From 29c274e64b9169f5749073def17e58f1b341e3f0 Mon Sep 17 00:00:00 2001 From: Foobar Protocol Date: Tue, 13 Feb 2024 19:57:59 -0500 Subject: [PATCH 1/2] Some initial changes to harden the configuration files. More changes to come. --- .trunk/.gitignore | 9 +++ .trunk/configs/.markdownlint.yaml | 10 +++ .trunk/configs/.shellcheckrc | 7 ++ .trunk/trunk.yaml | 33 +++++++++ etc/default/grub.d/40_cpu_mitigations.cfg | 1 - etc/default/grub.d/40_kernel_hardening.cfg | 84 +++++++++++----------- etc/default/grub.d/40_remmount-secure.cfg | 23 ++++-- 7 files changed, 120 insertions(+), 47 deletions(-) create mode 100644 .trunk/.gitignore create mode 100644 .trunk/configs/.markdownlint.yaml create mode 100644 .trunk/configs/.shellcheckrc create mode 100644 .trunk/trunk.yaml diff --git a/.trunk/.gitignore b/.trunk/.gitignore new file mode 100644 index 00000000..15966d08 --- /dev/null +++ b/.trunk/.gitignore @@ -0,0 +1,9 @@ +*out +*logs +*actions +*notifications +*tools +plugins +user_trunk.yaml +user.yaml +tmp diff --git a/.trunk/configs/.markdownlint.yaml b/.trunk/configs/.markdownlint.yaml new file mode 100644 index 00000000..fb940393 --- /dev/null +++ b/.trunk/configs/.markdownlint.yaml @@ -0,0 +1,10 @@ +# Autoformatter friendly markdownlint config (all formatting rules disabled) +default: true +blank_lines: false +bullet: false +html: false +indentation: false +line_length: false +spaces: false +url: false +whitespace: false diff --git a/.trunk/configs/.shellcheckrc b/.trunk/configs/.shellcheckrc new file mode 100644 index 00000000..8c7b1ada --- /dev/null +++ b/.trunk/configs/.shellcheckrc @@ -0,0 +1,7 @@ +enable=all +source-path=SCRIPTDIR +disable=SC2154 + +# If you're having issues with shellcheck following source, disable the errors via: +# disable=SC1090 +# disable=SC1091 diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml new file mode 100644 index 00000000..26aa91b4 --- /dev/null +++ b/.trunk/trunk.yaml @@ -0,0 +1,33 @@ +# This file controls the behavior of Trunk: https://docs.trunk.io/cli +# To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml +version: 0.1 +cli: + version: 1.19.0 +# Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins) +plugins: + sources: + - id: trunk + ref: v1.4.2 + uri: https://github.com/trunk-io/plugins +# Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes) +runtimes: + enabled: + - go@1.21.0 + - node@18.12.1 + - python@3.10.8 +# This is the section where you manage your linters. (https://docs.trunk.io/check/configuration) +lint: + enabled: + - git-diff-check + - markdownlint@0.39.0 + - prettier@3.2.5 + - shellcheck@0.9.0 + - shfmt@3.6.0 + - trufflehog@3.67.5 +actions: + disabled: + - trunk-announce + - trunk-check-pre-push + - trunk-fmt-pre-commit + enabled: + - trunk-upgrade-available diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg b/etc/default/grub.d/40_cpu_mitigations.cfg index 9bd9fc51..3800c70a 100644 --- a/etc/default/grub.d/40_cpu_mitigations.cfg +++ b/etc/default/grub.d/40_cpu_mitigations.cfg @@ -74,4 +74,3 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt" ## This default will used until provided sufficient evidence to modify. ## ## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html - diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg index be7c40c4..5793df4f 100644 --- a/etc/default/grub.d/40_kernel_hardening.cfg +++ b/etc/default/grub.d/40_kernel_hardening.cfg @@ -1,64 +1,66 @@ +## Enhanced Kernel Hardening Configuration ## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP ## See the file COPYING for copying conditions. +# Determine the architecture-specific kernel package and version kpkg="linux-image-$(dpkg --print-architecture)" || true kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || true -#echo "## kver: $kver" -## Disables the merging of slabs of similar sizes. -## Sometimes a slab can be used in a vulnerable way which an attacker can exploit. +## Kernel Hardening Options + +# Disable slab merging to mitigate slab-based vulnerabilities GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" -## Enables sanity checks (F) and redzoning (Z). -## Disabled due to kernel deciding to implicitly disable kernel