diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..1996d78e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,24 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows / pkg_install_dependabot_yml. +## Byte-identical across consumers; do not hand-edit. +## See agents/github-actions-consumer-templates.md. + +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 1 + commit-message: + prefix: "ci(deps)" + include: scope + groups: + github-actions: + patterns: + - "*" diff --git a/.github/dm-consumer.yml b/.github/dm-consumer.yml new file mode 100644 index 00000000..b61f2810 --- /dev/null +++ b/.github/dm-consumer.yml @@ -0,0 +1,44 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Per-repo parameter overrides. Read at workflow runtime by the +## reusable workflows in developer-meta-files. Top-level keys +## mirror the consumer-template basename without the +## 'consumer-' prefix. +## +## Spec: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +coverity: + ## scan.coverity.com project name (org-ai-assisted-owned; the "/" is + ## rejected in manual registration so the name is slash-free). + project-name: "org-ai-assisted-security-misc" + canonical-repos: "org-ai-assisted/security-misc" + +cppcheck: + paths: "usr/src/security-misc" + ## genmkfile names the C sources '*.c#security-misc-shared' + ## (cppcheck discovers files by extension; would otherwise miss + ## them). The codeql-prepare.sh script symlinks them to clean + ## '*.c' names. + prepare-command: "ci/codeql-prepare.sh" + +codeql-python: + ## Same prep as cppcheck: codeql-prepare.sh symlinks + ## '*.py#security-misc-shared' to clean '*.py' names so the + ## CodeQL python extractor discovers them. + prepare-command: "ci/codeql-prepare.sh" + +codeql-cpp: + ## codeql-prepare.sh handles both python and c-cpp source + ## symlinks; codeql-build.sh wraps the make invocation under + ## CodeQL's manual build-mode tracing. + prepare-command: "ci/codeql-prepare.sh" + build-command: "ci/codeql-build.sh" + +dist-ai-tests: + ## The ssh-audit config suite (security-misc-tests) stands up a + ## throwaway sshd and drives ssh-audit; python3-pytest is baseline. + apt-packages: "openssh-server openssh-client ssh-audit" diff --git a/.github/workflows/consumer-bandit.yml b/.github/workflows/consumer-bandit.yml new file mode 100644 index 00000000..ed41ac3f --- /dev/null +++ b/.github/workflows/consumer-bandit.yml @@ -0,0 +1,42 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-bandit.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Universal wrapper - no per-repo state required. The reusable +## does its own Python discovery (`.py` extension + shebang +## scan) so consumers don't need a `paths:` or `prepare-command` +## entry. Per-repo suppressions use bandit's `# nosec` inline +## comments. Install only in repos that contain Python (opt-in +## by file presence). +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-bandit.yml + +name: bandit + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + bandit: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-bandit.yml@master + permissions: + contents: read diff --git a/.github/workflows/consumer-codeql-actions.yml b/.github/workflows/consumer-codeql-actions.yml new file mode 100644 index 00000000..8391ed4b --- /dev/null +++ b/.github/workflows/consumer-codeql-actions.yml @@ -0,0 +1,48 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-actions.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Consumer wrapper for the 'actions' CodeQL language - workflow +## YAML security analysis (missing-permissions, script-injection, +## unversioned-immutable-actions, etc.). +## +## Cronless on purpose: byte-identical propagation forbids +## per-repo cron rewrites at propagation time. Push / PR / +## workflow_dispatch triggers cover the scan-on-change cases; +## rule-refresh re-scans can be kicked manually from the Actions +## tab. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml + +name: CodeQL Actions + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + actions: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master + with: + language: actions + permissions: + security-events: write + contents: read diff --git a/.github/workflows/consumer-codeql-cpp.yml b/.github/workflows/consumer-codeql-cpp.yml new file mode 100644 index 00000000..5855781d --- /dev/null +++ b/.github/workflows/consumer-codeql-cpp.yml @@ -0,0 +1,55 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-cpp.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Consumer wrapper for the 'c-cpp' CodeQL language. Cronless on +## purpose: byte-identical propagation forbids per-repo cron +## rewrites. Push / PR / workflow_dispatch triggers cover the +## scan-on-change cases. +## +## Required per-repo state in .github/dm-consumer.yml: +## +## codeql-cpp: +## build-command: "" # required +## prepare-command: "" # optional +## +## build-mode is hardcoded to 'manual' in the wrapper. The +## reusable hard-fails at workflow start if codeql-cpp.build-command +## is missing or empty. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml + +name: CodeQL c-cpp + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + c-cpp: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master + with: + language: c-cpp + build-mode: manual + dm-consumer-section: codeql-cpp + permissions: + security-events: write + contents: read diff --git a/.github/workflows/consumer-codeql-python.yml b/.github/workflows/consumer-codeql-python.yml new file mode 100644 index 00000000..9e038a3c --- /dev/null +++ b/.github/workflows/consumer-codeql-python.yml @@ -0,0 +1,61 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-python.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Consumer wrapper for the 'python' CodeQL language. Cronless +## on purpose (same rationale as consumer-codeql-actions.yml): +## byte-identical propagation forbids per-repo cron rewrites. +## Push / PR / workflow_dispatch triggers cover the +## scan-on-change cases. +## +## Also clears a flaky GHAS behavior: github-advanced-security +## speculatively creates a queued 'CodeQL' check-run when it +## detects Python in the repo. Without a workflow that submits +## Python SARIF, that check-run can stay queued forever and keep +## the PR's mergeable_state as 'unstable'. Installing this +## wrapper gives GHAS the Python analysis it expects. +## +## Install only in repos that contain Python (opt-in by file +## presence). Repos with no Python should not install this; the +## reusable would scan nothing and the GHAS speculative stub +## would not be created in the first place. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml + +name: CodeQL Python + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + python: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master + with: + language: python + ## Read .github/dm-consumer.yml `codeql-python:` section for + ## optional prepare-command (e.g. ci/codeql-prepare.sh for + ## genmkfile-tagged source-tree symlinks). Soft-skip if the + ## file or section is absent. + dm-consumer-section: codeql-python + permissions: + security-events: write + contents: read diff --git a/.github/workflows/consumer-coverity.yml b/.github/workflows/consumer-coverity.yml new file mode 100644 index 00000000..d5679b4f --- /dev/null +++ b/.github/workflows/consumer-coverity.yml @@ -0,0 +1,46 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-coverity.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Per-repo values are read by the reusable from +## .github/dm-consumer.yml at workflow runtime. Required keys: +## coverity.project-name, coverity.canonical-repos. Optional: +## coverity.apt-packages, coverity.build-command. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-coverity.yml + +name: Coverity + +on: + push: + tags: + - '*' + schedule: + - cron: '0 4 * * 5' + workflow_dispatch: + +permissions: + contents: read + +## Coverity singleton policy: G-A-006 in github-actions.md. +## Cancelling mid-flight wastes the daily free-tier slot. +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: false + +jobs: + coverity: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-coverity.yml@master + secrets: + COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }} + COVERITY_SCAN_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }} + permissions: + contents: read diff --git a/.github/workflows/consumer-cppcheck.yml b/.github/workflows/consumer-cppcheck.yml new file mode 100644 index 00000000..134945c4 --- /dev/null +++ b/.github/workflows/consumer-cppcheck.yml @@ -0,0 +1,39 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-cppcheck.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Per-repo values are read by the reusable from +## .github/dm-consumer.yml at workflow runtime. Required keys: +## cppcheck.paths. Optional: cppcheck.prepare-command. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-cppcheck.yml + +name: cppcheck + +on: + pull_request: + branches: [master] + push: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + cppcheck: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-cppcheck.yml@master + permissions: + contents: read diff --git a/.github/workflows/consumer-dist-ai-tests.yml b/.github/workflows/consumer-dist-ai-tests.yml new file mode 100644 index 00000000..f9894d7e --- /dev/null +++ b/.github/workflows/consumer-dist-ai-tests.yml @@ -0,0 +1,38 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Managed by pkg_update_consumer_workflows. Byte-identical +## across consumers; this file is `cp`-ed from +## developer-meta-files/consumer-templates/.github/workflows/consumer-dist-ai-tests.yml. +## DO NOT hand-edit this file in the consumer repo - changes +## will be overwritten on the next propagation pass. +## +## Runs this package's comprehensive dist-ai regression suites (which +## live in org-ai-assisted/dist-ai, not in-tree) on each PR and on push +## to master. The component is derived from the repo name by the +## reusable, so this wrapper carries no per-repo state. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-dist-ai-tests.yml + +name: dist-ai tests + +on: + pull_request: + branches: [master] + push: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + dist-ai-tests: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-dist-ai-tests.yml@master diff --git a/.github/workflows/local-dbus-fuzz.yml b/.github/workflows/local-dbus-fuzz.yml new file mode 100644 index 00000000..911720ba --- /dev/null +++ b/.github/workflows/local-dbus-fuzz.yml @@ -0,0 +1,93 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Coverage-guided D-Bus surface fuzzing for fm-shim-backend. +## +## fm-shim-backend implements org.freedesktop.FileManager1 on the +## session bus. dfuzzer (Debian-archive-shipped) walks every method +## / signal the service exposes and sends type-correct adversarial +## payloads. Catches the integration surface (D-Bus marshaling +## glue, sd_notify path, signal handlers, leaks across method +## calls) that an in-process libFuzzer harness on the parser alone +## would not catch. +## +## Trigger shape mirrors helper-scripts' local-python-fuzz.yml: +## workflow_dispatch + path-filtered pull_request. PRs that don't +## touch the shim backend, its compile script, the dfuzzer build / +## runner, or this workflow itself are skipped to keep cost bounded. +## +## Workflow body lives in ci/dfuzzer-run.sh (R-100); this file +## carries only the trigger schedule + apt install + invocation. + +name: dfuzzer (D-Bus) + +on: + workflow_dispatch: + inputs: + seconds: + description: 'Per-method dfuzzer time budget (seconds)' + required: false + default: '60' + pull_request: + branches: [master] + paths: + - 'usr/src/security-misc/fm-shim-backend.c#security-misc-shared' + - 'usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared' + - 'ci/dfuzzer-build.sh' + - 'ci/dfuzzer-run.sh' + - 'ci/codeql-prepare.sh' + - '.github/workflows/local-dbus-fuzz.yml' + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + dfuzzer: + name: dfuzzer (org.freedesktop.FileManager1) + runs-on: ubuntu-latest + timeout-minutes: 20 + + ## CI runs only where we enabled it; ANDed with the existing guard. + ## Unset variable -> skipped, no runner, run stays green. + if: >- + vars.CI_ENABLED_ORG_AI_ASSISTED == 'true' + && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') + + permissions: + contents: read + + env: + DFUZZER_SECONDS: ${{ inputs.seconds || '60' }} + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + ## install-deps composite action: apt deps for dfuzzer-build.sh + ## (build + runtime + fm-shim backend compile) plus genmkfile + + ## helper-scripts (org-standard install path; see + ## ci/dfuzzer-build.sh header for per-package rationale). + - name: Install apt deps + genmkfile + helper-scripts + uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master + with: + apt-packages: 'meson ninja-build xsltproc docbook-xsl libglib2.0-dev dbus dbus-x11 libdbus-1-dev libsystemd-dev pkg-config gcc' + + - name: Build dfuzzer from source + ## dfuzzer is not packaged for Ubuntu 24.04; build from + ## pinned upstream tag. See ci/dfuzzer-build.sh. + run: ci/dfuzzer-build.sh + + - name: Prepare extension-clean source paths + run: ci/codeql-prepare.sh + + - name: Run dfuzzer + run: ci/dfuzzer-run.sh diff --git a/.github/workflows/local-dist-ai-ssh-prod.yml b/.github/workflows/local-dist-ai-ssh-prod.yml new file mode 100644 index 00000000..901fd493 --- /dev/null +++ b/.github/workflows/local-dist-ai-ssh-prod.yml @@ -0,0 +1,41 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Hard-gating scan of the live production SSH servers (kicksecure.com, +## whonix.org) against security-misc's shipped ssh-audit server policy, via the +## dist-ai --e2e suite security-misc-tests-e2e (which lives in +## org-ai-assisted/dist-ai, not in-tree). This is NOT the managed +## consumer-dist-ai-tests.yml (--core) template. +## +## It runs on push to master, on a daily schedule, and on demand -- NOT on +## every pull request: a feature PR cannot change the production servers, so +## gating unrelated PRs on live external state would only wedge them. A failure +## here means a production server dropped (or never had) the security-misc SSH +## hardening; fix is on the host. +## +## Reusable docs: +## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-dist-ai-tests.yml + +name: dist-ai ssh prod + +on: + push: + branches: [master] + schedule: + - cron: '17 6 * * *' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + dist-ai-ssh-prod: + uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-dist-ai-tests.yml@master + with: + categories: '--e2e' diff --git a/.github/workflows/local-permission-hardener-test.yml b/.github/workflows/local-permission-hardener-test.yml new file mode 100644 index 00000000..e1d7e320 --- /dev/null +++ b/.github/workflows/local-permission-hardener-test.yml @@ -0,0 +1,64 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Regression test for the permission-hardener config parser. +## +## Scope is intentionally narrow: it exercises load_state()'s +## right-anchored option parsing so a config filename containing a +## space is parsed as one entry instead of being split and silently +## dropped. See ci/tests/permission_hardener/test_whitespace_filename.sh. + +## FIXME: The actual scripts run here should be in dist-ai. + +## WARNING: The new test scripts will not be reviewed by humans as they are +## slated to be moved to dist-ai. This workflow file has been reviewed. + +name: Test permission-hardener + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + test: + name: Test permission-hardener + runs-on: ubuntu-latest + timeout-minutes: 10 + + ## CI runs only where we enabled it; ANDed with the existing guard. + ## Unset variable -> skipped, no