + Don't remount /sys/kernel/security commit f5a52aeddc4742b4dbd8a0075d759b2ceaaae691 @@ -1093,7 +18276,7 @@ Author: Patrick Schleizer Date: Sat Dec 21 08:03:33 2019 -0500 add support for /etc/exec / /usr/local/etc/exec - + to allow enabling exec on a per VM basis commit 1c99b56c9b99cceab6fe38580d06197dd4bcfb77 @@ -1162,23 +18345,23 @@ Date: Sat Dec 21 06:58:01 2019 -0500 rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown - + https://github.com/Whonix/security-misc/pull/45 commit 2350e0f5d06d9625835ba1547aab0054b795c0c5 -Merge: 3ea5871 efd65a3 +Merge: 3ea58718 efd65a3f Author: Patrick Schleizer Date: Sat Dec 21 06:57:10 2019 -0500 Merge remote-tracking branch 'origin/master' commit efd65a3f15fc9380e2019c9d7ad0bf82adcc230d -Merge: c336bc4 c28ddf5 +Merge: c336bc4f c28ddf5c Author: Patrick Schleizer Date: Sat Dec 21 11:56:31 2019 +0000 Merge pull request #45 from madaidan/apparmor - + Delete apparmor profiles commit 3ea587187e9d0a927799a66d15d163ee56a41978 @@ -1186,7 +18369,7 @@ Author: Patrick Schleizer Date: Sat Dec 21 06:53:07 2019 -0500 no need to exclude xorg nosuid on Debian - + http://forums.whonix.org/t/permission-hardening/8655/25 commit c336bc4fd229d9a6370df5520aaa4e872465de5a @@ -1398,7 +18581,7 @@ Author: Patrick Schleizer Date: Sat Dec 21 04:08:35 2019 -0500 record existing modes in separate dpkg-statoverwrite databases - + to have a history of what was modified and to allow to undo changes commit 89be5f2ecb998c46ff4864996cd86b97fa56d176 @@ -1436,9 +18619,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 12:59:27 2019 -0500 add "/usr/lib/xorg/Xorg.wrap whitelist" - + until this is researched - + https://manpages.debian.org/buster/xserver-xorg-legacy/Xorg.wrap.1.en.html https://lwn.net/Articles/590315/ @@ -1447,7 +18630,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 12:57:24 2019 -0500 add matchwhitelist feature - + add "/usr/lib/virtualbox/ matchwhitelist" commit 3fab3876693f20303c95f03c45af9adb9ae680e2 @@ -1455,7 +18638,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 12:50:35 2019 -0500 suid /usr/bin/firejail whitelist - + There is a controversy about firejail but those who choose to install it should be able to use it. https://www.whonix.org/wiki/Dev/Firejail#Security @@ -1483,9 +18666,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 11:58:07 2019 -0500 fix terminology, sguid -> sgid - + Thanks to @madaidan for the bug report! - + https://forums.whonix.org/t/permission-hardening/8655/21 commit 1cd5fb6a0020504c7897acf169772d39b67f4bd4 @@ -1601,7 +18784,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 10:31:26 2019 -0500 speed up setuid removal by using find with '-perm /u=s,g=s' - + https://forums.whonix.org/t/permission-hardening/8655/19 commit 4cfdf2c65b57f410163653304871ee3eb1d3f6ea @@ -1633,7 +18816,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 09:43:23 2019 -0500 fix missing processing files bug - + https://forums.whonix.org/t/permission-hardening/8655/16 commit fbe2479f486add30cd29f5c4063a140c42c502fe @@ -1641,7 +18824,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 08:54:56 2019 -0500 count processed file system objects - + to be able to verify if any were "forgotten" commit 195ea522f5a8582851792b53047185717a6f679e @@ -1673,7 +18856,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 08:13:23 2019 -0500 do not remove suid from whitelisted binaries ever - + https://forums.whonix.org/t/permission-hardening/8655/13 commit d5f1bd8dd29a4f9e1ccb6fed82a255f7b7abfe6f @@ -1681,9 +18864,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 08:02:30 2019 -0500 fix mode sanity check - + no longer use seq due to issue - + https://forums.whonix.org/t/permission-hardening/8655/13 commit ddc0eec63d744e4600f3b1b8cdf60fef6d647cbe @@ -1811,9 +18994,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:32:26 2019 -0500 remove hardening-enable - + please invent package security-paranoid instead - + https://forums.whonix.org/t/security-hardening-tool-usr-bin-hardening-enable-by-security-misc/8609 commit 6c8127e3cd32c04a6eb4641ad856c7bf2c777fee @@ -1821,7 +19004,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:29:37 2019 -0500 remove "/lib/ nosuid" from permission hardening - + Takes 1 minute to parse. No SUID binaries there by default. remount-secure mounts it with nosuid anyhow. Therefore no processing it here. @@ -1831,7 +19014,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:27:11 2019 -0500 remount /lib with nosuid,nodev - + https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/22 commit 7f201604779e442660c4c13798b2b48d706576ac @@ -1845,7 +19028,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:22:59 2019 -0500 use must manually enable permission-hardening.service - + until development finished commit fa6f1e156898572513cacb1d65b042482896011a @@ -1871,10 +19054,10 @@ Author: Patrick Schleizer Date: Fri Dec 20 04:48:02 2019 -0500 fix - + fso: /lib/ usr/lib/security-misc/permission-hardening: line 19: /usr/bin/stat: Argument list too long - + https://forums.whonix.org/t/kernel-hardening/7296/326 commit e74d2e4f94f4cdb2f3a83f27e17e19e9e4078961 @@ -2032,7 +19215,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 02:57:57 2019 -0500 skip symlinks - + https://forums.whonix.org/t/kernel-hardening/7296/323? commit cc8f795799e76d61b60f31e718effb88478b0fea @@ -2058,7 +19241,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 02:39:53 2019 -0500 check string length of permission variable - + https://forums.whonix.org/t/kernel-hardening/7296/322 commit a89befd902f6976ebef303b22ee9f9cbc3a1cc23 @@ -2126,9 +19309,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 02:01:36 2019 -0500 exit non-zero if some line cannot be parsed - + therefore make systemd notice this - + therefore allow the sysadmin to notice this commit 66bcba831317cf4810e9123b305597ee85fc94bf @@ -2156,19 +19339,19 @@ Date: Fri Dec 20 01:31:37 2019 -0500 refactoring commit c5d1e9dda7059d18fad303128f6f09c98fe955b7 -Merge: 62eb462 a20b300 +Merge: 62eb4629 a20b3001 Author: Patrick Schleizer Date: Fri Dec 20 01:30:31 2019 -0500 Merge remote-tracking branch 'origin/master' commit a20b30013f9ae229d1fe86cc5992aac474a9d8e6 -Merge: 62eb462 9df7407 +Merge: 62eb4629 9df74072 Author: Patrick Schleizer Date: Fri Dec 20 06:29:58 2019 +0000 Merge pull request #44 from madaidan/permission-hardening - + Remove SUID bits commit 9df74072862b31871d0aad7bed8333fc8344ffec @@ -2212,9 +19395,9 @@ Author: Patrick Schleizer Date: Mon Dec 16 03:52:09 2019 -0500 remount /sys/kernel/security with nodev,nosuid[,noexec] - + as suggested by @madaidan - + http://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/238 commit 2c4170e6f3366709c391db396a74547d4fed9589 @@ -2234,11 +19417,11 @@ Author: Patrick Schleizer Date: Thu Dec 12 09:29:00 2019 -0500 increase priority of pam-abort-on-locked-password-security-misc - + since it has its own user help output - + so it shows before pam tally2 info - + to avoid duplicate non-applicable help text commit a10597de92c316cc32ab552865a6658b38b19f5e @@ -2308,7 +19491,7 @@ Author: Patrick Schleizer Date: Mon Dec 9 02:23:43 2019 -0500 read -r; refactoring - + as per https://mywiki.wooledge.org/BashFAQ/001 commit 7467252122cb2e7600ce5ab3dce9dac2aa7a0676 @@ -2318,19 +19501,19 @@ Date: Mon Dec 9 02:22:16 2019 -0500 quotes commit 9bea9960173cf06dcbc0aefa2fb3b10df1f84c69 -Merge: 6f94423 af62da3 +Merge: 6f944234 af62da34 Author: Patrick Schleizer Date: Mon Dec 9 02:21:47 2019 -0500 Merge remote-tracking branch 'origin/master' commit af62da34457a56fee43a6003036a3bb387b23b32 -Merge: 6f94423 d7e2dea +Merge: 6f944234 d7e2deae Author: Patrick Schleizer Date: Sun Dec 8 20:45:16 2019 +0000 Merge pull request #42 from madaidan/permission-hardening - + File permission hardening commit d7e2deae9250abd79ab83c2025b98476dde710d3 @@ -2368,20 +19551,20 @@ Author: Patrick Schleizer Date: Sun Dec 8 05:21:35 2019 -0500 security-misc `/usr/share/pam-configs/permission-lockdown-security-misc` is no longer required, removed. - + Thereby fix apparmor issue. - + > Dec 08 09:47:50 host audit[3232]: AVC apparmor="DENIED" operation="exec" profile="/usr/bin/whonixcheck" name="/usr/lib/security-misc/permission-lockdown" pid=3232 comm="sudo" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 > Dec 08 09:47:50 host sudo[3232]: pam_exec(sudo:session): execve(/usr/lib/security-misc/permission-lockdown,...) failed: Permission denied - + It is no longer required, because... - + existing linux user accounts: - + * Get permission lock down because security-misc `debian/security-misc.postinst` calls `/usr/lib/security-misc/permission-lockdown`. - + new linux user accounts (created at first boot): - + * security-misc `/usr/share/pam-configs/mkhomedir-security-misc` pam mkhomedir sets secure permissions using `umask=027`. commit edcc2de71dea9cf2f94ec008d2817a0cdfdf5b7c @@ -2407,9 +19590,9 @@ Author: Patrick Schleizer Date: Sun Dec 8 04:25:19 2019 -0500 skip sudo_users_check in Qubes - + Qubes users can use dom0 to get a root terminal emulator. - + For example: qvm-run -u root debian-10 xterm @@ -2448,7 +19631,7 @@ Author: Patrick Schleizer Date: Sun Dec 8 03:15:53 2019 -0500 higher priority usr/share/pam-configs/tally2-security-misc - + so it can give info before pam stack gets aborted by other pam modules commit 3bd0b3f837d5ad8c87e59b99c6baef1e2c74507b @@ -2480,7 +19663,7 @@ Author: Patrick Schleizer Date: Sun Dec 8 02:38:19 2019 -0500 abort installation if no user is a member of group "console"; output - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/7 commit 1dbca1ea2d80ff7f60a0f426b444994d6bd97d30 @@ -2568,19 +19751,19 @@ Date: Sun Dec 8 01:30:42 2019 -0500 description commit 491dd4d93d133ca23eaf5c501b7ab3d3bbf52a27 -Merge: 9432d16 a78a7e5 +Merge: 9432d163 a78a7e55 Author: Patrick Schleizer Date: Sun Dec 8 01:22:16 2019 -0500 Merge remote-tracking branch 'origin/master' commit a78a7e5571b178cbf4cddd065306d130431bc185 -Merge: 373e873 6846a94 +Merge: 373e8733 6846a943 Author: Patrick Schleizer Date: Sun Dec 8 06:21:44 2019 +0000 Merge pull request #41 from madaidan/system.map - + Check for more locations of System.map commit 6846a943277c5ad9049cbf3e21fcd739c316cf44 @@ -2596,19 +19779,19 @@ Date: Sat Dec 7 12:13:42 2019 -0500 /usr/bin/cat mrix, commit 373e8733d37cb795c7c48642346b0b6dc6dce30c -Merge: c1800b1 447eb14 +Merge: c1800b13 447eb144 Author: Patrick Schleizer Date: Sat Dec 7 11:34:42 2019 -0500 Merge remote-tracking branch 'origin/master' commit 447eb144325a532b0aaf7ce772d5a04005b2af1f -Merge: c1800b1 668b642 +Merge: c1800b13 668b6420 Author: Patrick Schleizer Date: Sat Dec 7 16:34:21 2019 +0000 Merge pull request #40 from madaidan/system.map - + Remove hyphen from remove-system.map commit c1800b13fe33a1c129dcb30c51dbead7f894b818 @@ -2616,9 +19799,9 @@ Author: Patrick Schleizer Date: Sat Dec 7 11:26:39 2019 -0500 separate group "ssh" for incoming ssh console permission - + Thanks to @madaidan - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/16 commit 668b6420de8024fdeaf948f1750beb8b62d9ffb7 @@ -2716,22 +19899,22 @@ Author: Patrick Schleizer Date: Sat Dec 7 05:40:20 2019 -0500 Console Lockdown. - + Allow members of group 'console' to use tty1 to tty7. Everyone else except members of group 'console-unrestricted' are restricted from using console using ancient, unpopular login methods such as using /bin/login over networks, which might be exploitable. (CVE-2001-0797) - + Not enabled by default in this package since this package does not know which users shall be added to group 'console'. - + In new Whonix builds, user 'user" will be added to group 'console' and pam console-lockdown enabled by package anon-base-files. - + /usr/share/pam-configs/console-lockdown - + /etc/security/access-security-misc.conf - + https://forums.whonix.org/t/etc-security-hardening/8592 commit 52934c9288a596b233c1ce3b5f68a29248602c96 @@ -2823,7 +20006,7 @@ Author: Patrick Schleizer Date: Fri Dec 6 05:14:02 2019 -0500 remount /home /tmp /dev/shm /run with nosuid,nodev (default) and noexec (opt-in) - + https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 commit 8cf5ed990a3940c108d661c6c169b5720b1459d1 @@ -2833,19 +20016,19 @@ Date: Thu Dec 5 15:52:24 2019 -0500 comment commit 19add3299c9215d05208e3c2e748527bf87e66b5 -Merge: 0c25a96 9679292 +Merge: 0c25a96b 96792928 Author: Patrick Schleizer Date: Thu Dec 5 15:46:19 2019 -0500 Merge remote-tracking branch 'origin/master' commit 96792928787c1c129a964bd81e97450d2edb29a6 -Merge: 0c25a96 af9e19c +Merge: 0c25a96b af9e19c5 Author: Patrick Schleizer Date: Thu Dec 5 20:33:47 2019 +0000 Merge pull request #39 from madaidan/rp_filter - + Enable reverse path filtering commit af9e19c51f256504c5c2206e31da1911872b6ef8 @@ -2867,19 +20050,19 @@ Date: Tue Dec 3 02:18:32 2019 -0500 description / comments commit d26ba05c4776cdff0750b872f3da70fd25fca1f4 -Merge: 6ca48ff 73c6410 +Merge: 6ca48fff 73c6410a Author: Patrick Schleizer Date: Tue Dec 3 01:52:04 2019 -0500 Merge remote-tracking branch 'origin/master' commit 73c6410a0e1e6e56529ba8ea98681867bd8acb37 -Merge: 6ca48ff 8d63da3 +Merge: 6ca48fff 8d63da3c Author: Patrick Schleizer Date: Tue Dec 3 06:51:31 2019 +0000 Merge pull request #38 from madaidan/distrust-cpu - + Distrust the CPU for initial entropy commit 8d63da3cef6e114deaa6943ea9a633d6620a974b @@ -2929,25 +20112,25 @@ Author: Patrick Schleizer Date: Wed Nov 27 10:22:31 2019 -0500 fix, make sure to undo pam changes on package removal - + Thanks to minimal for the bug report! - + https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/11 commit 62b924eea7d50f58649e089ff9cf8d73075cac63 -Merge: 9091f69 ba02dcb +Merge: 9091f69e ba02dcb2 Author: Patrick Schleizer Date: Tue Nov 26 13:00:36 2019 -0500 Merge remote-tracking branch 'origin/master' commit ba02dcb267a95d332bd01bb3fc725e051ccb3246 -Merge: 9091f69 d9d6d07 +Merge: 9091f69e d9d6d077 Author: Patrick Schleizer Date: Tue Nov 26 18:00:11 2019 +0000 Merge pull request #37 from madaidan/apparmor-fixes - + Fix permission-lockdown commit d9d6d0771433700f49c4ddf156a0b5bc7098d94b @@ -2973,7 +20156,7 @@ Author: Patrick Schleizer Date: Mon Nov 25 01:39:53 2019 -0500 Lock user accounts after 50 rather than 100 failed login attempts. - + https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698/19 commit 6277db1383451822769948bbebac31f719e98e74 @@ -2993,11 +20176,11 @@ Author: Patrick Schleizer Date: Sat Nov 23 11:20:32 2019 +0000 load jitterentropy_rng kernel module for better entropy collection - + https://www.whonix.org/wiki/Dev/Entropy - + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972 - + https://forums.whonix.org/t/jitterentropy-rngd/7204 commit d32024a3da3cdfbb07f61dd3e9a52535e747de6b @@ -3005,7 +20188,7 @@ Author: Patrick Schleizer Date: Sat Nov 23 05:53:19 2019 -0500 /usr/sbin/pam_tally2 mrix, - + https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/152 commit 03e80238477bef26cf14a86a136d2ab688c87d08 @@ -3039,19 +20222,19 @@ Date: Mon Nov 18 19:16:16 2019 +0000 bumped changelog version commit 9a20b85fe16584dda909fd5f1aa6bbb62d06bcf0 -Merge: 477d476 2b17c0f +Merge: 477d476b 2b17c0f3 Author: Patrick Schleizer Date: Sun Nov 17 11:20:17 2019 -0500 Merge remote-tracking branch 'origin/master' commit 2b17c0f3e4dcd7cb9f2239da649b4a885c27e7cf -Merge: 477d476 e92022a +Merge: 477d476b e92022a2 Author: Patrick Schleizer Date: Sun Nov 17 16:19:55 2019 +0000 Merge pull request #36 from madaidan/hidepid-fix - + Remove proc-hidepid systemd sandboxing commit e92022a21cbe2df76026b36482f5c71e3471b344 @@ -3107,7 +20290,7 @@ Author: Patrick Schleizer Date: Tue Nov 5 10:02:55 2019 -0500 do not set kernel boot parameter page_poison=1 in Qubes since does not work - + https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012 commit f57702c1589047f5d0eff7a7bdffb928117532f6 @@ -3145,9 +20328,9 @@ Author: Patrick Schleizer Date: Sun Nov 3 04:34:31 2019 -0500 add /var/cache/security-misc/state-files/placeholder file - + to make sure folder already exists to avoid AppArmor issue - + https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/76 commit 7c0ec7e50797c0da719f389e61445ff7d8e252b3 @@ -3163,7 +20346,7 @@ Date: Sun Nov 3 02:50:51 2019 -0500 Enables punycode (`network.IDN_show_punycode`) by default in Thunderbird to make phising attacks more difficult. Fixing URL not showing real Domain Name (Homograph attack). - + https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415 commit bf62306d4fc3b3168204254ca354028a1fe857a7 @@ -3177,7 +20360,7 @@ Author: Patrick Schleizer Date: Thu Oct 31 16:32:28 2019 +0000 apparmor fix - + https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/67 commit 6e5d8b357d977991953e153d618dbdda2b05c0e6 @@ -3193,19 +20376,19 @@ Date: Thu Oct 31 11:19:44 2019 -0400 copyright commit f001250ae61789bef7b2b19d5c40831273b0acca -Merge: d832ab9 5a3cbe8 +Merge: d832ab91 5a3cbe81 Author: Patrick Schleizer Date: Mon Oct 28 10:31:30 2019 -0400 Merge remote-tracking branch 'origin/master' commit 5a3cbe81000c3a9bbc69ba03c944c6c5ae9115bf -Merge: d832ab9 0e49bdc +Merge: d832ab91 0e49bdc4 Author: Patrick Schleizer Date: Mon Oct 28 14:30:45 2019 +0000 Merge pull request #35 from madaidan/apparmor - + Apparmor profiles commit 0e49bdc45f6c94b3f6c2874fd48a6b1c75519790 @@ -3321,11 +20504,11 @@ Author: Patrick Schleizer Date: Mon Oct 21 05:46:49 2019 -0400 Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with hidepid. - + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 - + https://forums.whonix.org/t/cannot-use-pkexec/8129 - + Thanks to AnonymousUser for the bug report! commit 31b771ac2e1cd692851f0d58191c3147d4a09335 @@ -3345,7 +20528,7 @@ Author: Patrick Schleizer Date: Fri Oct 18 10:38:25 2019 +0000 fix lintian warning - + W: security-misc: maintainer-script-should-not-parse-etc-passwd-or-group preinst:19 commit d301e7f3653bdb4b56c42deab9d0566ff1b27380 @@ -3371,9 +20554,9 @@ Author: Patrick Schleizer Date: Thu Oct 17 06:46:47 2019 -0400 abort installation if no user is part of group sudo - + https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 - + Thanks to minimal for the bug report! commit a5045dc26e3b7d6acd6ae2c5727920824f992cc7 @@ -3412,7 +20595,7 @@ Author: Patrick Schleizer Date: Thu Oct 17 06:08:55 2019 -0400 shuffle - + https://forums.whonix.org/t/restrict-hardware-information-to-root/7329/80 commit 28a440091dd98fd4f3284cce01d692c08aa96bf1 @@ -3428,28 +20611,28 @@ Date: Thu Oct 17 06:05:23 2019 -0400 remove trailing spaces commit c8e0303d6d59e3303c0582ff8ab2664762199c81 -Merge: 4b1b3b7 8a42c5b +Merge: 4b1b3b7d 8a42c5b0 Author: Patrick Schleizer Date: Thu Oct 17 06:04:34 2019 -0400 Merge remote-tracking branch 'origin/master' commit 8a42c5b02387da454ff5661057be88a7c6fe9d9c -Merge: 994ca02 61f7423 +Merge: 994ca024 61f74230 Author: Patrick Schleizer Date: Thu Oct 17 09:59:12 2019 +0000 Merge pull request #34 from madaidan/whitelist - + Add a whitelist for /sys and /proc/cpuinfo commit 994ca024c24cf80075b2f03bc65475a5d9980d94 -Merge: 4b1b3b7 259b1f2 +Merge: 4b1b3b7d 259b1f2c Author: Patrick Schleizer Date: Thu Oct 17 06:19:46 2019 +0000 Merge pull request #33 from madaidan/documentation - + Improve documentation commit 61f742304d26e73df8433bd6fa03d33d39e39625 @@ -3565,7 +20748,7 @@ Author: Patrick Schleizer Date: Sat Oct 5 13:15:34 2019 +0000 comment out sack by default - + https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109/8?u=patrick commit 02096f8d7c7ee1f61285cf96564616f2828aa6c2 @@ -3573,7 +20756,7 @@ Author: Patrick Schleizer Date: Sat Oct 5 13:13:46 2019 +0000 Revert "undo Disabling TCP SACK, DSACK, FACK" - + This reverts commit 5fb4eb8e561e7c37cea977072944501fc32ee883. commit 62a0239207ee355e3d07e0097c963a0ded496e76 @@ -3593,23 +20776,23 @@ Author: Patrick Schleizer Date: Sat Oct 5 07:00:47 2019 -0400 undo Disabling TCP SACK, DSACK, FACK - + https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109/5 commit c19942f72b8d74056dd8da8c3cd9ac7e0fbe8991 -Merge: 213aef6 a33851a +Merge: 213aef6e a33851a3 Author: Patrick Schleizer Date: Sat Oct 5 06:58:27 2019 -0400 Merge remote-tracking branch 'origin/master' commit a33851a3c99a5eb9021d2d28b3164ed10025fbd9 -Merge: 213aef6 d0c6bb1 +Merge: 213aef6e d0c6bb1e Author: Patrick Schleizer Date: Sat Oct 5 10:58:08 2019 +0000 Merge pull request #32 from madaidan/disable-dsack-fack - + Disable TCP DSACK and FACK commit 213aef6eb9288efffe9fb0458f0aa8a44a6dafa6 @@ -3643,19 +20826,19 @@ Date: Sat Oct 5 09:14:41 2019 +0000 chmod +x usr/lib/security-misc/hide-hardware-info commit ffe0d62c8148ec60f7528002e988b969ebb868ca -Merge: ddc778b 7bcf73d +Merge: ddc778b4 7bcf73de Author: Patrick Schleizer Date: Sat Oct 5 04:49:05 2019 -0400 Merge remote-tracking branch 'origin/master' commit 7bcf73deaa1c77f9c650d8844ad94d24e38746fd -Merge: ddc778b 7345287 +Merge: ddc778b4 73452875 Author: Patrick Schleizer Date: Sat Oct 5 08:46:21 2019 +0000 Merge pull request #31 from madaidan/hide-hardware-info - + Restrict /proc/cpuinfo, /proc/bus, /proc/scsi and /sys to root commit d0c6bb1e9064ffdf45f7ac606f708c3f5e7dc247 @@ -3735,17 +20918,17 @@ Author: Patrick Schleizer Date: Mon Sep 16 12:30:23 2019 +0000 pam_tally2-info: fix, do nothing when started as user "user" - + xscreensaver runs as user "user", therefore pam_tally2 cannot function. xscreensaver has its own failed login counter. - + as user "user" /sbin/pam_tally2 -u user pam_tally2: Error opening /var/log/tallylog for update: Permission denied /sbin/pam_tally2: Authentication error - + https://askubuntu.com/questions/983183/how-lock-the-unlock-screen-after-wrong-password-attempts - + https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698 commit c2e444479cf723a7ddb3c51cd6394795daba108e @@ -3789,7 +20972,7 @@ Author: Patrick Schleizer Date: Tue Sep 10 12:35:42 2019 -0400 undo SysRq restrictions - + https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079 commit fbd1a5bde922be9c571d54567c977618e2c4bfc5 @@ -3805,19 +20988,19 @@ Date: Mon Sep 9 12:10:24 2019 +0000 bumped changelog version commit 1b4391417619a51cfe22d9eee21d9fa644d145b6 -Merge: 9d875d7 d0b3bc7 +Merge: 9d875d7c d0b3bc7d Author: Patrick Schleizer Date: Mon Sep 9 11:45:36 2019 +0000 Merge remote-tracking branch 'origin/master' commit d0b3bc7d3da6a4e3a04adb85cc5c7aa6c22bb466 -Merge: 9d875d7 60db7e6 +Merge: 9d875d7c 60db7e62 Author: Patrick Schleizer Date: Mon Sep 9 11:45:19 2019 +0000 Merge pull request #30 from madaidan/patch-23 - + fix typo commit 60db7e6294ab405a862c1cbc62140c9e89208b25 @@ -3843,7 +21026,7 @@ Author: Patrick Schleizer Date: Sat Sep 7 05:47:34 2019 +0000 blacklist modules with /bin/false rather than /bin/true to fail with error - + message rather than failing without notification commit 8132052ce01215a98cb4464e5f78d75349e77b10 @@ -3857,7 +21040,7 @@ Author: Patrick Schleizer Date: Sat Sep 7 05:39:56 2019 +0000 allow loading unsigned modules due to issues - + https://forums.whonix.org/t/allow-loading-signed-kernel-modules-by-default-disallow-kernel-module-loading-by-default/7880/23 commit 9ee9309f542472a8c8045df44573a5ec38e32a90 @@ -3979,9 +21162,9 @@ Author: Patrick Schleizer Date: Sat Aug 24 12:14:22 2019 -0400 remove umask changes since these are causing issues are are not needed anymore - + thanks to home folder permission lockdown - + https://forums.whonix.org/t/change-default-umask/7416/45 commit 41c4682280b7bc8e700d9ed41b55e464c0511b69 @@ -3997,7 +21180,7 @@ Date: Fri Aug 23 16:53:55 2019 +0000 readme commit 793c9b6801ffda5d75d389b8e7a2a6d140d8d382 -Merge: a74b983 44d62e0 +Merge: a74b9832 44d62e05 Author: Patrick Schleizer Date: Mon Aug 19 12:48:23 2019 +0000 @@ -4008,22 +21191,22 @@ Author: Patrick Schleizer Date: Mon Aug 19 12:46:59 2019 +0000 remove LLC - IEEE 802.2 from blacklist - + since required by KVM - + https://forums.whonix.org/t/whonix-desktop-installer-with-calamares-field-report/7350/107 - + https://forums.whonix.org/t/blacklist-uncommon-network-protocols/7391/22 - + https://github.com/Whonix/security-misc/pull/29 commit 44d62e05b5a60a3d45afd829fb67970afa7678b7 -Merge: 0140df8 a8b6281 +Merge: 0140df86 a8b62811 Author: Patrick Schleizer Date: Mon Aug 19 12:45:52 2019 +0000 Merge pull request #29 from onions-knight/patch-1 - + Update uncommon-network-protocols.conf commit a8b62811199b6c4e5d86439cd0fc9e9c18dc027b @@ -4031,7 +21214,7 @@ Author: onions-knight <38859709+onions-knight@users.noreply.github.com> Date: Mon Aug 19 11:30:57 2019 +0000 Update uncommon-network-protocols.conf - + Removing llc from blacklisted network protocols as it is needed by KVM for networking. See https://hub.packtpub.com/kvm-networking-libvirt/ and https://forums.whonix.org/t/whonix-desktop-installer-with-calamares-field-report/7350/107 @@ -4070,7 +21253,7 @@ Author: Patrick Schleizer Date: Mon Aug 19 07:47:20 2019 +0000 keep cache folder outside of reach of user since even user can remove files - + owned by root in its home folder commit 1fa1efa58e6f719766394bc8b94d4aa4076bdc0d @@ -4126,9 +21309,9 @@ Author: Patrick Schleizer Date: Sat Aug 17 10:33:47 2019 +0000 PAM: abort on locked password - + to avoid needlessly bumping pam_tally2 counter - + https://forums.whonix.org/t/restrict-root-access/7658/1 commit e0e25364e2d14459b918eea2cb63cbe10b8371f3 @@ -4148,9 +21331,9 @@ Author: Patrick Schleizer Date: Sat Aug 17 09:55:20 2019 +0000 change default umask to 027 - + as per: - + https://forums.whonix.org/t/change-default-umask/7416/47 commit b9127faac300024f7d8851d41037bebd5d3fe05c @@ -4188,7 +21371,7 @@ Author: Patrick Schleizer Date: Fri Aug 16 11:15:25 2019 -0400 sudo default umask 006 - + https://forums.whonix.org/t/change-default-umask/7416/43 commit 17cfcb63b6358f51a65df9623bc23ddf869b06cc @@ -4198,23 +21381,23 @@ Date: Fri Aug 16 10:50:56 2019 -0400 code simplification; report locked account earlier commit 5754671c460c67bd7d8e064841383ea7b7f90824 -Merge: 34672b8 9781598 +Merge: 34672b88 97815986 Author: Patrick Schleizer Date: Fri Aug 16 10:36:43 2019 -0400 Merge remote-tracking branch 'origin/master' commit 97815986321b6daf9c1f0c6f33a4b282ca05438c -Merge: 34672b8 85502ad +Merge: 34672b88 85502ad4 Author: Patrick Schleizer Date: Fri Aug 16 14:36:00 2019 +0000 Merge pull request #27 from madaidan/patch-21 - + Blacklist bluetooth commit 85502ad430f560070806c8b95b7fed3fe7028587 -Merge: 4a6f87f 34672b8 +Merge: 4a6f87f3 34672b88 Author: Patrick Schleizer Date: Fri Aug 16 14:35:51 2019 +0000 @@ -4237,7 +21420,7 @@ Author: Patrick Schleizer Date: Thu Aug 15 13:37:28 2019 +0000 informational output during PAM: - + * Show failed and remaining password attempts. * Document unlock procedure if Linux user account got locked. * Point out, that there is no password feedback for `su`. @@ -4256,7 +21439,7 @@ Author: Patrick Schleizer Date: Thu Aug 15 07:30:56 2019 +0000 use requisite rather than required to avoid asking for password needlessly - + if login will fail anyhow commit ce4a30d3cecb7e9bddb96c79aab871804cb90bd4 @@ -4282,7 +21465,7 @@ Author: Patrick Schleizer Date: Wed Aug 14 11:10:18 2019 +0000 add Depends: apparmor-profile-anondist to fix apparmor issue - + sudo[19806]: pam_exec(sudo:session): execve(/usr/lib/security-misc/permission-lockdown,...) failed: Permission denied sudo[18961]: pam_exec(sudo:session): /usr/lib/security-misc/permission-lockdown failed: exit code 13 kernel: audit: type=1400 audit(1565780860.972:224): apparmor="DENIED" operation="exec" profile="/usr/bin/whonixcheck" name="/usr/lib/security-misc/permission-lockdown" pid=19806 comm="sudo" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 @@ -4382,7 +21565,7 @@ Author: Patrick Schleizer Date: Wed Aug 14 08:34:03 2019 +0000 run permission lockdown during pam - + https://forums.whonix.org/t/change-default-umask/7416 commit 42f2d5f6664f15baebdaf200a5690cf32cdbe284 @@ -4408,12 +21591,12 @@ Author: Patrick Schleizer Date: Wed Aug 14 07:22:14 2019 +0000 add hook etc/kernel/postinst.d/30_remove-system-map to remove system.map - + on kernel package upgrade; - + self-document this package: during upgrade the following will be written to stdout: - + Setting up linux-image-4.19.0-5-amd64 (4.19.37-5+deb10u2) ... /etc/kernel/postinst.d/30_remove-system-map: removed '/boot/System.map-4.19.0-5-amd64 @@ -4437,19 +21620,19 @@ Date: Wed Aug 14 07:01:25 2019 +0000 description commit ff8c0979435b491cf462c5ef6e8e02f6d85f1d81 -Merge: 6f8acf0 a8ea379 +Merge: 6f8acf06 a8ea3795 Author: Patrick Schleizer Date: Wed Aug 14 06:59:50 2019 +0000 Merge remote-tracking branch 'origin/master' commit a8ea37952669b3f40a452cb580442126ec44233a -Merge: 6f8acf0 9a49b8e +Merge: 6f8acf06 9a49b8ec Author: Patrick Schleizer Date: Wed Aug 14 06:59:34 2019 +0000 Merge pull request #28 from madaidan/patch-22 - + Require all loaded kernel modules to be signed with a valid key. commit 9a49b8ecbb863a995862a4d380c6a03f6c0991ac @@ -4457,7 +21640,7 @@ Author: madaidan <50278627+madaidan@users.noreply.github.com> Date: Tue Aug 13 13:33:07 2019 +0000 Create 40_only_allow_signed_modules.cfg - + Require all loaded kernel modules to be signed with a valid key. commit 6f8acf06d79c77e3bee15cc8696a433271e2b7c9 @@ -4520,11 +21703,11 @@ Author: Patrick Schleizer Date: Sat Aug 10 07:07:28 2019 -0400 pam_tally2.so deny=100 - + during testing, due to issues - + https://github.com/Whonix/security-misc/commit/d17e25272b9b7bbb6abc4dccd500a6b34311a7dd - + https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698/12 commit d17e25272b9b7bbb6abc4dccd500a6b34311a7dd @@ -4532,12 +21715,12 @@ Author: Patrick Schleizer Date: Sat Aug 10 06:06:39 2019 -0400 effectively (not directly) add "required pam_tally2.so debug" to /etc/pam.d/common-account - + This is required because otherwise something like "sudo bash" would count as a failed login for pam_tally2 even though it was successful. - + https://bugzilla.redhat.com/show_bug.cgi?id=707660 - + https://forums.whonix.org/t/restrict-root-access/7658 commit 0f896a9d8d6f7c125311a0e226755f8a00214f3c @@ -4676,33 +21859,33 @@ Date: Mon Jul 22 01:16:18 2019 +0000 bumped changelog version commit f38f307b37d2efb036c5b4e85f48921b0acfadeb -Merge: 8c538ba b2582fb +Merge: 8c538ba3 b2582fbd Author: Patrick Schleizer Date: Sun Jul 21 09:12:33 2019 -0400 Merge remote-tracking branch 'origin/master' commit b2582fbd4c2364c7bca95b4038eec2ef2a2fae41 -Merge: 8c538ba 077899c +Merge: 8c538ba3 077899c2 Author: Patrick Schleizer Date: Sun Jul 21 12:40:37 2019 +0000 Merge pull request #26 from fepitre/fix-files - + Fix files commit 077899c23d518416cd9ee801a3607585d3a51aab -Author: Frédéric Pierret (fepitre) +Author: Fr_d_ric Pierret (fepitre) Date: Sun Jul 21 11:23:06 2019 +0200 Add .gitignore commit 5fbe7537613a2034d80983e095cdd8d2971b1bcc -Author: Frédéric Pierret (fepitre) +Author: Fr_d_ric Pierret (fepitre) Date: Sun Jul 21 11:19:35 2019 +0200 spec: update %files section - + QubesOS/qubes-issues#1885 commit 8c538ba318e5524d07034f2f718e4b5ae483176d @@ -4782,10 +21965,10 @@ Author: Patrick Schleizer Date: Wed Jul 17 20:36:51 2019 +0000 passwordless recovery / emergency console - + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d - + https://forums.whonix.org/t/restrict-root-access/7658/46 commit 50036b2934410b57936a4909d022d436cd27cdfc @@ -4799,7 +21982,7 @@ Author: Patrick Schleizer Date: Wed Jul 17 14:25:19 2019 -0400 Revert "set back to default group "root" rather than group "sudo" membership required to use su" - + This reverts commit 2f276cdb10aedf0d30c01d25e50b17cac7d1c62c. commit 1b772c6a9aac9e6c203c0c89b49e589a2b6e83d3 @@ -4855,11 +22038,11 @@ Author: Patrick Schleizer Date: Mon Jul 15 08:44:28 2019 -0400 set back to default group "root" rather than group "sudo" membership required to use su - + since root login will be locked by default anyhow - + Thanks to @madaidan for providing the rationale! - + https://forums.whonix.org/t/restrict-root-access/7658/42 commit 6d1e8ac9a4657bb3d49a9674ce3a1500350d4bba @@ -4873,7 +22056,7 @@ Author: Patrick Schleizer Date: Sun Jul 14 11:11:59 2019 +0000 fix, add 'group=sudo' and 'debug' for debugging - + https://forums.whonix.org/t/restrict-root-access/7658 commit 1731196c9fda93233917bcf6dba48834be03a448 @@ -4942,9 +22125,9 @@ Date: Sat Jul 13 16:21:34 2019 +0000 removed: The amount of hashing rounds used by shadow is bumped to 65536. This increases the security of hashed passwords. - + Since we do not do that currently. - + https://forums.whonix.org/t/restrict-root-access/7658/37 commit 3f031a297dc2d54346e9c9b3d566c3fa3a469240 @@ -5000,7 +22183,7 @@ Author: Patrick Schleizer Date: Sat Jul 13 10:35:10 2019 -0400 port umask from /etc/pam.d to /usr/share/pam-configs implementation - + https://forums.whonix.org/t/change-default-umask/7416 commit ac25733de871b0da5ef42e2e0283a44d94ac3112 @@ -5008,9 +22191,9 @@ Author: Patrick Schleizer Date: Sat Jul 13 14:01:53 2019 +0000 remove etc/pam.d/common-password.security-misc rounds=65536 - + due to unclean implementation, see: - + https://forums.whonix.org/t/restrict-root-access/7658/37 commit 69b97981f3b5e4efc75954d6957659f1bb8e7d18 @@ -5018,7 +22201,7 @@ Author: Patrick Schleizer Date: Sat Jul 13 12:33:51 2019 +0000 convert etc/pam.d/su.security-misc to usr/share/pam-configs/wheel - + https://forums.whonix.org/t/restrict-root-access/7658/32 commit 4079632d1aed4f3e50ea21de674a9b6d537d3e05 @@ -5028,7 +22211,7 @@ Date: Sat Jul 13 11:41:37 2019 +0000 remove modifying to /etc/pam.d directly (unrelased) config-package-dev displace /etc/securetty remove trailing spaces - + https://forums.whonix.org/t/restrict-root-access/7658/31 commit cdb7c6f7eb8e61bd203c9a4cb755da0b97cc9a3d @@ -5044,19 +22227,19 @@ Date: Thu Jul 11 18:26:17 2019 +0000 fix lintian warning commit a40a04aaec0c30ceb47266a3f9b2b714e9b89888 -Merge: f5356ce 93190eb +Merge: f5356cee 93190ebf Author: Patrick Schleizer Date: Thu Jul 11 14:08:30 2019 -0400 Merge remote-tracking branch 'origin/master' commit 93190ebf1019f76b73cf0f1e4491f15fd36bcae1 -Merge: f5356ce 1aee08f +Merge: f5356cee 1aee08fa Author: Patrick Schleizer Date: Thu Jul 11 18:08:01 2019 +0000 Merge pull request #25 from madaidan/patch-20 - + Improve documentation of blacklisting uncommon network protocols commit 1aee08fa5e46cbd9439c36df9bcbb7a513270e1b @@ -5096,28 +22279,28 @@ Date: Thu Jul 11 07:07:01 2019 +0000 fix lintian warning commit 2a893c0562438aaf0c34a25538a8e21bb11ba197 -Merge: 3df6a44 a54500c +Merge: 3df6a44e a54500c6 Author: Patrick Schleizer Date: Thu Jul 11 06:50:35 2019 +0000 Merge remote-tracking branch 'origin/master' commit a54500c6f18719520ae66c335870d3e8f03e9e14 -Merge: 7d3a615 1e4d349 +Merge: 7d3a6156 1e4d3495 Author: Patrick Schleizer Date: Thu Jul 11 06:41:37 2019 +0000 Merge pull request #23 from madaidan/patch-18 - + Blacklist more uncommon network protocols commit 7d3a61564dc01b899466defe957a7bc65d38dc89 -Merge: 3df6a44 932524c +Merge: 3df6a44e 932524cb Author: Patrick Schleizer Date: Thu Jul 11 06:41:08 2019 +0000 Merge pull request #24 from madaidan/patch-19 - + Move disable-coredumps.conf to correct position commit 932524cbd1b15df06bd4e395dc391dd489ba100f @@ -5163,42 +22346,42 @@ Date: Tue Jul 9 06:56:23 2019 -0400 also allow members of group sudo to run /usr/lib/security-misc/panic-on-oops commit 5fb500ac32a8935ef989770b2b9d17df4fa1698c -Merge: 8793708 e4bb770 +Merge: 87937089 e4bb7703 Author: Patrick Schleizer Date: Tue Jul 9 06:55:27 2019 -0400 Merge remote-tracking branch 'origin/master' commit e4bb77037e9327eea7b8fd92961192613d6e0763 -Merge: a9441e7 0f15303 +Merge: a9441e7b 0f15303e Author: Patrick Schleizer Date: Tue Jul 9 10:54:48 2019 +0000 Merge pull request #21 from madaidan/patch-16 - + Make the kernel panic on oopses commit 0f15303eb4dd5701cae5b3985be47918e2e4700a -Merge: 45f8102 a9441e7 +Merge: 45f8102d a9441e7b Author: Patrick Schleizer Date: Tue Jul 9 10:54:24 2019 +0000 Merge branch 'master' into patch-16 commit 8793708906d037746a2e946177d8a4d1884b391a -Merge: 50c00fc a9441e7 +Merge: 50c00fcf a9441e7b Author: Patrick Schleizer Date: Tue Jul 9 03:23:26 2019 -0400 Merge remote-tracking branch 'origin/master' commit a9441e7be4794e88f782f1ff5dd95f00e3928279 -Merge: 50c00fc 24b326d +Merge: 50c00fcf 24b326d9 Author: Patrick Schleizer Date: Tue Jul 9 07:21:47 2019 +0000 Merge pull request #22 from madaidan/patch-17 - + Restrict access to the root account commit 24b326d906375bb543b936936519231f51154dcd @@ -5272,7 +22455,7 @@ Author: Patrick Schleizer Date: Sun Jul 7 23:39:58 2019 +0000 add 'Depends: libpam-cgfs' - + https://forums.whonix.org/t/change-default-umask/7416/30?u=patrick commit d31a16f264ea23a2fc890ffd6664deac3f4c4bdf @@ -5292,7 +22475,7 @@ Author: Patrick Schleizer Date: Sun Jul 7 21:31:56 2019 +0000 move to pam-auth-update --force - + --package hangs in Qubes updater since it starts whiptail for interactive dpkg configuration dialog. commit 8399a1136788dfbbfd5dfb5c11356776e90326cc @@ -5306,7 +22489,7 @@ Author: Patrick Schleizer Date: Sun Jul 7 21:09:26 2019 +0000 add "Depends: libpam-runtime" so pam-auth-update is available - + for Debian maintainer script commit f68b96241c6afc7dffa8831f35d38bf1bf49508a @@ -5322,7 +22505,7 @@ Date: Sun Jul 7 16:51:40 2019 -0400 Due to error: Jul 07 20:35:39 host sudo[16090]: PAM unable to dlopen(pam_cgfs.so): /lib/security/pam_cgfs.so: cannot open shared object file: No such file or directory Jul 07 20:35:39 host sudo[16090]: PAM adding faulty module: pam_cgfs.so - + run: pam-auth-update --package from Debian maintainer scripts @@ -5344,9 +22527,9 @@ Author: Patrick Schleizer Date: Sun Jul 7 09:37:25 2019 +0000 Enable APT seccomp sandboxing. - + Thanks to @torjunkie for the suggestion! - + https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702 commit 93e81b433036ef2f226d0a2b1422034aba54ea3a @@ -5368,19 +22551,19 @@ Date: Sat Jul 6 13:53:10 2019 +0000 bumped changelog version commit 7b0b9da32c660e527741a56543c78ee3ac93d541 -Merge: 6df7b3c 649878f +Merge: 6df7b3c2 649878fd Author: Patrick Schleizer Date: Sat Jul 6 07:06:54 2019 -0400 Merge remote-tracking branch 'origin/master' commit 649878fdcb81ac621af9bc1481a3b6b41d3e22a0 -Merge: 6df7b3c 8888147 +Merge: 6df7b3c2 8888147e Author: Patrick Schleizer Date: Sat Jul 6 11:06:25 2019 +0000 Merge pull request #20 from madaidan/patch-15 - + Blacklist HDLC and use "install" for blacklisting firewire/thunderbolt commit 8888147e1e1102fa852dce14c3ca1cb91cd1ff3b @@ -5442,7 +22625,7 @@ Author: Patrick Schleizer Date: Mon Jul 1 13:35:45 2019 +0000 config-package-dev displace files for change umask - + https://forums.whonix.org/t/change-default-umask/7416 commit a73f0566e978afb6d5b9693bf432a2496bedd61f @@ -5450,9 +22633,9 @@ Author: Patrick Schleizer Date: Mon Jul 1 13:25:23 2019 +0000 change default umask to 006 - + session optional pam_umask.so usergroups - + https://forums.whonix.org/t/change-default-umask/7416/17 commit 41b61e32776c15a8dcde4479841b71c7e9ca28d4 @@ -5462,19 +22645,19 @@ Date: Mon Jul 1 13:24:29 2019 +0000 revert to Debian buster original commit 88a78b1c87e8419bbb70daa77f7ddfb2332668ae -Merge: 24cc8e3 8c60e7c +Merge: 24cc8e38 8c60e7c6 Author: Patrick Schleizer Date: Mon Jul 1 09:21:05 2019 -0400 Merge remote-tracking branch 'origin/master' commit 8c60e7c67f692aa9e70316bdde29cdc41eff2a75 -Merge: 24cc8e3 cfaafe4 +Merge: 24cc8e38 cfaafe40 Author: Patrick Schleizer Date: Mon Jul 1 13:20:21 2019 +0000 Merge pull request #18 from madaidan/patch-14 - + Change the default umask to 006 commit 24cc8e380df8706cd8e9765d89bd44ac78c58936 @@ -5482,13 +22665,13 @@ Author: Patrick Schleizer Date: Mon Jul 1 03:43:02 2019 -0400 comment out proc-hidepid.service hardening for now - + since broken in Qubes Debian AppVMs - + https://forums.whonix.org/t/kernel-hardening/7296/104 commit 0bffc7a9303d0b32427da04694bbefcf6a3104c8 -Merge: 3c176ce 344d009 +Merge: 3c176ce1 344d0090 Author: Patrick Schleizer Date: Mon Jul 1 03:08:26 2019 -0400 @@ -5499,16 +22682,16 @@ Author: Patrick Schleizer Date: Mon Jul 1 03:07:14 2019 -0400 allow permissions openat mkdir - + since required in Qubes Debian templates commit 344d00903250d699fc64d7fa9fad80475ade92e5 -Merge: f26ad14 b8f2aee +Merge: f26ad14d b8f2aee9 Author: Patrick Schleizer Date: Mon Jul 1 06:39:28 2019 +0000 Merge pull request #19 from madaidan/patch-15 - + Add licensing to proc-hidepid.service commit b8f2aee905b78034a115e1e2c1d6ecb7fa624122 @@ -5584,35 +22767,35 @@ Date: Sun Jun 30 04:11:38 2019 -0400 fix package description commit e47339706170c92b8db44f014942ea7d94d1ff9e -Merge: 24b19c5 ec78a3e +Merge: 24b19c59 ec78a3e4 Author: Patrick Schleizer Date: Sun Jun 30 04:11:12 2019 -0400 Merge remote-tracking branch 'origin/master' commit ec78a3e42e23a270a245dc254046ac1d7fc6ceec -Merge: 9525ff8 67de524 +Merge: 9525ff87 67de5247 Author: Patrick Schleizer Date: Sun Jun 30 08:10:28 2019 +0000 Merge pull request #17 from madaidan/patch-13 - + Disable coredumps commit 67de5247c8e7cd68c851a3d62168e9de69000afe -Merge: dbfb9e1 9525ff8 +Merge: dbfb9e1c 9525ff87 Author: Patrick Schleizer Date: Sun Jun 30 08:10:04 2019 +0000 Merge branch 'master' into patch-13 commit 9525ff87c6ae3cd6538a0a8f294e6b8610e79a32 -Merge: 24b19c5 22267c8 +Merge: 24b19c59 22267c89 Author: Patrick Schleizer Date: Sun Jun 30 08:09:23 2019 +0000 Merge pull request #16 from madaidan/patch-12 - + Mount /proc with hidepid=2 commit dbfb9e1cdf1e042c8985e2e69b7f5f5f1eaed860 @@ -5682,19 +22865,19 @@ Date: Sat Jun 29 10:34:48 2019 +0000 fix lintian warning commit 250919b821a00c93ee4fe7d92f6f3ed812110aac -Merge: ecf5d80 60e6dfc +Merge: ecf5d80f 60e6dfcb Author: Patrick Schleizer Date: Sat Jun 29 06:06:02 2019 -0400 Merge remote-tracking branch 'origin/master' commit 60e6dfcbff08dd4526e60c3302741e40d98c8b3e -Merge: ecf5d80 9e9c854 +Merge: ecf5d80f 9e9c854d Author: Patrick Schleizer Date: Sat Jun 29 10:05:34 2019 +0000 Merge pull request #15 from madaidan/patch-11 - + Update control commit 9e9c854d274d7322759a9e5d2c49bcbd60e63e0d @@ -5740,37 +22923,37 @@ Date: Fri Jun 28 03:02:49 2019 -0400 update files list commit ccb89cfd5574ed5a7b3802edc3bf188250edfddd -Merge: 0a0be1a ab31223 +Merge: 0a0be1ad ab312235 Author: Patrick Schleizer Date: Fri Jun 28 03:00:21 2019 -0400 Merge remote-tracking branch 'origin/master' commit ab312235ba89d62b7b83c26f8e9b8a8ff0ec985b -Merge: 5e02100 3801a53 +Merge: 5e02100e 3801a53a Author: Patrick Schleizer Date: Fri Jun 28 06:59:16 2019 +0000 Merge pull request #14 from madaidan/patch-10 - + Add some hardening for other distributions commit 5e02100e34776bf410ba05d7a3f7ee7f696ca0fc -Merge: 7e12e16 b809185 +Merge: 7e12e16d b8091850 Author: Patrick Schleizer Date: Fri Jun 28 06:58:32 2019 +0000 Merge pull request #13 from madaidan/patch-9 - + Remove System.map and restrict the SysRq key. commit 7e12e16dc0513f0a6936e576e3c8fa8ee44509d2 -Merge: 0a0be1a 641407c +Merge: 0a0be1ad 641407c8 Author: Patrick Schleizer Date: Fri Jun 28 06:57:42 2019 +0000 Merge pull request #11 from madaidan/patch-7 - + Protect against DMA attacks commit 3801a53a9e01aafa3783276059a7907f5b20b96e @@ -5840,19 +23023,19 @@ Date: Sun Jun 23 19:47:05 2019 +0000 debian/control syntax fix commit a098b18560e30ef238f693bf8f05933489027dd4 -Merge: 2a62899 90d676e +Merge: 2a628998 90d676ec Author: Patrick Schleizer Date: Sun Jun 23 19:46:30 2019 +0000 Merge remote-tracking branch 'origin/master' commit 90d676ec1864bd915310673d134d62d10a17a42f -Merge: 2a62899 1a07d90 +Merge: 2a628998 1a07d90e Author: Patrick Schleizer Date: Sun Jun 23 19:45:31 2019 +0000 Merge pull request #12 from madaidan/patch-8 - + Update control commit 1a07d90ed2da597db6d58c5f2da6dc3b32a8104b @@ -5866,25 +23049,25 @@ Author: Patrick Schleizer Date: Sun Jun 23 18:46:52 2019 +0000 syntax fix - + GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" - + https://forums.whonix.org/t/kernel-hardening/7296/70 commit f1147318c04642f355eae96786c26ec1cb53977c -Merge: cd73466 aec6da2 +Merge: cd734669 aec6da28 Author: Patrick Schleizer Date: Sun Jun 23 18:45:41 2019 +0000 Merge remote-tracking branch 'origin/master' commit aec6da28e9ac4f8289d7b7aaa77bcef2562cda74 -Merge: cd73466 2178fb3 +Merge: cd734669 2178fb37 Author: Patrick Schleizer Date: Sun Jun 23 18:45:24 2019 +0000 Merge pull request #10 from madaidan/patch-6 - + Enable more kernel hardening parameters commit 641407c8e9c728429ec86e7c89e431896d88e116 @@ -5924,19 +23107,19 @@ Date: Sun Jun 23 08:38:01 2019 +0000 bumped changelog version commit ae50d8134294d3746235d383c18fc187c18717d7 -Merge: 5269cfe cd7172c +Merge: 5269cfee cd7172c0 Author: Patrick Schleizer Date: Sun Jun 23 03:59:58 2019 -0400 Merge remote-tracking branch 'origin/master' commit cd7172c00cbf0cb69e159b6159ef0bfff663a507 -Merge: 5269cfe 807ac7d +Merge: 5269cfee 807ac7d6 Author: Patrick Schleizer Date: Sun Jun 23 07:59:35 2019 +0000 Merge pull request #9 from madaidan/patch-5 - + Disables SACK. commit 807ac7d65916071e4294f42d62b8b2353255c4bc @@ -5952,35 +23135,35 @@ Date: Fri Jun 21 05:40:04 2019 +0000 bumped changelog version commit 0a5b15ff45dc1b30867b0093d238b95dde7c0810 -Merge: ca1aa1e f9dc1b6 +Merge: ca1aa1e5 f9dc1b63 Author: Patrick Schleizer Date: Fri Jun 21 04:05:50 2019 +0000 Merge remote-tracking branch 'origin/master' commit f9dc1b6322961ff0e6c7a5be122f9d1031ba87ea -Merge: ca1aa1e 2e81885 +Merge: ca1aa1e5 2e81885f Author: Patrick Schleizer Date: Thu Jun 20 23:54:58 2019 -0400 Merge pull request #8 from marmarek/packaging - + qubes-builder integration commit 2e81885f691201e2229dadfd5ec7b554980ac689 -Author: Marek Marczykowski-Górecki +Author: Marek Marczykowski-G_recki Date: Fri Jun 21 04:52:01 2019 +0200 Add rpm packaging - + QubesOS/qubes-issues#1885 commit 27e68a39fe005a58cac02336fc6c468a4b2f5d31 -Author: Marek Marczykowski-Górecki +Author: Marek Marczykowski-G_recki Date: Fri Jun 21 04:51:33 2019 +0200 Add Makefile.builder for qubes-builder (Debian) - + QubesOS/qubes-issues#1885 commit ca1aa1e577179d92f4ec002221b8c4207e6ce1d6 @@ -6006,7 +23189,7 @@ Author: Patrick Schleizer Date: Sun Jun 9 10:06:58 2019 +0000 solve package file conflict - + https://github.com/QubesOS/qubes-issues/issues/1885#issuecomment-500200375 commit d5127e716632af2f494e9b41571c44a56a887667 @@ -6040,19 +23223,19 @@ Date: Thu May 23 22:38:13 2019 +0000 bumped changelog version commit 0a200e09ecf745d23e5e880d521f1aec2a7b25a9 -Merge: 65d7eb8 244234c +Merge: 65d7eb81 244234c8 Author: Patrick Schleizer Date: Thu May 23 18:25:47 2019 -0400 Merge remote-tracking branch 'origin/master' commit 244234c8b709a425feed4f3cfb87389f4fb2c6f5 -Merge: 65d7eb8 7177c60 +Merge: 65d7eb81 7177c604 Author: Patrick Schleizer Date: Thu May 23 22:25:13 2019 +0000 Merge pull request #7 from madaidan/patch-3 - + Disable uncommon network protocols commit 7177c6041a9b086a4cb90504a492136b4da732a2 @@ -6068,19 +23251,19 @@ Date: Thu May 16 20:25:46 2019 +0000 bumped changelog version commit a2b184e5bb9942aa63a36fb918b203053a53f1e4 -Merge: 71bf635 7d7b899 +Merge: 71bf6351 7d7b899d Author: Patrick Schleizer Date: Thu May 16 19:53:27 2019 +0000 Merge remote-tracking branch 'origin/master' commit 7d7b899dd13f7123822bf269a639c68ff5cb737e -Merge: 71bf635 b814f33 +Merge: 71bf6351 b814f338 Author: Patrick Schleizer Date: Thu May 16 19:52:52 2019 +0000 Merge pull request #6 from madaidan/patch-2 - + Even more kernel hardening commit b814f338b803ae33380551919b00144bb63a53b8 @@ -6124,11 +23307,11 @@ Author: Patrick Schleizer Date: Wed May 8 21:38:25 2019 -0400 port to /etc/xdg/xfce4/xfconf/xfce-perchannel-xml - + https://forums.whonix.org/t/whonix-xfce-development/6213/84?u=patrick commit 3bd4da6794067708f517b099548c0aa2a2b65146 -Merge: c80b746 b00a264 +Merge: c80b7465 b00a264c Author: Patrick Schleizer Date: Wed May 8 21:32:29 2019 -0400 @@ -6177,19 +23360,19 @@ Date: Mon May 6 05:51:14 2019 -0400 remove trailing spaces commit 83e12f8e89cf0269daeca36946cdef07e23075b3 -Merge: 74cdecf 5177444 +Merge: 74cdecfd 5177444d Author: Patrick Schleizer Date: Mon May 6 05:50:35 2019 -0400 Merge remote-tracking branch 'origin/master' commit 5177444d624a8a935c461ebe1065d451d2f8da0f -Merge: 74cdecf 02e8888 +Merge: 74cdecfd 02e8888b Author: Patrick Schleizer Date: Mon May 6 05:46:03 2019 -0400 Merge pull request #5 from madaidan/patch-1 - + More kernel hardening commit 02e8888b0bc4f0dfadccbebc9e6e75849d32ba76 @@ -6287,18 +23470,18 @@ Author: Patrick Schleizer Date: Fri Mar 1 14:32:41 2019 +0000 add improved legal protections clauses - + The license for software created by Whonix is the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version with additional terms applicable per GNU GPL version 3 section 7. - + The additional terms are based on the Doom 3 license which is Debian refers to as `GPL-3+-with-id-software-additional-terms`, which is Debian DFSG [1] (The Debian Free Software Guidelines) approved and which is therefore suitable for Debian `main`. Whonix made applied minimal changes to it: - + * Rewrite `The Doom 3 BFG Edition GPL Source Code` to the more common `this program` which is used throughout the GPL. * Added a "trump clause" [2], in other words, any conflicts or disputes between the additional terms and the GPLv3 shall be resolved in favor of the GPLv3 by adding `Notwithstanding any other provision of this License` (as mentioned in GPL FAQ [3]) at the beginning of the additional terms. - + [1] https://www.debian.org/social_contract#guidelines [2] https://www.fsf.org/news/canonical-updated-licensing-terms [3] https://www.gnu.org/licenses/gpl-faq.html#v3Notwithstanding - + For more considerations, see also: https://www.whonix.org/wiki/Dev/Licensing @@ -6313,7 +23496,7 @@ Author: Patrick Schleizer Date: Mon Nov 19 06:27:52 2018 -0500 fix hiding network bookmark in thunar by default - + Thanks to @Algernon for suggesting the fix! commit daf7fc002b2d946c2946b9effe3fecc5cebe4cf2 @@ -6329,19 +23512,19 @@ Date: Thu Nov 8 09:55:41 2018 +0000 bumped changelog version commit 0c020af885b3dfb2924102e6cf41a5af114cc140 -Merge: f9e1877 6f240c0 +Merge: f9e18772 6f240c0c Author: Patrick Schleizer Date: Thu Nov 8 09:53:47 2018 +0000 Merge remote-tracking branch 'origin/master' commit 6f240c0c4c88df2946fdd673f833ee05dd8340bb -Merge: f9e1877 f84f988 +Merge: f9e18772 f84f9881 Author: Patrick Schleizer Date: Thu Nov 8 04:53:25 2018 -0500 Merge pull request #4 from Algernon-01/master - + Enable hidden files and volume management again. commit f84f988118e30a2a3d4d74ed008c1a626c35c365 @@ -6453,19 +23636,19 @@ Date: Wed Jul 26 14:37:34 2017 +0000 bumped changelog version commit dc2c9a9992551f5967e09b31a90721a9aadaf962 -Merge: 61bd4d0 91ff0c2 +Merge: 61bd4d05 91ff0c25 Author: Patrick Schleizer Date: Tue Mar 14 13:43:18 2017 +0000 Merge remote-tracking branch 'origin/master' commit 91ff0c2571b41710440006e770b8295c03b3a295 -Merge: 61bd4d0 6e5e5d6 +Merge: 61bd4d05 6e5e5d6e Author: Patrick Schleizer Date: Tue Mar 14 13:42:37 2017 +0000 Merge pull request #2 from HulaHoopWhonix/patch-2 - + Update README.md commit 6e5e5d6ea65a0fee4c76e5ad74c444344ff1f462 @@ -6503,7 +23686,7 @@ Author: Patrick Schleizer Date: Mon Feb 27 23:57:04 2017 +0000 No longer ignore duplicate apt sources in apt-get-wrapper. - + No longer acceptable because these generate lots of noise in the terminal. commit 191918027c1971bfb871abb438c4917e5b98bb74 @@ -6517,7 +23700,7 @@ Author: Patrick Schleizer Date: Mon Feb 27 23:16:32 2017 +0000 use python rather than unbuffer - + because unbuffer eats exit code when process is killed commit cc351165dc78a8b7158a2b9bfdd9e4f0b3866239 @@ -6545,7 +23728,7 @@ Author: Patrick Schleizer Date: Sun Feb 26 23:57:17 2017 +0000 fix, show progress during apt-get-wrapper - + fix, propagate signals to apt-get child process commit 49cde21078ccc9f623add6f587ee719843647ee7 @@ -6553,7 +23736,7 @@ Author: Patrick Schleizer Date: Tue Feb 21 19:54:41 2017 +0000 Whonix 14 KDE plasma 5 fixes - + https://phabricator.whonix.org/T633 commit 0228e87d477f634d1e1db7c1cf6f213275d40dd9 @@ -6567,7 +23750,7 @@ Author: Patrick Schleizer Date: Sun Feb 19 22:32:04 2017 +0000 override glib-compile-schemas with || true in postinst - + https://phabricator.whonix.org/T500 commit 5ba2a5b6ff53df37ad38f082ad86ff2227158d93 @@ -6575,13 +23758,13 @@ Author: Patrick Schleizer Date: Sun Feb 19 22:25:28 2017 +0000 disable previews in nautilus by default for better security - + copied solution by @unman - + https://github.com/QubesOS/qubes-issues/issues/1108 - + https://github.com/QubesOS/qubes-core-agent-linux/pull/39 - + https://phabricator.whonix.org/T500 commit 91adab0d1bab6c6b31903f1e165944b3f8c8adb1 @@ -6595,7 +23778,7 @@ Author: Patrick Schleizer Date: Wed Feb 15 20:46:22 2017 +0000 Debian stretch / kde plasma5 fix: KDEDIRS -> XDG_CONFIG_DIRS - + https://phabricator.whonix.org/T633 commit bddbba84a6fad680359bc8eee0c395fcc4d79ca9 @@ -6609,7 +23792,7 @@ Author: Patrick Schleizer Date: Tue Feb 14 02:37:08 2017 +0000 add usr/lib/security-misc/apt-get-update-sanity-test - + a CVE-2016-1252 sanity test script commit 5e076415536e1513463c59dba6e8afc4e90b7f1a @@ -6623,7 +23806,7 @@ Author: Patrick Schleizer Date: Fri Feb 10 15:47:52 2017 +0000 remove faketime from Build-Depends: - + since no longer used for reproducible builds commit be8084ad1c136ee4a18cb24abcc0c14c522b8089 @@ -6637,7 +23820,7 @@ Author: Patrick Schleizer Date: Wed Feb 8 14:26:26 2017 +0000 double apt-get-update wrapper timeout from 120 to 240 seconds - + since it takes a bit longer than 120 seconds for me on a fast connection commit 1e66e03da14ae2e3f7b315e443836c35f954b84f @@ -6705,7 +23888,7 @@ Author: Patrick Schleizer Date: Mon Oct 10 16:10:30 2016 +0000 disable conntrack helper for better security - + https://phabricator.whonix.org/T486 commit 0d66fc60b9ea65e826560986698c11cea7ca4ea6 @@ -6719,7 +23902,7 @@ Author: Patrick Schleizer Date: Mon Apr 25 23:19:54 2016 +0000 /etc/sysctl.d/nf_conntrack_helper.conf disabled for now as it needs more work - + https://phabricator.whonix.org/T486 commit 492ce128909cfda8645738b092fd9e8722c64aa0 @@ -6739,27 +23922,27 @@ Author: Patrick Schleizer Date: Thu Mar 31 15:36:59 2016 +0000 added 'Replaces: tcp-timestamps-disable' - + https://phabricator.whonix.org/T486 commit 7b54755841907c2b86b12eed5035860e17445193 -Merge: 10c87b8 be086ae +Merge: 10c87b84 be086aea Author: Patrick Schleizer Date: Thu Mar 31 15:35:07 2016 +0000 merged tcp-timestamps-disable package into security-misc package - + disable conntrack helper for better security - + https://phabricator.whonix.org/T486 commit be086aea597ff5e4db29f56fa57399c67568d4b6 -Merge: 10c87b8 d0eceae +Merge: 10c87b84 d0eceae0 Author: Patrick Schleizer Date: Thu Mar 31 15:34:17 2016 +0000 Merge pull request #1 from HulaHoopWhonix/patch-1 - + Create tcp_timestamps.conf commit d0eceae0c84a42bce4ade28c593fd6ba002a67b9 diff --git a/ci/codeql-build.sh b/ci/codeql-build.sh new file mode 100755 index 00000000..08c3e151 --- /dev/null +++ b/ci/codeql-build.sh @@ -0,0 +1,46 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## CodeQL manual build for the C sources in this repo. +## +## Delegates the actual gcc invocations to the upstream compile +## helpers under usr/libexec/security-misc/. Those helpers also run +## at install-time / first-run (out of build-fm-shim-backend and +## emerg-shutdown). Single source of truth means CI cannot drift on +## hardening flags vs runtime. +## +## Source-tree prep: +## +## ci/codeql-prepare.sh has already symlinked '*.c#' to clean +## '*.c' names by the time we run (the workflow runs prepare via +## the reusable's pre-init hook). gcc selects its driver behavior +## by file extension - a '.c#tag' source gets misclassified as a +## linker script - so the symlink is required even though gcc +## tolerates the tagged name in error messages. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +set -o xtrace + +sudo --non-interactive apt-get update --error-on=any +sudo --non-interactive apt-get install --yes --no-install-recommends \ + pkg-config libdbus-1-dev libsystemd-dev libc6-dev linux-libc-dev + +build_dir="$(mktemp -d)" +trap 'rm -rf -- "${build_dir}"' EXIT + +bash 'usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared' \ + usr/src/security-misc/fm-shim-backend.c \ + "${build_dir}/fm-shim-backend" + +bash 'usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared' \ + usr/src/security-misc/emerg-shutdown.c \ + "${build_dir}/emerg-shutdown" + +ls -l -- "${build_dir}" diff --git a/ci/codeql-prepare.sh b/ci/codeql-prepare.sh new file mode 100755 index 00000000..e4b63923 --- /dev/null +++ b/ci/codeql-prepare.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## CodeQL pre-init source-tree prep. +## +## This repo names installable files with a '#' suffix +## (Kicksecure/genmkfile convention - the suffix routes the file to +## the correct Debian binary package at build time). The suffix +## breaks two CodeQL paths: +## +## * Python extractor discovers source files by the '.py' +## extension; 'foo.py#security-misc-shared' is invisible. +## * gcc selects driver behavior by extension; 'foo.c#tag' is +## treated by ld as a linker script ("file format not +## recognized"). The compile helpers used by ci/codeql-build.sh +## receive their .c source by path argument, so a clean +## '.c'-extension symlink is required here too. +## +## Walk the tracked file list and create same-directory symlinks +## without the '#tag' suffix so both extractors and gcc see the +## source under its conventional name. Symlinks point at the +## original tagged file via basename so the link resolves regardless +## of how the tree is later moved. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(git rev-parse --show-toplevel)" +cd -- "${repo_root}" + +linked=0 +skipped=0 +while IFS= read -r tagged; do + ## Only files where the suffix immediately follows a known + ## source-language extension. Other tagged files (config files, + ## scripts without an extension, etc.) need no rename. + case "${tagged}" in + *'.py#'*|*'.c#'*|*'.h#'*) + ;; + *) + continue + ;; + esac + + clean="${tagged%#*}" + + ## Do not clobber a real (untagged) file. + if [ -e "${clean}" ] && [ ! -L "${clean}" ]; then + skipped=$((skipped + 1)) + continue + fi + + ## Symlink target must be relative to the link's directory. + target="$(basename -- "${tagged}")" + ln -snf -- "${target}" "${clean}" + linked=$((linked + 1)) +done < <(git ls-files -- '*.py#*' '*.c#*' '*.h#*') + +printf 'codeql-prepare: linked=%d skipped=%d\n' "${linked}" "${skipped}" diff --git a/ci/dfuzzer-build.sh b/ci/dfuzzer-build.sh new file mode 100755 index 00000000..607fe9ad --- /dev/null +++ b/ci/dfuzzer-build.sh @@ -0,0 +1,61 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Build dfuzzer from upstream source. Run from +## .github/workflows/local-dbus-fuzz.yml (R-100; no inline scripts +## in the YAML). +## +## Build / runtime deps are installed by the caller workflow via +## developer-meta-files/.github/actions/install-deps (genmkfile + +## helper-scripts + apt packages); the apt list lives in the +## caller workflow. +## +## Required apt deps for this script: +## - meson ninja-build # build system +## - xsltproc docbook-xsl # man-page generation +## - libglib2.0-dev # dfuzzer dep +## - dbus dbus-x11 # dfuzzer runtime +## - libdbus-1-dev libsystemd-dev pkg-config gcc # for the +## # fm-shim-backend +## # build below +## +## dfuzzer is NOT packaged in Ubuntu 24.04 noble (verified via +## packages.ubuntu.com - 'No such package'); hence the from-source +## build. Pinned to upstream tag v2.6 AND its exact commit (verified +## below); latest release as of 2026-05-08. Bump both DFUZZER_TAG and +## DFUZZER_COMMIT together when a new release lands. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## style-ok: no-tmp-hardcode (ephemeral CI build clone under /tmp/dfuzzer) + +if [ "${CI:-}" != "true" ] && [ "${ALLOW_LOCAL:-}" != "true" ]; then + printf '%s\n' "${BASH_SOURCE[0]}: refusing to run outside CI. Set ALLOW_LOCAL=true to override." >&2 + exit 1 +fi + +DFUZZER_TAG="${DFUZZER_TAG:-v2.6}" +DFUZZER_COMMIT="${DFUZZER_COMMIT:-a955a80f7dd20fd7aeffad91da1c495aab5dbbd3}" + +git clone --depth 1 --branch "${DFUZZER_TAG}" \ + https://github.com/dbus-fuzzer/dfuzzer /tmp/dfuzzer + +dfuzzer_actual_commit="$(git -C /tmp/dfuzzer rev-parse --verify HEAD)" +if [ "${dfuzzer_actual_commit}" != "${DFUZZER_COMMIT}" ]; then + printf '%s\n' "${BASH_SOURCE[0]}: dfuzzer tag ${DFUZZER_TAG} resolved to ${dfuzzer_actual_commit}, expected ${DFUZZER_COMMIT} -- refusing (tag moved?)." >&2 + exit 1 +fi + +meson setup --buildtype=release /tmp/dfuzzer/build /tmp/dfuzzer +ninja -C /tmp/dfuzzer/build -v +sudo install -m 0755 /tmp/dfuzzer/build/dfuzzer /usr/local/bin/dfuzzer +dfuzzer --version || dfuzzer -V || true diff --git a/ci/dfuzzer-run.sh b/ci/dfuzzer-run.sh new file mode 100755 index 00000000..9a293290 --- /dev/null +++ b/ci/dfuzzer-run.sh @@ -0,0 +1,194 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Run dfuzzer against fm-shim-backend's D-Bus surface. +## +## fm-shim-backend implements org.freedesktop.FileManager1 on the +## session bus. dfuzzer is the standard D-Bus service fuzzer +## (Debian-archive-shipped); given a bus name it iterates every +## method and signal on every interface the service exposes, sends +## type-correct adversarial payloads (overflow, mangled UTF-8, +## empty / max-length strings, weird container nesting), and +## flags any case where the service crashes, hangs, or returns +## an unexpected error. +## +## This is process-level fuzzing - we boot the actual binary +## under a transient D-Bus session bus rather than driving the +## function dispatcher in-process. Catches the integration +## surface (D-Bus marshaling glue, sd_notify, signal handlers, +## leaks across method calls) that an in-process libFuzzer +## harness on the parser alone would miss. +## +## Cwd contract: caller workflow runs this with the +## security-misc repo checkout as cwd. ci/codeql-prepare.sh +## must have run first to create the .c symlink the upstream +## compile script expects. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## CI guard. +if [ "${CI:-}" != "true" ] && [ "${ALLOW_LOCAL:-}" != "true" ]; then + printf '%s\n' "${BASH_SOURCE[0]}: refusing to run outside CI (CI != 'true'). Set ALLOW_LOCAL=true to override." >&2 + exit 1 +fi + +dfuzzer_seconds="${DFUZZER_SECONDS:-60}" + +work="$(mktemp -d)" + +dfuzzer_run_cleanup() { + # shellcheck disable=SC2317 ## invoked via 'trap' + rm -r -f -- "${work}" +} + +trap dfuzzer_run_cleanup EXIT + +printf '%s\n' "::group::Build fm-shim-backend" +bash 'usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared' \ + usr/src/security-misc/fm-shim-backend.c \ + "${work}/fm-shim-backend" +chmod 0755 -- "${work}/fm-shim-backend" +ls -l -- "${work}/fm-shim-backend" +printf '%s\n' "::endgroup::" + +## Inner script that runs INSIDE dbus-run-session's transient +## session bus. Manually starts fm-shim-backend in the background +## (auto-activation via XDG service files turned out to be +## flaky inside dbus-run-session) and fuzzes it. +## +## Written to a temp file rather than passed inline via 'bash -c' +## to avoid the multi-level shell quoting that was hiding bugs +## during initial debugging. +inner="${work}/dfuzzer-inner.sh" +cat > "${inner}" <<'INNER' +#!/bin/bash +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## Args (positional) from outer script: +## $1 = backend binary path +## $2 = dfuzzer seconds budget +backend_bin="$1" +seconds="$2" + +printf '%s\n' "DBUS_SESSION_BUS_ADDRESS=${DBUS_SESSION_BUS_ADDRESS}" + +backend_log="$(dirname -- "${backend_bin}")/fm-shim-backend.log" + +## Start fm-shim-backend in the background. Capture its stdout + +## stderr so we can surface them in the workflow log if dfuzzer +## fails to connect (without a tty the backend's output is +## block-buffered and would otherwise be lost on kill). +"${backend_bin}" >"${backend_log}" 2>&1 & +backend_pid=$! + +dfuzzer_inner_cleanup() { + kill "${backend_pid}" 2>/dev/null || true +} + +trap dfuzzer_inner_cleanup EXIT + +## Wait up to 5s for the backend to register the well-known name +## on the bus. dbus-run-session-internal name registration is +## usually < 100ms but allow a generous budget for slow runners. +for _i in {1..5}; do + sleep 1 + if ! kill -0 "${backend_pid}" 2>/dev/null; then + printf '%s\n' "::error::fm-shim-backend exited during startup" + cat -- "${backend_log}" || true + wait "${backend_pid}" 2>/dev/null + exit 1 + fi + if dbus-send --session --print-reply --dest=org.freedesktop.DBus \ + /org/freedesktop/DBus org.freedesktop.DBus.NameHasOwner \ + string:org.freedesktop.FileManager1 2>/dev/null \ + | grep -q 'boolean true'; then + printf '%s\n' "fm-shim-backend registered (after ${_i}s)" + break + fi +done + +## Sanity-check: confirm the name is actually owned and dump the +## backend's startup output to the workflow log. If anything +## subsequent fails, this gives a maintainer enough to triage. +printf '%s\n' "::group::backend startup log" +cat -- "${backend_log}" 2>/dev/null || printf '%s\n' "(no log lines flushed yet)" +printf '%s\n' "::endgroup::" + +printf '%s\n' "::group::busctl introspect (verifies Introspectable wiring)" +busctl --user --no-pager introspect \ + org.freedesktop.FileManager1 /org/freedesktop/FileManager1 || true +printf '%s\n' "::endgroup::" + +## Run the actual fuzzer. Iteration-bounded by default (-I 50 +## per method gives enough coverage on the small FileManager1 +## surface; bumpable per consumer). Total wall-clock bounded +## by the outer timeout wrapper. +rc=0 +## -n bus name (required) +## -o object path - dfuzzer defaults to '/' if omitted, which is +## empty for fm-shim-backend (its methods are at +## /org/freedesktop/FileManager1). Without -o the previous +## runs exited in milliseconds because there was nothing to +## fuzz at the default path. +## -s --no-suppressions. Without this flag dfuzzer 2.6 treats +## "no suppression file found at ./dfuzzer.conf, +## ~/.dfuzzer.conf, or /etc/dfuzzer.conf" as a fatal error +## and exits 1 before fuzzing anything. None of those paths +## exist on a fresh GitHub runner. We don't need suppressions +## anyway - we want every error reported. +## -I iterations per method. +## -v verbose per-method progress. +timeout --preserve-status "${seconds}" \ + dfuzzer \ + -n org.freedesktop.FileManager1 \ + -o /org/freedesktop/FileManager1 \ + -s \ + -I 50 \ + -v || rc=$? + +printf '%s\n' "::group::backend log after fuzz" +cat -- "${backend_log}" 2>/dev/null || true +printf '%s\n' "::endgroup::" + +printf '%s\n' "dfuzzer raw exit code: ${rc}" +exit "${rc}" +INNER +chmod +x "${inner}" + +printf '%s\n' "::group::dfuzzer (org.freedesktop.FileManager1, ${dfuzzer_seconds}s)" +rc=0 +dbus-run-session -- "${inner}" "${work}/fm-shim-backend" "${dfuzzer_seconds}" || rc=$? +printf '%s\n' "::endgroup::" +printf '%s\n' "dfuzzer wrapper exit code: ${rc}" + +case "${rc}" in + 0) + printf '%s\n' "dfuzzer: completed cleanly; no crashes / exceptions detected." + ;; + 124) + ## 'timeout --preserve-status' surfaces 124 when the wall- + ## clock budget is reached. Treat as 'budget reached, no + ## crash detected within window'. + printf '%s\n' "dfuzzer: ${dfuzzer_seconds}s budget reached; no crash detected within window." + rc=0 + ;; + *) + printf '%s\n' "::error::dfuzzer reported a finding (exit ${rc}). See log above for the failing method." + ;; +esac + +exit "${rc}" diff --git a/ci/tests/fm_shim_frontend/test_property.py b/ci/tests/fm_shim_frontend/test_property.py new file mode 100644 index 00000000..1361258e --- /dev/null +++ b/ci/tests/fm_shim_frontend/test_property.py @@ -0,0 +1,194 @@ +#!/usr/bin/python3 -Bsu + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Hypothesis property tests for fm_shim_frontend.get_path_list_from_uris. +## +## Target rationale: get_path_list_from_uris is the URI-validation +## chokepoint between the FileManager1 D-Bus surface and the user- +## facing dialog. It runs urllib.parse.urlsplit + urllib.parse.unquote +## on attacker-supplied strings, then enforces three independent +## invariants (no Unicode/control chars, no newlines/NUL post-decode, +## absolute-path-only) before the value is shown to the user or +## passed to a file manager. A property-test pass over Hypothesis- +## generated URI lists is the right shape to catch invariant +## violations: the function should never raise on any input (must +## degrade gracefully), and several output properties must hold for +## EVERY entry in the returned list - regardless of input pathology. + +# pylint: disable=missing-function-docstring,missing-class-docstring + +from pathlib import Path + +import pytest +from hypothesis import given, settings, HealthCheck, strategies as st + +from fm_shim_frontend.fm_shim_frontend import get_path_list_from_uris + + +## ---------------------------------------------------------------- +## Hypothesis strategies +## ---------------------------------------------------------------- + +## Arbitrary text that may include Unicode, control chars, NULs, +## newlines, percent escapes, etc. - explicitly UNSANITIZED so we +## probe the function's defensive behavior. +adversarial_text = st.text( + min_size=0, max_size=200, + alphabet=st.characters(blacklist_categories=()), +) + +## URIs that look plausibly file:// shaped so we exercise the +## post-urlsplit branches (most adversarial_text values fail at the +## scheme/netloc gate). Use 7-bit-ASCII for the URI body and let +## the unquoted path become arbitrary text via percent-escapes. +ascii_safe = st.text( + min_size=0, max_size=120, + alphabet=st.characters(min_codepoint=0x20, max_codepoint=0x7E), +) + +handler_modes = st.sampled_from([ + "--show-folders", + "--show-items", + "--show-item-properties", +]) + + +def _file_uri_from_text(t: str) -> str: + ## Always produce a file:// URI shape so the input survives the + ## scheme-check gate at least often enough for the inner code + ## paths to get exercised. + import urllib.parse as up + return "file://" + up.quote(t, safe="/-._~") + + +file_uri = ascii_safe.map(_file_uri_from_text) + +## Mix the two pools: half-and-half adversarial vs file-uri-shaped. +uri_strategy = st.one_of(adversarial_text, file_uri) + +uri_list_strategy = st.lists(uri_strategy, min_size=0, max_size=8) + + +## ---------------------------------------------------------------- +## Properties +## ---------------------------------------------------------------- + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_never_raises(handler_mode: str, uri_list: list[str]) -> None: + ## Foundational invariant: no input may crash the function. It + ## must always return a (possibly empty) list. Hypothesis will + ## try empty lists, lists of "", lists of malformed URIs, + ## arbitrary unicode, percent-escaped control chars, etc. + result = get_path_list_from_uris(handler_mode, uri_list) + assert isinstance(result, list) + for p in result: + assert isinstance(p, Path) + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_output_paths_are_absolute(handler_mode: str, uri_list: list[str]) -> None: + ## Domain invariant: every Path returned must be absolute. The + ## function explicitly skips relative paths; this property + ## guards against future refactors that drop the guard. + for p in get_path_list_from_uris(handler_mode, uri_list): + assert p.is_absolute(), f"non-absolute path leaked: {p!r}" + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_output_has_no_dangerous_chars( + handler_mode: str, uri_list: list[str] +) -> None: + ## Domain invariant: no path in the output may contain a newline + ## or a NUL byte. Both are explicitly filtered post-unquote; + ## this property catches a regression where the filter is moved + ## or weakened. + for p in get_path_list_from_uris(handler_mode, uri_list): + s = str(p) + assert "\n" not in s, f"newline leaked in output: {s!r}" + assert "\x00" not in s, f"NUL leaked in output: {s!r}" + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_output_unique_and_sorted( + handler_mode: str, uri_list: list[str] +) -> None: + ## Domain invariant: output is deduplicated and sorted (function + ## docs the dedup via 'set'; the sort is documented at the end). + ## A regression that drops either property would surprise + ## downstream callers that rely on stable iteration order. + out = get_path_list_from_uris(handler_mode, uri_list) + assert out == sorted(set(out)), \ + f"output not sorted-unique: {out!r}" + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_idempotent_when_paths_are_string_form( + handler_mode: str, uri_list: list[str] +) -> None: + ## If we feed the function back its own output (re-encoded as + ## file:// URIs), the result should be a subset of the original + ## output (filesystem state may have changed; some entries may + ## have disappeared, but no NEW entries should appear). This + ## catches refactors that introduce non-idempotent behavior. + import urllib.parse as up + first = get_path_list_from_uris(handler_mode, uri_list) + re_uris = ["file://" + up.quote(str(p), safe="/-._~") for p in first] + second = get_path_list_from_uris(handler_mode, re_uris) + assert set(second).issubset(set(first)), \ + f"second pass introduced paths not in first: " \ + f"first={first!r} second={second!r}" + + +## ---------------------------------------------------------------- +## Targeted regressions +## ---------------------------------------------------------------- + +@pytest.mark.parametrize("uri", [ + "", # empty + "file:///\nevil", # newline post-decode + "file:///%00etc/passwd", # NUL post-decode + "file:///etc/passwd?query=1", # query component + "file:///etc/passwd#frag", # fragment component + "http://example.com/etc/passwd", # non-file scheme + "file://attacker.example/etc/passwd", # non-localhost netloc + "file:relative/path", # relative + "file:///" + "A" * 10000, # very long + "file:///%C3%A9clair", # non-ASCII percent-escape +]) +def test_known_adversarial_inputs_rejected(uri: str) -> None: + ## Concrete fixed-input regressions for the categories the + ## function explicitly defends against. These are NOT + ## Hypothesis-generated; they nail down specific past or + ## anticipated bug shapes so a regression is caught immediately + ## rather than waiting for Hypothesis to rediscover them. + out = get_path_list_from_uris("--show-folders", [uri]) + assert out == [], f"adversarial URI not rejected: {uri!r} -> {out!r}" diff --git a/ci/tests/permission_hardener/test_state_spaced_filename.sh b/ci/tests/permission_hardener/test_state_spaced_filename.sh new file mode 100755 index 00000000..bfd77155 --- /dev/null +++ b/ci/tests/permission_hardener/test_state_spaced_filename.sh @@ -0,0 +1,70 @@ +#!/bin/bash +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## WARNING: Not human-reviewed, MUST be moved to dist-ai. + +## Regression test: a hardened file whose path contains spaces must be +## un-hardenable via 'disable'. +## +## load_state_without_policy() reads the dpkg-statoverride state DB, one entry +## per line as 'owner group mode path'. A plain 4-field split drops any spaced +## path, so 'disable' never finds the entry and the file can never be restored. +## +## Seeds one spaced entry (mode 0744) into the state DB, sets the file to 0600, +## runs 'disable', and asserts the mode is restored to 0744 -- which only +## happens if load_state_without_policy read the spaced path back. +## +## Requires root: writes the state DB and chmod/chowns the target file. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" +ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}" + +if [ ! -f "${ph_bin}" ]; then + printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2 + exit 1 +fi + +## Must match store_dir in the script under test. +existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode' +mkdir -p -- "${existing_mode_admindir}" + +test_dir="$(mktemp -d -t ph-state-test.XXXXXX)" +spaced_file="${test_dir}/spaced tool" +touch -- "${spaced_file}" +chmod 0600 -- "${spaced_file}" + +## invoked indirectly via 'trap ... EXIT' +# shellcheck disable=SC2317 +cleanup() { + ## undo touches the master and new_mode DBs, not existing_mode, so remove the + ## seeded entry explicitly. + dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \ + "${spaced_file}" >/dev/null 2>&1 || true + safe-rm -rf -- "${test_dir}" +} +trap cleanup EXIT + +## Seed the state DB: this is the record 'enable' would have written. +dpkg-statoverride --admindir "${existing_mode_admindir}" --add \ + root root 0744 "${spaced_file}" + +"${ph_bin}" disable "${spaced_file}" >/dev/null 2>&1 || true + +actual_mode="$(stat -c '%a' -- "${spaced_file}")" +if [ "${actual_mode}" = '744' ]; then + printf '%s\n' "PASS: spaced-path state entry read back; mode restored to 744." + exit 0 +fi + +printf '%s\n' "FAIL: mode is '${actual_mode}', expected '744' -- spaced state entry not read back, file cannot be un-hardened." >&2 +exit 1 diff --git a/ci/tests/permission_hardener/test_whitelists_disable_all.sh b/ci/tests/permission_hardener/test_whitelists_disable_all.sh new file mode 100755 index 00000000..e69b200c --- /dev/null +++ b/ci/tests/permission_hardener/test_whitelists_disable_all.sh @@ -0,0 +1,91 @@ +#!/bin/bash +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## WARNING: Not human-reviewed, MUST be moved to dist-ai. + +## Regression test: the documented special directive 'whitelists_disable_all=true' +## must be honored, not rejected. +## +## The line contains '=', which is outside the config character-class allow-set. +## The directive check must run BEFORE that character-class validation; otherwise +## the documented line trips "invalid characters" and aborts the whole hardener +## (exit 200), so every other hardening rule in every conf is dropped too. +## +## Drives the REAL script via 'print-policy' with a conf that holds the directive +## plus one ordinary entry, and asserts print-policy exits 0 with the ordinary +## entry present. +## +## Requires root: writes a temporary config under /etc/permission-hardener.d/ +## and needs helper-scripts installed (sourced by permission-hardener). + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" +ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}" + +if [ ! -f "${ph_bin}" ]; then + printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2 + exit 1 +fi + +test_dir="$(mktemp -d -t ph-wda-test.XXXXXX)" +ordinary_file="${test_dir}/ordinary" +touch -- "${ordinary_file}" + +config_dir="/etc/permission-hardener.d" +config_file="${config_dir}/zz-ai-whitelists-disable-all-test.conf" +mkdir -p -- "${config_dir}" + +## print-policy captures the file's current mode into this DB (must match +## store_dir in the script under test); remove the entry so a test run does not +## leave a stale root-owned override pointing at a deleted temp file. +existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode' + +## invoked indirectly via 'trap ... EXIT' +# shellcheck disable=SC2317 +cleanup() { + dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \ + "${ordinary_file}" >/dev/null 2>&1 || true + safe-rm -f -- "${config_file}" + safe-rm -rf -- "${test_dir}" +} +trap cleanup EXIT + +{ + printf '%s\n' 'whitelists_disable_all=true' + printf '%s\n' "${ordinary_file} 0744 root root" +} > "${config_file}" + +## The directive line aborts the whole run (exit 200) on the buggy ordering; +## capture the status via an 'if' condition (errexit stays enabled). +if policy_output="$( "${ph_bin}" print-policy 2>/dev/null )"; then + ph_rc=0 +else + ph_rc=$? +fi + +test_status=0 +if [ "${ph_rc}" -ne 0 ]; then + printf '%s\n' "FAIL: print-policy exited ${ph_rc} (directive rejected as invalid characters)." >&2 + test_status=1 +fi +if printf '%s\n' "${policy_output}" | grep --quiet --fixed-strings -- "${ordinary_file}"$'\t'; then + printf '%s\n' "PASS: whitelists_disable_all=true accepted; ordinary entry present." +else + printf '%s\n' "FAIL: ordinary entry '${ordinary_file}' missing from print-policy output." >&2 + test_status=1 +fi + +if [ "${test_status}" -ne 0 ]; then + printf '%s\n' "----- print-policy output -----" >&2 + printf '%s\n' "${policy_output}" >&2 +fi +exit "${test_status}" diff --git a/ci/tests/permission_hardener/test_whitespace_filename.sh b/ci/tests/permission_hardener/test_whitespace_filename.sh new file mode 100755 index 00000000..6d2a63b6 --- /dev/null +++ b/ci/tests/permission_hardener/test_whitespace_filename.sh @@ -0,0 +1,138 @@ +#!/bin/bash +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## WARNING: Not human-reviewed, MUST be moved to dist-ai. + +## Regression test: permission-hardener must parse a config filename that +## contains spaces. +## +## load_state() recovers the filename by reading the option fields from the +## right (a trailing whitelist keyword, or the mode/owner/group[/capability] +## tail anchored by the octal mode). A space in the filename must NOT split it +## into the wrong fields -- that drops the entry silently, leaving a SUID +## binary un-hardened. +## +## Drives the REAL script via 'print-policy' with a mode-form entry +## ( ) whose filename contains a space, and +## asserts the recovered filename appears in the printed policy. +## +## Requires root: writes a temporary config under /etc/permission-hardener.d/ +## and needs helper-scripts installed (sourced by permission-hardener). + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" +ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}" + +if [ ! -f "${ph_bin}" ]; then + printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2 + exit 1 +fi + +test_dir="$(mktemp -d -t ph-ws-test.XXXXXX)" +## The space in the directory name is the property under test. +spaced_file="${test_dir}/some space/binary" +mkdir -p -- "${test_dir}/some space" +touch -- "${spaced_file}" + +## A filename whose space-split yields a BARE octal chunk ('744'). The mode +## must be anchored from the RIGHT: a left-to-right scan anchors on that chunk +## instead of the real mode at the end, fails the field-count check, and aborts +## the whole hardener (exit 200) rather than parsing the entry. +octal_chunk_file="${test_dir}/a 744 name" +touch -- "${octal_chunk_file}" + +## A space-free filename with a 4-option (capability) tail whose OWNER is a +## numeric id that looks octal ('0755'). Right-anchoring must NOT treat that +## owner as the mode: it would fold the real mode into the filename, the folded +## path does not exist, and the entry is silently dropped -- leaving the file +## un-hardened. The line is already well formed, so no recovery must happen. +numeric_owner_file="${test_dir}/numowner" +touch -- "${numeric_owner_file}" + +## The mirror-image of the numeric-owner case: a SPACED filename whose second +## component (field index 1) is a bare octal, with a 3-field tail. Here field 1 +## is NOT the mode, so recovery must happen. Existence disambiguates: the spaced +## name exists, its no-recovery prefix does not. +octal_second_file="${test_dir}/a 744" +touch -- "${octal_second_file}" + +## Six fields: a SPACED filename plus a numeric octal-looking owner and a +## capability tail. The rightmost octal candidate (field_count-3) is the owner, +## not the mode; anchoring there folds the mode into the filename and drops the +## entry. Existence must select field_count-4 (the real mode) instead. +numeric_owner_spaced_file="${test_dir}/x y" +touch -- "${numeric_owner_spaced_file}" + +config_dir="/etc/permission-hardener.d" +config_file="${config_dir}/zz-ai-whitespace-regression-test.conf" +mkdir -p -- "${config_dir}" + +## print-policy captures each file's current mode into this DB (must match +## store_dir in the script under test); remove the entries so a test run does +## not leave stale root-owned overrides pointing at deleted temp files. +existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode' + +## invoked indirectly via 'trap ... EXIT' +# shellcheck disable=SC2317 +cleanup() { + local leaked_file + for leaked_file in "${spaced_file}" "${octal_chunk_file}" \ + "${numeric_owner_file}" "${octal_second_file}" \ + "${numeric_owner_spaced_file}"; do + dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \ + "${leaked_file}" >/dev/null 2>&1 || true + done + safe-rm -f -- "${config_file}" + safe-rm -rf -- "${test_dir}" +} +trap cleanup EXIT + +## mode-form entries: [capability] +{ + printf '%s\n' "${spaced_file} 0744 root root" + printf '%s\n' "${octal_chunk_file} 0744 root root" + printf '%s\n' "${numeric_owner_file} 0744 0755 root cap_net_raw" + printf '%s\n' "${octal_second_file} 0644 root root" + printf '%s\n' "${numeric_owner_spaced_file} 0744 0755 root cap_net_raw" +} > "${config_file}" + +## A parse failure on any line aborts the whole run with exit 200; capture the +## status via an 'if' condition (errexit stays enabled) so the failure is +## reported cleanly rather than aborting the test. +if policy_output="$( "${ph_bin}" print-policy 2>/dev/null )"; then + ph_rc=0 +else + ph_rc=$? +fi + +test_status=0 +if [ "${ph_rc}" -ne 0 ]; then + printf '%s\n' "FAIL: print-policy exited ${ph_rc} (parse aborted the whole run)." >&2 + test_status=1 +fi +## print-policy prints tab-separated columns (FileUser...), so match +## each filename as the whole first field (trailing TAB). A bare substring match +## would let '/a 744' spuriously match the '/a 744 name' entry. +for expected_file in "${spaced_file}" "${octal_chunk_file}" "${numeric_owner_file}" "${octal_second_file}" "${numeric_owner_spaced_file}"; do + if printf '%s\n' "${policy_output}" | grep --quiet --fixed-strings -- "${expected_file}"$'\t'; then + printf '%s\n' "PASS: filename '${expected_file}' parsed and present in policy." + else + printf '%s\n' "FAIL: filename '${expected_file}' missing from print-policy output." >&2 + test_status=1 + fi +done + +if [ "${test_status}" -ne 0 ]; then + printf '%s\n' "----- print-policy output -----" >&2 + printf '%s\n' "${policy_output}" >&2 +fi +exit "${test_status}" diff --git a/debian/changelog b/debian/changelog index 833969e1..3d05dca1 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,977 +1,3269 @@ +security-misc (3:54.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 30 Sep 2026 08:33:58 +0000 + +security-misc (3:54.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 29 Sep 2026 08:08:57 +0000 + +security-misc (3:54.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 19 Sep 2026 14:09:17 +0000 + +security-misc (3:53.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 15 Sep 2026 14:32:35 +0000 + +security-misc (3:53.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 15 Sep 2026 12:00:54 +0000 + +security-misc (3:53.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 09 Sep 2026 11:05:43 +0000 + +security-misc (3:53.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 08 Sep 2026 15:30:04 +0000 + +security-misc (3:53.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 06 Sep 2026 16:58:23 +0000 + +security-misc (3:53.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 16 Aug 2026 08:24:20 +0000 + +security-misc (3:53.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Aug 2026 08:12:04 +0000 + +security-misc (3:53.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 28 Jul 2026 13:20:23 +0000 + +security-misc (3:53.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 21 Jul 2026 09:23:19 +0000 + +security-misc (3:53.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 20 May 2026 22:20:09 +0000 + +security-misc (3:52.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 18 May 2026 10:14:14 +0000 + +security-misc (3:52.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 15 May 2026 18:40:53 +0000 + +security-misc (3:52.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 11 May 2026 20:28:53 +0000 + +security-misc (3:52.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 02 May 2026 08:48:24 +0000 + +security-misc (3:52.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 25 Apr 2026 09:26:49 +0000 + +security-misc (3:52.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 22 Apr 2026 13:16:45 +0000 + +security-misc (3:52.