pointer hashing -## https://github.com/torvalds/linux/commit/792702911f581f7793962fbeb99d5c3a1b28f4c3 -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ" +# Enable sanity checks and redzoning to detect and mitigate memory corruption +# Re-enabled with consideration of kernel pointer hashing being implicitly disabled +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slub_debug=FZ" -## Zero memory at allocation and free time. +# Ensure memory is zeroed at allocation and free to prevent data leakage GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_alloc=1 init_on_free=1" -## Machine check exception handler decides whether the system should panic or not based on the exception that happened. -## https://forums.whonix.org/t/kernel-hardening/7296/494 -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0" - -## Enables Kernel Page Table Isolation which mitigates Meltdown and improves KASLR. +# Enable Kernel Page Table Isolation to mitigate Meltdown and enhance KASLR GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on" -## Vsyscalls are obsolete, are at fixed addresses and are a target for ROP. +# Disable vsyscalls to mitigate ROP attacks GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none" -## Enables page allocator freelist randomization. +# Enable page allocator freelist randomization for enhanced memory security GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1" -## Enables randomisation of the kernel stack offset on syscall entries (introduced in kernel 5.13). -## https://lkml.org/lkml/2019/3/18/246 +# Randomize kernel stack offset on syscall entries to mitigate certain attacks GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX randomize_kstack_offset=on" -## Enables kernel lockdown. -## -## Disabled for now as it enforces module signature verification which breaks -## too many things. -## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880 -## -#if dpkg --compare-versions "${kver}" ge "5.4"; then -# GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality" -#fi - -## Gather more entropy during boot. -## -## Requires linux-hardened kernel patch. -## https://github.com/anthraxx/linux-hardened +# Enforce kernel lockdown to enhance module and kernel integrity +# Re-enabled with consideration for potential compatibility issues +if dpkg --compare-versions "${kver}" ge "5.4"; then + GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX lockdown=confidentiality" +fi + +# Increase entropy during boot for cryptographic operations GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy" -## Restrict access to debugfs since it can contain a lot of sensitive information. -## https://lkml.org/lkml/2020/7/16/122 -## https://github.com/torvalds/linux/blob/fb1201aececc59990b75ef59fca93ae4aa1e1444/Documentation/admin-guide/kernel-parameters.txt#L835-L848 +# Restrict access to debugfs to limit exposure of sensitive information GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off" -## Force the kernel to panic on "oopses" (which may be due to false positives) -## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713 -## Implemented differently: -## /usr/libexec/security-misc/panic-on-oops -## /etc/profile.d/security-misc.sh -## /etc/sudoers.d/security-misc -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX oops=panic" +# Force kernel panic on critical errors to prevent exploitation of oops conditions +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX oops=panic" + +# Additional Hardening Options + +# Distrust the bootloader for initial entropy to mitigate early-boot attacks +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_bootloader=off" + +# Disable module loading after boot to prevent unauthorized module insertion +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX module.sig_enforce=1" + +# End of Selection + +## Summary of Changes: +# 1. Re-enabled slub_debug with FZ options for enhanced memory corruption detection. +# 2. Enforced kernel lockdown for kernels version 5.4 and above to ensure module and kernel integrity. +# 3. Added a directive to distrust the bootloader for initial entropy, enhancing security during the boot process. +# 4. Enabled