runner, run stays green. + if: >- + vars.CI_ENABLED_ORG_AI_ASSISTED == 'true' + && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + ## permission-hardener sources helper-scripts (log_run_die.sh, + ## safe_echo.sh, strings.bsh) at startup; install-deps provides + ## them under /usr/libexec/helper-scripts/. + - name: Install genmkfile + helper-scripts + safe-rm + uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master + with: + apt-packages: 'safe-rm' + + - name: Whitespace-in-filename parser regression test + ## Root: the test writes a temp config under + ## /etc/permission-hardener.d/ and runs 'print-policy'. + run: sudo -E ci/tests/permission_hardener/test_whitespace_filename.sh diff --git a/.github/workflows/local-python-lint.yml b/.github/workflows/local-python-lint.yml new file mode 100644 index 00000000..6ef773d2 --- /dev/null +++ b/.github/workflows/local-python-lint.yml @@ -0,0 +1,107 @@ +--- +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Simple Python lint for fm_shim_frontend. +## +## Scope is intentionally narrow: +## - usr/lib/python3/dist-packages/fm_shim_frontend/ (the only +## Python in this repo) +## +## Tools: +## flake8 --select=F Pyflakes-class checks only (F-codes: +## undefined names, unused imports, unused +## local variables, etc.). Skips PEP8 style +## (E/W codes) - the codebase uses '##' block +## comments which would trigger E266 noise. +## flake8 over plain pyflakes because pyflakes +## does not honor '# noqa' (the standard +## escape-hatch for intentional violations); +## flake8 wraps pyflakes and adds that +## support. Pylint was deliberately not +## enabled here because pylint's interaction +## with PyQt5 produces a flood of +## 'no-name-in-module' false positives (PyQt5 +## generates its symbols dynamically; pylint +## cannot see them statically without a +## per-symbol --extension-pkg-allow-list that +## defeats the simplicity of this workflow). +## +## Source files in this repo carry a '#' suffix per +## the genmkfile convention. pyflakes discovers sources by file +## extension; ci/codeql-prepare.sh creates extension-clean symlinks +## that re-use that fix. + +name: Lint Python + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + lint: + name: Lint Python + runs-on: ubuntu-latest + timeout-minutes: 10 + + ## CI runs only where we enabled it; ANDed with the existing guard. + ## Unset variable -> skipped, no runner, run stays green. + if: >- + vars.CI_ENABLED_ORG_AI_ASSISTED == 'true' + && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + ## install-deps composite action installs apt deps + genmkfile + ## + helper-scripts. helper-scripts provides the stdisplay + ## Python module that fm_shim_frontend imports at module top + ## level; with the real package present we run the tests + ## against production modules instead of conftest.py stubs. + ## + ## python3-pyqt5 + python3-pyqt5.sip: runtime deps of + ## fm_shim_frontend's Qt UI; flake8 / python3-pytest / + ## python3-hypothesis: the lint + property-test toolchain. + - name: Install apt deps + genmkfile + helper-scripts + uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master + with: + apt-packages: 'flake8 python3-pytest python3-hypothesis python3-pyqt5 python3-pyqt5.sip' + + - name: Prepare extension-clean Python source paths + run: ci/codeql-prepare.sh + + - name: flake8 (pyflakes checks only) + ## Pass the symlinked clean-name files explicitly. Without + ## the explicit list, flake8 walks the directory and would + ## see each source twice (once via the symlink, once via + ## the original '*.py#tag') - causing duplicate findings. + run: | + flake8 --select=F -- \ + usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py \ + usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py + + - name: Hypothesis property tests + ## Coverage-based property fuzzing of the URI-validation + ## chokepoint (get_path_list_from_uris). Already caught one + ## real ENAMETOOLONG-on-long-path crash bug at introduction + ## (see ci/tests/fm_shim_frontend/test_property.py header). + env: + PYTHONPATH: usr/lib/python3/dist-packages + run: | + python3 -m pytest --import-mode=importlib -q \ + ci/tests/fm_shim_frontend/test_property.py diff --git a/.gitignore b/.gitignore index ef58a2f7..fb2e7236 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ pkgs +**/__pycache__/ diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 00000000..81bfc6b8 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,26 @@ +# Agent Guidelines for security-misc + +## General Guidelines + +- Check `./agents/` for component-specific notes before reviewing or commenting. +- Upstream repository: Kicksecure/security-misc +- No need to mention accepted/fixed/done things unless there is a specific + reason why it is needed in memory. + +## Component Notes + +- [fm-shim](./agents/fm-shim.md) - FileManager1 D-Bus shim (backend + frontend) +- [fuzzing](./agents/fuzzing.md) - Hypothesis property tests under + `ci/tests//`; ClusterFuzzLite / libFuzzer not yet wired up. + +## pkg-config quoting in build script + +`pkg-config` output is designed to be word-split by shells. Quoting it via bash +arrays just reimplements word splitting manually. The unquoted +`$(pkg-config ...)` is intentional. Upstream has a NOTE comment explaining this. +Do not re-propose this change. + +## Accepted Threat Model + +- systemd user manager environment is trusted. +- Python >= 3.13.5 required. diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 00000000..a263c705 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,3 @@ +# CLAUDE.md + +See [AGENTS.md](AGENTS.md). diff --git a/COPYING b/COPYING index bf111380..829d9096 100644 --- a/COPYING +++ b/COPYING @@ -1,7 +1,7 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Files: * -Copyright: 2012 - 2024 ENCRYPTED SUPPORT LP +Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC License: AGPL-3+ License: AGPL-3+ diff --git a/README.md b/README.md index c23d261e..c92ada13 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # Enhances miscellaneous security settings +Note that all the security features seen in this repository may not yet be incorporated into a public Kicksecure/Whonix release. Refer to the [forums](https://forums.kicksecure.com/c/news/5) with accompanying dates to see what is actually included in the most recent release. + ## Kernel hardening This section is inspired by the Kernel Self Protection Project (KSPP). It @@ -14,7 +16,7 @@ many more sources. sysctl settings are configured via the `/usr/lib/sysctl.d/990-security-misc.conf` configuration file and significant hardening is applied to a myriad of components. -Kernel space: +#### Kernel space - Restrict access to kernel addresses through the use of kernel pointers regardless of user privileges. @@ -37,29 +39,38 @@ Kernel space: - Entirely disable the SysRq key so that the Secure Attention Key (SAK) can no longer be utilized. See [documentation](https://www.kicksecure.com/wiki/SysRq). +- Optional - Disable all use of user namespaces. + - Optional - Restrict user namespaces to `CAP_SYS_ADMIN` as they can lead to substantial privilege escalation. -- Optional - Disable all use of user namespaces. - - Restrict kernel profiling and the performance events system to `CAP_PERFMON`. -- Force the kernel to panic on both "oopses", which can potentially indicate and thwart - certain kernel exploitation attempts, and also kernel warnings in the `WARN()` path. - -- Optional - Force immediate reboot on the occurrence of a single kernel panic and also - (when using Linux kernel >= 6.2) limit the number of allowed panics to one. +- Force immediate system reboot on the occurrence of a single kernel panic, reducing the + risk and impact of denial-of-service attacks and both cold and warm boot attacks. + +- Force the kernel to immediately panic on both "oopses" (which can potentially indicate + and thwart certain kernel exploitation attempts) and kernel warnings in the `WARN()` path. + +- Optional - Force immediate kernel panic on OOM (out of memory) which with the above setting + will force an immediate system reboot as opposed to placing any reliance on the oom_killer + to avoid arbitrarily terminating security features based on their OOM score. Note this + creates the risk of userspace-based denial-of-service attacks that maliciously fill memory. + +- Optional - Force immediate kernel panics upon receiving NMIs (Non-Maskable Interrupts) + triggered by serious hardware-level I/O issues, uncorrectable memory and hardware errors, + and undefined or unknown sources in order to prevent data corruption. - Disable the use of legacy TIOCSTI operations which can be used to inject keypresses. -- Disable asynchronous I/O (when using Linux kernel >= 6.6) as `io_uring` has been - the source of numerous kernel exploits. +- Disable asynchronous I/O as `io_uring` has been the source of numerous kernel exploits. + +- Disable 32-bit vDSO mappings as they are a legacy compatibility feature. -User space: +#### User space -- Restrict usage of `ptrace()` to only processes with `CAP_SYS_PTRACE` as it - enables programs to inspect and modify other active processes. Optional - Disable - usage of `ptrace()` by all processes. +- Disable the usage of `ptrace()` by all processes as it enables programs to inspect + and modify other active processes. - Maximize the bits of entropy used for mmap ASLR across all CPU architectures. @@ -79,18 +90,18 @@ User space: on a magic number or their file extension to prevent unintended code execution. See issue: https://github.com/Kicksecure/security-misc/issues/267 -Core dumps: +#### Core dumps - Disable core dump files and prevent their creation. If core dump files are enabled, they will be named based on `core.PID` instead of the default `core`. -Swap space: +#### Swap space - Limit the copying of potentially sensitive content in memory to the swap device. -Networking: +#### Networking -- Enable hardening of the BPF JIT compiler protect against JIT spraying. +- Enable hardening of the BPF JIT compiler to protect against JIT spraying. - Enable TCP SYN cookie protection to assist against SYN flood attacks. @@ -102,6 +113,17 @@ Networking: - Disable ICMP redirect acceptance and redirect sending messages to prevent man-in-the-middle attacks and minimize information disclosure. +- Deny sending and receiving shared media redirects to reduce the risk of IP + spoofing attacks. + +- Enable ARP filtering to mitigate some ARP spoofing and ARP cache poisoning attacks. + +- Respond to ARP requests only if the target IP address is on-link, + preventing some IP spoofing attacks. + +- Drop gratuitous ARP packets to prevent ARP cache poisoning via + man-in-the-middle and denial-of-service attacks. + - Ignore ICMP echo requests to prevent clock fingerprinting and Smurf attacks. - Ignore bogus ICMP error responses. @@ -109,24 +131,90 @@ Networking: - Disable source routing which allows users to redirect network traffic that can result in man-in-the-middle attacks. -- Do not accept IPv6 router advertisements and solicitations. +- Do not accept IPv6 router advertisements (RAs) and solicitations which can result + in both man-in-the-middle and denial-of-service attacks. - Optional - Disable SACK and DSACK as they have historically been a known vector for exploitation. - Disable TCP timestamps as they can allow detecting the system time. -- Optional - Log packets with impossible source or destination addresses to - enable further inspection and analysis. +- Disable reuse of `TIME_WAIT` sockets for new outgoing connections as the above + setting disables TCP timestamps. + +- Log packets with impossible source or destination addresses to enable further + inspection and analysis. - Optional - Enable IPv6 Privacy Extensions. +- Documentation: https://www.kicksecure.com/wiki/Networking + +#### CD-ROM/DVD + +- Disable CD-ROM/DVD drive automatic tray closure and ejection functionality to + prevent scripted tray cycling attacks. + +- Disable all CD-ROM/DVD drive debug messages to limit information disclosure. + +- Optional - Restrict CD-ROM/DVD drives by disabling kernel checking and hardware access. + ### Boot parameters Mitigations for known CPU vulnerabilities are enabled in their strictest form and simultaneous multithreading (SMT) is disabled. See the `/etc/default/grub.d/40_cpu_mitigations.cfg` configuration file. +Importantly, we do not rely on the use of the already enabled-by-default `mitigations=auto` +kernel boot parameter to perform CPU mitigations like many other distributions. This is +because its use is both totally redundant and it does not apply all hardening settings +to their strictest possible levels. See issue: +https://github.com/Kicksecure/security-misc/issues/199#issuecomment-3327391859. + +Note, to achieve complete protection for known CPU vulnerabilities, the latest +security microcode (BIOS/UEFI) updates must be installed on the system. Furthermore, +if using Secure Boot, the Secure Boot Forbidden Signature Database (DBX) must be kept +up to date through [UEFI Revocation List](https://github.com/microsoft/secureboot_objects) updates. + +CPU mitigations: + +- Disable Simultaneous Multithreading (SMT) + +- Spectre Side Channels (BTI and BHI) + +- Enable Kernel Page Table Isolation (PTI) + +- Meltdown + +- Speculative Store Bypass (SSB) + +- L1 Terminal Fault (L1TF) + +- Microarchitectural Data Sampling (MDS) + +- TSX Asynchronous Abort (TAA) + +- iTLB Multihit + +- Special Register Buffer Data Sampling (SRBDS) + +- L1D Flushing + +- Processor MMIO Stale Data + +- Arbitrary Speculative Code Execution with Return Instructions (Retbleed) + +- Cross-Thread Return Address Predictions + +- Optional - Speculative Return Stack Overflow (SRSO) + +- Gather Data Sampling (GDS) + +- Register File Data Sampling (RFDS) + +- Indirect Target Selection (ITS) + +- VMScape + Boot parameters relating to kernel hardening, DMA mitigations, and entropy generation are outlined in the `/etc/default/grub.d/40_kernel_hardening.cfg` configuration file. @@ -138,6 +226,8 @@ Kernel space: - Enable sanity checks and red zoning via slab debugging. This will implicitly disable kernel pointer hashing, leaking very sensitive information to root. + Re-enabling hashed pointers will be possible when using Linux kernel >= 6.17. + https://github.com/Kicksecure/security-misc/issues/253 - Enable memory zeroing at both allocation and free time, which mitigates some use-after-free vulnerabilities by erasing sensitive information in memory. @@ -145,9 +235,6 @@ Kernel space: - Enable the kernel page allocator to randomize free lists to limit some data exfiltration and ROP attacks, especially during the early boot process. -- Enable kernel page table isolation to increase KASLR effectiveness and also - mitigate the Meltdown CPU vulnerability. - - Enable randomization of the kernel stack offset on syscall entries to harden against memory corruption attacks. @@ -157,10 +244,16 @@ Kernel space: - Restrict access to debugfs by not registering the file system since it can contain sensitive information. -- Force kernel panics on "oopses" to potentially indicate and thwart certain - kernel exploitation attempts. +- Force immediate system reboot on the occurrence of a single kernel panic, reducing the + risk and impact of denial-of-service attacks and both cold and warm boot attacks. -- Optional - Modify the machine check exception handler. +- Force the kernel to immediately panic on both "oopses" (which can potentially indicate + and thwart certain kernel exploitation attempts) and kernel warnings in the `WARN()` path. + +- Optional - Force the kernel to immediately panic if it becomes tainted. Some reasons include + upon using out of specification hardware, bad page states, ACPI