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 16 Apr 2026 12:27:58 +0000 + +security-misc (3:52.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 12 Apr 2026 14:03:30 +0000 + +security-misc (3:52.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 Apr 2026 09:21:40 +0000 + +security-misc (3:52.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 09 Apr 2026 11:57:57 +0000 + +security-misc (3:51.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 08 Apr 2026 17:51:28 +0000 + +security-misc (3:51.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Mar 2026 11:13:50 +0000 + +security-misc (3:51.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Mar 2026 18:30:25 +0000 + +security-misc (3:51.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 14 Mar 2026 12:08:52 +0000 + +security-misc (3:51.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 23 Feb 2026 13:34:15 +0000 + +security-misc (3:51.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Feb 2026 12:17:16 +0000 + +security-misc (3:51.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 11 Jan 2026 16:40:08 +0000 + +security-misc (3:51.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 05 Jan 2026 10:28:53 +0000 + +security-misc (3:51.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 01 Jan 2026 17:28:24 +0000 + +security-misc (3:51.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 28 Dec 2025 06:36:59 +0000 + +security-misc (3:50.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Dec 2025 11:38:31 +0000 + +security-misc (3:50.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Dec 2025 09:56:05 +0000 + +security-misc (3:50.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 12 Dec 2025 13:17:08 +0000 + +security-misc (3:50.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 09 Dec 2025 14:06:55 +0000 + +security-misc (3:50.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 05 Dec 2025 11:39:12 +0000 + +security-misc (3:50.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 03 Dec 2025 08:31:21 +0000 + +security-misc (3:50.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 24 Nov 2025 08:44:09 +0000 + +security-misc (3:50.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 23 Nov 2025 10:26:13 +0000 + +security-misc (3:50.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 19 Nov 2025 07:02:14 +0000 + +security-misc (3:50.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 14 Nov 2025 06:21:34 +0000 + +security-misc (3:49.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 12 Nov 2025 06:13:05 +0000 + +security-misc (3:49.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 10 Nov 2025 08:00:05 +0000 + +security-misc (3:49.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 09 Nov 2025 10:47:45 +0000 + +security-misc (3:49.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 09 Nov 2025 08:12:41 +0000 + +security-misc (3:49.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 08 Nov 2025 07:44:43 +0000 + +security-misc (3:49.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 02 Nov 2025 11:41:51 +0000 + +security-misc (3:49.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Nov 2025 10:13:49 +0000 + +security-misc (3:49.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Nov 2025 09:41:23 +0000 + +security-misc (3:49.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Nov 2025 09:18:12 +0000 + +security-misc (3:49.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 31 Oct 2025 14:38:30 +0000 + +security-misc (3:48.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 27 Oct 2025 11:48:10 +0000 + +security-misc (3:48.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 26 Oct 2025 12:30:29 +0000 + +security-misc (3:48.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 23 Oct 2025 06:03:25 +0000 + +security-misc (3:48.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 19 Oct 2025 08:43:36 +0000 + +security-misc (3:48.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 18 Oct 2025 09:19:07 +0000 + +security-misc (3:48.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 Oct 2025 12:08:28 +0000 + +security-misc (3:48.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 07 Oct 2025 08:40:31 +0000 + +security-misc (3:48.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 28 Sep 2025 21:09:45 +0000 + +security-misc (3:48.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 26 Sep 2025 08:40:20 +0000 + +security-misc (3:48.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 24 Sep 2025 14:32:34 +0000 + +security-misc (3:47.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 22 Sep 2025 17:25:48 +0000 + +security-misc (3:47.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Sep 2025 18:43:35 +0000 + +security-misc (3:47.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Sep 2025 18:10:09 +0000 + +security-misc (3:47.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Sep 2025 16:18:37 +0000 + +security-misc (3:47.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 13 Sep 2025 08:33:02 +0000 + +security-misc (3:47.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 02 Sep 2025 15:25:49 +0000 + +security-misc (3:47.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 30 Aug 2025 14:19:30 +0000 + +security-misc (3:47.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 27 Aug 2025 19:31:06 +0000 + +security-misc (3:47.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 26 Aug 2025 09:16:15 +0000 + +security-misc (3:47.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 10 Aug 2025 06:34:30 +0000 + +security-misc (3:46.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 09 Aug 2025 09:45:34 +0000 + +security-misc (3:46.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 07 Aug 2025 07:08:19 +0000 + +security-misc (3:46.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 06 Aug 2025 08:27:15 +0000 + +security-misc (3:46.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 04 Aug 2025 09:27:11 +0000 + +security-misc (3:46.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 03 Aug 2025 11:33:03 +0000 + +security-misc (3:46.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 21 Jul 2025 10:00:25 +0000 + +security-misc (3:46.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 02 Jul 2025 20:52:17 +0000 + +security-misc (3:46.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 14 Jun 2025 11:51:44 +0000 + +security-misc (3:46.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 28 May 2025 13:48:11 +0000 + +security-misc (3:46.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 28 May 2025 12:12:00 +0000 + +security-misc (3:45.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 27 May 2025 19:41:25 +0000 + +security-misc (3:45.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 27 May 2025 15:51:50 +0000 + +security-misc (3:45.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 22:06:01 +0000 + +security-misc (3:45.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 15:52:16 +0000 + +security-misc (3:45.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 13:58:18 +0000 + +security-misc (3:45.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 11:23:39 +0000 + +security-misc (3:45.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 20 May 2025 11:40:27 +0000 + +security-misc (3:45.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 25 Apr 2025 09:54:23 +0000 + +security-misc (3:45.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 25 Apr 2025 08:19:34 +0000 + +security-misc (3:45.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 21 Apr 2025 10:21:54 +0000 + +security-misc (3:44.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 19 Apr 2025 17:33:56 +0000 + +security-misc (3:44.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 15 Apr 2025 20:59:37 +0000 + +security-misc (3:44.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 10 Apr 2025 11:38:17 +0000 + +security-misc (3:44.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 09 Apr 2025 15:15:59 +0000 + +security-misc (3:44.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 08 Apr 2025 14:08:24 +0000 + +security-misc (3:44.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 03 Mar 2025 11:00:37 +0000 + +security-misc (3:44.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 09 Feb 2025 23:04:36 +0000 + +security-misc (3:44.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 31 Jan 2025 19:38:41 +0000 + +security-misc (3:44.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 30 Jan 2025 12:58:48 +0000 + +security-misc (3:44.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jan 2025 14:36:41 +0000 + +security-misc (3:43.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 23 Jan 2025 16:28:58 +0000 + +security-misc (3:43.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 22 Jan 2025 14:11:21 +0000 + +security-misc (3:43.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 22 Jan 2025 13:52:29 +0000 + +security-misc (3:43.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 20 Jan 2025 11:35:08 +0000 + +security-misc (3:43.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 20 Jan 2025 10:11:42 +0000 + +security-misc (3:43.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 17 Jan 2025 13:35:27 +0000 + +security-misc (3:43.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 15 Jan 2025 15:02:43 +0000 + +security-misc (3:43.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:32:12 +0000 + +security-misc (3:43.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:30:58 +0000 + +security-misc (3:43.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:16:45 +0000 + +security-misc (3:42.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:07:50 +0000 + +security-misc (3:42.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:06:50 +0000 + +security-misc (3:42.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 13:53:49 +0000 + +security-misc (3:42.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 09:26:05 +0000 + +security-misc (3:42.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 08:24:05 +0000 + +security-misc (3:42.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 12 Jan 2025 11:47:17 +0000 + +security-misc (3:42.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 Jan 2025 15:34:20 +0000 + +security-misc (3:42.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 06 Jan 2025 10:31:40 +0000 + +security-misc (3:42.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 31 Dec 2024 18:42:01 +0000 + +security-misc (3:42.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 31 Dec 2024 14:09:34 +0000 + +security-misc (3:41.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 26 Dec 2024 04:12:02 +0000 + +security-misc (3:41.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 24 Dec 2024 05:16:21 +0000 + +security-misc (3:41.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 20 Dec 2024 06:01:27 +0000 + +security-misc (3:41.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 20 Dec 2024 05:58:24 +0000 + +security-misc (3:41.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 20 Dec 2024 05:48:48 +0000 + +security-misc (3:41.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Dec 2024 10:58:50 +0000 + +security-misc (3:41.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Dec 2024 09:43:26 +0000 + +security-misc (3:41.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Dec 2024 06:57:42 +0000 + +security-misc (3:41.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Dec 2024 19:19:10 +0000 + +security-misc (3:41.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Dec 2024 19:17:10 +0000 + +security-misc (3:40.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 25 Nov 2024 21:07:41 +0000 + +security-misc (3:40.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 14 Nov 2024 22:24:50 +0000 + +security-misc (3:40.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 14 Nov 2024 20:46:26 +0000 + +security-misc (3:40.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 12 Nov 2024 09:11:57 +0000 + +security-misc (3:40.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 11 Nov 2024 11:07:57 +0000 + +security-misc (3:40.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 10 Nov 2024 11:52:42 +0000 + +security-misc (3:40.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 30 Oct 2024 09:43:05 +0000 + +security-misc (3:40.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 23 Oct 2024 09:56:05 +0000 + +security-misc (3:40.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 16 Oct 2024 10:57:20 +0000 + +security-misc (3:40.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 08 Oct 2024 11:24:55 +0000 + +security-misc (3:39.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 03 Oct 2024 07:22:23 +0000 + +security-misc (3:39.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 25 Sep 2024 01:03:42 +0000 + +security-misc (3:39.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 14 Sep 2024 02:56:08 +0000 + +security-misc (3:39.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 08 Sep 2024 17:41:30 +0000 + +security-misc (3:39.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 04 Sep 2024 14:13:15 +0000 + +security-misc (3:39.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 29 Aug 2024 09:49:51 +0000 + +security-misc (3:39.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 28 Aug 2024 11:01:36 +0000 + +security-misc (3:39.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 25 Aug 2024 15:34:54 +0000 + +security-misc (3:39.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 25 Aug 2024 14:33:39 +0000 + +security-misc (3:39.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 16 Aug 2024 08:38:11 +0000 + +security-misc (3:38.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 15 Aug 2024 17:51:18 +0000 + +security-misc (3:38.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 06 Aug 2024 14:01:38 +0000 + +security-misc (3:38.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 28 Jul 2024 20:50:21 +0000 + +security-misc (3:38.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 27 Jul 2024 16:13:34 +0000 + +security-misc (3:38.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 26 Jul 2024 15:40:23 +0000 + +security-misc (3:38.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 26 Jul 2024 09:40:58 +0000 + +security-misc (3:38.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 21 Jul 2024 10:40:13 +0000 + +security-misc (3:38.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 20 Jul 2024 17:02:04 +0000 + +security-misc (3:38.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 18 Jul 2024 18:05:06 +0000 + +security-misc (3:38.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 18 Jul 2024 14:11:35 +0000 + +security-misc (3:37.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 18 Jul 2024 14:05:22 +0000 + +security-misc (3:37.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 15 Jul 2024 21:18:54 +0000 + +security-misc (3:37.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 13 Jul 2024 15:01:15 +0000 + +security-misc (3:37.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 11 Jun 2024 12:56:56 +0000 + +security-misc (3:37.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Jun 2024 18:13:08 +0000 + +security-misc (3:37.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Jun 2024 17:35:04 +0000 + +security-misc (3:37.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 28 May 2024 12:04:52 +0000 + +security-misc (3:37.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 18 May 2024 20:45:11 +0000 + +security-misc (3:37.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 May 2024 11:20:36 +0000 + +security-misc (3:37.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 12 Apr 2024 06:56:38 +0000 + +security-misc (3:36.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 01 Apr 2024 06:56:44 +0000 + +security-misc (3:36.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 18 Mar 2024 15:10:10 +0000 + +security-misc (3:36.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 11 Mar 2024 15:07:50 +0000 + +security-misc (3:36.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 10 Mar 2024 13:19:26 +0000 + +security-misc (3:36.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 04 Mar 2024 11:48:30 +0000 + +security-misc (3:36.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 26 Feb 2024 13:32:44 +0000 + +security-misc (3:36.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 20:08:17 +0000 + +security-misc (3:36.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 19:58:00 +0000 + +security-misc (3:36.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 16:07:16 +0000 + +security-misc (3:36.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 14:52:54 +0000 + +security-misc (3:35.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 22 Feb 2024 14:50:05 +0000 + +security-misc (3:35.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 03 Feb 2024 18:28:26 +0000 + +security-misc (3:35.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 25 Jan 2024 13:59:29 +0000 + +security-misc (3:35.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 18 Jan 2024 14:10:50 +0000 + +security-misc (3:35.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 17 Jan 2024 19:18:24 +0000 + +security-misc (3:35.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 16 Jan 2024 14:26:34 +0000 + +security-misc (3:35.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 16 Jan 2024 14:14:18 +0000 + +security-misc (3:35.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 16 Jan 2024 13:58:54 +0000 + +security-misc (3:35.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 09 Jan 2024 05:52:48 +0000 + +security-misc (3:35.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 04 Jan 2024 02:03:26 +0000 + +security-misc (3:34.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 02 Jan 2024 14:55:13 +0000 + +security-misc (3:34.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 29 Dec 2023 20:15:50 +0000 + +security-misc (3:34.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 25 Dec 2023 16:28:09 +0000 + +security-misc (3:34.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 22 Dec 2023 16:31:57 +0000 + +security-misc (3:34.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 12 Dec 2023 16:51:21 +0000 + +security-misc (3:34.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 04 Dec 2023 17:06:45 +0000 + +security-misc (3:34.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 20 Nov 2023 13:13:10 +0000 + +security-misc (3:34.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 11 Nov 2023 22:29:57 +0000 + +security-misc (3:34.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 11 Nov 2023 20:22:34 +0000 + +security-misc (3:34.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 06 Nov 2023 22:28:21 +0000 + +security-misc (3:33.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 06 Nov 2023 02:13:14 +0000 + +security-misc (3:33.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 06 Nov 2023 01:14:33 +0000 + +security-misc (3:33.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 05 Nov 2023 23:17:59 +0000 + +security-misc (3:33.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 05 Nov 2023 22:43:33 +0000 + +security-misc (3:33.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 05 Nov 2023 21:46:18 +0000 + +security-misc (3:33.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 05 Nov 2023 21:04:02 +0000 + +security-misc (3:33.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 05 Nov 2023 20:58:21 +0000 + +security-misc (3:33.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 05 Nov 2023 20:29:38 +0000 + +security-misc (3:33.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 05 Nov 2023 20:14:43 +0000 + +security-misc (3:33.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 05 Nov 2023 19:56:06 +0000 + +security-misc (3:32.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 03 Nov 2023 16:17:24 +0000 + +security-misc (3:32.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 03 Nov 2023 16:10:48 +0000 + +security-misc (3:32.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 03 Nov 2023 16:06:43 +0000 + +security-misc (3:32.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 03 Nov 2023 14:33:02 +0000 + +security-misc (3:32.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 03 Nov 2023 13:28:08 +0000 + +security-misc (3:32.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 01 Nov 2023 16:26:21 +0000 + +security-misc (3:32.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 01 Nov 2023 15:10:36 +0000 + +security-misc (3:32.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 27 Oct 2023 00:08:41 +0000 + +security-misc (3:32.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 26 Oct 2023 16:23:48 +0000 + +security-misc (3:32.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 25 Oct 2023 21:55:37 +0000 + +security-misc (3:31.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 24 Oct 2023 09:51:11 +0000 + +security-misc (3:31.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 23:23:22 +0000 + +security-misc (3:31.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 20:54:58 +0000 + +security-misc (3:31.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 20:29:08 +0000 + +security-misc (3:31.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 20:16:40 +0000 + +security-misc (3:31.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 19:44:47 +0000 + +security-misc (3:31.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 19:40:59 +0000 + +security-misc (3:31.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 19:33:21 +0000 + +security-misc (3:31.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 19:28:04 +0000 + +security-misc (3:31.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 18:46:42 +0000 + +security-misc (3:30.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 18:30:28 +0000 + +security-misc (3:30.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 17:31:55 +0000 + +security-misc (3:30.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 16:55:41 +0000 + +security-misc (3:30.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 15:28:18 +0000 + +security-misc (3:30.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 15:13:05 +0000 + +security-misc (3:30.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 14:50:30 +0000 + +security-misc (3:30.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 14:16:53 +0000 + +security-misc (3:30.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 14:01:54 +0000 + +security-misc (3:30.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 12:12:30 +0000 + +security-misc (3:30.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Oct 2023 11:06:00 +0000 + +security-misc (3:29.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 21 Oct 2023 18:19:24 +0000 + +security-misc (3:29.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 21 Oct 2023 16:34:59 +0000 + +security-misc (3:29.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 13 Oct 2023 19:22:58 +0000 + +security-misc (3:29.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 12 Oct 2023 16:51:37 +0000 + +security-misc (3:29.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 12 Oct 2023 14:43:40 +0000 + +security-misc (3:29.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 17 Jul 2023 15:48:35 +0000 + +security-misc (3:29.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 23 Jun 2023 08:18:12 +0000 + +security-misc (3:29.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 Jun 2023 09:36:44 +0000 + +security-misc (3:29.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 16 Jun 2023 11:09:01 +0000 + +security-misc (3:29.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 14 Jun 2023 09:59:20 +0000 + +security-misc (3:28.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 12 Jun 2023 18:01:55 +0000 + +security-misc (3:28.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 15 May 2023 17:31:59 +0000 + +security-misc (3:28.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 15 May 2023 11:56:30 +0000 + +security-misc (3:28.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 06 May 2023 12:00:12 +0000 + +security-misc (3:28.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 06 May 2023 11:54:31 +0000 + +security-misc (3:28.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 05 May 2023 15:09:32 +0000 + +security-misc (3:28.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 30 Jan 2023 10:58:47 +0000 + +security-misc (3:28.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 24 Jan 2023 12:09:40 +0000 + +security-misc (3:28.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 24 Jan 2023 12:05:53 +0000 + +security-misc (3:28.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 09 Jan 2023 12:05:18 +0000 + +security-misc (3:27.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 09 Jan 2023 12:02:01 +0000 + +security-misc (3:27.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 09 Jan 2023 10:34:48 +0000 + +security-misc (3:27.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 08 Jan 2023 12:17:02 +0000 + +security-misc (3:27.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 07 Jan 2023 23:13:57 +0000 + +security-misc (3:27.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 07 Jan 2023 22:49:24 +0000 + +security-misc (3:27.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 07 Jan 2023 22:23:35 +0000 + +security-misc (3:27.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 07 Jan 2023 22:16:23 +0000 + +security-misc (3:27.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 07 Jan 2023 21:20:48 +0000 + +security-misc (3:27.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 07 Jan 2023 20:37:47 +0000 + +security-misc (3:27.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 07 Jan 2023 19:31:40 +0000 + +security-misc (3:26.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 07 Jan 2023 19:27:42 +0000 + +security-misc (3:26.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 07 Jan 2023 17:57:36 +0000 + +security-misc (3:26.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 18 Dec 2022 19:37:51 +0000 + +security-misc (3:26.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 24 Nov 2022 12:21:58 +0000 + +security-misc (3:26.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 24 Nov 2022 12:00:33 +0000 + +security-misc (3:26.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 24 Nov 2022 11:49:25 +0000 + +security-misc (3:26.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 24 Nov 2022 11:31:37 +0000 + +security-misc (3:26.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 24 Nov 2022 11:14:15 +0000 + +security-misc (3:26.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 22 Nov 2022 11:03:13 +0000 + +security-misc (3:26.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 17 Nov 2022 15:15:36 +0000 + +security-misc (3:25.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 24 Aug 2022 22:28:39 +0000 + +security-misc (3:25.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 13 Aug 2022 15:40:04 +0000 + +security-misc (3:25.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 12 Aug 2022 11:52:26 +0000 + +security-misc (3:25.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 26 Jul 2022 14:00:53 +0000 + +security-misc (3:25.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 23 Jul 2022 12:07:37 +0000 + +security-misc (3:25.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 16 Jul 2022 12:00:16 +0000 + +security-misc (3:25.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 13 Jul 2022 12:28:34 +0000 + +security-misc (3:25.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 09 Jul 2022 15:42:24 +0000 + +security-misc (3:25.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 07 Jul 2022 21:41:13 +0000 + +security-misc (3:25.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 05 Jul 2022 15:16:33 +0000 + +security-misc (3:24.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 02 Jul 2022 22:30:06 +0000 + +security-misc (3:24.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 02 Jul 2022 21:37:16 +0000 + +security-misc (3:24.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 02 Jul 2022 20:03:52 +0000 + +security-misc (3:24.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 02 Jul 2022 19:52:08 +0000 + +security-misc (3:24.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 02 Jul 2022 19:32:50 +0000 + +security-misc (3:24.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 02 Jul 2022 18:27:04 +0000 + +security-misc (3:24.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 20:25:07 +0000 + +security-misc (3:24.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 20:06:33 +0000 + +security-misc (3:24.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 20:03:58 +0000 + +security-misc (3:24.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 19:24:40 +0000 + +security-misc (3:23.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 19:22:41 +0000 + +security-misc (3:23.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 18:18:02 +0000 + +security-misc (3:23.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 18:15:48 +0000 + +security-misc (3:23.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 17:03:35 +0000 + +security-misc (3:23.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 15:18:59 +0000 + +security-misc (3:23.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 14:02:18 +0000 + +security-misc (3:23.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jun 2022 13:54:27 +0000 + +security-misc (3:23.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 08 Jun 2022 15:05:07 +0000 + +security-misc (3:23.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 25 May 2022 10:07:17 +0000 + +security-misc (3:23.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 10 Feb 2022 19:06:54 +0000 + +security-misc (3:22.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Sep 2021 18:18:52 +0000 + +security-misc (3:22.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 12 Sep 2021 15:57:20 +0000 + +security-misc (3:22.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 09 Sep 2021 16:35:37 +0000 + +security-misc (3:22.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 06 Sep 2021 13:46:20 +0000 + +security-misc (3:22.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 06 Sep 2021 08:55:23 +0000 + +security-misc (3:22.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 05 Sep 2021 20:04:28 +0000 + +security-misc (3:22.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 04 Sep 2021 22:29:00 +0000 + +security-misc (3:22.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 04 Sep 2021 16:00:55 +0000 + +security-misc (3:22.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 02 Sep 2021 18:36:53 +0000 + +security-misc (3:22.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Aug 2021 09:32:18 +0000 + +security-misc (3:21.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 17 Aug 2021 19:24:12 +0000 + +security-misc (3:21.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Aug 2021 22:26:32 +0000 + +security-misc (3:21.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 05 Aug 2021 21:03:43 +0000 + +security-misc (3:21.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 01 Aug 2021 17:12:08 +0000 + +security-misc (3:21.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 25 Jul 2021 15:31:45 +0000 + +security-misc (3:21.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 24 Jul 2021 22:10:05 +0000 + +security-misc (3:21.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 23 Jun 2021 15:20:39 +0000 + +security-misc (3:21.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 20 Jun 2021 14:16:57 +0000 + +security-misc (3:21.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 07 Jun 2021 16:13:37 +0000 + +security-misc (3:21.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 01 Jun 2021 11:36:59 +0000 + +security-misc (3:20.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 05 May 2021 12:37:56 +0000 + +security-misc (3:20.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 05 Apr 2021 15:58:47 +0000 + +security-misc (3:20.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 17 Mar 2021 16:31:34 +0000 + +security-misc (3:20.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 04 Mar 2021 12:09:01 +0000 + +security-misc (3:20.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 06 Feb 2021 11:31:45 +0000 + +security-misc (3:20.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 30 Jan 2021 04:37:03 +0000 + +security-misc (3:20.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 28 Jan 2021 07:15:46 +0000 + +security-misc (3:20.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 27 Jan 2021 10:50:16 +0000 + +security-misc (3:20.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 24 Jan 2021 10:10:36 +0000 + +security-misc (3:20.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 20 Jan 2021 00:41:43 +0000 + +security-misc (3:19.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 14 Jan 2021 07:36:49 +0000 + +security-misc (3:19.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 05 Jan 2021 13:30:37 +0000 + +security-misc (3:19.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 10 Dec 2020 10:20:57 +0000 + +security-misc (3:19.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 01 Dec 2020 10:53:06 +0000 + +security-misc (3:19.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 28 Nov 2020 11:08:10 +0000 + +security-misc (3:19.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 06 Nov 2020 15:18:09 +0000 + +security-misc (3:19.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 31 Oct 2020 10:29:25 +0000 + +security-misc (3:19.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 31 Oct 2020 10:09:22 +0000 + +security-misc (3:19.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 05 Oct 2020 11:03:37 +0000 + +security-misc (3:19.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 28 Sep 2020 14:30:42 +0000 + +security-misc (3:18.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 19 Sep 2020 13:28:27 +0000 + +security-misc (3:18.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 03 Aug 2020 13:43:43 +0000 + +security-misc (3:18.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jul 2020 12:33:07 +0000 + +security-misc (3:18.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 14 May 2020 17:57:32 +0000 + +security-misc (3:18.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 23 Apr 2020 16:27:25 +0000 + +security-misc (3:18.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 16 Apr 2020 12:43:40 +0000 + +security-misc (3:18.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Apr 2020 16:40:31 +0000 + +security-misc (3:18.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 13 Apr 2020 10:56:34 +0000 + +security-misc (3:18.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 09 Apr 2020 09:45:30 +0000 + +security-misc (3:18.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 08 Apr 2020 17:13:21 +0000 + +security-misc (3:17.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 08 Apr 2020 12:51:11 +0000 + +security-misc (3:17.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 06 Apr 2020 17:29:23 +0000 + +security-misc (3:17.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 04 Apr 2020 20:51:42 +0000 + +security-misc (3:17.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 02 Apr 2020 11:58:51 +0000 + +security-misc (3:17.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 01 Apr 2020 14:58:16 +0000 + +security-misc (3:17.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 01 Apr 2020 12:26:44 +0000 + +security-misc (3:17.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 31 Mar 2020 11:41:45 +0000 + +security-misc (3:17.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 30 Mar 2020 22:42:02 +0000 + +security-misc (3:17.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 30 Mar 2020 21:16:46 +0000 + +security-misc (3:17.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 21 Mar 2020 18:56:48 +0000 + +security-misc (3:16.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 12 Mar 2020 08:43:08 +0000 + +security-misc (3:16.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 08 Mar 2020 13:43:24 +0000 + +security-misc (3:16.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 05 Mar 2020 13:36:27 +0000 + +security-misc (3:16.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 03 Mar 2020 14:19:49 +0000 + +security-misc (3:16.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 03 Mar 2020 14:12:50 +0000 + +security-misc (3:16.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 15 Feb 2020 20:35:44 +0000 + +security-misc (3:16.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 15 Feb 2020 20:29:38 +0000 + +security-misc (3:16.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 13 Feb 2020 18:39:45 +0000 + +security-misc (3:16.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 05 Feb 2020 11:31:48 +0000 + security-misc (3:16.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 03 Feb 2020 14:23:13 +0000 + -- Patrick Schleizer Mon, 03 Feb 2020 14:23:13 +0000 security-misc (3:15.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 03 Feb 2020 13:43:31 +0000 + -- Patrick Schleizer Mon, 03 Feb 2020 13:43:31 +0000 security-misc (3:15.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 30 Jan 2020 11:14:34 +0000 + -- Patrick Schleizer Thu, 30 Jan 2020 11:14:34 +0000 security-misc (3:15.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 30 Jan 2020 11:02:26 +0000 + -- Patrick Schleizer Thu, 30 Jan 2020 11:02:26 +0000 security-misc (3:15.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 30 Jan 2020 06:22:32 +0000 + -- Patrick Schleizer Thu, 30 Jan 2020 06:22:32 +0000 security-misc (3:15.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 24 Jan 2020 17:02:27 +0000 + -- Patrick Schleizer Fri, 24 Jan 2020 17:02:27 +0000 security-misc (3:15.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 24 Jan 2020 09:41:16 +0000 + -- Patrick Schleizer Fri, 24 Jan 2020 09:41:16 +0000 security-misc (3:15.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 24 Jan 2020 09:34:18 +0000 + -- Patrick Schleizer Fri, 24 Jan 2020 09:34:18 +0000 security-misc (3:15.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 24 Jan 2020 08:49:02 +0000 + -- Patrick Schleizer Fri, 24 Jan 2020 08:49:02 +0000 security-misc (3:15.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 22 Jan 2020 12:10:47 +0000 + -- Patrick Schleizer Wed, 22 Jan 2020 12:10:47 +0000 security-misc (3:15.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 21 Jan 2020 15:12:32 +0000 + -- Patrick Schleizer Tue, 21 Jan 2020 15:12:32 +0000 security-misc (3:14.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 20 Jan 2020 13:51:25 +0000 + -- Patrick Schleizer Mon, 20 Jan 2020 13:51:25 +0000 security-misc (3:14.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 17 Jan 2020 08:32:57 +0000 + -- Patrick Schleizer Fri, 17 Jan 2020 08:32:57 +0000 security-misc (3:14.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 15 Jan 2020 16:37:52 +0000 + -- Patrick Schleizer Wed, 15 Jan 2020 16:37:52 +0000 security-misc (3:14.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 15 Jan 2020 16:05:54 +0000 + -- Patrick Schleizer Wed, 15 Jan 2020 16:05:54 +0000 security-misc (3:14.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 14 Jan 2020 14:28:28 +0000 + -- Patrick Schleizer Tue, 14 Jan 2020 14:28:28 +0000 security-misc (3:14.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 14 Jan 2020 14:20:36 +0000 + -- Patrick Schleizer Tue, 14 Jan 2020 14:20:36 +0000 security-misc (3:14.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 11 Jan 2020 20:19:28 +0000 + -- Patrick Schleizer Sat, 11 Jan 2020 20:19:28 +0000 security-misc (3:14.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 01 Jan 2020 10:59:58 +0000 + -- Patrick Schleizer Wed, 01 Jan 2020 10:59:58 +0000 security-misc (3:14.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 31 Dec 2019 11:08:32 +0000 + -- Patrick Schleizer Tue, 31 Dec 2019 11:08:32 +0000 security-misc (3:14.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 31 Dec 2019 11:03:48 +0000 + -- Patrick Schleizer Tue, 31 Dec 2019 11:03:48 +0000 security-misc (3:13.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 31 Dec 2019 07:54:58 +0000 + -- Patrick Schleizer Tue, 31 Dec 2019 07:54:58 +0000 security-misc (3:13.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 30 Dec 2019 11:42:14 +0000 + -- Patrick Schleizer Mon, 30 Dec 2019 11:42:14 +0000 security-misc (3:13.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 30 Dec 2019 10:59:43 +0000 + -- Patrick Schleizer Mon, 30 Dec 2019 10:59:43 +0000 security-misc (3:13.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 27 Dec 2019 10:30:12 +0000 + -- Patrick Schleizer Fri, 27 Dec 2019 10:30:12 +0000 security-misc (3:13.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 24 Dec 2019 23:35:49 +0000 + -- Patrick Schleizer Tue, 24 Dec 2019 23:35:49 +0000 security-misc (3:13.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 24 Dec 2019 13:07:55 +0000 + -- Patrick Schleizer Tue, 24 Dec 2019 13:07:55 +0000 security-misc (3:13.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 23 Dec 2019 13:48:04 +0000 + -- Patrick Schleizer Mon, 23 Dec 2019 13:48:04 +0000 security-misc (3:13.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 23 Dec 2019 08:58:00 +0000 + -- Patrick Schleizer Mon, 23 Dec 2019 08:58:00 +0000 security-misc (3:13.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 23 Dec 2019 07:42:07 +0000 + -- Patrick Schleizer Mon, 23 Dec 2019 07:42:07 +0000 security-misc (3:13.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 23 Dec 2019 07:13:13 +0000 + -- Patrick Schleizer Mon, 23 Dec 2019 07:13:13 +0000 security-misc (3:12.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 19:55:03 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 19:55:03 +0000 security-misc (3:12.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 19:23:35 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 19:23:35 +0000 security-misc (3:12.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 12:49:55 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 12:49:55 +0000 security-misc (3:12.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 12:38:25 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 12:38:25 +0000 security-misc (3:12.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 11:28:19 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 11:28:19 +0000 security-misc (3:12.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 11:12:20 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 11:12:20 +0000 security-misc (3:12.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 11:00:17 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 11:00:17 +0000 security-misc (3:12.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 10:38:39 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 10:38:39 +0000 security-misc (3:12.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 10:31:55 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 10:31:55 +0000 security-misc (3:12.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 21 Dec 2019 07:05:39 +0000 + -- Patrick Schleizer Sat, 21 Dec 2019 07:05:39 +0000 security-misc (3:11.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 20 Dec 2019 16:50:25 +0000 + -- Patrick Schleizer Fri, 20 Dec 2019 16:50:25 +0000 security-misc (3:11.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 20 Dec 2019 16:09:22 +0000 + -- Patrick Schleizer Fri, 20 Dec 2019 16:09:22 +0000 security-misc (3:11.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 20 Dec 2019 15:50:51 +0000 + -- Patrick Schleizer Fri, 20 Dec 2019 15:50:51 +0000 security-misc (3:11.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 20 Dec 2019 13:15:00 +0000 + -- Patrick Schleizer Fri, 20 Dec 2019 13:15:00 +0000 security-misc (3:11.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 20 Dec 2019 12:12:36 +0000 + -- Patrick Schleizer Fri, 20 Dec 2019 12:12:36 +0000 security-misc (3:11.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 16 Dec 2019 11:27:51 +0000 + -- Patrick Schleizer Mon, 16 Dec 2019 11:27:51 +0000 security-misc (3:11.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 12 Dec 2019 14:04:15 +0000 + -- Patrick Schleizer Thu, 12 Dec 2019 14:04:15 +0000 security-misc (3:11.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 10 Dec 2019 16:44:02 +0000 + -- Patrick Schleizer Tue, 10 Dec 2019 16:44:02 +0000 security-misc (3:11.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 09 Dec 2019 13:25:30 +0000 + -- Patrick Schleizer Mon, 09 Dec 2019 13:25:30 +0000 security-misc (3:11.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 08 Dec 2019 10:26:29 +0000 + -- Patrick Schleizer Sun, 08 Dec 2019 10:26:29 +0000 security-misc (3:10.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 08 Dec 2019 09:38:33 +0000 + -- Patrick Schleizer Sun, 08 Dec 2019 09:38:33 +0000 security-misc (3:10.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 08 Dec 2019 09:27:01 +0000 + -- Patrick Schleizer Sun, 08 Dec 2019 09:27:01 +0000 security-misc (3:10.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 08 Dec 2019 09:05:29 +0000 + -- Patrick Schleizer Sun, 08 Dec 2019 09:05:29 +0000 security-misc (3:10.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 07 Dec 2019 07:02:32 +0000 + -- Patrick Schleizer Sat, 07 Dec 2019 07:02:32 +0000 security-misc (3:10.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 06 Dec 2019 17:43:21 +0000 + -- Patrick Schleizer Fri, 06 Dec 2019 17:43:21 +0000 security-misc (3:10.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 06 Dec 2019 16:18:20 +0000 + -- Patrick Schleizer Fri, 06 Dec 2019 16:18:20 +0000 security-misc (3:10.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 06 Dec 2019 14:32:18 +0000 + -- Patrick Schleizer Fri, 06 Dec 2019 14:32:18 +0000 security-misc (3:10.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 28 Nov 2019 15:22:41 +0000 + -- Patrick Schleizer Thu, 28 Nov 2019 15:22:41 +0000 security-misc (3:10.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 25 Nov 2019 08:51:36 +0000 + -- Patrick Schleizer Mon, 25 Nov 2019 08:51:36 +0000 security-misc (3:10.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 25 Nov 2019 08:49:15 +0000 + -- Patrick Schleizer Mon, 25 Nov 2019 08:49:15 +0000 security-misc (3:9.12-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 23 Nov 2019 14:07:45 +0000 + -- Patrick Schleizer Sat, 23 Nov 2019 14:07:45 +0000 security-misc (3:9.11-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 19 Nov 2019 15:31:55 +0000 + -- Patrick Schleizer Tue, 19 Nov 2019 15:31:55 +0000 security-misc (3:9.10-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 18 Nov 2019 19:16:16 +0000 + -- Patrick Schleizer Mon, 18 Nov 2019 19:16:16 +0000 security-misc (3:9.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 09 Nov 2019 18:44:50 +0000 + -- Patrick Schleizer Sat, 09 Nov 2019 18:44:50 +0000 security-misc (3:9.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 09 Nov 2019 12:57:45 +0000 + -- Patrick Schleizer Sat, 09 Nov 2019 12:57:45 +0000 security-misc (3:9.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 09 Nov 2019 12:23:15 +0000 + -- Patrick Schleizer Sat, 09 Nov 2019 12:23:15 +0000 security-misc (3:9.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 31 Oct 2019 16:34:35 +0000 + -- Patrick Schleizer Thu, 31 Oct 2019 16:34:35 +0000 security-misc (3:9.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 31 Oct 2019 16:06:51 +0000 + -- Patrick Schleizer Thu, 31 Oct 2019 16:06:51 +0000 security-misc (3:9.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 23 Oct 2019 10:22:03 +0000 + -- Patrick Schleizer Wed, 23 Oct 2019 10:22:03 +0000 security-misc (3:9.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 21 Oct 2019 09:55:41 +0000 + -- Patrick Schleizer Mon, 21 Oct 2019 09:55:41 +0000 security-misc (3:9.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 21 Oct 2019 09:51:36 +0000 + -- Patrick Schleizer Mon, 21 Oct 2019 09:51:36 +0000 security-misc (3:9.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 18 Oct 2019 10:39:43 +0000 + -- Patrick Schleizer Fri, 18 Oct 2019 10:39:43 +0000 security-misc (3:9.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 18 Oct 2019 08:55:07 +0000 + -- Patrick Schleizer Fri, 18 Oct 2019 08:55:07 +0000 security-misc (3:8.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 14 Oct 2019 10:23:01 +0000 + -- Patrick Schleizer Mon, 14 Oct 2019 10:23:01 +0000 security-misc (3:8.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 05 Oct 2019 11:33:15 +0000 + -- Patrick Schleizer Sat, 05 Oct 2019 11:33:15 +0000 security-misc (3:8.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 05 Oct 2019 09:40:26 +0000 + -- Patrick Schleizer Sat, 05 Oct 2019 09:40:26 +0000 security-misc (3:8.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 16 Sep 2019 13:34:11 +0000 + -- Patrick Schleizer Mon, 16 Sep 2019 13:34:11 +0000 security-misc (3:8.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 15 Sep 2019 14:08:13 +0000 + -- Patrick Schleizer Sun, 15 Sep 2019 14:08:13 +0000 security-misc (3:8.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 12 Sep 2019 12:50:42 +0000 + -- Patrick Schleizer Thu, 12 Sep 2019 12:50:42 +0000 security-misc (3:8.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 09 Sep 2019 12:10:24 +0000 + -- Patrick Schleizer Mon, 09 Sep 2019 12:10:24 +0000 security-misc (3:8.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 07 Sep 2019 06:11:32 +0000 + -- Patrick Schleizer Sat, 07 Sep 2019 06:11:32 +0000 security-misc (3:8.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 06 Sep 2019 13:04:57 +0000 + -- Patrick Schleizer Fri, 06 Sep 2019 13:04:57 +0000 security-misc (3:8.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 06 Sep 2019 11:47:40 +0000 + -- Patrick Schleizer Fri, 06 Sep 2019 11:47:40 +0000 security-misc (3:7.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 06 Sep 2019 09:33:06 +0000 + -- Patrick Schleizer Fri, 06 Sep 2019 09:33:06 +0000 security-misc (3:7.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 31 Aug 2019 13:44:37 +0000 + -- Patrick Schleizer Sat, 31 Aug 2019 13:44:37 +0000 security-misc (3:7.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 24 Aug 2019 16:41:27 +0000 + -- Patrick Schleizer Sat, 24 Aug 2019 16:41:27 +0000 security-misc (3:7.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 23 Aug 2019 16:57:12 +0000 + -- Patrick Schleizer Fri, 23 Aug 2019 16:57:12 +0000 security-misc (3:7.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 17 Aug 2019 10:54:08 +0000 + -- Patrick Schleizer Sat, 17 Aug 2019 10:54:08 +0000 security-misc (3:7.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 17 Aug 2019 09:57:48 +0000 + -- Patrick Schleizer Sat, 17 Aug 2019 09:57:48 +0000 security-misc (3:7.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 16 Aug 2019 16:05:51 +0000 + -- Patrick Schleizer Fri, 16 Aug 2019 16:05:51 +0000 security-misc (3:7.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 16 Aug 2019 15:59:14 +0000 + -- Patrick Schleizer Fri, 16 Aug 2019 15:59:14 +0000 security-misc (3:7.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 15 Aug 2019 15:18:02 +0000 + -- Patrick Schleizer Thu, 15 Aug 2019 15:18:02 +0000 security-misc (3:7.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 14 Aug 2019 11:52:26 +0000 + -- Patrick Schleizer Wed, 14 Aug 2019 11:52:26 +0000 security-misc (3:6.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 14 Aug 2019 11:13:25 +0000 + -- Patrick Schleizer Wed, 14 Aug 2019 11:13:25 +0000 security-misc (3:6.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 14 Aug 2019 10:08:18 +0000 + -- Patrick Schleizer Wed, 14 Aug 2019 10:08:18 +0000 security-misc (3:6.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 14 Aug 2019 07:02:09 +0000 + -- Patrick Schleizer Wed, 14 Aug 2019 07:02:09 +0000 security-misc (3:6.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 11 Aug 2019 12:07:07 +0000 + -- Patrick Schleizer Sun, 11 Aug 2019 12:07:07 +0000 security-misc (3:6.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 10 Aug 2019 11:37:02 +0000 + -- Patrick Schleizer Sat, 10 Aug 2019 11:37:02 +0000 security-misc (3:6.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 01 Aug 2019 12:02:41 +0000 + -- Patrick Schleizer Thu, 01 Aug 2019 12:02:41 +0000 security-misc (3:6.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 31 Jul 2019 19:12:27 +0000 + -- Patrick Schleizer Wed, 31 Jul 2019 19:12:27 +0000 security-misc (3:6.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 31 Jul 2019 15:17:50 +0000 + -- Patrick Schleizer Wed, 31 Jul 2019 15:17:50 +0000 security-misc (3:6.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 31 Jul 2019 07:44:50 +0000 + -- Patrick Schleizer Wed, 31 Jul 2019 07:44:50 +0000 security-misc (3:6.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 22 Jul 2019 01:16:18 +0000 + -- Patrick Schleizer Mon, 22 Jul 2019 01:16:18 +0000 security-misc (3:5.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 17 Jul 2019 21:38:26 +0000 + -- Patrick Schleizer Wed, 17 Jul 2019 21:38:26 +0000 security-misc (3:5.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 17 Jul 2019 21:08:23 +0000 + -- Patrick Schleizer Wed, 17 Jul 2019 21:08:23 +0000 security-misc (3:5.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 17 Jul 2019 19:13:57 +0000 + -- Patrick Schleizer Wed, 17 Jul 2019 19:13:57 +0000 security-misc (3:5.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 16 Jul 2019 19:45:52 +0000 + -- Patrick Schleizer Tue, 16 Jul 2019 19:45:52 +0000 security-misc (3:5.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 15 Jul 2019 13:26:47 +0000 + -- Patrick Schleizer Mon, 15 Jul 2019 13:26:47 +0000 security-misc (3:5.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 13 Jul 2019 18:51:32 +0000 + -- Patrick Schleizer Sat, 13 Jul 2019 18:51:32 +0000 security-misc (3:5.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 13 Jul 2019 16:30:39 +0000 + -- Patrick Schleizer Sat, 13 Jul 2019 16:30:39 +0000 security-misc (3:5.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 13 Jul 2019 15:17:16 +0000 + -- Patrick Schleizer Sat, 13 Jul 2019 15:17:16 +0000 security-misc (3:5.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 13 Jul 2019 14:58:47 +0000 + -- Patrick Schleizer Sat, 13 Jul 2019 14:58:47 +0000 security-misc (3:5.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 13 Jul 2019 14:55:31 +0000 + -- Patrick Schleizer Sat, 13 Jul 2019 14:55:31 +0000 security-misc (3:4.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 11 Jul 2019 18:28:04 +0000 + -- Patrick Schleizer Thu, 11 Jul 2019 18:28:04 +0000 security-misc (3:4.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 11 Jul 2019 07:16:38 +0000 + -- Patrick Schleizer Thu, 11 Jul 2019 07:16:38 +0000 security-misc (3:4.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 08 Jul 2019 00:23:52 +0000 + -- Patrick Schleizer Mon, 08 Jul 2019 00:23:52 +0000 security-misc (3:4.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 07 Jul 2019 23:00:27 +0000 + -- Patrick Schleizer Sun, 07 Jul 2019 23:00:27 +0000 security-misc (3:4.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 07 Jul 2019 21:11:08 +0000 + -- Patrick Schleizer Sun, 07 Jul 2019 21:11:08 +0000 security-misc (3:4.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 07 Jul 2019 09:39:12 +0000 + -- Patrick Schleizer Sun, 07 Jul 2019 09:39:12 +0000 security-misc (3:4.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 06 Jul 2019 13:56:28 +0000 + -- Patrick Schleizer Sat, 06 Jul 2019 13:56:28 +0000 security-misc (3:4.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 06 Jul 2019 13:53:10 +0000 + -- Patrick Schleizer Sat, 06 Jul 2019 13:53:10 +0000 security-misc (3:4.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 01 Jul 2019 15:23:49 +0000 + -- Patrick Schleizer Mon, 01 Jul 2019 15:23:49 +0000 security-misc (3:4.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 30 Jun 2019 11:21:58 +0000 + -- Patrick Schleizer Sun, 30 Jun 2019 11:21:58 +0000 security-misc (3:3.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 30 Jun 2019 08:23:51 +0000 + -- Patrick Schleizer Sun, 30 Jun 2019 08:23:51 +0000 security-misc (3:3.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 29 Jun 2019 10:35:13 +0000 + -- Patrick Schleizer Sat, 29 Jun 2019 10:35:13 +0000 security-misc (3:3.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 28 Jun 2019 07:20:53 +0000 + -- Patrick Schleizer Fri, 28 Jun 2019 07:20:53 +0000 security-misc (3:3.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 28 Jun 2019 07:09:35 +0000 + -- Patrick Schleizer Fri, 28 Jun 2019 07:09:35 +0000 security-misc (3:3.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 23 Jun 2019 19:57:42 +0000 + -- Patrick Schleizer Sun, 23 Jun 2019 19:57:42 +0000 security-misc (3:3.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 23 Jun 2019 12:22:13 +0000 + -- Patrick Schleizer Sun, 23 Jun 2019 12:22:13 +0000 security-misc (3:3.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 23 Jun 2019 08:38:01 +0000 + -- Patrick Schleizer Sun, 23 Jun 2019 08:38:01 +0000 security-misc (3:3.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 21 Jun 2019 05:40:04 +0000 + -- Patrick Schleizer Fri, 21 Jun 2019 05:40:04 +0000 security-misc (3:3.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 10 Jun 2019 15:42:58 +0000 + -- Patrick Schleizer Mon, 10 Jun 2019 15:42:58 +0000 security-misc (3:3.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 08 Jun 2019 11:32:12 +0000 + -- Patrick Schleizer Sat, 08 Jun 2019 11:32:12 +0000 security-misc (3:2.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 24 May 2019 20:48:59 +0000 + -- Patrick Schleizer Fri, 24 May 2019 20:48:59 +0000 security-misc (3:2.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 23 May 2019 22:38:13 +0000 + -- Patrick Schleizer Thu, 23 May 2019 22:38:13 +0000 security-misc (3:2.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 16 May 2019 20:25:46 +0000 + -- Patrick Schleizer Thu, 16 May 2019 20:25:46 +0000 security-misc (3:2.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 12 May 2019 11:08:32 +0000 + -- Patrick Schleizer Sun, 12 May 2019 11:08:32 +0000 security-misc (3:2.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 12 May 2019 10:48:27 +0000 + -- Patrick Schleizer Sun, 12 May 2019 10:48:27 +0000 security-misc (3:2.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 06 May 2019 09:58:44 +0000 + -- Patrick Schleizer Mon, 06 May 2019 09:58:44 +0000 security-misc (3:2.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 03 May 2019 11:34:25 +0000 + -- Patrick Schleizer Fri, 03 May 2019 11:34:25 +0000 security-misc (3:2.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 06 Apr 2019 12:13:43 +0000 + -- Patrick Schleizer Sat, 06 Apr 2019 12:13:43 +0000 security-misc (3:2.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 29 Mar 2019 10:02:51 +0000 + -- Patrick Schleizer Fri, 29 Mar 2019 10:02:51 +0000 security-misc (3:2.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 12 Mar 2019 11:36:25 +0000 + -- Patrick Schleizer Tue, 12 Mar 2019 11:36:25 +0000 security-misc (3:1.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 28 Nov 2018 06:33:14 +0000 + -- Patrick Schleizer Wed, 28 Nov 2018 06:33:14 +0000 security-misc (3:1.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 08 Nov 2018 09:55:41 +0000 + -- Patrick Schleizer Thu, 08 Nov 2018 09:55:41 +0000 security-misc (3:1.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 01 Nov 2018 07:42:29 +0000 + -- Patrick Schleizer Thu, 01 Nov 2018 07:42:29 +0000 security-misc (3:1.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 14 Sep 2018 13:20:11 +0000 + -- Patrick Schleizer Fri, 14 Sep 2018 13:20:11 +0000 security-misc (3:1.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 27 Aug 2018 16:49:44 +0000 + -- Patrick Schleizer Mon, 27 Aug 2018 16:49:44 +0000 security-misc (3:1.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 01 Feb 2018 15:18:55 +0000 + -- Patrick Schleizer Thu, 01 Feb 2018 15:18:55 +0000 security-misc (3:1.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 21 Dec 2017 20:35:29 +0000 + -- Patrick Schleizer Thu, 21 Dec 2017 20:35:29 +0000 security-misc (3:1.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Wed, 26 Jul 2017 14:37:34 +0000 + -- Patrick Schleizer Wed, 26 Jul 2017 14:37:34 +0000 security-misc (3:1.1-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 06 Mar 2017 16:16:31 +0000 + -- Patrick Schleizer Mon, 06 Mar 2017 16:16:31 +0000 security-misc (3:1.0-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 27 Feb 2017 02:04:00 +0000 + -- Patrick Schleizer Mon, 27 Feb 2017 02:04:00 +0000 security-misc (3:0.9-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Fri, 17 Feb 2017 14:08:56 +0000 + -- Patrick Schleizer Fri, 17 Feb 2017 14:08:56 +0000 security-misc (3:0.8-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sun, 15 Jan 2017 15:35:31 +0000 + -- Patrick Schleizer Sun, 15 Jan 2017 15:35:31 +0000 security-misc (3:0.7-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 12 Jan 2017 02:56:55 +0000 + -- Patrick Schleizer Thu, 12 Jan 2017 02:56:55 +0000 security-misc (3:0.6-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Sat, 10 Dec 2016 02:30:50 +0000 + -- Patrick Schleizer Sat, 10 Dec 2016 02:30:50 +0000 security-misc (3:0.5-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Mon, 25 Apr 2016 23:27:58 +0000 + -- Patrick Schleizer Mon, 25 Apr 2016 23:27:58 +0000 security-misc (3:0.4-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Thu, 07 Apr 2016 22:54:45 +0000 + -- Patrick Schleizer Thu, 07 Apr 2016 22:54:45 +0000 security-misc (3:0.3-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 15 Dec 2015 04:16:07 +0000 + -- Patrick Schleizer Tue, 15 Dec 2015 04:16:07 +0000 security-misc (3:0.2-1) unstable; urgency=medium * New upstream version (local package). - -- Patrick Schleizer Tue, 15 Dec 2015 02:00:33 +0000 + -- Patrick Schleizer Tue, 15 Dec 2015 02:00:33 +0000 security-misc (3:0.1-2) unstable; urgency=low * Initial release. - -- Patrick Schleizer Sun, 17 Aug 2014 17:56:36 +0000 + -- Patrick Schleizer Sun, 17 Aug 2014 17:56:36 +0000 diff --git a/debian/compat b/debian/compat deleted file mode 100644 index 48082f72..00000000 --- a/debian/compat +++ /dev/null @@ -1 +0,0 @@ -12 diff --git a/debian/control b/debian/control index 6a97d690..1673ab33 100644 --- a/debian/control +++ b/debian/control @@ -1,336 +1,82 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. Source: security-misc Section: misc Priority: optional -Maintainer: Patrick Schleizer -Build-Depends: debhelper (>= 12), genmkfile, config-package-dev, dh-apparmor, - ronn -Homepage: https://github.com/Whonix/security-misc -Vcs-Browser: https://github.com/Whonix/security-misc -Vcs-Git: https://github.com/Whonix/security-misc.git -Standards-Version: 4.3.0 +Maintainer: Patrick Schleizer +Build-Depends: debhelper (>= 13), + debhelper-compat (= 13), + dh-apparmor, + dh-exec, + config-package-dev, + po-debconf +Homepage: https://www.kicksecure.com/wiki/Security-misc +Vcs-Browser: https://github.com/Kicksecure/security-misc +Vcs-Git: https://github.com/Kicksecure/security-misc.git +Standards-Version: 4.7.2 +Rules-Requires-Root: no -Package: security-misc +## 'Package: security-misc-shared' Comments +## +## 'Conflicts: security-misc' is needed. +## > dpkg-divert: error: 'diversion of /etc/securetty to /etc/securetty.security-misc-orig by security-misc-shared' clashes with 'diversion of /etc/securetty to /etc/securetty.security-misc-orig by security-misc' +## +## 'Provides: security-misc' is useful. +## sudo dpkg -i /home/user/derivative-binary/genmkfile-packages-result/security-misc-shared_47.7-1_all.deb +## > dpkg: considering removing security-misc in favour of security-misc-shared ... +## > dpkg: no, cannot proceed with removal of security-misc (--auto-deconfigure will help): +## > systemcheck depends on security-misc +## > security-misc is to be removed +Package: security-misc-shared Architecture: all -Depends: python, libglib2.0-bin, libpam-runtime, sudo, adduser, libcap2-bin, - apparmor-profile-anondist, helper-scripts, ${misc:Depends} -Replaces: tcp-timestamps-disable -Description: enhances misc security settings - Inspired by Kernel Self Protection Project (KSPP) - . - * Implements most if not all recommended Linux kernel settings (sysctl) and - kernel parameters by KSPP. - . - * https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project - . - kernel hardening: - . - * deactivates Netfilter's connection tracking helper - Netfilter's connection tracking helper module increases kernel attack - surface by enabling superfluous functionality such as IRC parsing in - the kernel. (!) Hence, this package disables this feature by shipping the - /etc/modprobe.d/30_nf_conntrack_helper_disable.conf configuration file. - . - * Kernel symbols in various files in /proc are hidden as they can be - very useful for kernel exploits. - . - * Kexec is disabled as it can be used to load a malicious kernel. - /etc/sysctl.d/30_security-misc.conf - . - * ASLR effectiveness for mmap is increased. - . - * The TCP/IP stack is hardened by disabling ICMP redirect acceptance, - ICMP redirect sending and source routing to prevent man-in-the-middle attacks, - ignoring all ICMP requests, enabling TCP syncookies to prevent SYN flood - attacks, enabling RFC1337 to protect against time-wait assassination - attacks and enabling reverse path filtering to prevent IP spoofing and - mitigate vulnerabilities such as CVE-2019-14899. - . - * Some data spoofing attacks are made harder. - . - * SACK can be disabled as it is commonly exploited and is rarely used by - uncommenting settings in file /etc/sysctl.d/30_security-misc.conf. - . - * Slab merging is disabled as sometimes a slab can be used in a vulnerable - way which an attacker can exploit. - . - * Sanity checks and redzoning are enabled. - . - * Memory zeroing at allocation and free time is enabled. - . - * Machine checks (MCE) are disabled which makes the kernel panic - on uncorrectable errors in ECC memory that could be exploited. - . - * Kernel Page Table Isolation is enabled to mitigate Meltdown and increase - KASLR effectiveness. - . - * SMT is disabled as it can be used to exploit the MDS and other - vulnerabilities. - . - * All mitigations for the MDS vulnerability are enabled. - . - * Enables mitigations for the L1TF (L1 Terminal Fault) vulnerability. - . - * A systemd service clears System.map on boot as these contain kernel symbols - that could be useful to an attacker. - /etc/kernel/postinst.d/30_remove-system-map - /lib/systemd/system/remove-system-map.service - /usr/lib/security-misc/remove-system.map - . - * Coredumps are disabled as they may contain important information such as - encryption keys or passwords. - /etc/security/limits.d/30_security-misc.conf - /etc/sysctl.d/30_security-misc.conf - /lib/systemd/coredump.conf.d/30_security-misc.conf - . - * The thunderbolt and firewire kernel modules are blacklisted as they can be - used for DMA (Direct Memory Access) attacks. - . - * IOMMU is enabled with a boot parameter to prevent DMA attacks. - . - * Bluetooth is blacklisted to reduce attack surface. Bluetooth also has - a history of security concerns. - https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns - . - * A systemd service restricts /proc/cpuinfo, /proc/bus, /proc/scsi and - /sys to the root user only. This hides a lot of hardware identifiers from - unprivileged users and increases security as /sys exposes a lot of information - that shouldn't be accessible to unprivileged users. As this will break many - things, it is disabled by default and can optionally be enabled by running - `systemctl enable hide-hardware-info.service` as root. - /usr/lib/security-misc/hide-hardware-info - /lib/systemd/system/hide-hardware-info.service - /lib/systemd/system/user@.service.d/sysfs.conf - /etc/hide-hardware-info.d/30_default.conf - . - * The MSR kernel module is blacklisted to prevent CPU MSRs from being - abused to write to arbitrary memory. - . - * Vsyscalls are disabled as they are obsolete, are at fixed addresses and are - a target for ROP. - . - * Page allocator freelist randomization is enabled. - . - * The vivid kernel module is blacklisted as it's only required for testing - and has been the cause of multiple vulnerabilities. - . - * An initramfs hook sets the sysctl values in /etc/sysctl.conf and - /etc/sysctl.d before init is executed so sysctl hardening is enabled - as early as possible. - . - * The kernel panics on oopses to prevent it from continuing to run a flawed - process and to deter brute forcing. - . - Improve Entropy Collection - . - * Load jitterentropy_rng kernel module. - /usr/lib/modules-load.d/30_security-misc.conf - . - * Distrusts the CPU for initial entropy at boot as it is not possible to - audit, may contain weaknesses or a backdoor. - * https://en.wikipedia.org/wiki/RDRAND#Reception - * https://twitter.com/pid_eins/status/1149649806056280069 - * For more references, see: - * /etc/default/grub.d/40_distrust_cpu.cfg - . - Uncommon network protocols are blacklisted: - These are rarely used and may have unknown vulnerabilities. - /etc/modprobe.d/uncommon-network-protocols.conf - The network protocols that are blacklisted are: - . - * DCCP - Datagram Congestion Control Protocol - * SCTP - Stream Control Transmission Protocol - * RDS - Reliable Datagram Sockets - * TIPC - Transparent Inter-process Communication - * HDLC - High-Level Data Link Control - * AX25 - Amateur X.25 - * NetRom - * X25 - * ROSE - * DECnet - * Econet - * af_802154 - IEEE 802.15.4 - * IPX - Internetwork Packet Exchange - * AppleTalk - * PSNAP - Subnetwork Access Protocol - * p8023 - Novell raw IEEE 802.3 - * p8022 - IEEE 802.2 - . - user restrictions: - . - * remount /home, /tmp, /dev/shm and /run with nosuid,nodev (default) and - noexec (opt-in). To disable this, run "sudo touch /etc/remount-disable". To - opt-in noexec, run "sudo touch /etc/noexec" and reboot (easiest). - Alternatively file /usr/local/etc/remount-disable or file - /usr/local/etc/noexec could be used. - /lib/systemd/system/remount-secure.service - /usr/lib/security-misc/remount-secure - . - * A systemd service mounts /proc with hidepid=2 at boot to prevent users from - seeing each other's processes. - . - * The kernel logs are restricted to root only. - . - * The BPF JIT compiler is restricted to the root user and is hardened. - . - * The ptrace system call is restricted to the root user only. - . - restricts access to the root account: - . - * `su` is restricted to only users within the group `sudo` which prevents - users from using `su` to gain root access or to switch user accounts. - /usr/share/pam-configs/wheel-security-misc - (Which results in a change in file `/etc/pam.d/common-auth`.) - . - * Add user `root` to group `sudo`. This is required to make above work so - login as a user in a virtual console is still possible. - debian/security-misc.postinst - . - * Abort login for users with locked passwords. - /usr/lib/security-misc/pam-abort-on-locked-password - . - * Logging into the root account from a virtual, serial, whatnot console is - prevented by shipping an existing and empty /etc/securetty. - (Deletion of /etc/securetty has a different effect.) - /etc/securetty.security-misc - . - * Console Lockdown. - Allow members of group 'console' to use console. - Everyone else except members of group - 'console-unrestricted' are restricted from using console using ancient, - unpopular login methods such as using /bin/login over networks, which might - be exploitable. (CVE-2001-0797) Using pam_access. - Not enabled by default in this package since this package does not know which - users shall be added to group 'console' and would break console. - /usr/share/pam-configs/console-lockdown-security-misc - /etc/security/access-security-misc.conf - . - Protect Linux user accounts against brute force attacks. - Lock user accounts after 50 failed login attempts using pam_tally2. - /usr/share/pam-configs/tally2-security-misc - . - informational output during Linux PAM: - . - * Show failed and remaining password attempts. - * Document unlock procedure if Linux user account got locked. - * Point out, that there is no password feedback for `su`. - * Explain locked (root) account if locked. - * /usr/share/pam-configs/tally2-security-misc - * /usr/lib/security-misc/pam_tally2-info - * /usr/lib/security-misc/pam-abort-on-locked-password - . - access rights restrictions: - . - * Strong Linux User Account Separation. - Removes read, write and execute access for others for all users who have - home folders under folder /home by running for example - "chmod o-rwx /home/user" - during package installation, upgrade or pam mkhomedir. This will be done only - once per - folder in folder /home so users who wish to relax file permissions are free to - do so. This is to protect previously created files in user home folder which - were previously created with lax file permissions prior installation of this - package. - debian/security-misc.postinst - /usr/lib/security-misc/permission-lockdown - /usr/share/pam-configs/mkhomedir-security-misc - . - * SUID / GUID removal and permission hardening. - A systemd service removed SUID / GUID from non-essential binaries as these are - often used in privilege escalation attacks. - It is disabled by default for now during testing and can optionally be enabled - by running `systemctl enable permission-hardening.service` as root. - https://forums.whonix.org/t/disable-suid-binaries/7706 - /usr/lib/security-misc/permission-hardening - /lib/systemd/system/permission-hardening.service - /etc/permission-hardening.d/30_default.conf - . - access rights relaxations: - . - Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with - hidepid. - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 - https://forums.whonix.org/t/cannot-use-pkexec/8129 - /usr/bin/pkexec.security-misc - . - This package does (not yet) automatically lock the root account password. - It is not clear that would be sane in such a package. - It is recommended to lock and expire the root account. - In new Whonix builds, root account will be locked by package - anon-base-files. - https://www.whonix.org/wiki/Root - https://www.whonix.org/wiki/Dev/Permissions - https://forums.whonix.org/t/restrict-root-access/7658 - However, a locked root password will break rescue and emergency shell. - Therefore this package enables passwordless resuce and emergency shell. - This is the same solution that Debian will likely addapt for Debian - installer. - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 - Adverse security effects can be prevented by setting up BIOS password - protection, grub password protection and/or full disk encryption. - /etc/systemd/system/emergency.service.d/override.conf - /etc/systemd/system/rescue.service.d/override.conf - . - Disables TCP Time Stamps: - . - TCP time stamps (RFC 1323) allow for tracking clock - information with millisecond resolution. This may or may not allow an - attacker to learn information about the system clock at such - a resolution, depending on various issues such as network lag. - This information is available to anyone who monitors the network - somewhere between the attacked system and the destination server. - It may allow an attacker to find out how long a given - system has been running, and to distinguish several - systems running behind NAT and using the same IP address. It might - also allow one to look for clocks that match an expected value to find the - public IP used by a user. - . - Hence, this package disables this feature by shipping the - /etc/sysctl.d/30_security-misc.conf configuration file. - . - Note that TCP time stamps normally have some usefulness. They are - needed for: - . - * the TCP protection against wrapped sequence numbers; however, to - trigger a wrap, one needs to send roughly 2^32 packets in one - minute: as said in RFC 1700, "The current recommended default - time to live (TTL) for the Internet Protocol (IP) [45,105] is 64". - So, this probably won't be a practical problem in the context - of Anonymity Distributions. - * "Round-Trip Time Measurement", which is only useful when the user - manages to saturate their connection. When using Anonymity Distributions, - probably the limiting factor for transmission speed is rarely the capacity - of the user connection. - . - Application specific hardening: - . - * Enables APT seccomp-BPF sandboxing. /etc/apt/apt.conf.d/40sandbox - * Deactivates previews in Dolphin. - * Deactivates previews in Nautilus. - /usr/share/glib-2.0/schemas/30_security-misc.gschema.override - * Deactivates thumbnails in Thunar. - * Enables punycode (`network.IDN_show_punycode`) by default in Thunderbird - to make phising attacks more difficult. Fixing URL not showing real Domain - Name (Homograph attack). - . - Want more? Look into these: - . - * Linux Kernel Runtime Guard (LKRG). Kills whole Classes of Kernel Exploits. - * tirdad - TCP ISN CPU Information Leak Protection. - * Whonix ™ - Anonymous Operating System - * Kicksecure ™ - A Security-hardened, Non-anonymous Linux Distribution - * SecBrowser ™ - A Security-hardened, Non-anonymous Browser - * And more. - * https://www.whonix.org/wiki/Linux_Kernel_Runtime_Guard_LKRG - * https://github.com/Whonix/tirdad - * https://www.whonix.org - * https://www.whonix.org/wiki/Kicksecure - * https://www.whonix.org/wiki/SecBrowser - * https://github.com/Whonix +Pre-Depends: helper-scripts +Depends: adduser, + apparmor-profile-dist, + build-essential, + dmsetup, + libcap2-bin, + libdbus-1-dev, + libglib2.0-bin, + libpam-modules-bin, + libpam-runtime, + libpam-umask, + libsystemd-dev, + memlockd, + pkgconf, + python3, + secure-delete, + ${misc:Depends} +Replaces: anon-gpg-tweaks, + security-misc, + swappiness-lowest, + tcp-timestamps-disable +Conflicts: security-misc +Provides: security-misc +Description: Enhances Miscellaneous Security Settings + https://github.com/Kicksecure/security-misc/blob/master/README.md + . + https://www.kicksecure.com/wiki/Security-misc + . + Package security-misc-desktop and/or security-misc-server may also be useful. . Discussion: . Happening primarily in Whonix forums. - https://forums.whonix.org/t/kernel-hardening/7296 + https://forums.whonix.org/t/kernel-hardening-security-misc/7296 + +Package: security-misc-desktop +Architecture: all +Depends: security-misc-shared, ${misc:Depends} +Description: Security improvements for desktops + For desktops. + . + (Or servers running a desktop?) + +Package: security-misc-server +Architecture: all +Depends: security-misc-shared, ${misc:Depends} +Description: Security improvements for servers + For servers. + . + (Or desktops running a server?) diff --git a/debian/copyright b/debian/copyright index 513503af..829d9096 100644 --- a/debian/copyright +++ b/debian/copyright @@ -1,73 +1,668 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Files: * -Copyright: 2012 - 2019 ENCRYPTED SUPPORT LP -License: GPL-3+-with-additional-terms-1 - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - . - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - . - You should have received a copy of the GNU General Public License - along with this program. If not, see . - . - On Debian systems, the full text of the GNU General Public - License version 3 can be found in the file - `/usr/share/common-licenses/GPL-3'. - . - ADDITIONAL TERMS APPLICABLE per GNU GPL version 3 section 7 - . - 1. Replacement of Section 15. Section 15 of the GPL shall be deleted in its - entirety and replaced with the following: - . - 15. Disclaimer of Warranty. - . - THE PROGRAM IS PROVIDED WITHOUT ANY WARRANTIES, WHETHER EXPRESSED OR IMPLIED, - INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR - PURPOSE, NON-INFRINGEMENT, TITLE AND MERCHANTABILITY. THE PROGRAM IS BEING - DELIVERED OR MADE AVAILABLE 'AS IS', 'WITH ALL FAULTS' AND WITHOUT WARRANTY OR - REPRESENTATION. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE - PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC +License: AGPL-3+ + +License: AGPL-3+ + GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 + . + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + . + Preamble + . + The GNU Affero General Public License is a free, copyleft license for + software and other kinds of works, specifically designed to ensure + cooperation with the community in the case of network server software. + . + The licenses for most software and other practical works are designed + to take away your freedom to share and change the works. By contrast, + our General Public Licenses are intended to guarantee your freedom to + share and change all versions of a program--to make sure it remains free + software for all its users. + . + When we speak of free software, we are referring to freedom, not + price. Our General Public Licenses are designed to make sure that you + have the freedom to distribute copies of free software (and charge for + them if you wish), that you receive source code or can get it if you + want it, that you can change the software or use pieces of it in new + free programs, and that you know you can do these things. + . + Developers that use our General Public Licenses protect your rights + with two steps: (1) assert copyright on the software, and (2) offer + you this License which gives you legal permission to copy, distribute + and/or modify the software. + . + A secondary benefit of defending all users' freedom is that + improvements made in alternate versions of the program, if they + receive widespread use, become available for other developers to + incorporate. Many developers of free software are heartened and + encouraged by the resulting cooperation. However, in the case of + software used on network servers, this result may fail to come about. + The GNU General Public License permits making a modified version and + letting the public access it on a server without ever releasing its + source code to the public. + . + The GNU Affero General Public License is designed specifically to + ensure that, in such cases, the modified source code becomes available + to the community. It requires the operator of a network server to + provide the source code of the modified version running there to the + users of that server. Therefore, public use of a modified version, on + a publicly accessible server, gives the public access to the source + code of the modified version. + . + An older license, called the Affero General Public License and + published by Affero, was designed to accomplish similar goals. This is + a different license, not a version of the Affero GPL, but Affero has + released a new version of the Affero GPL which permits relicensing under + this license. + . + The precise terms and conditions for copying, distribution and + modification follow. + . + TERMS AND CONDITIONS + . + 0. Definitions. + . + "This License" refers to version 3 of the GNU Affero General Public License. + . + "Copyright" also means copyright-like laws that apply to other kinds of + works, such as semiconductor masks. + . + "The Program" refers to any copyrightable work licensed under this + License. Each licensee is addressed as "you". "Licensees" and + "recipients" may be individuals or organizations. + . + To "modify" a work means to copy from or adapt all or part of the work + in a fashion requiring copyright permission, other than the making of an + exact copy. The resulting work is called a "modified version" of the + earlier work or a work "based on" the earlier work. + . + A "covered work" means either the unmodified Program or a work based + on the Program. + . + To "propagate" a work means to do anything with it that, without + permission, would make you directly or secondarily liable for + infringement under applicable copyright law, except executing it on a + computer or modifying a private copy. Propagation includes copying, + distribution (with or without modification), making available to the + public, and in some countries other activities as well. + . + To "convey" a work means any kind of propagation that enables other + parties to make or receive copies. Mere interaction with a user through + a computer network, with no transfer of a copy, is not conveying. + . + An interactive user interface displays "Appropriate Legal Notices" + to the extent that it includes a convenient and prominently visible + feature that (1) displays an appropriate copyright notice, and (2) + tells the user that there is no warranty for the work (except to the + extent that warranties are provided), that licensees may convey the + work under this License, and how to view a copy of this License. If + the interface presents a list of user commands or options, such as a + menu, a prominent item in the list meets this criterion. + . + 1. Source Code. + . + The "source code" for a work means the preferred form of the work + for making modifications to it. "Object code" means any non-source + form of a work. + . + A "Standard Interface" means an interface that either is an official + standard defined by a recognized standards body, or, in the case of + interfaces specified for a particular programming language, one that + is widely used among developers working in that language. + . + The "System Libraries" of an executable work include anything, other + than the work as a whole, that (a) is included in the normal form of + packaging a Major Component, but which is not part of that Major + Component, and (b) serves only to enable use of the work with that + Major Component, or to implement a Standard Interface for which an + implementation is available to the public in source code form. A + "Major Component", in this context, means a major essential component + (kernel, window system, and so on) of the specific operating system + (if any) on which the executable work runs, or a compiler used to + produce the work, or an object code interpreter used to run it. + . + The "Corresponding Source" for a work in object code form means all + the source code needed to generate, install, and (for an executable + work) run the object code and to modify the work, including scripts to + control those activities. However, it does not include the work's + System Libraries, or general-purpose tools or generally available free + programs which are used unmodified in performing those activities but + which are not part of the work. For example, Corresponding Source + includes interface definition files associated with source files for + the work, and the source code for shared libraries and dynamically + linked subprograms that the work is specifically designed to require, + such as by intimate data communication or control flow between those + subprograms and other parts of the work. + . + The Corresponding Source need not include anything that users + can regenerate automatically from other parts of the Corresponding + Source. + . + The Corresponding Source for a work in source code form is that + same work. + . + 2. Basic Permissions. + . + All rights granted under this License are granted for the term of + copyright on the Program, and are irrevocable provided the stated + conditions are met. This License explicitly affirms your unlimited + permission to run the unmodified Program. The output from running a + covered work is covered by this License only if the output, given its + content, constitutes a covered work. This License acknowledges your + rights of fair use or other equivalent, as provided by copyright law. + . + You may make, run and propagate covered works that you do not + convey, without conditions so long as your license otherwise remains + in force. You may convey covered works to others for the sole purpose + of having them make modifications exclusively for you, or provide you + with facilities for running those works, provided that you comply with + the terms of this License in conveying all material for which you do + not control copyright. Those thus making or running the covered works + for you must do so exclusively on your behalf, under your direction + and control, on terms that prohibit them from making any copies of + your copyrighted material outside their relationship with you. + . + Conveying under any other circumstances is permitted solely under + the conditions stated below. Sublicensing is not allowed; section 10 + makes it unnecessary. + . + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + . + No covered work shall be deemed part of an effective technological + measure under any applicable law fulfilling obligations under article + 11 of the WIPO copyright treaty adopted on 20 December 1996, or + similar laws prohibiting or restricting circumvention of such + measures. + . + When you convey a covered work, you waive any legal power to forbid + circumvention of technological measures to the extent such circumvention + is effected by exercising rights under this License with respect to + the covered work, and you disclaim any intention to limit operation or + modification of the work as a means of enforcing, against the work's + users, your or third parties' legal rights to forbid circumvention of + technological measures. + . + 4. Conveying Verbatim Copies. + . + You may convey verbatim copies of the Program's source code as you + receive it, in any medium, provided that you conspicuously and + appropriately publish on each copy an appropriate copyright notice; + keep intact all notices stating that this License and any + non-permissive terms added in accord with section 7 apply to the code; + keep intact all notices of the absence of any warranty; and give all + recipients a copy of this License along with the Program. + . + You may charge any price or no price for each copy that you convey, + and you may offer support or warranty protection for a fee. + . + 5. Conveying Modified Source Versions. + . + You may convey a work based on the Program, or the modifications to + produce it from the Program, in the form of source code under the + terms of section 4, provided that you also meet all of these conditions: + . + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + . + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + . + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + . + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + . + A compilation of a covered work with other separate and independent + works, which are not by their nature extensions of the covered work, + and which are not combined with it such as to form a larger program, + in or on a volume of a storage or distribution medium, is called an + "aggregate" if the compilation and its resulting copyright are not + used to limit the access or legal rights of the compilation's users + beyond what the individual works permit. Inclusion of a covered work + in an aggregate does not cause this License to apply to the other + parts of the aggregate. + . + 6. Conveying Non-Source Forms. + . + You may convey a covered work in object code form under the terms + of sections 4 and 5, provided that you also convey the + machine-readable Corresponding Source under the terms of this License, + in one of these ways: + . + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + . + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + . + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + . + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + . + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + . + A separable portion of the object code, whose source code is excluded + from the Corresponding Source as a System Library, need not be + included in conveying the object code work. + . + A "User Product" is either (1) a "consumer product", which means any + tangible personal property which is normally used for personal, family, + or household purposes, or (2) anything designed or sold for incorporation + into a dwelling. In determining whether a product is a consumer product, + doubtful cases shall be resolved in favor of coverage. For a particular + product received by a particular user, "normally used" refers to a + typical or common use of that class of product, regardless of the status + of the particular user or of the way in which the particular user + actually uses, or expects or is expected to use, the product. A product + is a consumer product regardless of whether the product has substantial + commercial, industrial or non-consumer uses, unless such uses represent + the only significant mode of use of the product. + . + "Installation Information" for a User Product means any methods, + procedures, authorization keys, or other information required to install + and execute modified versions of a covered work in that User Product from + a modified version of its Corresponding Source. The information must + suffice to ensure that the continued functioning of the modified object + code is in no case prevented or interfered with solely because + modification has been made. + . + If you convey an object code work under this section in, or with, or + specifically for use in, a User Product, and the conveying occurs as + part of a transaction in which the right of possession and use of the + User Product is transferred to the recipient in perpetuity or for a + fixed term (regardless of how the transaction is characterized), the + Corresponding Source conveyed under this section must be accompanied + by the Installation Information. But this requirement does not apply + if neither you nor any third party retains the ability to install + modified object code on the User Product (for example, the work has + been installed in ROM). + . + The requirement to provide Installation Information does not include a + requirement to continue to provide support service, warranty, or updates + for a work that has been modified or installed by the recipient, or for + the User Product in which it has been modified or installed. Access to a + network may be denied when the modification itself materially and + adversely affects the operation of the network or violates the rules and + protocols for communication across the network. + . + Corresponding Source conveyed, and Installation Information provided, + in accord with this section must be in a format that is publicly + documented (and with an implementation available to the public in + source code form), and must require no special password or key for + unpacking, reading or copying. + . + 7. Additional Terms. + . + "Additional permissions" are terms that supplement the terms of this + License by making exceptions from one or more of its conditions. + Additional permissions that are applicable to the entire Program shall + be treated as though they were included in this License, to the extent + that they are valid under applicable law. If additional permissions + apply only to part of the Program, that part may be used separately + under those permissions, but the entire Program remains governed by + this License without regard to the additional permissions. + . + When you convey a copy of a covered work, you may at your option + remove any additional permissions from that copy, or from any part of + it. (Additional permissions may be written to require their own + removal in certain cases when you modify the work.) You may place + additional permissions on material, added by you to a covered work, + for which you have or can give appropriate copyright permission. + . + Notwithstanding any other provision of this License, for material you + add to a covered work, you may (if authorized by the copyright holders of + that material) supplement the terms of this License with terms: + . + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + . + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + . + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + . + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + . + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + . + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + . + All other non-permissive additional terms are considered "further + restrictions" within the meaning of section 10. If the Program as you + received it, or any part of it, contains a notice stating that it is + governed by this License along with a term that is a further + restriction, you may remove that term. If a license document contains + a further restriction but permits relicensing or conveying under this + License, you may add to a covered work material governed by the terms + of that license document, provided that the further restriction does + not survive such relicensing or conveying. + . + If you add terms to a covered work in accord with this section, you + must place, in the relevant source files, a statement of the + additional terms that apply to those files, or a notice indicating + where to find the applicable terms. + . + Additional terms, permissive or non-permissive, may be stated in the + form of a separately written license, or stated as exceptions; + the above requirements apply either way. + . + 8. Termination. + . + You may not propagate or modify a covered work except as expressly + provided under this License. Any attempt otherwise to propagate or + modify it is void, and will automatically terminate your rights under + this License (including any patent licenses granted under the third + paragraph of section 11). + . + However, if you cease all violation of this License, then your + license from a particular copyright holder is reinstated (a) + provisionally, unless and until the copyright holder explicitly and + finally terminates your license, and (b) permanently, if the copyright + holder fails to notify you of the violation by some reasonable means + prior to 60 days after the cessation. + . + Moreover, your license from a particular copyright holder is + reinstated permanently if the copyright holder notifies you of the + violation by some reasonable means, this is the first time you have + received notice of violation of this License (for any work) from that + copyright holder, and you cure the violation prior to 30 days after + your receipt of the notice. + . + Termination of your rights under this section does not terminate the + licenses of parties who have received copies or rights from you under + this License. If your rights have been terminated and not permanently + reinstated, you do not qualify to receive new licenses for the same + material under section 10. + . + 9. Acceptance Not Required for Having Copies. + . + You are not required to accept this License in order to receive or + run a copy of the Program. Ancillary propagation of a covered work + occurring solely as a consequence of using peer-to-peer transmission + to receive a copy likewise does not require acceptance. However, + nothing other than this License grants you permission to propagate or + modify any covered work. These actions infringe copyright if you do + not accept this License. Therefore, by modifying or propagating a + covered work, you indicate your acceptance of this License to do so. + . + 10. Automatic Licensing of Downstream Recipients. + . + Each time you convey a covered work, the recipient automatically + receives a license from the original licensors, to run, modify and + propagate that work, subject to this License. You are not responsible + for enforcing compliance by third parties with this License. + . + An "entity transaction" is a transaction transferring control of an + organization, or substantially all assets of one, or subdividing an + organization, or merging organizations. If propagation of a covered + work results from an entity transaction, each party to that + transaction who receives a copy of the work also receives whatever + licenses to the work the party's predecessor in interest had or could + give under the previous paragraph, plus a right to possession of the + Corresponding Source of the work from the predecessor in interest, if + the predecessor has it or can get it with reasonable efforts. + . + You may not impose any further restrictions on the exercise of the + rights granted or affirmed under this License. For example, you may + not impose a license fee, royalty, or other charge for exercise of + rights granted under this License, and you may not initiate litigation + (including a cross-claim or counterclaim in a lawsuit) alleging that + any patent claim is infringed by making, using, selling, offering for + sale, or importing the Program or any portion of it. + . + 11. Patents. + . + A "contributor" is a copyright holder who authorizes use under this + License of the Program or a work on which the Program is based. The + work thus licensed is called the contributor's "contributor version". + . + A contributor's "essential patent claims" are all patent claims + owned or controlled by the contributor, whether already acquired or + hereafter acquired, that would be infringed by some manner, permitted + by this License, of making, using, or selling its contributor version, + but do not include claims that would be infringed only as a + consequence of further modification of the contributor version. For + purposes of this definition, "control" includes the right to grant + patent sublicenses in a manner consistent with the requirements of + this License. + . + Each contributor grants you a non-exclusive, worldwide, royalty-free + patent license under the contributor's essential patent claims, to + make, use, sell, offer for sale, import and otherwise run, modify and + propagate the contents of its contributor version. + . + In the following three paragraphs, a "patent license" is any express + agreement or commitment, however denominated, not to enforce a patent + (such as an express permission to practice a patent or covenant not to + sue for patent infringement). To "grant" such a patent license to a + party means to make such an agreement or commitment not to enforce a + patent against the party. + . + If you convey a covered work, knowingly relying on a patent license, + and the Corresponding Source of the work is not available for anyone + to copy, free of charge and under the terms of this License, through a + publicly available network server or other readily accessible means, + then you must either (1) cause the Corresponding Source to be so + available, or (2) arrange to deprive yourself of the benefit of the + patent license for this particular work, or (3) arrange, in a manner + consistent with the requirements of this License, to extend the patent + license to downstream recipients. "Knowingly relying" means you have + actual knowledge that, but for the patent license, your conveying the + covered work in a country, or your recipient's use of the covered work + in a country, would infringe one or more identifiable patents in that + country that you have reason to believe are valid. + . + If, pursuant to or in connection with a single transaction or + arrangement, you convey, or propagate by procuring conveyance of, a + covered work, and grant a patent license to some of the parties + receiving the covered work authorizing them to use, propagate, modify + or convey a specific copy of the covered work, then the patent license + you grant is automatically extended to all recipients of the covered + work and works based on it. + . + A patent license is "discriminatory" if it does not include within + the scope of its coverage, prohibits the exercise of, or is + conditioned on the non-exercise of one or more of the rights that are + specifically granted under this License. You may not convey a covered + work if you are a party to an arrangement with a third party that is + in the business of distributing software, under which you make payment + to the third party based on the extent of your activity of conveying + the work, and under which the third party grants, to any of the + parties who would receive the covered work from you, a discriminatory + patent license (a) in connection with copies of the covered work + conveyed by you (or copies made from those copies), or (b) primarily + for and in connection with specific products or compilations that + contain the covered work, unless you entered into that arrangement, + or that patent license was granted, prior to 28 March 2007. + . + Nothing in this License shall be construed as excluding or limiting + any implied license or other defenses to infringement that may + otherwise be available to you under applicable patent law. + . + 12. No Surrender of Others' Freedom. + . + If conditions are imposed on you (whether by court order, agreement or + otherwise) that contradict the conditions of this License, they do not + excuse you from the conditions of this License. If you cannot convey a + covered work so as to satisfy simultaneously your obligations under this + License and any other pertinent obligations, then as a consequence you may + not convey it at all. For example, if you agree to terms that obligate you + to collect a royalty for further conveying from those to whom you convey + the Program, the only way you could satisfy both those terms and this + License would be to refrain entirely from conveying the Program. + . + 13. Remote Network Interaction; Use with the GNU General Public License. + . + Notwithstanding any other provision of this License, if you modify the + Program, your modified version must prominently offer all users + interacting with it remotely through a computer network (if your version + supports such interaction) an opportunity to receive the Corresponding + Source of your version by providing access to the Corresponding Source + from a network server at no charge, through some standard or customary + means of facilitating copying of software. This Corresponding Source + shall include the Corresponding Source for any work covered by version 3 + of the GNU General Public License that is incorporated pursuant to the + following paragraph. + . + Notwithstanding any other provision of this License, you have + permission to link or combine any covered work with a work licensed + under version 3 of the GNU General Public License into a single + combined work, and to convey the resulting work. The terms of this + License will continue to apply to the part which is the covered work, + but the work with which it is combined will remain governed by version + 3 of the GNU General Public License. + . + 14. Revised Versions of this License. + . + The Free Software Foundation may publish revised and/or new versions of + the GNU Affero General Public License from time to time. Such new versions + will be similar in spirit to the present version, but may differ in detail to + address new problems or concerns. + . + Each version is given a distinguishing version number. If the + Program specifies that a certain numbered version of the GNU Affero General + Public License "or any later version" applies to it, you have the + option of following the terms and conditions either of that numbered + version or of any later version published by the Free Software + Foundation. If the Program does not specify a version number of the + GNU Affero General Public License, you may choose any version ever published + by the Free Software Foundation. + . + If the Program specifies that a proxy can decide which future + versions of the GNU Affero General Public License can be used, that proxy's + public statement of acceptance of a version permanently authorizes you + to choose that version for the Program. + . + Later license versions may give you additional or different + permissions. However, no additional obligations are imposed on any + author or copyright holder as a result of your choosing to follow a + later version. + . + 15. Disclaimer of Warranty. + . + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY + APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT + HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY + OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, + THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM + IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. . - 2. Replacement of Section 16. Section 16 of the GPL shall be deleted in its - entirety and replaced with the following: - . - 16. LIMITATION OF LIABILITY. - . - UNDER NO CIRCUMSTANCES SHALL ANY COPYRIGHT HOLDER OR ITS AFFILIATES, OR ANY - OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE - LIABLE TO YOU, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, FOR ANY - DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, DIRECT, INDIRECT, SPECIAL, - INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES ARISING FROM, OUT OF OR IN - CONNECTION WITH THE USE OR INABILITY TO USE THE PROGRAM OR OTHER DEALINGS WITH - THE PROGRAM(INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED - INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE - PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), WHETHER OR NOT ANY COPYRIGHT HOLDER - OR SUCH OTHER PARTY RECEIVES NOTICE OF ANY SUCH DAMAGES AND WHETHER OR NOT SUCH - DAMAGES COULD HAVE BEEN FORESEEN. - . - 3. LEGAL NOTICES; NO TRADEMARK LICENSE; ORIGIN. You must reproduce faithfully - all trademark, copyright and other proprietary and legal notices on any copies - of the Program or any other required author attributions. This license does not - grant you rights to use any copyright holder or any other party's name, logo, or - trademarks. Neither the name of the copyright holder or its affiliates, or any - other party who modifies and/or conveys the Program may be used to endorse or - promote products derived from this software without specific prior written - permission. The origin of the Program must not be misrepresented; you must not - claim that you wrote the original Program. Altered source versions must be - plainly marked as such, and must not be misrepresented as being the original - Program. - . - 4. INDEMNIFICATION. IF YOU CONVEY A COVERED WORK AND AGREE WITH ANY RECIPIENT - OF THAT COVERED WORK THAT YOU WILL ASSUME ANY LIABILITY FOR THAT COVERED WORK, - YOU HEREBY AGREE TO INDEMNIFY, DEFEND AND HOLD HARMLESS THE OTHER LICENSORS AND - AUTHORS OF THAT COVERED WORK FOR ANY DAMAGES, DEMANDS, CLAIMS, LOSSES, CAUSES OF - ACTION, LAWSUITS, JUDGMENTS EXPENSES (INCLUDING WITHOUT LIMITATION REASONABLE - ATTORNEYS' FEES AND EXPENSES) OR ANY OTHER LIABILITY ARISING FROM, RELATED TO OR - IN CONNECTION WITH YOUR ASSUMPTIONS OF LIABILITY. + 16. Limitation of Liability. + . + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING + WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS + THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY + GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE + USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF + DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD + PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), + EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF + SUCH DAMAGES. + . + 17. Interpretation of Sections 15 and 16. + . + If the disclaimer of warranty and limitation of liability provided + above cannot be given local legal effect according to their terms, + reviewing courts shall apply local law that most closely approximates + an absolute waiver of all civil liability in connection with the + Program, unless a warranty or assumption of liability accompanies a + copy of the Program in return for a fee. + . + END OF TERMS AND CONDITIONS + . + How to Apply These Terms to Your New Programs + . + If you develop a new program, and you want it to be of the greatest + possible use to the public, the best way to achieve this is to make it + free software which everyone can redistribute and change under these terms. + . + To do so, attach the following notices to the program. It is safest + to attach them to the start of each source file to most effectively + state the exclusion of warranty; and each file should have at least + the "copyright" line and a pointer to where the full notice is found. + . + + Copyright (C) + . + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + . + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + . + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + . + Also add information on how to contact you by electronic and paper mail. + . + If your software can interact with users remotely through a computer + network, you should also make sure that it provides a way for users to + get its source. For example, if your program is a web application, its + interface could display a "Source" link that leads users to an archive + of the code. There are many ways you could offer source, and different + solutions will be better for different programs; see section 13 for the + specific requirements. + . + You should also get your employer (if you work as a programmer) or school, + if any, to sign a "copyright disclaimer" for the program, if necessary. + For more information on this, and how to apply and follow the GNU AGPL, see + . diff --git a/debian/make-helper-overrides.bsh b/debian/make-helper-overrides.bsh new file mode 100755 index 00000000..4804b3e2 --- /dev/null +++ b/debian/make-helper-overrides.bsh @@ -0,0 +1,7 @@ +#!/bin/bash + +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/24 +genmkfile_lintian_post_opts+=" --suppress-tags obsolete-command-in-modprobe.d-file --suppress-tags no-complete-debconf-translation" diff --git a/debian/po/POTFILES.in b/debian/po/POTFILES.in new file mode 100644 index 00000000..2d13c3f1 --- /dev/null +++ b/debian/po/POTFILES.in @@ -0,0 +1 @@ +[type: gettext/rfc822deb] security-misc-shared.templates diff --git a/debian/po/templates.pot b/debian/po/templates.pot new file mode 100644 index 00000000..6d99cfe5 --- /dev/null +++ b/debian/po/templates.pot @@ -0,0 +1,36 @@ +# SOME DESCRIPTIVE TITLE. +# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER +# This file is distributed under the same license as the security-misc-shared package. +# FIRST AUTHOR , YEAR. +# +#, fuzzy +msgid "" +msgstr "" +"Project-Id-Version: security-misc-shared\n" +"Report-Msgid-Bugs-To: security-misc-shared@packages.debian.org\n" +"POT-Creation-Date: 2025-01-14 09:31-0500\n" +"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" +"Last-Translator: FULL NAME \n" +"Language-Team: LANGUAGE \n" +"Language: \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=CHARSET\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Type: note +#. Description +#: ../security-misc-shared.templates:1001 +msgid "Manual intervention may be required for permission-hardener update" +msgstr "" + +#. Type: note +#. Description +#: ../security-misc-shared.templates:1001 +msgid "" +"No need to panic. Nothing is broken. A rare condition has been encountered. " +"permission-hardener is being updated to fix a minor bug that caused " +"corruption in the permission-hardener state file. If you installed your own " +"custom permission-hardener configuration, some manual intervention may be " +"required. See: https://www.kicksecure.com/wiki/" +"SUID_Disabler_and_Permission_Hardener#fixing_state_files" +msgstr "" diff --git a/debian/rules b/debian/rules index 963b738b..ca5e85c2 100755 --- a/debian/rules +++ b/debian/rules @@ -1,6 +1,6 @@ #!/usr/bin/make -f -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. #export DH_VERBOSE=1 @@ -10,8 +10,3 @@ override_dh_installchangelogs: dh_installchangelogs changelog.upstream upstream - -override_dh_install: - dh_apparmor --profile-name='usr.lib.security-misc.pam_tally2-info' - dh_apparmor --profile-name='usr.lib.security-misc.permission-lockdown' - dh_install diff --git a/debian/security-misc-desktop.install b/debian/security-misc-desktop.install new file mode 100755 index 00000000..609f3f7c --- /dev/null +++ b/debian/security-misc-desktop.install @@ -0,0 +1,12 @@ +#!/usr/bin/dh-exec + +## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file was generated using 'genmkfile debinstfile'. + +etc/bluetooth/30_security-misc.conf#security-misc-desktop => /etc/bluetooth/30_security-misc.conf +etc/sudoers.d/security-misc-desktop#security-misc-desktop => /etc/sudoers.d/security-misc-desktop +usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop => /usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf +usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop => /usr/lib/NetworkManager/conf.d/80_randomize-mac.conf +usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop => /usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf diff --git a/debian/security-misc-server.install b/debian/security-misc-server.install new file mode 100755 index 00000000..5e86b45a --- /dev/null +++ b/debian/security-misc-server.install @@ -0,0 +1,8 @@ +#!/usr/bin/dh-exec + +## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file was generated using 'genmkfile debinstfile'. + +usr/libexec/security-misc/placeholder#security-misc-server => /usr/libexec/security-misc/placeholder diff --git a/debian/security-misc-shared.config b/debian/security-misc-shared.config new file mode 100755 index 00000000..71d76190 --- /dev/null +++ b/debian/security-misc-shared.config @@ -0,0 +1,190 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + source /usr/libexec/helper-scripts/pre.bsh +fi + +source /usr/share/debconf/confmodule + +set -e + +## Not set by DPKG for '.config' script. +DPKG_MAINTSCRIPT_PACKAGE="security-misc-shared" +DPKG_MAINTSCRIPT_NAME="config" + +true " +##################################################################### +## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $* +##################################################################### +" + +## NOTE: Code duplication. +## Copied from: helper-scripts /usr/libexec/helper-scripts/package_installed_check.sh +## +## '.config' scripts are run very early. Even 'Pre-Depends: helper-scripts' would be insufficient. +## Therefore the code is duplicated here. +pkg_installed() { + local package_name dpkg_query_output + local requested_action status error_state + + package_name="$1" + ## Cannot use '&>' because it is a bashism. + dpkg_query_output="$(dpkg-query --show --showformat='${Status}' "$package_name" 2>/dev/null)" || true + ## dpkg_query_output Examples: + ## install ok half-configured + ## install ok installed + + requested_action=$(printf '%s' "$dpkg_query_output" | awk '{print $1}') + status=$(printf '%s' "$dpkg_query_output" | awk '{print $2}') + error_state=$(printf '%s' "$dpkg_query_output" | awk '{print $3}') + + if [ "$requested_action" = 'install' ]; then + true "$0: INFO: $package_name is installed, ok." + return 0 + fi + + true "$0: INFO: $package_name is not installed, ok." + return 1 +} + +check_migrate_permission_hardener_state() { + local pkg_list modified_pkg_data_str custom_hardening_arr config_file + + ## If folder /var/lib/permission-hardener (version 1) does not exist, this migration is unneeded. + if [ ! -d '/var/lib/permission-hardener' ]; then + return 0 + fi + + local orig_hardening_arr custom_hardening_arr config_file custom_config_file + if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" ]; then + return 0 + fi + mkdir --parents '/var/lib/security-misc/do_once' + + orig_hardening_arr=( + '/usr/lib/permission-hardener.d/25_default_passwd.conf' + '/usr/lib/permission-hardener.d/25_default_sudo.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_selinux.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf' + '/usr/lib/permission-hardener.d/20_user-sysmaint-split.conf' + '/usr/lib/permission-hardener.d/30_ping.conf' + '/usr/lib/permission-hardener.d/30_default.conf' + '/etc/permission-hardener.d/25_default_passwd.conf' + '/etc/permission-hardener.d/25_default_sudo.conf' + '/etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf' + '/etc/permission-hardener.d/25_default_whitelist_chromium.conf' + '/etc/permission-hardener.d/25_default_whitelist_dbus.conf' + '/etc/permission-hardener.d/25_default_whitelist_firejail.conf' + '/etc/permission-hardener.d/25_default_whitelist_fuse.conf' + '/etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf' + '/etc/permission-hardener.d/25_default_whitelist_mount.conf' + '/etc/permission-hardener.d/25_default_whitelist_pam.conf' + '/etc/permission-hardener.d/25_default_whitelist_passwd.conf' + '/etc/permission-hardener.d/25_default_whitelist_policykit.conf' + '/etc/permission-hardener.d/25_default_whitelist_postfix.conf' + '/etc/permission-hardener.d/25_default_whitelist_qubes.conf' + '/etc/permission-hardener.d/25_default_whitelist_selinux.conf' + '/etc/permission-hardener.d/25_default_whitelist_spice.conf' + '/etc/permission-hardener.d/25_default_whitelist_ssh.conf' + '/etc/permission-hardener.d/25_default_whitelist_sudo.conf' + '/etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf' + '/etc/permission-hardener.d/25_default_whitelist_virtualbox.conf' + '/etc/permission-hardener.d/20_user-sysmaint-split.conf' + '/etc/permission-hardener.d/30_ping.conf' + '/etc/permission-hardener.d/30_default.conf' + ) + + pkg_list=( "security-misc-shared" ) + if pkg_installed user-sysmaint-split ; then + pkg_list+=( "user-sysmaint-split" ) + fi + if pkg_installed anon-apps-config ; then + pkg_list+=( "anon-apps-config" ) + fi + + ## This will exit non-zero if some of the packages don't exist, but we + ## don't care. The packages that *are* installed will still be scanned. + modified_pkg_data_str="$(dpkg --verify "${pkg_list[@]}")" || true + + ## Example modified_pkg_data_str: + #modified_pkg_data_str='missing /usr/lib/permission-hardener.d/20_user-sysmaint-split.conf' + + readarray -t custom_hardening_arr < <(awk '/permission-hardener.d/{ print $NF }' <<< "${modified_pkg_data_str}") + + ## If the above `dpkg --verify` command doesn't return any permission-hardener + ## related lines, the array will contain no meaningful info, just a single + ## blank element at the start. Set the array to be explicitly empty in + ## this scenario. + if [ -z "${custom_hardening_arr[0]}" ]; then + custom_hardening_arr=() + fi + + for config_file in \ + /usr/lib/permission-hardener.d/*.conf \ + /etc/permission-hardener.d/*.conf \ + /usr/local/etc/permission-hardener.d/*.conf \ + /etc/permission-hardening.d/*.conf \ + /usr/local/etc/permission-hardening.d/*.conf + do + # shellcheck disable=SC2076 + if ! [[ " ${orig_hardening_arr[*]} " =~ " ${config_file} " ]]; then + if [ -f "${config_file}" ]; then + custom_hardening_arr+=( "${config_file}" ) + fi + fi + done + + if [ "${#custom_hardening_arr[@]}" != '0' ]; then + for custom_config_file in "${custom_hardening_arr[@]}"; do + if ! test -e "${custom_config_file}" ; then + echo "$0: INFO: Possible missing configuration file found: '${custom_config_file}'" + else + echo "$0: INFO: Possible custom configuration file found: '${custom_config_file}'" + fi + done + ## db_input will return code 30 if the message won't be displayed, which + ## causes a non-interactive install to error out if you don't use || true + db_input critical security-misc-shared/alert-on-permission-hardener-v2-upgrade || true + ## db_go can return code 30 too in some instances, we don't care here + # shellcheck disable=SC2119 + db_go || true + fi + + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" +} + +check_migrate_permission_hardener_state + +true "INFO: debhelper beginning here." + +#DEBHELPER# + +true "INFO: Done with debhelper." + +true " +##################################################################### +## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $* +##################################################################### +" + +## Explicitly "exit 0", so eventually trapped errors can be ignored. +exit 0 diff --git a/debian/security-misc-shared.displace b/debian/security-misc-shared.displace new file mode 100644 index 00000000..29bac069 --- /dev/null +++ b/debian/security-misc-shared.displace @@ -0,0 +1,7 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +/etc/securetty.security-misc +/etc/security/faillock.conf.security-misc +/etc/usbguard/usbguard-daemon.conf.security-misc +/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc diff --git a/debian/security-misc.displace-extension b/debian/security-misc-shared.displace-extension similarity index 100% rename from debian/security-misc.displace-extension rename to debian/security-misc-shared.displace-extension diff --git a/debian/security-misc-shared.gconf-defaults b/debian/security-misc-shared.gconf-defaults new file mode 100644 index 00000000..b79536a9 --- /dev/null +++ b/debian/security-misc-shared.gconf-defaults @@ -0,0 +1,6 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +/apps/nautilus/preview_sound never +/apps/nautilus/show_icon_text never +/apps/nautilus/show-image-thumbnails never diff --git a/debian/security-misc-shared.hide b/debian/security-misc-shared.hide new file mode 100644 index 00000000..7beb77ee --- /dev/null +++ b/debian/security-misc-shared.hide @@ -0,0 +1,6 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Allows users in the 'sudo' group to install Flatpak software without +## authorization. Breaks user/sysmaint separation, thus disabled. +/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules diff --git a/debian/security-misc-shared.install b/debian/security-misc-shared.install new file mode 100755 index 00000000..b141aba2 --- /dev/null +++ b/debian/security-misc-shared.install @@ -0,0 +1,153 @@ +#!/usr/bin/dh-exec + +## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file was generated using 'genmkfile debinstfile'. + +etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared => /etc/apparmor.d/tunables/home.d/security-misc +etc/apt/apt.conf.d/40error-on-any#security-misc-shared => /etc/apt/apt.conf.d/40error-on-any +etc/apt/apt.conf.d/40sandbox#security-misc-shared => /etc/apt/apt.conf.d/40sandbox +etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared => /etc/default/grub.d/40_cpu_mitigations.cfg +etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared => /etc/default/grub.d/40_kernel_hardening.cfg +etc/default/grub.d/40_remount_secure.cfg#security-misc-shared => /etc/default/grub.d/40_remount_secure.cfg +etc/default/grub.d/40_signed_modules.cfg#security-misc-shared => /etc/default/grub.d/40_signed_modules.cfg +etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared => /etc/default/grub.d/41_quiet_boot.cfg +etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared => /etc/default/grub.d/41_recovery_restrict.cfg +etc/dracut.conf.d/30-security-misc.conf#security-misc-shared => /etc/dracut.conf.d/30-security-misc.conf +etc/gitconfig#security-misc-shared => /etc/gitconfig +etc/hide-hardware-info.d/30_default.conf#security-misc-shared => /etc/hide-hardware-info.d/30_default.conf +etc/kernel/postinst.d/30_remove-system-map#security-misc-shared => /etc/kernel/postinst.d/30_remove-system-map +etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared => /etc/modprobe.d/30_security-misc_blacklist.conf +etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared => /etc/modprobe.d/30_security-misc_conntrack.conf +etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared => /etc/modprobe.d/30_security-misc_disable.conf +etc/profile.d/30_security-misc.sh#security-misc-shared => /etc/profile.d/30_security-misc.sh +etc/securetty.security-misc#security-misc-shared => /etc/securetty.security-misc +etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared => /etc/security-misc/emerg-shutdown/30_security_misc.conf +etc/security/access-security-misc.conf#security-misc-shared => /etc/security/access-security-misc.conf +etc/security/faillock.conf.security-misc#security-misc-shared => /etc/security/faillock.conf.security-misc +etc/security/limits.d/30_security-misc.conf#security-misc-shared => /etc/security/limits.d/30_security-misc.conf +etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared => /etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml +etc/skel/.gnupg/gpg.conf#security-misc-shared => /etc/skel/.gnupg/gpg.conf +etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared => /etc/ssh/ssh_config.d/30_security-misc.conf +etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared => /etc/ssh/sshd_config.d/30_security-misc.conf +etc/sudoers.d/security-misc#security-misc-shared => /etc/sudoers.d/security-misc +etc/systemd/system/emergency.service.d/override.conf#security-misc-shared => /etc/systemd/system/emergency.service.d/override.conf +etc/systemd/system/rescue.service.d/override.conf#security-misc-shared => /etc/systemd/system/rescue.service.d/override.conf +etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared => /etc/usbguard/IPCAccessControl.d/:qubes +etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared => /etc/usbguard/IPCAccessControl.d/:sudo +etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared => /etc/usbguard/rules.d/30_security-misc.conf +etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared => /etc/usbguard/usbguard-daemon.conf.security-misc +usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared => /usr/bin/disabled-bluetooth-by-security-misc +usr/bin/disabled-cdrom-by-security-misc#security-misc-shared => /usr/bin/disabled-cdrom-by-security-misc +usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared => /usr/bin/disabled-cpumsr-by-security-misc +usr/bin/disabled-filesys-by-security-misc#security-misc-shared => /usr/bin/disabled-filesys-by-security-misc +usr/bin/disabled-firewire-by-security-misc#security-misc-shared => /usr/bin/disabled-firewire-by-security-misc +usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared => /usr/bin/disabled-framebuffer-by-security-misc +usr/bin/disabled-gps-by-security-misc#security-misc-shared => /usr/bin/disabled-gps-by-security-misc +usr/bin/disabled-intelme-by-security-misc#security-misc-shared => /usr/bin/disabled-intelme-by-security-misc +usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared => /usr/bin/disabled-intelpmt-by-security-misc +usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared => /usr/bin/disabled-miscellaneous-by-security-misc +usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared => /usr/bin/disabled-netfilesys-by-security-misc +usr/bin/disabled-network-by-security-misc#security-misc-shared => /usr/bin/disabled-network-by-security-misc +usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared => /usr/bin/disabled-thunderbolt-by-security-misc +usr/bin/fm-shim-frontend#security-misc-shared => /usr/bin/fm-shim-frontend +usr/bin/permission-hardener#security-misc-shared => /usr/bin/permission-hardener +usr/bin/remount-secure#security-misc-shared => /usr/bin/remount-secure +usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared => /usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh +usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared => /usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh +usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared => /usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh +usr/lib/issue.d/20_security-misc.issue#security-misc-shared => /usr/lib/issue.d/20_security-misc.issue +usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared => /usr/lib/modules-load.d/30_security-misc.conf +usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf +usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf +usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf +usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf +usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf +usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf +usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_mount.conf +usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_pam.conf +usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf +usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf +usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf +usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf +usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_spice.conf +usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf +usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf +usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf +usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf +usr/lib/permission-hardener.d/30_default.conf#security-misc-shared => /usr/lib/permission-hardener.d/30_default.conf +usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py#security-misc-shared => /usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py +usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared => /usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py +usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared => /usr/lib/sysctl.d/30_security-misc_kexec-disable.conf +usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared => /usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf +usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared => /usr/lib/sysctl.d/30_silent-kernel-printk.conf +usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared => /usr/lib/sysctl.d/990-security-misc.conf +usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/coredump.conf.d/30_security-misc.conf +usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/journald.conf.d/30_security-misc.conf +usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/pstore.conf.d/30_security-misc.conf +usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared => /usr/lib/systemd/system-preset/50-security-misc.preset +usr/lib/systemd/system/block-shutdown.service#security-misc-shared => /usr/lib/systemd/system/block-shutdown.service +usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared => /usr/lib/systemd/system/emerg-shutdown.service +usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared => /usr/lib/systemd/system/ensure-shutdown-trigger.service +usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared => /usr/lib/systemd/system/ensure-shutdown.service +usr/lib/systemd/system/harden-module-loading.service#security-misc-shared => /usr/lib/systemd/system/harden-module-loading.service +usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/system/haveged.service.d/30_security-misc.conf +usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared => /usr/lib/systemd/system/hide-hardware-info.service +usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared => /usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service +usr/lib/systemd/system/panic-on-oops.service#security-misc-shared => /usr/lib/systemd/system/panic-on-oops.service +usr/lib/systemd/system/permission-hardener.service#security-misc-shared => /usr/lib/systemd/system/permission-hardener.service +usr/lib/systemd/system/proc-hidepid.service#security-misc-shared => /usr/lib/systemd/system/proc-hidepid.service +usr/lib/systemd/system/remount-secure.service#security-misc-shared => /usr/lib/systemd/system/remount-secure.service +usr/lib/systemd/system/remove-system-map.service#security-misc-shared => /usr/lib/systemd/system/remove-system-map.service +usr/lib/systemd/system/sysinit-post.target#security-misc-shared => /usr/lib/systemd/system/sysinit-post.target +usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf +usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared => /usr/lib/systemd/system/user@.service.d/sysfs.conf +usr/lib/systemd/user/fm-shim.service#security-misc-shared => /usr/lib/systemd/user/fm-shim.service +usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf +usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared => /usr/lib/udev/rules.d/95-emerg-shutdown.rules +usr/libexec/security-misc/askpass#security-misc-shared => /usr/libexec/security-misc/askpass +usr/libexec/security-misc/block-unsafe-logins#security-misc-shared => /usr/libexec/security-misc/block-unsafe-logins +usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared => /usr/libexec/security-misc/build-emerg-shutdown +usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared => /usr/libexec/security-misc/build-fm-shim-backend +usr/libexec/security-misc/check-for-usb-controller#security-misc-shared => /usr/libexec/security-misc/check-for-usb-controller +usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared => /usr/libexec/security-misc/compile-emerg-shutdown +usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared => /usr/libexec/security-misc/compile-fm-shim-backend +usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared => /usr/libexec/security-misc/disable-kernel-module-loading +usr/libexec/security-misc/echo-path#security-misc-shared => /usr/libexec/security-misc/echo-path +usr/libexec/security-misc/emerg-shutdown#security-misc-shared => /usr/libexec/security-misc/emerg-shutdown +usr/libexec/security-misc/ensure-shutdown#security-misc-shared => /usr/libexec/security-misc/ensure-shutdown +usr/libexec/security-misc/hide-hardware-info#security-misc-shared => /usr/libexec/security-misc/hide-hardware-info +usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared => /usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown +usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared => /usr/libexec/security-misc/mmap-rnd-bits +usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared => /usr/libexec/security-misc/pam-abort-on-locked-password +usr/libexec/security-misc/pam-info#security-misc-shared => /usr/libexec/security-misc/pam-info +usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared => /usr/libexec/security-misc/pam_faillock_not_if_x +usr/libexec/security-misc/pam_only_if_login#security-misc-shared => /usr/libexec/security-misc/pam_only_if_login +usr/libexec/security-misc/pam_only_if_su#security-misc-shared => /usr/libexec/security-misc/pam_only_if_su +usr/libexec/security-misc/panic-on-oops#security-misc-shared => /usr/libexec/security-misc/panic-on-oops +usr/libexec/security-misc/permission-lockdown#security-misc-shared => /usr/libexec/security-misc/permission-lockdown +usr/libexec/security-misc/remove-system.map#security-misc-shared => /usr/libexec/security-misc/remove-system.map +usr/libexec/security-misc/virusforget#security-misc-shared => /usr/libexec/security-misc/virusforget +usr/share/doc/security-misc/fstab-vm#security-misc-shared => /usr/share/doc/security-misc/fstab-vm +usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared => /usr/share/glib-2.0/schemas/30_security-misc.gschema.override +usr/share/lintian/overrides/security-misc-shared#security-misc-shared => /usr/share/lintian/overrides/security-misc-shared +usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared => /usr/share/pam-configs/block-unsafe-logins-security-misc +usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared => /usr/share/pam-configs/console-lockdown-security-misc +usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared => /usr/share/pam-configs/faillock-preauth-security-misc +usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared => /usr/share/pam-configs/mkhomedir-security-misc +usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared => /usr/share/pam-configs/pam-abort-on-locked-password-security-misc +usr/share/pam-configs/umask-security-misc#security-misc-shared => /usr/share/pam-configs/umask-security-misc +usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared => /usr/share/pam-configs/unix-faillock-security-misc +usr/share/pam-configs/wheel-security-misc#security-misc-shared => /usr/share/pam-configs/wheel-security-misc +usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared => /usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc +usr/share/security-misc/dolphinrc#security-misc-shared => /usr/share/security-misc/dolphinrc +usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared => /usr/share/security-misc/emerg-shutdown-initramfs.service +usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared => /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf +usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared => /usr/share/security-misc/lkrg/lkrg-virtualbox +usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared => /usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded +usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared => /usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded +usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared => /usr/share/security-misc/security-misc-memlockd.cfg +usr/src/security-misc/emerg-shutdown.c#security-misc-shared => /usr/src/security-misc/emerg-shutdown.c +usr/src/security-misc/fm-shim-backend.c#security-misc-shared => /usr/src/security-misc/fm-shim-backend.c +var/cache/security-misc/state-files/placeholder#security-misc-shared => /var/cache/security-misc/state-files/placeholder diff --git a/debian/security-misc-shared.links b/debian/security-misc-shared.links new file mode 100644 index 00000000..c3369df2 --- /dev/null +++ b/debian/security-misc-shared.links @@ -0,0 +1,5 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +/etc/profile.d/30_security-misc.sh /etc/zprofile.d/30_security-misc.zsh +/etc/profile.d/30_security-misc.sh /etc/X11/Xsession.d/30_security-misc diff --git a/debian/security-misc-shared.maintscript b/debian/security-misc-shared.maintscript new file mode 100644 index 00000000..f1c61145 --- /dev/null +++ b/debian/security-misc-shared.maintscript @@ -0,0 +1,111 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +rm_conffile /etc/sudoers.d/umask-security-misc + +## https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079 +rm_conffile /etc/sysctl.d/sysrq.conf + +## https://github.com/Kicksecure/security-misc/pull/45 +rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info +rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown + +## merged into 3 files /usr/lib/sysctl.d/30_security-misc_kexec-disable.conf, /usr/lib/sysctl.d/30_silent-kernel-printk.conf, and /usr/lib/sysctl.d/990-security-misc.conf +rm_conffile /etc/sysctl.d/fs_protected.conf +rm_conffile /etc/sysctl.d/kptr_restrict.conf +rm_conffile /etc/sysctl.d/suid_dumpable.conf +rm_conffile /etc/sysctl.d/harden_bpf.conf +rm_conffile /etc/sysctl.d/ptrace_scope.conf +rm_conffile /etc/sysctl.d/tcp_timestamps.conf +rm_conffile /etc/sysctl.d/mmap_aslr.conf +rm_conffile /etc/sysctl.d/dmesg_restrict.conf +rm_conffile /etc/sysctl.d/coredumps.conf +rm_conffile /etc/sysctl.d/kexec.conf +rm_conffile /etc/sysctl.d/tcp_hardening.conf +rm_conffile /etc/sysctl.d/tcp_sack.conf + +## merged into 3 files /etc/modprobe.d/30_security-misc_blacklist.conf, 30_security-misc_conntrack.conf, and /etc/modprobe.d/30_security-misc_disable.conf +rm_conffile /etc/modprobe.d/uncommon-network-protocols.conf +rm_conffile /etc/modprobe.d/blacklist-bluetooth.conf +rm_conffile /etc/modprobe.d/vivid.conf +rm_conffile /etc/modprobe.d/blacklist-dma.conf +rm_conffile /etc/modprobe.d/msr.conf +rm_conffile /etc/modprobe.d/30_nf_conntrack_helper_disable.conf +rm_conffile /etc/modprobe.d/30_security-misc.conf + +## renamed to /etc/security/limits.d/30_security-misc.conf +rm_conffile /etc/security/limits.d/disable-coredumps.conf + +## moved to separate package ram-wipe +rm_conffile /etc/default/grub.d/40_cold_boot_attack_defense.cfg + +rm_conffile /etc/X11/Xsession.d/50panic_on_oops +rm_conffile /etc/X11/Xsession.d/50security-misc + +## moved to /usr/lib/sysctl.d +rm_conffile /etc/sysctl.d/30_security-misc.conf +rm_conffile /etc/sysctl.d/30_silent-kernel-printk.conf +rm_conffile /etc/sysctl.d/30_security-misc_kexec-disable.conf + +## moved to /etc/permission-hardener.d +rm_conffile /etc/permission-hardening.d/25_default_passwd.conf +rm_conffile /etc/permission-hardening.d/25_default_sudo.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_bubblewrap.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_chromium.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_dbus.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_firejail.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_fuse.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_hardened_malloc.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_mount.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_pam.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_policykit.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_qubes.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_selinux.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_spice.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_ssh.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_sudo.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_unix_chkpwd.conf +rm_conffile /etc/permission-hardening.d/25_default_whitelist_virtualbox.conf +rm_conffile /etc/permission-hardening.d/30_default.conf + +## moved to /usr/lib/permission-hardener.d +rm_conffile /etc/permission-hardener.d/25_default_passwd.conf +rm_conffile /etc/permission-hardener.d/25_default_sudo.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_chromium.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_dbus.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_firejail.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_fuse.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_mount.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_pam.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_policykit.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_postfix.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_qubes.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_selinux.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_spice.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_ssh.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_sudo.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_virtualbox.conf +rm_conffile /etc/permission-hardener.d/30_default.conf + +## merged into 1 file /etc/default/grub.d/40_kernel_hardening.cfg +rm_conffile /etc/default/grub.d/40_distrust_bootloader.cfg +rm_conffile /etc/default/grub.d/40_distrust_cpu.cfg +rm_conffile /etc/default/grub.d/40_enable_iommu.cfg + +## renamed to /etc/default/grub.d/40_remount_secure.cfg +rm_conffile /etc/default/grub.d/40_remmount-secure.cfg + +## renamed to /etc/default/grub.d/40_signed_modules.cfg +rm_conffile /etc/default/grub.d/40_only_allow_signed_modules.cfg + +## renamed to /etc/default/grub.d/41_quiet_boot.cfg +rm_conffile /etc/default/grub.d/41_quiet.cfg + +## moved to usability-misc +rm_conffile /etc/dkms/framework.conf.d/30_security-misc.conf + +## renamed to reflect the fact that this uses a whitelist +rm_conffile /usr/lib/permission-hardener.d/25_default_passwd.conf diff --git a/debian/security-misc-shared.postinst b/debian/security-misc-shared.postinst new file mode 100755 index 00000000..0b1567c7 --- /dev/null +++ b/debian/security-misc-shared.postinst @@ -0,0 +1,231 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## style-ok: no-has - has.bsh isn't reliably available in maintainer scripts +## style-ok: no-strict - full strict block could leak into APT/debconf + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + source /usr/libexec/helper-scripts/pre.bsh +fi + +## Required since this package uses debconf - this is mandatory even though +## the postinst itself does not use debconf commands. +source /usr/share/debconf/confmodule + +set -o errexit + +true " +##################################################################### +## INFO: BEGIN: ${DPKG_MAINTSCRIPT_PACKAGE} ${DPKG_MAINTSCRIPT_NAME} $* +##################################################################### +" + +permission_hardening_legacy_config_folder() { + if ! test -d /etc/permission-hardening.d ; then + return 0 + fi + rmdir --verbose --ignore-fail-on-non-empty /etc/permission-hardening.d || true +} + +permission_hardening() { + printf '%s\n' "Running SUID Disabler and Permission Hardener... See also:" + printf '%s\n' "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener" + printf '%s\n' "$0: INFO: running: permission-hardener enable" + ## By design: report error but return 0 to avoid breaking APT. + ## A failing postinst would leave the package in a broken state. + if ! permission-hardener enable ; then + printf '%s\n' "$0: ERROR: Permission hardening failed." >&2 + return 0 + fi + printf '%s\n' "$0: INFO: Permission hardening success." +} + +fix_pkexec_remembered_permissions() { + if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" ]; then + return 0 + fi + mkdir --parents '/var/lib/security-misc/do_once' + + if ! [ -f "/var/lib/permission-hardener-v2/existing_mode/statoverride" ]; then + ## 'statoverride' file does not exist yet. Therefore no need to fix it using 'str_replace'. + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" + return 0 + fi + + ## The existing_mode database may incorrectly list the original permissions + ## of pkexec as '755'. They should be '4755'. Fix this with str_replace. If + ## this issue is not present, str_replace will do nothing. + str_replace 'root root 755 /usr/bin/pkexec' \ + 'root root 4755 /usr/bin/pkexec' \ + /var/lib/permission-hardener-v2/existing_mode/statoverride + + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" +} + +install_permission_hardener_base_state() { + local state_str + + if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" ]; then + return 0 + fi + mkdir --parents '/var/lib/security-misc/do_once' + + if [ -f "/var/lib/permission-hardener-v2/existing_mode/statoverride" ]; then + ## 'statoverride' file already exists. Therefore no need to pre-populate it. + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" + return 0 + fi + + mkdir --parents -- '/var/lib/permission-hardener-v2/existing_mode' + state_str="root root 644 /etc/passwd- +root root 755 /etc/cron.monthly +root root 755 /etc/sudoers.d +root shadow 2755 /usr/bin/expiry +root root 4755 /usr/bin/umount +root root 4755 /usr/bin/gpasswd +root root 755 /usr/lib/modules +root root 644 /etc/issue.net +root root 644 /etc/group- +root root 4755 /usr/bin/newgrp +root root 755 /etc/cron.weekly +root root 4755 /usr/lib/polkit-1/polkit-agent-helper-1 +root root 644 /etc/hosts.deny +root root 4755 /usr/bin/newgidmap +root root 644 /etc/issue.kicksecure +root root 4755 /usr/bin/pkexec +root root 4755 /usr/bin/su +root root 644 /etc/hosts.allow +root root 700 /root +root root 755 /etc/cron.daily +root root 644 /etc/motd +root root 4755 /usr/bin/newuidmap +root root 755 /boot +root root 755 /home +root shadow 2755 /usr/bin/chage +root root 4755 /usr/lib/openssh/ssh-keysign +root root 4755 /usr/bin/ntfs-3g +root root 4755 /usr/bin/chsh +root root 644 /etc/motd.kicksecure +root root 755 /usr/bin/su-to-root +root root 4755 /usr/bin/passwd +root root 4755 /usr/bin/chfn +root root 644 /etc/group +root root 4755 /usr/bin/sudo +root root 644 /etc/passwd +root root 755 /usr/src +root root 4755 /usr/bin/mount +root root 644 /etc/issue +root root 755 /etc/cron.d" + + printf '%s\n' "${state_str}" | tee /var/lib/permission-hardener-v2/existing_mode/statoverride + + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" +} + +build_fm_shim_backend() { + /usr/libexec/security-misc/build-fm-shim-backend +} + +build_emerg_shutdown() { + /usr/libexec/security-misc/build-emerg-shutdown +} + +case "$1" in + configure) + if [ -d /etc/skel/.gnupg ]; then + ## Lintian warns against use of chmod --recursive. + chmod 700 /etc/skel/.gnupg + fi + + ## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override + glib-compile-schemas /usr/share/glib-2.0/schemas || true + + ## state dir for PAM 'faillock' + mkdir -p /var/lib/security-misc/faillock + + ## Fix pkexec remembered permissions if necessary. + fix_pkexec_remembered_permissions + + ## Pre-populate permission-hardener state on first postinst run. + ## Necessary because the first permission-hardener run may occur + ## before all permissions are set properly by package postinst + ## scripts. In particular, pkexec is not SUID-root until after its + ## postinst runs. + install_permission_hardener_base_state + + ## Fix usbguard config permissions, this seemingly can't be done + ## during the unpack stage + usbguard_config_file_list=( + '/etc/usbguard/rules.d/30_security-misc.conf' + '/etc/usbguard/usbguard-daemon.conf.security-misc' + '/etc/usbguard/IPCAccessControl.d/:sudo' + '/etc/usbguard/IPCAccessControl.d/:qubes' + ) + for usbguard_config_file in "${usbguard_config_file_list[@]}"; do + if test -f "${usbguard_config_file}"; then + chmod 0600 "${usbguard_config_file}" + fi + done + + ## Build the org.freedesktop.FileManager1 shim backend. + build_fm_shim_backend + + ## Pre-compile emerg-shutdown. + build_emerg_shutdown + ;; + + abort-upgrade|abort-remove|abort-deconfigure) + ;; + + triggered) + printf '%s\n' "INFO: triggered ${DPKG_MAINTSCRIPT_PACKAGE}: '${DPKG_MAINTSCRIPT_PACKAGE}' ${DPKG_MAINTSCRIPT_PACKAGE} DPKG_MAINTSCRIPT_NAME: '${DPKG_MAINTSCRIPT_NAME}' $\*: '$*' 2: '$2'" + /usr/share/security-misc/lkrg/lkrg-virtualbox || true + /usr/libexec/security-misc/mmap-rnd-bits || true + permission_hardening + exit 0 + ;; + + *) + printf '%s\n' "${DPKG_MAINTSCRIPT_NAME} called with unknown argument \`$1'" >&2 + exit 1 + ;; +esac + +pam-auth-update --package + +/usr/libexec/security-misc/permission-lockdown + +permission_hardening + +## https://phabricator.whonix.org/T377 +## Debian has no update-grub trigger yet: +## https://bugs.debian.org/481542 +if command -v update-grub >/dev/null 2>&1; then + update-grub || \ + printf '%s\n' "${DPKG_MAINTSCRIPT_PACKAGE} ${DPKG_MAINTSCRIPT_NAME} ERROR: Running \ +'update-grub' failed with exit code $?. ${DPKG_MAINTSCRIPT_PACKAGE} is most \ +likely only the trigger, not the cause. Unless you know this is not an issue, \ +you should fix running 'update-grub', otherwise your system might no longer \ +boot." >&2 +fi + +/usr/libexec/security-misc/mmap-rnd-bits || true + +true "INFO: debhelper beginning here." + +#DEBHELPER# + +true "INFO: Done with debhelper." + +permission_hardening_legacy_config_folder + +true " +##################################################################### +## INFO: END : ${DPKG_MAINTSCRIPT_PACKAGE} ${DPKG_MAINTSCRIPT_NAME} $* +##################################################################### +" + +## Explicitly "exit 0", so eventually trapped errors can be ignored. +exit 0 diff --git a/debian/security-misc.postrm b/debian/security-misc-shared.postrm old mode 100644 new mode 100755 similarity index 71% rename from debian/security-misc.postrm rename to debian/security-misc-shared.postrm index 4ff6c360..0be096ef --- a/debian/security-misc.postrm +++ b/debian/security-misc-shared.postrm @@ -1,10 +1,10 @@ #!/bin/bash -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. -if [ -f /usr/lib/helper-scripts/pre.bsh ]; then - source /usr/lib/helper-scripts/pre.bsh +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + source /usr/libexec/helper-scripts/pre.bsh fi set -e @@ -16,7 +16,11 @@ true " " ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/11 -pam-auth-update --package --remove "$DPKG_MAINTSCRIPT_PACKAGE" +if command -v pam-auth-update >/dev/null 2>&1; then + pam-auth-update --package +fi + +rm -f /etc/sysctl.d/30_security-misc_aslr-mmap.conf true "INFO: debhelper beginning here." diff --git a/debian/security-misc-shared.preinst b/debian/security-misc-shared.preinst new file mode 100755 index 00000000..43a07ff6 --- /dev/null +++ b/debian/security-misc-shared.preinst @@ -0,0 +1,219 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## helper-scripts is a Pre-Depends. +source /usr/libexec/helper-scripts/pre.bsh +source /usr/libexec/helper-scripts/has.bsh +source /usr/libexec/helper-scripts/accountctl.sh + +true " +##################################################################### +## INFO: BEGIN: ${DPKG_MAINTSCRIPT_PACKAGE:-} ${DPKG_MAINTSCRIPT_NAME:-} $* +##################################################################### +" + +user_groups_modifications() { + ## /usr/libexec/security-misc/hide-hardware-info + addgroup --system sysfs + addgroup --system cpuinfo + + ## /usr/lib/systemd/system/proc-hidepid.service + addgroup --system proc + + ## Avoid 'debian/control' file 'Depends:' 'sudo'. + ## + ## Could use '/usr/libexec/helper-scripts/user_create.bsh' in preinst? Looks more complex. Avoided. + ## group 'sudo' is not a system group. + #addgroup --system sudo + ## Function 'is_group' is complex. Hence, use '2>/dev/null || true'. + addgroup sudo 2>/dev/null || true + + ## group 'sudo' membership required to use 'su' + ## /usr/share/pam-configs/wheel-security-misc + adduser root sudo + + ## Useful to create groups in preinst rather than postinst. + ## Otherwise if a user saw an error message such as this: + ## + ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted. + ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: You probably want to run: + ## sudo adduser user console + ## + ## Then the user could not run 'sudo adduser user console' but also would + ## have to create the groups himself. + + ## Related to Console Lockdown. + ## /usr/share/pam-configs/console-lockdown-security-misc + ## /etc/security/access-security-misc.conf + addgroup --system console + addgroup --system console-unrestricted + ## This has no effect since by default this package also ships and an + ## /etc/securetty configuration file that contains nothing but comments, i.e. + ## an "empty" /etc/securetty. + ## In case a system administrator edits /etc/securetty, there is no need to + ## block for this to be still blocked by console lockdown. See also: + ## https://www.kicksecure.com/wiki/Root#Root_Login + adduser root console +} + +output_skip_checks() { + printf '%s\n' "security-misc-shared '${0}' INFO: Allow installation of security-misc-shared anyway." >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: (technical reason: $*)" >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: If this is a chroot this is probably OK." >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: Otherwise you might not be able to login." >&2 +} + +sudo_users_check () { + if has qubesdb-read; then + ## Qubes users can use dom0 to get a root terminal emulator. + ## For example: + ## qvm-run -u root debian-10 xterm + return 0 + fi + + if group_has_nonroot_member sudo; then + return 0 + fi + + ## Prevent users from locking themselves out. + ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 + printf '%s\n' "${0}: ERROR: No account is a member of group 'sudo'. Installation aborted." >&2 + printf '%s\n' "${0}: ERROR: You probably want to run:" >&2 + printf '%s\n' "${0}: NOTE: Replace account 'user' with your actual Linux user account name." >&2 + printf '%s\n' "" >&2 + printf '%s\n' "sudo adduser user sudo" >&2 + printf '%s\n' "sudo adduser user console" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "${0}: ERROR: See also installation instructions:" >&2 + printf '%s\n' "https://www.kicksecure.com/wiki/security-misc#install" >&2 + + if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then + output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'." + return 0 + fi + if test -f "/var/lib/security-misc/skip_install_check" \ + || [ "${dist_build_iso:-}" = "true" ] ; then + output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists or this is an ISO/live build (dist_build_iso=true)." + return 0 + fi + + exit 200 +} + +console_users_check() { + if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then + return 0 + fi + if test -f "/var/lib/security-misc/skip_install_check" \ + || [ "${dist_build_iso:-}" = "true" ] ; then + return 0 + fi + if has qubesdb-read; then + ## Qubes users can use dom0 to get a root terminal emulator. + ## For example: + ## qvm-run -u root debian-10 xterm + return 0 + fi + + ## Prevent users from locking themselves out. + ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 + if group_has_nonroot_member console \ + || group_has_nonroot_member console-unrestricted; then + return 0 + fi + + printf '%s\n' "${0}: ERROR: No account is a member of group 'console'. Installation aborted." >&2 + printf '%s\n' "${0}: ERROR: You probably want to run:" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "sudo adduser user console" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "${0}: ERROR: See also installation instructions:" >&2 + printf '%s\n' "https://www.whonix.org/wiki/security-misc#install" >&2 + + if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then + output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'." + return 0 + fi + if test -f "/var/lib/security-misc/skip_install_check" \ + || [ "${dist_build_iso:-}" = "true" ] ; then + output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists or this is an ISO/live build (dist_build_iso=true)." + return 0 + fi + + exit 201 +} + +legacy() { + if [ -f "/var/lib/legacy/do_once/${FUNCNAME[0]}_version_1" ]; then + return 0 + fi + + local continue_yes user_to_be_created + + if [ -f "/usr/share/whonix/marker" ]; then + continue_yes=true + fi + if [ -f "/usr/share/kicksecure/marker" ]; then + continue_yes=true + fi + + if [ ! "${continue_yes:-}" = "true" ]; then + return 0 + fi + + if has qubesdb-read; then + ## Qubes users can use dom0 to get a root terminal emulator. + ## For example: + ## qvm-run -u root debian-10 xterm + return 0 + fi + + ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/7 + + user_to_be_created=user + + if ! id "${user_to_be_created}" &>/dev/null ; then + true "INFO: Account '${user_to_be_created}' does not exist. Skipping adding account '${user_to_be_created}' to group 'console' and also skipping 'pam-auth-update --enable console-lockdown-security-misc'." + return 0 + fi + + adduser "${user_to_be_created}" console + + pam-auth-update --enable console-lockdown-security-misc + + mkdir --parents "/var/lib/legacy/do_once" + touch "/var/lib/legacy/do_once/${FUNCNAME[0]}_version_1" +} + +user_groups_modifications +legacy + +if [ "${1:-}" = "install" ] || [ "${1:-}" = "upgrade" ]; then + sudo_users_check + console_users_check +fi + +true "INFO: debhelper beginning here." + +#DEBHELPER# + +true "INFO: Done with debhelper." + +true " +##################################################################### +## INFO: END : ${DPKG_MAINTSCRIPT_PACKAGE:-} ${DPKG_MAINTSCRIPT_NAME:-} $* +##################################################################### +" + +## Explicitly "exit 0", so eventually trapped errors can be ignored. +exit 0 diff --git a/debian/security-misc.prerm b/debian/security-misc-shared.prerm old mode 100644 new mode 100755 similarity index 53% rename from debian/security-misc.prerm rename to debian/security-misc-shared.prerm index f6ceea52..a4106c3e --- a/debian/security-misc.prerm +++ b/debian/security-misc-shared.prerm @@ -1,10 +1,10 @@ #!/bin/bash -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. -if [ -f /usr/lib/helper-scripts/pre.bsh ]; then - source /usr/lib/helper-scripts/pre.bsh +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + source /usr/libexec/helper-scripts/pre.bsh fi set -e @@ -16,7 +16,17 @@ true " " if [ "$1" = remove ]; then - pam-auth-update --package --remove "$DPKG_MAINTSCRIPT_PACKAGE" + ## REMINDER: This list of policies must be kept in sync with the contents of + ## usr/share/pam-configs. + pam-auth-update --package --remove \ + block-unsafe-logins-security-misc \ + console-lockdown-security-misc \ + faillock-preauth-security-misc \ + mkhomedir-security-misc \ + pam-abort-on-locked-password-security-misc \ + umask-security-misc \ + unix-faillock-security-misc \ + wheel-security-misc fi true "INFO: debhelper beginning here." diff --git a/debian/security-misc-shared.templates b/debian/security-misc-shared.templates new file mode 100644 index 00000000..d45dfa17 --- /dev/null +++ b/debian/security-misc-shared.templates @@ -0,0 +1,9 @@ +Template: security-misc-shared/alert-on-permission-hardener-v2-upgrade +Type: note +_Description: Manual intervention may be required for permission-hardener update + No need to panic. Nothing is broken. A rare condition has been encountered. + permission-hardener is being updated to fix a minor bug that caused + corruption in the permission-hardener state file. If you installed your own + custom permission-hardener configuration, some manual intervention may be + required. See: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#fixing_state_files diff --git a/debian/security-misc-shared.triggers b/debian/security-misc-shared.triggers new file mode 100644 index 00000000..1f4a5921 --- /dev/null +++ b/debian/security-misc-shared.triggers @@ -0,0 +1,16 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## use noawait +## https://github.com/Kicksecure/security-misc/issues/196 + +## Trigger permission hardener when new binaries are being installed. +interest-noawait /usr +interest-noawait /opt + +## Trigger permission hardener when new configuration files are being installed. +interest-noawait /usr/lib/permission-hardener.d +interest-noawait /etc/permission-hardener.d +interest-noawait /usr/local/etc/permission-hardener.d +interest-noawait /etc/permission-hardening.d +interest-noawait /usr/local/etc/permission-hardening.d diff --git a/debian/security-misc-shared.undisplace b/debian/security-misc-shared.undisplace new file mode 100644 index 00000000..990101a0 --- /dev/null +++ b/debian/security-misc-shared.undisplace @@ -0,0 +1,6 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +/etc/login.defs.security-misc +/usr/bin/pkexec.security-misc +/etc/dkms/framework.conf.security-misc diff --git a/debian/security-misc.displace b/debian/security-misc.displace deleted file mode 100644 index ec8a20bb..00000000 --- a/debian/security-misc.displace +++ /dev/null @@ -1,5 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -/usr/bin/pkexec.security-misc -/etc/securetty.security-misc diff --git a/debian/security-misc.gconf-defaults b/debian/security-misc.gconf-defaults deleted file mode 100644 index 26d57ff7..00000000 --- a/debian/security-misc.gconf-defaults +++ /dev/null @@ -1,3 +0,0 @@ -/apps/nautilus/preview_sound never -/apps/nautilus/show_icon_text never -/apps/nautilus/show-image-thumbnails never diff --git a/debian/security-misc.maintscript b/debian/security-misc.maintscript deleted file mode 100644 index 14236463..00000000 --- a/debian/security-misc.maintscript +++ /dev/null @@ -1,39 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -rm_conffile /etc/sudoers.d/umask-security-misc - -## https://forums.whonix.org/t/allow-loading-signed-kernel-modules-by-default-disallow-kernel-module-loading-by-default/7880/23 -rm_conffile /etc/default/grub.d/40_only_allow_signed_modules.cfg - -## https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079 -rm_conffile /etc/sysctl.d/sysrq.conf - -## https://github.com/Whonix/security-misc/pull/45 -rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info -rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown - -## merged into 1 file /etc/sysctl.d/30_security-misc.conf -rm_conffile /etc/sysctl.d/fs_protected.conf -rm_conffile /etc/sysctl.d/kptr_restrict.conf -rm_conffile /etc/sysctl.d/suid_dumpable.conf -rm_conffile /etc/sysctl.d/harden_bpf.conf -rm_conffile /etc/sysctl.d/ptrace_scope.conf -rm_conffile /etc/sysctl.d/tcp_timestamps.conf -rm_conffile /etc/sysctl.d/mmap_aslr.conf -rm_conffile /etc/sysctl.d/dmesg_restrict.conf -rm_conffile /etc/sysctl.d/coredumps.conf -rm_conffile /etc/sysctl.d/kexec.conf -rm_conffile /etc/sysctl.d/tcp_hardening.conf -rm_conffile /etc/sysctl.d/tcp_sack.conf - -## merged into 1 file /etc/modprobe.d/30_security-misc.conf -rm_conffile /etc/modprobe.d/uncommon-network-protocols.conf -rm_conffile /etc/modprobe.d/blacklist-bluetooth.conf -rm_conffile /etc/modprobe.d/vivid.conf -rm_conffile /etc/modprobe.d/blacklist-dma.conf -rm_conffile /etc/modprobe.d/msr.conf -rm_conffile /etc/modprobe.d/30_nf_conntrack_helper_disable.conf - -## renamed to /etc/security/limits.d/30_security-misc.conf -rm_conffile /etc/security/limits.d/disable-coredumps.conf diff --git a/debian/security-misc.postinst b/debian/security-misc.postinst deleted file mode 100644 index aabb3d59..00000000 --- a/debian/security-misc.postinst +++ /dev/null @@ -1,62 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -f /usr/lib/helper-scripts/pre.bsh ]; then - source /usr/lib/helper-scripts/pre.bsh -fi - -set -e - -true " -##################################################################### -## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -case "$1" in - configure) - ## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override - glib-compile-schemas /usr/share/glib-2.0/schemas || true - ;; - - abort-upgrade|abort-remove|abort-deconfigure) - ;; - - *) - echo "$DPKG_MAINTSCRIPT_NAME called with unknown argument \`$1'" >&2 - exit 1 - ;; -esac - -pam-auth-update --package - -/usr/lib/security-misc/permission-lockdown - -## https://phabricator.whonix.org/T377 -## Debian has no update-grub trigger yet: -## https://bugs.debian.org/481542 -if command -v update-grub >/dev/null 2>&1; then - update-grub || \ - echo "$DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME ERROR: Running \ -'update-grub' failed with exit code $?. $DPKG_MAINTSCRIPT_PACKAGE is most \ -likely only the trigger, not the cause. Unless you know this is not an issue, \ -you should fix running 'update-grub', otherwise your system might no longer \ -boot." >&2 -fi - -true "INFO: debhelper beginning here." - -#DEBHELPER# - -true "INFO: Done with debhelper." - -true " -##################################################################### -## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -## Explicitly "exit 0", so eventually trapped errors can be ignored. -exit 0 diff --git a/debian/security-misc.preinst b/debian/security-misc.preinst deleted file mode 100644 index 428bf82a..00000000 --- a/debian/security-misc.preinst +++ /dev/null @@ -1,208 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -f /usr/lib/helper-scripts/pre.bsh ]; then - source /usr/lib/helper-scripts/pre.bsh -fi - -set -e - -true " -##################################################################### -## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -user_groups_modifications() { - ## /usr/lib/security-misc/hide-hardware-info - addgroup --system sysfs - addgroup --system cpuinfo - - ## group 'sudo' membership required to use 'su' - ## /usr/share/pam-configs/wheel-security-misc - addgroup root sudo - - ## Useful to create groups in preinst rather than postinst. - ## Otherwise if a user saw an error message such as this: - ## - ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted. - ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: You probably want to run: - ## sudo adduser user console - ## - ## Then the user could not run 'sudo adduser user console' but also would - ## have to create the groups himself. - - ## Related to Console Lockdown. - ## /usr/share/pam-configs/console-lockdown-security-misc - ## /etc/security/access-security-misc.conf - addgroup --system console - addgroup --system console-unrestricted - ## This has no effect since by default this package also ships and an - ## /etc/securetty configuration file that contains nothing but comments, i.e. - ## an "empty" /etc/securetty. - ## In case a system administrator edits /etc/securetty, there is no need to - ## block for this to be still blocked by console lockdown. See also: - ## https://www.whonix.org/wiki/Root#Root_Login - addgroup root console -} - -sudo_users_check () { - if command -v "qubesdb-read" &>/dev/null; then - ## Qubes users can use dom0 to get a root terminal emulator. - ## For example: - ## qvm-run -u root debian-10 xterm - return 0 - fi - - local sudo_users user_with_sudo are_there_any_sudo_users OLD_IFS - - sudo_users="$(getent group sudo | cut -d: -f4)" - ## example sudo_users: - ## user,root - - OLD_IFS="$IFS" - IFS="," - export IFS - - for user_with_sudo in $sudo_users ; do - if [ "$user_with_sudo" = "root" ]; then - ## root login is also restricted. - ## Therefore user "root" being member of group "sudo" is - ## considered insufficient. - continue - fi - are_there_any_sudo_users=yes - break - done - - IFS="$OLD_IFS" - export IFS - - ## Prevent users from locking themselves out. - ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 - if [ ! "$are_there_any_sudo_users" = "yes" ]; then - echo "$0: ERROR: No user is a member of group 'sudo'. Installation aborted." >&2 - echo "$0: ERROR: You probably want to run:" >&2 - echo "" >&2 - echo "sudo adduser user sudo" >&2 - echo "sudo adduser user console" >&2 - echo "" >&2 - echo "$0: ERROR: See also installation instructions:" >&2 - echo "https://www.whonix.org/wiki/security-misc#install" >&2 - exit 200 - fi -} - -console_users_check() { - if command -v "qubesdb-read" &>/dev/null; then - ## Qubes users can use dom0 to get a root terminal emulator. - ## For example: - ## qvm-run -u root debian-10 xterm - return 0 - fi - - local console_users console_unrestricted_users user_with_console are_there_any_console_users OLD_IFS - - console_users="$(getent group console | cut -d: -f4)" - ## example console_users: - ## user - console_unrestricted_users="$(getent group console-unrestricted | cut -d: -f4)" - - OLD_IFS="$IFS" - IFS="," - export IFS - - for user_with_console in $console_users $console_unrestricted_users ; do - if [ "$user_with_console" = "root" ]; then - ## root login is also restricted. - ## Therefore user "root" being member of group "console" is - ## considered insufficient. - continue - fi - are_there_any_console_users=yes - break - done - - IFS="$OLD_IFS" - export IFS - - ## Prevent users from locking themselves out. - ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 - if [ ! "$are_there_any_console_users" = "yes" ]; then - echo "$0: ERROR: No user is a member of group 'console'. Installation aborted." >&2 - echo "$0: ERROR: You probably want to run:" >&2 - echo "" >&2 - echo "sudo adduser user console" >&2 - echo "" >&2 - echo "$0: ERROR: See also installation instructions:" >&2 - echo "https://www.whonix.org/wiki/security-misc#install" >&2 - exit 201 - fi -} - -legacy() { - if [ -f "/var/lib/legacy/do_once/${FUNCNAME}_version_1" ]; then - return 0 - fi - - local continue_yes user_to_be_created - - if [ -f "/usr/share/whonix/marker" ]; then - continue_yes=true - fi - if [ -f "/usr/share/kicksecure/marker" ]; then - continue_yes=true - fi - - if [ ! "$continue_yes" = "true" ]; then - return 0 - fi - - if command -v "qubesdb-read" &>/dev/null; then - ## Qubes users can use dom0 to get a root terminal emulator. - ## For example: - ## qvm-run -u root debian-10 xterm - return 0 - fi - - ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/7 - - user_to_be_created=user - - if ! id "$user_to_be_created" &>/dev/null ; then - true "INFO: user '$user_to_be_created' does not exist. Skipping addgroup console and pam-auth-update." - return 0 - fi - - addgroup "$user_to_be_created" console - - pam-auth-update --enable console-lockdown-security-misc - - mkdir --parents "/var/lib/legacy/do_once" - touch "/var/lib/legacy/do_once/${FUNCNAME}_version_1" -} - -user_groups_modifications -legacy - -if [ "$1" = "install" ] || [ "$1" = "upgrade" ]; then - sudo_users_check - console_users_check -fi - -true "INFO: debhelper beginning here." - -#DEBHELPER# - -true "INFO: Done with debhelper." - -true " -##################################################################### -## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -## Explicitly "exit 0", so eventually trapped errors can be ignored. -exit 0 diff --git a/debian/security-misc.triggers b/debian/security-misc.triggers deleted file mode 100644 index 4aa5743f..00000000 --- a/debian/security-misc.triggers +++ /dev/null @@ -1,12 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -#### meta start -#### project Whonix -#### category security -#### description - -## Activate initramfs hook that sets the sysctl values before init is executed. -activate-noawait update-initramfs - -#### meta end diff --git a/debian/security-misc.undisplace b/debian/security-misc.undisplace deleted file mode 100644 index db0d1fd9..00000000 --- a/debian/security-misc.undisplace +++ /dev/null @@ -1,4 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -/etc/login.defs.security-misc diff --git a/debian/source/lintian-overrides b/debian/source/lintian-overrides index 942fd18b..c6575653 100644 --- a/debian/source/lintian-overrides +++ b/debian/source/lintian-overrides @@ -1,2 +1,2 @@ ## https://phabricator.whonix.org/T277 -debian-watch-does-not-check-gpg-signature +debian-watch-does-not-check-openpgp-signature diff --git a/debian/watch b/debian/watch index 16e01a49..ea85f6bb 100644 --- a/debian/watch +++ b/debian/watch @@ -1,6 +1,6 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. version=4 opts=filenamemangle=s/.