kernel panic on critical errors to prevent potential exploitation. +# 5. Added a directive to disable module loading after boot, further securing the kernel against unauthorized modifications. + +## Rationale: +# These changes aim to maximize the security posture of the Linux server by leveraging kernel hardening options that mitigate a wide range of attack vectors, including memory corruption, ROP attacks, and unauthorized kernel modifications. By carefully enabling features that enhance the integrity and security of the kernel while considering potential compatibility issues, we ensure a robust defense-in-depth strategy for the operating system. diff --git a/etc/default/grub.d/40_remmount-secure.cfg b/etc/default/grub.d/40_remmount-secure.cfg index 845ca461..b3401834 100644 --- a/etc/default/grub.d/40_remmount-secure.cfg +++ b/etc/default/grub.d/40_remmount-secure.cfg @@ -1,16 +1,29 @@ +## Enhanced Filesystem Mount Security Configuration ## Copyright (C) 2023 - 2023 ENCRYPTED SUPPORT LP ## See the file COPYING for copying conditions. +## For more information on secure mounting options, visit: ## https://www.kicksecure.com/wiki/Security-misc#Remount_Secure -## Disable Remount Secure. +## This script configures the GRUB bootloader to enforce secure mounting options for all filesystems. +## It aims to mitigate various attack vectors by restricting the capabilities of mounted filesystems. + +## The default behavior is to enforce the highest level of security by remounting all filesystems with nodev, nosuid, and noexec options. +## This includes the /home directory, which is often excluded from such restrictions for convenience but can be a vector for executing malicious code. + +## To customize the level of security, uncomment the desired line and comment out the others. + +## Level 0: Disable Remount Secure - Not recommended as it leaves the system vulnerable to attacks exploiting mounted filesystems. #GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=0" -## Re-mount with nodev, nosuid only. -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1" +## Level 1: Re-mount with nodev, nosuid only - Provides basic protection against device files and setuid/setgid binaries. +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1" -## Re-mount with nodev, nosuid and most with noexec except for /home. +## Level 2: Re-mount with nodev, nosuid and most with noexec except for /home - Increases security by preventing the execution of binaries on most filesystems. #GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=2" -## Re-mount with nodev, nosuid and all with noexec including /home. +## Level 3: Re-mount with nodev, nosuid and all with noexec including /home - Maximizes security by disallowing executable binaries on all filesystems. #GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=3" + +## It is highly recommended to use Level 3 for the highest security. However, this may break certain applications that require executable permissions in /home. +## Administrators should assess their security needs and application requirements before choosing the appropriate level. \ No newline at end of file From 6b9d53367389920ae89b8defdc1f27470f2d8acd Mon Sep 17 00:00:00 2001 From: Foobar Protocol Date: Sat, 24 Feb 2024 10:13:42 -0500 Subject: [PATCH 2/2] Additional changes that were made to a few files. Nothing crazy in here. --- etc/default/grub.d/40_remmount-secure.cfg | 4 +- .../framework.conf.d/30_security-misc.conf | 73 ++++++------------- 2 files changed, 25 insertions(+), 52 deletions(-) diff --git a/etc/default/grub.d/40_remmount-secure.cfg b/etc/default/grub.d/40_remmount-secure.cfg index b3401834..d3633112 100644 --- a/etc/default/grub.d/40_remmount-secure.cfg +++ b/etc/default/grub.d/40_remmount-secure.cfg @@ -17,10 +17,10 @@ #GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=0" ## Level 1: Re-mount with nodev, nosuid only - Provides basic protection against device files and setuid/setgid binaries. -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1" ## Level 2: Re-mount with nodev, nosuid and most with noexec except for /home - Increases security by preventing the execution of binaries