tables being overridden, + severe firmware bugs, in-kernel tests run, or mutating `fwctl` debug operations. It can also + include the loading of proprietary or out-of-tree modules. - Prevent sensitive kernel information leaks in the console during boot. @@ -169,12 +262,23 @@ Kernel space: - Disable 32-bit vDSO mappings as they are a legacy compatibility feature. -- Optional - Use kCFI as the default CFI implementation (when using Linux kernel >= 6.2) - since it may be slightly more resilient to attacks that are able to write - arbitrary executables in memory. +- Use kCFI as the default CFI implementation as it is more resilient to attacks that are + able to write arbitrary executables into memory omitting the necessary hash validation. + +- Disable support for all 32-bit x86 processes and syscalls to reduce attack surface. + +- Disable the EFI persistent storage feature which prevents the kernel from writing crash logs + and other persistent data to either the UEFI variable storage or ACPI ERST backends. + +- Restrict processes from modifying their own memory mappings unless actively done via + `ptrace()` for debugging in order to limit self-modification which can trigger exploits. + +- Optional - Prevent runaway privileged processes from writing to block devices that are mounted by + filesystems to protect against filesystem corruption and kernel crashes. May cause breakages with + disk management operations such as disk resizing and VDI compaction in virtual machines. -- Optional - Disable support for all x86 processes and syscalls (when using Linux kernel >= 6.7) - to reduce attack surface. +- Optional - On compatible AMD CPUs enable Secure Memory Encryption (SME) to protect against + cold boot attacks and Secure Encrypted Virtualization (SEV) for further guest memory isolation. Direct memory access: @@ -186,11 +290,17 @@ Direct memory access: Entropy: -- Do not credit the CPU or bootloader as entropy sources at boot in order to - maximize the absolute quantity of entropy in the combined pool. +- Do not credit the CPU seeds as an entropy source at boot in order to maximize the + absolute quantity of entropy in the combined pool. This is desirable for all + cryptographic operations to avoid reliance on proprietary RDRAND and RDSEED CPU + instructions for random number generation that have long history of being defective. -- Obtain more entropy at boot from RAM as the runtime memory allocator is - being initialized. +- Do not credit the bootloader seeds as an entropy source at boot to maximize the + absolute quantity of entropy in the combined pool. This is desirable for all + cryptographic operations as seeds passed by the bootloader could be tampered. + +- Obtain more entropy at boot from RAM as the runtime memory allocator is being + initialized to maximize the absolute quantity of entropy in the combined pool. Networking: @@ -210,7 +320,7 @@ Networking: `security-misc` is in full compliance with KSPP recommendations wherever feasible. However, there are a few cases of partial or non-compliance due to technical limitations. -* [KSPP Recommended Settings](https://kspp.github.io/Recommended_Settings) +- [KSPP Recommended Settings](https://kspp.github.io/Recommended_Settings) **Full compliance:** @@ -219,35 +329,36 @@ the KSPP's recommendations. **Partial compliance:** -1. `sysctl kernel.yama.ptrace_scope=3` - -Completely disables `ptrace()`. Can be enabled easily if needed. - -* [security-misc pull request #242](https://github.com/Kicksecure/security-misc/pull/242) - -2. `sysctl kernel.panic=-1` +1. Kernel boot parameter `proc_mem.force_override=never` -Forces an immediate reboot on kernel panic. This can be enabled, but it may lead to unexpected -system crashes. +Restrict processes from modifying their own memory mappings by completely disables use of +`/proc/PID/mem` to write to protected pages. Can be enabled easily if required. -* [security-misc pull request #264](https://github.com/Kicksecure/security-misc/pull/264) -* [security-misc pull request #268](https://github.com/Kicksecure/security-misc/pull/268) +- [security-misc pull request #332](https://github.com/Kicksecure/security-misc/pull/332) **Non-compliance:** -3. `sysctl user.max_user_namespaces=0` +2. `sysctl user.max_user_namespaces=0` Disables user namespaces entirely. Not recommended due to the potential for widespread breakages. -* [security-misc pull request #263](https://github.com/Kicksecure/security-misc/pull/263) +- [security-misc pull request #263](https://github.com/Kicksecure/security-misc/pull/263) -4. `sysctl fs.binfmt_misc.status=0` +3. `sysctl fs.binfmt_misc.status=0` Disables the registration of interpreters for miscellaneous binary formats. Currently not feasible due to compatibility issues with Firefox. -* [security-misc pull request #249](https://github.com/Kicksecure/security-misc/pull/249) -* [security-misc issue #267](https://github.com/Kicksecure/security-misc/issues/267) +- [security-misc pull request #249](https://github.com/Kicksecure/security-misc/pull/249) +- [security-misc issue #267](https://github.com/Kicksecure/security-misc/issues/267) + +4. Kernel boot parameter `hash_pointers=always` + +Force all exposed pointers to be hashed and must be used in combination with the already enabled +`slab_debug=FZ` kernel boot parameter. Currently is not possible as requires Linux kernel >= 6.17. + +- [security-misc issue #253](https://github.com/Kicksecure/security-misc/issues/253) +- [security-misc pull request #325](https://github.com/Kicksecure/security-misc/pull/325) ### Kernel Modules @@ -298,6 +409,9 @@ Hardware modules: - Optional - Bluetooth: Disabled to reduce attack surface. +- Optional - CPU MSRs: Disabled as can be abused to access other trust domains + and write to arbitrary memory. + - FireWire (IEEE 1394): Disabled as they are often vulnerable to DMA attacks. - GPS: Disable GPS-related modules such as those required for Global Navigation @@ -327,20 +441,22 @@ Miscellaneous modules: - Amateur Radios: Disabled to reduce attack surface. -- Optional - CPU MSRs: Disabled as can be abused to write to arbitrary memory. - - Floppy Disks: Disabled to reduce attack surface. - Framebuffer (fbdev): Disabled as these drivers are well-known to be buggy, cause kernel panics, and are generally only used by legacy devices. +- Joysticks: Disabled to reduce attack surface. + - Replaced Modules: Disabled legacy drivers that have been entirely replaced and superseded by newer drivers. +- RNDIS - Disabled as believed to have unfixable buffer overflow issues. + - Optional - USB Video Device Class: Disables the USB-based video streaming driver for devices like some webcams and digital camcorders. -- Vivid: Disabled to reduce attack surface given previous vulnerabilities. +- Optional - Vivid: Disabled to reduce attack surface given previous vulnerabilities. ### Other @@ -350,7 +466,7 @@ Miscellaneous modules: `/etc/kernel/postinst.d/30_remove-system-map` -`/lib/systemd/system/remove-system-map.service` +`/usr/lib/systemd/system/remove-system-map.service` `/usr/libexec/security-misc/remove-system.map` @@ -359,16 +475,40 @@ Miscellaneous modules: `/etc/security/limits.d/30_security-misc.conf` -`/etc/sysctl.d/30_security-misc.conf` +`/usr/lib/sysctl.d/30_security-misc.conf` -`/lib/systemd/coredump.conf.d/30_security-misc.conf` +`/usr/lib/systemd/coredump.conf.d/30_security-misc.conf` -- An initramfs hook sets the sysctl values in `/etc/sysctl.conf` and +- PStore is disabled as crash logs can contain sensitive system data such as + kernel version, hostname, and users. See: + + `/usr/lib/systemd/pstore.conf.d/30_security-misc.conf` + +- An initramfs hook used to set the sysctl values in `/etc/sysctl.conf` and `/etc/sysctl.d` before init is executed so sysctl hardening is enabled as - early as possible. This is implemented for `initramfs-tools` only because + early as possible. This was implemented for `initramfs-tools` only because this is not needed for `dracut` as `dracut` does that by default, at least on `systemd` enabled systems. Not researched for non-`systemd` systems - by the author of this part of the readme. + by the author of this part of the readme. This is no longer implemented for + `initramfs-tools` as `initramfs-tools` support has been deprecated. + +- Kernel console output is suppressed during boot by setting `loglevel=0` and + `quiet` boot parameters to prevent sensitive kernel information from being + visible to physical observers. Must be paired with the `kernel.printk` sysctl + for complete effect. See: + + `/etc/default/grub.d/41_quiet_boot.cfg` + + `/usr/lib/sysctl.d/30_silent-kernel-printk.conf` + +- Recovery mode is restricted by removing GRUB recovery entries, halting + instead of dropping to an emergency shell during initramfs failures, and + disabling the dracut recovery shell entirely. This prevents physical attackers + from booting into a root shell via recovery options. See: + - `/etc/default/grub.d/41_recovery_restrict.cfg` + - [Recovery Mode](https://www.kicksecure.com/wiki/Recovery#Recovery_Mode) + - [Emergency Recovery Console](https://www.kicksecure.com/wiki/Recovery#Emergency_Recovery_Console) + - Is not an implementation of [Protecting the Kernel Command Line](https://www.kicksecure.com/wiki/Verified_Boot#Protecting_the_Kernel_Command_Line). ## Network hardening @@ -397,9 +537,9 @@ See: ### Bluetooth Status: Enabled but Defaulted to Off - **Default Behavior**: Although Bluetooth capability is 'enabled' in the kernel, - security-misc deviates from the usual behavior by starting with Bluetooth - turned off at system start. This setting remains until the user explicitly opts - to activate Bluetooth. + security-misc-desktop deviates from the usual behavior by starting with + Bluetooth turned off at system start. This setting remains until the user + explicitly opts to activate Bluetooth. - **User Control**: Users have the freedom to easily switch Bluetooth on and off in the usual way, exercising their own discretion. This can be done via the @@ -417,7 +557,15 @@ See: ### Configuration Details -- See configuration: `/etc/bluetooth/30_security-misc.conf` +- Bluetooth controllers are not automatically enabled at boot (`AutoEnable=false`). +- Pairable and discoverable modes time out after 30 seconds of inactivity. +- Only one Bluetooth controller is exposed to the system (`MaxControllers=1`). +- Resolvable Private Addresses (RPAs) are enforced (`Privacy=network/on`), + preventing MAC-based tracking. + +See: + +- `/etc/bluetooth/30_security-misc.conf` - For more information and discussion: [GitHub Pull Request](https://github.com/Kicksecure/security-misc/pull/145) ### Understanding Bluetooth Terms @@ -478,7 +626,7 @@ Not enabled by default yet. In development. Help welcome. - Add user `root` to group `sudo`. This is required due to the above restriction so that logging in from a virtual console is still possible - - `debian/security-misc.postinst` + `debian/security-misc-shared.preinst` - Abort login for users with locked passwords - `/usr/libexec/security-misc/pam-abort-on-locked-password`. @@ -510,8 +658,8 @@ See: - `/etc/systemd/system/emergency.service.d/override.conf` - `/etc/systemd/system/rescue.service.d/override.conf` -Adverse security effects can be prevented by setting up BIOS password -protection, GRUB password protection, and/or full disk encryption. +Adverse security effects can be prevented by setting up [BIOS Password](https://www.kicksecure.com/wiki/Protection_Against_Physical_Attacks#BIOS_Password) +protection, [Bootloader Password](https://www.kicksecure.com/wiki/Protection_Against_Physical_Attacks#Bootloader_Password) protection, and/or [Full Disk Encryption (FDE)](https://www.kicksecure.com/wiki/Full_Disk_Encryption). ## Console lockdown @@ -532,6 +680,13 @@ See: User accounts are locked after 50 failed login attempts using `pam_faillock`. +- The failure tracking window is 7 days (`fail_interval=604800`). +- Locked accounts never auto-unlock (`unlock_time=never`) and require manual + administrator intervention via the `faillock` command. +- The root account can also be locked (`even_deny_root`). +- Faillock is skipped for certain remote services (e.g. `sshd`, `dovecot`) to + prevent remote lockout attacks. + Informational output during Linux PAM: - Show failed and remaining password attempts. @@ -541,9 +696,12 @@ Informational output during Linux PAM: See: -- `/usr/share/pam-configs/tally2-security-misc` +- `/usr/share/pam-configs/faillock-preauth-security-misc` +- `/usr/share/pam-configs/unix-faillock-security-misc` +- `/etc/security/faillock.conf.security-misc` - `/usr/libexec/security-misc/pam-info` - `/usr/libexec/security-misc/pam-abort-on-locked-password` +- `/usr/libexec/security-misc/pam_faillock_not_if_x` ## Access rights restrictions @@ -566,30 +724,36 @@ of this package. See: -- `debian/security-misc.postinst` +- `debian/security-misc-shared.postinst` - `/usr/libexec/security-misc/permission-lockdown` - `/usr/share/pam-configs/mkhomedir-security-misc` #### umask -Default `umask` is set to `027` for files created by non-root users such as -user `user`. Broken. Disabled. See: - -* https://github.com/Kicksecure/security-misc/issues/184 +The default `umask` is set to `027` for files created by non-root users, such +as the account `user`. This is done using the PAM module `pam_mkhomedir.so umask=027`. -This means files created by non-root users cannot be read by other non-root -users by default. While Permission Lockdown already protects the `/home` folder, -this protects other folders such as `/tmp`. +This configuration ensures that files created by non-root users cannot be read +by other non-root users by default. While Permission Lockdown already protects +the `/home` folder, this setting extends protection to other folders such as +`/tmp`. `group` read permissions are not removed. This is unnecessary due to Debian's use of User Private Groups (UPGs). See also: https://wiki.debian.org/UserPrivateGroups -Default `umask` is unchanged for root because then configuration files created -in `/etc` by the system administrator would be unreadable by "others" and break -applications. Examples include `/etc/firefox-esr` and `/etc/thunderbird`. +The default `umask` is unchanged for root because configuration files created +in `/etc` by the system administrator would otherwise be unreadable by +"others," potentially breaking applications. Examples include `/etc/firefox-esr` +and `/etc/thunderbird`. Additionally, the `umask` is set to `022` via `sudoers` +configuration, ensuring that files created as root are world-readable, even +when using commands such as `sudo vi /etc/file` or `sudo -i; touch /etc/file`. + +When using `sudo`, the `umask` is set to `022` rather than `027` to ensure +compatibility with commands such as `sudo vi /etc/configfile` and +`sudo -i; touch /etc/file`. See: @@ -626,12 +790,12 @@ the boot process too much. See: -* `/usr/bin/permission-hardener` -* `debian/security-misc.postinst` -* `/lib/systemd/system/permission-hardener.service` -* `/etc/permission-hardener.d` -* https://forums.whonix.org/t/disable-suid-binaries/7706 -* https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener +- `/usr/bin/permission-hardener` +- `debian/security-misc-shared.postinst` +- `/usr/lib/systemd/system/permission-hardener.service` +- `/usr/lib/permission-hardener.d` +- https://forums.whonix.org/t/disable-suid-binaries/7706 +- https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener ### Access rights relaxations @@ -642,35 +806,87 @@ incompatible with `hidepid=2`. See: -* `/usr/bin/pkexec.security-misc` -* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 -* https://forums.whonix.org/t/cannot-use-pkexec/8129 +- `/usr/bin/pkexec.security-misc` +- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 +- https://forums.whonix.org/t/cannot-use-pkexec/8129 + +## Emergency shutdown + +- Forcibly powers off the system if the drive the system booted from is + removed from the system. +- Forcibly powers off the system if a user-configurable "panic key sequence" + is pressed (Ctrl+Alt+End by default). +- Forcibly powers off the system if + `sudo /run/emerg-shutdown --instant-shutdown` is called. +- Optional - Forcibly powers off the system if shutdown gets stuck for longer + than a user-configurable number of seconds (30 by default). Requires tuning + by the user to function properly, see notes in + `/etc/security-misc/emerg-shutdown/30_security_misc.conf`. + +A dracut module bundles the emergency shutdown binary, its systemd service, +and configuration files into the initramfs so the panic key sequence is +available even during early boot. A udev rule restarts the service whenever +a keyboard is added or removed. See: + +- `/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh` +- `/usr/lib/udev/rules.d/95-emerg-shutdown.rules` + +## File Manager D-Bus shim + +To prevent malicious applications from opening malicious content using D-Bus, +a shim is present that listens for `org.freedesktop.FileManager1` D-Bus method +calls. This shim displays a confirmation window for every request an +application makes to open one or more directories, while also ensuring +applications can only try to open directories (not files), and cannot try to +open directories that the user cannot access. + +See: + +- `/usr/src/security-misc/fm-shim-backend.c` +- `/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py` +- `/usr/bin/fm-shim-frontend` +- `/usr/libexec/security-misc/build-fm-shim-backend` +- `/usr/lib/systemd/user/fm-shim.service` ## Application-specific hardening -- Enables "`apt-get --error-on=any`" which makes apt exit non-zero for +- `sudo`: Enables "`Defaults !fqdn`", which disables attempts to + determine the local machine's FQDN via DNS as this can leak the machine's + hostname in cleartext to the configured DNS server and cause + `sudo unable to resolve host` errors. `security-misc-desktop` only. Not + enabled on `security-misc-server` since there has been no research yet if + this can break server use cases. +- `apt`: Enables "`apt-get --error-on=any`" which makes apt exit non-zero for transient failures. - `/etc/apt/apt.conf.d/40error-on-any`. -- Enables APT seccomp-BPF sandboxing - `/etc/apt/apt.conf.d/40sandbox`. -- Deactivates previews in Dolphin. -- Deactivates previews in Nautilus - +- `apt`: Enables APT seccomp-BPF sandboxing - `/etc/apt/apt.conf.d/40sandbox`. +- `Dolphin`: Deactivates previews in Dolphin. +- `Nautilus`: Deactivates previews in Nautilus - `/usr/share/glib-2.0/schemas/30_security-misc.gschema.override`. -- Deactivates thumbnails in Thunar. +- `Thunar`: Deactivates thumbnails, disables automatic volume management, + hides the network bookmark, and sets the date format to ISO in Thunar. - Rationale: lower attack surface when using the file manager - https://forums.whonix.org/t/disable-preview-in-file-manager-by-default/18904 -- Thunderbird is hardened with the following options: - - Displays domain names in punycode to prevent IDN homograph attacks (a - form of phishing). - - Strips email client information from sent email headers. - - Strips user time information from sent email headers by replacing the - originating time zone with UTC and rounding the timestamp to the nearest - minute. - - Disables scripting when viewing PDF files. - - Disables implicit outgoing connections. - - Disables all and any kind of telemetry. -- Security and privacy enhancements for gnupg's config file +- `gnupg`: Security and privacy enhancements for gnupg's config file `/etc/skel/.gnupg/gpg.conf`. See also: - https://raw.github.com/ioerror/torbirdy/master/gpg.conf - https://github.com/ioerror/torbirdy/pull/11 +- `SSH client`: Hardens the SSH client by restricting key exchange to + post-quantum-hybrid and modern algorithms, limiting host and public key + authentication to Ed25519 only, requiring the use of strong ciphers, and + enforcing encrypt-then-MAC. + `/etc/ssh/ssh_config.d/30_security-misc.conf` +- `SSH server`: Hardens the SSH server with the same cryptographic restrictions + as the client. Additionally disables password and keyboard-interactive + authentication, disables agent/TCP/X11 forwarding, limits authentication + attempts to 3, and suppresses the Debian version banner. + `/etc/ssh/sshd_config.d/30_security-misc.conf` +- `flatpak`: Configures flatpak to require authentication for all software installation + and management tasks including updates. Ships + `/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc`, + diverts/hides `/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules`. +- `git`: Disables symlinks to protect against known CVEs and enables object + integrity checking (`fsckObjects`) on transfer, fetch, and receive operations. + `/etc/gitconfig` ### Project scope of application-specific hardening @@ -680,7 +896,7 @@ Before sending pull requests to harden arbitrary applications, please note the scope of security-misc is limited to default installed applications in Kicksecure and Whonix. This includes: -- Thunderbird, VLC Media Player, KeePassXC +- VLC Media Player, KeePassXC - Debian Specific System Components (APT, DPKG) - System Services (NetworkManager IPv6 privacy options, MAC address randomization) @@ -736,12 +952,122 @@ default. break many things, it is disabled by default and can optionally be enabled by executing `systemctl enable hide-hardware-info.service` as root. +## USBGuard + +USB device authorization rules are shipped for USBGuard. All unrecognized USB +devices plugged in at runtime are blocked by default +(`ImplicitPolicyTarget=block`), while devices connected at boot time and some +likely-safe devices are allowed. The service is suppressed if the system lacks +a USB controller. + +- Reject USB devices with undefined or non-standard interface classes. +- Reject devices that combine a keyboard/mouse (HID) interface with + non-HID interfaces, which is a common indicator of a BadUSB attack. +- Reject devices with RNDIS interfaces due to suspected protocol-level + buffer overflow vulnerabilities. +- Allow only one keyboard and one mouse at a time. +- Allow USB audio, video, mass storage, and hub devices. +- IPC access is granted to members of the `sudo` and `qubes` groups. + +See: + +- `/etc/usbguard/usbguard-daemon.conf.security-misc` +- `/etc/usbguard/rules.d/30_security-misc.conf` +- `/etc/usbguard/IPCAccessControl.d/` +- `/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf` + +## Systemd preset defaults + +The following services are explicitly disabled by default in the systemd +preset because these are work-in-progress or can severely break functionality. +These can be opted-in by the user: + +- `hide-hardware-info.service` - Restricts `/sys` and `/proc` hardware info. + Testers-only. See [hide-hardware-info.service](https://www.kicksecure.com/wiki/Security-misc#hide-hardware-info.service). + +- `permission-hardener.service` - Applies permission hardening at boot. + See [permission-hardener.service](https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#permission-hardener.service). + +- `remount-secure.service` - Remounts filesystems with hardened options. + In development. See [Remount Secure](https://www.kicksecure.com/wiki/Dev/remount-secure). + +- `proc-hidepid.service` - Mounts `/proc` with `hidepid=2`. + See [hidepid](https://www.kicksecure.com/wiki/Security-misc#hidepid). + +- `harden-module-loading.service` - Disables kernel module loading after boot. + [Harden Module Loading](https://www.kicksecure.com/wiki/Security-misc#Harden_Module_Loading) can cause major breakage. + +- `ensure-shutdown.service` - Forced shutdown watchdog. + In development. + +- `ensure-shutdown-trigger.service` - Companion trigger for forced shutdown. + In development. + +- `memlockd.service` - Memory locking daemon (used internally by `emerg-shutdown`). + Can be enabled if the user intents to use `memlockd.service`. + +See: `/usr/lib/systemd/system-preset/50-security-misc.preset` + ## Miscellaneous - Hardened malloc compatibility for haveged workaround - `/lib/systemd/system/haveged.service.d/30_security-misc.conf` - -- Set `dracut` `reproducible=yes` setting + `/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf` + +- Set `dracut` `reproducible=yes` setting. + `/etc/dracut.conf.d/30-security-misc.conf` + +- A `virusforget` script detects unauthorized changes to a set of sensitive + files by comparing them against a stored baseline. Work in progress - the + implementation will likely change significantly. + `/usr/libexec/security-misc/virusforget` + +- A custom `askpass` helper provides a GUI password prompt via `yad` for + superuser actions. + `/usr/libexec/security-misc/askpass` + +- A helper script checks whether a USB controller is present on the system, + used as a conditional for USBGuard services. + `/usr/libexec/security-misc/check-for-usb-controller` + +- A VirtualBox-specific workaround kills the `VBoxDRMClient` process during + shutdown to prevent it from blocking a clean unmount of `/tmp`. Only + activates inside VirtualBox VMs. + `/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service` + +- PAM conditional helpers (`pam_only_if_login`, `pam_only_if_su`) allow + specific PAM rules to apply only to certain services. + `/usr/libexec/security-misc/pam_only_if_login` + `/usr/libexec/security-misc/pam_only_if_su` + +- Unsafe logins (such as logging into non-sysmaint accounts while booted in + sysmaint mode, or elevating privileges from an unprivileged account to a + passwordless privileged account) are blocked. Enforces account/session + separation between `sysmaint` and regular user accounts. + `/usr/libexec/security-misc/block-unsafe-logins` + `/usr/share/pam-configs/block-unsafe-logins-security-misc` + +- `/usr/share/security-misc/` is added to `XDG_CONFIG_DIRS` at login via + `/etc/profile.d/30_security-misc.sh` so that security-misc XDG + configuration overrides (e.g. Dolphin, Thunar) are available system-wide. + +- An AppArmor tunable creates aliases for security-misc's config-package-dev + displaced files (e.g. `common-session`, `login.defs`, `securetty`) so that + AppArmor policies continue to work with the diverted paths. + `/etc/apparmor.d/tunables/home.d/security-misc` + +- A custom `sysinit-post.target` provides a synchronization point between + `sysinit.target` and `basic.target` for services that must run after + early-boot initialization but before general services. + `/usr/lib/systemd/system/sysinit-post.target` + +- A systemd drop-in adds the `sysfs` supplementary group to all user session + managers (`user@.service`), granting users group-based read access to `/sys` + entries restricted by `hide-hardware-info.service`. + `/usr/lib/systemd/system/user@.service.d/sysfs.conf` + +- LKRG (Linux Kernel Runtime Guard) VirtualBox compatibility: automatically + manages LKRG sysctl settings when VirtualBox host software is detected. + `/usr/share/security-misc/lkrg/lkrg-virtualbox` ## Legal @@ -749,15 +1075,45 @@ default. https://github.com/Kicksecure/security-misc/pull/167 +## Package split + +The `security-misc` source code repository builds three different software packages: + +- `security-misc-shared` +- `security-misc-desktop` +- `security-misc-server` + +The guiding principle has been: if there are no adverse effects, or if it is unclear whether a file belongs in the `desktop` or `server` package, then it will be placed in the `shared` package. + +The hash symbol ("`#`") is used as a separator character. + +Some clear examples where files belong only in `security-misc-desktop`: + +- `/usr/lib/NetworkManager/conf.d/80_ipv6-privacy#security-misc-desktop.conf` +- `/usr/lib/NetworkManager/conf.d/80_randomize-mac#security-misc-desktop.conf` +- `./usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop` + +This is because enabling IPv6 privacy extensions or MAC randomization on a server will not increase privacy but instead carries a high risk of breaking connectivity. + +A less clear example is `/etc/bluetooth/30_security-misc.conf#security-misc-desktop`. Also refer to the above chapter "Bluetooth Hardening". A server usually doesn't have Bluetooth, so on a server it may instead be useful to fully disable Bluetooth. + +Some clear examples where files belong only in `security-misc-shared`: + +`/etc/profile.d/30_security-misc.sh#security-misc-shared` indeed belongs in `security-misc-shared` and not `security-misc-desktop`. For the reason, see below. + +Other considerations have been: + +- Just because it's a server, it does not follow that there is no GUI (graphical user interface) desktop environment. +- Just because it's a desktop computer, it doesn't mean it's a GUI and not a CLI (command line interface). +- Therefore, the split is between `security-misc-desktop` and `security-misc-server`. +- Therefore, the split is not between `security-misc-gui` and `security-misc-cli`. + +\[1\] https://github.com/Kicksecure/security-misc/issues/187 + ## Related -- Linux Kernel Runtime Guard (LKRG) -- tirdad - TCP ISN CPU Information Leak Protection. -- Kicksecure (TM) - a security-hardened Linux Distribution -- And more. -- https://www.kicksecure.com/wiki/Linux_Kernel_Runtime_Guard_LKRG -- https://github.com/Kicksecure/tirdad -- https://www.kicksecure.com +- [`tirdad` - TCP ISN CPU Information Leak Protection.](https://www.kicksecure.com/wiki/Tirdad) +- [Kicksecure (TM) - a security-hardened Linux Distribution](https://www.kicksecure.com) - https://github.com/Kicksecure ## Discussion @@ -772,7 +1128,7 @@ See https://www.kicksecure.com/wiki/Security-misc#install ## How to Build deb Package from Source Code -Can be build using standard Debian package build tools such as: +Can be built using standard Debian package build tools such as: dpkg-buildpackage -b diff --git a/README_generic.md b/README_generic.md index 787af723..70edaf08 100644 --- a/README_generic.md +++ b/README_generic.md @@ -4,10 +4,12 @@ https://github.com/Kicksecure/security-misc/blob/master/README.md https://www.kicksecure.com/wiki/Security-misc +Package security-misc-desktop and/or security-misc-server may also be useful. + Discussion: Happening primarily in Whonix forums. -https://forums.whonix.org/t/kernel-hardening/7296 +https://forums.whonix.org/t/kernel-hardening-security-misc/7296 ## How to install `security-misc` using apt-get ## @@ -28,7 +30,7 @@ sudo cp ~/derivative.asc /usr/share/keyrings/derivative.asc 3\. Add the derivative repository. ``` -echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list +echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com trixie main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list ``` 4\. Update your package lists. diff --git a/agents/fm-shim.md b/agents/fm-shim.md new file mode 100644 index 00000000..3ce7cc59 --- /dev/null +++ b/agents/fm-shim.md @@ -0,0 +1,53 @@ +# fm-shim Notes + +## Accepted Threat Model + +- Local DoS is out of scope. +- Directory replacement / symlink swaps are out of scope (frontend documents this). +- Success replies are returned even on frontend failure (spec safety). + +## Architecture + +- **Backend** (`fm-shim-backend.c`): C daemon that claims `org.freedesktop.FileManager1` + D-Bus name, receives ShowFolders/ShowItems/ShowItemProperties calls, forks a + Python frontend with the URI arguments and systemd's user environment. +- **Frontend** (`fm_shim_frontend.py`): PyQt5 dialog that validates URIs, resolves + paths, shows a confirmation prompt, then opens directories via `gio launch`. +- **Build script** (`build-fm-shim-backend`): Compiles the C backend with + extensive GCC hardening flags. +- **Service** (`fm-shim.service`): systemd user service, Type=notify. + +## D-Bus name acquisition + +The fm-shim-backend intentionally uses `DBUS_NAME_FLAG_REPLACE_EXISTING` +**without** `DBUS_NAME_FLAG_DO_NOT_QUEUE`. When the name cannot be acquired, +the process warns and omits `READY=1` so that systemcheck alerts the user. +Hard-failing (via `errx`) removes the service entirely, which is worse than +running in a degraded-but-monitored state. Do not change this to a fatal error. + +### DBUS_NAME_FLAG_DO_NOT_QUEUE + +The D-Bus name queueing behavior is intentional. The IN_QUEUE case withholds +`READY=1` (triggering a `systemcheck` warning) while remaining in the queue to +reclaim the name ASAP. Exiting immediately would leave the name permanently +unprotected - a worse outcome. Do not re-propose this change. + +## Systemd sandboxing on services that spawn user-facing apps + +Do not add restrictive systemd sandboxing directives (`ProtectHome`, +`MemoryDenyWriteExecute`, `ProtectSystem=strict`, etc.) to the fm-shim +service. These restrictions are inherited by child processes - the file +manager and anything it launches. `MemoryDenyWriteExecute` may break JIT, +`ProtectHome=read-only` breaks normal file manager operations, etc. + +## Closing inherited file descriptors in forked children + +Use the `close_range(3, ~0U, CLOSE_RANGE_UNSHARE)` syscall (requires +`#define _GNU_SOURCE` and `#include `). Do not iterate +`/proc/self/fd` manually. + +## D-Bus error replies + +When sending D-Bus error replies in multiple places, use the shared helper +function `send_error_message_maybe()` rather than duplicating the pattern +inline. diff --git a/agents/fuzzing.md b/agents/fuzzing.md new file mode 100644 index 00000000..56125099 --- /dev/null +++ b/agents/fuzzing.md @@ -0,0 +1,74 @@ + + +# Fuzzing + +## Hypothesis property tests + +Property tests live at `ci/tests//test_property.py` (mirroring +the helper-scripts layout). **Outside** the Python package tree on +purpose: `debian/security-misc-shared.install` ships +`usr/lib/python3/dist-packages/fm_shim_frontend/...