+\/v?(\d\S+)\.tar\.gz/security-misc-$1\.tar\.gz/ \ - https://github.com/Whonix/security-misc/tags .*/v?(\d\S+)\.tar\.gz + https://github.com/Kicksecure/security-misc/tags .*/v?(\d\S+)\.tar\.gz diff --git a/etc/X11/Xsession.d/50panic_on_oops b/etc/X11/Xsession.d/50panic_on_oops deleted file mode 100644 index ef212283..00000000 --- a/etc/X11/Xsession.d/50panic_on_oops +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/sh - -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -x /usr/lib/security-misc/panic-on-oops ]; then - sudo --non-interactive /usr/lib/security-misc/panic-on-oops -fi diff --git a/etc/X11/Xsession.d/50security-misc b/etc/X11/Xsession.d/50security-misc deleted file mode 100644 index 9ec65bdb..00000000 --- a/etc/X11/Xsession.d/50security-misc +++ /dev/null @@ -1,7 +0,0 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -z "$XDG_CONFIG_DIRS" ]; then - XDG_CONFIG_DIRS=/etc/xdg -fi -export XDG_CONFIG_DIRS=/usr/share/security-misc/:$XDG_CONFIG_DIRS diff --git a/etc/apparmor.d/tunables/home.d/security-misc b/etc/apparmor.d/tunables/home.d/security-misc deleted file mode 100644 index 61735d38..00000000 --- a/etc/apparmor.d/tunables/home.d/security-misc +++ /dev/null @@ -1,7 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -alias /etc/pam.d/common-session -> /etc/pam.d//etc/pam.d/common-session.security-misc, -alias /etc/pam.d/common-session-noninteractive -> /etc/pam.d/common-session-noninteractive.security-misc, -alias /etc/login.defs -> /etc/login.defs.security-misc, -alias /etc/securetty -> /etc/securetty.security-misc, diff --git a/etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared b/etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared new file mode 100644 index 00000000..b8b97362 --- /dev/null +++ b/etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared @@ -0,0 +1,4 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +alias /etc/securetty -> /etc/securetty.security-misc, diff --git a/etc/apt/apt.conf.d/40error-on-any#security-misc-shared b/etc/apt/apt.conf.d/40error-on-any#security-misc-shared new file mode 100644 index 00000000..f1be4729 --- /dev/null +++ b/etc/apt/apt.conf.d/40error-on-any#security-misc-shared @@ -0,0 +1,9 @@ +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Make "sudo apt-get update" exit non-zero for transient failures. +## Same as "apt-get --error-on=any". +## https://forums.whonix.org/t/debian-bullseye-apt-get-error-on-any/12068 +## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=594813 +## https://salsa.debian.org/apt-team/apt/-/commit/c7123bea6a8dc2c9e327ce41ddfc25e29f1bb145 +APT::Update::Error-Mode any; diff --git a/etc/apt/apt.conf.d/40sandbox b/etc/apt/apt.conf.d/40sandbox#security-misc-shared similarity index 65% rename from etc/apt/apt.conf.d/40sandbox rename to etc/apt/apt.conf.d/40sandbox#security-misc-shared index e79194fb..43150ec6 100644 --- a/etc/apt/apt.conf.d/40sandbox +++ b/etc/apt/apt.conf.d/40sandbox#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702 diff --git a/etc/bluetooth/30_security-misc.conf#security-misc-desktop b/etc/bluetooth/30_security-misc.conf#security-misc-desktop new file mode 100644 index 00000000..8de8384c --- /dev/null +++ b/etc/bluetooth/30_security-misc.conf#security-misc-desktop @@ -0,0 +1,28 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[General] +# How long to stay in pairable mode before going back to non-discoverable +# The value is in seconds. Default is 0. +# 0 = disable timer, i.e. stay pairable forever +PairableTimeout = 30 + +# How long to stay in discoverable mode before going back to non-discoverable +# The value is in seconds. Default is 180, i.e. 3 minutes. +# 0 = disable timer, i.e. stay discoverable forever +DiscoverableTimeout = 30 + +# Maximum number of controllers allowed to be exposed to the system. +# Default=0 (unlimited) +MaxControllers=1 + +[Policy] +# AutoEnable defines option to enable all controllers when they are found. +# This includes adapters present on start as well as adapters that are plugged +# in later on. Defaults to 'true'. +AutoEnable=false + +# network/on: A device will only accept advertising packets from peer +# devices that contain private addresses. It may not be compatible with some +# legacy devices since it requires the use of RPA(s) all the time. +Privacy=network/on diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared b/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared new file mode 100644 index 00000000..9d78a8ff --- /dev/null +++ b/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared @@ -0,0 +1,232 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Enable known mitigations for CPU vulnerabilities. +## Note, the mitigations for SSB and Retbleed are not currently mentioned in the first link. +## https://docs.kernel.org/admin-guide/hw-vuln/index.html +## https://docs.kernel.org/admin-guide/kernel-parameters.html +## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647 + +## Check for potential updates directly from AMD and Intel. +## https://www.amd.com/en/resources/product-security.html +## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html +## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html + +## Tabular comparison between the utility and functionality of various mitigations. +## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/587 + +## For complete protection, users must install the latest relevant security microcode update. +## BIOS/UEFI updates should only be obtained directly from OEMs and/or motherboard manufacturers. +## Note that incorrectly performing system BIOS/UEFI updates can potentially lead to serious functionality issues. +## The parameters below only provide (partial) protection at both the kernel and user space level. + +## If using Secure Boot, users must also ensure the Secure Boot Forbidden Signature Database (DBX) is up to date. +## The UEFI Revocation List contains signatures of now revoked firmware and software used in booting systems. +## If using compatible hardware, the database can be updated directly in user space using fwupd. +## Note that incorrectly performing DBX updates can potentially lead to serious functionality issues. +## https://github.com/microsoft/secureboot_objects +## https://uefi.org/revocationlistfile +## https://github.com/fwupd/fwupd + +## Enable a subset of known default mitigations for some CPU vulnerabilities and disable SMT. +## Note that this redundant parameter simply applies each mitigation at the already applied default settings. +## The default values are not always the strictest and so we reapply each below to their highest setting. +## We retain it here for completeness as many other distributions heavily rely on this for many CPU mitigations. +## +## https://github.com/Kicksecure/security-misc/issues/199#issuecomment-3327391859 +## https://github.com/secureblue/secureblue/issues/1405 +## https://docs.kernel.org/admin-guide/hw-vuln/attack_vector_controls.html +## +## KSPP=yes +## KSPP sets the kernel parameters. +## +## WARNING: Do not rely on this parameter, it is presented here only for educational purposes. +## WARNING: Parameters are applied consecutively and so do not ever move this setting down. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt" + +## Disable SMT as it has been the cause of and amplified numerous CPU exploits. +## The only full mitigation of cross-HT attacks is to disable SMT. +## Disabling will significantly decrease system performance on multi-threaded tasks. +## Note, this setting will prevent re-enabling SMT via the sysfs interface. +## +## https://docs.kernel.org/admin-guide/hw-vuln/core-scheduling.html +## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 +## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365 +## +## KSPP=yes +## KSPP sets the kernel parameter. +## +## To re-enable SMT: +## - Remove "nosmt=force". +## - Remove all occurrences of ",nosmt" in this file (note the comma ","). +## - Downgrade "l1tf=full,force" protection to "l1tf=flush". +## - Regenerate the dracut initramfs and then reboot system. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force" + +## Spectre Side Channels (BTI and BHI): +## Unconditionally enable mitigation for Spectre Variant 2 (branch target injection). +## Enable mitigation for the Intel branch history injection vulnerability. +## Currently affects both AMD and Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/spectre.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on" + +## Meltdown: +## Mitigate Spectre Variant 3 using kernel page table isolation (PTI). +## Enables kernel PTI to harden against kernel ASLR (KASLR) bypasses. +## Force enables PTI of user and kernel address spaces on all ARM cores. +## Currently affects AMD, ARM64, and Intel CPUs. +## +## https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability) +## https://en.wikipedia.org/wiki/Kernel_page-table_isolation +## +## KSPP=yes +## KSPP sets "pti=on", CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y, and CONFIG_UNMAP_KERNEL_AT_EL0=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kpti=1" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on" + +## Speculative Store Bypass (SSB): +## Mitigate Spectre Variant 4 by disabling speculative store bypass system-wide. +## Unconditionally enable the mitigation for both kernel and userspace. +## Currently affects AMD, ARM64, and Intel CPUs. +## +## https://en.wikipedia.org/wiki/Speculative_Store_Bypass +## https://www.suse.com/support/kb/doc/?id=000019189 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ssbd=force-on" + +## L1 Terminal Fault (L1TF): +## Mitigate the vulnerability by disabling L1D flush runtime control and SMT. +## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/l1tf.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always" + +## Microarchitectural Data Sampling (MDS): +## Mitigate the vulnerability by clearing the CPU buffer cache and disabling SMT. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/mds.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" + +## TSX Asynchronous Abort (TAA): +## Mitigate the vulnerability by disabling TSX. +## If TSX is enabled, clear CPU buffer rings on transitions and disable SMT. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/tsx_async_abort.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt" + +## iTLB Multihit: +## Mitigate the vulnerability by marking all huge pages in the EPT as non-executable. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/multihit.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force" + +## Special Register Buffer Data Sampling (SRBDS): +## Mitigation of the vulnerability is only possible via microcode update from Intel. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/special-register-buffer-data-sampling.html +## https://access.redhat.com/solutions/5142691 + +## L1D Flushing: +## Mitigate leaks from the L1D cache on context switches by enabling the prctl() interface. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/l1d_flush.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on" + +## Processor MMIO Stale Data: +## Mitigate the vulnerabilities by appropriately clearing the CPU buffer and disabling SMT. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/processor_mmio_stale_data.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt" + +## Arbitrary Speculative Code Execution with Return Instructions (Retbleed): +## Mitigate the vulnerability through CPU-dependent implementation and disable SMT. +## Currently affects both AMD Zen 1-2 and Intel CPUs. +## +## https://en.wikipedia.org/wiki/Retbleed +## https://comsec.ethz.ch/research/microarch/retbleed/ +## https://www.suse.com/support/kb/doc/?id=000020693 +## https://access.redhat.com/solutions/retbleed +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt" + +## Cross-Thread Return Address Predictions: +## Mitigate the vulnerability for certain KVM hypervisor configurations. +## Currently affects AMD Zen 1-2 CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/cross-thread-rsb.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.mitigate_smt_rsb=1" + +## Speculative Return Stack Overflow (SRSO): +## Mitigate the vulnerability by ensuring all RET instructions speculate to a controlled location. +## Currently affects AMD Zen 1-4 CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/srso.html +## +## The default kernel setting will be utilized until provided sufficient evidence to modify. +## Using "spec_rstack_overflow=ibpb" may provide superior protection to the default software-based approach. +## The use of hardware barriers may be more effective while possibly incurring a greater performance loss. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_rstack_overflow=safe-ret" + +## Gather Data Sampling (GDS): +## Mitigate the vulnerability either via microcode update or by disabling AVX. +## Note, without a suitable microcode update, this will entirely disable use of the AVX instructions set. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/gather_data_sampling.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX gather_data_sampling=force" + +## Register File Data Sampling (RFDS): +## Mitigate the vulnerability by appropriately clearing the CPU buffer. +## Currently affects Intel Atom CPUs (which encompasses E-cores on hybrid architectures). +## +## https://docs.kernel.org/admin-guide/hw-vuln/reg-file-data-sampling.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX reg_file_data_sampling=on" + +## Indirect Target Selection (ITS): +## Mitigate the vulnerability by not allowing indirect branches in the lower half of the cacheline. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/indirect-target-selection.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX indirect_target_selection=force" + +## VMScape: +## Mitigate the vulnerability by flushing branch predictors before returning to userspace when exiting guests. +## Comprehensive protection may also require disabling SMT to limit cross-thread attacks. +## Currently affects both AMD and Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/vmscape.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vmscape=force" diff --git a/etc/default/grub.d/40_distrust_cpu.cfg b/etc/default/grub.d/40_distrust_cpu.cfg deleted file mode 100644 index f3f2fab3..00000000 --- a/etc/default/grub.d/40_distrust_cpu.cfg +++ /dev/null @@ -1,11 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Distrusts the CPU for initial entropy at boot as it is not possible to -## audit, may contain weaknesses or a backdoor. -## -## https://en.wikipedia.org/wiki/RDRAND#Reception -## https://twitter.com/pid_eins/status/1149649806056280069 -## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html -## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566 -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off" diff --git a/etc/default/grub.d/40_enable_iommu.cfg b/etc/default/grub.d/40_enable_iommu.cfg deleted file mode 100644 index 1d6dd0af..00000000 --- a/etc/default/grub.d/40_enable_iommu.cfg +++ /dev/null @@ -1,5 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Enables IOMMU to prevent DMA attacks. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on amd_iommu=on" diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg deleted file mode 100644 index 82a2bb80..00000000 --- a/etc/default/grub.d/40_kernel_hardening.cfg +++ /dev/null @@ -1,73 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -kpkg="linux-image-$(dpkg --print-architecture)" -kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" -#echo "## kver: $kver" - -## Disables the merging of slabs of similar sizes. -## Sometimes a slab can be used in a vulnerable way which an attacker can exploit. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" - -if dpkg --compare-versions "$kver" ge "5.3"; then - ## Enables sanity checks (F) and redzoning (Z). - GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ" - - #echo "## $kver grater or equal 5.3: yes" - ## Zero memory at allocation and free time. - GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1" -else - #echo "## $kver grater or equal 5.3: no" - ## SLUB poisoning and page poisoning is used if the kernel - ## does not yet support init_on_{,alloc,free}. - GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZP" - - if command -v "qubesdb-read" >/dev/null 2>&1 ; then - ## https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012 - true "skip adding page_poison=1 in Qubes" - else - GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_poison=1" - fi -fi - -## Makes the kernel panic on uncorrectable errors in ECC memory that an attacker could exploit. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0" - -## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on" - -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on" - -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on" - -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off" - -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt" - -## Enables all mitigations for the MDS vulnerability. -## Disables smt which can be used to exploit the MDS vulnerability. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" - -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force" - -## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force" - -## Vsyscalls are obsolete, are at fixed addresses and are a target for ROP. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none" - -## Enables page allocator freelist randomization. -if dpkg --compare-versions "${kver}" ge "5.2"; then - GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1" -fi - -## Enables kernel lockdown. -## -## Disabled for now as it enforces module signature verification which breaks -## too many things. -## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880 -## -#if dpkg --compare-versions "${kver}" ge "5.4"; then -# GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality" -#fi diff --git a/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared b/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared new file mode 100644 index 00000000..ecbddc7a --- /dev/null +++ b/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared @@ -0,0 +1,437 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +kpkg="linux-image-$(dpkg --print-architecture)" || true +kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || true +#echo "## kver: $kver" + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## This configuration file is split into 4 sections: +## 1. Kernel Space +## 2. Direct Memory Access +## 3. Entropy +## 4. Networking + +## See the documentation below for details on the majority of the selected commands: +## https://docs.kernel.org/admin-guide/kernel-parameters.html +## https://wiki.archlinux.org/title/Kernel_parameters#GRUB + +## 1. Kernel Space: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#boot-parameters +## https://kspp.github.io/Recommended_Settings#kernel-command-line-options + +## Disable merging of slabs with similar size. +## Reduces the risk of triggering heap overflows. +## Prevents overwriting objects from merged caches and limits influencing slab cache layout. +## +## https://www.openwall.com/lists/kernel-hardening/2017/06/19/33 +## https://www.openwall.com/lists/kernel-hardening/2017/06/20/10 +## +## KSPP=yes +## KSPP sets the kernel parameter and does not set CONFIG_SLAB_MERGE_DEFAULT. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" + +## Enable sanity checks and red zoning of slabs via debugging options to detect memory corruption. +## Sanity checks force additional verification steps on every memory allocation and free operation. +## Red zoning adds extra metadata to each object to detect writes beyond the object's boundaries. +## As a by product of debugging, this will implicitly disabling kernel pointer hashing unless manually re-enabled. +## Enabling this (for now) will therefore leak exact and all kernel memory addresses to root. +## Introduces a noticeable performance overhead during all memory allocation and deallocation operations. +## +## https://docs.kernel.org/mm/slub.html +## https://www.kernel.org/doc/Documentation/vm/slub.txt +## https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u +## https://blogs.oracle.com/linux/post/linux-slub-allocator-internals-and-debugging-2 +## https://gitlab.tails.boum.org/tails/tails/-/issues/19613 +## https://github.com/Kicksecure/security-misc/issues/253 +## +## KSPP=partial +## KSPP sets the kernel parameters and CONFIG_SLUB_DEBUG. +## +## REMINDER: Debian forky / 14 +## The first parameter is applicable when using Linux kernel >= 6.17 (retained here for future-proofing and completeness). +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX hash_pointers=always" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ" + +## Zero memory at allocation time and free time. +## Fills newly allocated pages, freed pages, and heap objects with zeros. +## Mitigates use-after-free exploits by erasing sensitive information in memory. +## +## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6471384af2a6530696fc0203bafe4de41a23c9ef +## +## KSPP=yes +## KSPP sets the kernel parameters, CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y, and CONFIG_INIT_ON_FREE_DEFAULT_ON=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_free=1" + +## Enable the kernel page allocator to randomize free lists. +## During early boot, the page allocator has predictable FIFO behavior for physical pages. +## Limits some data exfiltration and ROP attacks that rely on inferring sensitive data location. +## Also improves performance by optimizing memory-side cache utilization. +## +## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e900a918b0984ec8f2eb150b8477a47b75d17692 +## https://en.wikipedia.org/wiki/Return-oriented_programming#Attacks +## +## KSPP=yes +## KSPP sets the kernel parameter and CONFIG_SHUFFLE_PAGE_ALLOCATOR=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1" + +## Enable randomization of the kernel stack offset on syscall entries. +## Hardens against memory corruption attacks due to increased entropy. +## Limits attacks relying on deterministic stack addresses or cross-syscall address exposure. +## +## https://lkml.org/lkml/2019/3/18/246 +## https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html +## +## KSPP=yes +## KSPP sets the kernel parameter and CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX randomize_kstack_offset=on" + +## Disable vsyscalls to reduce attack surface as they have been replaced by vDSO. +## Vulnerable to ROP attacks as vsyscalls are located at fixed addresses in memory. +## +## https://lwn.net/Articles/446528/ +## https://en.wikipedia.org/wiki/VDSO +## +## KSPP=yes +## KSPP sets the kernel parameter, CONFIG_LEGACY_VSYSCALL_NONE=y and does not set CONFIG_X86_VSYSCALL_EMULATION. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none" + +## Restrict access to debugfs by not registering the file system. +## Deactivated since the file system can contain sensitive information. +## +## https://lkml.org/lkml/2020/7/16/122 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off" + +## Force immediate system reboots on the occurrence of a single kernel panic. +## Increases resilience and limits impact of denial of service attacks as system automatically restarts. +## Ensures the system does not hang forever if a panic occurs, reducing susceptibility to both cold and warm boot attacks. +## Immediate rebooting also prevents persistent information disclosure on panic details that were dumped to screen. +## +## KSPP=yes +## KSPP sets CONFIG_PANIC_TIMEOUT=-1. +## +## See /usr/lib/sysctl.d/990-security-misc.conf for implementation. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic=-1" + +## Force the kernel to immediately panic on "oopses" and kernel warnings in the WARN() path. +## Panics may be due to false-positives such as bad drivers. +## Both allowed limits are set to one so that panics occur on the single first instance of either scenario. +## Oopses are serious but non-fatal errors. +## Certain "oopses" can sometimes indicate and thwart potential kernel exploitation attempts. +## Warnings are messages generated by the kernel to indicate unexpected conditions or errors. +## By default, code execution continues regardless of warnings emitted by macros like WARN() and WARN_ON(). +## Note that by forcing kernel panics on oopses and warnings, this exposes the system to targeted denial of service attacks. +## +## https://en.wikipedia.org/wiki/Kernel_panic#Linux +## https://en.wikipedia.org/wiki/Linux_kernel_oops +## https://lwn.net/Articles/876209/ +## https://git.sr.ht/~gregkh/presentation-security/tree/3fdaf81a2f8b2c8d64cdb2f529cc714624868aa8/item/security-stuff.pdf +## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713 +## +## KSPP=yes +## KSPP sets CONFIG_PANIC_ON_OOPS=y. +## +## Note that this must be used with panic=-1 for it to function as intended. +## +## See /usr/libexec/security-misc/panic-on-oops for implementation. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX oops=panic" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic_on_warn=1" + +## Force the kernel to immediately panic if it becomes tainted. +## Using kernel documentation, one can select a subset of taints to create a security policy. +## Requires summing the numbers for each taint state and then converting it to a hexadecimal bitmask. +## Some example combinations are shown below. +## S - Panic on using out of specification hardware: 4 = 0x4. +## B - On the above and bad page faults or some unexpected page flags: 36 = 0x24. +## A - On the above and ACPI tables are overridden by users: 292 = 0x124. +## I - On the above and severe firmware bugs: 2340 = 0x924. +## N - On the above and in-kernel tests have been run: 264484 = 0x40924. +## J - On the above and userspace has used a mutating debug operation in fwctl: 788772 = 0xC0924. +## G/P, O - On the above and the loading of proprietary or out-of-tree modules: 792869 = 0xC1925. +## All must first be tested to ensure there are no pre-existing issues on user hardware. +## After confirming stability this reduces attack surface. +## +## https://docs.kernel.org/admin-guide/tainted-kernels.html +## https://support.scc.suse.com/s/kb/Tainted-kernel-1583239310621?language=en_US +## https://lore.kernel.org/all/20200515175502.146720-1-aquini@redhat.com/T/ +## https://github.com/Kicksecure/security-misc/pull/339 +## +## Note that this must be used with panic=-1 for it to function as intended. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic_on_taint=0xC0924" + +## Prevent sensitive kernel information leaks in the console during boot. +## Must be used in combination with the kernel.printk sysctl. +## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation. +## +## https://docs.kernel.org/core-api/printk-basics.html +## https://wiki.archlinux.org/title/silent_boot +## +## See /etc/default/grub.d/41_quiet_boot.cfg for implementation. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX loglevel=0" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet" + +## Enable the kernel "Electric-Fence" sampling-based memory safety error detector. +## KFENCE detects heap out-of-bounds access, use-after-free, and invalid-free errors. +## Aims to have very low processing overhead at each sampling interval. +## Sampling interval is set to occur every 100 milliseconds as per KSPP recommendation. +## +## https://docs.kernel.org/dev-tools/kfence.html +## https://google.github.io/kernel-sanitizers/KFENCE.html +## https://blogs.oracle.com/linux/post/linux-slub-allocator-internals-and-debugging-4 +## https://lwn.net/Articles/835542/ +## +## KSPP=yes +## KSPP sets the kernel parameter, CONFIG_KFENCE=y, and CONFIG_KFENCE_SAMPLE_INTERVAL=100. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kfence.sample_interval=100" + +## Disable 32-bit Virtual Dynamic Shared Object (vDSO) mappings. +## Legacy compatibility feature for superseded glibc versions. +## +## https://lore.kernel.org/lkml/20080409082927.BD59E26F992@magilla.localdomain/T/ +## https://lists.openwall.net/linux-kernel/2014/03/11/3 +## +## KSPP=yes +## KSPP sets the kernel parameter and does not set CONFIG_COMPAT_VDSO. +## +## See /usr/lib/sysctl.d/990-security-misc.conf for another additional implementation. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0" + +## Switch (back) to using kCFI as the default Control Flow Integrity (CFI) implementation. +## The default implementation is FineIBT as of Linux kernel 6.2. +## The Intel-developed IBT (Indirect Branch Tracking) is only used if supported by the CPU. +## kCFI is software-only while FineIBT is a hybrid software/hardware implementation. +## FineIBT may result in some performance benefits as it only performs hash checks at the destinations. +## kCFI mandates hash validation at the source (which is randomized), making it more difficult to bypass. +## FineIBT is considered weaker against attacks that can write arbitrary executables into memory. +## +## https://lwn.net/Articles/891976/ +## https://lore.kernel.org/lkml/202210010918.4918F847C4@keescook/T/#u +## https://lore.kernel.org/lkml/202210182217.486CBA50@keescook/T/ +## https://lore.kernel.org/all/20221027092842.699804264@infradead.org/ +## https://lore.kernel.org/lkml/202407150933.E1871BE@keescook/ +## https://isopenbsdsecu.re/mitigations/forward_edge_cfi/ +## https://docs.kernel.org/next/x86/shstk.html +## https://source.android.com/docs/security/test/kcfi +## https://lpc.events/event/16/contributions/1315/attachments/1067/2169/cfi.pdf +## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/561 +## +## KSPP=yes +## KSPP sets the kernel parameter. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cfi=kcfi" + +## Disable support for all 32-bit x86 processes and syscalls. +## Unconditionally disables IA32 emulation to substantially reduce attack surface. +## +## https://lore.kernel.org/all/20230623111409.3047467-7-nik.borisov@suse.com/ +## +## KSPP=yes +## KSPP does not set CONFIG_COMPAT, CONFIG_IA32_EMULATION, CONFIG_X86_X32, CONFIG_X86_X32_ABI, and CONFIG_MODIFY_LDT_SYSCALL. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0" + +## Disable EFI persistent storage feature. +## Disable Error Record Serialization Table (ERST) support as a form of defense-in-depth. +## Prevents the kernel from writing crash logs and other persistent data to the storage backend. +## Both the UEFI variable storage and ACPI ERST backends are deactivated. +## +## https://blogs.oracle.com/linux/post/pstore-linux-kernel-persistent-storage-file-system +## https://www.ais.com/understanding-pstore-linux-kernel-persistent-storage-file-system/ +## https://lwn.net/Articles/434821/ +## https://manpages.debian.org/testing/systemd/systemd-pstore.service.8.en.html +## https://gitlab.tails.boum.org/tails/tails/-/issues/20813 +## https://github.com/Kicksecure/security-misc/issues/299 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable" + +## Restrict processes from modifying their own memory mappings. +## Prevents using /proc/PID/mem to write to protected pages unless via ptrace() for debugging. +## Increases the difficulty in tricking applications into overwriting their own memory. +## Limit self-modification which can be used trigger existing vulnerabilities. +## +## https://lore.kernel.org/lkml/20240712-vfs-procfs-ce7e6c7cf26b@brauner/ +## https://lwn.net/Articles/983169/ +## https://github.com/a13xp0p0v/kernel-hardening-checker/pull/201 +## https://github.com/Kicksecure/security-misc/issues/330 +## +## KSPP=partial +## KSPP sets the stricter kernel parameter "proc_mem.force_override=never". +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX proc_mem.force_override=ptrace" + +## Prevent processes from writing to block devices that are mounted by filesystems. +## Enhances system stability and security by protecting against runaway privileged processes. +## Allowing processes to write to the buffer cache can cause filesystem corruption and kernel crashes. +## Does not prevent data modifications using direct SCSI commands or lower-level storage stack access. +## May lead to breakages in certain limited scenarios. +## +## https://github.com/torvalds/linux/commit/ed5cc702d311c14b653323d76062b0294effa66e +## https://lore.kernel.org/lkml/20240105-vfs-super-4092d802972c@brauner/ +## https://github.com/a13xp0p0v/kernel-hardening-checker/issues/186 +## +## https://github.com/Kicksecure/security-misc/pull/334 +## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/609 +## https://forums.whonix.org/t/how-to-compress-and-prevent-vdi-from-ballooning-after-each-update-deleting-large-files/22675/9 +## https://forums.kicksecure.com/t/resizing-disk-for-guest-in-kvm/1657 +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX bdev_allow_write_mounted=0" + +## Enable AMD Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV). +## SME encrypts memory with a single key at the kernel level to protect against cold boot attacks. +## SEV extends SME to VMs by encrypting the memory of each with a unique key for guest isolation. +## SEV-ES (Encrypted State) extends SEV by encrypting each guests virtual CPU register state during VM exits. +## SEV-SNP (Secure Nested Paging) extends SEV by activating hardware-level memory integrity. +## This is hardware-based encryption managed by the proprietary and closed-source AMD Platform Security Processor (PSP). +## Both require a compatible AMD CPU and support for SME to first be enabled in the BIOS/UEFI. +## Likely unavailable in consumer-grade AMD CPUs where Transparent SME (TSME) can be enabled in the BIOS/UEFI to achieve SME. +## Note the corresponding Intel Total Memory Encryption (TME) can also be enabled via the BIOS/UEFI. +## May cause boot failure on certain hardware with incompatible DMA masks especially if IOMMU is disabled. +## +## https://www.kernel.org/doc/html/next/x86/amd-memory-encryption.html +## https://docs.kernel.org/virt/kvm/x86/amd-memory-encryption.html +## https://docs.amd.com/v/u/en-US/memory-encryption-white-paper +## https://docs.amd.com/v/u/en-US/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more +## https://github.com/AMDESE/AMDSEV +## https://en.wikichip.org/wiki/x86/sme +## https://lore.kernel.org/all/YWRgN63FOrQGO8jS@zn.tnic/ +## https://lore.kernel.org/lkml/YWvy9bSRaC+m1sV+@zn.tnic/T/#m01bcb37040b6b0d119d385d9a34b9c7ac4ce5f84 +## https://mricher.fr/post/amd-memory-encryption/ +## https://www.kicksecure.com/wiki/Dev/confidential_computing#AMD +## https://github.com/secureblue/secureblue/pull/1631#issuecomment-3655501478 +## https://forums.whonix.org/t/enable-secure-memory-encryption-sme-kernel-parameter-mem-encrypt-by-default/10393 +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mem_encrypt=on" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev=1" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_es=1" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_snp=1" + +## 2. Direct Memory Access: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#dma-attacks + +## Enable CPU manufacturer-specific IOMMU drivers to mitigate some DMA attacks. +## +## KSPP=yes +## KSPP sets CONFIG_INTEL_IOMMU=y, CONFIG_INTEL_IOMMU_DEFAULT_ON=y, CONFIG_INTEL_IOMMU_SVM=y, CONFIG_AMD_IOMMU=y, and CONFIG_AMD_IOMMU_V2=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX amd_iommu=force_isolation" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on" + +## Enable and force use of IOMMU translation to protect against some DMA attacks. +## Strictly force DMA unmap operations to synchronously invalidate IOMMU hardware TLBs. +## Ensures devices will never be able to access stale data contents. +## +## https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit +## https://en.wikipedia.org/wiki/DMA_attack +## https://lenovopress.lenovo.com/lp1467.pdf +## https://www.kb.cert.org/vuls/id/382314 +## +## KSPP=yes +## KSPP sets the kernel parameters, CONFIG_IOMMU_SUPPORT=y, CONFIG_IOMMU_DEFAULT_DMA_STRICT=y, and does not set CONFIG_IOMMU_DEFAULT_PASSTHROUGH. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu=force" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu.passthrough=0" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX iommu.strict=1" + +## Clear the busmaster bit on all PCI bridges during the EFI hand-off. +## Terminates all existing DMA transactions prior to the kernel's IOMMU setup. +## Forces third party PCI devices to then re-set their busmaster bit in order to perform DMA. +## Assumes that the motherboard chipset and firmware are not malicious. +## May cause complete boot failure on certain hardware with incompatible firmware. +## +## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94 +## https://mjg59.dreamwidth.org/54433.html +## +## KSPP=yes +## KSPP sets CONFIG_EFI_DISABLE_PCI_DMA=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma" + +## 3. Entropy: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#rdrand + +## Do not credit the CPU seeds as an entropy sources at boot. +## The RDRAND and RDSEED CPU (RNG) instructions are proprietary and closed-source. +## Numerous implementations of RDRAND and RDSEED have a long history of being defective. +## Maximizing the entropy pool at boot is desirable for all cryptographic operations. +## This ensures additional entropy is obtained from other sources to initialize the Linux CRNG. +## Note that distrusting this (relatively fast) source of entropy will increase boot time. +## +## https://en.wikipedia.org/wiki/RDRAND +## https://systemd.io/RANDOM_SEEDS/ +## https://www.kicksecure.com/wiki/Dev/Entropy#RDRAND +## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html +## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566 +## https://lkml.org/lkml/2022/6/5/271 +## https://lwn.net/Articles/961121/ +## https://lore.kernel.org/lkml/aPFDn-4Cm6n0_3_e@gourry-fedora-PF4VCD3F/ +## https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7055.html +## +## KSPP=yes +## KSPP sets CONFIG_RANDOM_TRUST_CPU=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off" + +## Do not credit the bootloader seeds as an entropy source at boot. +## The RNG seed passed by the bootloader could potentially be tampered. +## Maximizing the entropy pool at boot is desirable for all cryptographic operations. +## This ensures additional entropy is obtained from other sources to initialize the Linux CRNG. +## Note that distrusting this (relatively fast) source of entropy will increase boot time. +## +## https://systemd.io/RANDOM_SEEDS/ +## https://github.com/NixOS/nixpkgs/pull/165355 +## https://lkml.org/lkml/2022/6/5/271 +## +## KSPP=yes +## KSPP sets CONFIG_RANDOM_TRUST_BOOTLOADER=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_bootloader=off" + +## Obtain more entropy during boot as the runtime memory allocator is being initialized. +## Entropy will be extracted from up to the first 4GB of RAM as another source. +## Note that entropy extracted this way is not cryptographically secure and so is not credited. +## Maximizing the entropy pool at boot is desirable for all cryptographic operations. +## This will increase boot time due to interrupting the boot process. +## Requires the linux-hardened kernel patch. +## +## https://www.kicksecure.com/wiki/Hardened-kernel#linux-hardened +## https://github.com/anthraxx/linux-hardened/commit/c3e7df1dba1eb8105d6d5143079a6a0ad9e9ebc7 +## https://github.com/anthraxx/linux-hardened/commit/a04458f97fe1f7e95888c77c0165b646375db9c4 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy" + +## 4. Networking +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-boot-parameters + +## Disable the entire IPv6 stack functionality. +## Removes attack surface associated with the IPv6 module. +## +## https://docs.kernel.org/networking/ipv6.html +## https://wiki.archlinux.org/title/IPv6#Disable_IPv6 +## +## Enabling makes redundant many network hardening sysctl's in /usr/lib/sysctl.d/990-security-misc.conf. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ipv6.disable=1" diff --git a/etc/default/grub.d/40_remount_secure.cfg#security-misc-shared b/etc/default/grub.d/40_remount_secure.cfg#security-misc-shared new file mode 100644 index 00000000..c3cc30a7 --- /dev/null +++ b/etc/default/grub.d/40_remount_secure.cfg#security-misc-shared @@ -0,0 +1,31 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Remount Secure provides enhanced security via mount options: +## https://www.kicksecure.com/wiki/Security-misc#Remount_Secure + +## Option A (No Security): +## Disable Remount Secure. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=0" + +## Option B (Low Security): +## Re-mount with nodev and nosuid only. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1" + +## Option C (Medium Security): +## Re-mount with nodev, nosuid, and noexec for most mount points, excluding /home. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=2" + +## Option D (Highest Security): +## Re-mount with nodev, nosuid, and noexec for all mount points including /home. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=3" diff --git a/etc/default/grub.d/40_signed_modules.cfg#security-misc-shared b/etc/default/grub.d/40_signed_modules.cfg#security-misc-shared new file mode 100644 index 00000000..36af7f33 --- /dev/null +++ b/etc/default/grub.d/40_signed_modules.cfg#security-misc-shared @@ -0,0 +1,37 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Require every kernel module to be signed before being loaded. +## Any module that is unsigned or signed with an invalid key cannot be loaded. +## This prevents all out-of-tree kernel modules unless signed. +## This makes it harder to load a malicious module. +## +## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/61 +## https://github.com/dell/dkms/issues/359 +## +## KSPP=yes +## KSPP sets CONFIG_MODULE_SIG=y, CONFIG_MODULE_SIG_FORCE=y, and CONFIG_MODULE_SIG_ALL=y. +## +## Not enabled by default yet due to several issues. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX module.sig_enforce=1" + +## Enable kernel lockdown to enforce security boundary between user and kernel space. +## Confidentiality mode enforces module signature verification. +## +## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880 +## +## KSPP=yes +## KSPP sets CONFIG_SECURITY_LOCKDOWN_LSM=y, CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y, and CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y. +## +## Not enabled by default yet due to several issues. +## +#if dpkg --compare-versions "${kver}" ge "5.4"; then +# GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality" +#fi diff --git a/etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared b/etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared new file mode 100644 index 00000000..21b73f5b --- /dev/null +++ b/etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared @@ -0,0 +1,35 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Some default configuration files automatically include the "quiet" parameter. +## Therefore, first remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT since "quiet" must be first. +## str_replace is provided by package helper-scripts. +## +## https://github.com/Kicksecure/security-misc/pull/233#issuecomment-2228792461 +## +GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | str_replace "quiet" "")" + +## Prevent sensitive kernel information leaks in the console during boot. +## Must be used in combination with the kernel.printk sysctl. +## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation. +## +## https://docs.kernel.org/core-api/printk-basics.html +## https://wiki.archlinux.org/title/silent_boot +## +## For easier debugging, these are not applied to the recovery boot option. +## Switch the pair of commands to universally apply parameters to all boot options. +## +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT loglevel=0" +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT quiet" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX loglevel=0" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX quiet" + +## For Increased Log Verbosity: +## Adjust (or comment out) the kernel.printk sysctl in /usr/lib/sysctl.d/30_silent-kernel-printk.conf. +## Alternatively, installing the debug-misc package will undo these settings. diff --git a/etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared b/etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared new file mode 100644 index 00000000..5da19e7e --- /dev/null +++ b/etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Disable access to the GRUB single-user (recovery) mode menu entries. +## +## https://forums.kicksecure.com/t/remove-linux-recovery-mode-boot-option-from-default-grub-boot-menu/727 +## +GRUB_DISABLE_RECOVERY="true" + +## Disable access to Dracut's recovery console. +## Prevents the emergency shell from starting automatically during boot failures. +## +## https://insinuator.net/2025/07/insecure-boot-injecting-initramfs-from-a-debug-shell/ +## https://serverfault.com/questions/554853/how-can-i-secure-the-dracut-shell +## https://forums.kicksecure.com/t/harden-dracut-initramfs-generator-by-disabling-recovery-console/724 +## +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.emergency=halt" +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.shell=0" diff --git a/etc/dracut.conf.d/30-security-misc.conf#security-misc-shared b/etc/dracut.conf.d/30-security-misc.conf#security-misc-shared new file mode 100644 index 00000000..5b3c7b5a --- /dev/null +++ b/etc/dracut.conf.d/30-security-misc.conf#security-misc-shared @@ -0,0 +1,7 @@ +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +reproducible=yes + +## Debugging. +#show_modules=yes diff --git a/etc/gitconfig#security-misc-shared b/etc/gitconfig#security-misc-shared new file mode 100644 index 00000000..c7a8c5d8 --- /dev/null +++ b/etc/gitconfig#security-misc-shared @@ -0,0 +1,40 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Lines starting with a hash symbol ('#') are comments. +## https://github.com/Kicksecure/security-misc/issues/225 + +[core] + ## https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm + symlinks = false + + #hooksPath = /home/user/.config/git/hooks + +## https://forums.whonix.org/t/git-users-enable-fsck-by-default-for-better-security/2066 +[transfer] + fsckobjects = true +[fetch] + fsckobjects = true +[receive] + fsckobjects = true + +## Generally a good idea but too intrusive to enable by default. +## Listed here as suggestions what users should put into their ~/.gitconfig +## file. + +## Not enabled by default because it requires essential knowledge about OpenPGP +## and an already existing local signing key. Otherwise would prevent all new +## commits. +#[commit] +# gpgsign = true + +## Not enabled by default because it would break the 'git merge' command for +## unsigned commits and require the '--no-verify-signature' command line +## option. +#[merge] +# verifySignatures = true + +## Not enabled by default because it would break for users who are not having +## an account at the git server and having added a SSH public key. +#[url "ssh://git@github.com/"] +# insteadOf = https://github.com/ diff --git a/etc/hide-hardware-info.d/30_default.conf b/etc/hide-hardware-info.d/30_default.conf deleted file mode 100644 index 8c9ee9a6..00000000 --- a/etc/hide-hardware-info.d/30_default.conf +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Disable the /sys whitelist. -#sysfs_whitelist=0 - -## Disable the /proc/cpuinfo whitelist. -#cpuinfo_whitelist=0 diff --git a/etc/hide-hardware-info.d/30_default.conf#security-misc-shared b/etc/hide-hardware-info.d/30_default.conf#security-misc-shared new file mode 100644 index 00000000..d1bc221c --- /dev/null +++ b/etc/hide-hardware-info.d/30_default.conf#security-misc-shared @@ -0,0 +1,15 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Disable the /sys whitelist. +#sysfs_whitelist=0 + +## Disable the /proc/cpuinfo whitelist. +#cpuinfo_whitelist=0 + +## Disable /sys hardening. +#sysfs=0 + +## Disable selinux mode. +## https://www.kicksecure.com/wiki/Security-misc#selinux +#selinux=0 diff --git a/etc/initramfs-tools/hooks/sysctl-initramfs b/etc/initramfs-tools/hooks/sysctl-initramfs deleted file mode 100755 index d091ca8b..00000000 --- a/etc/initramfs-tools/hooks/sysctl-initramfs +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -PREREQ="" -prereqs() -{ - echo "$PREREQ" -} -case $1 in -prereqs) - prereqs - exit 0 - ;; -esac - -. /usr/share/initramfs-tools/hook-functions -copy_exec /sbin/sysctl /sbin diff --git a/etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs b/etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs deleted file mode 100755 index 71e82f49..00000000 --- a/etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -PREREQ="" -prereqs() -{ - echo "$PREREQ" -} -case $1 in -prereqs) - prereqs - exit 0 - ;; -esac - -sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null -sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null - -true diff --git a/etc/kernel/postinst.d/30_remove-system-map b/etc/kernel/postinst.d/30_remove-system-map deleted file mode 100755 index fc4a6048..00000000 --- a/etc/kernel/postinst.d/30_remove-system-map +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -if test -x /usr/lib/security-misc/remove-system.map ; then - /usr/lib/security-misc/remove-system.map -fi diff --git a/etc/kernel/postinst.d/30_remove-system-map#security-misc-shared b/etc/kernel/postinst.d/30_remove-system-map#security-misc-shared new file mode 100755 index 00000000..e2d1228d --- /dev/null +++ b/etc/kernel/postinst.d/30_remove-system-map#security-misc-shared @@ -0,0 +1,15 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +if test -x /usr/libexec/security-misc/remove-system.map ; then + /usr/libexec/security-misc/remove-system.map +fi diff --git a/etc/modprobe.d/30_security-misc.conf b/etc/modprobe.d/30_security-misc.conf deleted file mode 100644 index a43a60bd..00000000 --- a/etc/modprobe.d/30_security-misc.conf +++ /dev/null @@ -1,54 +0,0 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://phabricator.whonix.org/T486 -options nf_conntrack nf_conntrack_helper=0 - -# Blacklists bluetooth to reduce attack surface. -# Bluetooth also has a history of security vulnerabilities: -# -# https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns -install bluetooth /bin/false -install btusb /bin/false - -# Blacklist thunderbolt and firewire to prevent some DMA attacks. -install firewire-core /bin/false -install thunderbolt /bin/false - -# Blacklist CPU MSRs as they can be abused to write to -# arbitrary memory. -install msr /bin/false - -# Disables unneeded network protocols that will likely not be used as these may have unknown vulnerabilties. -# -# Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these. -# -# > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users. -# -# > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record. -# -install dccp /bin/false -install sctp /bin/false -install rds /bin/false -install tipc /bin/false -install n-hdlc /bin/false -install ax25 /bin/false -install netrom /bin/false -install x25 /bin/false -install rose /bin/false -install decnet /bin/false -install econet /bin/false -install af_802154 /bin/false -install ipx /bin/false -install appletalk /bin/false -install psnap /bin/false -install p8023 /bin/false -install p8022 /bin/false - -## Blacklists the vivid kernel module as it's only required for -## testing and has been the cause of multiple vulnerabilities. -## -## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233 -## https://www.openwall.com/lists/oss-security/2019/11/02/1 -## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 -install vivid /bin/false diff --git a/etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared b/etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared new file mode 100644 index 00000000..f3bd87bf --- /dev/null +++ b/etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared @@ -0,0 +1,59 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## See the following links for a community discussion and overview regarding the selections. +## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989 +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules + +## Blacklisting prevents kernel modules from automatically starting. +## Disabling prohibits kernel modules from starting. + +## CD-ROM/DVD: +## Blacklist CD-ROM and DVD modules. +## Not disabled by default due to potential future ISO plans. +## Can uncomment the bottom pair to disable both modules. +## +## https://nvd.nist.gov/vuln/detail/CVE-2018-11506 +## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31 +## +blacklist cdrom +blacklist sr_mod +#install cdrom /usr/bin/disabled-cdrom-by-security-misc +#install sr_mod /usr/bin/disabled-cdrom-by-security-misc + +## Miscellaneous: + +## GrapheneOS: +## Partial selection of their infrastructure blacklist. +## Duplicate and already disabled modules have been omitted. +## Currently snd_intel8x0 is required by some users for VirtualBox audio device ICH AC97. +## +## https://github.com/GrapheneOS/infrastructure/tree/main/etc/modprobe.d +## https://www.kicksecure.com/wiki/Dev/audio +## https://github.com/Kicksecure/security-misc/issues/271 +## +#blacklist cfg80211 +#blacklist intel_agp +#blacklist ip_tables +#blacklist mousedev +#blacklist psmouse +#blacklist snd_intel8x0 +#blacklist tls +#blacklist virtio_balloon +#blacklist virtio_console + +## Ubuntu: +## Already disabled modules have been omitted. +## +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-ath_pci.conf?h=ubuntu/disco +## +blacklist amd76x_edac +blacklist ath_pci +blacklist evbug +blacklist pcspkr +blacklist snd_aw2 +blacklist snd_intel8x0m +blacklist snd_pcsp +blacklist usbkbd +blacklist usbmouse diff --git a/etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared b/etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared new file mode 100644 index 00000000..7c51595e --- /dev/null +++ b/etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared @@ -0,0 +1,13 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Conntrack: +## Disable Netfilter's automatic connection tracking helper assignment. +## This functionality adds unnecessary features, such as IRC protocol parsing, into the kernel. +## Disabling it reduces the kernel attack surface and improves security. +## +## https://conntrack-tools.netfilter.org/manual.html +## https://home.regit.org/netfilter-en/secure-use-of-helpers/ +## https://forums.whonix.org/t/disable-conntrack-helper/18917 +## +options nf_conntrack nf_conntrack_helper=0 diff --git a/etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared b/etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared new file mode 100644 index 00000000..4396c473 --- /dev/null +++ b/etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared @@ -0,0 +1,356 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## See the following links for a community discussion and overview regarding the selections: +## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989 +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules + +## Blacklisting prevents kernel modules from automatically starting. +## Disabling prohibits kernel modules from starting. + +## This configuration file is split into 4 sections: +## 1. Hardware +## 2. File Systems +## 3. Networking +## 4. Miscellaneous + +## 1. Hardware: + +## Bluetooth: +## Disable Bluetooth to reduce the attack surface due to its long history of security vulnerabilities. +## Replaced with a privacy and security preserving default Bluetooth configuration for better usability. +## +## https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns +## https://github.com/Kicksecure/security-misc/pull/145 +## +#install bluetooth /usr/bin/disabled-bluetooth-by-security-misc +#install bluetooth_6lowpan /usr/bin/disabled-bluetooth-by-security-misc +#install bt3c_cs /usr/bin/disabled-bluetooth-by-security-misc +#install btbcm /usr/bin/disabled-bluetooth-by-security-misc +#install btintel /usr/bin/disabled-bluetooth-by-security-misc +#install btmrvl /usr/bin/disabled-bluetooth-by-security-misc +#install btmrvl_sdio /usr/bin/disabled-bluetooth-by-security-misc +#install btmtk /usr/bin/disabled-bluetooth-by-security-misc +#install btmtksdio /usr/bin/disabled-bluetooth-by-security-misc +#install btmtkuart /usr/bin/disabled-bluetooth-by-security-misc +#install btnxpuart /usr/bin/disabled-bluetooth-by-security-misc +#install btqca /usr/bin/disabled-bluetooth-by-security-misc +#install btrsi /usr/bin/disabled-bluetooth-by-security-misc +#install btrtl /usr/bin/disabled-bluetooth-by-security-misc +#install btsdio /usr/bin/disabled-bluetooth-by-security-misc +#install btusb /usr/bin/disabled-bluetooth-by-security-misc +#install virtio_bt /usr/bin/disabled-bluetooth-by-security-misc + +## CPU Model-Specific Registers (MSRs): +## User-level read access to MSRs can allow malicious unprivileged applications to access other trust domains. +## MSRs can also be abused to write to arbitrary memory. +## +## https://en.wikipedia.org/wiki/Model-specific_register +## https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/running-average-power-limit-energy-reporting.html +## https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/reading-writing-msrs-in-linux.html +## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode +## https://github.com/Kicksecure/security-misc/issues/215 +## +#install intel_rapl_msr /usr/bin/disabled-cpumsr-by-security-misc +#install isst_if_mbox_msr /usr/bin/disabled-cpumsr-by-security-misc +#install msr /usr/bin/disabled-cpumsr-by-security-misc + +## FireWire (IEEE 1394): +## Disable IEEE 1394 (FireWire/i.LINK/Lynx) modules to prevent certain DMA attacks. +## +## https://en.wikipedia.org/wiki/IEEE_1394#Security_issues +## +install dv1394 /usr/bin/disabled-firewire-by-security-misc +install firewire-core /usr/bin/disabled-firewire-by-security-misc +install firewire-ohci /usr/bin/disabled-firewire-by-security-misc +install firewire-net /usr/bin/disabled-firewire-by-security-misc +install firewire-sbp2 /usr/bin/disabled-firewire-by-security-misc +install ohci1394 /usr/bin/disabled-firewire-by-security-misc +install raw1394 /usr/bin/disabled-firewire-by-security-misc +install sbp2 /usr/bin/disabled-firewire-by-security-misc +install video1394 /usr/bin/disabled-firewire-by-security-misc + +## Global Positioning Systems (GPS): +## Disable GPS-related modules like GNSS (Global Navigation Satellite System). +## +install garmin_gps /usr/bin/disabled-gps-by-security-misc +install gnss /usr/bin/disabled-gps-by-security-misc +install gnss-mtk /usr/bin/disabled-gps-by-security-misc +install gnss-serial /usr/bin/disabled-gps-by-security-misc +install gnss-sirf /usr/bin/disabled-gps-by-security-misc +install gnss-ubx /usr/bin/disabled-gps-by-security-misc +install gnss-usb /usr/bin/disabled-gps-by-security-misc + +## Intel Management Engine (ME): +## Partially disable the Intel ME interface with the OS. +## ME functionality has increasingly become intertwined with basic Intel system operation. +## Disabling it may lead to breakages in various components without clear debugging/error messages. +## It may affect firmware updates, security, power management, display, and DRM. +## +## https://docs.kernel.org/driver-api/mei/mei.html +## https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities +## https://www.kicksecure.com/wiki/Out-of-band_Management_Technology#Intel_ME_Disabling_Disadvantages +## https://github.com/Kicksecure/security-misc/pull/236#issuecomment-2229092813 +## https://github.com/Kicksecure/security-misc/issues/239 +## +#install mei /usr/bin/disabled-intelme-by-security-misc +#install mei-gsc /usr/bin/disabled-intelme-by-security-misc +#install mei_gsc_proxy /usr/bin/disabled-intelme-by-security-misc +#install mei_hdcp /usr/bin/disabled-intelme-by-security-misc +#install mei-me /usr/bin/disabled-intelme-by-security-misc +#install mei_phy /usr/bin/disabled-intelme-by-security-misc +#install mei_pxp /usr/bin/disabled-intelme-by-security-misc +#install mei-txe /usr/bin/disabled-intelme-by-security-misc +#install mei-vsc /usr/bin/disabled-intelme-by-security-misc +#install mei-vsc-hw /usr/bin/disabled-intelme-by-security-misc +#install mei_wdt /usr/bin/disabled-intelme-by-security-misc +#install microread_mei /usr/bin/disabled-intelme-by-security-misc + +## Intel Platform Monitoring Technology (PMT) Telemetry: +## Disable certain functionalities of the Intel PMT components. +## +## https://www.intel.com/content/www/us/en/content-details/710389/intel-platform-monitoring-technology-intel-pmt-technical-specification.html +## https://github.com/intel/Intel-PMT +## +install pmt_class /usr/bin/disabled-intelpmt-by-security-misc +install pmt_crashlog /usr/bin/disabled-intelpmt-by-security-misc +install pmt_telemetry /usr/bin/disabled-intelpmt-by-security-misc + +## Thunderbolt: +## Disable Thunderbolt modules to prevent certain DMA attacks. +## +## https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Security_vulnerabilities +## +install intel-wmi-thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc +install thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc +install thunderbolt_net /usr/bin/disabled-thunderbolt-by-security-misc + +## 2. File Systems: + +## File Systems: +## Disable uncommon file systems to reduce attack surface. +## HFS/HFS+ are legacy Apple file systems that may be required depending on the EFI partition format. +## +## https://docs.kernel.org/filesystems/index.html +## https://github.com/secureblue/secureblue/tree/live/files/system/usr/lib/modprobe.d +## +install adfs /usr/bin/disabled-filesys-by-security-misc +install affs /usr/bin/disabled-filesys-by-security-misc +install afs /usr/bin/disabled-filesys-by-security-misc +install befs /usr/bin/disabled-filesys-by-security-misc +install ceph /usr/bin/disabled-filesys-by-security-misc +install coda /usr/bin/disabled-filesys-by-security-misc +install cramfs /usr/bin/disabled-filesys-by-security-misc +install ecryptfs /usr/bin/disabled-filesys-by-security-misc +install freevxfs /usr/bin/disabled-filesys-by-security-misc +install hfs /usr/bin/disabled-filesys-by-security-misc +install hfsplus /usr/bin/disabled-filesys-by-security-misc +install jffs2 /usr/bin/disabled-filesys-by-security-misc +install jfs /usr/bin/disabled-filesys-by-security-misc +install kafs /usr/bin/disabled-filesys-by-security-misc +install minix /usr/bin/disabled-filesys-by-security-misc +install nilfs2 /usr/bin/disabled-filesys-by-security-misc +install ocfs2 /usr/bin/disabled-filesys-by-security-misc +install orangefs /usr/bin/disabled-filesys-by-security-misc +install reiserfs /usr/bin/disabled-filesys-by-security-misc +install romfs /usr/bin/disabled-filesys-by-security-misc +install sysv /usr/bin/disabled-filesys-by-security-misc +install ubifs /usr/bin/disabled-filesys-by-security-misc +install udf /usr/bin/disabled-filesys-by-security-misc +install ufs /usr/bin/disabled-filesys-by-security-misc +install zonefs /usr/bin/disabled-filesys-by-security-misc + +## Network File Systems: +## Disable uncommon network file systems to reduce attack surface. +## Currently 9p is required for KVM shared folders in Whonix. +## +## https://www.whonix.org/wiki/KVM#Shared_Folder +## +#install 9p /usr/bin/disabled-netfilesys-by-security-misc +install gfs2 /usr/bin/disabled-netfilesys-by-security-misc +install ksmbd /usr/bin/disabled-netfilesys-by-security-misc + +## Network File System - Common Internet File System (CIFS): +## +install cifs /usr/bin/disabled-netfilesys-by-security-misc +install cifs_arc4 /usr/bin/disabled-netfilesys-by-security-misc +install cifs_md4 /usr/bin/disabled-netfilesys-by-security-misc + +## Network File System - Network File System (NFS): +## +install nfs /usr/bin/disabled-netfilesys-by-security-misc +install nfs_acl /usr/bin/disabled-netfilesys-by-security-misc +install nfs_layout_nfsv41_files /usr/bin/disabled-netfilesys-by-security-misc +install nfs_layout_flexfiles /usr/bin/disabled-netfilesys-by-security-misc +install nfsd /usr/bin/disabled-netfilesys-by-security-misc +install nfsv2 /usr/bin/disabled-netfilesys-by-security-misc +install nfsv3 /usr/bin/disabled-netfilesys-by-security-misc +install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc + +## 3. Networking: + +## Network Protocols: +## Disable rare and unneeded network protocols that are a common source of unknown vulnerabilities. +## Previously had blacklisted eepro100 and eth1394. +## +## https://tails.boum.org/blueprint/blacklist_modules/ +## https://fedoraproject.org/wiki/Security_Features_Matrix#Blacklist_Rare_Protocols +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-rare-network.conf?h=ubuntu/disco +## https://github.com/Kicksecure/security-misc/pull/234#issuecomment-2230732015 +## +install af_802154 /usr/bin/disabled-network-by-security-misc +install appletalk /usr/bin/disabled-network-by-security-misc +install ax25 /usr/bin/disabled-network-by-security-misc +install decnet /usr/bin/disabled-network-by-security-misc +install dccp /usr/bin/disabled-network-by-security-misc +install econet /usr/bin/disabled-network-by-security-misc +install eepro100 /usr/bin/disabled-network-by-security-misc +install eth1394 /usr/bin/disabled-network-by-security-misc +install ipx /usr/bin/disabled-network-by-security-misc +install n-hdlc /usr/bin/disabled-network-by-security-misc +install netrom /usr/bin/disabled-network-by-security-misc +install p8022 /usr/bin/disabled-network-by-security-misc +install p8023 /usr/bin/disabled-network-by-security-misc +install psnap /usr/bin/disabled-network-by-security-misc +install rose /usr/bin/disabled-network-by-security-misc +install x25 /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Asynchronous Transfer Mode (ATM): +## +install atm /usr/bin/disabled-network-by-security-misc +install ueagle-atm /usr/bin/disabled-network-by-security-misc +install usbatm /usr/bin/disabled-network-by-security-misc +install xusbatm /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Controller Area Network (CAN): +## +install c_can /usr/bin/disabled-network-by-security-misc +install c_can_pci /usr/bin/disabled-network-by-security-misc +install c_can_platform /usr/bin/disabled-network-by-security-misc +install can /usr/bin/disabled-network-by-security-misc +install can-bcm /usr/bin/disabled-network-by-security-misc +install can-dev /usr/bin/disabled-network-by-security-misc +install can-gw /usr/bin/disabled-network-by-security-misc +install can-isotp /usr/bin/disabled-network-by-security-misc +install can-raw /usr/bin/disabled-network-by-security-misc +install can-j1939 /usr/bin/disabled-network-by-security-misc +install can327 /usr/bin/disabled-network-by-security-misc +install ifi_canfd /usr/bin/disabled-network-by-security-misc +install janz-ican3 /usr/bin/disabled-network-by-security-misc +install m_can /usr/bin/disabled-network-by-security-misc +install m_can_pci /usr/bin/disabled-network-by-security-misc +install m_can_platform /usr/bin/disabled-network-by-security-misc +install phy-can-transceiver /usr/bin/disabled-network-by-security-misc +install slcan /usr/bin/disabled-network-by-security-misc +install ucan /usr/bin/disabled-network-by-security-misc +install vxcan /usr/bin/disabled-network-by-security-misc +install vcan /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Transparent Inter Process Communication (TIPC): +## +install tipc /usr/bin/disabled-network-by-security-misc +install tipc_diag /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Reliable Datagram Sockets (RDS): +## +install rds /usr/bin/disabled-network-by-security-misc +install rds_rdma /usr/bin/disabled-network-by-security-misc +install rds_tcp /usr/bin/disabled-network-by-security-misc + +## Network Protocol - Stream Control Transmission Protocol (SCTP): +## +install sctp /usr/bin/disabled-network-by-security-misc +install sctp_diag /usr/bin/disabled-network-by-security-misc + +## 4. Miscellaneous: + +## Amateur Radios: +## +install hamradio /usr/bin/disabled-miscellaneous-by-security-misc + +## Floppy Disks: +## +install floppy /usr/bin/disabled-miscellaneous-by-security-misc + +## Framebuffer (fbdev): +## Video drivers are known to be buggy, cause kernel panics, and are generally only used by legacy devices. +## These were all previously blacklisted. +## +## https://docs.kernel.org/fb/index.html +## https://en.wikipedia.org/wiki/Linux_framebuffer +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco +## +install aty128fb /usr/bin/disabled-framebuffer-by-security-misc +install atyfb /usr/bin/disabled-framebuffer-by-security-misc +install cirrusfb /usr/bin/disabled-framebuffer-by-security-misc +install cyber2000fb /usr/bin/disabled-framebuffer-by-security-misc +install cyblafb /usr/bin/disabled-framebuffer-by-security-misc +install gx1fb /usr/bin/disabled-framebuffer-by-security-misc +install hgafb /usr/bin/disabled-framebuffer-by-security-misc +install i810fb /usr/bin/disabled-framebuffer-by-security-misc +install intelfb /usr/bin/disabled-framebuffer-by-security-misc +install kyrofb /usr/bin/disabled-framebuffer-by-security-misc +install lxfb /usr/bin/disabled-framebuffer-by-security-misc +install matroxfb_base /usr/bin/disabled-framebuffer-by-security-misc +install neofb /usr/bin/disabled-framebuffer-by-security-misc +install nvidiafb /usr/bin/disabled-framebuffer-by-security-misc +install pm2fb /usr/bin/disabled-framebuffer-by-security-misc +install radeonfb /usr/bin/disabled-framebuffer-by-security-misc +install rivafb /usr/bin/disabled-framebuffer-by-security-misc +install s1d13xxxfb /usr/bin/disabled-framebuffer-by-security-misc +install savagefb /usr/bin/disabled-framebuffer-by-security-misc +install sisfb /usr/bin/disabled-framebuffer-by-security-misc +install sstfb /usr/bin/disabled-framebuffer-by-security-misc +install tdfxfb /usr/bin/disabled-framebuffer-by-security-misc +install tridentfb /usr/bin/disabled-framebuffer-by-security-misc +install vesafb /usr/bin/disabled-framebuffer-by-security-misc +install vfb /usr/bin/disabled-framebuffer-by-security-misc +install viafb /usr/bin/disabled-framebuffer-by-security-misc +install vt8623fb /usr/bin/disabled-framebuffer-by-security-misc +install udlfb /usr/bin/disabled-framebuffer-by-security-misc + +## Joysticks: +## +## https://docs.kernel.org/input/joydev/joystick.html +## +install joydev /usr/bin/disabled-miscellaneous-by-security-misc + +## Replaced Modules: +## These legacy drivers have all been entirely replaced and superseded by newer drivers. +## Many of these were previously blacklisted. +## +## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco +## +install asus_acpi /usr/bin/disabled-miscellaneous-by-security-misc +install bcm43xx /usr/bin/disabled-miscellaneous-by-security-misc +install brcm80211 /usr/bin/disabled-miscellaneous-by-security-misc +install de4x5 /usr/bin/disabled-miscellaneous-by-security-misc +install prism54 /usr/bin/disabled-miscellaneous-by-security-misc + +## RNDIS: +## Disable as believed to have unfixable buffer overflow issues impossible to make secure. +## Used by some network devices common with Android USB tethering. +## +## https://en.wikipedia.org/wiki/RNDIS +## https://lkml.org/lkml/2022/11/23/728 +## https://lore.kernel.org/lkml/2023071333-wildly-playroom-878b@gregkh/ +## +install rndis_host /usr/bin/disabled-miscellaneous-by-security-misc +install usb_f_rndis /usr/bin/disabled-miscellaneous-by-security-misc + +## USB Video Device Class: +## Disable the USB-based video streaming driver for devices like some webcams and digital camcorders. +## +#install uvcvideo /usr/bin/disabled-miscellaneous-by-security-misc + +## Vivid: +## Disable the vivid kernel module since it has been the cause of multiple vulnerabilities. +## Required only for running tests associated with the Qubes Video Companion. +## +## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233 +## https://www.openwall.com/lists/oss-security/2019/11/02/1 +## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 +## https://forums.whonix.org/t/testing-qubes-video-companion-on-whonix/21393 +## https://github.com/Kicksecure/security-misc/issues/298 +## +#install vivid /usr/bin/disabled-miscellaneous-by-security-misc diff --git a/etc/permission-hardening.d/30_default.conf b/etc/permission-hardening.d/30_default.conf deleted file mode 100644 index 1d0e0dfe..00000000 --- a/etc/permission-hardening.d/30_default.conf +++ /dev/null @@ -1,146 +0,0 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardening.d/20_user.conf" or -## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## File permission hardening. -## -## Syntax: -## [filename] [mode] [owner] [group] [capability] -## -## To remove all SUID/SGID binaries in a directory, you can use the "nosuid" -## argument. - -## TODO: white spaces inside file name untested and probably will not work. - -###################################################################### -# SUID disablewhitelist -###################################################################### - -## disablewhitelist disables below (or in lexically higher) files -## exactwhitelist and matchwhitelist. Add these here (discouraged) or better -## in file "/etc/permission-hardening.d/20_user.conf". - -## For example, if you are not using SELinux the following might make sense to -## enable. TODO: research -#/utempter/utempter disablewhitelist - -## If you are not going to use AppImages such as electrum Bitcoin wallet. -#/fusermount disablewhitelist - -###################################################################### -# SUID exact match whitelist -###################################################################### - -/usr/bin/sudo exactwhitelist -/bin/sudo exactwhitelist -/usr/bin/bwrap exactwhitelist -/bin/bwrap exactwhitelist -/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper exactwhitelist -/usr/lib/chromium/chrome-sandbox exactwhitelist - -## https://forums.whonix.org/t/disable-suid-binaries/7706/61 -## Protect from 'chmod -x' (and SUID removal). -## SUID will be removed below in separate step. -/bin/mount exactwhitelist -/usr/bin/mount exactwhitelist - -## There is a controversy about firejail but those who choose to install it -## should be able to use it. -## https://www.whonix.org/wiki/Dev/Firejail#Security -/usr/bin/firejail exactwhitelist - -## In case you need to use 'su'. See also: -## https://www.whonix.org/wiki/root#su -#/bin/su exactwhitelist -#/usr/bin/su exactwhitelist - -###################################################################### -# SUID exact match whitelist -###################################################################### - -## https://manpages.debian.org/buster/xserver-xorg-legacy/Xorg.wrap.1.en.html -## https://lwn.net/Articles/590315/ -## http://forums.whonix.org/t/permission-hardening/8655/25 -#/usr/lib/xorg/Xorg.wrap whitelist - -###################################################################### -# SUID regex match whitelist - research required -###################################################################### - -/usr/lib/virtualbox/ matchwhitelist - -## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c -## match both: -#/usr/lib/qubes/qfile-unpacker whitelist -#/lib/qubes/qfile-unpacker -/qubes/qfile-unpacker matchwhitelist - -## match both: -#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist -#/lib/policykit-1/polkit-agent-helper-1 -polkit-agent-helper-1 matchwhitelist - -###################################################################### -# SUID regex match whitelist -###################################################################### - -dbus-daemon-launch-helper matchwhitelist -/utempter/utempter matchwhitelist - -## required for AppImages such as electrum Bitcoin wallet -## https://forums.whonix.org/t/disable-suid-binaries/7706/57 -/fusermount matchwhitelist - -###################################################################### -# Permission Hardening -###################################################################### - -## Remove SUID from 'mount' but keep executable. -## https://forums.whonix.org/t/disable-suid-binaries/7706/61 -/bin/mount 745 root root -/usr/bin/mount 745 root root - -/home/ 0755 root root -/home/user/ 0700 user user -/root/ 0700 root root -/boot/ 0700 root root -/etc/permission-hardening.d 0600 root root -/usr/local/etc/permission-hardening.d 0600 root root -/lib/modules/ 0700 root root - -###################################################################### -# SUID/SGID Removal -###################################################################### - -## Remove all SUID/SGID binaries/libraries. - -/bin/ nosuid -/usr/bin/ nosuid -/usr/local/bin/ nosuid -/sbin/ nosuid -/usr/sbin/ nosuid -/usr/local/sbin/ nosuid -/lib/ nosuid -/lib32/ nosuid -/lib64/ nosuid -/usr/lib/ nosuid -/usr/lib32/ nosuid -/usr/lib64/ nosuid -/usr/local/lib/ nosuid -/usr/local/lib32/ nosuid -/usr/local/lib64/ nosuid - -###################################################################### -# Capability Removal -###################################################################### - -## Ping doesn't work with Tor anyway so its capabilities are removed to -## reduce attack surface. -## anon-apps-config does this. -#/bin/ping 0744 root root none - -## TODO: research -#/usr/lib/x86_64-linux-gnu/gstreamer1.0/grstreamer-1.0/gst-ptp-helper 0744 root root none diff --git a/etc/profile.d/30_security-misc.sh#security-misc-shared b/etc/profile.d/30_security-misc.sh#security-misc-shared new file mode 100755 index 00000000..39ee52ba --- /dev/null +++ b/etc/profile.d/30_security-misc.sh#security-misc-shared @@ -0,0 +1,11 @@ +#!/bin/sh + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +if [ -z "$XDG_CONFIG_DIRS" ]; then + XDG_CONFIG_DIRS="/etc:/etc/xdg:/usr/share" +fi +if ! printf '%s\n' "$XDG_CONFIG_DIRS" | grep -- "/usr/share/security-misc/" >/dev/null 2>/dev/null ; then + export XDG_CONFIG_DIRS="/usr/share/security-misc/:$XDG_CONFIG_DIRS" +fi diff --git a/etc/securetty.security-misc b/etc/securetty.security-misc deleted file mode 100644 index ca0d81b1..00000000 --- a/etc/securetty.security-misc +++ /dev/null @@ -1,2 +0,0 @@ -# /etc/securetty: list of terminals on which root is allowed to login. -# See securetty(5) and login(1). diff --git a/etc/securetty.security-misc#security-misc-shared b/etc/securetty.security-misc#security-misc-shared new file mode 100644 index 00000000..c98d20d3 --- /dev/null +++ b/etc/securetty.security-misc#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +# /etc/securetty: list of terminals on which root is allowed to login. +# See securetty(5) and login(1). diff --git a/etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared b/etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared new file mode 100644 index 00000000..e8b4b486 --- /dev/null +++ b/etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared @@ -0,0 +1,34 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/security-misc/emerg-shutdown/50_user.conf" or +## "/usr/local/etc/security-misc/emerg-shutdown/50_user.conf" +## for your custom configuration, which will override the defaults found here. +## When Kicksecure is updated, this file may be overwritten. + +## Set the key combo for forcing immediate shutdown. See the "Keys and +## buttons" section of "/usr/include/linux/input-event-codes.h" for possibly +## supported values. Not all keys are supported. +## +## All specified keys must be depressed at the same time to trigger a +## shutdown. Use a comma (",") to separate keys. If you want to alias certain +## keys to each other from emerg-shutdown's standpoint, use a pipe +## character("|"). +## +## The default key sequence triggers a shutdown when Ctrl+Alt+Delete is +## pressed, allowing the use of either the left or right Ctrl and Alt keys. +EMERG_SHUTDOWN_KEYS="KEY_LEFTCTRL|KEY_RIGHTCTRL,KEY_LEFTALT|KEY_RIGHTALT,KEY_END" + +## Set the maximum number of seconds shutdown can take. If shutdown gets stuck +## for longer than this, the system will forcibly power down. +## +## NOTE: This requires ensure-shutdown.service and +## ensure-shutdown-trigger.service to be enabled, which is not done by +## default. Enabling ensure-shutdown.service will cause shutdown to always +## take at least as long as systemd's DefaultTimeoutStopSec (which by default +## is 90 seconds). If you are going to enable ensure-shutdown.service, it is +## highly recommended to set DefaultTimeoutStopSec to a much smaller value, +## such as 5 seconds. The maximum shutdown time set here should be at least 10 +## seconds *longer* than DefaultTimeoutStopSec, to give normal shutdown a +## chance to actually succeed before forcibly shutting down the system. +ENSURE_SHUTDOWN_TIMEOUT=30 diff --git a/etc/security/access-security-misc.conf b/etc/security/access-security-misc.conf deleted file mode 100644 index a081d336..00000000 --- a/etc/security/access-security-misc.conf +++ /dev/null @@ -1,25 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Console Lockdown -## https://forums.whonix.org/t/etc-security-hardening/8592 - -## This is the error message should this fail: -## sudo su -## sudo: PAM account management error: Permission denied - -## see also: -## man access.conf -## man pam_access - -## Usually tty7 is for X. -## Qubes uses tty1 for X. - -## Allow members of group 'console' to use tty1 to tty7 and pts/0 to pts/9 and hvc0 to hvc9. -## Qubes has 'pts/0' when for example running "sudo" from a terminal emulator. -## Qubes uses 'hvc0' when using in dom0 "sudo xl console vm-name". -+:console:tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 - -## Everyone else except members of group 'console-unrestricted' -## are restricted from everything else. --:ALL EXCEPT console-unrestricted :ALL diff --git a/etc/security/access-security-misc.conf#security-misc-shared b/etc/security/access-security-misc.conf#security-misc-shared new file mode 100644 index 00000000..d34325e9 --- /dev/null +++ b/etc/security/access-security-misc.conf#security-misc-shared @@ -0,0 +1,41 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## To enable root login, see: +## https://www.kicksecure.com/wiki/Root#Root_Login + +## Console Lockdown +## https://forums.whonix.org/t/etc-security-hardening/8592 + +## This is the error message should this fail: +## sudo su +## sudo: PAM account management error: Permission denied + +## see also: +## man access.conf +## man pam_access + +## Usually tty7 is for X. +## Qubes uses tty1 for X. + +## Qubes has 'pts/0' when for example running "sudo" from a terminal emulator. +## Qubes uses 'hvc0' when using in dom0 "sudo xl console vm-name". +## When using systemd-nspawn (chroot) then `login` requires console 'console' to be permitted. + +## Allow members of group `console` to use: +## - 'console' +## - 'tty1' to 'tty7' +## - 'pts/0' to 'pts/9' +## - 'hvc0' to 'hvc9' +## serial console +## https://forums.whonix.org/t/how-do-i-enter-the-whonix-shell-from-cli/7271/43 +## - 'ttyS0' to 'ttyS9' ++:(console):console tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9 + +## Same as above also for members of group `sudo`. +## https://github.com/Kicksecure/security-misc/pull/74#issuecomment-607748407 ++:(sudo):console tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9 + +## Everyone else except members of group 'console-unrestricted' +## are restricted from everything else. +-:ALL EXCEPT (console-unrestricted):ALL diff --git a/etc/security/faillock.conf.security-misc#security-misc-shared b/etc/security/faillock.conf.security-misc#security-misc-shared new file mode 100644 index 00000000..4b70cdee --- /dev/null +++ b/etc/security/faillock.conf.security-misc#security-misc-shared @@ -0,0 +1,70 @@ +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +# Configuration for locking the user after multiple failed +# authentication attempts. +# +# The directory where the user files with the failure records are kept. +# The default is /var/run/faillock. +dir = /var/lib/security-misc/faillock +# +# Will log the user name into the system log if the user is not found. +# Enabled if option is present. +audit +# +# Don't print informative messages. +# Enabled if option is present. +# silent +# +# Don't log informative messages via syslog. +# Enabled if option is present. +# no_log_info +# +# Only track failed user authentications attempts for local users +# in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users. +# The `faillock` command will also no longer track user failed +# authentication attempts. Enabling this option will prevent a +# double-lockout scenario where a user is locked out locally and +# in the centralized mechanism. +# Enabled if option is present. +# local_users_only +# +# Deny access if the number of consecutive authentication failures +# for this user during the recent interval exceeds n tries. +# The default is 3. +deny = 50 +# +# The length of the interval during which the consecutive +# authentication failures must happen for the user account +# lock out is n seconds. +# The default is 900 (15 minutes). +# security-misc note: the interval should be set to infinity if possible, +# however pam_faillock arbitrarily limits this variable to a maximum of 604800 +# seconds (7 days). See +# https://github.com/linux-pam/linux-pam/blob/539816e4a0a277dbb632412be91e482fff9d9d09/modules/pam_faillock/faillock_config.h#L59 +# for details. Therefore we set this to the maximum allowable value of 7 days. +fail_interval = 604800 +# +# The access will be re-enabled after n seconds after the lock out. +# The value 0 has the same meaning as value `never` - the access +# will not be re-enabled without resetting the faillock +# entries by the `faillock` command. +# The default is 600 (10 minutes). +unlock_time = never +# +# Root account can become locked as well as regular accounts. +# Enabled if option is present. +even_deny_root +# +# This option implies the `even_deny_root` option. +# Allow access after n seconds to root account after the +# account is locked. In case the option is not specified +# the value is the same as of the `unlock_time` option. +# root_unlock_time = 900 +# +# If a group name is specified with this option, members +# of the group will be handled by this module the same as +# the root account (the options `even_deny_root>` and +# `root_unlock_time` will apply to them. +# By default, the option is not set. +# admin_group = diff --git a/etc/security/limits.d/30_security-misc.conf b/etc/security/limits.d/30_security-misc.conf deleted file mode 100644 index ea7c4149..00000000 --- a/etc/security/limits.d/30_security-misc.conf +++ /dev/null @@ -1,2 +0,0 @@ -# Disable coredumps. -* hard core 0 diff --git a/etc/security/limits.d/30_security-misc.conf#security-misc-shared b/etc/security/limits.