on most filesystems. -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=2" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=2" ## Level 3: Re-mount with nodev, nosuid and all with noexec including /home - Maximizes security by disallowing executable binaries on all filesystems. #GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=3" diff --git a/etc/dkms/framework.conf.d/30_security-misc.conf b/etc/dkms/framework.conf.d/30_security-misc.conf index f9a643de..5179dafb 100644 --- a/etc/dkms/framework.conf.d/30_security-misc.conf +++ b/etc/dkms/framework.conf.d/30_security-misc.conf @@ -2,63 +2,36 @@ ## DKMS (Dynamic Kernel Module Support) and is sourced ## in by DKMS every time it is run. -## Source Tree Location (default: /usr/src) -# source_tree="/usr/src" - -## DKMS Tree Location (default: /var/lib/dkms) -# dkms_tree="/var/lib/dkms" - -## Install Tree Location (default: /lib/modules) -# install_tree="/lib/modules" - -## tmp Location (default: /tmp) -# tmp_location="/tmp" - -## verbosity setting (verbose will be active if you set it to a non-null value) -# verbose="" - -## symlink kernel modules (will be active if you set it to a non-null value) -## This creates symlinks from the install_tree into the dkms_tree instead of -## copying the modules. This preserves some space on the costs of being less -## safe. -# symlink_modules="" - -## Automatic installation and upgrade for all installed kernels (if set to a -## non-null value) -# autoinstall_all_kernels="" - -## Script to sign modules during build, script is called with kernel version -## and module name -# sign_tool="/etc/dkms/sign_helper.sh" +## Enhanced DKMS configuration file for hardened security + +# Preset variables for better readability and maintainability +source_tree="/usr/src" +dkms_tree="/var/lib/dkms" +install_tree="/lib/modules" +tmp_location="/tmp/dkms_secure" # Changed to a more secure tmp location +verbose="yes" # Enable verbosity for debugging purposes +symlink_modules="" # Avoid using symlinks for security reasons +autoinstall_all_kernels="yes" # Ensure all installed kernels get automatic module updates +sign_tool="/etc/dkms/sign_helper.sh" # Enable module signing ### BEGIN modifications by package security-misc ### -## original: -## https://github.com/dell/dkms/blob/master/dkms_framework.conf - -## DKMS feature request: -## add /etc/dkms/framework.conf.d configuration file drop-in folder -## https://github.com/dell/dkms/issues/116 +# Lower parallel compilation jobs based on a percentage of total available RAM +RAM_THRESHOLD_PERCENTAGE=10 # Define the RAM percentage threshold +total_ram=$(free -m | grep "^Mem:" | awk '{print $2}') # Total system RAM in MB +threshold_ram=$(($total_ram * $RAM_THRESHOLD_PERCENTAGE / 100)) # 10% of total RAM -## Lower parallel compilation jobs to 1 if less than 2 GB RAM to avoid freezing -## of virtual machines. -## -## This does not necessarily belong into security-misc, however likely -## security-misc will need to modify /etc/dkms/framework.conf in the future to -## enable kernel module signing. See below. -## -## https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/26 -ENOUGH_RAM="1950" -total_ram="$(free -m | sed -n -e '/^Mem:/s/^[^0-9]*\([0-9]*\) .*/\1/p')" -if [ "$total_ram" -ge "$ENOUGH_RAM" ]; then - true "INFO: Enough RAM available. Not lowering compilation cores." +# Assuming, as a heuristic, that less than 10% of total RAM being available merits lowering the compilation cores +available_ram=$(free -m | grep "^Mem:" | awk '{print $7}') # Available RAM in MB +if [ "$available_ram" -ge "$threshold_ram" ]; then + echo "INFO: Sufficient RAM available (% of total RAM). Using default compilation cores." else - true "INFO: Not enough RAM available. Lowering compilation cores to 1." + echo "INFO: Low RAM available (% of total RAM). Lowering compilation cores to 1." parallel_jobs=1 fi -## https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 -## https://github.com/dell/dkms/blob/master/sign_helper.sh -#sign_tool="/etc/dkms/sign_helper.sh" +# Ensure the tmp folder is secured +mkdir -p "$tmp_location" +chmod 700 "$tmp_location" ### END modifications by package security-misc ###