`, so keeping the +property tests under `ci/tests/` means they don't end up in the +installed `.deb`. + +Currently covered: + +- `ci/tests/fm_shim_frontend/test_property.py` - Hypothesis + property tests over `get_path_list_from_uris`, the URI-validation + chokepoint between the FileManager1 D-Bus surface and the user- + facing dialog. Six properties (`never_raises`, + `output_paths_absolute`, `output_no_dangerous_chars`, + `output_unique_and_sorted`, `idempotent`, plus a deterministic + regression-suite of nine adversarial inputs). + + At introduction this suite found an exploitable bug: an attacker + who can deliver a URI with a single path component longer than + NAME_MAX (255 bytes on Linux) crashed the process via an + uncaught `OSError(ENAMETOOLONG)` from `Path.exists()`. Fixed in + the same commit that added the suite. + +Test runner: `.github/workflows/lint-python.yml` runs flake8 +followed by `python3 -m pytest` against `ci/tests//`. apt- +installs `python3-pytest`, `python3-hypothesis`, plus PyQt5 +runtime deps required for the source under test to import. + +`ci/tests//conftest.py` stubs out `stdisplay` (helper-scripts +package, not on PyPI / not in apt for the runner) with an identity +function, and stubs PyQt5.QtCore/Gui/Widgets so that the Qt class +inheritance at module level (`class FmShimWindow(QDialog)`) works +without a real display. + +Local run (single package): + +``` +PYTHONPATH=usr/lib/python3/dist-packages python3 -m pytest \ + --import-mode=importlib -q \ + ci/tests/fm_shim_frontend/test_property.py +``` + +When adding a new package, mirror the same structure: +`ci/tests//{test_property.py,conftest.py}`. Keep at least +two properties: `test_never_raises` and one domain-specific +invariant. + +## ClusterFuzzLite (Atheris / libFuzzer) + +Not yet wired up. Helper-scripts has the full +`.clusterfuzzlite/{Dockerfile,build.sh,project.yaml}` + +`fuzz/fuzz_.py` setup; mirror that here when the property- +test suite has been running long enough to catch the easy wins +and the harder, coverage-guided layer is justified. + +## Trust footprint + +- Hypothesis: Debian apt (`python3-hypothesis`). +- pytest: Debian apt (`python3-pytest`). +- PyQt5 + sip: Debian apt (`python3-pyqt5` + `python3-pyqt5.sip`). +- ClusterFuzzLite + Atheris (when added): Google. Per-pin + provenance will live in the future + `.clusterfuzzlite/Dockerfile`. diff --git a/changelog.upstream b/changelog.upstream index 0d74dbf9..7d8ff45c 100644 --- a/changelog.upstream +++ b/changelog.upstream @@ -1,17 +1,7920 @@ +commit 7f60beb8bffa344453bd6794f92ff72b6098edf3 +Merge: d80e26de cbba86cb +Author: Patrick Schleizer +Date: Wed Sep 30 04:20:30 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit cbba86cb06d7acd46aaf780f9cd1e5ab4ac97d8d +Author: Aaron Rainbolt +Date: Tue Sep 29 22:57:46 2026 -0400 + + Polish, reintroduce removed ciphers again but keep the requirement to use post-quantum key exchange + +commit 5202e7564b9133ae267c6064c88e69d23d45cd87 +Merge: d80e26de c3b4e219 +Author: Aaron Rainbolt +Date: Tue Sep 29 22:33:57 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit c3b4e219acaf5b853c8a3d71f32360ae5db3aa32 +Merge: 96c0366c d217e28d +Author: assisted-by-ai +Date: Tue Sep 29 04:28:20 2026 -0400 + + Merge arraybolt3/trixie into ai (remaster) + +commit d80e26defda7271a513cb6ba8ddee7c3e9ae83cf +Author: Patrick Schleizer +Date: Tue Sep 29 08:08:57 2026 +0000 + + bumped changelog version + +commit 96c0366cdc53005b5a06104d6c9c325c12c87882 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Mon Sep 28 02:58:45 2026 -0400 + + ssh: fix override advice; sync interop comments + + - OpenSSH is first-wins: a lower-numbered drop-in (or ~/.ssh/config) overrides, not a higher-numbered one + + - server comment no longer claims the client stays broad; the client config is equally strict + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit aba02ec3634c006ea993c4609cf9a31c2e65a2b4 +Merge: 9cb4efa8 d217e28d +Author: Patrick Schleizer +Date: Mon Sep 28 02:40:50 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 802205a4b8e9519ebd04eda34f5428ec8719ed59 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Mon Sep 28 01:19:07 2026 -0400 + + ssh client: post-quantum-only kex + aes256-gcm (match server) + + - The client default now uses the same strictest set as the server: PQ-only + key exchange and the aes256-gcm cipher only (drop curve25519, chacha20, + aes256-ctr). Outbound SSH therefore only reaches post-quantum-capable + servers; override per-host in ~/.ssh/config or a 50_user.conf drop-in for a + server with a narrower algorithm set. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit d217e28daaaa3ef05d3f489180ec920eb2a4e18a +Author: Aaron Rainbolt +Date: Sun Sep 27 21:11:28 2026 -0400 + + Undo dangerous SSH settings changes applied by AI + +commit 6cee7b5659c60bd6e2f995786c178cb575f8c980 +Merge: 9cb4efa8 0a35d857 +Author: Aaron Rainbolt +Date: Sun Sep 27 20:49:32 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit 0a35d857cf38f02e99389bbfc0e299619b4105da +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sun Sep 27 08:22:31 2026 -0400 + + sshd: post-quantum-only kex + aes256-gcm (sshaudit.com A+/100) + + - Server default now offers PQ-only key exchange (drop classical curve25519) + and an AEAD, Terrapin-immune cipher (aes256-gcm, drop chacha20). This is the + A+ / 100-of-100 sshaudit.com profile (verified equivalent to grapheneos.org): + resists harvest-now-decrypt-later and removes chacha20's residual Terrapin + exposure for unpatched peers. + - Interop: requires an OpenSSH 9.0+ (post-quantum) peer. Client config stays + broad so outbound SSH to older servers is unaffected. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit fcbf940c25f57af3ddf2ec8dda1e2f8e95847bda +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sun Sep 27 04:21:49 2026 -0400 + + Move ssh-audit test tool + policies out to dist-ai + + - The ssh-audit-test driver and the server/client ssh-audit policies are test + artifacts, not runtime hardening; they now live in the dist-ai + security-misc-tests suite. security-misc's shipped package stays lean. + - Kept here: only the CI wiring (dm-consumer.yml + the dist-ai-tests / + ssh-prod workflows), which is inherently per-consumer-repo. The dist-ai + drift-guard test keeps the moved policies in sync with the ssh config drop-ins + that remain the source of truth. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 6d70b404e1812ade14912840263bf4671890dcc6 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sat Sep 26 02:54:03 2026 -0400 + + ssh-audit-test: clean error on missing option operand + + - --policy / --port with no value crashed on shift (shift count out of range) + instead of reporting the missing operand; validate and die cleanly. + - Document that the ssh-audit policy check is server-to-client; OpenSSH sets + both directions symmetrically, so it is complete for our OpenSSH targets. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 3ce6b81d5f7f9f1561d33ae0f474d11de8021195 +Author: claude (dev706 06a4d27a-451a-4444-b924-ffce1da248b5) +Date: Sat Sep 26 01:46:37 2026 -0400 + + Add ssh-audit hardening policies, test tool and CI wiring + + - ssh-audit-test + server/client policies pin the exact hardened algorithm + set (allow_algorithm_subset_and_reordering = false); a regression that + loosens the ssh config, or a server missing the hardening, now fails loud. + - dist-ai consumer wiring runs the config suite per PR and scans production + SSH on a schedule. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 2bf04eee21a66fed4f3c45556ebd362cfc6f810f +Merge: 00bad984 9cb4efa8 +Author: assisted-by-ai +Date: Thu Sep 24 22:51:46 2026 -0400 + + Merge master into ai (remaster) + +commit 9cb4efa8a716343271e3339fb7e13408146b7943 +Author: Patrick Schleizer +Date: Sat Sep 19 14:09:18 2026 +0000 + + bumped changelog version + +commit f7e4aa5ed2dbf0cd0d9155695ad4fdf315a1181f +Merge: a70c168d 87ff42a1 +Author: Patrick Schleizer +Date: Sat Sep 19 10:00:10 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 87ff42a19c786050471b5350e228a26a82bd61eb +Author: Aaron Rainbolt +Date: Wed Sep 16 00:01:44 2026 -0400 + + Comments, revert an unreliable feature addition in permission-hardener's state file parsing + +commit 3bc6ec2a046f20d292273095c40352ec6d914a52 +Merge: a70c168d 00bad984 +Author: Aaron Rainbolt +Date: Tue Sep 15 23:26:46 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit 00bad98497794d461fe4923e4ff182a61b918df7 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 10:56:10 2026 -0400 + + security-misc: source has.bsh explicitly in preinst + +commit 57a6530574d21307d77a371a1fb53259bfbe22fa +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 10:52:46 2026 -0400 + + security-misc: simplify preinst helper-scripts sourcing + + - helper-scripts is a Pre-Depends, configured before this preinst; strict + options first, then plain source -- errexit turns any load failure into a + hard stop, so the bespoke fail-closed handling + type -t check are redundant + +commit f0ea22f6b0f631485fb8f405eb352d35a3d33d84 +Merge: 888a5f67 a70c168d +Author: assisted-by-ai +Date: Tue Sep 15 10:45:48 2026 -0400 + + Merge master into ai (remaster) + +commit a70c168da6730ce86d1ea12f29bff2448734a8a9 +Author: Patrick Schleizer +Date: Tue Sep 15 14:32:35 2026 +0000 + + bumped changelog version + +commit 0a004b6675d22e4e54f79f07b086cebe78177280 +Author: Patrick Schleizer +Date: Tue Sep 15 10:27:21 2026 -0400 + + output + +commit edbaf1c198cb727ab00ff57ef573edc8c7974fd6 +Author: Patrick Schleizer +Date: Tue Sep 15 12:00:55 2026 +0000 + + bumped changelog version + +commit 888a5f679d816aeb8c50fc14ab604d27d158863d +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 04:27:13 2026 -0400 + + permission-hardener: restore octal-owner filename disambiguation + + - the right-to-left octal scan mis-anchors on a numeric octal-looking owner + (e.g. 0755), folding the real mode into the filename; the nonexistent path is + then silently dropped, leaving a SUID binary un-hardened. + - restore fixed-width tail anchoring + disambiguation by on-disk existence; + test_whitespace_filename.sh (numowner, 'x y') parses again. + +commit c894bbcf75bbe3c63f17b75f0ffc8a0ae2f98ef3 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 02:37:02 2026 -0400 + + preinst: fail closed loudly if helper-scripts library missing + + - source failures were swallowed (errexit not set yet); abort with the real + cause instead. + - a missing group_has_nonroot_member now aborts with the true reason rather + than degrading the lockout check into a misleading 'no account is a member of + sudo' abort. + +commit 239532762966b9fc57f158bb02fb19b04bf1e1bc +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Tue Sep 15 02:16:06 2026 -0400 + + Pre-Depend on helper-scripts; source accountctl.sh, drop vendored copy + + - helper-scripts moved from Depends to Pre-Depends: it is configured before this + package is unpacked, so the preinst can source its libraries. Reuse the real + group_has_nonroot_member from accountctl.sh instead of a vendored copy (and its + drift guard). + - accountctl.sh pulls in has.bsh, so 'has' is available: use it, drop the + no-has waiver and the command -v fallbacks. + +commit 497a23fbb31e2550fc858e6139e84b595be49d20 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Mon Sep 14 12:49:30 2026 -0400 + + Sync vendored group_has_nonroot_member (reject numeric arg) + +commit 88abbcaa436a86dcd15a37c8ba4f4351b565c050 +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Mon Sep 14 11:13:01 2026 -0400 + + Detect primary-GID members in the install checks + + - sudo_users_check / console_users_check now count a non-root account + whose PRIMARY group is sudo/console (via a vendored + group_has_nonroot_member), not only supplementary members; a + supplementary-only scan falsely aborted install for such an admin. + - Revert the qubesdb-read probe to 'command -v' (no-has waiver): a + preinst runs at unpack time, before helper-scripts is guaranteed + configured, so it must not source has.bsh. + - group_has_nonroot_member is VENDORED from helper-scripts accountctl.sh + (same reason it cannot be sourced); a dist-ai drift guard keeps them + in sync. + +commit dc103b260b2dfd8b94ccdd23aaaaa54000d8d56c +Author: claude (dev556 4bdc306f-7204-4d7f-ba68-0c897dcf0291) +Date: Mon Sep 14 09:35:22 2026 -0400 + + Also skip install checks on dist_build_iso; house-style + + - Skip the sudo/console-user install checks when dist_build_iso=true (an + ISO/live build) in addition to the existing skip_install_check file, so + the derivative-maker build no longer needs to write that marker file. + The manual file-based bypass is kept for non-derivative-maker users. + - Modernize to dist-ai house style: strict-mode block, printf not echo, + has not command -v, braced + nounset-guarded variables. + +commit 4db7b41bda5f7f2a1d0c1f163a070c998a5a284e +Merge: 81d6905a 827e5ee1 +Author: Patrick Schleizer +Date: Mon Sep 14 02:29:46 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 827e5ee1f8a250ba8b04e08c91892b1887e83d61 +Author: Aaron Rainbolt +Date: Sun Sep 13 17:50:16 2026 -0400 + + comments + +commit a85c5b57045e95a840c4059e66d8296b8e51c155 +Merge: d108f60a 28d05b0c +Author: Aaron Rainbolt +Date: Sun Sep 13 17:40:14 2026 -0400 + + Merge branch 'arraybolt3/maybebyte-pam-auth-update' into arraybolt3/trixie + +commit 28d05b0cd17c9f3d77786cf14798c1cdec912d0c +Merge: 86780917 d108f60a +Author: Aaron Rainbolt +Date: Sun Sep 13 17:39:32 2026 -0400 + + Merge branch 'arraybolt3/trixie' into arraybolt3/maybebyte-pam-auth-update + +commit d108f60a20cfc51cbe3d98f6200e8387a47f7488 +Author: Aaron Rainbolt +Date: Sun Sep 13 17:25:53 2026 -0400 + + comment + +commit ac4b5023ae7c0ca034b8e85dda91d34de4e2e920 +Author: Aaron Rainbolt +Date: Sun Sep 13 17:21:40 2026 -0400 + + Polish + +commit 81ed36c2e3e5777ca81e33f8a40edd1cd952e001 +Merge: 439ddce5 db8f36fd +Author: Aaron Rainbolt +Date: Sun Sep 13 17:11:40 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit db8f36fd5ab660ad1c2dd02fffa998a2b3f1ee58 +Merge: e64a2c7d b8e218c6 +Author: claude +Date: Sun Sep 13 06:07:26 2026 -0400 + + Merge branch 'master' into ai + +commit b8e218c6438b862acd881eac9599ff40224fe862 +Merge: c77beac7 b9cf5081 +Author: claude +Date: Sun Sep 13 06:07:25 2026 -0400 + + Merge remote-tracking branch 'upstream/master' + +commit e64a2c7d0481dfd38c8a575a49ddf55248e6230d +Author: claude (dev541 abd2cdfa-632f-4eda-bd69-14b67be2017e) +Date: Sun Sep 13 05:28:23 2026 -0400 + + Python -Bsu shebangs; grep --quiet in tests + +commit 81d6905af8bd14a21163a1ab308c996e38869f74 +Merge: b9cf5081 439ddce5 +Author: Patrick Schleizer +Date: Sat Sep 12 09:49:38 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 439ddce5bf08465710b81bd2353ac105b1e522c4 +Author: Aaron Rainbolt +Date: Fri Sep 11 17:06:29 2026 -0400 + + Revert some faulty changes to style-ok comments (uglier style, excessive verbosity, allow-echo in a script that did not use echo) + +commit d4e50dc6d74b6cf13c3dff2ef2b7d16a2b682ec2 +Merge: b9cf5081 409e0483 +Author: Aaron Rainbolt +Date: Fri Sep 11 16:58:09 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit b9cf508116757b7fff13c199a142742246162877 +Author: Patrick Schleizer +Date: Wed Sep 9 11:05:44 2026 +0000 + + bumped changelog version + +commit 0ba912995c461446bf527cf0c6a9db47e8aaab08 +Merge: fc2afb15 dd05179e +Author: Patrick Schleizer +Date: Wed Sep 9 06:56:30 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 409e0483071c2ca6a313272ec1957aab80a8cc3f +Merge: 24b39b0c c77beac7 +Author: claude (dev490 427cd1a1-bb80-4a36-9e14-2b6cec600780) +Date: Tue Sep 8 23:45:54 2026 -0400 + + Merge branch 'master' into ai + + # Conflicts: + # debian/security-misc-shared.postinst + # usr/bin/remount-secure#security-misc-shared + # usr/libexec/security-misc/check-for-usb-controller#security-misc-shared + # usr/share/lintian/overrides/security-misc-shared#security-misc-shared + # usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared + +commit c77beac7b4db560cd6d58abbc8943b77ee0ae62c +Merge: 6355b72c dd05179e +Author: claude (dev490 427cd1a1-bb80-4a36-9e14-2b6cec600780) +Date: Tue Sep 8 23:43:07 2026 -0400 + + Merge remote-tracking branch 'ab/trixie' + +commit 6355b72c6d9de2002506a3ab797b153f83c92a9d +Merge: 78491468 fc2afb15 +Author: claude (dev490 427cd1a1-bb80-4a36-9e14-2b6cec600780) +Date: Tue Sep 8 23:43:06 2026 -0400 + + Merge remote-tracking branch 'up/master' + +commit dd05179ea3310d0cac4d2de9db220ebbd5224fbf +Author: Aaron Rainbolt +Date: Tue Sep 8 21:24:00 2026 -0400 + + fix + +commit fc2afb158592f8a8ad7270dcb5ee5abb33e1824d +Author: Patrick Schleizer +Date: Tue Sep 8 15:30:04 2026 +0000 + + bumped changelog version + +commit 24b39b0ca1b6c5a0fd35036703f56a2a1f5b9225 +Author: claude (dev474 c7439536-fad8-4884-b71a-d2f3c4c23905) +Date: Mon Sep 7 11:49:54 2026 -0400 + + rename has.sh to has.bsh (bashism convention) + + Sourced helper-scripts lib uses bashisms; .bsh marks it. Scoped to has.sh consumers (repo carries unrelated concurrent WIP). + +commit 24a55b78fe94ef69bb866f71b86d54e3a659b83c +Merge: 94ea3994 aa458bac +Author: Patrick Schleizer +Date: Mon Sep 7 01:11:01 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit aa458bac395d6fd450c749d0934f4a63d4a76c17 +Author: Aaron Rainbolt +Date: Sun Sep 6 23:11:56 2026 -0400 + + Fix coding style, shorten comments + +commit 97f78d8262aeea854cef3d654ab6aeb57e1f08ec +Merge: 94ea3994 077d41a6 +Author: Aaron Rainbolt +Date: Sun Sep 6 22:38:54 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/remove-system-map-readonly-continue' into arraybolt3/trixie + +commit 94ea3994027115b02bdcc8d8246c4c5b5c40a776 +Author: Patrick Schleizer +Date: Sun Sep 6 16:58:23 2026 +0000 + + bumped changelog version + +commit 0088727e4a9ca17d07916a30544ffa6e13890bfc +Author: Patrick Schleizer +Date: Sun Sep 6 12:56:41 2026 -0400 + + cleanup + +commit ebd72d593c81fad95d09a055d4e839b6eecca332 +Merge: 78491468 87506b1e +Author: Patrick Schleizer +Date: Sun Aug 30 10:02:32 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 3e3d7453e3318ac79ea36ae14ed90442ded0c165 +Author: claude (dev371 3fff1819-b77d-4dde-be19-8c01e09d3394) +Date: Fri Aug 28 01:23:45 2026 -0400 + + lintian: drop redundant maintainer-script-ignores-errors override + + Now suppressed globally in genmkfile; the false positive is the same errexit long-form case. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 87506b1eaf45fa7501d54cf83b9be13578f86ecb +Author: Aaron Rainbolt +Date: Fri Aug 28 01:03:22 2026 -0400 + + Polish, add TODOs + +commit 0f1f701b5c413b1ab2229577261fe6e0187d84ca +Merge: eb5b301d bb399ba7 +Author: Aaron Rainbolt +Date: Thu Aug 27 21:02:55 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit bb399ba73704e4c20fbc6965d13bee4f2c63626c +Author: claude (dev352 385b930f-4313-4883-93d5-e6857c3f7ea7) +Date: Thu Aug 27 12:07:58 2026 -0400 + + lintian: override maintainer-script-ignores-errors in the shipped file + + The postinst uses long-form 'set -o errexit' (style R-013); lintian's + scripts check only matches short 'set -e'. Add the false-positive + override to the package's own usr/share/lintian/overrides file -- a + separate debian/*.lintian-overrides displaces it (dh_lintian installs to + the same path), losing the etc-skel and other overrides it carries. + +commit d1b9f4c0517f03936af556445fedd2ee22d14e98 +Merge: cc7a93d1 908cadc6 +Author: claude (dev352 385b930f-4313-4883-93d5-e6857c3f7ea7) +Date: Thu Aug 27 11:22:32 2026 -0400 + + Merge branch 'ai' of ssh://github.com/org-ai-assisted/security-misc into ai + +commit cc7a93d10a30e19631c64437b5c6078ba5d74f77 +Author: claude (dev352 385b930f-4313-4883-93d5-e6857c3f7ea7) +Date: Thu Aug 27 11:21:51 2026 -0400 + + lintian: override false-positive maintainer-script-ignores-errors + + The postinst enables errexit via long-form 'set -o errexit' (project + style, R-013); lintian's check only matches short 'set -e'. Same + override tb-updater already carries. + +commit 908cadc6177c00d4ff3465b33b20b3c971ce246a +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Aug 24 23:31:21 2026 -0400 + + ci: drop orphaned consumer-secrets-audit.yml (reusable decommissioned) + +commit a6d7a3585f8905bc3f898d8dd83c3b07cb04cba9 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Aug 24 23:31:19 2026 -0400 + + ci: drop orphaned consumer-codex-review.yml (reusable decommissioned) + +commit e6a81266555130673dc7d8bcb85ea50bbad9e852 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Aug 24 23:31:16 2026 -0400 + + ci: drop orphaned consumer-claude-code.yml (reusable decommissioned) + +commit 1c9f144b9ebe58daa174de05f5b0c0e42038bfc1 +Author: claude (dev272 e8b76afb-795c-4739-8ebd-023de854021e) +Date: Fri Aug 21 04:41:27 2026 -0400 + + security-misc: source helper-scripts via HELPER_SCRIPTS_PATH, drop SC1091 disable + + - check-for-usb-controller, permission-hardener, lkrg-virtualbox: use + source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/; + drop the dead '# shellcheck disable=SC1091' and the stale sibling note. + - completed pre-existing whole-file style debt: R-010 export LC_ALL=C in + the strict-mode block (dropping the duplicate single-quoted mid-file one). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 78491468a7c209f423f48f74de015f1df2b9a980 +Author: Patrick Schleizer +Date: Sun Aug 16 08:24:20 2026 +0000 + + bumped changelog version + +commit f1e9da8fb911b1e3962f219290df14753794aee8 +Merge: 52e18f72 1fcf4967 +Author: Patrick Schleizer +Date: Sat Aug 15 12:55:45 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit f2c1e7517cf8a8017db91ef7cf42784e93e14ae8 +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 13:28:37 2026 -0400 + + permission-hardener: read spaced paths back from the state DB + + Fresh-claude review of the whitespace feature found the write/read sides + disagree: parsing now accepts space-containing filenames into the policy, but + load_state_without_policy split the dpkg-statoverride DB line on whitespace and + required exactly 4 fields, silently dropping any spaced path. A spaced SUID file + then got hardened but could never be un-hardened ('disable' never found it), and + repeated 'enable' failed with exit 203. + + - Read the three fixed fields (owner group mode) and take the remainder as the + path, matching the DB's 'owner group mode path' format. + - Regression test test_state_spaced_filename.sh: seed a spaced entry, disable, + assert the mode is restored (fails on the old reader: file stays un-restored). + - Test hygiene: print-policy captures modes into the state DB, so the two + print-policy tests now remove the entries they create instead of leaving stale + root-owned overrides for deleted temp files. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 6dcffee4bf717bfac9a4c13153dcaa1a25cdc89f +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 13:12:25 2026 -0400 + + permission-hardener: unify mode anchoring across all field widths + + Fresh-claude follow-up: the field_count==4/5 existence override did not cover a + 6-field line (spaced filename + numeric octal-looking owner + capability), which + anchored the mode on the owner and silently dropped the entry. No hardening + bypass -- numeric owners are rejected later against passwd names -- but a silent + drop instead of a loud rejection, and the ==4 disjunct was dead code. + + Replace the special-case override with one existence-based loop: among the octal + candidates at field_count-3 and field_count-4, pick the one whose recovered + filename exists; a mode at field 1 means no-space (no recovery); fall back to + the rightmost octal candidate when neither name exists. Handles the 3-field, + 4-field, spaced, numeric-owner and 6-field cases uniformly. + + - Regression test: 6-field spaced numeric-owner case; the suite now + distinguishes this fix from all three prior parser iterations. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 73cc7889b271e2f3733daed276ba235dde04dc20 +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 13:00:51 2026 -0400 + + permission-hardener: disambiguate octal-ambiguous entries by file existence + + Fresh-claude review found the earlier field-1 guard reintroduced a symmetric + misparse: a spaced filename whose second component is a bare octal (e.g. + '/srv/a 744 0644 root root') got dropped because the guard mistook the octal + component for the mode. + + The 5-field reading is genuinely ambiguous lexically -- '/a 744 0644 root root' + (spaced name) vs '/foo 0744 1000 root cap' (numeric owner). Resolve by which + candidate filename exists on disk, consistent with the tool skipping + nonexistent targets. Keep the no-recovery reading only when field 1 is an octal + mode and only the un-recovered name exists. + + - Replace the lexical guard with the existence check inside the right-anchor + branch; the whitelist-keyword branch is no longer gated (it was wrongly + skipped for '/x 744 y matchwhitelist'). + - Regression test: spaced octal-second-component case; the assertion now matches + the whole first column (trailing TAB) so '/a 744' cannot substring-match the + '/a 744 name' entry. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 780561e61a6bf1c8d110d1105a5102b59ceb14ea +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 12:49:10 2026 -0400 + + permission-hardener: fix disable-all directive + numeric-owner misparse + + Both surfaced by a fresh-claude review of the right-anchor change. + + - whitelists_disable_all=true was unreachable: the character-class check (which + excludes '=') ran before the directive check, so the documented line tripped + "invalid characters" and aborted the whole run (exit 200). Recognize the + directive first. + - Numeric octal-looking owner in a capability entry (e.g. ' 0744 0755 root + cap'): right-anchoring folded the owner into the mode position, the folded + path did not exist, and the entry was silently dropped -- file left + un-hardened. Skip recovery when the line is already a well-formed no-space + entry (octal mode at field 1, count 4 or 5). + - Correct the stale field-order comment: the tail is + 'filemode user_owner group_owner [capability]', mode first (per add_to_policy). + - Regression tests: numeric-owner case in the whitespace test; new + test_whitelists_disable_all.sh. Both fail on the pre-fix code. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit fca4984733e4aff6b90e8dd248d38b8cbb3889cc +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 12:40:52 2026 -0400 + + permission-hardener confs: correct gst-ptp-helper path/pkg and #8633 fix credit + + - 30_default.conf: gst-ptp-helper ships in libgstreamer1.0-0, not + gstreamer1.0-plugins-base; fix the disabled entry's path to + .../gstreamer1.0/gstreamer-1.0/... (first component was gstreamer-1.0, + which does not exist). Verified via dpkg -S. + - 25_default_whitelist_qubes.conf: the #8633 EoP fix is qfile-unpacker + (qubes-core-agent-linux) refusing a UID change other than the caller's; + libqubes-pure path/symlink sanitization (qubes-linux-utils PR #87) is a + separate layer. The comment credited only PR #87. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 37ad483b25c43b93bb350983c2534f9d775e977a +Author: claude (reviewdrain4 8d32e35d-2a57-4379-829c-6ef986f68cd4) +Date: Fri Aug 14 12:34:17 2026 -0400 + + permission-hardener: anchor mode tail from the right for spaced filenames + + - Space filenames are recovered from the option tail; the mode/owner/group + [/capability] tail has a fixed width (3 or 4 fields). + - Old left-to-right octal scan misanchored when a space-delimited filename + chunk was itself a bare octal (e.g. '/path/a 744 name 0744 root root'): the + field-count check then failed and the WHOLE hardener aborted (exit 200), + contradicting the comment that claimed such a line was skipped. + - Anchor the mode from the right (field_count-3, else field_count-4); prefer + the 3-field reading so a filename ending in an octal chunk is not mistaken + for a 4-field capability tail. + - Regression test: config line with a bare-octal filename chunk must parse via + print-policy; fails on the old code (exit 200 / entry missing). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit c2fcb2d893bf26a59c1b25415333fafcad8682dc +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 05:15:00 2026 -0400 + + security-misc: drop versioned bash dependency + + - Revert the bash (>= 4.4) Depends. Supported Debian (trixie+) always + ships bash >= 4.4 and earlier is unsupported, so the inherit_errexit + builtin is always present; the dependency adds nothing. Policy bans it + (bash-style-guide R-010b). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit a66fa50019f95326fef372ec5b3d1cde3b59b4a9 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:55:18 2026 -0400 + + security-misc: fix undo chown empty-arg + emerg fallback (ai-review) + + - undo_policy_for_file: the strict-mode brace pass quoted "${verbose}", + so 'permission-hardener disable all' ran 'chown "" -- ...' (invalid + empty owner) and 'chmod "" ...'. Make verbose an array so an empty + value expands to zero arguments. Canary-verified. + - emerg-shutdown fallback: when the prebuilt binary is absent, compile + straight into /run (tmpfs, writable even if /usr is read-only) rather + than via build-emerg-shutdown into /usr/bin. + - Document the space-filename parser limitations (consecutive spaces + collapse; an octal-looking path chunk can misanchor -> entry skipped). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit c4bf5403d0dbda87b2e1fe165ade7c81bf4e1b30 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:44:07 2026 -0400 + + security-misc: declare bash (>= 4.4) for inherit_errexit + + - Many scripts use 'shopt -s inherit_errexit' (bash 4.4+) in their + strict-mode preamble; ${misc:Depends} does not supply the baseline, so + an older /bin/bash would die in the preamble before the script's logic. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 5b34c9406198a47ce0c8d78a143606056e9d51b0 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:49 2026 -0400 + + security-misc: dfuzzer commit pin, marker rewords, remount-secure cleanup + + - ci/dfuzzer-build.sh: pin dfuzzer to the exact upstream commit and + verify the tag resolves to it (a moved tag now fails loudly). + - grub 40_kernel_hardening + remount-secure hidepid: reword standing + 'TODO' notes to 'REMINDER' (tracking, not pending work). + - remount-secure: replace the echo/true toggle with a printf-array + output helper; bring the file to strict-mode / shellcheck compliance + (6-directive block, braces) as required to touch it. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 9f12941585d5b18ae79f5d8dfd9f94cc0cd2507d +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:35 2026 -0400 + + security-misc: document whitelisted SUID/SGID helpers, flag human-only + + - Replace the bare 'TODO: research' markers on the permission-hardener + whitelist entries (postfix, selinux/utempter, spice, virtualbox, + qubes/qfile-unpacker, pam-tmpdir-helper, gst-ptp-helper) with concise + documentation: what each helper is, why it is SUID/SGID, what breaks if + stripped, and relevant CVE/hardening notes. + - Retag the keep-vs-strip decisions TODO-HUMAN-DEVELOPER-ONLY -- a + security-trust call for a human maintainer, not AI-resolvable. + - 30_default.conf: fix the commented gst-ptp-helper path typo + (gstreamer1.0/grstreamer-1.0 -> gstreamer-1.0/gstreamer-1.0); note that + filenames with spaces are now parsed. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 8aef705e63595beaa90f70e9c8a4f297fd7a08ee +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:20 2026 -0400 + + security-misc: fm-shim frontend calls xdg-mime/gio by absolute path + + - fm-shim-frontend invoked xdg-mime and gio by bare name, depending on + the systemd --user manager's PATH (minimal, profile-derived entries + absent) that fm-shim-backend hands it. Use /usr/bin/xdg-mime and + /usr/bin/gio, matching the existing /usr/bin/unicode-show call. + - Reword the backend TODO: the whole-session PATH fix belongs in + desktop-config-dist's start-lxqt-session (out of this repo); the + frontend absolute-path change is the in-repo mitigation. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 8ba6ca134e52411ce18f29b553dbfedb42b8ed3e +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:40:08 2026 -0400 + + security-misc: silence expected pam_exec journal noise via quiet_log + + - The [success=1 default=ignore] pam_exec lines run helper scripts that + exit 1 on their expected control-flow path, emitting an alarming + 'pam_exec(...): ... failed: exit code 1' journal line. Plain 'quiet' + suppresses only the user-facing message, not the log. + - Add 'quiet_log' (linux-pam >= 1.5.2, present on bookworm+) to every + skip-logic pam_exec line (console-lockdown, unix-faillock, + faillock-preauth, wheel), leaving the control flow byte-identical. + - Update the scripts' comments to point at the resolution. + + Note: not verified on a live login journal (needs a real PAM stack); + the change is additive and semantics-preserving regardless. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 8c991dd34247e7cc43843a1dff6d5300330646f1 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:39:52 2026 -0400 + + security-misc: compile emerg-shutdown once at postinst, not every boot + + - emerg-shutdown.c was recompiled into /run on every boot. Move the + compile to a standalone build-emerg-shutdown run from postinst, which + installs /usr/bin/emerg-shutdown. Compiling on-target keeps the package + Architecture: all while still producing a correct per-arch static binary. + - Boot-time emerg-shutdown now just copies /usr/bin/emerg-shutdown into + /run (memlockd-resident), with a fallback build if the binary is absent. + - dracut module ships /usr/bin/emerg-shutdown (exists right after install, + fixing the require_binaries /run chicken-and-egg). + - Sandbox-verified: build-emerg-shutdown produces a static ELF in /usr/bin. + - Strict/style compliance on the touched scripts (waivers for the debconf + maintainer script and the dracut-sourced module). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 942ba8a1902c2c8a0d6cd1921f2b540eb413a217 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 04:39:33 2026 -0400 + + security-misc: permission-hardener parse filenames with spaces + + - load_state() split config lines on every space, so any entry whose + filename contains a space was mis-fielded: silently skipped (a SUID + binary left un-hardened) or mapped to a corrupted policy entry. + - Recover the filename by parsing options from the right -- a trailing + whitelist keyword, or the mode/owner/group[/capability] tail anchored + by the octal mode. Space-free lines unchanged. + - Add regression test (drives the real script via print-policy) plus its + CI workflow. Canary-verified: fails on the pre-fix parser, passes now. + - Bring the file to strict-mode / shellcheck compliance as required to + touch it (6-directive block, printf, braces). + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit ec78b99bb1be3be87fb07b3c269d54dc4f1db113 +Merge: a8f26061 1fcf4967 +Author: claude (dev188 4c9dda7c-c359-4064-afa5-2ec7ed54398c) +Date: Wed Aug 12 03:30:39 2026 -0400 + + Merge branch 'master' into ai + + Absorb upstream + fork-trunk work (merged PRs #23/#26, CI-workflow + propagation, changelog bump) so the PR diff carries only our own commits. + +commit 52e18f723e37b5e5616ae6681f9e3cd28369e88c +Merge: 2da1f21c eb5b301d +Author: Patrick Schleizer +Date: Wed Aug 12 03:02:01 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit a8f26061e0e199b95077aa20696257bddc3db73d +Author: claude (dev182 e09ec5cf-4ebf-4e1b-88e5-55fbac6ef1d3) +Date: Mon Aug 10 13:56:04 2026 -0400 + + Drain input in USB-controller and config-file lookups + + check-for-usb-controller: grep --quiet exits on the first match and closes + the pipe, sending SIGPIPE to lspci. Under pipefail the pipeline then reports + 141, so the guarding if takes the false branch even when a USB controller is + present. Let grep read the whole stream and redirect to /dev/null instead. + + mmap-rnd-bits: head -n 1 has the same early-close hazard against ls; use + sed -n '1p', which consumes all input, for consistency. Drop the redundant + duplicate set -euo pipefail line already covered by the long-form preamble. + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit eb5b301db6069a5ccabf327745a000053ece1475 +Merge: a5655e63 2da1f21c +Author: Aaron Rainbolt +Date: Sun Aug 9 12:06:37 2026 -0400 + + Merge branch 'master' into arraybolt3/trixie + +commit a5655e632e2d67a1ef9ff1c1b998d179fc9c71d8 +Author: Aaron Rainbolt +Date: Sun Aug 9 01:46:03 2026 -0400 + + Fixes and TODOs + +commit 21048819c7b1c06c3f7ebee845e2332fa7c93ba8 +Merge: dc1a17c2 1ec153c3 +Author: Aaron Rainbolt +Date: Sun Aug 9 01:04:49 2026 -0400 + + Merge branch 'ai' into arraybolt3/trixie + +commit 1ec153c3f0db147e82f9d6c4c82b5a1026eada7b +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Fri Aug 7 07:17:03 2026 -0400 + + fix shellcheck directives for an isolated CI checkout + + The gate passed locally but failed (or would fail) in CI. Cause: CI checks + each repo out ALONE, while locally they sit side by side as submodules + under derivative-maker/packages. A '# shellcheck source=' climbing out of + the repo ('../../../../helper-scripts/...') therefore resolves here and + not there, so shellcheck reports SC1091 and the gate fails on a commit + that looked clean. + + The source= paths are kept -- they document where the file actually lives + -- and each is paired with a 'disable=SC1091' so an absent sibling is + tolerated. Same shape already used in security-misc master. + + Follow-on findings from the same isolated run, each with a stated reason + rather than a blanket waiver: + - SC2154 on systemd_notify: assigned by the sourced systemd-notify.bsh, + which shellcheck can no longer follow. + - SC2034 on SCRIPTNAME and output_cmd: genuinely unused. suspend-pre's + output_cmd toggle is vestigial -- unlike suspend-post the script prints + directly -- flagged rather than removed, since wiring it up or dropping + it is a maintainer call. + - SC1090 on the uwt.d conf glob: a dynamic source, which R-081 prescribes + SC1090 for. + + Verified with a new reproducer, ~/strict-pass-tests/ci-repro.sh, which + clones the repo on its own and runs the real gate there -- the condition + CI actually sees. All six repos: gate exit 0. + + Co-Authored-By: Claude Opus 5 (1M context) + +commit 9d6c4634a056c0711d3a42b8c3e4c876b93ec001 +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Wed Aug 5 13:57:59 2026 -0400 + + security-misc: R-010 strict for the remaining standalone scripts + + Covers the eleven remaining standalones, plus the whole-file debt the gate + surfaces on each: echo -> printf (R-034), 'has' instead of 'command -v' + (R-090, sourcing has.sh -- security-misc-shared already Depends on + helper-scripts), safe-rm (R-120), SC2250 braces. + + permission-lockdown needed care. Its loop chmods every home directory and + records a state file per user, and it tolerated per-user failures: a + directory it could not chmod did not stop the ones after it. Under errexit + the first failure aborted the whole loop, so every remaining home directory + silently stayed un-locked-down -- observed in the sandbox as 1 user + processed instead of 11, and the script exiting 1 rather than 0. The two + per-user operations are now explicitly best-effort, restoring the original + behaviour (including that a failed chmod still records the state file -- + arguably wrong, but changing it is not this pass's business). + + mmap-rnd-bits keeps its 'ls -1 -t /boot/config-* | head -n 1' with a + reasoned SC2012 disable: kernel config filenames carry no spaces or + newlines, so the parsing hazard is unreachable, and rewriting newest-file + detection in a security package is risk without gain. + + Not touched, deliberately: the dracut modules under + usr/lib/dracut/modules.d*. 'module-setup.sh' is SOURCED by dracut at + initramfs build time, and remount-secure.sh is installed with 'inst_hook' + and SOURCED by dracut-lib at BOOT. A strict-mode block in either runs in + dracut's own shell; in the boot case that risks an unbootable system. + + Sandbox differential vs the pre-change scripts, comparing output AND exit + code: 36 cases identical. The only two remaining deltas are 'set -x' traces + of the preamble and of echo -> printf, both at unchanged exit codes. + + Co-Authored-By: Claude Opus 5 (1M context) + +commit 59b3e60b2627a9eeda0f4e7cbd4804958cabedd3 +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Wed Aug 5 13:57:39 2026 -0400 + + security-misc: R-010 strict for the PAM helpers, preserving exit codes + + These four scripts are invoked by pam_exec and their EXIT CODE is the + security decision: the PAM stacks use '[success=1 default=ignore]', so the + code selects whether the next module runs. Strict mode must not perturb it. + + PAM_SERVICE and PAM_USER come from pam_exec's environment. Read bare under + nounset they abort the script with a NONZERO status, which PAM then reads + as a control-flow decision. Each is now read as '${VAR:-}', which + reproduces today's semantics exactly (an unset value falls through to the + same branch it already took). + + pam-abort-on-locked-password was the sharp case. It documents "identifiable + exit codes in case stdout / stderr is not logged in journal"; with PAM_USER + absent it returned 3 ("user does not exist"), and a bare read turned that + into 1. Verified restored. + + Exit-code matrix, old vs new, all matching: + PAM_SERVICE=login -> pam_only_if_login 1, pam_only_if_su 0 + PAM_SERVICE=su -> pam_only_if_login 0, pam_only_if_su 1 + PAM_SERVICE=sshd -> both 0 + PAM_SERVICE empty -> both 0 + PAM_SERVICE absent -> pam_only_if_login 0, pam_only_if_su 0, + pam_faillock_not_if_x 1 + PAM_USER root / nonexistent / absent -> pam-abort 3 in every case + + Co-Authored-By: Claude Opus 5 (1M context) + +commit a2b13848b6a2189c0bda2b478f5ac1b0f9c88819 +Author: claude (dev163 38f9745c-aed1-4fb4-b6ae-9899f20f8de2) +Date: Wed Aug 5 13:57:22 2026 -0400 + + security-misc: R-010 strict for the module-disabled alert scripts + + The thirteen disabled-*-by-security-misc scripts are near-identical: they + warn that a kernel module was blocked and exit 1. Add the strict preamble + and convert echo -> printf (R-034). + + The '$@' inside the message becomes '$*' deliberately. Under printf, + "...$@" expands to one argument per positional parameter, so a multi-word + invocation would print one word per line; '$*' joins with spaces, which is + what echo did. + + Sandbox differential vs the pre-change scripts: all thirteen byte-identical + in output and still exit 1. + + Co-Authored-By: Claude Opus 5 (1M context) + +commit 1fcf496705dd9b44ca62d01f737ffb9c6355e715 +Merge: e59019a5 e8e9fd4f +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat Aug 1 05:01:13 2026 -0400 + + Merge pull request #23 from org-ai-assisted/ai-claude-review-mention-only + + consumer-claude-code: mention-only triggers (propagated from template) + +commit e59019a54fb525d7cf884f10d26226efb1d8ab21 +Merge: 2da1f21c 32cb7a2f +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat Aug 1 05:01:08 2026 -0400 + + Merge pull request #26 from org-ai-assisted/ai + + CI: add codeql-actions + secrets-audit scanner workflows + +commit 2da1f21cb66cd52b04c7d25b7053524cd6cd6611 +Author: Patrick Schleizer +Date: Sat Aug 1 08:12:04 2026 +0000 + + bumped changelog version + +commit 32cb7a2f36105a23bed0562293901e3799cd7892 +Author: claude (dev142 b93fb2c6-e15f-4d45-8566-f3ded893b70e) +Date: Fri Jul 31 16:23:30 2026 -0400 + + CI: propagate codeql-actions + secrets-audit consumer workflows + + Byte-identical propagation from developer-meta-files + consumer-templates. Closes scanner-coverage gaps + (bandit already present): + + - consumer-codeql-actions.yml: CodeQL 'actions' language -- + workflow-YAML security analysis (script-injection, missing + permissions, unpinned actions). + - consumer-secrets-audit.yml: manual-dispatch secrets surface + audit (presence flags only, values never emitted). + + Managed files -- do not hand-edit; regenerated on the next + propagation pass. + + ## AI-Assisted + + Co-Authored-By: Claude Opus 4.8 (1M context) + +commit 83b8f6650bae86e75258e4643ec7c8a273993919 +Merge: f8c82a87 f0478e7b +Author: Patrick Schleizer +Date: Fri Jul 31 13:16:34 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit f0478e7b7cff57d8002501d17c8196889de66a27 +Merge: f8c82a87 4b410ccd +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Fri Jul 31 10:22:34 2026 -0400 + + Merge pull request from org-ai-assisted/ai + + ci: gate the local workflows on CI_ENABLED_ORG_AI_ASSISTED + +commit 4b410ccda527cf1f28d9d5eb8a4ea2a0ad7965ee +Author: claude (dev138 9b889944-0a22-45e7-8fd6-c189113e33b9) +Date: Fri Jul 31 09:38:10 2026 -0400 + + ci: gate the local workflows on CI_ENABLED_ORG_AI_ASSISTED + + Our workflows ran wherever the branch landed. Merged upstream they burn + Kicksecure/Whonix runner quota and post our CI into