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..632b8736 --- /dev/null +++ b/etc/security/limits.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,7 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Disable core dumps. +## `-` in the second field sets both hard and soft limits at the same time. +## See `man 5 limits.conf`. +* - core 0 diff --git a/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml b/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared similarity index 75% rename from etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml rename to etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared index f6909a36..dd943495 100644 --- a/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml +++ b/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared @@ -1,5 +1,8 @@ + + + @@ -13,4 +16,5 @@ + diff --git a/etc/skel/.gnupg/gpg.conf#security-misc-shared b/etc/skel/.gnupg/gpg.conf#security-misc-shared new file mode 100644 index 00000000..f0ed5a4b --- /dev/null +++ b/etc/skel/.gnupg/gpg.conf#security-misc-shared @@ -0,0 +1,350 @@ +# Options for GnuPG +# Copyright 1998, 1999, 2000, 2001, 2002, 2003, +# 2010 Free Software Foundation, Inc. +# +# This file is free software; as a special exception the author gives +# unlimited permission to copy and/or distribute it, with or without +# modifications, as long as this notice is preserved. +# +# This file is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the +# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +# +# Unless you specify which option file to use (with the command line +# option "--options filename"), GnuPG uses the file ~/.gnupg/gpg.conf +# by default. +# +# An options file can contain any long options which are available in +# GnuPG. If the first non white space character of a line is a '#', +# this line is ignored. Empty lines are also ignored. +# +# See the man page for a list of options. + +# Uncomment the following option to get rid of the copyright notice + +#no-greeting + +# If you have more than 1 secret key in your keyring, you may want to +# uncomment the following option and set your preferred keyid. + +#default-key 621CC013 + +# If you do not pass a recipient to gpg, it will ask for one. Using +# this option you can encrypt to a default key. Key validation will +# not be done in this case. The second form uses the default key as +# default recipient. + +#default-recipient some-user-id +#default-recipient-self + +# Use --encrypt-to to add the specified key as a recipient to all +# messages. This is useful, for example, when sending mail through a +# mail client that does not automatically encrypt mail to your key. +# In the example, this option allows you to read your local copy of +# encrypted mail that you've sent to others. + +#encrypt-to some-key-id + +# By default GnuPG creates version 4 signatures for data files as +# specified by OpenPGP. Some earlier (PGP 6, PGP 7) versions of PGP +# require the older version 3 signatures. Setting this option forces +# GnuPG to create version 3 signatures. + +#force-v3-sigs + +# Because some mailers change lines starting with "From " to ">From " +# it is good to handle such lines in a special way when creating +# cleartext signatures; all other PGP versions do it this way too. + +#no-escape-from-lines + +# If you do not use the Latin-1 (ISO-8859-1) charset, you should tell +# GnuPG which is the native character set. Please check the man page +# for supported character sets. This character set is only used for +# metadata and not for the actual message which does not undergo any +# translation. Note that future version of GnuPG will change to UTF-8 +# as default character set. In most cases this option is not required +# as GnuPG is able to figure out the correct charset at runtime. + +#charset utf-8 + +# Group names may be defined like this: +# group mynames = paige 0x12345678 joe patti +# +# Any time "mynames" is a recipient (-r or --recipient), it will be +# expanded to the names "paige", "joe", and "patti", and the key ID +# "0x12345678". Note that there is only one level of expansion - you +# cannot make a group that points to another group. Note also that +# if there are spaces in the recipient name, this will appear as two +# recipients. In these cases it is better to use the key ID. + +#group mynames = paige 0x12345678 joe patti + +# Lock the file only once for the lifetime of a process. If you do +# not define this, the lock will be obtained and released every time +# it is needed, which is usually preferable. + +#lock-once + +# GnuPG can send and receive keys to and from a keyserver. These +# servers can be HKP, email, or LDAP (if GnuPG is built with LDAP +# support). +# +# High-risk users should stop using the keyserver network immediately. +# https://forums.whonix.org/t/gpg-recv-keys-fails-no-longer-use-keyservers-for-anything/5607/8 +# +# Example HKP keyserver: +# hkp://keys.gnupg.net +# hkp://subkeys.pgp.net +# +# Example email keyserver: +# mailto:pgp-public-keys@keys.pgp.net +# +# Example LDAP keyservers: +# ldap://keyserver.pgp.com +# +# Regular URL syntax applies, and you can set an alternate port +# through the usual method: +# hkp://keyserver.example.net:22742 +# +# Most users just set the name and type of their preferred keyserver. +# Note that most servers (with the notable exception of +# ldap://keyserver.pgp.com) synchronize changes with each other. Note +# also that a single server name may actually point to multiple +# servers via DNS round-robin. hkp://keys.gnupg.net is an example of +# such a "server", which spreads the load over a number of physical +# servers. To see the IP address of the server actually used, you may use +# the "--keyserver-options debug". +# +#keyserver hkp://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.onion +#keyserver mailto:pgp-public-keys@keys.nl.pgp.net +#keyserver ldap://keyserver.pgp.com + +# Common options for keyserver functions: +# +# include-disabled : when searching, include keys marked as "disabled" +# on the keyserver (not all keyservers support this). +# +# no-include-revoked : when searching, do not include keys marked as +# "revoked" on the keyserver. +# +# verbose : show more information as the keys are fetched. +# Can be used more than once to increase the amount +# of information shown. +# +# use-temp-files : use temporary files instead of a pipe to talk to the +# keyserver. Some platforms (Win32 for one) always +# have this on. +# +# keep-temp-files : do not delete temporary files after using them +# (really only useful for debugging) +# +# http-proxy="proxy" : set the proxy to use for HTTP and HKP keyservers. +# This overrides the "http_proxy" environment variable, +# if any. +# +# auto-key-retrieve : automatically fetch keys as needed from the keyserver +# when verifying signatures or when importing keys that +# have been revoked by a revocation key that is not +# present on the keyring. +# +# no-include-attributes : do not include attribute IDs (aka "photo IDs") +# when sending keys to the keyserver. + +#keyserver-options auto-key-retrieve + +# Display photo user IDs in key listings + +# list-options show-photos + +# Display photo user IDs when a signature from a key with a photo is +# verified + +# verify-options show-photos + +# Use this program to display photo user IDs +# +# %i is expanded to a temporary file that contains the photo. +# %I is the same as %i, but the file isn't deleted afterwards by GnuPG. +# %k is expanded to the key ID of the key. +# %K is expanded to the long OpenPGP key ID of the key. +# %t is expanded to the extension of the image (e.g. "jpg"). +# %T is expanded to the MIME type of the image (e.g. "image/jpeg"). +# %f is expanded to the fingerprint of the key. +# %% is %, of course. +# +# If %i or %I are not present, then the photo is supplied to the +# viewer on standard input. If your platform supports it, standard +# input is the best way to do this as it avoids the time and effort in +# generating and then cleaning up a secure temp file. +# +# If no photo-viewer is provided, GnuPG will look for xloadimage, eog, +# or display (ImageMagick). On Mac OS X and Windows, the default is +# to use your regular JPEG image viewer. +# +# Some other viewers: +# photo-viewer "qiv %i" +# photo-viewer "ee %i" +# +# This one saves a copy of the photo ID in your home directory: +# photo-viewer "cat > ~/photoid-for-key-%k.%t" +# +# Use your MIME handler to view photos: +# photo-viewer "metamail -q -d -b -c %T -s 'KeyID 0x%k' -f GnuPG" + +# Passphrase agent +# +# We support the old experimental passphrase agent protocol as well as +# the new Assuan based one (currently available in the "newpg" package +# at ftp.gnupg.org/gcrypt/alpha/aegypten/). To make use of the agent, +# you have to run an agent as daemon and use the option +# +# For Ubuntu we now use-agent by default to support more automatic +# use of GPG and S/MIME encryption by GUI programs. Depending on the +# program, users may still have to manually decide to install gnupg-agent. + +#use-agent + +# which tries to use the agent but will fallback to the regular mode +# if there is a problem connecting to the agent. The normal way to +# locate the agent is by looking at the environment variable +# GPG_AGENT_INFO which should have been set during gpg-agent startup. +# In certain situations the use of this variable is not possible, thus +# the option +# +# --gpg-agent-info=::1 +# +# may be used to override it. + +# Automatic key location +# +# GnuPG can automatically locate and retrieve keys as needed using the +# auto-key-locate option. This happens when encrypting to an email +# address (in the "user@example.com" form), and there are no +# user@example.com keys on the local keyring. This option takes the +# following arguments, in the order they are to be tried: +# +# cert = locate a key using DNS CERT, as specified in RFC-4398. +# GnuPG can handle both the PGP (key) and IPGP (URL + fingerprint) +# CERT methods. +# +# pka = locate a key using DNS PKA. +# +# ldap = locate a key using the PGP Universal method of checking +# "ldap://keys.(thedomain)". For example, encrypting to +# user@example.com will check ldap://keys.example.com. +# +# keyserver = locate a key using whatever keyserver is defined using +# the keyserver option. +# +# You may also list arbitrary keyservers here by URL. +# +# Try CERT, then PKA, then LDAP, then hkp://subkeys.net: +#auto-key-locate cert pka ldap hkp://subkeys.pgp.net + +## Begin Anonymity Distribution /home/user/.gnupg/gpg.conf changes. + +#### meta start +#### project Whonix +#### category networking and apps +#### description GnuPG gpg configuration +#### meta end + +## source: +## https://raw.github.com/ioerror/torbirdy/master/gpg.conf +## https://github.com/ioerror/torbirdy/commit/e6d7c9e6e103f0b3289675d04ed3f92e92d8d7b3 + +## Out commented proxy settings, because uwt wrapper keeps care of that. + +## gpg.conf optimized for privacy + +################################################################## +## BEGIN some suggestions from TorBirdy setting extensions.enigmail.agentAdditionalParam + +## Don't disclose the version +no-emit-version + +## Don't add additional comments (may leak language, etc) +no-comments + +## We want to force UTF-8 everywhere +display-charset utf-8 + +## Proxy settings +#keyserver-options http-proxy=socks5://TORIP:TORPORT + +## https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f +## https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html +## https://forums.whonix.org/t/gpg-recv-keys-fails-no-longer-use-keyservers-for-anything/5607 +#keyserver hkps://keys.openpgp.org + +## END some suggestions from TorBirdy TorBirdy setting extensions.enigmail.agentAdditionalParam +################################################################## + +################################################################## +## BEGIN Some suggestions from Debian https://keyring.debian.org/creating-key.html + +personal-digest-preferences SHA512 +cert-digest-algo SHA512 +default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed + +## END Some suggestions from Debian https://keyring.debian.org/creating-key.html +################################################################## + +################################################################## +## BEGIN Some suggestions added from riseup https://we.riseup.net/riseuplabs+paow/openpgp-best-practices + +## When creating a key, individuals may designate a specific keyserver to use to pull their keys from. +## The above option will disregard this designation and use the pool, which is useful because (1) it +## prevents someone from designating an insecure method for pulling their key and (2) if the server +## designated uses hkps, the refresh will fail because the ca-cert will not match, so the keys will +## never be refreshed. +keyserver-options no-honor-keyserver-url + +## when outputting certificates, view user IDs distinctly from keys: +fixed-list-mode + +## long keyids are more collision-resistant than short keyids (it's trivial to make a key with any desired short keyid) +keyid-format 0xlong + +## when multiple digests are supported by all recipients, choose the strongest one: +## already defined above +#personal-digest-preferences SHA512 SHA384 SHA256 SHA224 + +## preferences chosen for new keys should prioritize stronger algorithms: +## already defined above +#default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 BZIP2 ZLIB ZIP Uncompressed + +## If you use a graphical environment (and even if you don't) you should be using an agent: +## (similar arguments as https://www.debian-administration.org/users/dkg/weblog/64) +use-agent + +## You should always know at a glance which User IDs gpg thinks are legitimately bound to the keys in your keyring: +verify-options show-uid-validity +list-options show-uid-validity + +## include an unambiguous indicator of which key made a signature: +## (see http://thread.gmane.org/gmane.mail.notmuch.general/3721/focus=7234) +sig-notation issuer-fpr@notations.openpgp.fifthhorseman.net=%g + +## when making an OpenPGP certification, use a stronger digest than the default SHA1: +## already defined above +#cert-digest-algo SHA256 + +## END Some suggestions added from riseup https://we.riseup.net/riseuplabs+paow/openpgp-best-practices +################################################################## + +################################################################## +## BEGIN Some suggestions from TorBirdy opt-in's + +## Up to you whether you in comment it (remove the single # in front of +## it) or not. Disabled by default, because it causes too much complaints and +## confusion. + +## Don't include keyids that may disclose the sender or any other non-obvious keyids +#throw-keyids + +## END Some suggestions from TorBirdy opt-in's +################################################################## + +## End of Anonymity Distribution /home/user/.gnupg/gpg.conf changes. diff --git a/etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared b/etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..67ad1e86 --- /dev/null +++ b/etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Don't edit this file; to overwrite any options, edit a file with a higher +## number that is read earlier by SSH, such as +## '/etc/ssh/ssh_config.d/10_user.conf'. If your configuration changes do not +## need to be system-wide, you may also consider placing overrides in +## ~/.ssh/config. + +## See also: +## https://www.kicksecure.com/wiki/SSH#Client_Configuration_File + +Host * + VisualHostKey yes + ## Ciphers that are Terrapin-vulnerable when an outdated client or server are + ## used are intentionally retained. Connecting to a Terrapin-vulnerable + ## server cannot be made secure (as any Terrapin-vulnerable server will be + ## vulnerable to other issues as well) and is therefore unsupported. + Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr + MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com + ## Only post-quantum-sequre KexAlgorithms are allowed. + KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256 + HostKeyAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519 + PubkeyAcceptedAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519 diff --git a/etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared b/etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..6d52003d --- /dev/null +++ b/etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,80 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Don't edit this file; to overwrite any options, edit a file with a lower +## number that is read earlier by sshd, such as +## '/etc/ssh/sshd_config.d/10_user.conf'. + +## See also: +## https://www.kicksecure.com/wiki/SSH#Server_Configuration_File + +## Number of allowed login attempts per connection. +MaxAuthTries 3 + +## Require strong ciphers and algorithms. +HostKey /etc/ssh/ssh_host_ed25519_key +HostKeyAlgorithms ssh-ed25519 +PubkeyAcceptedAlgorithms ssh-ed25519,sk-ssh-ed25519@openssh.com +## Ciphers that are Terrapin-vulnerable when an outdated client or server are +## used are intentionally retained. Connections from a Terrapin-vulnerable +## client cannot be made secure (as any Terrapin-vulnerable client will be +## vulnerable to other issues as well) and is therefore unsupported. +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com +MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com +## Only post-quantum-sequre KexAlgorithms are allowed. +KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256 + +## Override with 'no' to fully deny root login, or leave this as +## 'prohibit-password' for denying root password login but still allowing +## other authentication methods such as public key. +PermitRootLogin prohibit-password + +## Public key authentication is transparent, non-interactive and more secure. +PasswordAuthentication no + +## Change to 'yes' to enable challenge-response passwords (beware issues with +## some PAM modules and threads) +KbdInteractiveAuthentication no + +## PAM can be used for account and session processing when using +## ChallengeResponseAuthentication or PasswordAuthentication. +## +## Depending on your PAM configuration, PAM authentication via +## ChallengeResponseAuthentication may bypass the setting of "PermitRootLogin +## without-password". +## +## If you want PAM account and session checks to run without PAM +## authentication, then enable this but set PasswordAuthentication and +## ChallengeResponseAuthentication to 'no'. +## +## The default upstream is 'no', Debian sets this to 'yes'. If using a locked +## account, read: +## https://www.kicksecure.com/wiki/SSH#SSH_Login_Comparison_Table +## We set it to 'yes' to work with libpam-tmpdir. +## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#libpam-tmpdir +## Also folders such as '/run/user/1000' will exist thanks to PAM. +## The absence of that folder can lead to issues (such as with msgcollector). +UsePAM yes + +## Block dangerous forwarding. +AllowAgentForwarding no +AllowTcpForwarding no +X11Forwarding no + +## Hide unnecessary login banners. +PrintMotd no +#Banner /etc/issue.net +#Hiding Debian version from SSH banner (obscurity) +DebianBanner no + +## Some options are dangerous but may be required in certain circumstances. As +## an example, if forwarding is required, selectively allow it with a 'Match' +## block. Consider a new separate user named 'tunnel' which wants to forward +## its local port to be available on the server on port 443. Note that a +## tunnel user doesn't even require a TTY nor a shell, so don't forget to +## change the 'tunnel' shell to something that prevents login such as +## '/usr/sbin/nologin'. +#Match User tunnel +# AllowTcpForwarding yes +# PermitListen localhost:443 +# PermitTTY no diff --git a/etc/sudoers.d/pkexec-security-misc b/etc/sudoers.d/pkexec-security-misc deleted file mode 100644 index 1572b030..00000000 --- a/etc/sudoers.d/pkexec-security-misc +++ /dev/null @@ -1,11 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## REVIEW: is it ok that users can find out the PATH setting of root? -%sudo ALL=NOPASSWD: /usr/lib/security-misc/echo-path - -## xfpm-power-backlight-helper demands environment variable PKEXEC_UID to be -## set. Would otherwise error out with the following error message: -## "This program must only be run through pkexec" -## REVIEW: Can bad things be done by spoofing PKEXEC_UID? -Defaults:ALL env_keep += "PKEXEC_UID" diff --git a/etc/sudoers.d/security-misc b/etc/sudoers.d/security-misc deleted file mode 100644 index 3f98634c..00000000 --- a/etc/sudoers.d/security-misc +++ /dev/null @@ -1,5 +0,0 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -user ALL=NOPASSWD: /usr/lib/security-misc/panic-on-oops -%sudo ALL=NOPASSWD: /usr/lib/security-misc/panic-on-oops diff --git a/etc/sudoers.d/security-misc#security-misc-shared b/etc/sudoers.d/security-misc#security-misc-shared new file mode 100644 index 00000000..1fa2146e --- /dev/null +++ b/etc/sudoers.d/security-misc#security-misc-shared @@ -0,0 +1,12 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Neither of these are needed. +#user ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops +#%sudo ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops + +## Use a more open umask when executing commands with sudo +## Can be overridden on a per-user basis using .[z]profile if desirable +## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#umask_hardening +Defaults umask_override +Defaults umask=0022 diff --git a/etc/sudoers.d/security-misc-desktop#security-misc-desktop b/etc/sudoers.d/security-misc-desktop#security-misc-desktop new file mode 100644 index 00000000..cab7ca7c --- /dev/null +++ b/etc/sudoers.d/security-misc-desktop#security-misc-desktop @@ -0,0 +1,6 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Don't attempt to determine the local machine's FQDN via DNS. This can leak +## the machine's hostname in cleartext to the configured DNS server. +Defaults !fqdn diff --git a/etc/sudoers.d/xfce-security-misc b/etc/sudoers.d/xfce-security-misc deleted file mode 100644 index 8e751025..00000000 --- a/etc/sudoers.d/xfce-security-misc +++ /dev/null @@ -1,19 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://forums.whonix.org/t/xfce4-power-manager-xfpm-power-backlight-helper-pkexec-lxsudo-popup/8764 -## /usr/share/polkit-1/actions/org.xfce.power.policy - -## Feel free to out comment this if you are not using xfce4-power-manager or XFCE. - -%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]] -%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]] -%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]][[\:digit\:]] - -%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]] -%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]] -%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]][[\:digit\:]] - -## XXX: Should we allow this? -#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --suspend -#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --hibernate diff --git a/etc/sysctl.d/30_security-misc.conf b/etc/sysctl.d/30_security-misc.conf deleted file mode 100644 index ae374de6..00000000 --- a/etc/sysctl.d/30_security-misc.conf +++ /dev/null @@ -1,114 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Disables coredumps. This setting may be overwritten by systemd so this may not be useful. -## security-misc also disables coredumps in other ways. -kernel.core_pattern=|/bin/false - - -## Restricts the kernel log to root only. -kernel.dmesg_restrict=1 - - -## Makes some data spoofing attacks harder. -fs.protected_fifos=2 -fs.protected_regular=2 - - -## Hardens the BPF JIT compiler and restricts it to root. -kernel.unprivileged_bpf_disabled=1 -net.core.bpf_jit_harden=2 - - -## Quote https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html -## -## kexec_load_disabled: -## -## A toggle indicating if the kexec_load syscall has been disabled. This value defaults to 0 (false: kexec_load enabled), but can be set to 1 (true: kexec_load disabled). Once true, kexec can no longer be used, and the toggle cannot be set back to false. This allows a kexec image to be loaded before disabling the syscall, allowing a system to set up (and later use) an image without it being altered. Generally used together with the "modules_disabled" sysctl. - -## Disables kexec which can be used to replace the running kernel. -kernel.kexec_load_disabled=1 - - -## Hides kernel addresses in various files in /proc. -## Kernel addresses can be very useful in certain exploits. -## -## https://kernsec.org/wiki/index.php/Bug_Classes/Kernel_pointer_leak -kernel.kptr_restrict=2 - - -## Improves ASLR effectiveness for mmap. -vm.mmap_rnd_bits=32 -vm.mmap_rnd_compat_bits=16 - - -## Restricts the use of ptrace to root. This might break some programs running under WINE. -## A workaround for WINE would be to give the wineserver and wine-preloader ptrace capabilities. This can be done by running: -## -## sudo apt-get install libcap2-bin -## sudo setcap cap_sys_ptrace=eip /usr/bin/wineserver -## sudo setcap cap_sys_ptrace=eip /usr/bin/wine-preloader -kernel.yama.ptrace_scope=2 - - -## Prevent setuid processes from creating coredumps. -fs.suid_dumpable=0 - - -#### meta start -#### project Kicksecure -#### category networking and security -#### description -## TCP/IP stack hardening - -## Protects against time-wait assassination. -## It drops RST packets for sockets in the time-wait state. -net.ipv4.tcp_rfc1337=1 - -## Disables ICMP redirect acceptance. -net.ipv4.conf.all.accept_redirects=0 -net.ipv4.conf.default.accept_redirects=0 -net.ipv4.conf.all.secure_redirects=0 -net.ipv4.conf.default.secure_redirects=0 -net.ipv6.conf.all.accept_redirects=0 -net.ipv6.conf.default.accept_redirects=0 - -## Disables ICMP redirect sending. -net.ipv4.conf.all.send_redirects=0 -net.ipv4.conf.default.send_redirects=0 - -## Ignores ICMP requests. -net.ipv4.icmp_echo_ignore_all=1 - -## Enables TCP syncookies. -net.ipv4.tcp_syncookies=1 - -## Disable source routing. -net.ipv4.conf.all.accept_source_route=0 -net.ipv4.conf.default.accept_source_route=0 - -## Enable reverse path filtering to prevent IP spoofing and -## mitigate vulnerabilities such as CVE-2019-14899. -## https://forums.whonix.org/t/enable-reverse-path-filtering/8594 -net.ipv4.conf.default.rp_filter=1 -net.ipv4.conf.all.rp_filter=1 - -#### meta end - - -## Disables SACK as it is commonly exploited and likely not needed. -## https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109 -#net.ipv4.tcp_sack=0 -#net.ipv4.tcp_dsack=0 -#net.ipv4.tcp_fack=0 - - -#### meta start -#### project Kicksecure -#### category networking and security -#### description -## disable IPv4 TCP Timestamps - -net.ipv4.tcp_timestamps=0 - -#### meta end diff --git a/etc/systemd/system/rescue.service.d/override.conf b/etc/systemd/system/emergency.service.d/override.conf#security-misc-shared similarity index 61% rename from etc/systemd/system/rescue.service.d/override.conf rename to etc/systemd/system/emergency.service.d/override.conf#security-misc-shared index b24186a0..42fefd44 100644 --- a/etc/systemd/system/rescue.service.d/override.conf +++ b/etc/systemd/system/emergency.service.d/override.conf#security-misc-shared @@ -1,3 +1,6 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 ## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d diff --git a/etc/systemd/system/emergency.service.d/override.conf b/etc/systemd/system/rescue.service.d/override.conf#security-misc-shared similarity index 61% rename from etc/systemd/system/emergency.service.d/override.conf rename to etc/systemd/system/rescue.service.d/override.conf#security-misc-shared index b24186a0..42fefd44 100644 --- a/etc/systemd/system/emergency.service.d/override.conf +++ b/etc/systemd/system/rescue.service.d/override.conf#security-misc-shared @@ -1,3 +1,6 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 ## https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d diff --git a/etc/thunderbird/pref/40_security-mic.js b/etc/thunderbird/pref/40_security-mic.js deleted file mode 100644 index fe36be26..00000000 --- a/etc/thunderbird/pref/40_security-mic.js +++ /dev/null @@ -1,8 +0,0 @@ -//#### meta start -//#### project Whonix and Kicksecure -//#### category security and apps -//#### description https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415 -//#### meta end - -// https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415 -pref("network.IDN_show_punycode", true); diff --git a/etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared b/etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared new file mode 100644 index 00000000..1d7596d4 --- /dev/null +++ b/etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared @@ -0,0 +1 @@ +Devices=listen,list,modify diff --git a/etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared b/etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared new file mode 100644 index 00000000..1d7596d4 --- /dev/null +++ b/etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared @@ -0,0 +1 @@ +Devices=listen,list,modify diff --git a/etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared b/etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..7315d9d5 --- /dev/null +++ b/etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,76 @@ +## We allow devices that were plugged in before the daemon starts. Everything +## is blocked as the default. Following rules apply on top of this. + +## First match wins. Therefore, reject rules should be on the top. +## Quote: +## https://usbguard.github.io/documentation/rule-language +## > the daemon scans the existing rules sequentially + +## Explicitly reject any interface that is not documented and/or defined by +## USB.org. +## Note: Most probably superfluous. +reject with-interface none-of { 00:*:* 01:*:* 02:*:* 03:*:* 05:*:* 06:*:* 07:*:* 08:*:* 09:*:* 0a:*:* 0b:*:* 0d:*:* 0e:*:* 0f:*:* 10:*:* 11:*:* 12:*:* 13:*:* 14:*:* 3c:*:* dc:*:* e0:*:* ef:*:* fe:*:* ff:*:* } + +## Explicitly reject any device with a mouse/keyboard interface in +## combination with some other interface. +## Mice and keyboards should likely never have non-HID interfaces provided +## alongside them. +reject with-interface all-of { 03:*:* 00:*:* } +reject with-interface all-of { 03:*:* 01:*:* } +reject with-interface all-of { 03:*:* 02:*:* } +reject with-interface all-of { 03:*:* 05:*:* } +reject with-interface all-of { 03:*:* 06:*:* } +reject with-interface all-of { 03:*:* 07:*:* } +reject with-interface all-of { 03:*:* 08:*:* } +reject with-interface all-of { 03:*:* 09:*:* } +reject with-interface all-of { 03:*:* 0a:*:* } +reject with-interface all-of { 03:*:* 0b:*:* } +reject with-interface all-of { 03:*:* 0d:*:* } +reject with-interface all-of { 03:*:* 0e:*:* } +reject with-interface all-of { 03:*:* 0f:*:* } +reject with-interface all-of { 03:*:* 10:*:* } +reject with-interface all-of { 03:*:* 11:*:* } +reject with-interface all-of { 03:*:* 12:*:* } +reject with-interface all-of { 03:*:* 13:*:* } +reject with-interface all-of { 03:*:* 14:*:* } +reject with-interface all-of { 03:*:* 3c:*:* } +reject with-interface all-of { 03:*:* dc:*:* } +reject with-interface all-of { 03:*:* e0:*:* } +reject with-interface all-of { 03:*:* ef:*:* } +reject with-interface all-of { 03:*:* fe:*:* } +reject with-interface all-of { 03:*:* ff:*:* } + +## Explicitly reject any device with an RNDIS interface. RNDIS is believed to +## have protocol-level buffer overflow vulnerabilities that cannot be fixed. +reject with-interface one-of { ef:04:* } + +## Allow all mouses and keyboards, in a sense, so the user can conveniently +## change them without restrating the daemon. + +## Allow only one keyboard to be connected +allow with-interface equals { 03:01:01 } if !allowed-matches(with-interface equals { 03:01:01 }) +## Allow only one mouse to be connected +allow with-interface equals { 03:01:02 } if !allowed-matches(with-interface equals { 03:01:02 }) +## NOTE: Some HID devices will have an interface of 03:00:00 - these are HID +## devices that do not support a "boot interface". **These are blocked +## entirely.** It is very likely that this will cause issues with some mice +## and keyboards. Also note, all HID devices other than mice and keyboards +## will be blocked, **including touchscreens.** + +## Allow USB audio devices. The intended functionality of these devices is +## unlikely to be usable in a malicious capacity without having already +## compromised the machine. +allow with-interface equals { 01:*:* } + +## Allow USB video devices (i.e. webcams). Also tricky to use in a malicious +## manner without having already compromised the machine. +allow with-interface equals { 0e:*:* } + +## Allow USB mass storage, if and only if the USB device only has the mass +## storage interface and nothing extra. +## Suspicious interface combinations with mass storage are blocked. +allow with-interface equals { 08:*:* } + +## Allow USB hubs, these are likely safe and are required for Qubes OS USB +## passthrough to work. +allow with-interface equals { 09:*:* } diff --git a/etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared b/etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared new file mode 100644 index 00000000..f2c1406b --- /dev/null +++ b/etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared @@ -0,0 +1,218 @@ +# +# Rule set file path. +# +# The USBGuard daemon will use this file to load the policy +# rule set from it and to write new rules received via the +# IPC interface. +# +# RuleFile=/path/to/rules.conf +# +RuleFile=/etc/usbguard/rules.conf + +# +# Rule set folder path. +# +# The USBGuard daemon will use this folder to load the policy +# rule set from it and to write new rules received via the +# IPC interface. Usually, we set the option to +# /etc/usbguard/rules.d/. The USBGuard daemon is supposed to +# behave like any other standard Linux daemon therefore it +# loads rule files in alphanumeric order. File names inside +# RuleFolder directory should start with a two-digit number +# prefix indicating the position, in which the rules are +# scanned by the daemon. +# +# RuleFolder=/path/to/rulesfolder/ +# +RuleFolder=/etc/usbguard/rules.d/ + + + +# +# Implicit policy target. +# +# How to treat devices that don't match any rule in the +# policy. One of: +# +# * allow - authorize the device +# * block - block the device +# * reject - remove the device +# +ImplicitPolicyTarget=block + +# +# Present device policy. +# +# How to treat devices that are already connected when the +# daemon starts. One of: +# +# * allow - authorize every present device +# * block - deauthorize every present device +# * reject - remove every present device +# * keep - just sync the internal state and leave it +# * apply-policy - evaluate the ruleset for every present +# device +# +# Overridden by Kicksecure to allow all devices that are connected at startup. +# +PresentDevicePolicy=allow + +# +# Present controller policy. +# +# How to treat USB controllers that are already connected +# when the daemon starts. One of: +# +# * allow - authorize every present device +# * block - deauthorize every present device +# * reject - remove every present device +# * keep - just sync the internal state and leave it +# * apply-policy - evaluate the ruleset for every present +# device +# +PresentControllerPolicy=keep + +# +# Inserted device policy. +# +# How to treat USB devices that are already connected +# *after* the daemon starts. One of: +# +# * block - deauthorize every present device +# * reject - remove every present device +# * apply-policy - evaluate the ruleset for every present +# device +# +InsertedDevicePolicy=apply-policy + +# +# Control which devices are authorized by default. +# +# The USBGuard daemon modifies some the default authorization state attributes +# of controller devices. This setting, enables you to define what value the +# default authorization is set to. +# +# * keep - do not change the authorization state +# * none - every new device starts out deauthorized +# * all - every new device starts out authorized +# * internal - internal devices start out authorized, external devices start +# out deauthorized (this requires the ACPI tables to properly +# label internal devices, and kernel support) +# +AuthorizedDefault=none + +# +# Restore controller device state. +# +# The USBGuard daemon modifies some attributes of controller +# devices like the default authorization state of new child device +# instances. Using this setting, you can control whether the +# daemon will try to restore the attribute values to the state +# before modification on shutdown. +# +# SECURITY CONSIDERATIONS: If set to true, the USB authorization +# policy could be bypassed by performing some sort of attack on the +# daemon (via a local exploit or via a USB device) to make it shutdown +# and restore to the operating-system default state (known to be permissive). +# +RestoreControllerDeviceState=false + +# +# Device manager backend +# +# Which device manager backend implementation to use. One of: +# +# * uevent - Netlink based implementation which uses sysfs to scan for present +# devices and an uevent netlink socket for receiving USB device +# related events. +# * umockdev - umockdev based device manager capable of simulating devices based +# on umockdev-record files. Useful for testing. +# +DeviceManagerBackend=uevent + +#!!! WARNING: It's good practice to set at least one of the !!! +#!!! two options below. If none of them are set, !!! +#!!! the daemon will accept IPC connections from !!! +#!!! anyone, thus allowing anyone to modify the !!! +#!!! rule set and (de)authorize USB devices. !!! + +# +# Users allowed to use the IPC interface. +# +# A space delimited list of usernames that the daemon will +# accept IPC connections from. +# +# IPCAllowedUsers=username1 username2 ... +# +IPCAllowedUsers=root + +# +# Groups allowed to use the IPC interface. +# +# A space delimited list of groupnames that the daemon will +# accept IPC connections from. +# +# IPCAllowedGroups=groupname1 groupname2 ... +# +IPCAllowedGroups=root plugdev + +# +# IPC access control definition files path. +# +# The files at this location will be interpreted by the USBGuard +# daemon as access control definition files for the IPC interface. +# The (base)name of a file should be in the form: +# +# [user][:] +# +# where user is either username or UID and group is either groupname or GID. +# IPC access control files should contain lines in the form: +# +#
=[privilege1][,privilege2] ... +# +# This way each file defines who is able to connect to the IPC +# bus and what privileges he has. Note that the IPC access control +# files need to have file permissions set to 0600. +# +IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/ + +# +# Generate device specific rules including the "via-port" +# attribute. +# +# This option modifies the behavior of the allowDevice +# action. When instructed to generate a permanent rule, +# the action can generate a port specific rule. Because +# some systems have unstable port numbering, the generated +# rule might not match the device after rebooting the system. +# +# If set to false, the generated rule will still contain +# the "parent-hash" attribute which also defines an association +# to the parent device. See usbguard-rules.conf(5) for more +# details. +# +DeviceRulesWithPort=false + +# +# USBGuard Audit events log backend +# +# One of: +# +# * FileAudit - Log audit events into a file specified by +# AuditFilePath setting (see below) +# * LinuxAudit - Log audit events using the Linux Audit +# subsystem (using audit_log_user_message) +# +AuditBackend=FileAudit + +# +# USBGuard audit events log file path. +# +AuditFilePath=/var/log/usbguard/usbguard-audit.log + +# +# Hides personally identifiable information such as device serial numbers and +# hashes of descriptors (which include the serial number) from audit entries. +# +HidePII=false + diff --git a/lib/systemd/coredump.conf.d/30_security-misc.conf b/lib/systemd/coredump.conf.d/30_security-misc.conf deleted file mode 100644 index 519f838c..00000000 --- a/lib/systemd/coredump.conf.d/30_security-misc.conf +++ /dev/null @@ -1,2 +0,0 @@ -[Coredump] -Storage=none diff --git a/lib/systemd/system-preset/50-security-misc.preset b/lib/systemd/system-preset/50-security-misc.preset deleted file mode 100644 index 7debfe24..00000000 --- a/lib/systemd/system-preset/50-security-misc.preset +++ /dev/null @@ -1,11 +0,0 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618 -disable hide-hardware-info.service - -## Disable for now until development finished / tested. -disable permission-hardening.service - -## Disable for now until development finished / tested. -disable remount-secure.service diff --git a/lib/systemd/system/permission-hardening.service b/lib/systemd/system/permission-hardening.service deleted file mode 100644 index 31c5ac32..00000000 --- a/lib/systemd/system/permission-hardening.service +++ /dev/null @@ -1,19 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -[Unit] -Description=SUID, SGID, Capability and File Permission Hardening -Documentation=https://github.com/Whonix/security-misc - -DefaultDependencies=no -Before=sysinit.target -Requires=local-fs.target -After=local-fs.target - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/usr/lib/security-misc/permission-hardening - -[Install] -WantedBy=sysinit.target diff --git a/lib/systemd/system/remount-secure.service b/lib/systemd/system/remount-secure.service deleted file mode 100644 index 92509120..00000000 --- a/lib/systemd/system/remount-secure.service +++ /dev/null @@ -1,21 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -[Unit] -Description=remount /home /tmp /dev/shm /run with nosuid,nodev (default) and noexec (opt-in) -Documentation=https://github.com/Whonix/security-misc - -DefaultDependencies=no -Before=sysinit.target -Requires=local-fs.target -After=local-fs.target - -After=qubes-sysinit.service - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/usr/lib/security-misc/remount-secure - -[Install] -WantedBy=sysinit.target diff --git a/lib/systemd/system/user@.service.d/sysfs.conf b/lib/systemd/system/user@.service.d/sysfs.conf deleted file mode 100644 index e0cf3a75..00000000 --- a/lib/systemd/system/user@.service.d/sysfs.conf +++ /dev/null @@ -1,2 +0,0 @@ -[Service] -SupplementaryGroups=sysfs diff --git a/rpm_spec/security-misc.spec.in b/rpm_spec/security-misc.spec.in index a2cfca66..b42625ef 100644 --- a/rpm_spec/security-misc.spec.in +++ b/rpm_spec/security-misc.spec.in @@ -3,8 +3,8 @@ Version: @VERSION@ Release: 1%{?dist} Summary: enhances misc security settings -License: GPL-3+-with-additional-terms-1 -URL: https://github.com/Whonix/security-misc +License: AGPL-3+ +URL: https://github.com/Kicksecure/security-misc Source0: %{name}-%{version}.tar.xz BuildRequires: dpkg-dev @@ -13,50 +13,7 @@ Requires: make BuildArch: noarch %description -The following settings are changed: - -deactivates previews in Dolphin; -deactivates previews in Nautilus; -deactivates thumbnails in Thunar; -deactivates TCP timestamps; -deactivates Netfilter's connection tracking helper; - -TCP time stamps (RFC 1323) allow for tracking clock -information with millisecond resolution. This may or may not allow an -attacker to learn information about the system clock at such -a resolution, depending on various issues such as network lag. -This information is available to anyone who monitors the network -somewhere between the attacked system and the destination server. -It may allow an attacker to find out how long a given -system has been running, and to distinguish several -systems running behind NAT and using the same IP address. It might -also allow one to look for clocks that match an expected value to find the -public IP used by a user. - -Hence, this package disables this feature by shipping the -/etc/sysctl.d/tcp_timestamps.conf configuration file. - -Note that TCP time stamps normally have some usefulness. They are -needed for: - -* the TCP protection against wrapped sequence numbers; however, to - trigger a wrap, one needs to send roughly 2^32 packets in one - minute: as said in RFC 1700, "The current recommended default - time to live (TTL) for the Internet Protocol (IP) [45,105] is 64". - So, this probably won't be a practical problem in the context - of Anonymity Distributions. - -* "Round-Trip Time Measurement", which is only useful when the user - manages to saturate their connection. When using Anonymity Distributions, - probably the limiting factor for transmission speed is rarely the capacity - of the user connection. - -Netfilter's connection tracking helper module increases kernel attack -surface by enabling superfluous functionality such as IRC parsing in -the kernel. (!) - -Hence, this package disables this feature by shipping the -/etc/sysctl.d/nf_conntrack_helper.conf configuration file. +See README. %prep %setup -q @@ -72,48 +29,9 @@ make %{?_smp_mflags} %files %license debian/copyright -/etc/X11/Xsession.d/50panic_on_oops -/etc/X11/Xsession.d/50security-misc -/etc/apparmor.d/tunables/home.d/security-misc -/etc/apt/apt.conf.d/40sandbox -/etc/default/grub.d/40_enable_iommu.cfg -/etc/default/grub.d/40_kernel_hardening.cfg -/etc/login.defs.security-misc -/etc/modprobe.d/30_nf_conntrack_helper_disable.conf -/etc/modprobe.d/blacklist-dma.conf -/etc/modprobe.d/uncommon-network-protocols.conf -/etc/securetty.security-misc -/etc/security/limits.d/disable-coredumps.conf -/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml -/etc/sudoers.d/security-misc -/etc/sysctl.d/coredumps.conf -/etc/sysctl.d/dmesg_restrict.conf -/etc/sysctl.d/fs_protected.conf -/etc/sysctl.d/harden_bpf.conf -/etc/sysctl.d/kexec.conf -/etc/sysctl.d/kptr_restrict.conf -/etc/sysctl.d/mmap_aslr.conf -/etc/sysctl.d/ptrace_scope.conf -/etc/sysctl.d/suid_dumpable.conf -/etc/sysctl.d/sysrq.conf -/etc/sysctl.d/tcp_hardening.conf -/etc/sysctl.d/tcp_sack.conf -/etc/sysctl.d/tcp_timestamps.conf -/etc/systemd/system/emergency.service.d/override.conf -/etc/systemd/system/rescue.service.d/override.conf -/lib/systemd/coredump.conf.d/disable-coredumps.conf -/lib/systemd/system/proc-hidepid.service -/lib/systemd/system/remove-system-map.service -/usr/lib/security-misc/apt-get-update -/usr/lib/security-misc/apt-get-update-sanity-test -/usr/lib/security-misc/apt-get-wrapper -/usr/lib/security-misc/panic-on-oops -/usr/lib/security-misc/remove-system.map -/usr/share/glib-2.0/schemas/30_security-misc.gschema.override -/usr/share/lintian/overrides/security-misc -/usr/share/pam-configs/usergroups -/usr/share/pam-configs/wheel -/usr/share/security-misc/dolphinrc +/etc/* +/lib/* +/usr/* %changelog @CHANGELOG@ diff --git a/usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared b/usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared new file mode 100755 index 00000000..f52a6b1d --- /dev/null +++ b/usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Bluetooth kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-cdrom-by-security-misc#security-misc-shared b/usr/bin/disabled-cdrom-by-security-misc#security-misc-shared new file mode 100755 index 00000000..bb4db834 --- /dev/null +++ b/usr/bin/disabled-cdrom-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This CD-ROM/DVD kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared b/usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared new file mode 100755 index 00000000..7e5bdadd --- /dev/null +++ b/usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This CPU MSR kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-filesys-by-security-misc#security-misc-shared b/usr/bin/disabled-filesys-by-security-misc#security-misc-shared new file mode 100755 index 00000000..d85a951a --- /dev/null +++ b/usr/bin/disabled-filesys-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This file system kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-firewire-by-security-misc#security-misc-shared b/usr/bin/disabled-firewire-by-security-misc#security-misc-shared new file mode 100755 index 00000000..ecd429e1 --- /dev/null +++ b/usr/bin/disabled-firewire-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This FireWire (IEEE 1394) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared b/usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared new file mode 100755 index 00000000..97e5869a --- /dev/null +++ b/usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This framebuffer (fbdev) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-gps-by-security-misc#security-misc-shared b/usr/bin/disabled-gps-by-security-misc#security-misc-shared new file mode 100755 index 00000000..9a29b36d --- /dev/null +++ b/usr/bin/disabled-gps-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Global Positioning System (GPS) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-intelme-by-security-misc#security-misc-shared b/usr/bin/disabled-intelme-by-security-misc#security-misc-shared new file mode 100755 index 00000000..b50fbbd0 --- /dev/null +++ b/usr/bin/disabled-intelme-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Intel Management Engine (ME) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared b/usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared new file mode 100755 index 00000000..edee2680 --- /dev/null +++ b/usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Intel Platform Monitoring Technology (PMT) Telemetry kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared b/usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared new file mode 100755 index 00000000..04b627c8 --- /dev/null +++ b/usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared b/usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared new file mode 100755 index 00000000..de4db437 --- /dev/null +++ b/usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This network file system kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-network-by-security-misc#security-misc-shared b/usr/bin/disabled-network-by-security-misc#security-misc-shared new file mode 100755 index 00000000..3d2e342a --- /dev/null +++ b/usr/bin/disabled-network-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This network protocol kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared b/usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared new file mode 100755 index 00000000..faa380bc --- /dev/null +++ b/usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Thunderbolt kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/fm-shim-frontend#security-misc-shared b/usr/bin/fm-shim-frontend#security-misc-shared new file mode 100755 index 00000000..fadcd9e0 --- /dev/null +++ b/usr/bin/fm-shim-frontend#security-misc-shared @@ -0,0 +1,10 @@ +#!/usr/bin/python3 -Bsu + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Shell-invocation guard. +"exec" "bash" "-c" "printf '%s\n' '$0: ERROR: Do not execute this script with bash!' >&2; exit 1" + +from fm_shim_frontend.fm_shim_frontend import main +main() diff --git a/usr/bin/permission-hardener#security-misc-shared b/usr/bin/permission-hardener#security-misc-shared new file mode 100755 index 00000000..7e92e0a5 --- /dev/null +++ b/usr/bin/permission-hardener#security-misc-shared @@ -0,0 +1,1096 @@ +#!/bin/bash +# shellcheck disable=SC2076 + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## https://forums.whonix.org/t/disable-suid-binaries/7706 +## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 + +## dpkg-statoverride does not support end-of-options ("--"). + +## SC2076 is disabled because ShellCheck seems to think that any use of +## [[ ... =~ ... ]] is supposed to be a regex match. But [[ '...' =~ '...' ]] +## works very well for literal matching, and it is used that way extensively +## throughout this script. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## Constants +# shellcheck disable=SC2034 +log_level=notice +store_dir="/var/lib/permission-hardener-v2" +state_file="${store_dir}/existing_mode/statoverride" +dpkg_admindir_parameter_existing_mode="--admindir ${store_dir}/existing_mode" +dpkg_admindir_parameter_new_mode="--admindir ${store_dir}/new_mode" +delimiter="#permission-hardener-delimiter#" + +## Library imports +# shellcheck source=../../../helper-scripts/usr/libexec/helper-scripts/safe_echo.sh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/safe_echo.sh +# shellcheck source=../../../helper-scripts/usr/libexec/helper-scripts/log_run_die.sh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/log_run_die.sh +# shellcheck source=../../../helper-scripts/usr/libexec/helper-scripts/strings.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/strings.bsh + +## Functions +echo_wrapper_ignore() { + if [ "${1}" = 'verbose' ]; then + shift + log notice "Executing: $*" + elif [ "${1}" = 'silent' ]; then + shift + else + log error "Unrecognized command '${1}'! calling function name: '${FUNCNAME[1]}'" >&2 + return + fi + "$@" 2>/dev/null || true +} + +echo_wrapper_audit() { + local return_code + if [ "${1}" = 'verbose' ]; then + shift + log notice "Executing: $*" + elif [ "${1}" = 'silent' ]; then + shift + else + log error "Unrecognized command '${1}'! calling function name: '${FUNCNAME[1]}'" >&2 + return + fi + return_code=0 + "$@" || + { + return_code="$?" + exit_code=203 + log error "Command '$*' failed with exit code '${return_code}'! calling function name: '${FUNCNAME[1]}'" >&2 + } +} + +## Some tools may fail on newlines and even variable assignment to array may +## fail if a variable that will be assigned to an array element contains +## characters that are used as delimiters. +block_newlines() { + local newline_variable newline_value + newline_variable="${1:-}" + newline_value="${2:-}" + ## dpkg-statoverride: error: path may not contain newlines + if [[ "${newline_value}" != "${newline_value//$'\n'/NEWLINE}" ]]; then + log warn "Skipping ${newline_variable} that contains newlines: '${newline_value}'" >&2 + return 1 + fi +} + +output_stat() { + local file_name stat_output stat_output_newlined hardlink_count + declare -a arr + file_name="${1:-}" + + if [ -z "${file_name}" ]; then + log error "File name is empty. file_name: '${file_name}'" >&2 + return 1 + fi + + if ! block_newlines file "${file_name}"; then + existing_mode='' + existing_owner='' + existing_group='' + file_name_from_stat='' + return 0 + fi + + if [ ! -e "${file_name}" ]; then + log info "File does not exist. file_name: '${file_name}'" >&2 + existing_mode='' + existing_owner='' + existing_group='' + file_name_from_stat='' + return 0 + fi + + if ! stat_output="$(stat -L \ + --format="%a${delimiter}%U${delimiter}%G${delimiter}%n${delimiter}%h${delimiter}" \ + -- "${file_name}")"; then + log error "Failed to run 'stat' on file: '${file_name}'!" >&2 + return 1 + fi + + if [ -z "${stat_output}" ]; then + log error "stat_output is empty. +File name: '${file_name}' +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + stat_output_newlined="$(printf '%s\n' "${stat_output//${delimiter}/$'\n'}")" + + if [ -z "${stat_output_newlined}" ]; then + log error "stat_output_newlined is empty. +File name: '${file_name}' +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + readarray -t arr <<< "${stat_output_newlined}" + + if [ "${#arr[@]}" = '0' ]; then + log error "Array length is 0. +File name: '${file_name}' +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + existing_mode="${arr[0]}" + existing_owner="${arr[1]}" + existing_group="${arr[2]}" + file_name_from_stat="${arr[3]}" + hardlink_count="${arr[4]}" + + if ! is_whole_number "${hardlink_count}"; then + log error "\ +hardlink_count returned by stat is not an integer. +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +hardlink_count: '${hardlink_count}' +" >&2 + return 1 + fi + + if [ "${file_name}" != "${file_name_from_stat}" ]; then + log error "\ +File name is different from file name received from stat: +File name: '${file_name}' +File name from stat: '${file_name_from_stat}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + ## We can't handle files with hardlinks because figuring out all of the files + ## in a "hardlink pool" requires scanning the whole filesystem, which would + ## result in an unacceptable performance hit for this script. We don't check + ## directory hardlinks since directories can't have traditional hardlinks. + if [ ! -d "${file_name_from_stat}" ]; then + if (( hardlink_count > 1 )); then + log info "File has unexpected hardlinks, cannot handle. file_name: '${file_name}'" >&2 + existing_mode='' + existing_owner='' + existing_group='' + file_name_from_stat='' + return 0 + fi + fi + + if [ -z "${existing_mode}" ]; then + log error "Existing mode is empty. Stat output: '${stat_output}', line: '${processed_config_line}'" >&2 + return 1 + fi + if [ -z "${existing_owner}" ]; then + log error "Existing owner is empty. Stat output: '${stat_output}', line: '${processed_config_line}'" >&2 + return 1 + fi + if [ -z "${existing_group}" ]; then + log error "Existing group is empty. Stat output: '${stat_output}', line: '${processed_config_line}'" >&2 + return 1 + fi + + ## If a symlink was passed as input, return the original file's path rather + ## than the symlink to avoid problems stemming from using the wrong path + if [ -h "${file_name_from_stat}" ]; then + file_name_from_stat="$(realpath "${file_name_from_stat}")" + fi +} + +print_usage(){ + safe_echo "Usage: ${0##*/} enable + ${0##*/} disable [FILE|all] + ${0##*/} print-policy + ${0##*/} print-state + ${0##*/} print-policy-applied-state + ${0##*/} print-diagnostics + +Examples: + ${0##*/} enable + ${0##*/} disable all + ${0##*/} disable /usr/bin/newgrp" >&2 +} + +add_to_policy() { + local file_name file_mode file_owner file_group updated_entry policy_idx \ + file_capabilities + file_name="${1:-}" + file_mode="${2:-}" + file_owner="${3:-}" + file_group="${4:-}" + file_capabilities="${5:-}" + updated_entry=false + + if [ -z "${file_name}" ]; then + exit_code=207 + log error "Attempted to add a policy entry with an empty filename! file_mode='${file_mode}' file_onwer='${file_owner}' file_group='${file_group}' file_capabilities='${file_capabilities}'" >&2 + exit "${exit_code}" + fi + + if [ -h "${file_name}" ]; then + file_name="$(realpath "${file_name}")" || return 1 + fi + + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + if [ "${policy_file_list[policy_idx]}" = "${file_name}" ]; then + policy_mode_list[policy_idx]="${file_mode}" + policy_user_owner_list[policy_idx]="${file_owner}" + policy_group_owner_list[policy_idx]="${file_group}" + policy_capability_list[policy_idx]="${file_capabilities}" + updated_entry=true + break + fi + done + + if [ "${updated_entry}" != 'true' ]; then + policy_file_list+=( "${file_name}" ) + policy_mode_list+=( "${file_mode}" ) + policy_user_owner_list+=( "${file_owner}" ) + policy_group_owner_list+=( "${file_group}" ) + policy_capability_list+=( "${file_capabilities}" ) + fi +} + +check_nosuid_whitelist() { + local target_file match_white_list_entry + + target_file="${1:-}" + + ## Handle whitelists, if we're supposed to + [ "${whitelists_disable_all}" = 'true' ] && return 0 + + ## literal matching is intentional here + [[ " ${policy_disable_white_list[*]} " =~ " ${target_file} " ]] && return 0 + + ## literal matching is intentional here too + [[ " ${policy_exact_white_list[*]} " =~ " ${target_file} " ]] && return 1 + + for match_white_list_entry in "${policy_match_white_list[@]}"; do + if [[ "${target_file}" == *"${match_white_list_entry}"* ]]; then + return 1 + fi + done + + return 0 +} + +load_early_nosuid_policy() { + local target_file find_list_item + + target_file="${1:-}" + + # shellcheck disable=SC2185 + while IFS="" read -r -d "" find_list_item; do + check_nosuid_whitelist "${find_list_item}" || continue + + ## sets: + ## exiting_mode + ## existing_owner + ## existing_group + output_stat "${find_list_item}" + if [ -z "${file_name_from_stat}" ]; then + continue + fi + + ## -h file True if file is a symbolic link. + if [ -h "${find_list_item}" ]; then + ## https://forums.whonix.org/t/disable-suid-binaries/7706/14 + log info "Skip symlink: '${find_list_item}'" + continue + fi + + if [ -d "${find_list_item}" ]; then + log info "Skip directory: '${find_list_item}'" + continue + fi + + ## Remove suid / gid and execute permission for 'group' and 'others'. + ## Similar to: chmod og-ugx /path/to/filename + ## Removing execution permission is useful to make binaries such as 'su' + ## fail closed rather than fail open if suid was removed from these. + ## Do not remove read access since no security benefit and easier to + ## manually undo for users. + ## Are there suid or sgid binaries which are still useful if suid / sgid + ## has been removed from these? + local new_mode + new_mode='744' + + add_to_policy "${file_name_from_stat}" "${new_mode}" "${existing_owner}" \ + "${existing_group}" + done < <(safe_echo_nonewline "${target_file}" \ + | find -files0-from - -perm /u=s,g=s -print0) +} + +## If the "target file" matches the start of the state file name, that's a +## likely match. This is used by load_late_nosuid_policy for detecting info +## about files that need SUID-locked that are in the state. +match_dir() { + local base_str match_str base_arr match_arr base_idx + + base_str="${1}" + match_str="${2}" + if [ -z "${base_str}" ] || [ -z "${match_str}" ]; then + exit_code=207 + log error "Empty base_str or match_str provided to match_dir! base_str: '${base_str}' match_str: '${match_str}'" >&2 + exit "${exit_code}" + fi + [[ "${base_str}" =~ '//' ]] && return 1 + [[ "${match_str}" =~ '//' ]] && return 1 + + IFS='/' read -r -a base_arr <<< "${base_str}" + IFS='/' read -r -a match_arr <<< "${match_str}" + (( ${#base_arr[@]} > ${#match_arr[@]} )) && return 1 + + for (( base_idx=0; base_idx < ${#base_arr[@]}; base_idx++ )); do + if [ "${base_arr[base_idx]}" != "${match_arr[base_idx]}" ]; then + return 1 + fi + done + + return 0 +} + +load_late_nosuid_policy() { + local target_file state_idx state_file_item state_user_owner_item \ + state_group_owner_item new_mode + + target_file="${1:-}" + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + check_nosuid_whitelist "${state_file_item}" || continue + + match_dir "${target_file}" "${state_file_item}" || continue + + if [ -h "${state_file_item}" ]; then + ## https://forums.whonix.org/t/disable-suid-binaries/7706/14 + log info "Skip symlink: '${state_file_item}'" + continue + fi + + if [ -d "${state_file_item}" ]; then + log info "Skip directory: '${state_file_item}'" + continue + fi + + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + new_mode='744' + add_to_policy "${state_file_item}" "${new_mode}" \ + "${state_user_owner_item}" "${state_group_owner_item}" + done +} + +load_state_without_policy() { + local line sf_owner sf_group sf_mode sf_path + + ## Load the state file from disk. + if [ -f "${state_file}" ]; then + while read -r line; do + read -r sf_owner sf_group sf_mode sf_path <<< "${line}" + if [ -z "${sf_path}" ]; then + log info \ + "Invalid number of fields in state file line: '${line}'. Skipping." + continue + fi + state_user_owner_list+=( "${sf_owner}" ) + state_group_owner_list+=( "${sf_group}" ) + state_mode_list+=( "${sf_mode}" ) + state_file_list+=( "${sf_path}" ) + done < "${state_file}" + fi +} + +load_state() { + ## Config format: + ## path options + ## where options is one of: + ## filemode user_owner group_owner [capability-setting] + ## [nosuid|exactwhitelist|matchwhitelist|disablewhitelist] + ## + ## Additionally, the special value 'whitelists_disable_all=true' is understood + ## to mean that all whitelisting should be ignored. + + local config_file line field_list policy_nosuid_file_item policy_file_item + local one_field field_count fso_name meta_list field_index hit_barrier + + ## Load configuration, deferring whitelist handling until later + for config_file in \ + /usr/lib/permission-hardener.d/*.conf \ + /etc/permission-hardener.d/*.conf \ + /usr/local/etc/permission-hardener.d/*.conf \ + /etc/permission-hardening.d/*.conf \ + /usr/local/etc/permission-hardening.d/*.conf + do + if [ ! -f "${config_file}" ]; then + continue + fi + + while read -r line; do + if [ -z "${line}" ]; then + true 'DEBUG: line is empty. Skipping.' + continue + fi + + if [[ "${line}" =~ ^\s*# ]]; then + continue + fi + + if [ "${line}" = 'whitelists_disable_all=true' ]; then + whitelists_disable_all=true + log info "whitelists_disable_all=true" + continue + fi + + if ! [[ "${line}" =~ ^[-0-9a-zA-Z._/[:space:]]*$ ]]; then + exit_code=200 + log error "Line contains invalid characters: '${line}'" >&2 + ## Safer to exit with error in this case. + ## https://forums.whonix.org/t/disable-suid-binaries/7706/59 + exit "${exit_code}" + fi + + processed_config_line="${line}" + + ## We can handle filenames with spaces. This is because the first item + ## after a filename is either an octal file mode or a keyword, and we + ## only support user/group names, not UIDs and GIDs, as owner + ## identifiers. This means that we can scan from right to left for the + ## furthest-right octal integer or keyword field and use it to separate + ## the filename from the rest of the options. (If usernames could + ## themselves be octal integers, this would break, but adduser.conf's + ## default NAME_REGEX forbids this. This is definitely a hack, but the + ## alternative is to change the format of the policy files, which would + ## break custom config for users. + ## + ## Do not attempt to reimplement this in a way that copes with usernames + ## that look identical to UIDs. Systems containing such usernames are + ## very broken and unsupported. + ## + ## 'read' will collapse consecutive spaces when splitting on spaces. + ## Convert spaces into newlines first, then split on newlines with a + ## loop. + field_list=() + while IFS= read -r one_field; do + field_list+=( "${one_field}" ) + done < <(printf '%s\n' "${line}" | tr ' ' '\n') + field_count="${#field_list[@]}" + + hit_barrier='false' + fso_name="" + meta_list=() + for (( field_index = field_count - 1; field_index >= 0; \ + field_index-- )); do + if [ "${hit_barrier}" = 'false' ]; then + if [[ "${field_list[field_index]}" =~ ^[0-7]{3,4}$ ]] \ + || [[ "${field_list[field_index]}" =~ ^(nosuid|exactwhitelist|matchwhitelist|disablewhitelist)$ ]]; then + hit_barrier='true' + fi + meta_list=( "${field_list[field_index]}" "${meta_list[@]}" ) + else + fso_name="${field_list[field_index]}${fso_name:+" ${fso_name}"}" + fi + done + + case "${#meta_list[@]}" in + 1|3|4) + true + ;; + *) + exit_code=200 + log error "Line contains an invalid number of fields: '${line}'" >&2 + exit "${exit_code}" + ;; + esac + + # Strip trailing slash if appropriate + fso_name="${fso_name%/}" + + case "${meta_list[0]}" in + 'exactwhitelist') + [ ! -e "${fso_name}" ] && continue + policy_exact_white_list+=( "${fso_name}" ) + continue + ;; + 'matchwhitelist') + policy_match_white_list+=( "${fso_name}" ) + continue + ;; + 'disablewhitelist') + policy_disable_white_list+=( "${fso_name}" ) + continue + ;; + 'nosuid') + [ ! -e "${fso_name}" ] && continue + policy_nosuid_file_list+=( "${fso_name}" ) + ;; + *) + [ ! -e "${fso_name}" ] && continue + add_to_policy "${fso_name}" "${meta_list[@]}" + ;; + esac + done < "${config_file}" + done + + ## We have to handle nosuid files at the end since the whitelist arrays need + ## built first. + for policy_nosuid_file_item in "${policy_nosuid_file_list[@]}"; do + load_early_nosuid_policy "${policy_nosuid_file_item}" + done + + load_state_without_policy + + ## Find any files in the policy that don't already have a matching file in + ## the state. Add those files to the state, and save them to the state file + ## as well. + for policy_file_item in "${policy_file_list[@]}"; do + if [[ " ${state_file_list[*]} " =~ " ${policy_file_item} " ]]; then + continue + fi + output_stat "${policy_file_item}" + if [ -z "${file_name_from_stat}" ]; then + continue + fi + state_file_list+=( "${file_name_from_stat}" ) + state_user_owner_list+=( "${existing_owner}" ) + state_group_owner_list+=( "${existing_group}" ) + state_mode_list+=( "${existing_mode}" ) + # shellcheck disable=SC2086 + echo_wrapper_audit silent dpkg-statoverride \ + ${dpkg_admindir_parameter_existing_mode} \ + --add "${existing_owner}" "${existing_group}" "${existing_mode}" \ + "${file_name_from_stat}" + done + + ## Fix up nosuid policies using state information + for policy_nosuid_file_item in "${policy_nosuid_file_list[@]}"; do + load_late_nosuid_policy "${policy_nosuid_file_item}" + done +} + +apply_policy() { + local policy_idx did_state_update state_idx + + ## Modify the in-memory state so that all items that the policy affects match + ## the policy. DO NOT save these changes to the state file! + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + did_state_update=false + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + if [ "${state_file_list[state_idx]}" = "${policy_file_list[policy_idx]}" ]; then + state_user_owner_list[state_idx]="${policy_user_owner_list[policy_idx]}" + state_group_owner_list[state_idx]="${policy_group_owner_list[policy_idx]}" + state_mode_list[state_idx]="${policy_mode_list[policy_idx]}" + did_state_update=true + break + fi + done + if [ "${did_state_update}" = 'false' ]; then + exit_code=206 + log error \ + "File exists in policy but not in state! File: '${policy_file_list[policy_idx]}'" + exit "${exit_code}" + fi + done +} + +commit_policy() { + local policy_idx state_idx state_file_item \ + state_user_owner_item state_group_owner_item \ + state_mode_item orig_main_statoverride_db orig_new_statoverride_db \ + policy_file_item policy_capability_item + + ## Check each file on the filesystem against the state, and update it if the + ## state does not match. Also ensure the consistency of the new_mode database + ## so that people can compare the original permissions of files with the new + ## permissions. + orig_main_statoverride_db="$(dpkg-statoverride --list)" || true + # shellcheck disable=SC2086 + orig_new_statoverride_db="$(dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --list)" || true + + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + state_mode_item="${state_mode_list[state_idx]}" + + ## Get rid of leading zeros, stat doesn't output them due to how we use it. + ## Using BASH_REMATCH is faster than sed. We capture all leading zeros into + ## one group, and the rest of the string into a second group. The second + ## group is the string we want. BASH_REMATCH[0] is the entire string, + ## BASH_REMATCH[1] is the first match that we want to discard, and + ## BASH_REMATCH[2] is the desired second group. + if [[ "${state_mode_item}" =~ ^(0*)(.*) ]]; then + state_mode_item="${BASH_REMATCH[2]}" + else + exit_code=208 + log error "'Impossible' regex match failure in commit_policy! Regex: '^(0*)(.*)' String (state_mode_item): '${state_mode_item}'" >&2 + exit "${exit_code}" + fi + + output_stat "${state_file_item}" + if [ -z "${file_name_from_stat}" ]; then + continue + fi + + if [ "${existing_owner}" != "${state_user_owner_item}" ] \ + || [ "${existing_group}" != "${state_group_owner_item}" ] \ + || [ "${existing_mode}" != "${state_mode_item}" ]; then + ## Anchor user/group lookups to line boundaries to prevent substring + ## matches (e.g. 'oot' must not match 'root:...') + if ! [[ $'\n'"${passwd_file_contents}" \ + =~ $'\n'"${state_user_owner_item}:" ]]; then + log error "Owner from config does not exist: '${state_user_owner_item}'" >&2 + continue + fi + + if ! [[ $'\n'"${group_file_contents}" \ + =~ $'\n'"${state_group_owner_item}:" ]]; then + log error "Group from config does not exist: '${state_group_owner_item}'" >&2 + continue + fi + ## Remove and reapply in main list + ## Anchor to file field and line boundary to prevent substring path + ## matches + if [[ "${orig_main_statoverride_db}"$'\n' \ + =~ [[:space:]]"${file_name_from_stat}"$'\n' ]]; then + echo_wrapper_ignore silent dpkg-statoverride --remove \ + "${file_name_from_stat}" + fi + echo_wrapper_audit verbose dpkg-statoverride --add --update \ + "${state_user_owner_item}" "${state_group_owner_item}" \ + "${state_mode_item}" "${file_name_from_stat}" + + ## Update item in secondary list + if [[ "${orig_new_statoverride_db}"$'\n' \ + =~ [[:space:]]"${file_name_from_stat}"$'\n' ]]; then + # shellcheck disable=SC2086 + echo_wrapper_ignore silent dpkg-statoverride \ + ${dpkg_admindir_parameter_new_mode} --remove \ + "${file_name_from_stat}" + fi + # shellcheck disable=SC2086 + echo_wrapper_audit verbose dpkg-statoverride \ + ${dpkg_admindir_parameter_new_mode} --add \ + "${state_user_owner_item}" "${state_group_owner_item}" \ + "${state_mode_item}" "${file_name_from_stat}" + fi + done + + ## Apply capability hardening, dpkg-statoverride can't handle this so we have + ## to do this manually + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + policy_file_item="${policy_file_list[policy_idx]}" + policy_capability_item="${policy_capability_list[policy_idx]}" + if [ -z "${policy_capability_item}" ]; then + continue + fi + + if [ "${policy_capability_item}" = 'none' ]; then + echo_wrapper_ignore verbose setcap -r "${policy_file_item}" + if [ -n "$(getcap -- "${policy_file_item}")" ]; then + exit_code=205 + log error \ + "Removing capabilities failed. File: '${policy_file_item}'" >&2 + continue + fi + else + if ! capsh --print \ + | grep --fixed-strings -- "Bounding set" \ + | grep -- "${policy_capability_item}" >/dev/null; then + log error \ + "Capability from config does not exist: '${policy_capability_item}'" \ + >&2 + continue + fi + + ## feature request: dpkg-statoverride: support for capabilities + ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502580 + echo_wrapper_audit verbose setcap "${policy_capability_item}+ep" \ + -- "${policy_file_item}" + fi + done + + log notice "\ +To compare the current and previous permission modes, install 'meld' (or preferred diff tool) for comparison of file mode changes: + sudo apt install --no-install-recommends meld + meld ${store_dir}/existing_mode/statoverride ${store_dir}/new_mode/statoverride" +} + +undo_policy_for_file() { + local undo_file state_idx state_file_item did_undo \ + undo_all verbose orig_main_statoverride_db orig_new_statoverride_db \ + state_user_owner_item state_group_owner_item state_mode_item + + undo_file="${1}" + undo_all=false + verbose=('--verbose') + if [ "${undo_file}" = 'all' ]; then + undo_all=true + verbose=() + fi + + if [ ! -f "${state_file}" ]; then + true 'DEBUG: State file does not exist, hardening was not applied before.' + return 0 + fi + + did_undo=false + + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + if [ "${undo_all}" = 'true' ]; then + undo_file="${state_file_item}" + fi + + if [ "${state_file_item}" = "${undo_file}" ]; then + orig_main_statoverride_db="$(dpkg-statoverride --list)" || true + # shellcheck disable=SC2086 + orig_new_statoverride_db="$(dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --list)" || true + + if [[ "${orig_main_statoverride_db}"$'\n' \ + =~ [[:space:]]"${undo_file}"$'\n' ]]; then + echo_wrapper_ignore silent dpkg-statoverride --remove \ + "${undo_file}" + fi + + if [[ "${orig_new_statoverride_db}"$'\n' \ + =~ [[:space:]]"${undo_file}"$'\n' ]]; then + # shellcheck disable=SC2086 + echo_wrapper_ignore silent dpkg-statoverride \ + ${dpkg_admindir_parameter_new_mode} --remove \ + "${undo_file}" + fi + + if [ -e "${undo_file}" ]; then + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + state_mode_item="${state_mode_list[state_idx]}" + chown "${verbose[@]}" -- "${state_user_owner_item}:${state_group_owner_item}" \ + "${undo_file}" || exit_code=202 + ## chmod needs to be run after chown since chown removes suid. + chmod "${verbose[@]}" "${state_mode_item}" "${undo_file}" || exit_code=203 + else + log info "File does not exist: '${undo_file}'" + fi + did_undo=true + + if [ "${undo_all}" = 'false' ]; then + break + fi + fi + done + + if [ "${did_undo}" = 'false' ]; then + log notice "The specified file is not hardened, leaving unchanged. + + File '${undo_file}' has not been removed from SUID Disabler and Permission Hardener during this invocation. This is expected if no policy was ever applied to the file before. + + This program expects the full path to the file. Example: + $0 disable /usr/bin/newgrp # absolute path: works + $0 disable newgrp # relative path: does not work + + To remove all: + $0 disable all + + This change might not be permanent. For full instructions, see: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener + + To view list of changed by SUID Disabler and Permission Hardener: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#View_List_of_Permissions_Changed_by_SUID_Disabler_and_Permission_Hardener + + For re-enabling any specific SUID binary: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Re-Enable_Specific_SUID_Binaries + + For completely disabling SUID Disabler and Permission Hardener: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Disable_SUID_Disabler_and_Permission_Hardener" + fi +} + +print_columns() { + local format_str + format_str='' + for _ in "$@"; do + format_str="${format_str}%s\t" + done + format_str="${format_str}\n" + ## Using a dynamically generated format string on purpose. + ## style-ok: printf-format + # shellcheck disable=SC2059 + printf "${format_str}" "$@" +} + +print_policy() { + local policy_idx + + print_columns 'File' 'User' 'Group' 'Mode' 'Capabilities' + + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + print_columns \ + "${policy_file_list[policy_idx]}" \ + "${policy_user_owner_list[policy_idx]}" \ + "${policy_group_owner_list[policy_idx]}" \ + "${policy_mode_list[policy_idx]}" \ + "${policy_capability_list[policy_idx]}" + done +} + +print_state() { + local state_idx + + print_columns 'File' 'User' 'Group' 'Mode' + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + print_columns \ + "${state_file_list[state_idx]}" \ + "${state_user_owner_list[state_idx]}" \ + "${state_group_owner_list[state_idx]}" \ + "${state_mode_list[state_idx]}" + done +} + +print_raw_policy_config() { + local config_file + for config_file in \ + /usr/lib/permission-hardener.d/*.conf \ + /etc/permission-hardener.d/*.conf \ + /usr/local/etc/permission-hardener.d/*.conf \ + /etc/permission-hardening.d/*.conf \ + /usr/local/etc/permission-hardening.d/*.conf + do + if [ ! -f "${config_file}" ]; then + continue + fi + printf '%s\n' "*** begin ${config_file} ***" + cat "${config_file}" + printf '%s\n' "*** end ${config_file} ***" + done +} + +print_raw_state() { + local state_file + for state_file in "${store_dir}/existing_mode/statoverride" \ + "${store_dir}/new_mode/statoverride"; do + printf '%s\n' "*** begin ${state_file} ***" + if [ -f "${state_file}" ]; then + cat "${state_file}" + else + printf '%s\n' '(file does not exist)' + fi + printf '%s\n' "*** end ${state_file} ***" + done +} + +print_fs_audit() { + local state_idx state_file_item state_user_owner_item state_group_owner_item \ + state_mode_item + + printf '%s\n' 'Legend:' + printf '%s\n' '... - Warning about an unusual, but not necessarily wrong, condition' + printf '%s\n' '!!! - Warning about an unusual and definitely wrong condition' + printf '%s\n' '*** - File permission data, actual state on filesystem is consistent with policy' + printf '%s\n' '^^^ - File permission data, actual state on filesystem is inconsistent with policy' + printf '%s\n' 'vvv - File permissions specified by state, always shown after a ^^^ item' + printf '%s\n' '' + + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + state_mode_item="${state_mode_list[state_idx]}" + + ## Get rid of leading zeros, stat doesn't output them due to how we use it. + ## Using BASH_REMATCH is faster than sed. We capture all leading zeros into + ## one group, and the rest of the string into a second group. The second + ## group is the string we want. BASH_REMATCH[0] is the entire string, + ## BASH_REMATCH[1] is the first match that we want to discard, and + ## BASH_REMATCH[2] is the desired second group. + if [[ "${state_mode_item}" =~ ^(0*)(.*) ]]; then + state_mode_item="${BASH_REMATCH[2]}" + else + exit_code=208 + log error "'Impossible' regex match failure in print_fs_audit! Regex: '^(0*)(.*)' String (state_mode_item): '${state_mode_item}'" >&2 + exit "${exit_code}" + fi + + output_stat "${state_file_item}" + if [ -z "${file_name_from_stat}" ]; then + printf '%s\n' "... '${state_file_item}' does not exist or has multiple hardlinks" + continue + fi + + if [ "${existing_owner}" != "${state_user_owner_item}" ] \ + || [ "${existing_group}" != "${state_group_owner_item}" ] \ + || [ "${existing_mode}" != "${state_mode_item}" ]; then + if ! [[ $'\n'"${passwd_file_contents}" \ + =~ $'\n'"${state_user_owner_item}:" ]]; then + printf '%s\n' "!!! Owner from config does not exist: '${state_user_owner_item}'" + continue + fi + + if ! [[ $'\n'"${group_file_contents}" \ + =~ $'\n'"${state_group_owner_item}:" ]]; then + printf '%s\n' "!!! Group from config does not exist: '${state_group_owner_item}'" + continue + fi + + printf '%s\n' "^^^ ${file_name_from_stat} ${existing_owner}:${existing_group} ${existing_mode}" + printf '%s\n' "vvv ${file_name_from_stat} ${state_user_owner_item}:${state_group_owner_item} ${state_mode_item}" + else + printf '%s\n' "*** ${file_name_from_stat} ${existing_owner}:${existing_group} ${existing_mode}" + fi + done +} + +reset_global_vars() { + ## Global variables + policy_file_list=() + policy_user_owner_list=() + policy_group_owner_list=() + policy_mode_list=() + policy_capability_list=() + policy_exact_white_list=() + policy_match_white_list=() + policy_disable_white_list=() + policy_nosuid_file_list=() + state_file_list=() + state_user_owner_list=() + state_group_owner_list=() + state_mode_list=() + whitelists_disable_all=false + existing_mode='' + existing_owner='' + existing_group='' + processed_config_line='' + file_name_from_stat='' + passwd_file_contents="$(getent passwd)" + group_file_contents="$(getent group)" + exit_code=0 +} + +reset_global_vars + +## Setup and sanity checking +if [ "$(id -u)" != '0' ]; then + log error "Not running as root, aborting." + exit 1 +fi + +mkdir --parents "${store_dir}/existing_mode" +mkdir --parents "${store_dir}/new_mode" + +echo_wrapper_audit silent which capsh getcap setcap stat find \ + dpkg-statoverride getent grep 1>/dev/null + +## Command parsing and execution +case "${1:-}" in + enable) + shift + load_state + apply_policy + commit_policy + ;; + disable) + shift + case "${1:-}" in + "") + print_usage + exit 1 + ;; + *) + load_state_without_policy + undo_policy_for_file "${1}" + ;; + esac + ;; + print-policy) + load_state + print_policy + ;; + print-state) + load_state + print_state + ;; + print-policy-applied-state) + load_state + apply_policy + print_state + ;; + print-diagnostics) + printf '%s\n' '=== BEGIN PERMISSION-HARDENER DIAGNOSTICS ===' + + printf '%s\n' '--- BEGIN State without policy ---' + load_state_without_policy + print_state + printf '%s\n' '--- END State without policy ---' + + reset_global_vars + + printf '%s\n' '--- BEGIN Policy without state ---' + load_state + print_policy + printf '%s\n' '--- END Policy without state ---' + + reset_global_vars + + printf '%s\n' '--- BEGIN Policy-applied-state ---' + load_state + apply_policy + print_state + printf '%s\n' '--- END Policy-applied state ---' + + reset_global_vars + + printf '%s\n' '--- BEGIN Master dpkg-statoverride database ---' + dpkg-statoverride --list + printf '%s\n' '--- END Master dpkg-statoverride database ---' + + printf '%s\n' '--- BEGIN Raw policy configuration ---' + print_raw_policy_config + printf '%s\n' '--- END Raw policy configuration ---' + + printf '%s\n' '--- BEGIN Raw state data ---' + print_raw_state + printf '%s\n' '--- END Raw state data ---' + + printf '%s\n' '--- BEGIN Filesystem state audit ---' + load_state + apply_policy + print_fs_audit + printf '%s\n' '--- END Filesystem state audit ---' + + printf '%s\n' '=== END PERMISSION-HARDENER DIAGNOSTICS ===' + ;; + -h|--help) + print_usage + exit 0 + ;; + *) + print_usage + exit 1 + ;; +esac + +## Exit +if test "${exit_code}" != "0"; then + log error "Exiting with non-zero exit code: '${exit_code}'" >&2 +fi + +exit "${exit_code}" diff --git a/usr/bin/pkexec.security-misc b/usr/bin/pkexec.security-misc deleted file mode 100755 index 8a844fc9..00000000 --- a/usr/bin/pkexec.security-misc +++ /dev/null @@ -1,131 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with -## hidepid. -## * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 -## * https://forums.whonix.org/t/cannot-use-pkexec/8129 - -set -e - -my_real_path="$(realpath "$0")" || true -identifier="$my_real_path wrapper" -exec > >(systemd-cat --identifier="$identifier output by program:") 2>&1 - -log_to_journal() { - echo "$@" | systemd-cat --identifier="$identifier output by wrapper:" || true -} - -log_to_journal "$0 $@" -log_to_journal "DISPLAY: '$DISPLAY'" -my_pstree="$(pstree -p $$)" || true -log_to_journal "my_pstree: '$my_pstree'" - -## If hidepid is not in use, just use pkexec normally. -if ! mount | grep "/proc" | grep "hidepid=2" &>/dev/null ; then - pkexec.security-misc-orig "$@" - exit $? -fi - -switch_user=false - -original_args="$@" - -## Thanks to: -## http://mywiki.wooledge.org/BashFAQ/035 - -while : -do - case $1 in - ## Should show 'pkexec --version' or fail? - --version) - shift - pkexec.security-misc-orig "$original_args" - exit $? - ;; - ## Should show 'pkexec --help' or fail? - --help) - shift - pkexec.security-misc-orig "$original_args" - exit $? - ;; - ## Drop --disable-internal-agent as not needed and breaking both, - ## lxqt-sudo and sudo. - --disable-internal-agent) - shift - ;; - --user) - ## lxqt-sudo does not support "--user". - ## We should not make this wrapper run something as root which - ## is supposed to run under a different user. Try using - ## "sudo -A --user user --set-home" instead. - user_pkexec_wrapper="$2" - if [ "$user_pkexec_wrapper" = "" ]; then - shift - else - shift 2 - fi - switch_user=true - maybe_switch_to_user="--user $user_pkexec_wrapper" - ;; - --) - shift - break - ;; - *) - break - ;; - esac -done - -## If there are input files (for example) that follow the options, they -## will remain in the "$@" positional parameters. - -if [ "$PKEXEC_UID" = "" ]; then - if [ ! "$user_pkexec_wrapper" = "" ]; then - PKEXEC_UID="$user_pkexec_wrapper" - elif [ ! "$SUDO_USER" = "" ]; then - PKEXEC_UID="$SUDO_USER" - else - PKEXEC_UID="$(whoami)" - fi -fi -export PKEXEC_UID - -if [[ "$@" = "" ]]; then - ## Call original pkexec in case there are no arguments. - pkexec.security-misc-orig $original_args - exit $? -fi - -exit_code=0 - -## lxqt-sudo does not check /etc/sudoers / /etc/sudoers.d exceptions. -## Therefore use 'sudo -l' to see if there is any already existing sudoers exception. -if sudo -l --non-interactive $maybe_switch_to_user --set-home PKEXEC_UID="$PKEXEC_UID" "$@" ; then - log_to_journal "sudoers exception: yes" - sudo --non-interactive $maybe_switch_to_user --set-home PKEXEC_UID="$PKEXEC_UID" "$@" || { exit_code=$? ; true; }; - log_to_journal "sudo --user | exit_code: '$exit_code'" - exit "$exit_code" -fi - -log_to_journal "sudoers exception: no" - -if [ "$switch_user" = "true" ]; then - ## 'sudo --user user' clears environment variables such as PATH. - lxqt-sudo sudo $maybe_switch_to_user --set-home PKEXEC_UID="$PKEXEC_UID" "$@" || { exit_code=$? ; true; }; -else - ## set PATH same as root - ## This is required for gdebi. - ## REVIEW: is it ok that users can find out the PATH setting of root? - ## lxqt-sudo does not clear environment variable PATH. - PATH="$(sudo --non-interactive /usr/lib/security-misc/echo-path)" - export PATH - lxqt-sudo "$@" || { exit_code=$? ; true; }; -fi - -log_to_journal "exit_code: '$exit_code'" - -exit "$exit_code" diff --git a/usr/bin/remount-secure#security-misc-shared b/usr/bin/remount-secure#security-misc-shared new file mode 100755 index 00000000..5d1322ab --- /dev/null +++ b/usr/bin/remount-secure#security-misc-shared @@ -0,0 +1,397 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## features: +## - nodev,nosuid where appropriate +## - optional noexec for most except /home +## - optional noexec for all including /home +## - idempotent (script can be safely re-run) +## - can be run from: +## - systemd +## - dracut +## - manually from command line +## - can safely handle non-existing folders +## - error handling +## - log output: +## - shows each and every command executed +## - shows old mount options prior running remount-secure +## - shows new mount options after running remount-secure + +## noexec in /tmp and/or /home can break some malware but also legitimate +## applications. + +## https://www.kicksecure.com/wiki/Noexec +## https://www.kicksecure.com/wiki/Dev/remount-secure +## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 + +## style-ok: no-has - may run in dracut without helper-scripts + +## Mount helper functions (_boot, _sys, _usr, ...) are invoked indirectly via +## the dispatch in main(). +# shellcheck disable=SC2317 + +#set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +init() { + if test -o xtrace ; then + output_command=( true ) + else + output_command=( printf '%s\n' ) + fi + + "${output_command[@]}" "$0: INFO: START" + + ## dracut does not have id. Saving space in initial ramdisk. + if command -v id &>/dev/null ; then + if [ "$(id -u)" != "0" ]; then + "${output_command[@]}" "ERROR: must be run as root! sudo $0" + exit 1 + fi + fi + + mkdir --parents "/run/remount-secure" + exit_code=0 + + ## dracut sets NEWROOT=/sysroot + [[ -v NEWROOT ]] || NEWROOT="" + if [ "${NEWROOT}" = "" ]; then + "${output_command[@]}" "INFO: dracut detected: no" + else + "${output_command[@]}" "INFO: dracut detected: yes - NEWROOT: '${NEWROOT}'" + fi + + ## Debugging. + #echo "ls -la /root/" + #ls -la / || true + #echo "ls -la /sysroot/" + #ls -la /sysroot/ || true + #echo "env" + #env || true +} + +parse_options() { + ## Thanks to: + ## https://mywiki.wooledge.org/BashFAQ/035 + + while : + do + case ${1:-} in + 0) + "${output_command[@]}" "WARNING: Not using remount-secure." + exit 0 + shift + ;; + 1) + "${output_command[@]}" "INFO: level 1/3 (low)" + most_noexec_maybe="" + home_noexec_maybe="" + parsed=true + shift + ;; + 2) + "${output_command[@]}" "INFO: level 2/3 (medium)" + most_noexec_maybe=",noexec" + home_noexec_maybe="" + parsed=true + shift + ;; + 3) + "${output_command[@]}" "INFO: level 3/3 (high)" + most_noexec_maybe=",noexec" + home_noexec_maybe=",noexec" + parsed=true + shift + ;; + --force) + "${output_command[@]}" "INFO: --force" + option_force=true + shift + ;; + --) + shift + break + ;; + -*) + "${output_command[@]}" "ERROR: unknown option: ${1}" >&2 + exit 1 + ;; + *) + break + ;; + esac + done + + [[ -v option_force ]] || option_force="" + [[ -v parsed ]] || parsed=false + [[ -v home_noexec_maybe ]] || home_noexec_maybe="" + [[ -v most_noexec_maybe ]] || most_noexec_maybe="" + + "${output_command[@]}" "INFO: using nosuid,nodev: yes" + + if [ "${home_noexec_maybe}" = "" ]; then + "${output_command[@]}" "INFO: using noexec for all: no" + else + "${output_command[@]}" "INFO: using noexec for all: yes" + return 0 + fi + + if [ "${most_noexec_maybe}" = "" ]; then + "${output_command[@]}" "INFO: using noexec for most: no" + else + "${output_command[@]}" "INFO: using noexec for most (not all): yes" + return 0 + fi + + if [ "${parsed}" = "true" ]; then + return 0 + fi + + "${output_command[@]}" "ERROR: syntax error. use either: +$0 0 +$0 1 +$0 2 +$0 3" + + exit 1 +} + +preparation() { + ## Debugging. + #"${output_command[@]}" "INFO: 'findmnt --list' output at the START." + #"${output_command[@]}" "$(findmnt --list)" + #"${output_command[@]}" "" + true +} + +remount_secure() { + "${output_command[@]}" "" + + ## ${FUNCNAME[1]} is the name of the calling function. I.e. the function + ## which called this function. + status_file_name="${FUNCNAME[1]}" + ## example status_file_name: + ## _home + status_file_full_path="/run/remount-secure/${status_file_name}" + ## example status_file_full_path: + ## /run/remount-secure/_home + + old_mount_options="$(findmnt --noheadings --output options -- "${mount_folder}")" || true + ## example old_mount_options: + ## rw,nosuid,nodev,relatime,discard + + "${output_command[@]}" "INFO: '${mount_folder}' old_mount_options: '${old_mount_options}'" + + if printf '%s\n' "${old_mount_options}" | grep "${intended_mount_options}" >/dev/null 2>/dev/null ; then + "${output_command[@]}" "INFO: '${mount_folder}' has already intended mount options. ('${intended_mount_options}')" + return 0 + fi + + ## When this package is upgraded, the systemd unit will run again. + ## If the user meanwhile manually relaxed mount options, this should not be undone. + + if [ ! "${option_force}" == "true" ]; then + if [ -e "${status_file_full_path}" ]; then + "${output_command[@]}" "INFO: '${mount_folder}' already remounted earlier. Not remounting again. Use --force if this is what you want." + return 0 + fi + fi + + if ! test -d "${mount_folder}" ; then + ## For example /boot/efi does not always exist on all systems. + "${output_command[@]}" "INFO: '${mount_folder}' folder exists: no" + return 0 + fi + "${output_command[@]}" "INFO: '${mount_folder}' folder exists: yes" + + if findmnt --noheadings "${mount_folder}" >/dev/null ; then + "${output_command[@]}" "INFO: '${mount_folder}' already mounted, therefore using remount." + "${output_command[@]}" "INFO: Executing: mount --make-private --options remount,${intended_mount_options} ${mount_folder}" + mount --make-private --options "remount,${intended_mount_options}" "${mount_folder}" || exit_code=100 + else + "${output_command[@]}" "INFO: '${mount_folder}' not yet mounted, therefore using mount bind." + "${output_command[@]}" "INFO: Executing: mount --make-private --options ${intended_mount_options} --bind ${mount_folder} ${mount_folder}" + mount --make-private --options "${intended_mount_options}" --bind "${mount_folder}" "${mount_folder}" || exit_code=101 + fi + + new_mount_options="$(findmnt --noheadings --output options -- "${mount_folder}")" || true + "${output_command[@]}" "INFO: '${mount_folder}' new_mount_options: '${new_mount_options}'" + + touch "${status_file_full_path}" +} + +_boot() { + mount_folder="${NEWROOT}/boot" + ## https://lists.freedesktop.org/archives/systemd-devel/2015-February/028456.html + intended_mount_options="nosuid,nodev,noexec" + remount_secure +} + +_boot_efi() { + ## TODO: new, test + mount_folder="${NEWROOT}/boot/efi" + intended_mount_options="nosuid,nodev,noexec" + remount_secure +} + +_run() { + mount_folder="/run" + ## https://lists.freedesktop.org/archives/systemd-devel/2015-February/028456.html + intended_mount_options="nosuid,nodev${most_noexec_maybe}" + remount_secure +} + +_dev() { + mount_folder="/dev" + ## /dev should be nosuid,noexec as per: + ## https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1991975 + intended_mount_options="nosuid,noexec" + remount_secure +} + +_dev_shm() { + mount_folder="/dev/shm" + intended_mount_options="nosuid,nodev${most_noexec_maybe}" + remount_secure +} + +_sys() { + ## TODO: new, test + mount_folder="/sys" + intended_mount_options="nosuid,nodev,noexec" + remount_secure +} + +_tmp() { + mount_folder="${NEWROOT}/tmp" + intended_mount_options="nosuid,nodev${most_noexec_maybe}" + remount_secure +} + +_var_tmp() { + mount_folder="${NEWROOT}/var/tmp" + intended_mount_options="nosuid,nodev${most_noexec_maybe}" + remount_secure +} + +_var_log() { + mount_folder="${NEWROOT}/var/log" + intended_mount_options="nosuid,nodev,noexec" + remount_secure +} + +_var() { + mount_folder="${NEWROOT}/var" + ## noexec: Not possible. Reason: + ## Debian stores executable maintainer scripts in /var/lib/dpkg/info folder. + intended_mount_options="nosuid,nodev" + remount_secure +} + +_usr() { + ## TODO: new, test + mount_folder="${NEWROOT}/usr" + intended_mount_options="nodev" + remount_secure +} + +_home() { + mount_folder="${NEWROOT}/home" + intended_mount_options="nosuid,nodev${home_noexec_maybe}" + remount_secure +} + +_root() { + ## TODO: new, test + mount_folder="${NEWROOT}/root" + intended_mount_options="nosuid,nodev${home_noexec_maybe}" + remount_secure +} + +_srv() { + ## TODO: new, test + mount_folder="${NEWROOT}/srv" + intended_mount_options="nosuid,nodev${most_noexec_maybe}" + remount_secure +} + +_media() { + ## TODO: new, test + mount_folder="${NEWROOT}/media" + intended_mount_options="nosuid,nodev${most_noexec_maybe}" + remount_secure +} + +_mnt() { + ## TODO: new, test + mount_folder="${NEWROOT}/mnt" + intended_mount_options="nosuid,nodev${most_noexec_maybe}" + remount_secure +} + +_opt() { + ## TODO: new, test + mount_folder="${NEWROOT}/opt" + ## Allow /opt exec as usually optional binaries are placed there such as Firefox + ## when manually installed from tarball. + intended_mount_options="nosuid,nodev" + remount_secure +} + +_etc() { + ## TODO: new, test + ## /etc cannot be noexec because various executables are there. To find, run: + ## sudo find /etc -executable + mount_folder="${NEWROOT}/etc" + intended_mount_options="nosuid,nodev" + remount_secure +} + +end() { + ## Debugging. + #"${output_command[@]}" "INFO: 'findmnt --list' output at the END." + #"${output_command[@]}" "$(findmnt --list)" + + "${output_command[@]}" "" + "${output_command[@]}" "INFO: exit_code: ${exit_code}" + "${output_command[@]}" "$0: INFO: END" + exit "${exit_code}" +} + +main() { + init + parse_options "$@" + preparation + + _boot + _boot_efi + _run + _dev + _dev_shm + _tmp + _var_tmp + _var_log + _var + _usr + _home + _root + _srv + _media + _mnt + _opt + _etc + + end +} + +## REMINDER: see also hidepid /usr/lib/systemd/system/proc-hidepid.service +#mount --options defaults,nosuid,nodev,noexec,remount,subset=pid /proc + +main "$@" diff --git a/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop b/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop new file mode 100644 index 00000000..5bd18739 --- /dev/null +++ b/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop @@ -0,0 +1,13 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## MAC randomisation breaks root server and VirtualBox DHCP likely due to IPv6 Privacy Extensions. +## +## https://datatracker.ietf.org/doc/html/rfc4941 +## https://github.com/Kicksecure/security-misc/pull/145 +## https://github.com/Kicksecure/security-misc/issues/184 +## +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. + +#[connection] +#ipv6.ip6-privacy=2 diff --git a/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop b/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop new file mode 100644 index 00000000..c664e9b7 --- /dev/null +++ b/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop @@ -0,0 +1,17 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## MAC randomisation breaks root server and VirtualBox DHCP likely due to IPv6 Privacy Extensions. +## +## https://datatracker.ietf.org/doc/html/rfc4941 +## https://github.com/Kicksecure/security-misc/pull/145 +## https://github.com/Kicksecure/security-misc/issues/184 +## +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. + +#[device-mac-randomization] +#wifi.scan-rand-mac-address=yes + +#[connection-mac-randomization] +#ethernet.cloned-mac-address=random +#wifi.cloned-mac-address=random diff --git a/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared b/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared new file mode 100755 index 00000000..89170912 --- /dev/null +++ b/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared @@ -0,0 +1,44 @@ +#!/bin/bash + +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +# called by dracut +check() { + ## For debugging only. + ## Saving space in initial ramdisk. + #require_binaries id || return 1 + #require_binaries env || return 1 + + require_binaries findmnt || return 1 + require_binaries touch || return 1 + require_binaries grep || return 1 + require_binaries mount || return 1 + require_binaries remount-secure || return 1 + return 0 +} + +# called by dracut +depends() { + return 0 +} + +# called by dracut +install() { + ## For debugging only. + ## Saving space in initial ramdisk. + #inst_multiple id + #inst_multiple env + + inst_multiple findmnt + inst_multiple touch + inst_multiple grep + inst_multiple mount + inst_multiple remount-secure + inst_hook cleanup 90 "$moddir/remount-secure.sh" +} + +# called by dracut +installkernel() { + return 0 +} diff --git a/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared b/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared new file mode 100755 index 00000000..0e0a0c17 --- /dev/null +++ b/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared @@ -0,0 +1,23 @@ +#!/bin/sh + +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This script is intended to remount specified mount points with more secure +## options based on kernel command line parameters. + +remount_hook() { + local remountsecure_action + ## getarg returns the last parameter only. + ## If /proc/cmdline contains 'remountsecure=0 remountsecure=1' the last one wins. + remountsecure_action=$(getarg remountsecure) + + if ! remount-secure $remountsecure_action; then + warn "$0: ERROR: 'remount-secure $remountsecure_action' failed." + return 1 + fi + info "$0: INFO: 'remount-secure $remountsecure_action' success." + return 0 +} + +remount_hook diff --git a/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared b/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared new file mode 100755 index 00000000..092b610f --- /dev/null +++ b/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared @@ -0,0 +1,50 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## style-ok: no-strict (sourced by dracut) + +## called by dracut +check() { + require_binaries /usr/bin/emerg-shutdown || return 1 + return 255 +} + +## called by dracut +depends() { + printf '%s\n' 'systemd bash' + return 0 +} + +## called by dracut +install() { + local config_file + + inst systemd-notify + + inst_simple /usr/libexec/security-misc/emerg-shutdown + inst_simple /usr/share/security-misc/emerg-shutdown-initramfs.service /usr/lib/systemd/system/emerg-shutdown-initramfs.service + inst_simple /usr/bin/emerg-shutdown /emerg-shutdown + + for config_file in /etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + inst_multiple /etc/security-misc/emerg-shutdown/*.conf + break + fi + done + for config_file in /usr/local/etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + inst_multiple /usr/local/etc/security-misc/emerg-shutdown/*.conf + break + fi + done + + mkdir -p "${initdir}/usr/lib/systemd/system/initrd.target.wants" + ln -s '../emerg-shutdown-initramfs.service' "${initdir}/usr/lib/systemd/system/initrd.target.wants/emerg-shutdown-initramfs.service" +} + +## called by dracut +installkernel () { + hostonly='' instmods evdev +} diff --git a/usr/lib/issue.d/20_security-misc.issue#security-misc-shared b/usr/lib/issue.d/20_security-misc.issue#security-misc-shared new file mode 100644 index 00000000..d03f39b7 --- /dev/null +++ b/usr/lib/issue.d/20_security-misc.issue#security-misc-shared @@ -0,0 +1,2 @@ +By continuing, you acknowledge and give consent that the owner of this system has a right to keep a log of all activity. +Unauthorized access is strictly prohibited and may result in legal action. Do not proceed! diff --git a/usr/lib/modules-load.d/30_security-misc.conf b/usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared similarity index 60% rename from usr/lib/modules-load.d/30_security-misc.conf rename to usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared index 02dc5f00..6ee13ca8 100644 --- a/usr/lib/modules-load.d/30_security-misc.conf +++ b/usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared @@ -1,7 +1,7 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. -## https://www.whonix.org/wiki/Dev/Entropy +## https://www.kicksecure.com/wiki/Dev/Entropy ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972 ## https://forums.whonix.org/t/jitterentropy-rngd/7204 jitterentropy_rng diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared new file mode 100644 index 00000000..e45baa3f --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared @@ -0,0 +1,9 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +/usr/bin/bwrap exactwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared new file mode 100644 index 00000000..0c00e338 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared @@ -0,0 +1,18 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Chrome/Chromium now uses namespace-based sandboxing rather than a SUID +## sandbox for most use cases, and while the SUID sandbox is still technically +## supported [1], it's also virtually unused [2]. Chromium still works fine +## when it is stripped of its SUID bit and rendered no longer executable, +## and opening `chrome://sandbox` while in this state shows that sandboxing is +## still working perfectly fine. +## +## [1] https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_sandboxing.md +## [2] https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_suid_sandbox.md +#chrome-sandbox matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared new file mode 100644 index 00000000..8d370cd4 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared @@ -0,0 +1,17 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Needed for D-Bus system activation to work. +## https://dbus.freedesktop.org/doc/system-activation.txt +## +## May be vital for desktop features to work normally. +## +## Appears to have been designed with security in mind and can only be called +## by root or a user in the `messagebus` group (which currently has one member, +## namely user `messagebus`). +dbus-daemon-launch-helper matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared new file mode 100644 index 00000000..79517913 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared @@ -0,0 +1,12 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## There is a controversy about firejail but those who choose to install it +## should be able to use it. +## https://www.kicksecure.com/wiki/Dev/Firejail#Security +/usr/bin/firejail exactwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared new file mode 100644 index 00000000..785df830 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared @@ -0,0 +1,18 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Critical component of FUSE (Filesystem in USErspace) +## +## Used by things such as: +## - AppImages +## - such as electrum Bitcoin wallet +## - Docker +## If not SUID, unprivileged users will be unable to use FUSE any longer. +## +## https://forums.whonix.org/t/disable-suid-binaries/7706/57 +/fusermount matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared new file mode 100644 index 00000000..3d8eae38 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared @@ -0,0 +1,10 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +libhardened_malloc.so matchwhitelist +libhardened_malloc-light.so matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared new file mode 100644 index 00000000..d1955e28 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared @@ -0,0 +1,18 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## https://forums.whonix.org/t/disable-suid-binaries/7706/61 +## Protect from 'chmod -x' (and SUID removal). +## SUID will be removed below in separate step. +/usr/bin/mount exactwhitelist +/usr/bin/umount exactwhitelist + +## Remove SUID from 'mount' but keep executable. +## https://forums.whonix.org/t/disable-suid-binaries/7706/61 +/usr/bin/mount 755 root root +/usr/bin/umount 755 root root diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared new file mode 100644 index 00000000..a851cbb6 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared @@ -0,0 +1,23 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Used by the pam_tmpdir module to create a secure temporary directory for the +## user that is logging in. +## https://manpages.ubuntu.com/manpages/oracular/man8/pam-tmpdir-helper.8.html +## Apparently specific to Debian, there isn't actually any Git repo with this +## code in it, it's just a "floating" package in the Debian archive. Written by +## the same person who maintains the package. Almost certainly cannot be +## disabled without causing serious problems, but may be worth auditing. +## (Worthy of note, it doesn't seem this program takes any user input, but +## relies solely on the calling user's UID and GID, though this could require +## further review.) +## +## Without this, LXQt fails to start with a dbus-launch error. +## +## TODO-HUMAN-DEVELOPER-ONLY: source audit pam-tmpdir-helper +pam-tmpdir-helper matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared new file mode 100644 index 00000000..4cd8d358 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared @@ -0,0 +1,16 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +# Keep the `passwd` utility executable to prevent issues with the +# /usr/libexec/security-misc/pam-abort-on-locked-password script blocking +# user logins with `su` and KScreenLocker. exactwhitelist is needed to keep +# the nosuid rule on /usr/bin from fighting with these rules. +# +# See also: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#passwd +/usr/bin/passwd exactwhitelist +/usr/bin/passwd 0755 root root diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared new file mode 100644 index 00000000..e328564a --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared @@ -0,0 +1,28 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## user-sysmaint-split hardens this further. +/usr/bin/pkexec exactwhitelist +/usr/bin/pkexec.security-misc-orig exactwhitelist + +## Required for PolicyKit (Polkit) to function. +## +## https://polkit-devel.freedesktop.narkive.com/zXO4yEg7/documentation-on-polkit-agent-helper-1-and-suid# +## https://gitlab.freedesktop.org/polkit/polkit/-/issues/168 +## https://cgit.freedesktop.org/polkit/tree/src/polkitagent/polkitagenthelper-pam.c#n93 +## +## Changing permissions here may break more than just normal privilege escalation. +## May be safe to disable for users other than sysmaint similar to what was done with pkexec and sudo, +## however even that might not be safe. +## +## matches both: +## - /usr/lib/policykit-1/polkit-agent-helper-1 +## - /lib/policykit-1/polkit-agent-helper-1 +## +## user-sysmaint-split hardens this further. +polkit-agent-helper-1 matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared new file mode 100644 index 00000000..e4508770 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared @@ -0,0 +1,12 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Ref: https://www.postfix.org/postconf.5.html (setgid_group) +## TODO-HUMAN-DEVELOPER-ONLY: research +postqueue matchwhitelist +postdrop matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared new file mode 100644 index 00000000..82be6d2e --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## qfile-unpacker is written by Qubes and is trusted. Needed as part of copying +## files between VMs. +## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c +## +## Historic Qubes upstream security issue: +## qfile-unpacker allows unprivileged users in VMs to gain root privileges +## https://github.com/QubesOS/qubes-issues/issues/8633 +## +## matches both: +## - /usr/lib/qubes/qfile-unpacker whitelist +## - Not bit-for-bit identical to /usr/lib/qubes/qfile-unpacker. +## - Stripping SUID from this does *not* break file copying. +## - TODO-HUMAN-DEVELOPER-ONLY: further research required on its purpose +## - /usr/bin/qfile-unpacker +## - Appears to be an integral part of file transfer between qubes, stripping +## SUID from this in an AppVM results in that AppVM being unable to receive +## files any longer. (It can still send files to other qubes though.) +qfile-unpacker matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared new file mode 100644 index 00000000..6265587f --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared @@ -0,0 +1,11 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Ref: https://packages.debian.org/trixie/spice-client-glib-usb-acl-helper +## TODO-HUMAN-DEVELOPER-ONLY: research +spice-client-glib-usb-acl-helper matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared new file mode 100644 index 00000000..6a987f3e --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared @@ -0,0 +1,22 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Used for SSH client key management +## https://manpages.debian.org/ssh-agent +## Debian installs ssh-agent with setgid permissions (2755) and with +## _ssh as the group to help mitigate ptrace attacks that could extract +## private keys from the agent's memory. +ssh-agent matchwhitelist + +## Used only for SSH host-based authentication +## https://manpages.debian.org/ssh-keysign +## Needed to allow access to the machine's host key for use in the +## authentication process. This is a non-default method of authenticating to +## SSH, and is likely rarely used, thus this should be safe to disable. +#ssh-keysign matchwhitelist +#/usr/lib/openssh matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared new file mode 100644 index 00000000..84e74975 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared @@ -0,0 +1,10 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## user-sysmaint-split hardens this further. +/usr/bin/sudo exactwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared new file mode 100644 index 00000000..0733fc9a --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared @@ -0,0 +1,11 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## required for performing password validation from unprivileged user +## processes such as KScreenLocker's unlock prompt +/usr/sbin/unix_chkpwd exactwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared new file mode 100644 index 00000000..6e27e081 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared @@ -0,0 +1,16 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## TODO-HUMAN-DEVELOPER-ONLY: research +/usr/lib/virtualbox/ matchwhitelist +VirtualBoxVM matchwhitelist +VBoxSDL matchwhitelist +VBoxNetNAT matchwhitelist +VBoxNetDHCP matchwhitelist +VBoxHeadless matchwhitelist +VBoxNetAdpCtl matchwhitelist diff --git a/usr/lib/permission-hardener.d/30_default.conf#security-misc-shared b/usr/lib/permission-hardener.d/30_default.conf#security-misc-shared new file mode 100644 index 00000000..91e15eb5 --- /dev/null +++ b/usr/lib/permission-hardener.d/30_default.conf#security-misc-shared @@ -0,0 +1,120 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## File permission hardening. +## +## Syntax: +## [filename] [mode] [owner] [group] [capability] +## [filename] [exactwhitelist|matchwhitelist|disablewhitelist|nosuid] +## +## White spaces inside a file name are supported, no quoting or escaping is +## necessary (or permitted). + +###################################################################### +# Global Settings +###################################################################### + +#whitelists_disable_all=true + +###################################################################### +# SUID disables below (or in lexically higher) files: disablewhitelist +###################################################################### + +## If you are not going to use AppImages such as electrum Bitcoin wallet. +#/fusermount disablewhitelist + +###################################################################### +# SUID whitelist matches full path: exactwhitelist +###################################################################### + +## In case you need to use 'su'. See also: +## https://www.kicksecure.com/wiki/root#su +#/usr/bin/su exactwhitelist + +## https://manpages.debian.org/xserver-xorg-legacy/Xorg.wrap.1.en.html +## https://lwn.net/Articles/590315/ +## https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706/35 +#/usr/lib/xorg/Xorg.wrap whitelist + +###################################################################### +# SUID whitelist matches in any section of the path: matchwhitelist +###################################################################### + +## Examples below are already configured: +#ssh-agent matchwhitelist +#/usr/lib/openssh matchwhitelist + +###################################################################### +# Permission Hardening +###################################################################### + +/home/ 0755 root root +/root/ 0700 root root +/boot/ 0700 root root +/etc/permission-hardener.d 0600 root root +/usr/local/etc/permission-hardener.d 0600 root root +/usr/lib/modules/ 0700 root root +/usr/src 0700 root root +/etc/cups/cupsd.conf 0400 root root +/etc/syslog.conf 0600 root root +/etc/ssh/sshd_config 0600 root root +/etc/crontab 0600 root root +/etc/cron.d 0700 root root +/etc/cron.daily 0700 root root +/etc/sudoers.d 0700 root root +/etc/cron.hourly 0700 root root +/etc/cron.weekly 0700 root root +/etc/cron.monthly 0700 root root +/etc/group 0644 root root +/etc/group- 0644 root root +/etc/hosts.allow 0644 root root +/etc/hosts.deny 0644 root root +/etc/issue 0644 root root +/etc/issue.net 0644 root root +/etc/motd 0644 root root +/etc/passwd 0644 root root +/etc/passwd- 0644 root root + +###################################################################### +# SUID/SGID Removal: nosuid +###################################################################### + +## To remove all SUID/SGID binaries in a directory, you can use the "nosuid" +## argument. +## +## Remove all SUID/SGID binaries/libraries. + +/opt/ nosuid +/usr/bin/ nosuid +/usr/lib32/ nosuid +/usr/lib64/ nosuid +/usr/lib/ nosuid +/usr/local/bin/ nosuid +/usr/local/lib32/ nosuid +/usr/local/lib64/ nosuid +/usr/local/lib/ nosuid +/usr/local/opt/ nosuid +/usr/local/sbin/ nosuid +/usr/local/usr/bin/ nosuid +/usr/local/usr/lib32/ nosuid +/usr/local/usr/lib64/ nosuid +/usr/local/usr/lib/ nosuid +/usr/local/usr/sbin/ nosuid +/usr/sbin/ nosuid + +###################################################################### +# Capability Removal +###################################################################### + +## Ping doesn't work with Tor anyway so its capabilities are removed to +## reduce attack surface. +## anon-apps-config does this. +#/usr/bin/ping 0744 root root none + +## TODO-HUMAN-DEVELOPER-ONLY: research +#/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper 0744 root root none diff --git a/usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py#security-misc-shared b/usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py#security-misc-shared new file mode 100644 index 00000000..e69de29b diff --git a/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared b/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared new file mode 100755 index 00000000..3fb3053e --- /dev/null +++ b/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared @@ -0,0 +1,724 @@ +#!/usr/bin/python3 -Bsu + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +# pylint: disable=broad-exception-caught + +## Notes for reviewers: +## +## * Local denial-of-service is out of scope. There are easier ways for +## malware to pop up lots of windows or consume huge amounts of RAM. +## * The shim's primary purpose is to ensure that files aren't accidentally +## opened when trying to view the contents of a directory. We do not care if +## the exact directory that exists at launch time is the directory that gets +## opened when the user chooses to open it. Therefore replacement attacks +## involving swapping one directory with another or with a symlink to a +## directory are out of scope. +## * Python version lower than 3.13.5 are out of scope. + +""" +fm_shim_frontend.py - Prompts the user if they want to open one or more +directories in the default file manager. +""" + +import sys +import os +import signal +import subprocess +import traceback +import urllib.parse +from pathlib import Path +from typing import NoReturn, cast +from types import FrameType + +from PyQt5.QtCore import QTimer, QObject, QEvent, Qt +from PyQt5.QtGui import QFontDatabase, QBrush, QColor +from PyQt5.QtWidgets import ( + QApplication, + QCheckBox, + QDialog, + QLabel, + QListWidget, + QListWidgetItem, + QPushButton, + QSizePolicy, + QTextEdit, + QVBoxLayout, + QHBoxLayout, + QWidget, + QScrollBar, + QLayout, + QMessageBox, +) + +from stdisplay.stdisplay import stdisplay + + +class WidgetShowBinding(QObject): + """ + Detects when a widget is shown or hidden, and shows or hides another + widget in response. + """ + + def __init__( + self, bound_widget: QWidget, parent: QObject | None = None + ) -> None: + """ + ScrollBarEventFilter constructor. + """ + + super().__init__(parent) + + self.bound_widget = bound_widget + + # pylint: disable=invalid-name, unused-argument + def eventFilter(self, obj: QObject | None, event: QEvent | None) -> bool: + """ + Shows or hides the bound widget when the binding widget is shown or + hidden. + """ + + if event is None: + return False + + # pylint: disable=no-member + do_recalc_layout: bool = False + if event.type() == QEvent.Type.Show: + self.bound_widget.show() + do_recalc_layout = True + # pylint: disable=no-member + elif event.type() == QEvent.Type.Hide: + self.bound_widget.hide() + do_recalc_layout = True + if do_recalc_layout: + parent_object: QObject | None = self.bound_widget.parent() + assert parent_object is not None + parent_widget: QWidget = cast(QWidget, parent_object) + parent_layout: QLayout | None = parent_widget.layout() + assert parent_layout is not None + parent_layout.update() + return False + + +class AnalyzePathsWindow(QDialog): + """ + Helper window for analyzing unsafe characters in paths. + """ + + def __init__( + self, dir_list: list[Path], parent: QDialog | None = None + ) -> None: + """ + AnalyzePathsWindow constructor. + """ + + super().__init__(parent) + + self.dir_list: list[Path] = dir_list + self.has_unsafe_chars_list: list[bool] = [] + + self.core_layout: QVBoxLayout = QVBoxLayout() + self.dir_list_view: QListWidget = QListWidget() + self.dir_list_view.resize(1, 50) + # pylint: disable=no-member + self.dir_list_view.setSizePolicy( + QSizePolicy.Policy.Expanding, + QSizePolicy.Policy.Fixed, + ) + self.dir_list_view.currentRowChanged.connect( + self.populate_unicode_show_view + ) + self.core_layout.addWidget(self.dir_list_view) + + self.unicode_show_view: QTextEdit = QTextEdit() + self.unicode_show_view.setReadOnly(True) + # pylint: disable=no-member + self.unicode_show_view.setLineWrapMode(QTextEdit.LineWrapMode.NoWrap) + # pylint: disable=no-member + self.unicode_show_view.setCurrentFont( + QFontDatabase.systemFont(QFontDatabase.SystemFont.FixedFont) + ) + self.core_layout.addWidget(self.unicode_show_view) + + self.button_layout: QHBoxLayout = QHBoxLayout() + self.button_layout.addStretch() + self.done_button: QPushButton = QPushButton("Done") + self.done_button.clicked.connect(self.accept) + self.button_layout.addWidget(self.done_button) + self.core_layout.addLayout(self.button_layout) + + self.setLayout(self.core_layout) + self.setWindowTitle("Analyze Paths") + self.resize(690, 500) + + for dir_path in self.dir_list: + qlwi: QListWidgetItem = QListWidgetItem( + stdisplay(str(dir_path), sgr=-1) + ) + if any( + (not 0x20 <= ord(path_char) <= 0x7E) + for path_char in str(dir_path) + ): + qlwi.setBackground(QBrush(QColor(255, 128, 128))) + self.has_unsafe_chars_list.append(True) + else: + self.has_unsafe_chars_list.append(False) + self.dir_list_view.addItem(qlwi) + + self.populate_unicode_show_view(-1) + + def populate_unicode_show_view(self, path_idx: int) -> None: + """ + Runs the path through unicode-show and populates info about it in the + unicode_show_view widget. + """ + + if path_idx < 0 or path_idx >= len(self.dir_list): + self.unicode_show_view.setPlainText( + "Select a file path to analyze above.\n" + + "Paths highlighted in red contain potentially unsafe " + + "characters." + ) + return + + if self.has_unsafe_chars_list[path_idx]: + try: + unicode_show_output: str = subprocess.run( + ["/usr/bin/unicode-show"], + input=str(self.dir_list[path_idx]), + capture_output=True, + check=False, + encoding="utf-8", + ).stdout + self.unicode_show_view.setPlainText(unicode_show_output) + except Exception: + traceback.print_exc(file=sys.stderr) + self.unicode_show_view.setPlainText( + "Unable to check this path for unsafe chars!\n" + + "See logs in 'journalctl --user --boot fm-shim.service' " + + "for more information." + ) + else: + self.unicode_show_view.setPlainText( + "No unsafe chars found in the selected path." + ) + + +# pylint: disable=too-many-instance-attributes +class FmShimWindow(QDialog): + """ + Core fm_shim_frontend window. + """ + + # pylint: disable=too-many-statements + def __init__( + self, dir_list: list[Path], parent: QDialog | None = None + ) -> None: + """ + FmShimWindow constructor. + """ + + super().__init__(parent) + + self.dir_list: list[Path] = dir_list + + self.core_layout: QVBoxLayout = QVBoxLayout() + self.head_label: QLabel = QLabel( + "An application has requested to open the following directories " + + "with the default file manager:" + ) + self.core_layout.addWidget(self.head_label) + + self.dir_list_view: QTextEdit = QTextEdit() + self.dir_list_view.setReadOnly(True) + # pylint: disable=no-member + self.dir_list_view.setLineWrapMode(QTextEdit.LineWrapMode.NoWrap) + # pylint: disable=no-member + self.dir_list_view.setCurrentFont( + QFontDatabase.systemFont(QFontDatabase.SystemFont.FixedFont) + ) + self.core_layout.addWidget(self.dir_list_view) + + self.sanitized_text_label: QLabel = QLabel( + "Note: Any spaces in the above filenames are displayed as " + + '"middle dot" (\N{MIDDLE DOT}) characters. Potentially ' + + "unsafe characters are displayed as underscores (_)." + ) + self.sanitized_text_label.setWordWrap(True) + self.sanitized_text_label.setVisible(False) + self.core_layout.addWidget(self.sanitized_text_label) + + self.unsafe_text_label: QLabel = QLabel( + 'WARNING: Some of the listed paths ' + + "contain Unicode or ASCII control characters. These can be " + + 'malicious. Use the "Analyze Paths" button for more details. ' + + 'If you are sure the text is safe, check "Display raw path ' + + 'text" below.' + ) + self.unsafe_text_label.setWordWrap(True) + self.unsafe_text_label.setVisible(False) + self.core_layout.addWidget(self.unsafe_text_label) + + horiz_scroll_bar: QScrollBar | None = ( + self.dir_list_view.horizontalScrollBar() + ) + assert horiz_scroll_bar is not None + self.horiz_overflow_warning_label: QLabel = QLabel( + 'WARNING: Some of the paths listed ' + + "above are too long to display all at once. Double-check that " + + "the paths do not look suspicious." + ) + self.horiz_overflow_warning_label.setWordWrap(True) + self.core_layout.addWidget(self.horiz_overflow_warning_label) + self.horiz_overflow_warning_label.setVisible( + horiz_scroll_bar.isVisible() + ) + self.horiz_overflow_warning_binding: WidgetShowBinding = ( + WidgetShowBinding(self.horiz_overflow_warning_label, self) + ) + horiz_scroll_bar.installEventFilter(self.horiz_overflow_warning_binding) + + vert_scroll_bar: QScrollBar | None = ( + self.dir_list_view.verticalScrollBar() + ) + assert vert_scroll_bar is not None + self.vert_overflow_warning_label: QLabel = QLabel( + 'WARNING: Too many paths are listed ' + + "above to display all at once. A new file manager window will " + + "be opened for every listed path. Double-check that this is " + + "what you want." + ) + self.vert_overflow_warning_label.setWordWrap(True) + self.core_layout.addWidget(self.vert_overflow_warning_label) + self.vert_overflow_warning_label.setVisible(vert_scroll_bar.isVisible()) + self.vert_overflow_warning_binding: WidgetShowBinding = ( + WidgetShowBinding(self.vert_overflow_warning_label, self) + ) + vert_scroll_bar.installEventFilter(self.vert_overflow_warning_binding) + + self.foot_label: QLabel = QLabel( + "Would you like to open these directories? A separate file " + + "manager window will be opened for every listed path." + ) + self.core_layout.addWidget(self.foot_label) + + self.button_layout: QHBoxLayout = QHBoxLayout() + self.display_raw_checkbox: QCheckBox = QCheckBox( + "Display raw path text" + ) + self.display_raw_checkbox.stateChanged.connect(self.toggle_display_raw) + self.button_layout.addWidget(self.display_raw_checkbox) + + self.analyze_paths_button: QPushButton = QPushButton("Analyze Paths") + self.analyze_paths_button.clicked.connect(self.analyze_paths) + self.analyze_paths_button.setVisible(False) + self.button_layout.addWidget(self.analyze_paths_button) + self.button_layout.addStretch() + + self.open_button: QPushButton = QPushButton("Open") + self.open_button.clicked.connect(self.open_dir_list) + self.cancel_button: QPushButton = QPushButton("Cancel") + self.cancel_button.clicked.connect(self.exit_app) + self.button_layout.addWidget(self.open_button) + self.button_layout.addWidget(self.cancel_button) + self.core_layout.addLayout(self.button_layout) + + self.setLayout(self.core_layout) + self.setWindowTitle("Open Directories") + + for dir_path in self.dir_list: + if any( + (not 0x20 <= ord(path_char) <= 0x7E) + for path_char in str(dir_path) + ): + self.unsafe_text_label.setVisible(True) + self.analyze_paths_button.setVisible(True) + + self.resize(690, 500) + + self.display_sanitized_dir_paths() + self.show() + + def display_sanitized_dir_paths(self) -> None: + """ + Sanitizes the paths in the dir list from all unsafe characters, + replaces spaces with middle dot characters, displays them to the user, + and displays a note about text sanitization. + """ + + sanitized_string: str = stdisplay( + "\n".join([str(x) for x in self.dir_list]), sgr=-1 + ) + self.dir_list_view.setPlainText( + sanitized_string.replace(" ", "\N{MIDDLE DOT}") + ) + self.sanitized_text_label.setVisible(True) + + def display_unsanitized_dir_paths(self) -> None: + """ + Displays the paths in the dir list unsanitized, and hides the text + sanitization note. + """ + + self.dir_list_view.setPlainText( + "\n".join([str(x) for x in self.dir_list]) + ) + self.sanitized_text_label.setVisible(False) + + def toggle_display_raw(self, new_state: int) -> None: + """ + Turns text sanitization on or off. + """ + + if new_state == 0: + self.display_sanitized_dir_paths() + else: + self.display_unsanitized_dir_paths() + + def analyze_paths(self) -> None: + """ + Opens a new window where the user can analyze potentially unsafe paths + before opening them with PCManFM-Qt. + """ + + apw: AnalyzePathsWindow = AnalyzePathsWindow(self.dir_list) + apw.exec() + + # pylint: disable=too-many-branches + def open_dir_list(self) -> None: + """ + Opens all specified directories using the default file manager. + """ + + try: + default_fm_desktop_file: str = subprocess.run( + ["/usr/bin/xdg-mime", "query", "default", "inode/directory"], + check=True, + capture_output=True, + encoding="utf-8", + ).stdout.strip() + except Exception: + print( + "ERROR: Unable to get default file manager!", + file=sys.stderr, + ) + sys.exit(1) + + ## Expect a plain desktop filename, not a path. + if ( + default_fm_desktop_file == "" + or "/" in default_fm_desktop_file + or not default_fm_desktop_file.endswith(".desktop") + ): + print( + "ERROR: Invalid default file manager desktop file name!", + file=sys.stderr, + ) + sys.exit(1) + + search_dir_list: list[str] = [] + + ## "" rather than None is intentional here, as + ## os.environ["XDG_DATA_HOME"] may be "", not None. + xdg_data_home: str = "" + try: + xdg_data_home = os.environ["XDG_DATA_HOME"] + except KeyError: + pass + if xdg_data_home == "": + home_env_var = "" + try: + home_env_var = os.environ["HOME"] + except KeyError: + pass + if home_env_var == "": + print( + "ERROR: Both the XDG_DATA_HOME and HOME environment " + + "variables are either undefined or empty!", + file=sys.stderr, + ) + sys.exit(1) + xdg_data_home = home_env_var + "/.local/share" + if not xdg_data_home.startswith("/"): + print( + "ERROR: XDG_DATA_HOME is not an absolute path!", file=sys.stderr + ) + sys.exit(1) + search_dir_list.append(xdg_data_home) + + ## Again, using "" rather than None is intentional here. + xdg_data_dirs: str = "" + try: + xdg_data_dirs = os.environ["XDG_DATA_DIRS"] + except Exception: + pass + xdg_data_dir_list = [p for p in xdg_data_dirs.split(":") if p != ""] + if len(xdg_data_dir_list) == 0: + xdg_data_dir_list = ["/usr/local/share", "/usr/share"] + if not all(x.startswith("/") for x in xdg_data_dir_list): + print( + "ERROR: XDG_DATA_DIRS contains non-absolute paths!", + file=sys.stderr, + ) + sys.exit(1) + search_dir_list.extend(xdg_data_dir_list) + + found_desktop_file: bool = False + for search_dir in search_dir_list: + default_fm_path: Path = Path( + search_dir + "/applications/" + default_fm_desktop_file + ) + if default_fm_path.is_file(): + found_desktop_file = True + break + if not found_desktop_file: + print( + "ERROR: Cannot find default file manager's desktop file!", + file=sys.stderr, + ) + sys.exit(1) + + for target_dir in self.dir_list: + if target_dir.is_dir(): + subprocess.run( + ["/usr/bin/gio", "launch", str(default_fm_path), str(target_dir)], + check=False, + ) + else: + QMessageBox.warning( + self, + "Open Directories", + Qt.convertFromPlainText( # type: ignore + "ERROR: The following path was no longer a dir when " + + "checked before opening:\n" + + "\n" + + f"{stdisplay(str(target_dir), sgr=-1)}\n" + + "\n" + + "This may be the result of an attempted attack. No " + + "further directories will be opened." + ), + ) + sys.exit(1) + + sys.exit(0) + + @staticmethod + def exit_app() -> None: + """ + Exits the application. + """ + + sys.exit(0) + + +# pylint: disable=unused-argument +def signal_handler(sig: int, frame: FrameType | None) -> None: + """ + Handles SIGINT and SIGTERM. + """ + + print("Received SIGINT or SIGTERM, exiting.", file=sys.stderr) + sys.exit(128 + sig) + + +def get_path_list_from_uris( + handler_mode: str, uri_list: list[str] +) -> list[Path]: + """ + Converts a list of URIs into a list of paths, discarding any invalid URIs + that are encountered in the process. + """ + + path_set: set[Path] = set() + + for uri in uri_list: + ## Do not permit Unicode or control characters in URIs. While the + ## files pointed to by URIs may contain Unicode in their filenames, + ## Unicode characters beyond 7-bit ASCII are forbidden in URIs. The + ## org.freedesktop.FileManager1 spec says that we should expect URI + ## strings here, not IRI strings (which can contain Unicode), so this + ## is safe. + if any((not 0x20 <= ord(uri_char) <= 0x7E) for uri_char in uri): + print( + "WARNING: Path URI contains Unicode or control characters, " + + f"skipping. Sanitized URI: '{stdisplay(uri, sgr=-1)}'", + file=sys.stderr, + ) + continue + + uri_components: urllib.parse.SplitResult = urllib.parse.urlsplit(uri) + + ## Sanity-check the URI (must be a local file URI, must not have a + ## query or fragment component) + if ( + uri_components.scheme != "file" + or uri_components.netloc not in ("", "localhost") + or uri_components.query != "" + or uri_components.fragment != "" + ): + print( + f"WARNING: Path URI '{uri}' does not look like a local file " + + "URI, skipping.", + file=sys.stderr, + ) + continue + + path_str: str = urllib.parse.unquote(uri_components.path) + + ## Do not permit newlines in the path. It is unlikely that these will + ## be used in practice, and they can easily be used to confuse the + ## user. + if "\n" in path_str: + print( + "WARNING: Decoded path string contains newlines, skipping. " + + f"Path: {stdisplay(path_str, sgr=-1)}", + file=sys.stderr, + ) + continue + + ## Do not permit NUL characters in the path. + if "\x00" in path_str: + print( + "WARNING: Decoded path string contains NUL characters, " + + f"skipping. Path: {stdisplay(path_str, sgr=-1)}", + file=sys.stderr, + ) + continue + + ## Ensure path_str is absolute. + if not path_str.startswith("/"): + print( + f"WARNING: Path '{stdisplay(path_str, sgr=-1)}' is not " + + "absolute, skipping.", + file=sys.stderr, + ) + continue + + ## Ensure the path is valid, exists, and is accessible. + path_item: Path = Path(path_str) + try: + path_exists = path_item.exists(follow_symlinks=False) + except OSError as exc: + ## Under Python 3.13, Path.exists() can raise on pathological + ## inputs - in particular ENAMETOOLONG (errno 36) when any single + ## path component exceeds NAME_MAX. An attacker who can inject a + ## URI here (D-Bus FileManager1 calls from another desktop app) + ## could otherwise crash this process by sending one long path. + ## Treat as "non-existent, skip" - same as the False branch. This + ## issue does not exist in Python 3.14, so we can remove this + ## check in Forky. + print( + f"WARNING: Path could not be checked (errno " + f"{exc.errno}: {exc.strerror}), skipping. Sanitized " + f"path: '{stdisplay(path_str, sgr=-1)}'", + file=sys.stderr, + ) + continue + if not path_exists: + print( + f"WARNING: Path '{stdisplay(path_str, sgr=-1)}' does not " + + "exist, skipping.", + file=sys.stderr, + ) + continue + + ## Grab the parent dir if necessary. Note that we aren't able to + ## actually highlight items or show item properties with the API that + ## PCManFM-Qt provides us, but we are able to open the parent + ## directories, which at least gets the user closer to the intended + ## action. + if handler_mode in ("--show-items", "--show-item-properties"): + path_item = path_item.parent + + ## Resolve symlinks and '..' components of the path so the user sees + ## what they're actually going to open. + try: + path_item = path_item.resolve(strict=True) + except OSError: + print( + "WARNING: Could not resolve path " + + f"'{stdisplay(str(path_item), sgr=-1)}', skipping.", + file=sys.stderr, + ) + continue + + ## Only respect directories that we can access the contents of. + if not path_item.is_dir(): + print( + f"WARNING: Path '{stdisplay(str(path_item), sgr=-1)}' does " + + "not point to a directory, skipping.", + file=sys.stderr, + ) + continue + if not os.access(path_item, os.R_OK | os.X_OK): + print( + f"WARNING: Path '{stdisplay(str(path_item), sgr=-1)}' cannot " + + "be accessed by us, skipping.", + file=sys.stderr, + ) + continue + + path_set.add(path_item) + + output_list: list[Path] = list(path_set) + output_list.sort() + return output_list + + +def main() -> NoReturn: + """ + Main function. + """ + + handler_mode: str | None = None + uri_list: list[str] = [] + + for arg_idx, arg in enumerate(sys.argv): + if arg_idx == 0: + continue + if arg in ("--show-folders", "--show-items", "--show-item-properties"): + if handler_mode is not None: + print( + f"ERROR: {arg} and {handler_mode} are mutually exclusive!", + file=sys.stderr, + ) + sys.exit(1) + handler_mode = arg + elif arg == "--": + uri_list = sys.argv[arg_idx + 1 :] + break + else: + uri_list = sys.argv[arg_idx:] + break + + if len(uri_list) == 0: + print("ERROR: No URIs provided!", file=sys.stderr) + sys.exit(1) + if handler_mode is None: + print("ERROR: No handler mode provided!", file=sys.stderr) + sys.exit(1) + + path_list: list[Path] = get_path_list_from_uris(handler_mode, uri_list) + if len(path_list) == 0: + print("ERROR: All provided URIs were invalid!", file=sys.stderr) + sys.exit(1) + + app: QApplication = QApplication(sys.argv) + + signal.signal(signal.SIGINT, signal_handler) + signal.signal(signal.SIGTERM, signal_handler) + + timer: QTimer = QTimer() + timer.timeout.connect(lambda: None) + timer.start(500) + + ## Keep a reference to the window so it isn't garbage-collected. + # pylint: disable=unused-variable + fsw: FmShimWindow = FmShimWindow(path_list) # noqa: F841 + app.exec_() + sys.exit(0) + + +if __name__ == "__main__": + main() diff --git a/usr/lib/security-misc/apt-get-update b/usr/lib/security-misc/apt-get-update deleted file mode 100755 index 03df63de..00000000 --- a/usr/lib/security-misc/apt-get-update +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -sigterm_trap() { - if [ "$lastpid" = "" ]; then - exit 143 - fi - ps -p "$lastpid" >/dev/null 2>&1 - if [ ! "$?" = "0" ]; then - ## Already terminated. - exit 143 - fi - kill -s sigterm "$lastpid" - exit 143 -} - -trap "sigterm_trap" SIGTERM SIGINT - -[ -n "$timeout_after" ] || timeout_after="600" -[ -n "$kill_after" ] || kill_after="10" - -timeout \ - --kill-after="$kill_after" \ - "$timeout_after" \ - /usr/lib/security-misc/apt-get-wrapper update "$@" & - -lastpid="$!" -wait "$lastpid" - -exit "$?" diff --git a/usr/lib/security-misc/apt-get-update-sanity-test b/usr/lib/security-misc/apt-get-update-sanity-test deleted file mode 100755 index 6e303816..00000000 --- a/usr/lib/security-misc/apt-get-update-sanity-test +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -x -set -e -set -o pipefail - -wc -L "/var/lib/apt/lists/"*InRelease -wc -L "/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}' diff --git a/usr/lib/security-misc/apt-get-wrapper b/usr/lib/security-misc/apt-get-wrapper deleted file mode 100755 index b3b60adb..00000000 --- a/usr/lib/security-misc/apt-get-wrapper +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e -set -o pipefail -set -o errtrace - -cleanup() { - if [ -d "$temp_dir" ]; then - rm --recursive --force "$temp_dir" - fi -} - -temp_dir="$(mktemp --directory)" -logfile="$temp_dir/log" - -trap "cleanup" EXIT - -apt_get_exit_code="0" - -## Thanks to: -## dmw -## http://stackoverflow.com/a/26263980/2605155 -## for the python way to create a pty. - -python -c 'import pty, sys; pty.spawn(sys.argv[1:])' \ - | apt-get "$@" 2>&1 \ - | tee -a "$logfile" \ - || { apt_get_exit_code="$?"; true; }; - -if [ ! "$apt_get_exit_code" = "0" ]; then - exit "$apt_get_exit_code" -fi - -log="$(cat "$logfile")" - -while read -r -d $'\n' line; do - line_lower_case="${line,,}" - first_two="${line_lower_case:0:2}" - if [ "$first_two" = "e:" ]; then - exit 125 - fi - if [ "$first_two" = "w:" ]; then - exit 125 - fi -done < <( echo "$log" ) - -exit "$apt_get_exit_code" diff --git a/usr/lib/security-misc/askpass b/usr/lib/security-misc/askpass deleted file mode 100755 index 0a7cb838..00000000 --- a/usr/lib/security-misc/askpass +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -title="$0: password required for $(whoami) to perform action as superuser" - -zenity --password --title="$title" diff --git a/usr/lib/security-misc/echo-path b/usr/lib/security-misc/echo-path deleted file mode 100755 index ba4cdf40..00000000 --- a/usr/lib/security-misc/echo-path +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -echo "$PATH" diff --git a/usr/lib/security-misc/hide-hardware-info b/usr/lib/security-misc/hide-hardware-info deleted file mode 100755 index 2c8e0754..00000000 --- a/usr/lib/security-misc/hide-hardware-info +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -sysfs_whitelist=1 -cpuinfo_whitelist=1 - -shopt -s nullglob - -## Allows for disabling the whitelist. -for i in /etc/hide-hardware-info.d/*.conf -do - bash -n "${i}" - source "${i}" -done - -create_whitelist() { - if [ "${1}" = "sysfs" ]; then - whitelist_path="/sys" - elif [ "${1}" = "cpuinfo" ]; then - whitelist_path="/proc/cpuinfo" - else - echo "ERROR: ${1} is not a correct parameter." - exit 1 - fi - - if grep -q "${1}" /etc/group; then - ## Changing the permissions of /sys recursively - ## causes errors as the permissions of /sys/kernel/debug - ## and /sys/fs/cgroup cannot be changed. - chgrp -fR "${1}" "${whitelist_path}" || true - - chmod o-rwx "${whitelist_path}" - else - echo "ERROR: The ${1} group does not exist, the ${1} whitelist was not created." - fi -} - -## sysfs and debugfs expose a lot of information -## that should not be accessible by an unprivileged -## user which includes hardware info, debug info and -## more. This restricts /sys, /proc/cpuinfo, /proc/bus -## and /proc/scsi to the root user only. This hides -## many hardware identifiers from ordinary users -## and increases security. -for i in /proc/cpuinfo /proc/bus /proc/scsi /sys -do - if [ -e "${i}" ]; then - if [ "${i}" = "/sys" ]; then - ## Whitelist for /sys. - if [ "${sysfs_whitelist}" = "1" ]; then - create_whitelist sysfs - else - chmod og-rwx /sys - echo "INFO: The sysfs whitelist is not enabled. Some things may not work properly." - fi - elif [ "${i}" = "/proc/cpuinfo" ]; then - ## Whitelist for /proc/cpuinfo. - if [ "${cpuinfo_whitelist}" = "1" ]; then - create_whitelist cpuinfo - else - chmod og-rwx /proc/cpuinfo - echo "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly." - fi - else - chmod og-rwx "${i}" - fi - else - ## /proc/scsi doesn't exist on Debian so errors - ## are expected here. - if ! [ "${i}" = "/proc/scsi" ]; then - echo "ERROR: ${i} could not be found." - fi - fi -done diff --git a/usr/lib/security-misc/pam-abort-on-locked-password b/usr/lib/security-misc/pam-abort-on-locked-password deleted file mode 100755 index 71b432c7..00000000 --- a/usr/lib/security-misc/pam-abort-on-locked-password +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash - -if ! passwd_output="$(passwd -S "$PAM_USER" 2>/dev/null)" ; then - echo "$0: ERROR: user \"$PAM_USER\" does not exist." >&2 - exit 1 -fi - -if [ "$(echo "$passwd_output" | cut -d ' ' -f 2)" = "P" ]; then - true "INFO: Password not locked." -else - echo "$0: ERROR: Password for user \"$PAM_USER\" is locked." >&2 - - if [ -f /usr/share/whonix/marker ] || [ -f /usr/share/kicksecure/marker ]; then - if [ "$PAM_USER" = "root" ]; then - echo "$0: ERROR: root account is locked by default. See:" >&2 - echo "https://www.whonix.org/wiki/root" >&2 - echo "" >&2 - fi - fi - - exit 1 -fi - -exit 0 diff --git a/usr/lib/security-misc/pam_tally2-info b/usr/lib/security-misc/pam_tally2-info deleted file mode 100755 index b3e7f127..00000000 --- a/usr/lib/security-misc/pam_tally2-info +++ /dev/null @@ -1,153 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -grep_result="$(grep "accessfile=/etc/security/access-security-misc.conf" /etc/pam.d/common-account 2>/dev/null)" - -## Check if grep matched something. -if [ ! "$grep_result" = "" ]; then - ## Yes, grep matched. - - ## Check if not out commented. - if ! echo "$grep_result" | grep -q "#" ; then - ## Not out commented indeed. - - ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592 - - if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console"; then - console_allowed=true - fi - if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console-unrestricted"; then - console_allowed=true - fi - - if [ ! "$console_allowed" = "true" ]; then - echo "$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console'" >&2 - echo "$0: To unlock, run the following command as superuser:" >&2 - echo "$0: (If you still have a sudo/root shell somewhere.)" >&2 - echo "" >&2 - echo "addgroup $PAM_USER console" >&2 - echo "" >&2 - echo "$0: However, possibly unlock procedure is required." >&2 - echo "$0: First boot into recovery mode at grub boot menu and then run above command." >&2 - echo "$0: See also:" >&2 - echo "https://www.whonix.org/wiki/root#console" >&2 - echo "" >&2 - exit 0 - fi - fi -fi - -## https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698 - -if [ ! "$(id -u)" = "0" ]; then - ## as user "user" - ## /sbin/pam_tally2 -u user - ## pam_tally2: Error opening /var/log/tallylog for update: Permission denied - ## /sbin/pam_tally2: Authentication error - ## - ## xscreensaver runs as user "user", therefore pam_tally2 cannot function. - ## xscreensaver has its own failed login counter. - ## - ## https://askubuntu.com/questions/983183/how-lock-the-unlock-screen-after-wrong-password-attempts - ## - ## https://www.whonix.org/pipermail/whonix-devel/2019-September/001439.html - true "$0: not started as root, exiting." - exit 0 -fi - -## Does not work (yet) for login, pam_securetty runs before and aborts. -## Also this should only run for login since securetty covers only login. -# if [ "$PAM_USER" = "root" ]; then -# if [ -f /etc/securetty ]; then -# grep_result="$(grep "^[^#]" /etc/securetty)" -# if [ "$grep_result" = "" ]; then -# echo "$0: ERROR: Root login is disabled." >&2 -# echo "$0: ERROR: This is because /etc/securetty is empty." >&2 -# echo "$0: See also:" >&2 -# echo "https://www.whonix.org/wiki/root#login" >&2 -# echo "" >&2 -# exit 0 -# fi -# fi -# fi - -## Using || true to not break read-only disk boot without ro-mode-init or grub-live. -pam_tally2_output="$(pam_tally2 --user "$PAM_USER")" || true - -if [ "$pam_tally2_output" = "" ]; then - true "$0: no failed login" - exit 0 -fi - -## Example: -#Login Failures Latest failure From -#user 0 - -pam_tally2_output_last_line="$(echo "$pam_tally2_output" | tail -1)" -## Example: -#user 0 - -arr=($pam_tally2_output_last_line) -user_name="${arr[0]}" -failed_login_counter="${arr[1]}" - -if [ ! "$PAM_USER" = "$user_name" ]; then - echo "$0: ERROR: PAM_USER: '$PAM_USER' does not equal user_name: '$user_name'." >&2 - echo "$0: ERROR: Please report this bug." >&2 - echo "" >&2 - exit 0 -fi - -if [ "$failed_login_counter" = "0" ]; then - true "$0: INFO: Failed login counter is 0, ok." - exit 0 -fi - -deny_line="$(cat /etc/pam.d/common-auth | grep deny=)" -## Example: -#auth requisite pam_tally2.so even_deny_root deny=50 onerr=fail audit debug - -for word in $deny_line ; do - if echo "$word" | grep -q "deny=" ; then - deny="$(echo "$word" | cut -d "=" -f 2)" - break - fi -done - -if [[ "$deny" == *[!0-9]* ]]; then - echo "$0: ERROR: deny is not numeric." >&2 - echo "$0: ERROR: Please report this bug." >&2 - echo "" >&2 - exit 0 -fi - -remaining_attempts="$(( $deny - $failed_login_counter ))" - -if [ "$remaining_attempts" -le "0" ]; then - echo "$0: ERROR: Login blocked after $failed_login_counter attempts." >&2 - echo "$0: To unlock, run the following command as superuser:" >&2 - echo "$0: (If you still have a sudo/root shell somewhere.)" >&2 - echo "" >&2 - echo "pam_tally2 --quiet -r --user $PAM_USER" >&2 - echo "" >&2 - echo "$0: However, most likely unlock procedure is required." >&2 - echo "$0: First boot into recovery mode at grub boot menu and then run above command." >&2 - echo "$0: See also:" >&2 - echo "https://www.whonix.org/wiki/root#unlock" >&2 - echo "" >&2 - exit 0 -fi - -echo "$0: WARNING: $failed_login_counter failed login attempts." >&2 -echo "$0: Login will be blocked after $deny attempts." >&2 -echo "$0: You have $remaining_attempts more attempts before unlock procedure is required." >&2 -echo "" >&2 - -if [ "$PAM_SERVICE" = "su" ]; then - echo "$0: NOTE: Type the password. When entering the password, no password feedback (no asterisk (\"*\") symbol) will be shown." >&2 - echo "" >&2 -fi - -exit 0 diff --git a/usr/lib/security-misc/panic-on-oops b/usr/lib/security-misc/panic-on-oops deleted file mode 100755 index ed59cf6c..00000000 --- a/usr/lib/security-misc/panic-on-oops +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -if [ -f /usr/lib/helper-scripts/pre.bsh ]; then - ## pre.bsh would `source` the following folders: - ## /etc/panic-on-oops_pre.d/*.conf - ## /usr/local/etc/panic-on-oops_pre.d/*.conf - source /usr/lib/helper-scripts/pre.bsh -fi - -## Makes the kernel panic on oopses. This prevents the kernel -## from continuing to run a flawed processes. Many kernel exploits -## will also cause an oops which this will make the kernel kill. -sysctl kernel.panic_on_oops=1 diff --git a/usr/lib/security-misc/permission-hardening b/usr/lib/security-misc/permission-hardening deleted file mode 100755 index 3a1b2c4b..00000000 --- a/usr/lib/security-misc/permission-hardening +++ /dev/null @@ -1,468 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://forums.whonix.org/t/disable-suid-binaries/7706 -## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 - -## To view previous modes and how these were changed: -## meld /var/lib/permission-hardening/existing_mode/statoverride /var/lib/permission-hardening/new_mode/statoverride - -## To undo: -## sudo /usr/lib/security-misc/permission-hardening-undo - -#set -x -set -e -set -o pipefail - -exit_code=0 - -mkdir -p /var/lib/permission-hardening/existing_mode -mkdir -p /var/lib/permission-hardening/new_mode -dpkg_admindir_parameter_existing_mode="--admindir /var/lib/permission-hardening/existing_mode" -dpkg_admindir_parameter_new_mode="--admindir /var/lib/permission-hardening/new_mode" - -echo_wrapper_ignore() { - echo "run: $@" - "$@" 2>/dev/null || true -} - -echo_wrapper_silent_ignore() { - #echo "run: $@" - "$@" 2>/dev/null || true -} - -echo_wrapper_audit() { - echo "run: $@" - return_code=0 - "$@" || \ - { \ - return_code="$?" ; \ - exit_code=203 ; \ - echo "ERROR: above command failed with exit code '$return_code'! calling function name: '${FUNCNAME[1]}'" >&2 ; \ - }; -} - -echo_wrapper_silent_audit() { - #echo "run (debugging): $@" - return_code=0 - "$@" || \ - { \ - return_code="$?" ; \ - exit_code=204 ; \ - echo "ERROR: above command '$@' failed with exit code '$return_code'! calling function name: '${FUNCNAME[1]}'" >&2 ; \ - }; -} - -sanity_tests() { - echo_wrapper_silent_audit which \ - capsh getcap setcap stat find dpkg-statoverride getent xargs grep 1>/dev/null -} - -add_nosuid_statoverride_entry() { - local fso_to_process - fso_to_process="$fso" - local should_be_counter - should_be_counter="$(find "$fso_to_process" -perm /u=s,g=s | wc -l)" || true - local counter_actual - counter_actual=0 - - local line - while read -r line; do - true "line: $line" - counter_actual="$(( counter_actual + 1 ))" - - local arr file_name existing_mode existing_owner existing_group - arr=($line) - file_name="${arr[0]}" - existing_mode="${arr[1]}" - existing_owner="${arr[2]}" - existing_group="${arr[3]}" - - if [ "$arr" = "" ]; then - echo "ERROR: arr is empty. line: '$line'" >&2 - continue - fi - if [ "$file_name" = "" ]; then - echo "ERROR: file_name is empty. line: '$line'" >&2 - continue - fi - if [ "$existing_mode" = "" ]; then - echo "ERROR: existing_mode is empty. line: '$line'" >&2 - continue - fi - if [ "$existing_owner" = "" ]; then - echo "ERROR: existing_owner is empty. line: '$line'" >&2 - continue - fi - if [ "$existing_group" = "" ]; then - echo "ERROR: existing_group is empty. line: '$line'" >&2 - continue - fi - - ## -h file True if file is a symbolic Link. - ## -u file True if file has its set-user-id bit set. - ## -g file True if file has its set-group-id bit set. - - if test -h "$file_name" ; then - ## https://forums.whonix.org/t/disable-suid-binaries/7706/14 - true "skip symlink: $file_name" - continue - fi - - if test -d "$file_name" ; then - true "skip directory: $file_name" - continue - fi - - local setuid setuid_output setsgid setsgid_output - setuid="" - setuid_output="" - if test -u "$file_name" ; then - setuid=true - setuid_output="set-user-id" - fi - setsgid="" - setsgid_output="" - if test -g "$file_name" ; then - setsgid=true - setsgid_output="set-group-id" - fi - - local setuid_or_setsgid - setuid_or_setsgid="" - if [ "$setuid" = "true" ] || [ "$setsgid" = "true" ]; then - setuid_or_setsgid=true - fi - if [ "$setuid_or_setsgid" = "" ]; then - continue - fi - - ## Remove suid / gid and execute permission for 'group' and 'others'. - ## Similar to: chmod og-ugx /path/to/filename - ## Removing execution permission is useful to make binaries such as 'su' fail closed rather - ## than fail open if suid was removed from these. - ## Do not remove read access since no security benefit and easier to manually undo for users. - ## Are there suid or sgid binaries which are still useful if suid / sgid has been removed from these? - new_mode="744" - - local is_exact_whitelisted - is_exact_whitelisted="" - for white_list_entry in $exact_white_list ; do - if [ "$file_name" = "$white_list_entry" ]; then - is_exact_whitelisted="true" - ## Stop looping through the whitelist. - break - fi - done - - local is_match_whitelisted - is_match_whitelisted="" - for matchwhite_list_entry in $match_white_list ; do - if echo "$file_name" | grep -q "$matchwhite_list_entry" ; then - is_match_whitelisted="true" - ## Stop looping through the match_white_list. - break - fi - done - - local is_disable_whitelisted - is_disable_whitelisted="" - for disablematch_list_entry in $disable_white_list ; do - if echo "$file_name" | grep -q "$disablematch_list_entry" ; then - is_disable_whitelisted="true" - ## Stop looping through the disablewhitelist. - break - fi - done - - if [ "$is_disable_whitelisted" = "true" ]; then - echo "INFO: white list disabled - $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode'" - else - if [ "$is_exact_whitelisted" = "true" ]; then - echo "INFO: SKIP whitelisted - $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode'" - continue - fi - if [ "$is_match_whitelisted" = "true" ]; then - echo "INFO: SKIP matchwhitelisted - $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode' | matchwhite_list_entry: '$matchwhite_list_entry'" - continue - fi - fi - - echo "INFO: $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'" - - if dpkg-statoverride $dpkg_admindir_parameter_existing_mode --list "$file_name" >/dev/null ; then - true "OK Existing mode already saved previously. No need to save again." - else - ## Save existing_mode in separate database. - ## Not using --update as not intending to enforce existing_mode. - echo_wrapper_silent_audit dpkg-statoverride $dpkg_admindir_parameter_existing_mode --add "$existing_owner" "$existing_group" "$existing_mode" "$file_name" - fi - - ## No need to check "dpkg-statoverride --list" for existing entries. - ## If existing_mode was correct already, we would not have reached this point. - ## Since existing_mode is incorrect, remove from dpkg-statoverride and re-add. - - ## Remove from real database. - echo_wrapper_silent_ignore dpkg-statoverride --remove "$file_name" - - ## Remove from separate database. - echo_wrapper_silent_ignore dpkg-statoverride $dpkg_admindir_parameter_new_mode --remove "$file_name" - - ## Add to real database and use --update to make changes on disk. - echo_wrapper_audit dpkg-statoverride --add --update "$existing_owner" "$existing_group" "$new_mode" "$file_name" - - ## Not using --update as this is only for recording. - echo_wrapper_silent_audit dpkg-statoverride $dpkg_admindir_parameter_new_mode --add "$existing_owner" "$existing_group" "$new_mode" "$file_name" - - ## /lib will hit ARG_MAX if using bash 'shopt -s globstar' and '/lib/**'. - ## Using 'find' with '-perm /u=s,g=s' is faster and avoids ARG_MAX. - ## https://forums.whonix.org/t/disable-suid-binaries/7706/17 - done < <( find "$fso_to_process" -perm /u=s,g=s -print0 | xargs -I{} -0 stat -c "%n %a %U %G" {} ) - - ## Sanity test. - if [ ! "$should_be_counter" = "$counter_actual" ]; then - echo "INFO: fso_to_process: '$fso_to_process' | counter_actual : '$counter_actual'" - echo "INFO: fso_to_process: '$fso_to_process' | should_be_counter: '$should_be_counter'" - exit_code=202 - echo "ERROR: counter does not check out." >&2 - fi -} - -set_file_perms() { - echo "INFO: START parsing config_file: '$config_file'" - local line - while read -r line; do - if [ "$line" = "" ]; then - continue - fi - - if [[ "$line" =~ ^# ]]; then - continue - fi - - if [[ "$line" =~ [0-9a-zA-Z/] ]]; then - true "OK line contains only white listed characters." - else - exit_code=200 - echo "ERROR: cannot parse line with invalid character. line: '$line'" >&2 - ## Safer to exit with error in this case. - ## https://forums.whonix.org/t/disable-suid-binaries/7706/59 - exit "$exit_code" - fi - - #global fso - local mode_from_config owner_from_config group_from_config capability_from_config - if ! read -r fso mode_from_config owner_from_config group_from_config capability_from_config <<< "$line" ; then - exit_code=201 - echo "ERROR: cannot parse. line: '$line'" >&2 - ## Debugging. - du -hs /tmp || true - echo "test -w /tmp: '$(test -w /tmp)'" >&2 || true - ## Safer to exit with error in this case. - ## https://forums.whonix.org/t/disable-suid-binaries/7706/59 - exit "$exit_code" - fi - - local fso_without_trailing_slash - fso_without_trailing_slash="${fso%/}" - - if [ "$mode_from_config" = "disablewhitelist" ]; then - ## TODO: test/add white spaces inside file name support - disable_white_list+="$fso " - continue - fi - - if [ "$mode_from_config" = "exactwhitelist" ]; then - ## TODO: test/add white spaces inside file name support - exact_white_list+="$fso " - continue - fi - - if [ "$mode_from_config" = "matchwhitelist" ]; then - ## TODO: test/add white spaces inside file name support - match_white_list+="$fso " - continue - fi - - if [ ! -e "$fso" ]; then - echo "INFO: fso: '$fso' - does not exist. This is likely normal." - continue - fi - - ## Use dpkg-statoverride so permissions are not reset during upgrades. - - if [ "$mode_from_config" = "nosuid" ]; then - ## If mode_from_config is "nosuid" the config does not set owner and - ## group. Therefore do not enforce owner/group check. - - add_nosuid_statoverride_entry - else - local string_length_of_mode_from_config - string_length_of_mode_from_config="${#mode_from_config}" - if [ "$string_length_of_mode_from_config" -gt "4" ]; then - echo "ERROR: Mode '$mode_from_config' is invalid!" >&2 - continue - fi - if [ "$string_length_of_mode_from_config" -lt "3" ]; then - echo "ERROR: Mode '$mode_from_config' is invalid!" >&2 - continue - fi - - if ! getent passwd | grep -q "^${owner_from_config}:" ; then - echo "ERROR: owner_from_config '$owner_from_config' does not exist!" >&2 - continue - fi - - if ! getent group | grep -q "^${group_from_config}:" ; then - echo "ERROR: group_from_config '$group_from_config' does not exist!" >&2 - continue - fi - - local mode_for_grep - mode_for_grep="$mode_from_config" - first_character_of_mode_from_config="${mode_from_config::1}" - if [ "$first_character_of_mode_from_config" = "0" ]; then - ## Remove leading '0'. - mode_for_grep="${mode_from_config:1}" - fi - - local stat_output - stat_output="" - if ! stat_output="$(stat -c "%n %a %U %G" "$fso_without_trailing_slash")" ; then - echo "ERROR: failed to run 'stat' for fso_without_trailing_slash: '$fso_without_trailing_slash'!" >&2 - continue - fi - - local arr file_name existing_mode existing_owner existing_group - arr=($stat_output) - file_name="${arr[0]}" - existing_mode="${arr[1]}" - existing_owner="${arr[2]}" - existing_group="${arr[3]}" - - if [ "$arr" = "" ]; then - echo "ERROR: arr is empty. stat_output: '$stat_output' | line: '$line'" >&2 - continue - fi - if [ "$file_name" = "" ]; then - echo "ERROR: file_name is empty. stat_output: '$stat_output' | line: '$line'" >&2 - continue - fi - if [ "$existing_mode" = "" ]; then - echo "ERROR: existing_mode is empty. stat_output: '$stat_output' | line: '$line'" >&2 - continue - fi - if [ "$existing_owner" = "" ]; then - echo "ERROR: existing_owner is empty. stat_output: '$stat_output' | line: '$line'" >&2 - continue - fi - if [ "$existing_group" = "" ]; then - echo "ERROR: $existing_group is empty. stat_output: '$stat_output' | line: '$line'" >&2 - continue - fi - - ## Check there is an entry for the fso. - ## - ## example: dpkg-statoverride --list | grep /home - ## output: - ## root root 755 /home - ## - ## dpkg-statoverride does not show leading '0'. - local dpkg_statoverride_list_output="" - local dpkg_statoverride_list_exit_code=0 - dpkg_statoverride_list_output="$(dpkg-statoverride --list "$fso_without_trailing_slash")" || { dpkg_statoverride_list_exit_code=$? ; true; }; - - if [ "$dpkg_statoverride_list_exit_code" = "0" ]; then - true "There is an fso entry. Check if owner/group/mode match." - local grep_line - grep_line="$owner_from_config $group_from_config $mode_for_grep $fso_without_trailing_slash" - if echo "$dpkg_statoverride_list_output" | grep -q "$grep_line" ; then - true "OK The owner/group/mode matches. No further action required." - else - true "The owner/group/mode do not match, therefore remove and re-add the entry to update it." - ## fso_without_trailing_slash instead of fso to prevent - ## "dpkg-statoverride: warning: stripping trailing /" - - if dpkg-statoverride $dpkg_admindir_parameter_existing_mode --list "$fso_without_trailing_slash" >/dev/null ; then - true "OK Existing mode already saved previously. No need to save again." - else - ## Save existing_mode in separate database. - ## Not using --update as not intending to enforce existing_mode. - echo_wrapper_silent_audit dpkg-statoverride $dpkg_admindir_parameter_existing_mode --add "$existing_owner" "$existing_group" "$existing_mode" "$fso_without_trailing_slash" - fi - - echo_wrapper_silent_ignore dpkg-statoverride $dpkg_admindir_parameter_new_mode --remove "$fso_without_trailing_slash" - - ## Remove from and add to real database. - echo_wrapper_silent_ignore dpkg-statoverride --remove "$fso_without_trailing_slash" - echo_wrapper_audit dpkg-statoverride --add --update "$owner_from_config" "$group_from_config" "$mode_from_config" "$fso_without_trailing_slash" - - ## Save in separate database. - ## Not using --update as this is only for saving. - echo_wrapper_silent_audit dpkg-statoverride $dpkg_admindir_parameter_new_mode --add "$owner_from_config" "$group_from_config" "$mode_from_config" "$fso_without_trailing_slash" - fi - else - true "There is no fso entry. Therefore add one." - - if dpkg-statoverride $dpkg_admindir_parameter_existing_mode --list "$fso_without_trailing_slash" >/dev/null ; then - true "OK Existing mode already saved previously. No need to save again." - else - ## Save existing_mode in separate database. - ## Not using --update as not intending to enforce existing_mode. - echo_wrapper_silent_audit dpkg-statoverride $dpkg_admindir_parameter_existing_mode --add "$existing_owner" "$existing_group" "$existing_mode" "$fso_without_trailing_slash" - fi - - ## Add to real database. - echo_wrapper_audit dpkg-statoverride --add --update "$owner_from_config" "$group_from_config" "$mode_from_config" "$fso_without_trailing_slash" - - ## Save in separate database. - ## Not using --update as this is only for saving. - echo_wrapper_silent_audit dpkg-statoverride $dpkg_admindir_parameter_new_mode --add "$owner_from_config" "$group_from_config" "$mode_from_config" "$fso_without_trailing_slash" - fi - fi - if [ "$capability_from_config" = "" ]; then - continue - fi - - if [ "$capability_from_config" = "none" ]; then - ## https://forums.whonix.org/t/disable-suid-binaries/7706/45 - # sudo setcap -r /usr/bin/ping 2>/dev/null - # Failed to set capabilities on file `/usr/bin/ping' (No data available) - # The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file - ## Therefore use echo_wrapper_ignore. - echo_wrapper_ignore setcap -r "$fso" - getcap_output="$(getcap "$fso")" - if [ ! "$getcap_output" = "" ]; then - exit_code=205 - echo "ERROR: removing capabilities for fso '$fso' failed!" >&2 - continue - fi - else - if ! capsh --print | grep "Bounding set" | grep -q "$capability_from_config" ; then - echo "ERROR: capability_from_config '$capability_from_config' does not exist!" >&2 - continue - fi - - echo_wrapper_audit setcap "${capability_from_config}+ep" "$fso" - fi - done < "$config_file" - echo "INFO: END parsing config_file: '$config_file'" -} - -parse_config_folder() { - shopt -s nullglob - for config_file in /etc/permission-hardening.d/*.conf /usr/local/etc/permission-hardening.d/*.conf; do - set_file_perms - done -} - -sanity_tests -parse_config_folder - -if [ ! "$exit_code" = "0" ]; then - echo "ERROR: Will exit with non-zero exit code: '$exit_code'" >&2 -fi - -exit "$exit_code" diff --git a/usr/lib/security-misc/permission-hardening-undo b/usr/lib/security-misc/permission-hardening-undo deleted file mode 100755 index 5f2324df..00000000 --- a/usr/lib/security-misc/permission-hardening-undo +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -#set -x -set -e -set -o pipefail - -exit_code=0 - -dpkg_admindir_parameter_existing_mode="--admindir /var/lib/permission-hardening/existing_mode" -dpkg_admindir_parameter_new_mode="--admindir /var/lib/permission-hardening/new_mode" - -undo_all() { - if [ ! -f /var/lib/permission-hardening/existing_mode/statoverride ]; then - return 0 - fi - - local line - - while read -r line; do - ## example line: - ## root root 4755 /usr/lib/eject/dmcrypt-get-device - - local owner group mode file_name - if ! read -r owner group mode file_name <<< "$line" ; then - exit_code=201 - echo "ERROR: cannot parse line: $line" >&2 - continue - fi - true "owner: '$owner' group: '$group' mode: '$mode' file_name: '$file_name'" - - chown "${owner}:${group}" "$file_name" || exit_code=202 - ## chmod need to be run after chown since chown removes suid. - ## https://unix.stackexchange.com/questions/53665/chown-removes-setuid-bit-bug-or-feature - chmod "$mode" "$file_name" || exit_code=203 - - dpkg-statoverride --remove "$file_name" &>/dev/null || true - dpkg-statoverride $dpkg_admindir_parameter_existing_mode --remove "$file_name" &>/dev/null || true - dpkg-statoverride $dpkg_admindir_parameter_new_mode --remove "$file_name" &>/dev/null || true - - done < "/var/lib/permission-hardening/existing_mode/statoverride" -} - -undo_all - -if [ ! "$exit_code" = "0" ]; then - echo "ERROR: Will exit with non-zero exit code: '$exit_code'" >&2 -fi - -exit "$exit_code" diff --git a/usr/lib/security-misc/permission-lockdown b/usr/lib/security-misc/permission-lockdown deleted file mode 100755 index 2b4e8027..00000000 --- a/usr/lib/security-misc/permission-lockdown +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Doing this for all users would create many issues. -# /usr/lib/security-misc/permission-lockdown: user: root | chmod o-rwx "/root" -# /usr/lib/security-misc/permission-lockdown: user: daemon | chmod o-rwx "/usr/sbin" -# /usr/lib/security-misc/permission-lockdown: user: bin | chmod o-rwx "/bin" -# /usr/lib/security-misc/permission-lockdown: user: sys | chmod o-rwx "/dev" -# /usr/lib/security-misc/permission-lockdown: user: sync | chmod o-rwx "/bin" -# /usr/lib/security-misc/permission-lockdown: user: games | chmod o-rwx "/usr/games" -# /usr/lib/security-misc/permission-lockdown: user: man | chmod o-rwx "/var/cache/man" -# /usr/lib/security-misc/permission-lockdown: user: mail | chmod o-rwx "/var/mail" -# /usr/lib/security-misc/permission-lockdown: user: proxy | chmod o-rwx "/bin" -# /usr/lib/security-misc/permission-lockdown: user: backup | chmod o-rwx "/var/backups" -# /usr/lib/security-misc/permission-lockdown: user: systemd-timesync | chmod o-rwx "/run/systemd" -# /usr/lib/security-misc/permission-lockdown: user: systemd-network | chmod o-rwx "/run/systemd/netif" -# /usr/lib/security-misc/permission-lockdown: user: messagebus | chmod o-rwx "/var/run/dbus" -# /usr/lib/security-misc/permission-lockdown: user: tinyproxy | chmod o-rwx "/run/tinyproxy" -# /usr/lib/security-misc/permission-lockdown: user: rtkit | chmod o-rwx "/proc" -# /usr/lib/security-misc/permission-lockdown: user: colord | chmod o-rwx "/var/lib/colord" -# /usr/lib/security-misc/permission-lockdown: user: Debian-exim | chmod o-rwx "/var/spool/exim4" -# /usr/lib/security-misc/permission-lockdown: user: debian-tor | chmod o-rwx "/var/lib/tor" -# /usr/lib/security-misc/permission-lockdown: user: stunnel4 | chmod o-rwx "/var/run/stunnel4" -# /usr/lib/security-misc/permission-lockdown: user: iodine | chmod o-rwx "/var/run/iodine" -# /usr/lib/security-misc/permission-lockdown: user: apt-cacher-ng | chmod o-rwx "/var/cache/apt-cacher-ng" -# /usr/lib/security-misc/permission-lockdown: user: statd | chmod o-rwx "/var/lib/nfs" -# /usr/lib/security-misc/permission-lockdown: user: timidity | chmod o-rwx "/etc/timidity" -# /usr/lib/security-misc/permission-lockdown: user: uuidd | chmod o-rwx "/run/uuidd" -# /usr/lib/security-misc/permission-lockdown: user: _rpc | chmod o-rwx "/run/rpcbind" -# /usr/lib/security-misc/permission-lockdown: user: geoclue | chmod o-rwx "/var/lib/geoclue" - -home_folder_access_rights_lockdown() { - shopt -s nullglob - - ## Not using dotglob. - ## touch /var/cache/security-misc/state-files//home/.Trash - ## touch: cannot touch '/var/cache/security-misc/state-files//home/.Trash': No such file or directory - - local folder_name base_name - - for folder_name in /home/* ; do - base_name="$(basename "$folder_name")" - if [ -f "/var/cache/security-misc/state-files/$base_name" ]; then - continue - fi - if [ ! -d "$folder_name" ]; then - continue - fi - if [ "$folder_name" = "/home/" ]; then - continue - fi - mkdir -p /var/cache/security-misc/state-files - echo "$0: chmod o-rwx \"$folder_name\"" - chmod o-rwx "$folder_name" - ## Create a state-file so we do this only once. - ## Therefore a user who will manually undo this, will not get - ## annoyed by this being done over and over again. - touch "/var/cache/security-misc/state-files/$base_name" - done - - shopt -u nullglob -} - -home_folder_access_rights_lockdown - -exit 0 diff --git a/usr/lib/security-misc/remount-secure b/usr/lib/security-misc/remount-secure deleted file mode 100755 index 84cd9090..00000000 --- a/usr/lib/security-misc/remount-secure +++ /dev/null @@ -1,130 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## noexec in /tmp and/or /home can break some malware but also legitimate -## applications. - -## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 - -set -x -set -e - -if [ -f /usr/lib/helper-scripts/pre.bsh ]; then - ## pre.bsh would `source` the following folders: - ## /etc/remount-secure_pre.d/*.conf - ## /usr/local/etc/remount-secure_pre.d/*.conf - source /usr/lib/helper-scripts/pre.bsh -fi - -if [ -e /etc/remount-disable ] || [ -e /usr/local/etc/remount-disable ]; then - echo "INFO: file /etc/remount-disable exists. Doing nothing." - exit 0 -fi - -if [ -e /etc/exec ] || [ -e /usr/local/etc/exec ]; then - noexec=false - echo "INFO: Will remount with exec because file /etc/exec or /usr/local/etc/exec exists." -else - if [ -e /etc/noexec ] || [ -e /usr/local/etc/noexec ]; then - noexec=true - echo "INFO: Will remount with noexec because file /etc/noexec or /usr/local/etc/noexec exists." - else - echo "INFO: Will not remount with noexec because file /etc/noexec or /usr/local/etc/noexec does not exist." - fi -fi - -mkdir --parents "/var/run/remount-secure" - -if [ "$noexec" = "true" ]; then - noexec_maybe=",noexec" -fi - -exit_code=0 - -mount_output="$(mount)" - -remount_secure() { - ## ${FUNCNAME[1]} is the name of the calling function. I.e. the function - ## which called this function. - status_file_name="${FUNCNAME[1]}" - ## example status_file_name: - ## _home - status_file_full_path="/var/run/remount-secure/${status_file_name}" - ## example status_file_full_path: - ## /var/run/remount-secure/_home - - ## str_replace is provided by package helper-scripts. - mount_folder="$(echo "${status_file_name}" | str_replace "_" "/")" - ## example mount_folder: - ## /home - - mount_line_of_mount_folder="$(echo "$mount_output" | grep "$mount_folder ")" || true - - if echo "$mount_line_of_mount_folder" | grep -q "$new_mount_options" ; then - echo "INFO: $mount_folder has already intended mount options." - return 0 - fi - - if [ -e "$status_file_full_path" ]; then - echo "INFO: $mount_folder already remounted earlier. Not remounting again." - return 0 - fi - - ## BUG: echo: write error: Broken pipe - if echo "$mount_output" | grep -q "$mount_folder " ; then - ## Already mounted. Using remount. - echo mount -o "remount,${new_mount_options}" "$mount_folder" - mount -o "remount,${new_mount_options}" "$mount_folder" || exit_code=100 - else - ## Not yet mounted. Using mount bind. - echo mount -o "$new_mount_options" --bind "$mount_folder" "$mount_folder" - mount -o "$new_mount_options" --bind "$mount_folder" "$mount_folder" || exit_code=101 - fi - - touch "$status_file_full_path" -} - -_home() { - new_mount_options="nosuid,nodev${noexec_maybe}" - remount_secure "$@" -} - -_run() { - ## https://lists.freedesktop.org/archives/systemd-devel/2015-February/028456.html - new_mount_options="nosuid,nodev${noexec_maybe}" - remount_secure "$@" -} - -_dev_shm() { - new_mount_options="nosuid,nodev${noexec_maybe}" - remount_secure "$@" -} - -_tmp() { - new_mount_options="nosuid,nodev${noexec_maybe}" - remount_secure "$@" -} - -## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25 -# _lib() { -# ## Not using noexec on /lib. -# new_mount_options="nosuid,nodev" -# remount_secure "$@" -# } - -end() { - exit $exit_code -} - -main() { - _home "$@" - _run "$@" - _dev_shm "$@" - _tmp "$@" - #_lib "$@" - end "$@" -} - -main "$@" diff --git a/usr/lib/security-misc/remove-system.map b/usr/lib/security-misc/remove-system.map deleted file mode 100755 index c99b2860..00000000 --- a/usr/lib/security-misc/remove-system.map +++ /dev/null @@ -1,35 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -f /usr/lib/helper-scripts/pre.bsh ]; then - ## pre.bsh would `source` the following folders: - ## /etc/remove-system.map_pre.d/*.conf - ## /usr/local/etc/remove-system.map_pre.d/*.conf - source /usr/lib/helper-scripts/pre.bsh -fi - -shopt -s nullglob - -system_map_location="/boot/System.map* /usr/src/*/System.map* /lib/modules/*/*/System.map* /System.map*" - -counter=0 -for filename in ${system_map_location} ; do - counter=$(( counter + 1 )) -done - -if [ "$counter" -ge "1" ]; then - echo "Deleting system.map files..." -fi - -## Removes the System.map files as they are only used for debugging or malware. -for filename in ${system_map_location} ; do - if [ -f "${filename}" ]; then - rm --verbose --force "${filename}" - fi -done - -if [ "$counter" -ge "1" ]; then - echo "Done. Success." -fi diff --git a/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared b/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared new file mode 100644 index 00000000..0ef99dab --- /dev/null +++ b/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## NOTE: +## This configuration is in a dedicated file because the ram-wipe package +## requires kexec. However, ram-wipe cannot ship a config file +## /etc/sysctl.d/40_ram-wipe.conf that sets 'kernel.kexec_load_disabled=0'. +## Once systemd-sysctl.service has set 'kernel.kexec_load_disabled=1', +## it cannot be undone without a reboot. This is an upstream Linux security feature. +## Instead, ram-wipe will config-package-dev 'hide' this file. + +## Disables kexec, which can be used to replace the running kernel. +## Useful for live kernel patching without rebooting. +## +## https://en.wikipedia.org/wiki/Kexec +## +## KSPP=yes +## KSPP sets the sysctl and does not set CONFIG_KEXEC. +## +kernel.kexec_load_disabled=1 diff --git a/usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared b/usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared new file mode 100644 index 00000000..724e0f14 --- /dev/null +++ b/usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Disable the usage of the ptrace() system call by all processes. +## Restrict ptrace() as it enables programs to inspect and modify other active processes. +## Prevents native code debugging which some programs use as a method to detect tampering. +## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE. +## +## https://docs.kernel.org/admin-guide/LSM/Yama.html#ptrace-scope +## https://en.wikipedia.org/wiki/Ptrace +## https://grapheneos.org/features#attack-surface-reduction +## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928 +## https://github.com/netblue30/firejail/issues/2860 +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.yama.ptrace_scope=3 diff --git a/usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared b/usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared new file mode 100644 index 00000000..3e424917 --- /dev/null +++ b/usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared @@ -0,0 +1,20 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Prevent kernel information leaks in the console during boot. +## Must be used in conjunction with kernel boot parameters. +## See /etc/default/grub.d/41_quiet_boot.cfg for implementation. +## +## https://docs.kernel.org/core-api/printk-basics.html +## +kernel.printk=3 3 3 3 + +## For increased log verbosity: +## A) Adjust (or comment out) the kernel parameters in /etc/default/grub.d/41_quiet_boot.cfg. Or, +## B) Alternatively, install the debug-misc package to undo these settings. diff --git a/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared b/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared new file mode 100644 index 00000000..4dc06302 --- /dev/null +++ b/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared @@ -0,0 +1,678 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## NOTE: +## This file has a special name to ensure that /usr/lib/sysctl.d/99-protect-links.conf +## is parsed first, followed by /usr/lib/sysctl.d/990-security-misc.conf. +## https://github.com/Kicksecure/security-misc/pull/135 + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## This configuration file is divided into 6 sections: +## 1. Kernel Space +## 2. User Space +## 3. Core Dumps +## 4. Swap Space +## 5. Networking +## 6. CD-ROM/DVD + +## For detailed explanations of most of the selected commands, refer to: +## https://docs.kernel.org/admin-guide/sysctl/index.html +## https://docs.kernel.org/networking/ip-sysctl.html + +## 1. Kernel Space: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-kernel +## https://kspp.github.io/Recommended_Settings#sysctls +## https://wiki.archlinux.org/title/Security#Kernel_hardening + +## Restrict kernel address visibility via /proc and other interfaces, regardless of user privileges. +## Kernel pointers expose specific locations in kernel memory. +## +## https://kernsec.org/wiki/index.php/Bug_Classes/Kernel_pointer_leak +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.kptr_restrict=2 + +## Restrict access to the kernel log buffer to users with CAP_SYSLOG. +## Kernel logs often contain sensitive information such as kernel pointers. +## +## KSPP=yes +## KSPP sets the sysctl and CONFIG_SECURITY_DMESG_RESTRICT=y. +## +kernel.dmesg_restrict=1 + +## Prevent kernel information leaks in the console during boot. +## Must be used in conjunction with kernel boot parameters. +## See /etc/default/grub.d/41_quiet_boot.cfg for implementation. +## +## https://docs.kernel.org/core-api/printk-basics.html +## +## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation. +## +#kernel.printk=3 3 3 3 + +## Restrict eBPF access to CAP_BPF. +## Disables unprivileged calls to bpf() without recovery. +## +## https://en.wikipedia.org/wiki/EBPF#Security +## https://lwn.net/Articles/660331/ +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.unprivileged_bpf_disabled=1 + +## Restrict loading TTY line disciplines to users with CAP_SYS_MODULE. +## Prevents unprivileged users from loading vulnerable line disciplines with the TIOCSETD ioctl. +## +## https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html +## https://lkml.org/lkml/2019/4/15/890 +## +## KSPP=yes +## KSPP sets the sysctl does not set CONFIG_LDISC_AUTOLOAD. +## +dev.tty.ldisc_autoload=0 + +## Restrict the userfaultfd() syscall to users with SYS_CAP_PTRACE. +## Reduces the likelihood of use-after-free exploits from heap sprays. +## +## https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cefdca0a86be517bc390fc4541e3674b8e7803b0 +## https://duasynt.com/blog/linux-kernel-heap-spray +## +## KSPP=yes +## KSPP sets the sysctl. +## +vm.unprivileged_userfaultfd=0 + +## Disables kexec, which can be used to replace the running kernel. +## Useful for live kernel patching without rebooting. +## +## https://en.wikipedia.org/wiki/Kexec +## +## See /usr/lib/sysctl.d/30_security-misc_kexec-disable.conf for implementation. +## +## KSPP=yes +## KSPP sets the sysctl and does not set CONFIG_KEXEC. +## +#kernel.kexec_load_disabled=1 + +## Disable the SysRq key to prevent leakage of kernel information. +## The Secure Attention Key (SAK) can no longer be utilized. +## +## https://docs.kernel.org/admin-guide/sysrq.html +## https://www.kicksecure.com/wiki/SysRq +## https://github.com/xairy/unlockdown +## +## KSPP=yes +## KSPP sets the less strict CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=176. +## +kernel.sysrq=0 + +## Disable user namespaces entirely. +## User namespaces aim to improve sandboxing and accessibility for unprivileged users. +## Disabling entirely will reduce compatibility with some AppArmor profiles. +## Disabling entirely is known to break the UPower systemd service. +## Not recommended due to well-known breakages across numerous software packages. +## +## https://lwn.net/Articles/673597/ +## https://madaidans-insecurities.github.io/linux.html#kernel +## https://github.com/a13xp0p0v/kernel-hardening-checker#questions-and-answers +## https://github.com/NixOS/nixpkgs/pull/84522#issuecomment-614640601 +## https://github.com/Kicksecure/security-misc/pull/263 +## +## KSPP=no +## KSPP sets the sysctl. +## +#user.max_user_namespaces=0 + +## Restrict user namespaces to users with CAP_SYS_ADMIN. +## See the user.max_user_namespaces setting for more details. +## This is a Debian-specific kernel feature, not a Linux mainline setting. +## Unprivileged user namespaces pose substantial privilege escalation risks. +## Flatpak requires unprivileged users to create new user namespaces for sandboxing. +## Restricting is known to cause breakages in some AppImages and the Evolution Email Client. +## Not recommended due to widespread breakages across many software packages. +## +## https://salsa.debian.org/debian/bubblewrap/-/blob/debian/latest/debian/README.Debian +## https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction +## https://github.com/flatpak/flatpak/wiki/User-namespace-requirements +## https://forums.kicksecure.com/t/can-not-run-flatpak-apps-after-kicksecure-update/592 +## https://forums.kicksecure.com/t/cannot-run-some-appimage-apps-after-kicksecure-upate/594 +## https://forums.kicksecure.com/t/impossible-to-start-evolution-app-since-the-last-update/601 +## https://github.com/Kicksecure/security-misc/issues/274 +## +#kernel.unprivileged_userns_clone=0 + +## Restricts kernel profiling to users with CAP_PERFMON. +## The performance events system should not be accessible by unprivileged users. +## Other distributions such as Ubuntu and Fedora may permit further restricting. +## +## https://docs.kernel.org/admin-guide/perf-security.html#unprivileged-users +## https://lore.kernel.org/kernel-hardening/1469630746-32279-1-git-send-email-jeffv@google.com/ +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.perf_event_paranoid=3 + +## Force immediate system reboots on the occurrence of a single kernel panic. +## Increases resilience and limits impact of denial-of-service attacks as system automatically restarts. +## Ensures the system does not hang forever if a panic occurs, reducing susceptibility to both cold and warm boot attacks. +## Immediate rebooting also prevents persistent information disclosure on panic details that were dumped to screen. +## +## KSPP=yes +## KSPP sets CONFIG_PANIC_TIMEOUT=-1. +## +kernel.panic=-1 + +## Force the kernel to immediately panic on "oopses" and kernel warnings in the WARN() path. +## Panics may be due to false-positives such as bad drivers. +## Both allowed limits are set to one so that panics occur on the single first instance of either scenario. +## Oopses are serious but non-fatal errors. +## Certain "oopses" can sometimes indicate and thwart potential kernel exploitation attempts. +## Warnings are messages generated by the kernel to indicate unexpected conditions or errors. +## By default, code execution continues regardless of warnings emitted by macros like WARN() and WARN_ON(). +## Note that by forcing kernel panics on oopses and warnings, this exposes the system to targeted denial-of-service attacks. +## +## https://en.wikipedia.org/wiki/Kernel_panic#Linux +## https://en.wikipedia.org/wiki/Linux_kernel_oops +## https://lwn.net/Articles/876209/ +## https://git.sr.ht/~gregkh/presentation-security/tree/3fdaf81a2f8b2c8d64cdb2f529cc714624868aa8/item/security-stuff.pdf +## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panisc-on-oops-1-sysctl-for-better-security/7713 +## +## KSPP=yes +## KSPP sets the sysctls and CONFIG_PANIC_ON_OOPS=y +## +## Note that this must be used with kernel.panic=-1 for it to function as intended. +## +## See /usr/libexec/security-misc/panic-on-oops for implementation. +## +#kernel.oops_limit=1 +#kernel.warn_limit=1 + +## Force immediate kernel panic on OOM (out of memory) scenarios. +## Registers a kernel panic whenever the oom_killer is triggered to kill some rogue process based on their OOM score. +## This prevents security features such as the screen locker, kloak, and emerg-shutdown from being arbitrarily terminated. +## Enabling these two together creates a risk of userspace-based denial-of-service attacks that maliciously fill memory. +## This forces immediate system reboot rather than placing any reliance on the oom_killer. +## Known to cause extreme user experience problems with certain applications as the Tor Browser. +## Enabling by default requires improved upstream handling of user space OOM better accounting for desktop users. +## +## https://en.wikipedia.org/wiki/Out_of_memory +## https://forums.whonix.org/t/screen-locker-in-security-can-we-disable-these-at-least-4-backdoors/8128/14 +## https://github.com/KSPP/kspp.github.io/issues/9 +## https://github.com/Kicksecure/security-misc/issues/324 +## +## Note that this must be used with kernel.panic=-1 for it to function as intended. +## +#vm.panic_on_oom=2 + +## Force immediate kernel panic on certain NMIs (Non-Maskable Interrupts). +## NMIs are hardware interrupts that cannot be ignored by standard interrupt-masking techniques. +## NMIs are reserved for critical events that require immediate attention. +## Panic upon a NMI indicating a serious hardware-level I/O issue to prevent data corruption. +## Panic upon a NMI indicating uncorrectable memory and hardware errors to prevent data corruption. +## Panic upon receiving an undefined or unknown NMI. +## All three must first be tested to ensure there are no pre-existing issues on user hardware. +## After confirming stability of each they can then be used to prevent data corruption from hardware sources. +## These are valuable for high-reliability systems where data integrity is critical. +## +## https://en.wikipedia.org/wiki/Non-maskable_interrupt +## https://docs.kernel.org/trace/events-nmi.html +## https://0xax.gitbook.io/linux-insides/summary/interrupts/linux-interrupts-6 +## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_for_real_time/7/html/reference_guide/non-maskable_interrupts +## +## Note that these must be used with kernel.panic=-1 for them to function as intended. +## +#kernel.panic_on_io_nmi=1 +#kernel.panic_on_unrecovered_nmi=1 +#kernel.unknown_nmi_panic=1 + +## Disable the use of legacy TIOCSTI operations which can be used to inject keypresses. +## Can lead to privilege escalation by pushing characters into a controlling TTY. +## Will break out-dated screen readers that continue to rely on this legacy functionality. +## Note this was already disabled by default as of Linux kernel 6.2. +## +## https://lore.kernel.org/lkml/20221228205726.rfevry7ud6gmttg5@begin/T/ +## +## KSPP=yes +## KSPP sets the sysctl and does not set CONFIG_LEGACY_TIOCSTI. +## +dev.tty.legacy_tiocsti=0 + +## Disable asynchronous I/O for all processes. +## Use of io_uring has been the leading cause of numerous kernel exploits. +## Disabling will reduce the read/write performance of storage devices. +## +## https://en.wikipedia.org/wiki/Io_uring#Security +## https://lwn.net/Articles/902466/ +## https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html +## https://github.com/moby/moby/pull/46762 +## https://forums.whonix.org/t/io-uring-security-vulnerabilties/16890 +## +kernel.io_uring_disabled=2 + +## Disable 32-bit Virtual Dynamic Shared Object (vDSO) mappings. +## Legacy compatibility feature for superseded glibc versions. +## +## https://lore.kernel.org/lkml/20080409082927.BD59E26F992@magilla.localdomain/T/ +## https://lists.openwall.net/linux-kernel/2014/03/11/3 +## +## KSPP=yes +## KSPP sets the kernel parameter and does not set CONFIG_COMPAT_VDSO. +## +## See /etc/default/grub.d/40_kernel_hardening.cfg for another additional implementation. +## +abi.vsyscall32=0 + +## 2. User Space: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-userspace + +## Disable the usage of the ptrace() system call by all processes. +## Restrict ptrace() as it enables programs to inspect and modify other active processes. +## Prevents native code debugging which some programs use as a method to detect tampering. +## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE. +## +## https://docs.kernel.org/admin-guide/LSM/Yama.html#ptrace-scope +## https://en.wikipedia.org/wiki/Ptrace +## https://grapheneos.org/features#attack-surface-reduction +## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928 +## https://github.com/netblue30/firejail/issues/2860 +## +## KSPP=yes +## KSPP sets the sysctl. +## +## See /usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf for implementation. +## +#kernel.yama.ptrace_scope=3 + +## Maximize bits of entropy for improved effectiveness of mmap ASLR. +## The maximum number of bits depends on CPU architecture (the ones shown below are for x86). +## Both explicit sysctl are made redundant due to automation. +## Do NOT enable either sysctl - displaying only for clarity. +## +## https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514 +## +## See /usr/libexec/security-misc/mmap-rnd-bits for implementation. +## +#vm.mmap_rnd_bits=32 +#vm.mmap_rnd_compat_bits=16 + +## Prevent hardlink creation by users who do not have read/write/ownership of source file. +## Only allow symlinks to be followed when outside of world-writable sticky directories. +## Allow symlinks when the owner and follower match or when the directory owner matches the symlink's owner. +## Hardens cross-privilege boundaries if root process follows a hardlink/symlink belonging to another user. +## This mitigates many hardlink/symlink-based TOCTOU races in world-writable directories like /tmp. +## +## https://wiki.archlinux.org/title/Security#File_systems +## https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=/tmp +## https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use#Preventing_TOCTOU +## +## KSPP=yes +## KSPP sets the sysctls. +## +fs.protected_hardlinks=1 +fs.protected_symlinks=1 + +## Disallow writes to files in world-writable sticky directories unless owned by the directory owner. +## Also applies to group-writable sticky directories to make data spoofing attacks more difficult. +## Prevents unintentional writes to attacker-controlled files. +## +## KSPP=yes +## KSPP sets the sysctls. +## +fs.protected_fifos=2 +fs.protected_regular=2 + +## Enable ASLR for mmap base, stack, VDSO pages, and heap. +## Forces shared libraries to be loaded to random addresses. +## Start location of PIE-linked binaries is randomized. +## Heap randomization can lead to breakages with legacy applications. +## +## https://en.wikipedia.org/wiki/Address_space_layout_randomization#Linux +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.randomize_va_space=2 + +## Raise the minimum address a process can request for memory mapping to 64KB as a form of defense-in-depth. +## Prevents kernel null pointer dereference vulnerabilities which may trigger kernel panics. +## Protects against local unprivileged users gaining root privileges by mapping data to low memory pages. +## Some legacy applications may still depend on low virtual memory addresses for proper functionality. +## +## https://googleprojectzero.blogspot.com/2023/01/exploiting-null-dereferences-in-linux.html +## https://access.redhat.com/articles/20484 +## https://wiki.debian.org/mmap_min_addr +## +## KSPP=yes +## KSPP sets CONFIG_DEFAULT_MMAP_MIN_ADDR=65536. +## +vm.mmap_min_addr=65536 + +## Increase the maximum number of memory map areas a process is permitted to utilize. +## Addresses performance, crash, and start-up issues for some memory-intensive applications. +## Required to accommodate the very large number of guard pages created by hardened_malloc. +## Kicksecure version 18 will deprecate hardened_malloc, so this sysctl will be applied here instead. +## +## https://archlinux.org/news/increasing-the-default-vmmax_map_count-value/ +## https://github.com/GrapheneOS/hardened_malloc#traditional-linux-based-operating-systems +## https://github.com/Kicksecure/hardened_malloc/blob/master/debian/hardened_malloc.conf +## https://www.kicksecure.com/wiki/Hardened_Malloc#Deprecation_in_Kicksecure +## +vm.max_map_count=1048576 + +## Disable the miscellaneous binary format virtual file system to prevent unintended code execution. +## Prevents registering interpreters for various binary formats based on a magic number or their file extension. +## Otherwise arbitrary executables with recognized file formats will be passed to relevant user space applications. +## These interpreters will then run with root permissions when a setuid binary is owned by root. +## Can stop maliciously crafted files with specific file extensions from automatically executing. +## Breaks many scripts that do not have appropriate shebang interpreter directives (#!/bin/...). +## +## https://docs.kernel.org/admin-guide/binfmt-misc.html +## https://salsa.debian.org/debian/binfmt-support +## https://access.redhat.com/solutions/1985633 +## https://en.wikipedia.org/wiki/Binfmt_misc +## https://security.stackexchange.com/questions/271786/does-allowing-binfmt-misc-significantly-increase-the-attack-surface-for-unprivil +## https://unix.stackexchange.com/questions/439569/what-kinds-of-executable-formats-do-the-files-under-proc-sys-fs-binfmt-misc-al +## https://github.com/Kicksecure/security-misc/pull/249 +## +## KSPP=no +## KSPP does not set CONFIG_BINFMT_MISC. +## +## This is disabled by default due to file/folder permission issues: +## https://github.com/Kicksecure/security-misc/issues/267 +## +#fs.binfmt_misc.status=0 + +## 3. Core Dumps: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#core-dumps + +## Disable core dump files by preventing any pattern names. +## This setting may be overwritten by systemd and is not comprehensive. +## Core dumps are also disabled in security-misc-shared via other means. +## +## https://wiki.archlinux.org/title/Core_dump#Disabling_automatic_core_dumps +## +kernel.core_pattern=|/bin/false + +## Prevent setuid processes or otherwise protected/tainted binaries from creating core dumps. +## Any process which has changed privilege levels or is execute-only will not be dumped. +## +## https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598 +## +## KSPP=yes +## KSPP sets the sysctl. +## +fs.suid_dumpable=0 + +## Set core dump file name to 'core.PID' instead of 'core' as a form of defense-in-depth. +## If core dumps are permitted, only useful if PID listings are hidden from non-root users. +## +kernel.core_uses_pid=1 + +## 4. Swap Space: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#swap + +## Limit the copying of memory to the swap device only if absolutely necessary. +## Minimizes the likelihood of writing potentially sensitive contents to disk. +## Not recommended to set to zero since this disables periodic write behavior. +## +## https://en.wikipedia.org/wiki/Memory_paging#Linux +## https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Performance_Tuning_Guide/s-memory-tunables.html +## +vm.swappiness=1 + +## 5. Networking: +## +## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-network +## https://wiki.archlinux.org/title/Sysctl#TCP/IP_stack_hardening + +## Enable hardening of the BPF JIT compiler for all users. +## Provides some mitigation against JIT spraying. +## +## https://en.wikipedia.org/wiki/JIT_spraying +## https://www.blackhat.com/docs/eu-16/materials/eu-16-Reshetova-Randomization-Can't-Stop-BPF-JIT-Spray-wp.pdf +## https://lwn.net/Articles/686098/ +## https://lwn.net/Articles/525609/ +## +## KSPP=yes +## KSPP sets the sysctl. +## +net.core.bpf_jit_harden=2 + +## Enable TCP SYN cookie protection to assist against SYN flood attacks. +## +## https://en.wikipedia.org/wiki/SYN_flood +## https://cateee.net/lkddb/web-lkddb/SYN_COOKIES.html +## +## KSPP=yes +## KSPP sets CONFIG_SYN_COOKIES=y. +## +net.ipv4.tcp_syncookies=1 + +## Protect against TCP time-wait assassination hazards. +## Drops RST packets for sockets in the time-wait state. +## +## https://tools.ietf.org/html/rfc1337 +## +net.ipv4.tcp_rfc1337=1 + +## Enable reverse path filtering (source validation) of packets received from all interfaces. +## Prevents IP spoofing and mitigates vulnerabilities such as CVE-2019-14899. +## The second "default" command fixes a bug in the existing kernel implementation. +## +## https://en.wikipedia.org/wiki/IP_address_spoofing +## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-reverse_path_forwarding#sect-Security_Guide-Server_Security-Reverse_Path_Forwarding +## https://forums.whonix.org/t/enable-reverse-path-filtering/8594 +## https://seclists.org/oss-sec/2019/q4/122 +## https://github.com/Kicksecure/security-misc/pull/261 +## +net.ipv4.conf.*.rp_filter=1 +net.ipv4.conf.default.rp_filter=1 + +## Disable ICMP redirect acceptance and redirect sending messages. +## Prevents man-in-the-middle attacks and minimizes information disclosure. +## If ICMP redirects are permitted, accept messages only through approved gateways (kernel default). +## Approving gateways requires the managing of a default gateway list. +## +## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing#sect-Security_Guide-Server_Security-Disable-Source-Routing +## https://www.frozentux.net/ipsysctl-tutorial/chunkyhtml/theconfvariables.html +## https://www.debian.org/doc/manuals/securing-debian-manual/network-secure.en.html +## https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked +## https://github.com/Kicksecure/security-misc/pull/248 +## +net.ipv4.conf.*.accept_redirects=0 +net.ipv4.conf.*.send_redirects=0 +net.ipv6.conf.*.accept_redirects=0 +#net.ipv4.conf.*.secure_redirects=1 + +## Deny sending and receiving RFC1620 shared media redirects. +## Relevant mainly for network interfaces that operate over shared media such as Ethernet hubs. +## Stops the kernel from sending ICMP redirects to specific networks from the connected network. +## This variable overrides the use secure_redirects. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## https://datatracker.ietf.org/doc/html/rfc1620 +## https://www.frozentux.net/ipsysctl-tutorial/chunkyhtml/theconfvariables.html +## +net.ipv4.conf.*.shared_media=0 + +## Enable ARP (Address Resolution Protocol) filtering. +## Prevents the Linux kernel from handling the ARP table globally. +## Can mitigate some ARP spoofing and ARP cache poisoning attacks. +## Improper filtering can lead to increased ARP traffic and inadvertently block legitimate ARP requests. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## +net.ipv4.conf.*.arp_filter=1 + +## Respond to ARP (Address Resolution Protocol) requests only if the target IP address is on-link. +## Reduces IP spoofing attacks by limiting the scope of allowable ARP responses. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## https://github.com/mullvad/mullvadvpn-app/blob/main/audits/2024-12-10-X41-D-Sec.md#mllvd-cr-24-03-virtual-ip-address-of-tunnel-device-leaks-to-network-adjacent-participant-severity-medium +## https://github.com/mullvad/mullvadvpn-app/pull/7141 +## https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf +## +## Can lead to breakages with certain VM configurations that may be resolved by lowering protection to `arp_ignore=1`. +## https://github.com/Kicksecure/security-misc/pull/290 +## +net.ipv4.conf.*.arp_ignore=2 + +## Drop gratuitous ARP (Address Resolution Protocol) packets. +## Stops ARP responses sent by a device without being explicitly requested. +## Prevents ARP cache poisoning by rejecting fake ARP entries into a network. +## Prevents man-in-the-middle and denial-of-service attacks. +## May cause breakages when ARP proxies are used in the network. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## https://patchwork.ozlabs.org/project/netdev/patch/1428652454-1224-3-git-send-email-johannes@sipsolutions.net/ +## https://www.practicalnetworking.net/series/arp/gratuitous-arp/ +## +net.ipv4.conf.*.drop_gratuitous_arp=1 + +## Ignore ICMP echo requests. +## Prevents clock fingerprinting through ICMP timestamps and Smurf attacks. +## +## https://en.wikipedia.org/wiki/Smurf_attack +## +net.ipv4.icmp_echo_ignore_all=1 +net.ipv6.icmp.echo_ignore_all=1 + +## Ignore bogus ICMP error responses. +## Mitigates attacks designed to fill log files with useless error messages. +## +net.ipv4.icmp_ignore_bogus_error_responses=1 + +## Disable source routing which allows users to redirect network traffic. +## Prevents man-in-the-middle attacks in which the traffic is redirected. +## +## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing +## +net.ipv4.conf.*.accept_source_route=0 +net.ipv6.conf.*.accept_source_route=0 + +## Do not accept IPv6 router advertisements (RAs) and solicitations. +## RAs are unsecured and unauthenticated and any device on the local link can send and accept them without verification. +## Malicious RAs can activate IPv6 connectivity on dormant hosts leading to unauthorized access. +## Flooding the network with malicious RAs can lead to denial-of-service attacks. +## Rogue RAs can lead to interception of all network traffic by setting the attacker's system as the default gateway. +## +## https://datatracker.ietf.org/doc/html/rfc6104 +## https://datatracker.ietf.org/doc/html/rfc6105 +## https://archive.conference.hitb.org/hitbsecconf2012kul/materials/D1T2%20-%20Marc%20Heuse%20-%20IPv6%20Insecurity%20Revolutions.pdf +## +net.ipv6.conf.*.accept_ra=0 + +## Disable SACK and DSACK. +## Select acknowledgements (SACKs) are a known common vector of exploitation. +## Duplicate select acknowledgements (DSACKs) are an extension of SACK. +## Disabling can cause severe connectivity issues on networks with high latency or packet loss. +## Enabling on stable high-bandwidth networks can lead to reduced efficiency of TCP connections. +## +## https://datatracker.ietf.org/doc/html/rfc2018 +## https://datatracker.ietf.org/doc/html/rfc2883 +## https://access.redhat.com/sites/default/files/attachments/20150325_network_performance_tuning.pdf +## https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md +## https://wiki.archlinux.org/title/Sysctl#TCP_Selective_Acknowledgement +## https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109/5 +## +## SACK and DSACK are currently enabled. +## +#net.ipv4.tcp_sack=0 +#net.ipv4.tcp_dsack=0 + +## Disable TCP timestamps to limit device fingerprinting via system time. +## Timestamps allow round-trip time measurement and protection against wrapped sequence numbers. +## Disabling timestamps on very fast links is likely to cause TCP Sequence Numbers to wrap. +## Segments with wrapped numbers will be incorrectly discarded, reducing network performance. +## +## https://datatracker.ietf.org/doc/html/rfc1323 +## https://forums.whonix.org/t/do-ntp-and-tcp-timestamps-really-leak-your-local-time/7824 +## https://web.archive.org/web/20170201160732/https://mailman.boum.org/pipermail/tails-dev/2013-December/004520.html +## https://access.redhat.com/sites/default/files/attachments/20150325_network_performance_tuning.pdf +## +net.ipv4.tcp_timestamps=0 + +## Disable reuse of TIME_WAIT sockets for new outgoing connections. +## The safety of reusing of TIME_WAIT sockets requires enabling TCP timestamps. +## The kernel uses timestamps to verify a new connection is not a duplicate segment from an older connection. +## Hence TIME-WAIT sockets should wait the full timeout period before being made available again. +## Can lead to port exhaustion on high-traffic networks with numerous short-lived connections. +## +## https://vincent.bernat.ch/en/blog/2014-tcp-time-wait-state-linux +## +net.ipv4.tcp_tw_reuse=0 + +## Enable logging of packets with impossible source or destination addresses. +## Martian and unroutable packets may be used for malicious purposes. +## Recommended to keep a (kernel dmesg) log of these to identify suspicious packets. +## Useful for troubleshooting and diagnostics but not necessary by default. +## Previously known to cause performance issues, especially on systems with multiple interfaces. +## This no longer seems to be a problem. +## +## https://wiki.archlinux.org/title/Sysctl#Log_martian_packets +## https://www.cyberciti.biz/faq/linux-log-suspicious-martian-packets-un-routable-source-addresses/ +## https://support.scc.suse.com/s/kb/Martian-sources-errors-showing-in-messages-log?language=en_US +## https://github.com/Kicksecure/security-misc/issues/214 +## +net.ipv4.conf.*.log_martians=1 + +## Enable IPv6 Privacy Extensions to prefer temporary addresses over public addresses. +## The temporary/privacy address is used as the source for all outgoing traffic. +## Must be used in combination with /usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf. +## Must be used in combination with /usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf. +## Should be used with MAC randomization in /usr/lib/NetworkManager/conf.d/80_randomize-mac.conf. +## +## MAC randomization breaks root server and VirtualBox DHCP, likely due to IPv6 Privacy Extensions. +## +## https://datatracker.ietf.org/doc/html/rfc4941 +## https://github.com/Kicksecure/security-misc/pull/145 +## https://github.com/Kicksecure/security-misc/issues/184 +## +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. +## +#net.ipv6.conf.*.use_tempaddr=2 + +## 6. CD-ROM/DVD +## +## https://github.com/Kicksecure/security-misc/issues/348 + +## Disable CD-ROM/DVD drive automatic tray closure and ejection functionality. +## Prevents scripted tray cycling attacks. +## Requires users to press physical hardware buttons to insert and eject media. +## +## https://github.com/torvalds/linux/blob/master/drivers/cdrom/cdrom.c +## https://github.com/Kicksecure/security-misc/issues/348 +## +dev.cdrom.autoclose=0 +dev.cdrom.autoeject=0 + +## Disable all CD-ROM/DVD drive debug messages. +## Prevents verbose logging that could leak drive information. +## +## https://github.com/torvalds/linux/blob/master/drivers/cdrom/cdrom.c +## https://github.com/Kicksecure/security-misc/issues/348 +## +dev.cdrom.debug=0 + +## Restrict CD-ROM/DVD drives by disabling usage and hardware access. +## Disable the kernel from checking for media changes to the drive bay. +## Lock the drive bay preventing the physical eject button from opening the tray. +## +## https://github.com/torvalds/linux/blob/master/drivers/cdrom/cdrom.c +## https://github.com/Kicksecure/security-misc/issues/348 +## +#dev.cdrom.check_media=0 +#dev.cdrom.lock=1 diff --git a/usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..2d02bc99 --- /dev/null +++ b/usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Coredump] +Storage=none diff --git a/usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..8e6ca79f --- /dev/null +++ b/usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,7 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Mitigation for https://www.openwall.com/lists/oss-security/2026/04/08/1 + +[Journal] +ForwardToWall=no diff --git a/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop b/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop new file mode 100644 index 00000000..70aca2c9 --- /dev/null +++ b/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop @@ -0,0 +1,13 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## MAC randomisation breaks root server and VirtualBox DHCP likely due to IPv6 Privacy Extensions. +## +## https://datatracker.ietf.org/doc/html/rfc4941 +## https://github.com/Kicksecure/security-misc/pull/145 +## https://github.com/Kicksecure/security-misc/issues/184 +## +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. + +#[Network] +#IPv6PrivacyExtensions=kernel diff --git a/usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..9e513c62 --- /dev/null +++ b/usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[PStore] +Storage=none diff --git a/usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared b/usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared new file mode 100644 index 00000000..8b1c2615 --- /dev/null +++ b/usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared @@ -0,0 +1,29 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618 +disable hide-hardware-info.service + +## Disable for now until development finished / tested. +disable permission-hardener.service + +## Disable for now until development finished / tested. +## https://github.com/Kicksecure/security-misc/pull/152 +disable remount-secure.service + +## Disable due to pkexec issues. +disable proc-hidepid.service + +## Disable due to issues. See: +## https://github.com/Kicksecure/security-misc/issues/159 +disable harden-module-loading.service + +## TODO: polish, test +## Disable due to timing difficulties. See: +## https://github.com/systemd/systemd/issues/38261#issuecomment-3134580852 +disable ensure-shutdown.service +disable ensure-shutdown-trigger.service + +## memlockd is needed by emerg-shutdown, but the service is not, the user can +## enable this manually if desired. +disable memlockd.service diff --git a/usr/lib/systemd/system/block-shutdown.service#security-misc-shared b/usr/lib/systemd/system/block-shutdown.service#security-misc-shared new file mode 100644 index 00000000..3d4be21b --- /dev/null +++ b/usr/lib/systemd/system/block-shutdown.service#security-misc-shared @@ -0,0 +1,29 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This unit, if uncommented and started, will prevent the system from ever +## shutting down unless ensure-shutdown.service is enabled and correctly +## configured. If you have enabled ensure-shutdown.service and tuned the +## ENSURE_SHUTDOWN_TIMEOUT and DefaultTimeoutStopSec variables (in +## /etc/security-misc/emerg-shutdown/30_security_misc.conf and +## /etc/systemd/system.conf respectively) and want to make sure +## ensure-shutdown.service actually works, you can uncomment this unit and +## start it with `sudo systemctl start block-shutdown.service`. If the systems +## successfully powers down even with this unit started, +## ensure-shutdown.service is working. + +# [Unit] +# Description=Blocks shutdown indefinitely unless ensure-shutdown.service is enabled +# +# [Service] +# Type=exec +# ExecStart=bash -c -- "trap '' SIGTERM; sleep infinity" +# KillSignal=SIGTERM +# FinalKillSignal=SIGTERM +# RestartKillSignal=SIGTERM +# WatchdogSignal=SIGTERM +# SendSIGHUP=no +# TimeoutStopSec=infinity +# +# [Install] +# WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared b/usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared new file mode 100644 index 00000000..06c232e0 --- /dev/null +++ b/usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared @@ -0,0 +1,30 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## WARNING: Do not add ANY "Requires" dependencies to this unit. If a required +## dependency terminates, systemd will terminate emerg-shutdown, and many +## services crash when the boot drive is removed. Use "Wants" instead. + +[Unit] +Description=Emergency shutdown when boot media is removed +Documentation=https://github.com/Kicksecure/security-misc +DefaultDependencies=no +Before=sysinit.target +Wants=systemd-udevd.service +After=systemd-udevd.service +Wants=local-fs.target +After=local-fs.target +ConditionPathExists=!/usr/share/qubes/marker-vm +## Do not run emerg-shutdown.service in case 'rd.live.ram' or 'rd.live.ram=1' +## is set. +## https://forums.kicksecure.com/t/how-to-run-iso-live-mode-from-ram/1542/9 +ConditionKernelCommandLine=!rd.live.ram +ConditionKernelCommandLine=!rd.live.ram=1 + +[Service] +Type=notify +ExecStart=/usr/libexec/security-misc/emerg-shutdown +NotifyAccess=main + +[Install] +WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared b/usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared new file mode 100644 index 00000000..593f08de --- /dev/null +++ b/usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared @@ -0,0 +1,19 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## NOTE: If enabling this unit, also enable ensure-shutdown.service, otherwise +## this will do nothing. + +[Unit] +Description=Forcibly shut down the system if normal shutdown gets stuck (alternate trigger unit) +Documentation=https://github.com/Kicksecure/security-misc +ConditionPathExists=!/usr/share/qubes/marker-vm + +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=true +ExecStop=bash -c -- 'echo "d" > /run/emerg-shutdown-trigger' + +[Install] +WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared b/usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared new file mode 100644 index 00000000..ad124f55 --- /dev/null +++ b/usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## NOTE: If enabling this unit, also enable ensure-shutdown-trigger.service, +## otherwise this will likely be unable to unstick a stuck shutdown. + +[Unit] +Description=Forcibly shut down the system if normal shutdown gets stuck +Documentation=https://github.com/Kicksecure/security-misc +DefaultDependencies=no +Before=sysinit.target +Requires=systemd-udevd.service +After=systemd-udevd.service +Wants=emerg-shutdown.service +After=emerg-shutdown.service +ConditionPathExists=!/usr/share/qubes/marker-vm + +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=/usr/libexec/security-misc/ensure-shutdown +ExecStop=bash -c -- 'echo "d" > /run/emerg-shutdown-trigger' +KillMode=process + +[Install] +WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/harden-module-loading.service#security-misc-shared b/usr/lib/systemd/system/harden-module-loading.service#security-misc-shared new file mode 100644 index 00000000..8efea40e --- /dev/null +++ b/usr/lib/systemd/system/harden-module-loading.service#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=Disable the loading of additional modules after systemd-modules-load.service +Documentation=https://github.com/Kicksecure/security-misc + +DefaultDependencies=no +Before=sysinit.target +Requires=local-fs.target +Requires=systemd-modules-load.service +After=local-fs.target +After=systemd-modules-load.service + +# This functionality is implemented with this and not directly in the sysctl config is +# to allow systemd-modules-load.service to load the modules with no problem but +# to disallow anyone else do the same after the system boots up. + +[Service] +Type=oneshot +ExecStart=/usr/libexec/security-misc/disable-kernel-module-loading + +[Install] +WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..29814644 --- /dev/null +++ b/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,7 @@ +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Service] +## hardened malloc compatibility +## Otherwise haveged will exit with a core dump. +SystemCallFilter=getrandom diff --git a/lib/systemd/system/hide-hardware-info.service b/usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared similarity index 56% rename from lib/systemd/system/hide-hardware-info.service rename to usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared index dafa5318..659c3f57 100644 --- a/lib/systemd/system/hide-hardware-info.service +++ b/usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared @@ -1,9 +1,10 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] Description=Hide hardware information to unprivileged users -Documentation=https://github.com/Whonix/security-misc +Documentation=https://github.com/Kicksecure/security-misc + DefaultDependencies=no Before=sysinit.target Requires=local-fs.target @@ -11,7 +12,8 @@ After=local-fs.target [Service] Type=oneshot -ExecStart=/usr/lib/security-misc/hide-hardware-info +ExecStart=/usr/libexec/security-misc/hide-hardware-info +RemainAfterExit=yes [Install] WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared b/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared new file mode 100644 index 00000000..136ff7ae --- /dev/null +++ b/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared @@ -0,0 +1,15 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=kill VBoxDRMClient during shutdown to allow /tmp to be unmounted properly +ConditionVirtualization=oracle + +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=true +ExecStop=/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown + +[Install] +WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/panic-on-oops.service#security-misc-shared b/usr/lib/systemd/system/panic-on-oops.service#security-misc-shared new file mode 100644 index 00000000..bf97d7f2 --- /dev/null +++ b/usr/lib/systemd/system/panic-on-oops.service#security-misc-shared @@ -0,0 +1,21 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=Sets 'sysctl' settings relating to kernel panics on both oopses and warnings late during the boot process. +Documentation=https://github.com/Kicksecure/security-misc + +ConditionKernelCommandLine=!panic-on-oops=0 + +After=multi-user.target +After=graphical.target +After=getty.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/security-misc/panic-on-oops enable +ExecStop=/usr/libexec/security-misc/panic-on-oops disable + +[Install] +WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/permission-hardener.service#security-misc-shared b/usr/lib/systemd/system/permission-hardener.service#security-misc-shared new file mode 100644 index 00000000..1285bf06 --- /dev/null +++ b/usr/lib/systemd/system/permission-hardener.service#security-misc-shared @@ -0,0 +1,19 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=Permission Hardener at Boot Time (opt-in in addition to security-misc-shared package installation time hardening) +Documentation=https://github.com/Kicksecure/security-misc + +DefaultDependencies=no +Before=sysinit.target +Requires=local-fs.target +After=local-fs.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=permission-hardener enable + +[Install] +WantedBy=sysinit.target diff --git a/lib/systemd/system/proc-hidepid.service b/usr/lib/systemd/system/proc-hidepid.service#security-misc-shared similarity index 51% rename from lib/systemd/system/proc-hidepid.service rename to usr/lib/systemd/system/proc-hidepid.service#security-misc-shared index f2e9e91e..d7ea4d9e 100644 --- a/lib/systemd/system/proc-hidepid.service +++ b/usr/lib/systemd/system/proc-hidepid.service#security-misc-shared @@ -1,9 +1,10 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] Description=Mounts /proc with hidepid=2 -Documentation=https://github.com/Whonix/security-misc +Documentation=https://github.com/Kicksecure/security-misc + DefaultDependencies=no Before=sysinit.target Requires=local-fs.target @@ -11,7 +12,8 @@ After=local-fs.target [Service] Type=oneshot -ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc +ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2,gid=proc /proc +RemainAfterExit=yes [Install] WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/remount-secure.service#security-misc-shared b/usr/lib/systemd/system/remount-secure.service#security-misc-shared new file mode 100644 index 00000000..2489d347 --- /dev/null +++ b/usr/lib/systemd/system/remount-secure.service#security-misc-shared @@ -0,0 +1,32 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=remount /home /tmp /dev/shm /run with nosuid,nodev (default) and noexec (opt-in) +Documentation=https://github.com/Kicksecure/security-misc + +ConditionKernelCommandLine=!remountsecure=0 + +DefaultDependencies=no + +Before=sysinit-post.target +Before=basic.target +Before=multi-user.target +Before=graphical.target +Before=getty-pre.target +Before=network-pre.target + +After=local-fs.target +After=sysinit.target +After=qubes-sysinit.service + +Requires=local-fs.target +Requires=sysinit.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=remount-secure 3 + +[Install] +WantedBy=sysinit-post.target diff --git a/lib/systemd/system/remove-system-map.service b/usr/lib/systemd/system/remove-system-map.service#security-misc-shared similarity index 54% rename from lib/systemd/system/remove-system-map.service rename to usr/lib/systemd/system/remove-system-map.service#security-misc-shared index 562b1952..1e36d61c 100644 --- a/lib/systemd/system/remove-system-map.service +++ b/usr/lib/systemd/system/remove-system-map.service#security-misc-shared @@ -1,9 +1,10 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] Description=Removes the System.map files -Documentation=https://github.com/Whonix/security-misc +Documentation=https://github.com/Kicksecure/security-misc + DefaultDependencies=no Before=sysinit.target Requires=local-fs.target @@ -11,7 +12,8 @@ After=local-fs.target [Service] Type=oneshot -ExecStart=/usr/lib/security-misc/remove-system.map +ExecStart=/usr/libexec/security-misc/remove-system.map +RemainAfterExit=yes [Install] WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/sysinit-post.target#security-misc-shared b/usr/lib/systemd/system/sysinit-post.target#security-misc-shared new file mode 100644 index 00000000..81fb65bf --- /dev/null +++ b/usr/lib/systemd/system/sysinit-post.target#security-misc-shared @@ -0,0 +1,12 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=sysinit-post.target by security-misc-shared + +After=sysinit.target +Before=basic.target +Requires=sysinit.target + +[Install] +WantedBy=basic.target diff --git a/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..24cb0da2 --- /dev/null +++ b/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,8 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +ConditionPathExists=/sys/bus/usb + +[Service] +ExecCondition=/usr/libexec/security-misc/check-for-usb-controller diff --git a/usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared b/usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared new file mode 100644 index 00000000..3a9129d2 --- /dev/null +++ b/usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Service] +SupplementaryGroups=sysfs diff --git a/usr/lib/systemd/user/fm-shim.service#security-misc-shared b/usr/lib/systemd/user/fm-shim.service#security-misc-shared new file mode 100644 index 00000000..b372859c --- /dev/null +++ b/usr/lib/systemd/user/fm-shim.service#security-misc-shared @@ -0,0 +1,16 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=org.freedesktop.FileManager1 handler +StartLimitIntervalSec=10 +StartLimitBurst=3 + +[Service] +Type=notify +NotifyAccess=main +ExecStart=/usr/bin/fm-shim-backend +Restart=always + +[Install] +WantedBy=default.target diff --git a/usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..70accafb --- /dev/null +++ b/usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +ConditionPathExists=/sys/bus/usb diff --git a/usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared b/usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared new file mode 100644 index 00000000..051af9fe --- /dev/null +++ b/usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared @@ -0,0 +1,9 @@ +SUBSYSTEM!="input", GOTO="end" + +# new keyboard or mouse attached or removed, restart emerg-shutdown +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEYBOARD}=="1", RUN+="/usr/bin/systemctl restart emerg-shutdown.service" +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEYBOARD}=="1", GOTO="end" +KERNEL=="event*", ACTION=="remove", ENV{ID_INPUT_KEYBOARD}=="1", RUN+="/usr/bin/systemctl restart emerg-shutdown.service" +KERNEL=="event*", ACTION=="remove", ENV{ID_INPUT_KEYBOARD}=="1", GOTO="end" + +LABEL="end" diff --git a/usr/libexec/security-misc/askpass#security-misc-shared b/usr/libexec/security-misc/askpass#security-misc-shared new file mode 100755 index 00000000..64d36fd8 --- /dev/null +++ b/usr/libexec/security-misc/askpass#security-misc-shared @@ -0,0 +1,15 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +title="$0: password required for $(whoami) to perform action as superuser" + +yad --password --title="${title}" diff --git a/usr/libexec/security-misc/block-unsafe-logins#security-misc-shared b/usr/libexec/security-misc/block-unsafe-logins#security-misc-shared new file mode 100755 index 00000000..3000c688 --- /dev/null +++ b/usr/libexec/security-misc/block-unsafe-logins#security-misc-shared @@ -0,0 +1,146 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +source /usr/libexec/helper-scripts/package_installed_check.sh + +if [ -z "${PAM_USER:-}" ]; then + true "$0: ERROR: Environment variable 'PAM_USER' is unset!" + ## 'exit 0' here to let the appropriate PAM module handle this. + exit 0 +fi +if [ -z "${PAM_SERVICE:-}" ]; then + true "$0: ERROR: Environment variable 'PAM_SERVICE' is unset!" + ## 'exit 0' here to let the appropriate PAM module handle this. + exit 0 +fi + +if ! pkg_installed 'user-sysmaint-split' ; then + true "$0: INFO: user-sysmaint-split not installed. Proceeding, ok." + exit 0 +fi + +kernel_cmdline='' +if [ -r /proc/cmdline ]; then + kernel_cmdline="$(cat /proc/cmdline)" +elif [ -r /proc/1/cmdline ]; then + kernel_cmdline="$(cat /proc/1/cmdline)" +fi + +if [[ "$kernel_cmdline" =~ 'boot-role=sysmaint' ]]; then + true "INFO: session type: sysmaint session" + if [ "$PAM_USER" != 'sysmaint' ]; then + printf '%s\n' "ERROR: Rejecting non-sysmaint account '$PAM_USER' in sysmaint session!" + exit 1 + fi + true 'INFO: Running in sysmaint session and authenticating as sysmaint account, allowing authentication to proceed.' + exit 0 +fi + +true "INFO: session type: user session" + +if [ "$PAM_USER" = 'sysmaint' ]; then + printf '%s\n' 'ERROR: Rejecting sysmaint account in user session!' + exit 1 +fi + +## Threat model: +## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#Block_Unsafe_Logins + +login_service_list=( 'login' 'greetd' 'sshd' 'swaylock' ) +for login_service in "${login_service_list[@]}"; do + if [ "$PAM_SERVICE" = "$login_service" ]; then + true "INFO: Login service '$PAM_SERVICE' is considered safe, allowing authentication to proceed." + exit 0 + fi +done + +true "INFO: Login service '$PAM_SERVICE' is potentially unsafe, checking if account is sensitive and passwordless." + +if ! user_list_str="$(/usr/libexec/helper-scripts/get-user-list)"; then + printf '%s\n' 'ERROR: Failed to get user list!' + exit 1 +fi +readarray -t user_list <<< "$user_list_str" +if [ "${#user_list[@]}" = '0' ] || [ -z "${user_list[0]}" ]; then + printf '%s\n' 'ERROR: No user accounts found!' + exit 1 +fi + +## Minor race condition here, quick deletion of users during this process +## could result in user_list and passwd_status_list becoming misaligned. This +## attack would require root privileges to execute though, so this is likely +## not a concern. We do this before checking if $PAM_USER is in the list of +## interactive users to keep the race window as short as possible. +## +## NOTE: PAM modules may run as non-root in some instances (such as when used +## by Swaylock). +if [ "$(id -u)" = '0' ]; then + passwd_status_list_cmd=( + '/usr/libexec/helper-scripts/get-password-status-list' + ) +else + passwd_status_list_cmd=( 'leaprun' 'get-password-status-list' ) +fi +if ! password_status_list_str="$("${passwd_status_list_cmd[@]}")"; then + printf '%s\n' 'ERROR: Failed to get password status list!' + exit 1 +fi +readarray -t passwd_status_list <<< "$password_status_list_str" +if [ "${#passwd_status_list[@]}" = '0' ] \ + || [ -z "${passwd_status_list[0]}" ] \ + || (( ${#passwd_status_list[@]} != ${#user_list[@]} )); then + printf '%s\n' 'ERROR: Unexpected number of password status entries!' + exit 1 +fi + +interactive_user_idx='-1' +for user_idx in "${!user_list[@]}"; do + if [ "${user_list[user_idx]}" = "$PAM_USER" ]; then + interactive_user_idx="$user_idx" + break + fi +done +if [ "$interactive_user_idx" = '-1' ]; then + ## This isn't a user account we care about (it's not an interactive + ## account), therefore allow authentication to proceed. + true "INFO: Account '$PAM_USER' is not an interactive account, allowing authentication to proceed." + exit 0 +fi + +IFS=' ' read -r -a user_gid_list < <(id --groups -- "$PAM_USER") +sensitive_group_list=( 'sudo' 'root' 'sysmaint' ) +is_user_sensitive='false' + +for sensitive_group in "${sensitive_group_list[@]}"; do + sensitive_gid="$(accountctl "$sensitive_group" get-entry group gid)" + for user_gid in "${user_gid_list[@]}"; do + if [ "$sensitive_gid" = "$user_gid" ]; then + is_user_sensitive='true' + break + fi + done + if [ "$is_user_sensitive" = 'true' ]; then + break + fi +done + +if [ "$is_user_sensitive" = 'true' ]; then + if [ "${passwd_status_list[interactive_user_idx]}" = 'Absent' ]; then + ## User account is sensitive and passwordless, deny authentication + printf '%s\n' "ERROR: Rejecting passwordless sensitive account '$PAM_USER'!" + exit 1 + else + true "INFO: Account '$PAM_USER' is sensitive but protected, allowing authentication to proceed." + exit 0 + fi +fi + +true "INFO: Account '$PAM_USER' is not sensitive, allowing authentication to proceed." +exit 0 diff --git a/usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared b/usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared new file mode 100755 index 00000000..c66662cb --- /dev/null +++ b/usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared @@ -0,0 +1,36 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +export LC_ALL=C + +## Compile to a temporary file first, then atomically move into place. +## This prevents leaving a corrupted binary if compilation is interrupted. +tmp_output="$(mktemp -- /usr/bin/emerg-shutdown.XXXXXX)" + +cleanup() { + rm -f -- "${tmp_output}" +} +trap cleanup EXIT + +/usr/libexec/security-misc/compile-emerg-shutdown \ + /usr/src/security-misc/emerg-shutdown.c \ + "${tmp_output}" \ + || { + printf '%s\n' 'Could not compile emerg-shutdown executable!' + exit 1 + } + +chmod 0755 -- "${tmp_output}" +mv -f -- "${tmp_output}" /usr/bin/emerg-shutdown +trap - EXIT diff --git a/usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared b/usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared new file mode 100755 index 00000000..af4c53f8 --- /dev/null +++ b/usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared @@ -0,0 +1,29 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +export LC_ALL=C + +## Compile to a temporary file first, then atomically move into place. +## This prevents leaving a corrupted binary if compilation is interrupted. +tmp_output="$(mktemp -- /usr/bin/fm-shim-backend.XXXXXX)" +trap 'rm -f -- "${tmp_output}"' EXIT + +/usr/libexec/security-misc/compile-fm-shim-backend \ + /usr/src/security-misc/fm-shim-backend.c \ + "${tmp_output}" \ + || { + printf "%s\n" 'Could not compile fm-shim-backend executable!' + rm -f -- "${tmp_output}" + exit 1 + } + +chmod 0755 -- "${tmp_output}" +mv -f -- "${tmp_output}" /usr/bin/fm-shim-backend +trap - EXIT diff --git a/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared new file mode 100755 index 00000000..efb7641d --- /dev/null +++ b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared @@ -0,0 +1,25 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## security-misc-shared Depends on helper-scripts. +# shellcheck source=../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh + +## Package 'pciutils' provides tool 'lspci'. +has lspci + +if lspci | grep -- '^[^ ]* USB controller: ' >/dev/null; then + exit 0 +fi + +exit 1 diff --git a/usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared b/usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared new file mode 100755 index 00000000..1954de3f --- /dev/null +++ b/usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared @@ -0,0 +1,79 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Compile emerg-shutdown.c with the project's standard hardening +## flag set, statically linked. +## +## Usage: +## compile-emerg-shutdown +## +## Used by: +## * usr/libexec/security-misc/build-emerg-shutdown +## * ci/codeql-build.sh (CodeQL static analysis prebuild) + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +export LC_ALL=C + +if [ "$#" -ne 2 ]; then + printf '%s\n' "usage: ${BASH_SOURCE[0]} " >&2 + exit 64 +fi + +source_file="$1" +output_binary="$2" + +gcc_hardening_options=( + "-O2" "-Wall" "-Wextra" "-Wformat" "-Wformat=2" "-Wconversion" + "-Wimplicit-fallthrough" "-Werror=format-security" "-Werror=implicit" + "-Werror=int-conversion" "-Werror=incompatible-pointer-types" + "-Wformat-overflow" "-Wformat-signedness" "-Wformat-truncation" + "-Wnull-dereference" "-Winit-self" + "-Wmissing-include-dirs" "-Wshift-negative-value" "-Wshift-overflow" + "-Wswitch-default" "-Wuninitialized" "-Walloca" "-Warray-bounds" + "-Wfloat-equal" "-Wshadow" "-Wpointer-arith" "-Wundef" "-Wunused-macros" + "-Wbad-function-cast" "-Wcast-qual" "-Wcast-align" "-Wwrite-strings" + "-Wdate-time" "-Wstrict-prototypes" "-Wold-style-definition" + "-Wredundant-decls" "-Winvalid-utf8" "-Wvla" "-Wdisabled-optimization" + "-Wstack-protector" "-Wdeclaration-after-statement" "-Wtrampolines" + "-Wbidi-chars=any,ucn" "-Wformat-overflow=2" "-Wformat-truncation=2" + "-Wshift-overflow=2" "-Wtrivial-auto-var-init" "-Wstringop-overflow=3" + "-Wstrict-flex-arrays" "-Walloc-zero" "-Warray-bounds=2" + "-Wattribute-alias=2" "-Wduplicated-branches" "-Wduplicated-cond" + "-Wcast-align=strict" "-Wjump-misses-init" "-Wlogical-op" "-U_FORTIFY_SOURCE" + "-D_FORTIFY_SOURCE=3" "-fstack-clash-protection" "-fstack-protector-all" + "-fno-delete-null-pointer-checks" "-fno-strict-aliasing" + "-fno-strict-overflow" "-fstrict-flex-arrays=3" + "-ftrivial-auto-var-init=pattern" "-fPIE" +) + +gcc_machine="$(gcc -dumpmachine)" +if [ "${gcc_machine}" = 'x86_64-linux-gnu' ]; then + gcc_hardening_options+=( '-fcf-protection=full' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +elif [ "${gcc_machine}" = 'aarch64-linux-gnu' ]; then + gcc_hardening_options+=( '-mbranch-protection=standard' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +fi + +gcc_hardening_options+=( + "-Wl,-z,nodlopen" "-Wl,-z,noexecstack" "-Wl,-z,relro" "-Wl,-z,now" + "-Wl,-z,separate-code" "-Wl,--as-needed" "-Wl,--no-copy-dt-needed-entries" + "-pie" +) + +gcc \ + -g \ + "${source_file}" \ + -o "${output_binary}" \ + -static \ + "${gcc_hardening_options[@]}" diff --git a/usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared b/usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared new file mode 100755 index 00000000..ffebdbb1 --- /dev/null +++ b/usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared @@ -0,0 +1,91 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Compile fm-shim-backend.c with the project's standard hardening +## flag set. Pure compile - the helper does not chmod, mv, or +## otherwise install the produced binary; the caller decides. +## +## Usage: +## compile-fm-shim-backend +## +## Used by: +## * usr/libexec/security-misc/build-fm-shim-backend (postinst-time +## compile-and-install on the user's machine) +## * ci/codeql-build.sh (CodeQL static +## analysis prebuild) +## +## Holding the gcc command in one place keeps the runtime build path +## and the CI analysis path from drifting on hardening flags. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +export LC_ALL=C + +if [ "$#" -ne 2 ]; then + printf '%s\n' "usage: ${BASH_SOURCE[0]} " >&2 + exit 64 +fi + +source_file="$1" +output_binary="$2" + +gcc_hardening_options=( + "-O2" "-Wall" "-Wextra" "-Wformat" "-Wformat=2" "-Wconversion" + "-Wimplicit-fallthrough" "-Werror=format-security" "-Werror=implicit" + "-Werror=int-conversion" "-Werror=incompatible-pointer-types" + "-Wformat-overflow" "-Wformat-signedness" "-Wformat-truncation" + "-Wnull-dereference" "-Winit-self" + "-Wmissing-include-dirs" "-Wshift-negative-value" "-Wshift-overflow" + "-Wswitch-default" "-Wuninitialized" "-Walloca" "-Warray-bounds" + "-Wfloat-equal" "-Wshadow" "-Wpointer-arith" "-Wundef" "-Wunused-macros" + "-Wbad-function-cast" "-Wcast-qual" "-Wcast-align" "-Wwrite-strings" + "-Wdate-time" "-Wstrict-prototypes" "-Wold-style-definition" + "-Wredundant-decls" "-Winvalid-utf8" "-Wvla" "-Wdisabled-optimization" + "-Wstack-protector" "-Wdeclaration-after-statement" "-Wtrampolines" + "-Wbidi-chars=any,ucn" "-Wformat-overflow=2" "-Wformat-truncation=2" + "-Wshift-overflow=2" "-Wtrivial-auto-var-init" "-Wstringop-overflow=3" + "-Wstrict-flex-arrays" "-Walloc-zero" "-Warray-bounds=2" + "-Wattribute-alias=2" "-Wduplicated-branches" "-Wduplicated-cond" + "-Wcast-align=strict" "-Wjump-misses-init" "-Wlogical-op" "-U_FORTIFY_SOURCE" + "-D_FORTIFY_SOURCE=3" "-fstack-clash-protection" "-fstack-protector-all" + "-fno-delete-null-pointer-checks" "-fno-strict-aliasing" + "-fno-strict-overflow" "-fstrict-flex-arrays=3" + "-ftrivial-auto-var-init=pattern" "-fPIE" +) + +gcc_machine="$(gcc -dumpmachine)" +if [ "${gcc_machine}" = 'x86_64-linux-gnu' ]; then + gcc_hardening_options+=( '-fcf-protection=full' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +elif [ "${gcc_machine}" = 'aarch64-linux-gnu' ]; then + gcc_hardening_options+=( '-mbranch-protection=standard' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +fi + +gcc_hardening_options+=( + "-Wl,-z,nodlopen" "-Wl,-z,noexecstack" "-Wl,-z,relro" "-Wl,-z,now" + "-Wl,-z,separate-code" "-Wl,--as-needed" "-Wl,--no-copy-dt-needed-entries" + "-pie" +) + +## NOTE: pkg-config subshells intentionally are not quoted; pkg-config +## output is designed to be word-split by shells safely and would be +## broken by quoting. (See AGENTS.md "pkg-config quoting in build +## script".) +# shellcheck disable=SC2046 +gcc \ + -g \ + $(pkg-config --cflags dbus-1) \ + $(pkg-config --cflags libsystemd) \ + "${source_file}" \ + -o "${output_binary}" \ + $(pkg-config --libs dbus-1) \ + $(pkg-config --libs libsystemd) \ + "${gcc_hardening_options[@]}" diff --git a/usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared b/usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared new file mode 100755 index 00000000..ae0ccd34 --- /dev/null +++ b/usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared @@ -0,0 +1,16 @@ +#!/bin/bash + +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +sysctl -w kernel.modules_disabled=1 + +true "The loading of new modules to the kernel has been disabled by package security-misc-shared." diff --git a/usr/libexec/security-misc/echo-path#security-misc-shared b/usr/libexec/security-misc/echo-path#security-misc-shared new file mode 100755 index 00000000..f5d0d00f --- /dev/null +++ b/usr/libexec/security-misc/echo-path#security-misc-shared @@ -0,0 +1,13 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "${PATH}" diff --git a/usr/libexec/security-misc/emerg-shutdown#security-misc-shared b/usr/libexec/security-misc/emerg-shutdown#security-misc-shared new file mode 100755 index 00000000..10ac93b5 --- /dev/null +++ b/usr/libexec/security-misc/emerg-shutdown#security-misc-shared @@ -0,0 +1,67 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## Make sure globs sort in a predictable, reproducible fashion +export LC_ALL=C + +in_dracut='false' +if [ -f '/dracut-state.sh' ]; then + in_dracut='true' +fi +binary_prefix='/run' +EMERG_SHUTDOWN_KEYS='' +root_devices[0]='' + +## Read emergency shutdown key configuration +for config_file in /etc/security-misc/emerg-shutdown/*.conf /usr/local/etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + bash -n "${config_file}" + source "${config_file}" + fi +done + +if [ "${in_dracut}" = 'true' ]; then + binary_prefix='' + modprobe evdev || { + printf '%s\n' 'Failed to load evdev driver!' + exit 1 + } + ## modules may not work immediately after loaded, give them time to + ## initialize + sleep 0.1 +else + ## Find the devices that make up the root device + readarray -t root_devices < <(/usr/libexec/helper-scripts/get-backing-devices-for-mountpoint '/') || true; + + if [ ! -f '/run/emerg-shutdown' ]; then + if [ -f '/usr/bin/emerg-shutdown' ]; then + cp -- /usr/bin/emerg-shutdown /run/emerg-shutdown + else + /usr/libexec/security-misc/compile-emerg-shutdown \ + /usr/src/security-misc/emerg-shutdown.c \ + /run/emerg-shutdown \ + || { + printf '%s\n' 'Could not compile emerg-shutdown executable!' + exit 1 + } + fi + fi + + ## memlockd daemonizes itself, so no need to background it. + memlockd -c /usr/share/security-misc/security-misc-memlockd.cfg || true +fi + +systemd-notify --ready + +## Launch emerg-shutdown +IFS=',' +"${binary_prefix}/emerg-shutdown" "--devices=${root_devices[*]}" "--keys=${EMERG_SHUTDOWN_KEYS}" diff --git a/usr/libexec/security-misc/ensure-shutdown#security-misc-shared b/usr/libexec/security-misc/ensure-shutdown#security-misc-shared new file mode 100755 index 00000000..9a1cf1cf --- /dev/null +++ b/usr/libexec/security-misc/ensure-shutdown#security-misc-shared @@ -0,0 +1,31 @@ +#!/bin/bash + +# Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +# See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +source /usr/libexec/helper-scripts/strings.bsh + +## Make sure globs sort in a predictable, reproducible fashion +export LC_ALL=C + +## Read emergency shutdown key configuration +for config_file in /etc/security-misc/emerg-shutdown/*.conf /usr/local/etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + bash -n "${config_file}" + source "${config_file}" + fi +done +if [ -z "${ENSURE_SHUTDOWN_TIMEOUT:-}" ] \ + || ! is_whole_number "${ENSURE_SHUTDOWN_TIMEOUT}"; then + ENSURE_SHUTDOWN_TIMEOUT=30; +fi + +/run/emerg-shutdown --monitor-fifo "--timeout=${ENSURE_SHUTDOWN_TIMEOUT}" & +sleep 1 +disown +exit 0 diff --git a/usr/libexec/security-misc/hide-hardware-info#security-misc-shared b/usr/libexec/security-misc/hide-hardware-info#security-misc-shared new file mode 100755 index 00000000..081e06e9 --- /dev/null +++ b/usr/libexec/security-misc/hide-hardware-info#security-misc-shared @@ -0,0 +1,138 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail +shopt -s nullglob + +run_cmd() { + printf '%s\n' "INFO: normal executing : $@" + "$@" +} + +run_cmd_whitelist() { + printf '%s\n' "INFO: whitelist executing: $@" + "$@" +} + +printf '%s\n' "$0: INFO: START" + +default_variables_set() { + sysfs_whitelist=1 + cpuinfo_whitelist=1 + sysfs=1 + ## https://www.kicksecure.com/wiki/Security-misc#selinux + selinux=0 +} + +parse_configuration() { + ## Allows for disabling the whitelist. + local i + for i in /usr/local/etc/hide-hardware-info.d/*.conf /etc/hide-hardware-info.d/*.conf ; do + bash -n -- "${i}" + source "${i}" + done +} + +create_whitelist() { + if [ "${1}" = "sysfs" ]; then + whitelist_path="/sys" + elif [ "${1}" = "cpuinfo" ]; then + whitelist_path="/proc/cpuinfo" + else + printf '%s\n' "ERROR: ${1} is not a correct parameter." + exit 1 + fi + + if getent group -- "${1}" >/dev/null; then + ## Changing the permissions of /sys recursively + ## causes errors as the permissions of /sys/kernel/debug + ## and /sys/fs/cgroup cannot be changed. + run_cmd_whitelist chgrp --quiet --recursive -- "${1}" "${whitelist_path}" || true + + run_cmd_whitelist chmod -- o-rwx "${whitelist_path}" + else + printf '%s\n' "ERROR: The ${1} group does not exist, the ${1} whitelist was not created." + fi +} + +default_variables_set +parse_configuration + +## sysfs and debugfs expose a lot of information +## that should not be accessible by an unprivileged +## user which includes hardware info, debug info and +## more. This restricts /sys, /proc/cpuinfo, /proc/bus +## and /proc/scsi to the root user only. This hides +## many hardware identifiers from ordinary users +## and increases security. +for i in /proc/cpuinfo /proc/bus /proc/scsi /sys ; do + if [ -e "${i}" ]; then + if [ "${i}" = "/sys" ]; then + if [ "${sysfs}" = "1" ]; then + ## Whitelist for /sys. + if [ "${sysfs_whitelist}" = "1" ]; then + create_whitelist sysfs + else + printf '%s\n' "INFO: The sysfs whitelist is not enabled. Some things may not work properly. Full sysfs hardening..." + run_cmd chmod -- og-rwx /sys + fi + fi + elif [ "${i}" = "/proc/cpuinfo" ]; then + if [ "${cpuinfo_whitelist}" = "1" ]; then + create_whitelist cpuinfo + else + printf '%s\n' "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly. Full cpuinfo hardening..." + run_cmd chmod -- og-rwx /proc/cpuinfo + fi + else + run_cmd chmod -- og-rwx "${i}" + fi + else + ## /proc/scsi doesn't exist on Debian so errors + ## are expected here. + if ! [ "${i}" = "/proc/scsi" ]; then + printf '%s\n' "ERROR: ${i} could not be found." + fi + fi +done + + +if [ "${sysfs}" = "1" ]; then + ## restrict permissions on everything but + ## what is needed + for i in /sys/* /sys/fs/* ; do + ## Using '|| true': + ## https://github.com/Kicksecure/security-misc/pull/108 + if [ "${sysfs_whitelist}" = "1" ]; then + run_cmd chmod -- o-rwx "${i}" || true + else + run_cmd chmod -- og-rwx "${i}" || true + fi + done + + ## polkit needs stat access to /sys/fs/cgroup + ## to function properly + run_cmd chmod -- o+rx /sys /sys/fs + + ## on SELinux systems, at least /sys/fs/selinux + ## must be visible to unprivileged users, else + ## SELinux userspace utilities will not function + ## properly + if [ -d /sys/fs/selinux ]; then + printf '%s\n' "INFO: SELinux detected because folder /sys/fs/selinux exists. See also:" + printf '%s\n' "https://www.kicksecure.com/wiki/Security-misc#selinux" + if [ "${selinux}" = "1" ]; then + run_cmd chmod -- o+rx /sys /sys/fs /sys/fs/selinux + printf '%s\n' "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function." + else + printf '%s\n' "INFO: SELinux detected, but SELinux mode is not enabled. Some userspace utilities may not work properly." + fi + fi +fi + +printf '%s\n' "$0: INFO: END" diff --git a/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared b/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared new file mode 100755 index 00000000..677dc90b --- /dev/null +++ b/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared @@ -0,0 +1,29 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +vboxdrmclient_sock='/tmp/.iprt-localipc-DRMIpcServer' + +if ! [ -S "$vboxdrmclient_sock" ]; then + printf '%s\n' "INFO: Socket file '$vboxdrmclient_sock' does not exist or is not a socket, ok." + exit 0 +fi + +sock_pid="$(/usr/libexec/helper-scripts/query-sock-pid "$vboxdrmclient_sock")" || true +if [ -z "$sock_pid" ]; then + printf '%s\n' "INFO: Cannot get PID listening on '$vboxdrmclient_sock', ok." + exit 0 +fi +if kill -SIGKILL -- "$sock_pid"; then + printf '%s\n' "INFO: Killed VBoxDRMClient ('$sock_pid'), ok." + exit 0 +fi + +printf '%s\n' "ERROR: Could not kill VBoxDRMClient ('$sock_pid')!" +exit 1 diff --git a/usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared b/usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared new file mode 100755 index 00000000..c7ec5782 --- /dev/null +++ b/usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared @@ -0,0 +1,90 @@ +#!/usr/bin/env bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This script enforces the maximum ASLR hardening settings for mmap, given the +## installed Linux config. +## See also: +## https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514 + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +shopt -s failglob + +more_info_link="https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514" +aslr_mmap_config_file="/etc/sysctl.d/30_security-misc_aslr-mmap.conf" + +exit_with_error() { + printf '%s\n' "$0: SEE ALSO:" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "${more_info_link}" >&2 + exit 1 +} + +if ! test -d /etc/sysctl.d ; then + printf '%s\n' "$0: ERROR: Folder /etc/sysctl.d does not exist!" >&2 + exit_with_error +fi + +if ! test -w /etc/sysctl.d ; then + printf '%s\n' "$0: ERROR: Folder /etc/sysctl.d not writeable! This script is supposed to be run as root." >&2 + exit_with_error +fi + +## Defaults in case Linux config detection fails. These are likely to work fine +## on x86_64, probably not elsewhere. +BITS_MAX_DEFAULT=32 +COMPAT_BITS_MAX_DEFAULT=16 + +## Find the most recently modified Linux config file. +## Kernel config filenames are /boot/config-: no spaces or newlines, +## so the ls-parsing hazard SC2012 warns about is not reachable here, and a +## find-based newest-file rewrite would be a behaviour risk for no gain. +# shellcheck disable=SC2012 +if compgen -G "/boot/config-*" > /dev/null && CONFIG=$(ls -1 -t /boot/config-* | head -n1) ; then + ## Find the relevant config options. + if ! BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) ; then + printf '%s\n' "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_BITS_MAX! Using built-in default." >&2 + BITS_MAX="${BITS_MAX_DEFAULT}" + fi + if ! COMPAT_BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) ; then + printf '%s\n' "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX! Using built-in default." >&2 + COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}" + fi +else + ## Could be a chroot. + printf '%s\n' "$0: INFO: No Linux config file detected in folder /boot/ (starting with 'config-'). Therefore using built-in defaults." >&2 + BITS_MAX="${BITS_MAX_DEFAULT}" + COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}" +fi + +## Generate a sysctl.d conf file. +SYSCTL="\ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file is automatically generated by: +## $0 +## Do not edit! +## See also: +## ${more_info_link} + +## Improves ASLR effectiveness for mmap. +vm.mmap_rnd_bits=${BITS_MAX} +vm.mmap_rnd_compat_bits=${COMPAT_BITS_MAX}" + +## Write the sysctl.d conf file. +if printf '%s\n' "${SYSCTL}" | tee "${aslr_mmap_config_file}" > /dev/null ; then + printf '%s\n' "$0: INFO: Successfully written ASLR map config file: +${aslr_mmap_config_file}" + exit 0 +fi + +printf '%s\n' "$0: ERROR: Error writing ASLR map config file: +${aslr_mmap_config_file}" >&2 +exit_with_error diff --git a/usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared b/usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared new file mode 100755 index 00000000..5452a1af --- /dev/null +++ b/usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared @@ -0,0 +1,62 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This is only a usability feature to avoid needlessly bumping pam_faillock +## counter. This is not a security feature. +## https://forums.whonix.org/t/restrict-root-access/7658/1 + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +PAM_USER="${PAM_USER:-}" + +passwd_bin="$(type -P -- "passwd")" + +if ! test -x "${passwd_bin}" ; then + printf '%s\n' "\ +$0: ERROR: passwd_bin \"${passwd_bin}\" is not executable. +See https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#passwd" >&2 + ## Identifiable exit codes in case stdout / stderr is not logged in journal. + exit 2 +fi + +if ! passwd_output="$("${passwd_bin}" -S -- "${PAM_USER}" 2>/dev/null)" ; then + printf '%s\n' "$0: ERROR: user \"${PAM_USER}\" does not exist." >&2 + exit 3 +fi + +password_status_field="$(printf '%s\n' "${passwd_output}" | cut -d ' ' -f 2)" + +if [ "${password_status_field}" = "P" ]; then + true "$0: INFO: user \"${PAM_USER}\" has a usable password." +elif [ "${password_status_field}" = "NP" ]; then + true "$0: INFO: user \"${PAM_USER}\" has no password." +elif [ "${password_status_field}" = "L" ]; then + printf '%s\n' "$0: INFO: Password for user \"${PAM_USER}\" is locked." + + if [ -f /usr/share/whonix/marker ] || [ -f /usr/share/kicksecure/marker ]; then + if [ "${PAM_USER}" = "root" ]; then + printf '%s\n' "$0: ERROR: root account is locked by default. See:" >&2 + printf '%s\n' "https://www.kicksecure.com/wiki/root" >&2 + printf '%s\n' "" >&2 + exit 4 + fi + fi + + ## Should not unconditionally 'exit 1' here. + ## Locked user accounts might have valid sudoers exceptions. + ## https://forums.whonix.org/t/pam-abort-on-locked-password-and-running-privileged-command-from-web-browser/10521 + ## 'exit 1' would be good for usability here because then the user would get + ## faster feedback. A new login attempt would not be needlessly delayed. + exit 0 +else + printf '%s\n' "$0: INFO: Password status field for user \"${PAM_USER}\" could not be parsed. Please report this bug." +fi + +exit 0 diff --git a/usr/libexec/security-misc/pam-info#security-misc-shared b/usr/libexec/security-misc/pam-info#security-misc-shared new file mode 100755 index 00000000..70e0d98d --- /dev/null +++ b/usr/libexec/security-misc/pam-info#security-misc-shared @@ -0,0 +1,299 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## To enable debug log, run: +## sudo touch /etc/pam-info-debug +## +## Debug log if enabled can be found in file: +## /root/pam-info-debug.txt + +true "$0: START PHASE 1" + +if test -f /etc/pam-info-debug || test -f /usr/local/etc/pam-info-debug ; then + set -x + exec 5>&1 1>> ~/pam-info-debug.txt + exec 6>&2 2>> ~/pam-info-debug.txt +fi + +true "$0: START PHASE 2" + +set -o errexit +set -o errtrace +set -o pipefail +set -o nounset + +error_handler() { + exit_code="$?" + printf '%s\n' "\ +$0: ERROR: Unexpected error. +BASH_COMMAND: '$BASH_COMMAND' +exit_code: '$exit_code' +ERROR: Please report this bug." >&2 + exit 1 +} + +trap error_handler ERR + +if ! printf '%s\n' "" | wc -l >/dev/null ; then + printf '%s\n' "\ +$0: ERROR: command 'wc' test failed! Do not ignore this! + +'wc' can core dump. Example: +zsh: illegal hardware instruction (core dumped) wc -l +https://github.com/rspamd/rspamd/issues/5137" >&2 + exit 1 +fi + +command -v str_replace &>/dev/null + +## Named constants. +pam_faillock_state_dir="/var/lib/security-misc/faillock" + +[[ -v PAM_USER ]] || PAM_USER="" +[[ -v SUDO_USER ]] || SUDO_USER="" + +## Debugging. +who_ami="$(whoami)" +true "$0: who_ami: $who_ami" +true "$0: PAM_USER: $PAM_USER" +true "$0: SUDO_USER: $SUDO_USER" + +if [ "$PAM_USER" = "" ]; then + true "$0: ERROR: Environment variable PAM_USER is unset!" + exit 0 +fi + +## PAM_USER is set by the PAM stack and is generally trusted. +## Sanity check: reject control characters and values starting with '-' +## to prevent option injection into commands like faillock. +if [[ "$PAM_USER" =~ [[:cntrl:]] ]] || [[ "$PAM_USER" == -* ]]; then + true "$0: ERROR: PAM_USER contains suspicious characters: '$(printf '%q' "$PAM_USER")'" + exit 0 +fi + +grep_result="$(grep -- "accessfile=/etc/security/access-security-misc.conf" /etc/pam.d/common-account 2>/dev/null)" || true + +## Check if grep matched something. +if [ ! "$grep_result" = "" ]; then + ## Yes, grep matched. + + ## Check if not out commented. + if ! printf '%s\n' "$grep_result" | grep --quiet -- "#" ; then + ## Not out commented indeed. + + ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592 + + console_allowed="" + if id --name --groups --zero -- "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings -- "console"; then + console_allowed=true + fi + if id --name --groups --zero -- "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings -- "console-unrestricted"; then + console_allowed=true + fi + + if [ ! "$console_allowed" = "true" ]; then + printf '%s\n' "\ +$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console' +To unlock, run the following command as superuser: +(If you still have a sudo/root shell somewhere.) + +adduser $PAM_USER console + +However, possibly unlock procedure is required. +First boot into recovery mode at grub boot menu and then run above command. +See also: +https://www.kicksecure.com/wiki/root#console +" >&2 + exit 0 + fi + fi +fi + +if [ "$PAM_USER" = 'sysmaint' ]; then + sysmaint_passwd_info="$(passwd --status sysmaint 2>/dev/null)" || true + sysmaint_lock_info="$(cut -d' ' -f2 <<< "${sysmaint_passwd_info}")" + if [ "${sysmaint_lock_info}" = 'L' ]; then + printf '%s\n' "$0: ERROR: Reboot and choose 'PERSISTENT Mode - SYSMAINT Session' for system maintenance. See https://www.kicksecure.com/wiki/Sysmaint" >&2 + fi +fi + +kernel_cmdline='' +if [ -f /proc/cmdline ]; then + kernel_cmdline="$(cat -- /proc/cmdline)" || true +elif [ -f /proc/1/cmdline ]; then + kernel_cmdline="$(cat -- /proc/1/cmdline)" || true +fi + +if [ "$PAM_USER" != 'sysmaint' ]; then + if [[ "${kernel_cmdline}" =~ 'boot-role=sysmaint' ]]; then + printf '%s\n' "$0: WARNING: Use account 'sysmaint' for system maintenance. See https://www.kicksecure.com/wiki/Sysmaint" >&2 + fi +fi + +## https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698 + +## Does not work (yet) for login, pam_securetty runs before and aborts. +## Also this should only run for login since securetty covers only login. +# if [ "$PAM_USER" = "root" ]; then +# if [ -f /etc/securetty ]; then +# grep_result="$(grep -- "^[^#]" /etc/securetty)" +# if [ "$grep_result" = "" ]; then +# printf '%s\n' "\ +# $0: ERROR: Root login is disabled. +# ERROR: This is because file '/etc/securetty' is empty. +# See also: +# https://www.kicksecure.com/wiki/root#login +# " >&2 +# exit 0 +# fi +# fi +# fi + +## under account "user" +## /usr/sbin/faillock -u user +## faillock: Error opening /var/log/tallylog for update: Permission denied +## /usr/sbin/faillock: Authentication error +## +## xscreensaver runs under account "user", therefore pam_faillock cannot function. +## xscreensaver has its own failed login counter. +## +## https://askubuntu.com/questions/983183/how-lock-the-unlock-screen-after-wrong-password-attempts +## +## https://web.archive.org/web/20200919221439/https://www.whonix.org/pipermail/whonix-devel/2019-September/001439.html +## +## Checking exit code to avoid breaking when read-only disk boot but +## without ro-mode-init or grub-live being used. +## +## end-of-options ("--") unsupported by faillock. +if ! pam_faillock_output="$(faillock --dir "$pam_faillock_state_dir" --user "$PAM_USER")" ; then + true "$0: faillock non-zero exit code." + exit 0 +fi + +if [ "$pam_faillock_output" = "" ]; then + true "$0: no failed login" + exit 0 +fi + +## example pam_faillock_output (stdout): +## user: +## When Type Source Valid +## 2021-08-10 16:26:33 RHOST V +## 2021-08-10 16:26:54 RHOST V + +## example pam_faillock_output (stderr): +## faillock: No user name supplied. +## Usage: faillock [--dir /path/to/tally-directory] [--user username] [--reset] + +## Get first line. +#pam_faillock_output_first_line="$(printf '%s\n' "$pam_faillock_output" | head --lines=1)" +while read -t 10 -r pam_faillock_output_first_line ; do + break +done <<< "$pam_faillock_output" + +true "pam_faillock_output_first_line: '$pam_faillock_output_first_line'" +## example pam_faillock_output_first_line: +## user: + +user_name="$(printf '%s\n' "$pam_faillock_output_first_line" | str_replace ":" "")" +## example user_name: +## user +## root + +if [ "$PAM_USER" != "$user_name" ]; then + printf '%s\n' "\ +$0: ERROR: Variable 'PAM_USER' '$PAM_USER' does not match variable 'user_name' '$user_name'. +ERROR: Please report this bug. +" >&2 + exit 1 +fi + +pam_faillock_output_count="$(printf '%s\n' "$pam_faillock_output" | wc -l)" +## example pam_faillock_output_count: +## 2 +## example pam_faillock_output_count: +## 4 + +if [[ "$pam_faillock_output_count" == *[!0-9]* ]]; then + printf '%s\n' "\ +$0: ERROR: Variable 'pam_faillock_output_count' is not numeric. pam_faillock_output_count: '$pam_faillock_output_count' +ERROR: Please report this bug. +" >&2 + exit 0 +fi + +## Do not count the first two informational textual output lines (starting with "user:" and "When") if present, +failed_login_counter=$(( pam_faillock_output_count - 2 )) + +## example failed_login_counter: +## 2 + +## Ensuring failed_login_counter is not set to a negative value. +## https://github.com/Kicksecure/security-misc/pull/305 +if [ "$failed_login_counter" -lt "0" ]; then + true "$0: WARNING: Failed login counter is negative. Resetting to 0." + failed_login_counter=0 +fi + +if [ "$failed_login_counter" = "0" ]; then + true "$0: INFO: Failed login counter is 0, ok." + exit 0 +fi + +## pam_faillock default if it cannot be determined below. +deny=3 + +if test -f /etc/security/faillock.conf ; then + deny_line=$(grep --invert-match "#" -- /etc/security/faillock.conf | grep -- "deny =") || true + deny="$(printf '%s\n' "$deny_line" | str_replace "=" "" | str_replace "deny" "" | str_replace " " "")" + ## Restore the default if no uncommented 'deny =' line was found; an empty + ## value would slip past the numeric guard below and incorrectly report a + ## lockout. + [ -n "$deny" ] || deny=3 + ## Example: + #deny=50 +fi + +if [[ "$deny" == *[!0-9]* ]]; then + printf '%s\n' "\ +$0: ERROR: Variable 'deny' is not numeric. deny: '$deny' +ERROR: Please report this bug. +" >&2 + exit 0 +fi + +remaining_attempts="$(( deny - failed_login_counter ))" + +if [ "$remaining_attempts" -le "0" ]; then + printf '%s\n' "\ +$0: ERROR: Login blocked after $failed_login_counter attempts. +To unlock, run the following command as superuser: +(If you still have a sudo/root shell somewhere.) + +faillock --dir $pam_faillock_state_dir --reset --user $PAM_USER + +However, most likely unlock procedure is required. +First boot into recovery mode at grub boot menu and then run above command. +See also: +https://www.kicksecure.com/wiki/root#unlock +" >&2 + exit 0 +fi + +printf '%s\n' "\ +$0: WARNING: $failed_login_counter failed login attempts for account '$user_name'. +Login will be blocked after $deny attempts. +You have $remaining_attempts more attempts before unlock procedure is required. +" >&2 + +if [ "$PAM_SERVICE" = "su" ]; then + printf '%s\n' "\ +$0: NOTE: Type the password. When entering the password, no password feedback (no asterisk (\"*\") symbol) will be shown. +" >&2 +fi + +true "$0: END" + +exit 0 diff --git a/usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared b/usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared new file mode 100755 index 00000000..4cb725a8 --- /dev/null +++ b/usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared @@ -0,0 +1,44 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +PAM_SERVICE="${PAM_SERVICE:-}" + +true "PAM_SERVICE: ${PAM_SERVICE}" + +## PAM configuration notes +## +## success=$num +## "will specify how many rules to skip when successful." +## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files +## +## ignore +## "when used with a stack of modules, the module's return status will not contribute to the return code the application obtains." +## http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html + +## - Failed dovecot ssh logins from malicious remotes should not result in account getting locked. +## This list can later be extended as needed. +pam_service_exclusion_list="dovecot sshd" + +for pam_service_exclusion_item in ${pam_service_exclusion_list} ; do + if [ "${PAM_SERVICE}" = "${pam_service_exclusion_item}" ]; then + ## exit success so [success=1 default=ignore] will result in skipping the + ## next PAM module (the pam_faillock module). + exit 0 + fi +done + +## exit failure so [success=1 default=ignore] will result in running the +## next PAM module (the pam_faillock module). +exit 1 diff --git a/usr/lib/security-misc/pam_only_if_login b/usr/libexec/security-misc/pam_only_if_login#security-misc-shared similarity index 50% rename from usr/lib/security-misc/pam_only_if_login rename to usr/libexec/security-misc/pam_only_if_login#security-misc-shared index 51b6d805..a462e19a 100755 --- a/usr/lib/security-misc/pam_only_if_login +++ b/usr/libexec/security-misc/pam_only_if_login#security-misc-shared @@ -1,18 +1,21 @@ #!/bin/bash -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose -true "PAM_SERVICE: $PAM_SERVICE" +true "PAM_SERVICE: ${PAM_SERVICE:-}" -if [ "$PAM_SERVICE" = "login" ]; then - ## FIXME: - ## Creates unwanted journal log entry. - ## pam_exec(login:account): /usr/lib/security-misc/pam_only_if_login failed: exit code 1 +if [ "${PAM_SERVICE:-}" = "login" ]; then exit 1 else ## exit success so [success=1 default=ignore] will result in skipping the diff --git a/usr/libexec/security-misc/pam_only_if_su#security-misc-shared b/usr/libexec/security-misc/pam_only_if_su#security-misc-shared new file mode 100755 index 00000000..eeef759e --- /dev/null +++ b/usr/libexec/security-misc/pam_only_if_su#security-misc-shared @@ -0,0 +1,23 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Similar to: +## /usr/libexec/security-misc/pam_only_if_login + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +true "PAM_SERVICE: ${PAM_SERVICE:-}" + +if [ "${PAM_SERVICE:-}" = "su" ]; then + exit 1 +else + exit 0 +fi diff --git a/usr/libexec/security-misc/panic-on-oops#security-misc-shared b/usr/libexec/security-misc/panic-on-oops#security-misc-shared new file mode 100755 index 00000000..a89bbd0d --- /dev/null +++ b/usr/libexec/security-misc/panic-on-oops#security-misc-shared @@ -0,0 +1,39 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + ## pre.bsh would `source` the following folders: + ## /etc/panic-on-oops_pre.d/*.conf + ## /usr/local/etc/panic-on-oops_pre.d/*.conf + source /usr/libexec/helper-scripts/pre.bsh +fi + +action="${1:-}" + +if [ "${action}" = 'enable' ]; then + ## Makes the kernel immediately panic on both oopses and warnings. + ## These settings force a full system crash rather than continuing + ## to run after an inconsistent state is triggered by a potentially + ## flawed processes. The reasons for the errors could be kernel + ## exploit attempts but may also simply be general software bugs. + ## + ## https://docs.kernel.org/admin-guide/sysctl/kernel.html#oops-limit + sysctl kernel.oops_limit=1 + ## https://docs.kernel.org/admin-guide/sysctl/kernel.html#warn-limit + sysctl kernel.warn_limit=1 +elif [ "${action}" = 'disable' ]; then + sysctl kernel.oops_limit=0 + sysctl kernel.warn_limit=0 +else + printf '%s\n' "ERROR: Unrecognized action '${action}'!" + exit 1 +fi diff --git a/usr/libexec/security-misc/permission-lockdown#security-misc-shared b/usr/libexec/security-misc/permission-lockdown#security-misc-shared new file mode 100755 index 00000000..5b226475 --- /dev/null +++ b/usr/libexec/security-misc/permission-lockdown#security-misc-shared @@ -0,0 +1,69 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Doing this for all users would create many issues. +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +# /usr/libexec/security-misc/permission-lockdown: user: root | chmod o-rwx "/root" +# /usr/libexec/security-misc/permission-lockdown: user: daemon | chmod o-rwx "/usr/sbin" +# /usr/libexec/security-misc/permission-lockdown: user: bin | chmod o-rwx "/bin" +# /usr/libexec/security-misc/permission-lockdown: user: sys | chmod o-rwx "/dev" +# /usr/libexec/security-misc/permission-lockdown: user: sync | chmod o-rwx "/bin" +# /usr/libexec/security-misc/permission-lockdown: user: games | chmod o-rwx "/usr/games" +# /usr/libexec/security-misc/permission-lockdown: user: man | chmod o-rwx "/var/cache/man" +# /usr/libexec/security-misc/permission-lockdown: user: mail | chmod o-rwx "/var/mail" +# /usr/libexec/security-misc/permission-lockdown: user: proxy | chmod o-rwx "/bin" +# /usr/libexec/security-misc/permission-lockdown: user: backup | chmod o-rwx "/var/backups" +# /usr/libexec/security-misc/permission-lockdown: user: systemd-timesync | chmod o-rwx "/run/systemd" +# /usr/libexec/security-misc/permission-lockdown: user: systemd-network | chmod o-rwx "/run/systemd/netif" +# /usr/libexec/security-misc/permission-lockdown: user: messagebus | chmod o-rwx "/var/run/dbus" +# /usr/libexec/security-misc/permission-lockdown: user: tinyproxy | chmod o-rwx "/run/tinyproxy" +# /usr/libexec/security-misc/permission-lockdown: user: rtkit | chmod o-rwx "/proc" +# /usr/libexec/security-misc/permission-lockdown: user: colord | chmod o-rwx "/var/lib/colord" +# /usr/libexec/security-misc/permission-lockdown: user: Debian-exim | chmod o-rwx "/var/spool/exim4" +# /usr/libexec/security-misc/permission-lockdown: user: debian-tor | chmod o-rwx "/var/lib/tor" +# /usr/libexec/security-misc/permission-lockdown: user: stunnel4 | chmod o-rwx "/var/run/stunnel4" +# /usr/libexec/security-misc/permission-lockdown: user: iodine | chmod o-rwx "/var/run/iodine" +# /usr/libexec/security-misc/permission-lockdown: user: apt-cacher-ng | chmod o-rwx "/var/cache/apt-cacher-ng" +# /usr/libexec/security-misc/permission-lockdown: user: approx | chmod o-rwx "/var/cache/approx" +# /usr/libexec/security-misc/permission-lockdown: user: statd | chmod o-rwx "/var/lib/nfs" +# /usr/libexec/security-misc/permission-lockdown: user: timidity | chmod o-rwx "/etc/timidity" +# /usr/libexec/security-misc/permission-lockdown: user: uuidd | chmod o-rwx "/run/uuidd" +# /usr/libexec/security-misc/permission-lockdown: user: _rpc | chmod o-rwx "/run/rpcbind" +# /usr/libexec/security-misc/permission-lockdown: user: geoclue | chmod o-rwx "/var/lib/geoclue" + +home_folder_access_rights_lockdown() { + mkdir --parents /var/cache/security-misc/state-files + local user + for user in $(dir /home); do ## lists directories only + if [ -f "/var/cache/security-misc/state-files/${user}" ]; then + continue + fi + folder_name="/home/${user}" + ## chmod: + ## The 'g' for 'group' is not needed. + ## Debian by default uses USERGROUPS=yes in /etc/adduser.conf. + ## The group which the user is being added to has the same name as the user. + ## If the username is user then the name of the group is also user. + ## Some background information here: + ## https://unix.stackexchange.com/questions/156473/reasons-behind-the-default-groups-and-users-on-linux + ## In short, this is useful for "file sharing". A if user1 wants to share data with user2 the command + ## required to run is sudo addgroup user1 user2. + ## See also: user private groups UPGs + ## https://wiki.debian.org/UserPrivateGroups + printf '%s\n' "$0: chmod o-rwx \"${folder_name}\"" + chmod o-rwx "${folder_name}" || true + touch "/var/cache/security-misc/state-files/${user}" || true + done +} + +home_folder_access_rights_lockdown + +exit 0 diff --git a/usr/libexec/security-misc/placeholder#security-misc-server b/usr/libexec/security-misc/placeholder#security-misc-server new file mode 100755 index 00000000..6cfad57b --- /dev/null +++ b/usr/libexec/security-misc/placeholder#security-misc-server @@ -0,0 +1,14 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +printf '%s\n' "$0: This is just a placeholder until security-misc-server gets implemented." +exit 0 diff --git a/usr/libexec/security-misc/remove-system.map#security-misc-shared b/usr/libexec/security-misc/remove-system.map#security-misc-shared new file mode 100755 index 00000000..a0dff730 --- /dev/null +++ b/usr/libexec/security-misc/remove-system.map#security-misc-shared @@ -0,0 +1,60 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + ## pre.bsh would `source` the following folders: + ## /etc/remove-system.map_pre.d/*.conf + ## /usr/local/etc/remove-system.map_pre.d/*.conf + source /usr/libexec/helper-scripts/pre.bsh +fi + +shopt -s nullglob + +system_map_list=( /boot/System.map* /usr/src/*/System.map* /lib/modules/*/*/System.map* /System.map* ) + +if [ "${#system_map_list[@]}" -gt 0 ]; then + printf '%s\n' "INFO: Deleting system.map files..." +fi + +failed_list=() + +## Removes the System.map files as they are only used for debugging or malware. +for filename in "${system_map_list[@]}"; do + if ! [ -f "${filename}" ]; then + continue + fi + ## The immutable and append-only file attributes prevent deletion. + ## System.map files have no reason to have either. + chattr -ia -- "${filename}" >/dev/null 2>&1 || true + + ## 'shred' with '--verbose' is too chatty. (7 lines) + ## 'shred' stderr is suppressed because failure is expected on read-only + ## file systems. + if shred --force --zero -u -- "${filename}" 2>/dev/null; then + printf '%s\n' "INFO: removed '${filename}'" + continue + fi + failed_list+=( "${filename}" ) +done + +if [ "${#failed_list[@]}" -gt 0 ]; then + for filename in "${failed_list[@]}"; do + printf '%s\n' "NOTE: Could not remove '${filename}'." + done + printf '%s\n' "NOTE: For details, see: https://www.kicksecure.com/wiki/security-misc#system_map" +elif [ "${#system_map_list[@]}" -gt 0 ]; then + printf '%s\n' "INFO: Done. Success." +fi + +## Deliberately exits 0 even on partial failure. A non-zero exit code would fail +## the kernel package's postinst hook and the oneshot unit on every boot. +exit 0 diff --git a/usr/lib/security-misc/virusforget b/usr/libexec/security-misc/virusforget#security-misc-shared similarity index 93% rename from usr/lib/security-misc/virusforget rename to usr/libexec/security-misc/virusforget#security-misc-shared index 70817373..dbab06dd 100755 --- a/usr/lib/security-misc/virusforget +++ b/usr/libexec/security-misc/virusforget#security-misc-shared @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## VirusForget is inspired by Christopher Laprise. @@ -29,7 +29,7 @@ root_check() { parse_cmd_options() { ## Thanks to: - ## http://mywiki.wooledge.org/BashFAQ/035 + ## https://mywiki.wooledge.org/BashFAQ/035 while : do @@ -85,6 +85,10 @@ parse_cmd_options() { echo "ERROR: must set --user username" >&2 exit 1 fi + if ! id -u "$user_name" >/dev/null 2>&1; then + echo "ERROR: User '$user_name' does not appear to exist!" >&2 + exit 1 + fi } variables() { @@ -270,7 +274,7 @@ unexpected_file() { elif [ "$clean" = "true" ]; then echo "unexpected symlink. Removing... unlink '$full_path_original'" >&2 unlink "$full_path_original" - echo "Removed unexpect symlink." >&2 + echo "Removed unexpected symlink." >&2 fi else if [ "$test_mode" = "true" ]; then @@ -294,6 +298,13 @@ unexpected_file() { } restore_file() { + ## An extraneous file has no baseline backup to restore from; the caller + ## has already removed it, which is the correct action. Return early so the + ## 'cp' below does not fail on the missing backup and abort the entire + ## '--clean' run (via 'set -e') on the first extraneous file encountered. + if [ ! -e "$full_path_backup" ]; then + return 0 + fi if [ "$test_mode" = "true" ]; then echo "Simulate restoring file... $full_path_original" >&2 echo cp --no-dereference --archive "$full_path_backup" "$full_path_original" diff --git a/usr/share/doc/security-misc/fstab-vm#security-misc-shared b/usr/share/doc/security-misc/fstab-vm#security-misc-shared new file mode 100644 index 00000000..e02a0870 --- /dev/null +++ b/usr/share/doc/security-misc/fstab-vm#security-misc-shared @@ -0,0 +1,40 @@ +# + +/dev/disk/by-uuid/26ada0c0-1165-4098-884d-aafd2220c2c6 / auto nofail,defaults,errors=remount-ro 0 1 + +proc /proc proc nofail,defaults 0 0 + +/dev /dev devtmpfs nofail,bind,remount,nosuid,noexec 0 0 +#udev /dev devtmpfs defaults,nosuid,noexec 0 0 + +## noexec optional +/dev/shm /dev/shm tmpfs nofail,nosuid,nodev,noexec 0 0 +#tmpfs /dev/shm tmpfs defaults,nosuid,nodev,noexec 0 0 + +## nodev,nosuid,noexec as per: +## https://www.debian.org/doc/manuals/securing-debian-manual/ch04s10.en.html +## Commented out by default to prevent warning: +## mount: /mnt/cdrom: mount point does not exist. +#/dev/cdrom /mnt/cdrom iso9660 nofail,ro,users,nodev,nosuid,noexec 0 0 + +/boot /boot none nofail,bind,nosuid,nodev,noexec 0 0 + +## noexec optional +/tmp /tmp tmpfs nofail,bind,nosuid,nodev,noexec 0 0 +#tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec 0 0 + +/var /var none nofail,bind,nosuid,nodev 0 0 + +## noexec optional +/var/tmp /var/tmp none nofail,bind,nosuid,nodev,noexec 0 0 + +/var/log /var/log none nofail,bind,nosuid,nodev,noexec 0 0 + +## noexec optional +/run /run none nofail,bind,nosuid,nodev,noexec 0 0 + +## noexec optional +/home /home none nofail,bind,nosuid,nodev,noexec 0 0 + +## TODO: +#/sys diff --git a/usr/share/glib-2.0/schemas/30_security-misc.gschema.override b/usr/share/glib-2.0/schemas/30_security-misc.gschema.override deleted file mode 100644 index 2ee9098a..00000000 --- a/usr/share/glib-2.0/schemas/30_security-misc.gschema.override +++ /dev/null @@ -1,2 +0,0 @@ -[org.gnome.nautilus.preferences] -show-image-thumbnails="never" diff --git a/usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared b/usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared new file mode 100644 index 00000000..2f568050 --- /dev/null +++ b/usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2017 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[org.gnome.nautilus.preferences] +show-image-thumbnails="never" diff --git a/usr/share/lintian/overrides/security-misc b/usr/share/lintian/overrides/security-misc deleted file mode 100644 index 3217d4b1..00000000 --- a/usr/share/lintian/overrides/security-misc +++ /dev/null @@ -1,11 +0,0 @@ -## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## The whole point of the package. -security-misc: package-contains-file-in-etc-skel etc/skel/.config/* - -## Wrapper script. -security-misc: binary-without-manpage usr/bin/pkexec.security-misc - -## Non-ideal but still a good solution. -security-misc: file-in-unusual-dir var/cache/security-misc/state-files/placeholder diff --git a/usr/share/lintian/overrides/security-misc-shared#security-misc-shared b/usr/share/lintian/overrides/security-misc-shared#security-misc-shared new file mode 100644 index 00000000..0735aaa3 --- /dev/null +++ b/usr/share/lintian/overrides/security-misc-shared#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## The whole point of the package. +security-misc-shared: package-contains-file-in-etc-skel [etc/skel/*] + +## Wrapper script. +security-misc-shared: no-manual-page [usr/bin/pkexec.security-misc] + +## Non-ideal but still a good solution. +security-misc-shared: file-in-unusual-dir [var/cache/security-misc/state-files/placeholder] + +## False-positive. Just a comment mentioning dpkg's folder. +security-misc-shared: uses-dpkg-database-directly [usr/bin/remount-secure] + +## Special target to make sure this runs as non-parallelized as possible to avoid race conditions. +security-misc-shared: systemd-service-file-refers-to-unusual-wantedby-target sysinit-post.target [usr/lib/systemd/system/remount-secure.service] + +## False-positive. Unit is commented out by default. +security-misc-shared: systemd-service-file-missing-install-key [usr/lib/systemd/system/block-shutdown.service] + +## Minor bug: Unknown. +security-misc-shared: package-contains-empty-directory [usr/share/security-misc-shared/] + +## Lintian doesn't know that set -o errexit is the same as set -e. +security-misc-shared: maintainer-script-ignores-errors [postinst] diff --git a/usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared b/usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared new file mode 100644 index 00000000..eec6702b --- /dev/null +++ b/usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared @@ -0,0 +1,6 @@ +Name: block unsafe passwordless login (by package security-misc-shared) +Default: yes +Priority: 1100 +Auth-Type: Primary +Auth: + requisite pam_exec.so seteuid stdout /usr/libexec/security-misc/block-unsafe-logins diff --git a/usr/share/pam-configs/console-lockdown-security-misc b/usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared similarity index 60% rename from usr/share/pam-configs/console-lockdown-security-misc rename to usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared index 61fec784..d760d5fe 100644 --- a/usr/share/pam-configs/console-lockdown-security-misc +++ b/usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared @@ -1,7 +1,7 @@ -Name: allow only members of group console to use login (by package security-misc) +Name: allow only members of group console to use login (by package security-misc-shared) Default: no Priority: 280 Account-Type: Primary Account: - [success=1 default=ignore] pam_exec.so seteuid quiet /usr/lib/security-misc/pam_only_if_login + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_only_if_login required pam_access.so accessfile=/etc/security/access-security-misc.conf debug diff --git a/usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared b/usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared new file mode 100644 index 00000000..41c61f9a --- /dev/null +++ b/usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared @@ -0,0 +1,8 @@ +Name: lock accounts after 50 failed authentication attempts (preauth component) (by package security-misc-shared) +Default: yes +Priority: 1024 +Auth-Type: Primary +Auth: + optional pam_exec.so debug stdout seteuid /usr/libexec/security-misc/pam-info + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + required pam_faillock.so preauth diff --git a/usr/share/pam-configs/mkhomedir-security-misc b/usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared similarity index 64% rename from usr/share/pam-configs/mkhomedir-security-misc rename to usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared index 326013c0..03b11e4e 100644 --- a/usr/share/pam-configs/mkhomedir-security-misc +++ b/usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared @@ -1,4 +1,4 @@ -Name: Create home directory on login (by package security-misc) +Name: Create home directory on login (by package security-misc-shared) Default: yes Priority: 100 Session-Type: Additional diff --git a/usr/share/pam-configs/pam-abort-on-locked-password-security-misc b/usr/share/pam-configs/pam-abort-on-locked-password-security-misc deleted file mode 100644 index 7298601a..00000000 --- a/usr/share/pam-configs/pam-abort-on-locked-password-security-misc +++ /dev/null @@ -1,6 +0,0 @@ -Name: abort on locked password (by package security-misc) -Default: yes -Priority: 300 -Auth-Type: Primary -Auth: - requisite pam_exec.so debug stdout seteuid /usr/lib/security-misc/pam-abort-on-locked-password diff --git a/usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared b/usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared new file mode 100644 index 00000000..02cd2a35 --- /dev/null +++ b/usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared @@ -0,0 +1,6 @@ +Name: abort on locked password (by package security-misc-shared) +Default: yes +Priority: 300 +Auth-Type: Primary +Auth: + requisite pam_exec.so debug stdout seteuid /usr/libexec/security-misc/pam-abort-on-locked-password diff --git a/usr/share/pam-configs/tally2-security-misc b/usr/share/pam-configs/tally2-security-misc deleted file mode 100644 index 9638d26f..00000000 --- a/usr/share/pam-configs/tally2-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -Name: lock accounts after 50 failed authentication attempts (by package security-misc) -Default: yes -Priority: 290 -Auth-Type: Primary -Auth: - optional pam_exec.so debug stdout seteuid /usr/lib/security-misc/pam_tally2-info - requisite pam_tally2.so even_deny_root deny=50 onerr=fail audit debug -Account-Type: Primary -Account: - requisite pam_tally2.so debug diff --git a/usr/share/pam-configs/umask-security-misc#security-misc-shared b/usr/share/pam-configs/umask-security-misc#security-misc-shared new file mode 100644 index 00000000..3b34c25f --- /dev/null +++ b/usr/share/pam-configs/umask-security-misc#security-misc-shared @@ -0,0 +1,9 @@ +Name: Restrict umask to 027 for non-root users (by package security-misc-shared) +Default: yes +Priority: 100 +Session-Type: Additional +Session: + [success=1 default=ignore] pam_succeed_if.so uid eq 0 + optional pam_umask.so umask=027 + [success=1 default=ignore] pam_succeed_if.so uid ne 0 + optional pam_umask.so umask=022 diff --git a/usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared b/usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared new file mode 100644 index 00000000..0950f2ad --- /dev/null +++ b/usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared @@ -0,0 +1,20 @@ +Name: Unix authentication with faillock (by package security-misc-shared) +Default: yes +Priority: 384 +Auth-Type: Primary +Auth: + [success=3 default=ignore] pam_unix.so nullok try_first_pass + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + [default=die] pam_faillock.so authfail + requisite pam_deny.so + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + optional pam_faillock.so authsucc + required pam_permit.so +Auth-Initial: + [success=3 default=ignore] pam_unix.so nullok + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + [default=die] pam_faillock.so authfail + requisite pam_deny.so + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + optional pam_faillock.so authsucc + required pam_permit.so diff --git a/usr/share/pam-configs/wheel-security-misc b/usr/share/pam-configs/wheel-security-misc#security-misc-shared similarity index 50% rename from usr/share/pam-configs/wheel-security-misc rename to usr/share/pam-configs/wheel-security-misc#security-misc-shared index 323ff72e..12d72100 100644 --- a/usr/share/pam-configs/wheel-security-misc +++ b/usr/share/pam-configs/wheel-security-misc#security-misc-shared @@ -1,6 +1,7 @@ -Name: group sudo membership required to use su (by package security-misc) +Name: group sudo membership required to use su (by package security-misc-shared) Default: yes -Priority: 280 +Priority: 1050 Auth-Type: Primary Auth: + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_only_if_su requisite pam_wheel.so group=sudo debug diff --git a/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared b/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared new file mode 100644 index 00000000..176b14e1 --- /dev/null +++ b/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared @@ -0,0 +1,335 @@ + + + + + The Flatpak Project + https://github.com/flatpak/flatpak + package-x-generic + + + Install signed application + Authentication is required to install software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.app-update org.freedesktop.Flatpak.runtime-install org.freedesktop.Flatpak.runtime-update + + + + Install signed runtime + Authentication is required to install software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-update + + + + Update signed application + Authentication is required to update software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-install org.freedesktop.Flatpak.runtime-update + + + + Update signed runtime + Authentication is required to update software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update remote metadata + Authentication is required to update remote info + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update system repository + Authentication is required to modify a system repository + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Install bundle + Authentication is required to install software from $(path) + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-install org.freedesktop.Flatpak.runtime-update + + + + Uninstall runtime + Authentication is required to uninstall software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Uninstall app + Authentication is required to uninstall $(ref) + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-uninstall + + + + Configure Remote + Authentication is required to configure software repositories + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Configure + Authentication is required to configure software installation + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update appstream + Authentication is required to update information about software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update metadata + Authentication is required to update metadata + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Override parental controls for installs + Authentication is required to install software which is restricted by your parental controls policy + package-x-generic + + auth_admin + auth_admin + auth_admin + + org.freedesktop.Flatpak.override-parental-controls-update + + + + Override parental controls for updates + Authentication is required to update software which is restricted by your parental controls policy + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + diff --git a/usr/share/security-misc/dolphinrc b/usr/share/security-misc/dolphinrc#security-misc-shared similarity index 50% rename from usr/share/security-misc/dolphinrc rename to usr/share/security-misc/dolphinrc#security-misc-shared index 86831213..9028487f 100644 --- a/usr/share/security-misc/dolphinrc +++ b/usr/share/security-misc/dolphinrc#security-misc-shared @@ -1,6 +1,5 @@ -## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions [PreviewSettings] Plugins= - diff --git a/usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared b/usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared new file mode 100644 index 00000000..8de5412f --- /dev/null +++ b/usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared @@ -0,0 +1,21 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file should not be installed on the host system, it is intended for +## inclusion in a dracut initramfs only. + +[Unit] +Description=Emergency shutdown when boot media is removed +Documentation=https://github.com/Kicksecure/security-misc +DefaultDependencies=no +Before=sysinit.target +Requires=systemd-udevd.service +After=systemd-udevd.service + +[Service] +Type=notify +ExecStart=/usr/libexec/security-misc/emerg-shutdown +NotifyAccess=main + +[Install] +WantedBy=sysinit.target diff --git a/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared b/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared new file mode 100644 index 00000000..87de7e08 --- /dev/null +++ b/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared @@ -0,0 +1,30 @@ +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## LKRG VirtualBox host configuration + +## DO NOT EDIT THIS FILE /etc/sysctl.d/30-lkrg-dkms.conf AS EDITS WILL BE LOST! +## This is an auto generated file. + +## Please use "/etc/sysctl.d/50-user.conf" for your custom +## configuration, which will override the defaults found here. + +## gets copied from: +## /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf +## to: +## /etc/sysctl.d/30-lkrg-virtualbox.conf +## by package security-misc-shared, files: +## /usr/share/security-misc/lkrg/lkrg-virtualbox +## /usr/lib/systemd/system/lkrg.service.d/40-virtualbox.conf + +## https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/32 +## https://www.openwall.com/lists/lkrg-users/2020/01/24/2 +## https://www.openwall.com/lists/lkrg-users/2020/01/25/2 +## https://github.com/openwall/lkrg/issues/82 +## https://github.com/openwall/lkrg/blob/main/scripts/bootup/lkrg.conf +## https://github.com/openwall/lkrg/blob/main/scripts/bootup/systemd/lkrg.service +## /etc/sysctl.d/30-lkrg-dkms.conf +## /usr/lib/systemd/system/lkrg.service + +## https://github.com/openwall/lkrg/issues/82#issuecomment-886188999 +lkrg.pcfi_validate = 1 diff --git a/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared new file mode 100755 index 00000000..a64cb9fe --- /dev/null +++ b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared @@ -0,0 +1,42 @@ +#!/bin/bash + +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +#set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## security-misc-shared Depends on helper-scripts. +# shellcheck source=../../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh + +## Check if the VirtualBox host software is installed. +if ! has vboxmanage ; then + ## VirtualBox host software is not installed. + if test -f /etc/sysctl.d/30-lkrg-virtualbox.conf ; then + ## Delete using '--verbose' so user is notified. + safe-rm --force --verbose -- /etc/sysctl.d/30-lkrg-virtualbox.conf + fi + exit 0 +fi + +if ! test -d /etc/sysctl.d ; then + exit 0 +fi + +if ! test -f /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf ; then + exit 0 +fi + +if ! package-installed-check "lkrg" ; then + exit 0 +fi + +## Delete using '--verbose' so user is notified. +cp --verbose -- /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf /etc/sysctl.d/30-lkrg-virtualbox.conf diff --git a/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared b/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared new file mode 100644 index 00000000..d40c552c --- /dev/null +++ b/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared @@ -0,0 +1,36 @@ +root root 644 /etc/passwd- +root root 755 /etc/cron.monthly +root root 755 /etc/sudoers.d +root shadow 2755 /usr/bin/expiry +root root 4755 /usr/bin/umount +root root 4755 /usr/bin/gpasswd +root root 755 /usr/lib/modules +root root 644 /etc/issue.net +root root 644 /etc/group- +root root 4755 /usr/bin/newgrp +root root 755 /etc/cron.weekly +root root 644 /etc/hosts.deny +root root 4755 /usr/bin/su +root root 644 /etc/hosts.allow +root root 700 /root +root root 755 /etc/cron.daily +root root 755 /bin/ping +root root 777 /etc/motd.kicksecure +root root 777 /etc/motd.whonix +root root 755 /boot +root root 755 /home +root shadow 2755 /usr/bin/chage +root root 4755 /usr/bin/chsh +root root 4755 /usr/bin/passwd +root root 4755 /usr/bin/chfn +root root 644 /etc/group +root root 755 /etc/permission-hardener.d +root root 644 /etc/passwd +root root 755 /usr/src +root root 4755 /usr/bin/mount +root root 777 /etc/issue.kicksecure +root root 777 /etc/issue.whonix +root root 755 /etc/cron.d +root root 4755 /usr/bin/sudo +root root 4755 /usr/bin/pkexec +root root 4755 /usr/lib/polkit-1/polkit-agent-helper-1 diff --git a/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared b/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared new file mode 100644 index 00000000..d1b3a806 --- /dev/null +++ b/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared @@ -0,0 +1,26 @@ +root root 700 /etc/cron.monthly +root root 700 /etc/sudoers.d +root shadow 744 /usr/bin/expiry +root root 755 /usr/bin/umount +root root 744 /usr/bin/gpasswd +root root 700 /usr/lib/modules +root root 744 /usr/bin/newgrp +root root 700 /etc/cron.weekly +root root 744 /usr/bin/su +root root 700 /etc/cron.daily +root root 755 /bin/ping +root root 644 /etc/motd.kicksecure +root root 644 /etc/motd.whonix +root _ssh 744 /usr/bin/ssh-agent +root root 700 /boot +root shadow 744 /usr/bin/chage +root root 744 /usr/lib/openssh/ssh-keysign +root root 744 /usr/bin/chsh +root root 755 /usr/bin/passwd +root root 744 /usr/bin/chfn +root root 600 /etc/permission-hardener.d +root root 700 /usr/src +root root 755 /usr/bin/mount +root root 644 /etc/issue.kicksecure +root root 644 /etc/issue.whonix +root root 700 /etc/cron.d diff --git a/usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared b/usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared new file mode 100644 index 00000000..12439b3e --- /dev/null +++ b/usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared @@ -0,0 +1,2 @@ +# Lock systemd and all of its library dependencies into memory ++/usr/lib/systemd/systemd diff --git a/usr/src/security-misc/emerg-shutdown.c#security-misc-shared b/usr/src/security-misc/emerg-shutdown.c#security-misc-shared new file mode 100644 index 00000000..95cd3371 --- /dev/null +++ b/usr/src/security-misc/emerg-shutdown.c#security-misc-shared @@ -0,0 +1,1110 @@ +/* + * Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC + * See the file COPYING for copying conditions. + */ + +/* + * This program is designed specifically to immediately and forcibly power off + * the system in the event the device providing the root filesystem is + * abruptly removed from the system. The idea is that a user can shut down + * a portable installation of Kicksecure by simply yanking the USB drive + * containing the installation from the computer. Tails provides essentially + * the same feature, however it is known for occasionally failing to do its + * job properly. + * + * The fact that we're triggering a shutdown when the device containing the + * root filesystem vanishes presents a number of significant challenges: + * + * - The device providing the entire operating system is gone. The only things + * we will still have left are the kernel, files loaded into RAM (for + * instance under /run), and anything that happens to still be in the + * system's disk cache. + * - Virtually any process on the system may abruptly crash at any time. This + * isn't just because applications may be unable to access files. The Linux + * kernel's virtual memory subsystem doesn't just page out RAM contents to a + * swap file, it will sometimes simply erase pages containing executable + * code from memory if it can reload that code from disk later when needed. + * If part of a program isn't present in memory, and then the root device + * vanishes, any attempt to use code in the absent part of the application + * will result in the application crashing. (Attempts to access data in RAM + * that happened to be paged out will result in a similar crash.) + * - We have no control over what is and isn't in the disk cache, which makes + * it unsafe to launch any dynamically linked executable. What happens if we + * need to load a missing part of libc? What if the dynamic linker itself + * needs loaded from disk? + * - Systemd could lock up at any time, since the init process isn't immune to + * having bits of it erased from RAM to free up memory. If systemd receives + * a SIGSEGV, rather than crashing (which would panic the kernel), it goes + * into an "emergency mode" that tries to keep the system as operational as + * possible even though PID 1 is now out of service. + * + * Circumventing this set of difficulties is not easy, and it might not even + * be entirely possible. To give our feature the highest chance of success: + * + * - We use memlockd to lock systemd and all libraries it depends on into + * memory. It can hold its own pretty well in the event of a segfault, but + * if its crash handler ends up re-segfaulting, that could get ugly. + * - We compile the utility at boot time, statically link it against all of + * its dependencies (really only one, glibc), and load it into /run. This + * allows for decent architecture independence while removing any dependency + * on anything that isn't in RAM, thus (hopefully!) making the process + * crash-immune. + * - Because we're static-linking against glibc, we cannot call anything + * defined in stdio.h. This is because glibc uses dlopen() to load iconv + * modules, which are used internally by glibc for locale support. Things + * defined in stdio.h may use iconv, so calling anything there will + * basically make our static-linked executable become dynamically linked, + * which could segfault it since the root filesystem is gone. We can't call + * anything that could touch Name Service Switch (NSS) either, but we have + * no need to do so, so we should be safe there. See + * https://stackoverflow.com/questions/57476533/why-is-statically-linking-glibc-discouraged + * - We can't use udev either because libudev is only available as a dynamic + * library. That means we have to listen to kernel uevents directly to + * determine when the root device vanishes. Thankfully this isn't as much of + * a pain as it might sound like. + * - We don't call out to any external process, since those external processes + * could segfault. + * + * This is likely superior to Tails' implementation, which uses udev (and thus + * dynamic linking), uses an interpreter-driven script to shut down the system + * when the root device vanishes, and calls out to external executables to + * actually shut the system down. These issues are likely why Tails' + * implementation of emergency shutdown occasionally fails. See + * https://www.reddit.com/r/tails/comments/xh8njn/tails_wont_shutdown_when_i_pull_usb_stick/ + * (there are other similar posts as well). + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +//#define fd_stdin 0 +//#define fd_stdout 1 +#define fd_stderr 2 + +#define max_inputs 255 +#define input_path_size 20 +#define key_flags_len 12 + +#define hw_monitor_val 1 +#define fifo_monitor_val 2 + +#define max_sig_num 31 + +int console_fd = -1; + +/* Adapted from kloak/src/keycodes.c */ +struct name_value { + const char *name; + const uint32_t value; +}; +static struct name_value key_table[] = { + {"KEY_ESC", KEY_ESC}, + {"KEY_1", KEY_1}, + {"KEY_2", KEY_2}, + {"KEY_3", KEY_3}, + {"KEY_4", KEY_4}, + {"KEY_5", KEY_5}, + {"KEY_6", KEY_6}, + {"KEY_7", KEY_7}, + {"KEY_8", KEY_8}, + {"KEY_9", KEY_9}, + {"KEY_0", KEY_0}, + {"KEY_MINUS", KEY_MINUS}, + {"KEY_EQUAL", KEY_EQUAL}, + {"KEY_BACKSPACE", KEY_BACKSPACE}, + {"KEY_TAB", KEY_TAB}, + {"KEY_Q", KEY_Q}, + {"KEY_W", KEY_W}, + {"KEY_E", KEY_E}, + {"KEY_R", KEY_R}, + {"KEY_T", KEY_T}, + {"KEY_Y", KEY_Y}, + {"KEY_U", KEY_U}, + {"KEY_I", KEY_I}, + {"KEY_O", KEY_O}, + {"KEY_P", KEY_P}, + {"KEY_LEFTBRACE", KEY_LEFTBRACE}, + {"KEY_RIGHTBRACE", KEY_RIGHTBRACE}, + {"KEY_ENTER", KEY_ENTER}, + {"KEY_LEFTCTRL", KEY_LEFTCTRL}, + {"KEY_A", KEY_A}, + {"KEY_S", KEY_S}, + {"KEY_D", KEY_D}, + {"KEY_F", KEY_F}, + {"KEY_G", KEY_G}, + {"KEY_H", KEY_H}, + {"KEY_J", KEY_J}, + {"KEY_K", KEY_K}, + {"KEY_L", KEY_L}, + {"KEY_SEMICOLON", KEY_SEMICOLON}, + {"KEY_APOSTROPHE", KEY_APOSTROPHE}, + {"KEY_GRAVE", KEY_GRAVE}, + {"KEY_LEFTSHIFT", KEY_LEFTSHIFT}, + {"KEY_BACKSLASH", KEY_BACKSLASH}, + {"KEY_Z", KEY_Z}, + {"KEY_X", KEY_X}, + {"KEY_C", KEY_C}, + {"KEY_V", KEY_V}, + {"KEY_B", KEY_B}, + {"KEY_N", KEY_N}, + {"KEY_M", KEY_M}, + {"KEY_COMMA", KEY_COMMA}, + {"KEY_DOT", KEY_DOT}, + {"KEY_SLASH", KEY_SLASH}, + {"KEY_RIGHTSHIFT", KEY_RIGHTSHIFT}, + {"KEY_KPASTERISK", KEY_KPASTERISK}, + {"KEY_LEFTALT", KEY_LEFTALT}, + {"KEY_SPACE", KEY_SPACE}, + {"KEY_CAPSLOCK", KEY_CAPSLOCK}, + {"KEY_F1", KEY_F1}, + {"KEY_F2", KEY_F2}, + {"KEY_F3", KEY_F3}, + {"KEY_F4", KEY_F4}, + {"KEY_F5", KEY_F5}, + {"KEY_F6", KEY_F6}, + {"KEY_F7", KEY_F7}, + {"KEY_F8", KEY_F8}, + {"KEY_F9", KEY_F9}, + {"KEY_F10", KEY_F10}, + {"KEY_NUMLOCK", KEY_NUMLOCK}, + {"KEY_SCROLLLOCK", KEY_SCROLLLOCK}, + {"KEY_KP7", KEY_KP7}, + {"KEY_KP8", KEY_KP8}, + {"KEY_KP9", KEY_KP9}, + {"KEY_KPMINUS", KEY_KPMINUS}, + {"KEY_KP4", KEY_KP4}, + {"KEY_KP5", KEY_KP5}, + {"KEY_KP6", KEY_KP6}, + {"KEY_KPPLUS", KEY_KPPLUS}, + {"KEY_KP1", KEY_KP1}, + {"KEY_KP2", KEY_KP2}, + {"KEY_KP3", KEY_KP3}, + {"KEY_KP0", KEY_KP0}, + {"KEY_KPDOT", KEY_KPDOT}, + {"KEY_ZENKAKUHANKAKU", KEY_ZENKAKUHANKAKU}, + {"KEY_102ND", KEY_102ND}, + {"KEY_F11", KEY_F11}, + {"KEY_F12", KEY_F12}, + {"KEY_RO", KEY_RO}, + {"KEY_KATAKANA", KEY_KATAKANA}, + {"KEY_HIRAGANA", KEY_HIRAGANA}, + {"KEY_HENKAN", KEY_HENKAN}, + {"KEY_KATAKANAHIRAGANA", KEY_KATAKANAHIRAGANA}, + {"KEY_MUHENKAN", KEY_MUHENKAN}, + {"KEY_KPJPCOMMA", KEY_KPJPCOMMA}, + {"KEY_KPENTER", KEY_KPENTER}, + {"KEY_RIGHTCTRL", KEY_RIGHTCTRL}, + {"KEY_KPSLASH", KEY_KPSLASH}, + {"KEY_SYSRQ", KEY_SYSRQ}, + {"KEY_RIGHTALT", KEY_RIGHTALT}, + {"KEY_LINEFEED", KEY_LINEFEED}, + {"KEY_HOME", KEY_HOME}, + {"KEY_UP", KEY_UP}, + {"KEY_PAGEUP", KEY_PAGEUP}, + {"KEY_LEFT", KEY_LEFT}, + {"KEY_RIGHT", KEY_RIGHT}, + {"KEY_END", KEY_END}, + {"KEY_DOWN", KEY_DOWN}, + {"KEY_PAGEDOWN", KEY_PAGEDOWN}, + {"KEY_INSERT", KEY_INSERT}, + {"KEY_DELETE", KEY_DELETE}, + {"KEY_MACRO", KEY_MACRO}, + {"KEY_MUTE", KEY_MUTE}, + {"KEY_VOLUMEDOWN", KEY_VOLUMEDOWN}, + {"KEY_VOLUMEUP", KEY_VOLUMEUP}, + {"KEY_POWER", KEY_POWER}, + {"KEY_POWER2", KEY_POWER2}, + {"KEY_KPEQUAL", KEY_KPEQUAL}, + {"KEY_KPPLUSMINUS", KEY_KPPLUSMINUS}, + {"KEY_PAUSE", KEY_PAUSE}, + {"KEY_SCALE", KEY_SCALE}, + {"KEY_KPCOMMA", KEY_KPCOMMA}, + {"KEY_HANGEUL", KEY_HANGEUL}, + {"KEY_HANGUEL", KEY_HANGUEL}, + {"KEY_HANJA", KEY_HANJA}, + {"KEY_YEN", KEY_YEN}, + {"KEY_LEFTMETA", KEY_LEFTMETA}, + {"KEY_RIGHTMETA", KEY_RIGHTMETA}, + {"KEY_COMPOSE", KEY_COMPOSE}, + {"KEY_F13", KEY_F13}, + {"KEY_F14", KEY_F14}, + {"KEY_F15", KEY_F15}, + {"KEY_F16", KEY_F16}, + {"KEY_F17", KEY_F17}, + {"KEY_F18", KEY_F18}, + {"KEY_F19", KEY_F19}, + {"KEY_F20", KEY_F20}, + {"KEY_F21", KEY_F21}, + {"KEY_F22", KEY_F22}, + {"KEY_F23", KEY_F23}, + {"KEY_F24", KEY_F24}, + {"KEY_UNKNOWN", KEY_UNKNOWN}, + {NULL, 0} +}; +uint32_t lookup_keycode(const char *name) { + struct name_value *p; + for (p = key_table; p->name != NULL; ++p) { + if (strcmp(p->name, name) == 0) { + return p->value; + } + } + return 0; +} + +/* Adapted from systemd/src/login/logind-button.c */ +bool bitset_get(const uint64_t *bits, uint32_t i) { + return (bits[i / 64] >> (i % 64)) & 1UL; +} + +void print(int fd, const char *str) { + size_t len = strlen(str); + while (len > 0) { + ssize_t write_len = write(fd, str, len); + if (write_len < 0) { + /* File descriptor was closed, continue regardless */ + return; + } + len -= (size_t)write_len; + str += write_len; + } +} + +void print_usage(void) { + print(fd_stderr, "Usage:\n"); + print(fd_stderr, " emerg-shutdown [OPTIONS...]\n"); + print(fd_stderr, "Options:\n"); + print(fd_stderr, " --devices=DEVICE1[,DEVICE2...]\n"); + print(fd_stderr, " A comma-separated list of devices. If any of these devices are\n"); + print(fd_stderr, " removed from the system, an emergency shutdown will occur.\n"); + print(fd_stderr, " --keys=KEY_1[,KEY_2|KEY_3...]\n"); + print(fd_stderr, " A comma-separated list of keys. If all of the specified keys are\n"); + print(fd_stderr, " pressed at the same time, an emergency shutdown will occur.\n"); + print(fd_stderr, " Keys separated with a pipe will be treated as aliases of each\n"); + print(fd_stderr, " other.\n"); + print(fd_stderr, " --paranoid\n"); + print(fd_stderr, " Watches for the removal of any removable device whatsoever. An\n"); + print(fd_stderr, " emergency shutdown will be triggered if any device is removed.\n"); + print(fd_stderr, " Cannot be combined with --devices.\n"); + print(fd_stderr, " --instant-shutdown\n"); + print(fd_stderr, " Immediately triggers an emergency shutdown. Cannot be combined\n"); + print(fd_stderr, " with other options.\n"); + print(fd_stderr, " --monitor-fifo\n"); + print(fd_stderr, " Used internally to implement the ensure-shutdown service. Do\n"); + print(fd_stderr, " not use.\n"); + print(fd_stderr, " --timeout=TIMEOUT\n"); + print(fd_stderr, " Used internally to implement the ensure-shutdown service. Do\n"); + print(fd_stderr, " not use.\n"); + print(fd_stderr, "Example:\n"); + print(fd_stderr, " emerg-shutdown --devices=/dev/sda3 --keys=KEY_POWER\n"); + print(fd_stderr, "See /etc/security-misc/emerg-shutdown/30_security-misc.conf to\n"); + print(fd_stderr, "configure the emerg-shutdown service.\n"); +} + +void *safe_calloc(size_t nmemb, size_t size) { + void *ret_buf = calloc(nmemb, size); + if (ret_buf == NULL) { + print(fd_stderr, "Out of memory!\n"); + exit(1); + } + return ret_buf; +} + +void *safe_reallocarray(void *ptr, size_t nmemb, size_t size) { + void *ret_buf = reallocarray(ptr, nmemb, size); + if (ret_buf == NULL) { + print(fd_stderr, "Out of memory!\n"); + exit(1); + } + return ret_buf; +} + +/* Inspired by https://www.strudel.org.uk/itoa/ */ +char *int_to_str(uint32_t val) { + static char buf[11]; + int8_t i; + char *rslt = NULL; + const char *digits = "0123456789"; + + buf[10] = '\0'; + + for (i = 9; i >= 0; i--) { + buf[i] = digits[val % 10]; + val /= 10; + if (val == 0) { + break; + } + } + assert(i >= 0); + + rslt = safe_calloc(1, 11 - (uint8_t)(i)); + memcpy(rslt, buf + i, 11 - (uint8_t)(i)); + return rslt; +} + +void load_list(const char *arg, size_t *result_list_len_ref, char ***result_list_ref, const char *sep, bool parse_opt) { + char **result_list = NULL; + size_t result_list_len = 0; + size_t arg_copy_len = strlen(arg) + 1; + char *arg_copy = safe_calloc(1, arg_copy_len); + char *arg_val; + char *arg_part; + + memcpy(arg_copy, arg, arg_copy_len); + if (parse_opt) { + /* returns "--whatever" */ + arg_val = strtok(arg_copy, "="); + /* returns everything after the = sign */ + arg_val = strtok(NULL, ""); + } else { + arg_val = arg_copy; + } + + arg_part = strtok(arg_val, sep); + if (arg_part == NULL) { + free(arg_copy); + return; + } + + do { + result_list_len++; + result_list = safe_reallocarray(result_list, result_list_len, sizeof(char *)); + result_list[result_list_len - 1] = safe_calloc(1, strlen(arg_part) + 1); + strcpy(result_list[result_list_len - 1], arg_part); + } while ((arg_part = strtok(NULL, sep)) != NULL); + + *result_list_len_ref = result_list_len; + *result_list_ref = result_list; + free(arg_copy); +} + +void kill_system(void) { + /* + * It isn't safe to simply call the reboot syscall here - there is a + * graphics driver bug in the i915 driver on Bookworm that will throw a + * kernel warning during shutdown. Kicksecure sets panic_on_oops and + * panic_on_warn to 1 during bootup, which means this bug will cause a + * kernel panic and thus hang the system rather than shutting down. + * + * To mitigate this, we do two things: + * + * - We disable the panic_on_oops and panic_on_warn kernel settings before + * calling the reboot syscall. This way if a warn or oops does occur, at + * least it isn't as likely to block shutdown. + * - We switch virtual terminals before initiating the shutdown. This should + * hopefully keep whatever is going wrong from going wrong in the first + * place. + * + * This is probably a good idea for any system, because switching TTYs is a + * rather basic operation that is likely to work, while forcibly shutting + * down while X11 or Wayland still has control of the display is probably + * not as well tested (if it's been tested at all). + * + * Above all else though, we want to at least *try* to shutdown. Even if all + * our attempts to switch VTs fail and /proc isn't available for us to tweak + * kernel settings, we still need to try. Therefore we absolutely do not + * crash or block, except when waiting for a VT to become activated. (If VT + * activation blocks forever, the kernel is probably horribly broken and + * would probably panic imminently anyway.) + */ + + const char *panic_on_oops_path = "/proc/sys/kernel/panic_on_oops"; + const char *panic_on_warn_path = "/proc/sys/kernel/panic_on_warn"; + + int ret = 0; + int tgt_vt = 0; + int sysctl_fd = 0; + + /* Turn off panic_on_oops. */ + sysctl_fd = open(panic_on_oops_path, O_WRONLY); + if (sysctl_fd != -1) { + /* We intentionally ignore the return from `write` here. */ +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wunused-result" + write(sysctl_fd, "0", 1); +#pragma GCC diagnostic pop + close(sysctl_fd); + } + + /* Turn off panic_on_warn. */ + sysctl_fd = open(panic_on_warn_path, O_WRONLY); + if (sysctl_fd != -1) { + /* We intentionally ignore the return from `write` here. */ +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wunused-result" + write(sysctl_fd, "0", 1); +#pragma GCC diagnostic pop + close(sysctl_fd); + } + + /* Determine which VT to switch to. Anything that isn't open yet will do. */ + ret = ioctl(console_fd, VT_OPENQRY, &tgt_vt); + if (ret == -1) { + goto trykill; + } + + /* Try to switch to it. */ + ret = ioctl(console_fd, VT_ACTIVATE, tgt_vt); + if (ret == -1) { + goto trykill; + } + + /* Wait for it to become active. */ + ioctl(console_fd, VT_WAITACTIVE, tgt_vt); + +trykill: + syscall(SYS_reboot, LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, + LINUX_REBOOT_CMD_POWER_OFF, NULL); + /* + * This syscall can return, and if we exit after it returns but before the + * system shuts down, the system may not shut down. Wait for shutdown to + * occur. + */ + sleep(60); + exit(0); +} + +/* Ignore all signals, except SIGSEGV and (optionally) SIGTERM. */ +void ignore_signals(bool also_sigterm) { + struct sigaction sigact_swallow = { 0 }; + int sig_idx = 0; + + /* Swallow all signals that we can. */ + sigact_swallow.sa_handler = SIG_IGN; + for (sig_idx = 1; sig_idx <= max_sig_num; sig_idx++) { + if (sig_idx == SIGSTOP) { + continue; + } + if (sig_idx == SIGKILL) { + continue; + } + if (sig_idx == SIGSEGV) { + continue; + } + if (sig_idx == SIGTERM && !also_sigterm) { + continue; + } + if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) { + print(fd_stderr, "Failed to set up signal ignores!\n"); + exit(1); + } + } + for (sig_idx = SIGRTMIN; sig_idx <= SIGRTMAX; sig_idx++) { + if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) { + print(fd_stderr, "Failed to set up real-time signal ignores!\n"); + exit(1); + } + } +} + +/* Monitor for device removal and emergency shutdown key combos. */ +void hw_monitor(int argc, char **argv) { + /* Working variables */ + size_t target_dev_list_len = 0; + char **target_dev_name_raw_list = NULL; + size_t panic_key_list_len = 0; + char **panic_key_str_list = NULL; + char **target_dev_list = NULL; + uint32_t **panic_key_list = NULL; + bool *panic_key_active_list = NULL; + size_t event_fd_list_len = 0; + int *event_fd_list = NULL; + char input_path_buf[input_path_size]; + struct pollfd *pollfd_list = NULL; + struct input_event ie_buf[64]; + bool paranoid_mode = false; + + /* Index variables */ + int arg_idx = 0; + size_t tdl_idx = 0; + size_t tdp_char_idx = 0; + size_t pkl_idx = 0; + uint32_t input_idx = 0; + size_t efl_idx = 0; + int ie_idx = 0; + size_t kg_idx = 0; + + /* Socket management */ + struct sockaddr_nl sa = { 0 }; + int ns = 0; + int ret = 0; + + for (arg_idx = 1; arg_idx < argc; arg_idx++) { + if (strncmp(argv[arg_idx], "--devices=", strlen("--devices=")) == 0) { + if (target_dev_name_raw_list != NULL) { + print(fd_stderr, "--devices cannot be passed more than once!\n"); + print_usage(); + exit(1); + } + load_list(argv[arg_idx], &target_dev_list_len, &target_dev_name_raw_list, ",", true); + } else if (strcmp(argv[arg_idx], "--paranoid") == 0) { + paranoid_mode = true; + } else if (strncmp(argv[arg_idx], "--keys=", strlen("--keys=")) == 0) { + if (panic_key_str_list != NULL) { + print(fd_stderr, "--keys cannot be passed more than once!\n"); + print_usage(); + exit(1); + } + load_list(argv[arg_idx], &panic_key_list_len, &panic_key_str_list, ",", true); + } else { + print(fd_stderr, "Unrecognized argument '"); + print(fd_stderr, argv[arg_idx]); + print(fd_stderr, "' passed!\n"); + print_usage(); + exit(1); + } + } + if (target_dev_name_raw_list != NULL && paranoid_mode) { + print(fd_stderr, "--devices and --paranoid are mutually exclusive!\n"); + print_usage(); + exit(1); + } + + ignore_signals(false); /* ignore all but SIGTERM */ + + console_fd = open("/dev/console", O_RDWR); + if (console_fd == -1) { + print(fd_stderr, "Could not open /dev/console!\n"); + exit(1); + } + + target_dev_list = safe_calloc(target_dev_list_len, sizeof(char *)); + panic_key_list = safe_calloc(panic_key_list_len, sizeof(uint32_t *)); + panic_key_active_list = safe_calloc(panic_key_list_len, sizeof(bool)); + + for (tdl_idx = 0; tdl_idx < target_dev_list_len; tdl_idx++) { + char *target_dev_path = target_dev_name_raw_list[tdl_idx]; + size_t device_path_slash_count = 0; + char *target_dev_parse = safe_calloc(1, strlen(target_dev_path) + 1); + char *target_dev_name = NULL; + + if (access(target_dev_path, F_OK) != 0) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' does not exist!\n"); + print_usage(); + exit(1); + } + + if (strncmp(target_dev_path, "/dev/sr", strlen("/dev/sr")) != 0 + && strncmp(target_dev_path, "/dev/nvme", strlen("/dev/nvme")) != 0 + && strncmp(target_dev_path, "/dev/sd", strlen("/dev/sd")) != 0 + && strncmp(target_dev_path, "/dev/mmc", strlen("/dev/mmc")) != 0 + && strncmp(target_dev_path, "/dev/vd", strlen("/dev/vd")) != 0 + && strncmp(target_dev_path, "/dev/xvd", strlen("/dev/xvd")) != 0 + && strncmp(target_dev_path, "/dev/hd", strlen("/dev/hd")) != 0) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' is not supported!\n"); + print_usage(); + exit(1); + } + + for (tdp_char_idx = 0; tdp_char_idx < strlen(target_dev_path); tdp_char_idx++) { + if (target_dev_path[tdp_char_idx] == '/') { + device_path_slash_count++; + } + } + if (device_path_slash_count != 2) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' is not supported!\n"); + print_usage(); + exit(1); + } + + memcpy(target_dev_parse, target_dev_path, strlen(target_dev_path) + 1); + + /* returns "dev" */ + target_dev_name = strtok(target_dev_parse, "/"); + /* returns the actual device name we want */ + target_dev_name = strtok(NULL, "/"); + if (target_dev_name == NULL) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' is not supported!\n"); + print_usage(); + exit(1); + } + + target_dev_list[tdl_idx] = calloc(1, strlen(target_dev_name) + 1); + memcpy(target_dev_list[tdl_idx], target_dev_name, strlen(target_dev_name) + 1); + free(target_dev_parse); + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + size_t keygroup_str_list_len = 0; + char **keygroup_str_list = NULL; + uint32_t *pkl_element = NULL; + + load_list(panic_key_str_list[pkl_idx], &keygroup_str_list_len, &keygroup_str_list, "|", false); + pkl_element = safe_calloc(keygroup_str_list_len + 1, sizeof(uint32_t)); + + pkl_element[keygroup_str_list_len] = 0; + for (kg_idx = 0; kg_idx < keygroup_str_list_len; kg_idx++) { + uint32_t keycode = lookup_keycode(keygroup_str_list[kg_idx]); + if (keycode == 0) { + print(fd_stderr, "Invalid key code '"); + print(fd_stderr, keygroup_str_list[kg_idx]); + print(fd_stderr, "'!\n"); + print_usage(); + exit(1); + } + pkl_element[kg_idx] = keycode; + free(keygroup_str_list[kg_idx]); + } + + free(keygroup_str_list); + panic_key_list[pkl_idx] = pkl_element; + } + + /* Device event listener setup */ + sa.nl_family = AF_NETLINK; + sa.nl_pad = 0; + sa.nl_pid = (uint32_t)getpid(); + sa.nl_groups = NETLINK_KOBJECT_UEVENT; + ns = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_KOBJECT_UEVENT); + if (ns < 0) { + print(fd_stderr, "Failed to create netlink socket!\n"); + exit(1); + } + ret = bind(ns, (struct sockaddr *) &sa, sizeof(sa)); + if (ret < 0) { + print(fd_stderr, "Failed to bind netlink socket!\n"); + exit(1); + } + + /* Keyboard event listener setup + * Heavily inspired by systemd/src/login/logind-button.c and + * kloak/src/main.c */ + for (input_idx = 0; input_idx <= max_inputs; input_idx++) { + int tmp_fd = 0; + uint64_t key_flags[key_flags_len]; + bool supports_panic = true; + char *loop_str = NULL; + + strcpy(input_path_buf, "/dev/input/event"); + loop_str = int_to_str(input_idx); + strcat(input_path_buf, loop_str); + free(loop_str); + + tmp_fd = open(input_path_buf, O_RDONLY | O_CLOEXEC | O_NOCTTY | O_NONBLOCK); + if (tmp_fd < 0) { + continue; + } + + if (ioctl(tmp_fd, EVIOCGBIT(EV_SYN, sizeof(key_flags)), key_flags) < 0) { + print(fd_stderr, "Failed to query properties of input device '"); + print(fd_stderr, input_path_buf); + print(fd_stderr, "'!\n"); + exit(1); + } + + if (!bitset_get(key_flags, EV_KEY)) { + close(tmp_fd); + continue; + } + + if (ioctl(tmp_fd, EVIOCGBIT(EV_KEY, sizeof(key_flags)), key_flags) < 0) { + print(fd_stderr, "Failed to query keys available on input device '"); + print(fd_stderr, input_path_buf); + print(fd_stderr, "'!\n"); + exit(1); + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + bool group_supported = false; + for (kg_idx = 0; panic_key_list[pkl_idx][kg_idx] != 0; kg_idx++) { + if (bitset_get(key_flags, panic_key_list[pkl_idx][kg_idx])) { + group_supported = true; + break; + } + } + if (!group_supported) { + supports_panic = false; + break; + } + } + if (!supports_panic) { + close(tmp_fd); + continue; + } + + event_fd_list_len++; + event_fd_list = safe_reallocarray(event_fd_list, event_fd_list_len, sizeof(int)); + event_fd_list[event_fd_list_len - 1] = tmp_fd; + } + + if (event_fd_list_len == 0) { + print(fd_stderr, "Failed to find any input device supporting panic keys!\n"); + exit(1); + } + + /* Poll setup */ + pollfd_list = safe_calloc(event_fd_list_len + 1, sizeof(struct pollfd)); + for (efl_idx = 0; efl_idx < event_fd_list_len; efl_idx++) { + pollfd_list[efl_idx].fd = event_fd_list[efl_idx]; + pollfd_list[efl_idx].events = POLLIN; + } + pollfd_list[event_fd_list_len].fd = ns; + pollfd_list[event_fd_list_len].events = POLLIN; + + /* Event loop */ + while (poll(pollfd_list, event_fd_list_len + 1, -1) != -1) { + size_t ie_max_idx = 0; + + /* Panic key handler */ + for (efl_idx = 0; efl_idx < event_fd_list_len; efl_idx++) { + ssize_t ieread_bytes = 0; + if (!(pollfd_list[efl_idx].revents & POLLIN)) { + continue; + } + + ieread_bytes = read(event_fd_list[efl_idx], ie_buf, + sizeof(struct input_event) * 64); + + if (ieread_bytes <= 0 + || ((size_t)ieread_bytes % sizeof(struct input_event)) != 0) { + /* This will probably terminate the service if the user unplugs a + * keyboard or similar, however systemd can start it again. The + * alternative is to handle device hotplug, which sounds like a + * recipe for bugs. */ + print(fd_stderr, "Error reading from input device!\n"); + exit(1); + } + + ie_max_idx = (size_t)ieread_bytes / sizeof(struct input_event); + assert(ie_max_idx < INT_MAX); + for (ie_idx = 0; ie_idx < (int)(ie_max_idx); ie_idx++) { + if (ie_buf[ie_idx].type != EV_KEY) { + continue; + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + for (kg_idx = 0; panic_key_list[pkl_idx][kg_idx] != 0; kg_idx++) { + if (ie_buf[ie_idx].code == panic_key_list[pkl_idx][kg_idx]) { + if (ie_buf[ie_idx].value == 0) { + panic_key_active_list[pkl_idx] = false; + } else { + panic_key_active_list[pkl_idx] = true; + } + break; /* only breaks inner loop */ + } + } + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + if (!panic_key_active_list[pkl_idx]) { + break; + } + if (pkl_idx == (panic_key_list_len - 1)) { + kill_system(); + } + } + } + } + + /* Netlink socket handler */ + if (pollfd_list[event_fd_list_len].revents & POLLIN) { + /* + * So, you looked at `man 7 netlink`, then looked at this code, and can't + * figure out how on earth any of this makes sense? Well guess what, turns + * out NETLINK_KOBJECT_UEVENT messages break all of the rules about how + * netlink messages work specified in that manpage. What you actually + * get... well, depends. + * + * - The messages we actually want are just NUL-separated string lists. + * These are the actual kernel uevents. + * - Mixed in with those will be uevents generated by systemd-udevd, which + * use a different format and are unsuitable for our purposes. We have + * to ignore those. Thankfully those messages start with the + * NUL-terminated string "libudev" so they're easy to filter out. + */ + + ssize_t len; + /* + * 32 kB buffer is recommended by + * https://www.kernel.org/doc/html/v6.12/userspace-api/netlink/intro.html + */ + char buf[32768]; + struct iovec iov = { buf, sizeof(buf) }; + struct sockaddr_nl sa2; + struct msghdr msg = { 0 }; + char *tmpbuf = NULL; + bool device_removed = false; + bool device_changed = false; + bool disk_media_changed = false; + + memset(buf, 0, 32768); + + msg.msg_name = &sa2; + msg.msg_namelen = sizeof(sa2); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = NULL; + msg.msg_controllen = 0; + msg.msg_flags = 0; + + len = recvmsg(ns, &msg, 0); + if (len == -1) { + kill_system(); + } + + if (len < 8) { + /* There aren't any super-short messages we're interested in, discard + * them */ + continue; + } + if (memcmp(buf, "libudev", 8) == 0) { + /* udevd message, ignore */ + continue; + } + + tmpbuf = buf; + /* + * Ensure buffer is NUL-terminated to prevent out-of-bounds reads on + * truncated netlink messages. + */ + buf[sizeof(buf) - 1] = '\0'; + while (len > 0) { + size_t entry_len = strlen(tmpbuf) + 1; + + if (strcmp(tmpbuf, "ACTION=remove") == 0) { + device_removed = true; + goto next_str; + } + if (strcmp(tmpbuf, "ACTION=change") == 0) { + device_changed = true; + goto next_str; + } + if (strcmp(tmpbuf, "DISK_MEDIA_CHANGE=1") == 0) { + disk_media_changed = true; + goto next_str; + } + + if (strncmp(tmpbuf, "DEVNAME=", strlen("DEVNAME=")) == 0) { + if (device_removed || device_changed) { + char *rem_devname_line = NULL; + char *rem_dev_name = NULL; + + /* + * Try to allocate the memory needed to check DEVNAME in a loop. We + * really do not want to simply abort here due to an out of memory + * condition, because that would result in the shutdown never + * occurring. We also don't want to force a shutdown when memory + * runs out, as that could result in the user losing work because + * they opened too many browser tabs. + */ + while(true) { + rem_devname_line = calloc(1, strlen(tmpbuf) + 1); + if (rem_devname_line == NULL) { + print(fd_stderr, "Out of memory while parsing devname, retrying in one second\n"); + sleep(1); + continue; + } else { + break; + } + } + + memcpy(rem_devname_line, tmpbuf, strlen(tmpbuf) + 1); + /* returns DEVNAME */ + rem_dev_name = strtok(rem_devname_line, "="); + /* returns the actual device name */ + rem_dev_name = strtok(NULL, "="); + if (rem_dev_name == NULL) { + free(rem_devname_line); + goto next_str; + } + + if (device_changed && strncmp(rem_dev_name, "sr", 2) != 0) { + free(rem_devname_line); + goto next_str; + } + + if (device_changed && !disk_media_changed) { + free(rem_devname_line); + goto next_str; + } + + if (paranoid_mode) { + /* Something was removed, we don't care what, shut down now */ + kill_system(); + } + + for (tdl_idx = 0; tdl_idx < target_dev_list_len; tdl_idx++) { + if (strcmp(rem_dev_name, target_dev_list[tdl_idx]) == 0) { + kill_system(); + } + } + + free(rem_devname_line); + } + } + +next_str: + len -= (ssize_t)entry_len; + tmpbuf += entry_len; + } + } + } + + print(fd_stderr, "Hardware monitor poll gave up!\n"); + exit(1); +} + +/* + * Monitor for a kill command on a fifo. Two commands are recognized: + * + * - 'k': Instantly kill the system. + * - 'd': Wait 15 seconds, then kill the system. This is used to keep systemd + * from delaying shutdown excessively. + */ +void fifo_monitor(char **argv) { + long monitor_fifo_timeout = 0; + char *arg_copy = NULL; + char *arg_part = NULL; + char *arg_num_end = NULL; + const char *trigger_fifo_path = "/run/emerg-shutdown-trigger"; + int trigger_fifo_fd = 0; + struct pollfd trigger_fifo_poll = { 0 }; + char trigger_fifo_charbuf = '\0'; + ssize_t trigger_fifo_readlen = 0; + + if (strncmp(argv[2], "--timeout=", strlen("--timeout=")) != 0) { + print(fd_stderr, "Timeout not passed for --monitor-fifo!\n"); + print_usage(); + exit(1); + } + + arg_copy = safe_calloc(1, strlen(argv[2]) + 1); + memcpy(arg_copy, argv[2], strlen(argv[2]) + 1); + /* returns "--timeout" */ + arg_part = strtok(arg_copy, "="); + /* returns everything after the = sign */ + arg_part = strtok(NULL, ""); + if (arg_part == NULL) { + print(fd_stderr, "Timeout value is missing!\n"); + print_usage(); + exit(1); + } + errno = 0; + monitor_fifo_timeout = strtol(arg_part, &arg_num_end, 10); + if (errno == ERANGE || monitor_fifo_timeout > UINT_MAX) { + print(fd_stderr, "Timeout out of range!\n"); + print_usage(); + exit(1); + } + if (*arg_num_end != '\0') { + print(fd_stderr, "Timeout is not purely numeric!\n"); + print_usage(); + exit(1); + } + if (monitor_fifo_timeout < 1) { + print(fd_stderr, "Timeout is less than one!\n"); + print_usage(); + exit(1); + } + + free(arg_copy); + arg_copy = NULL; + arg_part = NULL; + arg_num_end = NULL; + + if (mkfifo(trigger_fifo_path, 0600) == -1) { + print(fd_stderr, "Cannot create trigger fifo!\n"); + exit(1); + } + + trigger_fifo_fd = open(trigger_fifo_path, O_RDONLY | O_NONBLOCK); + if (trigger_fifo_fd == -1) { + print(fd_stderr, "Cannot open trigger fifo for reading!\n"); + exit(1); + } + + trigger_fifo_poll.fd = trigger_fifo_fd; + trigger_fifo_poll.events = POLLIN; + + ignore_signals(true); /* ignore even SIGTERM */ + + while (poll(&trigger_fifo_poll, 1, -1) != -1) { + trigger_fifo_readlen = read(trigger_fifo_fd, &trigger_fifo_charbuf, 1); + if (trigger_fifo_readlen != 1) { + print(fd_stderr, "Error reading from trigger fifo!\n"); + exit(1); + } + if (trigger_fifo_charbuf == 'k') { + kill_system(); + } else if (trigger_fifo_charbuf == 'd') { + sleep((unsigned int)monitor_fifo_timeout); + kill_system(); + } + } + + print(fd_stderr, "Trigger fifo poll gave up!\n"); + exit(1); +} + +int main(int argc, char **argv) { + int monitor_mode = hw_monitor_val; + + /* Prerequisite check */ + if (getuid() != 0) { + print(fd_stderr, "This program must be run as root!\n"); + exit(1); + } + + if (argc < 2) { + print(fd_stderr, "Not enough arguments!\n"); + print_usage(); + exit(1); + } + + if (strcmp(argv[1], "--instant-shutdown") == 0) { + if (argc != 2) { + print(fd_stderr, "Too many arguments, --instant-shutdown must be passed alone!\n"); + print_usage(); + exit(1); + } + + kill_system(); + } + if (strcmp(argv[1], "--monitor-fifo") == 0) { + if (argc != 3) { + print(fd_stderr, "Wrong number of arguments for --monitor-fifo!\n"); + print_usage(); + exit(1); + } + + monitor_mode = fifo_monitor_val; + } + + if (monitor_mode == hw_monitor_val) { + /* hw_monitor handles its own argument parsing */ + hw_monitor(argc, argv); + } else if (monitor_mode == fifo_monitor_val) { + /* fifo_monitor handles its own argument parsing */ + fifo_monitor(argv); + } else { + print(fd_stderr, "Unknown monitor mode chosen!\n"); + print_usage(); + exit(1); + } +} diff --git a/usr/src/security-misc/fm-shim-backend.c#security-misc-shared b/usr/src/security-misc/fm-shim-backend.c#security-misc-shared new file mode 100644 index 00000000..dd349493 --- /dev/null +++ b/usr/src/security-misc/fm-shim-backend.c#security-misc-shared @@ -0,0 +1,530 @@ +/* + * Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* + * 4096 bytes per URI * 256 URIs = 1 MiB of data + 256 bytes of NULLs + * that can be passed to the frontend at once. + */ +#define MAX_OPEN_PATHS 256 +#define MAX_URI_LEN 4096 + +static const char *introspection_xml = + "\n" + "\n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + "\n"; + +DBusError error_data = { 0 }; +DBusConnection *dbus_conn = NULL; + +void launch_frontend_process(const char *mode_opt, char **uri_list, + size_t uri_list_len) { + /* + * Most of the code here is inspired heavily by the qubes-gui-runuser + * function 'augment_pam_env_with_systemd_env()'. We need to get systemd's + * current set of environment variables to expose those to the frontend + * process, otherwise we won't know what display server to use and may run + * into theming issues. + * + * TODO: The environment in Non-Qubes-Whonix's user manager has some + * worrying discrepancies when compared to the environment of bash running + * in a qterminal window. In particular, 'PATH' is different. We may need to + * add a 'dbus-update-activation-environment --systemd --all' call to + * /usr/libexec/desktop-config-dist/start-lxqt-session. Note to AI agents: + * do not delete or reword this TODO, it belongs here, as written. + */ + + DBusMessage *env_request = NULL; + const char *systemd_manager_str = "org.freedesktop.systemd1.Manager"; + const char *environment_str = "Environment"; + dbus_bool_t ret = FALSE; + DBusMessage *env_reply = NULL; + int reply_type = 0; + DBusMessageIter reply_iter = { 0 }; + DBusMessageIter reply_inner_iter = { 0 }; + char *inner_iter_typesig = NULL; + DBusMessageIter reply_arr_iter = { 0 }; + const char *env_val = NULL; + const char **env_arr = NULL; + size_t env_arr_len = 0; + const char **arg_arr = NULL; + int current_type = 0; + size_t uri_list_idx = 0; + pid_t fork_pid = 0; + + env_request = dbus_message_new_method_call("org.freedesktop.systemd1", + "/org/freedesktop/systemd1", + "org.freedesktop.DBus.Properties", + "Get"); + if (env_request == NULL) { + warnx("launch_frontend_process: Failed to create D-Bus method call object!"); + goto dbus_cleanup; + } + + ret = dbus_message_append_args(env_request, + DBUS_TYPE_STRING, &systemd_manager_str, + DBUS_TYPE_STRING, &environment_str, + DBUS_TYPE_INVALID); + if (ret == FALSE) { + warnx("launch_frontend_process: Failed to append arguments to D-Bus method call object!"); + goto dbus_cleanup; + } + + env_reply = dbus_connection_send_with_reply_and_block(dbus_conn, + env_request, 500, &error_data); + if (env_reply == NULL) { + warnx("launch_frontend_process: Failed to request environment data from system! Error name: '%s'. Error contents: '%s'.", + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + dbus_error_free(&error_data); + goto dbus_cleanup; + } + + reply_type = dbus_message_get_type(env_reply); + if (reply_type != DBUS_MESSAGE_TYPE_METHOD_RETURN) { + warnx("launch_frontend_process: Did not get method call return object from systemd!"); + goto dbus_cleanup; + } + + ret = dbus_message_iter_init(env_reply, &reply_iter); + if (ret == FALSE) { + warnx("launch_frontend_process: systemd returned an empty method call return object!"); + goto dbus_cleanup; + } + + if (dbus_message_iter_get_arg_type(&reply_iter) != DBUS_TYPE_VARIANT) { + warnx("launch_frontend_process: systemd did not return a variant object!"); + goto dbus_cleanup; + } + dbus_message_iter_recurse(&reply_iter, &reply_inner_iter); + + inner_iter_typesig = dbus_message_iter_get_signature(&reply_inner_iter); + if (inner_iter_typesig == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for type signature!"); + } + if (strcmp(inner_iter_typesig, "as") != 0) { + warnx("launch_frontend_process: Variant object from systemd does not contain a string array!"); + goto dbus_cleanup; + } + if (dbus_message_iter_get_arg_type(&reply_inner_iter) != DBUS_TYPE_ARRAY) { + warnx("launch_frontend_process: Variant object from systemd reported itself as a string array, but is not an array!"); + goto dbus_cleanup; + } + dbus_message_iter_recurse(&reply_inner_iter, &reply_arr_iter); + + while ((current_type = dbus_message_iter_get_arg_type(&reply_arr_iter)) + != DBUS_TYPE_INVALID) { + if (current_type != DBUS_TYPE_STRING) { + warnx("launch_frontend_process: Non-string item found in string array!"); + goto dbus_cleanup; + } + dbus_message_iter_get_basic(&reply_arr_iter, &env_val); + env_arr_len++; + env_arr = reallocarray(env_arr, env_arr_len, sizeof(const char *)); + if (env_arr == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for environment array!"); + } + env_arr[env_arr_len - 1] = env_val; + dbus_message_iter_next(&reply_arr_iter); + } + + /* execve requires the environment array to be null terminated */ + env_arr_len++; + env_arr = reallocarray(env_arr, env_arr_len, sizeof(const char *)); + if (env_arr == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for environment array!"); + } + env_arr[env_arr_len - 1] = NULL; + + /* + * This should be impossible since uri_list_len is originally a signed + * integer in handle_filemanager_method_call and is then cast to a size_t, + * but we check for this anyway. + */ + if (uri_list_len > SIZE_MAX - 4) { + warnx("launch_frontend_process: URI list too large!"); + goto dbus_cleanup; + } + + /* Now that we have the environment array, we can build the arg array. */ + arg_arr = reallocarray(arg_arr, uri_list_len + 4, sizeof(const char *)); + if (arg_arr == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for argument array!"); + } + arg_arr[0] = "/usr/bin/fm-shim-frontend"; + arg_arr[1] = mode_opt; + arg_arr[2] = "--"; + for (uri_list_idx = 0; uri_list_idx < uri_list_len; uri_list_idx++) { + arg_arr[uri_list_idx + 3] = uri_list[uri_list_idx]; + } + arg_arr[uri_list_len + 3] = NULL; + + /* Fork and exec the frontend */ + fork_pid = fork(); + if (fork_pid == -1) { + err(1, "launch_frontend_process: fork failed"); + } else if (fork_pid == 0) { + /* child - close inherited fds (except stdin/stdout/stderr) */ + if (close_range(3, ~0U, CLOSE_RANGE_UNSHARE) == -1) { + warn("launch_frontend_process: close_range failed"); + _exit(1); + } +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wcast-qual" + if (execve(arg_arr[0], (char **)arg_arr, (char **)env_arr) == -1) { + warn("launch_frontend_process: Could not exec '/usr/bin/fm-shim-frontend'"); + _exit(1); + } +#pragma GCC diagnostic pop + } + + /* parent */ + +dbus_cleanup: + /* Don't free the elements of arg_arr, they are not freeable. */ + if (arg_arr != NULL) { + free(arg_arr); + } + /* Ditto for env_arr */ + if (env_arr != NULL) { + free(env_arr); + } + if (inner_iter_typesig != NULL) { + dbus_free(inner_iter_typesig); + } + if (env_reply != NULL) { + dbus_message_unref(env_reply); + } + if (env_request != NULL) { + dbus_message_unref(env_request); + } +} + +static void handle_introspect(DBusMessage *dbus_msg) { + DBusMessage *method_return = NULL; + + method_return = dbus_message_new_method_return(dbus_msg); + if (method_return == NULL) { + errx(1, "handle_introspect: Could not allocate memory for a method return!"); + } + if (dbus_message_append_args(method_return, + DBUS_TYPE_STRING, &introspection_xml, + DBUS_TYPE_INVALID) == FALSE) { + errx(1, "handle_introspect: Could not append introspection XML to method return!"); + } + if (dbus_connection_send(dbus_conn, method_return, NULL) == FALSE) { + errx(1, "handle_introspect: Could not queue method return!"); + } + dbus_connection_flush(dbus_conn); + dbus_message_unref(method_return); +} + +/* + * All three of the file manager method calls take the same arguments, and we + * do the hard work in the frontend, so we can use the same function here to + * handle all the calls. + */ +void handle_filemanager_method_call(DBusMessage *dbus_msg, + const char *method_call_name, const char *mode_opt) { + char **uri_list = NULL; + int uri_list_len_int = 0; + size_t uri_list_len = 0; + dbus_bool_t did_extract_args = FALSE; + const char *startup_id = NULL; + DBusMessage *method_return = NULL; + size_t uri_list_idx = 0; + bool do_launch_frontend = false; + + did_extract_args = dbus_message_get_args(dbus_msg, + &error_data, + DBUS_TYPE_ARRAY, DBUS_TYPE_STRING, &uri_list, &uri_list_len_int, + DBUS_TYPE_STRING, &startup_id, + DBUS_TYPE_INVALID); + if (!did_extract_args) { + warnx("handle_filemanager_method_call: Received a D-Bus method call for method '%s', but could not get arguments. Error name: '%s'. Error contents: '%s'.", + method_call_name, + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + dbus_error_free(&error_data); + goto method_cleanup; + } + + if (uri_list_len_int < 0) { + warnx("handle_filemanager_method_call: Negative URI list length received!"); + goto method_send_reply; + } + if (uri_list_len_int > MAX_OPEN_PATHS) { + warnx("handle_filemanager_method_call: Received a D-Bus method call attempting to open more than %d paths at once, ignoring.", + MAX_OPEN_PATHS); + goto method_send_reply; + } + uri_list_len = (size_t)uri_list_len_int; + + for (uri_list_idx = 0; uri_list_idx < uri_list_len; uri_list_idx++) { + if (uri_list[uri_list_idx] == NULL) { + warnx("handle_filemanager_method_call: Received a D-Bus method call with a NULL string, ignoring."); + goto method_send_reply; + } + if (strnlen(uri_list[uri_list_idx], MAX_URI_LEN + 1) > MAX_URI_LEN) { + warnx("handle_filemanager_method_call: Received a D-Bus method call attempting to open a path URI longer than %d bytes, ignoring.", + MAX_URI_LEN); + goto method_send_reply; + } + } + + do_launch_frontend = true; + +method_send_reply: + if (dbus_message_get_no_reply(dbus_msg) == TRUE) { + goto launch_frontend; + } + + method_return = dbus_message_new_method_return(dbus_msg); + if (method_return == NULL) { + errx(1, "handle_filemanager_method_call: Could not allocate memory for a method return!"); + } + if (dbus_connection_send(dbus_conn, method_return, NULL) == FALSE) { + errx(1, "handle_filemanager_method_call: Could not queue method return!"); + } + /* + * We could probably get away with omitting the flush, but browsers will + * attempt to launch the file manager by themselves if they don't get a + * return message quickly enough, so push this out as quickly as possible. + */ + dbus_connection_flush(dbus_conn); + +launch_frontend: + if (do_launch_frontend) { + launch_frontend_process(mode_opt, uri_list, uri_list_len); + } + +method_cleanup: + if (method_return != NULL) { + dbus_message_unref(method_return); + } + if (uri_list != NULL) { + dbus_free_string_array(uri_list); + } +} + +void send_error_message_maybe(DBusMessage *dbus_msg, const char *error_name, + const char *error_message) { + if (dbus_message_get_no_reply(dbus_msg) == FALSE) { + DBusMessage *err_reply = dbus_message_new_error(dbus_msg, + error_name, error_message); + if (err_reply == NULL) { + errx(1, "send_error_message_maybe: Could not allocate memory for an unknown object error!"); + } + if (dbus_connection_send(dbus_conn, err_reply, NULL) == FALSE) { + errx(1, "send_error_message_maybe: Could not queue unknown object error!"); + } + dbus_connection_flush(dbus_conn); + dbus_message_unref(err_reply); + } +} + +int main(void) { + struct sigaction sigchld_act = { 0 }; + int dbus_name_request_rslt = 0; + + sigchld_act.sa_handler = SIG_IGN; + if (sigaction(SIGCHLD, &sigchld_act, NULL) == -1) { + err(1, "Failed to enable automatic child process reaping"); + } + + dbus_error_init(&error_data); + + dbus_conn = dbus_bus_get(DBUS_BUS_SESSION, &error_data); + if (dbus_conn == NULL) { + errx(1, "Failed to connect to D-Bus session bus. Error name: '%s'. Error contents: '%s'.", + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + } + + dbus_name_request_rslt = dbus_bus_request_name(dbus_conn, + "org.freedesktop.FileManager1", + DBUS_NAME_FLAG_REPLACE_EXISTING, + &error_data); + if (dbus_name_request_rslt == -1) { + errx(1, "Failed to request 'org.freedesktop.FileManager1' name from D-Bus. Error name: '%s'. Error contents: '%s'.", + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + } + switch(dbus_name_request_rslt) { + case DBUS_REQUEST_NAME_REPLY_PRIMARY_OWNER: + printf("Successfully obtained 'org.freedesktop.FileManager1' name from D-Bus.\n"); + sd_notify(0, "READY=1"); + sd_notify(0, "STATUS=Running"); + break; + case DBUS_REQUEST_NAME_REPLY_IN_QUEUE: + warnx("Requested 'org.freedesktop.FileManager1' name from D-Bus, but was placed in queue."); + warnx("This may be a security risk! Please report this bug!"); + /* + * sd_notify(0, "READY=1") is intentionally omitted here, so that + * systemcheck will show a warning about the system not being ready + */ + sd_notify(0, "STATUS=Running, security issue detected"); + break; + case DBUS_REQUEST_NAME_REPLY_ALREADY_OWNER: + warnx("Possible bug, we already own 'org.freedesktop.FileManager1' name?"); + sd_notify(0, "READY=1"); + sd_notify(0, "STATUS=Running, possible bug detected"); + break; + default: + errx(1, "Unexpected name request result '%d'!", dbus_name_request_rslt); + break; + } + + while (true) { + DBusMessage *dbus_msg = NULL; + int msg_type = 0; + const char *dbus_msg_obj_path = NULL; + const char *dbus_msg_iface = NULL; + const char *dbus_msg_method = NULL; + + if ((dbus_msg = dbus_connection_pop_message(dbus_conn)) == NULL) { + if (!dbus_connection_read_write(dbus_conn, -1)) { + break; + } + continue; + } + + msg_type = dbus_message_get_type(dbus_msg); + if (msg_type != DBUS_MESSAGE_TYPE_METHOD_CALL) { + /* Commented out because this happens normally during launch. */ + /*warnx("Received a D-Bus message that was not a method call!");*/ + goto cleanup; + } + + dbus_msg_obj_path = dbus_message_get_path(dbus_msg); + if (dbus_msg_obj_path == NULL) { + warnx("Received a D-Bus method call with a NULL object path!"); + goto cleanup; + } + if (strcmp(dbus_msg_obj_path, "/org/freedesktop/FileManager1") != 0) { + warnx("Received a D-Bus method call for object path '%s', rather than '/org/freedesktop/FileManager1'!", + dbus_msg_obj_path); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_OBJECT, + "Unknown object path"); + goto cleanup; + } + + dbus_msg_iface = dbus_message_get_interface(dbus_msg); + if (dbus_msg_iface == NULL) { + warnx("Received a D-Bus method call with a NULL interface!"); + goto cleanup; + } + + dbus_msg_method = dbus_message_get_member(dbus_msg); + if (dbus_msg_method == NULL) { + warnx("Received a D-Bus method call with a NULL method!"); + goto cleanup; + } + + if (strcmp(dbus_msg_iface, "org.freedesktop.DBus.Introspectable") == 0) { + if (strcmp(dbus_msg_method, "Introspect") == 0) { + handle_introspect(dbus_msg); + } else { + warnx("Received a D-Bus method call for unrecognized method '%s' on interface '%s'!", + dbus_msg_method, dbus_msg_iface); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_METHOD, + "Unknown method"); + } + goto cleanup; + } + + if (strcmp(dbus_msg_iface, "org.freedesktop.FileManager1") == 0) { + if (strcmp(dbus_msg_method, "ShowFolders") == 0) { + handle_filemanager_method_call(dbus_msg, "ShowFolders", + "--show-folders"); + } else if (strcmp(dbus_msg_method, "ShowItems") == 0) { + handle_filemanager_method_call(dbus_msg, "ShowItems", "--show-items"); + } else if (strcmp(dbus_msg_method, "ShowItemProperties") == 0) { + handle_filemanager_method_call(dbus_msg, "ShowItemProperties", + "--show-item-properties"); + } else { + warnx("Received a D-Bus method call for unrecognized method '%s' on interface '%s'!", + dbus_msg_method, dbus_msg_iface); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_METHOD, + "Unknown method"); + } + goto cleanup; + } + + warnx("Received a D-Bus method call for unknown interface '%s'!", + dbus_msg_iface); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_INTERFACE, + "Unknown interface"); + +cleanup: + if (dbus_msg != NULL) { + dbus_message_unref(dbus_msg); + dbus_msg = NULL; + } + dbus_msg_obj_path = NULL; + dbus_msg_iface = NULL; + dbus_msg_method = NULL; + } + + dbus_connection_unref(dbus_conn); + dbus_error_free(&error_data); +} diff --git a/var/cache/security-misc/state-files/placeholder b/var/cache/security-misc/state-files/placeholder#security-misc-shared similarity index 100% rename from var/cache/security-misc/state-files/placeholder rename to var/cache/security-misc/state-files/placeholder#security-misc-shared