repos that never + asked for it; on a contributor fork they run the whole suite unbidden. + Only 5 of 136 workflow files across the fleet carried any owner gate. + + Gate: a job-level `vars.CI_ENABLED_ORG_AI_ASSISTED == 'true'`, set once + as an organization variable on org-ai-assisted. Zero runner cost -- a job + whose `if:` is false never allocates one -- and the run still reports + green, so upstream and forks are not handed a red X for a lane they did + not opt into. A fork that WANTS the lane sets the same variable in its + own repo; no patch to these files, no fork of our workflows. + + ANDed in front of any existing fork-PR guard rather than replacing it. + + Verified: the workflow-yaml validator reports 0 findings for this repo. + + Generated with assistance from Claude Code. + +commit e8e9fd4fae34474d5d1a96c516ddfd1913b7fd82 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Thu Jul 30 11:59:15 2026 -0400 + + consumer-claude-code: propagate the corrected template + + Byte-identical to developer-meta-files consumer-templates. + + The github.ref comment was wrong for one of the two events it described: + issue_comment fires with the default branch ref, pull_request_review_comment + with the PR merge ref (refs/pull//merge). No behaviour change -- the + concurrency group reaches github.ref only if neither number field is set, and + one always is for the events this workflow accepts. + + Generated with assistance from Claude Code. + +commit 867809170a265b269a34f6d704c97ec53744cd4d +Author: Ashlen +Date: Wed Jul 15 19:06:42 2026 -0600 + + fix(pam): pass profile names to pam-auth-update --remove + + 'pam-auth-update --remove' matches pam-config filenames under + /usr/share/pam-configs/, but prerm and postrm passed + $DPKG_MAINTSCRIPT_PACKAGE -- the package name security-misc-shared -- + which matches no profile. An unknown target is stored without + validation and simply never matches, so the --remove was inert in + both calls: the prerm call was an effective no-op, while the postrm + call still performed a plain reconciliation. + + The prerm early-disable was therefore dead. On removal + /etc/pam.d/common-* kept referencing helper scripts under + /usr/libexec/security-misc/ that dpkg then deleted; + block-unsafe-logins is a Priority 1100 'requisite' entry, so a + dangling reference fails all authentication until postrm's + reconciliation regenerates common-* -- permanently, if postrm fails + before that point. + + prerm now passes the eight profile filenames explicitly. postrm + drops the ineffective '--remove ' for a plain + reconciliation and guards it with 'command -v': Debian Policy 7.2 + gives no guarantee that dependencies are available when postrm runs + and requires postrm to gracefully skip such actions, and an absent + pam-auth-update would abort the script under 'set -e'. prerm stays + unguarded: Policy names Depends (here libpam-runtime) as the + mechanism prerm scripts rely on, dependencies there normally being + at least unpacked. + + One consequence of a '--remove' that now takes effect: it also drops + the eight names from /var/lib/pam/seen. If a removal is aborted, + postinst's 'pam-auth-update --package' re-enables the seven + 'Default: yes' profiles among them, including any of them an + administrator had deliberately disabled (other packages' profiles + remain in seen and are unaffected), while + console-lockdown-security-misc ('Default: no') stays off until an + administrator re-enables it -- reinstalling does not restore it, + since preinst's enable is behind a do_once stamp. Both are new + relative to the previous inert behavior. + +commit 077d41a6b193787dc31718370c1532d6638569bc +Author: Ashlen +Date: Wed Jul 15 12:54:05 2026 -0600 + + fix(remove-system.map): continue past undeletable files + + The deletion loop called `exit 0` on the first System.map that `[ -w ]` + rejected, so copies in later locations were never shredded. Where + `[ -w ]` passed but shred failed anyway, shred ran as a bare command and + tripped the ERR trap that pre.bsh installs, aborting with a "## Please + report this bug!" banner and exit 1. + + Branch on shred's exit status instead of `[ -w ]`, which does not + predict removability. Unlinking depends on write permission on the + parent directory rather than on the file itself, and an append-only file + passes the test yet cannot be unlinked at all. For a full-capability + root process the check is also true on a mode 444 file, so it only ever + failed on read-only file systems and on files carrying the immutable + attribute. + + Clear the immutable and append-only attributes before each attempt. Per + review, a System.map should never be immutable and `chattr +i` would + possibly complicate kernel package removal; append-only is cleared on + the same grounds, since it blocks removal without affecting `[ -w ]`. + + Report the files that remain once at the end, under a single wiki link + rather than repeating it on every line, and withhold "Done. Success." + when anything failed. A file reachable under two names, such as + /lib/modules//build and the source symlink beside it, is listed + under each, since both matched and both failed. + + Iterate an array rather than word-splitting a string with IFS, which a + /etc/remove-system.map_pre.d drop-in can set; under `IFS=:` the globs + matched nothing, so the script deleted nothing and still exited 0. + + The removal loop no longer exits early on failure and the script ends in + an explicit `exit 0`; a non-zero status would fail the kernel package's + postinst hook and the oneshot unit on every boot. + +commit 5daefde4e8cb4705d8fbe7886f2e003e61e0b974 +Author: claude (dev118 bd22decd-3027-4ab5-9e48-11adfe39b279) +Date: Tue Jul 28 13:50:24 2026 -0400 + + consumer-claude-code: mention-only triggers (propagated from template) + + Byte-identical cp from developer-meta-files/consumer-templates. + + pull_request and workflow_dispatch resolve to claude-code-action's + agent mode, whose trigger is a non-empty 'prompt' input that this + workflow does not pass, so those events could only spin up a runner + and exit without calling the model - a green "Claude Code Review" + check that reviewed nothing. + + Co-Authored-By: Claude + +commit f8c82a87f207eee40dad64e0d090be5cd2858b76 +Author: Patrick Schleizer +Date: Tue Jul 28 13:20:23 2026 +0000 + + bumped changelog version + +commit ec941913e9bf1ad4e33a8146812cfe3c07cde956 +Merge: d1381a0c a5420ffb +Author: Patrick Schleizer +Date: Tue Jul 28 08:12:04 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit d1381a0c16ca62d8ac61fa00dcc5d760b8f5d106 +Merge: 2ac7df95 dc1a17c2 +Author: Patrick Schleizer +Date: Tue Jul 28 07:44:23 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit a5420ffb35edf92c0c953b09cd31580cd74c1d27 +Author: claude +Date: Tue Jul 28 06:17:17 2026 -0400 + + consumer-codex-review: drop OPENAI_API_KEY forward to the disabled reusable + + Propagates org-ai-assisted/developer-meta-files#167. The reusable is a no-op + stub (job 'if: false') and no longer declares an OPENAI_API_KEY secret; + forwarding an undeclared secret is rejected by GitHub at workflow startup + (startup_failure). Dropping the forward lets the no-op run green; Codex review + stays cleanly disabled. + + Co-Authored-By: Claude Opus 4.8 + +commit dc1a17c2c3047cc985a121275792460f1dbb5730 +Merge: 7f55b21b da942f8b +Author: Aaron Rainbolt +Date: Mon Jul 27 21:04:57 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/pam-info-empty-deny-fallback' into arraybolt3/trixie + +commit da942f8b9dcbbc9fd62777181b99d3b6e97b41a0 +Author: Ashlen +Date: Wed Jul 15 13:23:54 2026 -0600 + + fix(pam-info): restore deny default when faillock.conf lacks it + + When /etc/security/faillock.conf has no uncommented "deny =" line + (commented out, or written without spaces), the parse overwrites the + deny=3 default with an empty string. The empty value slips past the + [[ "$deny" == *[!0-9]* ]] numeric guard, then evaluates to 0 in the + remaining-attempts arithmetic, producing a false "Login blocked, boot + into recovery mode" message for users still well below the threshold. + + Fall back to the documented default of 3 when the parse yields empty. + +commit 2ac7df95d287e98bccae5c583f4d3ac33575da36 +Merge: 7f55b21b e645c7c1 +Author: Patrick Schleizer +Date: Thu Jul 23 08:18:02 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit e645c7c17913ca72ed1a4c593d9c6edc95c0457c +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Wed Jul 22 10:21:24 2026 -0400 + + consumer-claude-code: forward CLAUDE_CODE_OAUTH_TOKEN (claude review OAuth port) + +commit b684685bd03755c79b823076d111b29541469491 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue Jul 21 09:05:41 2026 -0400 + + Coverity: point CI at the org-ai-assisted-security-misc project (#22) + + project-name -> org-ai-assisted-security-misc; canonical-repos -> org-ai-assisted/security-misc. Project registered + repo COVERITY_SCAN_TOKEN set. + + AI-Assisted + + Co-Authored-By: Claude Opus 4.8 + +commit 7f55b21b018a8133a2ab5cc82bc5145caa8f0174 +Author: Patrick Schleizer +Date: Tue Jul 21 09:23:19 2026 +0000 + + bumped changelog version + +commit 2b0422a2dab93fd29393b7e400a07dc5b75a8da4 +Merge: f5e6783a 545c9430 +Author: Patrick Schleizer +Date: Tue Jul 21 04:18:24 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 545c94307bd7dcdcefe67c8061b8dd18caf17b79 +Author: Aaron Rainbolt +Date: Sun Jul 19 20:14:13 2026 -0400 + + printf + +commit 46e87db6d5d7d7071d3766a5f9b20b880cd54b10 +Author: Aaron Rainbolt +Date: Sun Jul 19 20:12:46 2026 -0400 + + end-of-options + +commit e9b3374a305ace3d6c40cc5143627e31c38602b2 +Merge: b9a492bb 90b514c7 +Author: Aaron Rainbolt +Date: Sun Jul 19 20:09:33 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/hide-hardware-info-getent' into arraybolt3/trixie + +commit b9a492bb071a4726672f0b0c14a7586c60536e21 +Author: Aaron Rainbolt +Date: Sun Jul 19 19:46:33 2026 -0400 + + Revert "udev: mark optical drives UDISKS_IGNORE (quiet + harden)" + + This reverts commit 41638e64911a7f019b32cacd5a368ec480fcc21a. The change + was made to avoid a spurious error in CI, and the underlying issue has + been fixed in a different way now, so this is no longer needed. + +commit aab24f84e4677d9447d339c5f6ee0699f8e0b97b +Author: Aaron Rainbolt +Date: Sun Jul 19 19:23:52 2026 -0400 + + Don't use required dependencies in emerg-shutdown to keep systemd from terminating it when the boot drive is removed + +commit 097880e26749bc874ba266cadaa84a8a3925dc4a +Merge: 0a4386b1 81096c4b +Author: Aaron Rainbolt +Date: Sun Jul 19 18:03:32 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/emerg-shutdown-fd-leak-sigsys' into arraybolt3/trixie + +commit 0a4386b1927a76f0d3d6010d33bd9f1b5b23af89 +Author: Aaron Rainbolt +Date: Sun Jul 19 18:03:01 2026 -0400 + + Swallow signals in emerg-shutdown's hardware monitor mode too + +commit 7d1553c5136942c38c59d4d5c8cec673e2ba1f06 +Merge: f5e6783a 6dc96859 +Author: Aaron Rainbolt +Date: Sun Jul 19 11:47:42 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/virusforget-error-handling' into arraybolt3/trixie + +commit f5e6783afe645a9bded31e63241d2b76f9945807 +Merge: f9853503 57b0072b +Author: Patrick Schleizer +Date: Sun Jul 19 03:40:40 2026 -0400 + + Merge remote-tracking branch 'org-ai-assisted/master' + +commit f9853503c5847d960d83499c6d8ef02ce8e045fd +Merge: b39215e4 f3a060ed +Author: Patrick Schleizer +Date: Sun Jul 19 03:39:58 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit f3a060ed528a66f3524206a22108b59e3de67ef2 +Merge: 89745aab 6f3f6425 +Author: Aaron Rainbolt +Date: Sun Jul 19 01:28:06 2026 -0400 + + Merge remote-tracking branch 'maybebyte/docs/config-section-numbering' into arraybolt3/trixie + +commit 89745aabf7931aad32ea437b6e644146a63d46a3 +Merge: 27009709 b39215e4 +Author: Aaron Rainbolt +Date: Sun Jul 19 01:19:36 2026 -0400 + + Merge branch 'master' into arraybolt3/trixie + +commit 2700970971f97a732ef1d53c407c8e2e6d2b575d +Author: Aaron Rainbolt +Date: Sun Jul 19 01:08:29 2026 -0400 + + Fix messaging when a file with multiple hardlinks is skipped over + +commit 7a603055bf11f7d0d4162d4c437aa95f034ebb89 +Author: Aaron Rainbolt +Date: Sun Jul 19 00:55:13 2026 -0400 + + Fix output when permission-hardener encounters a file with multiple hardlinks + +commit 9a3e8851404f6e6a1fa1fcfefebe68b17dd6dbb7 +Merge: 98c27d90 1625a3db +Author: Aaron Rainbolt +Date: Sun Jul 19 00:48:40 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/permission-hardener-whitelist-and-errexit' into arraybolt3/trixie + +commit 57b0072b0194848b5bc3816efb4b243bba343141 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat Jul 18 20:00:25 2026 -0400 + + Coverity: point CI at the org-ai-assisted-security-misc project + +commit b39215e47fc127ef41951b7d686237c1e48dc9ba +Merge: 4ed85e1f 26ef321b +Author: Patrick Schleizer +Date: Sat Jul 18 16:26:00 2026 -0400 + + Merge remote-tracking branch 'org-ai-assisted/master' + +commit 4ed85e1f6114fa74debc17b88eeb165c4f8afc15 +Merge: 59decfa2 98c27d90 +Author: Patrick Schleizer +Date: Sat Jul 18 16:24:30 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 98c27d9074f31cfeb006ecce1aef10a90e06a8c7 +Merge: c3ec2119 b076e2c0 +Author: Aaron Rainbolt +Date: Fri Jul 17 21:12:46 2026 -0400 + + Merge remote-tracking branch 'maybebyte/fix/ensure-shutdown-nounset-default' into arraybolt3/trixie + +commit c3ec2119b2fa7e8c172fe7a63686b98e66b3c35e +Merge: 59decfa2 1a71a3e9 +Author: Aaron Rainbolt +Date: Fri Jul 17 21:02:54 2026 -0400 + + Merge remote-tracking branch 'assisted-by-ai/claude/comment-bdev-allow-write-aYEla' into arraybolt3/trixie + +commit 26ef321b73377254da64007362fdadfa602fb384 +Merge: 55c087cc 41638e64 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Wed Jul 15 23:46:34 2026 -0400 + + Merge pull request #20 from org-ai-assisted/udisks-ignore-optical + + udev: UDISKS_IGNORE optical drives + +commit 41638e64911a7f019b32cacd5a368ec480fcc21a +Author: assisted-by-ai +Date: Wed Jul 15 23:34:07 2026 -0400 + + udev: mark optical drives UDISKS_IGNORE (quiet + harden) + + udisks auto-probing removable optical media (sr*) is noisy -- on a drive with no + or inert media (e.g. a VM CD-ROM) it errors repeatedly ('udisksd: Error probing + device: Error sending ATA command IDENTIFY PACKET DEVICE to /dev/sr0') -- and is + avoidable attack surface: inserted media should not be auto-processed without + user action. Add a udev rule marking optical drives UDISKS_IGNORE. This does NOT + affect booting the live ISO from optical media: rd.live mounts the medium in the + initramfs, not via userspace udisks. (AI-Assisted.) + +commit 90b514c7cdc33fa8237cf19b8e7a49827290de44 +Author: Ashlen +Date: Wed Jul 15 16:43:40 2026 -0600 + + fix(hide-hardware-info): look up group with getent + + The sysfs/cpuinfo whitelist gated its chgrp/chmod on + `grep -q "${1}" /etc/group`, an unanchored substring match over the + whole file. A group whose name merely contains the string, or a user + listed as a member of any group, produced a false positive: the branch + ran chgrp against a group that does not exist (silently swallowed by + `|| true`) and suppressed the "group does not exist" warning, so an + admin who never created the group was told nothing. + + Use `getent group "${1}"` instead. It matches by exact group name or + GID and consults NSS, so groups from non-file sources are recognized + as well. + + Co-Authored-By: Claude Opus 4.8 + +commit 6f3f6425eed69a50fe747262ce8d62d365432273 +Author: Ashlen +Date: Wed Jul 15 12:28:01 2026 -0600 + + docs: correct section numbering in config comments + + The sysctl config header claimed 5 sections while its list + enumerates 6 (through CD-ROM/DVD); update the count to 6. + + The modprobe config's Networking section header read "2.", + duplicating the File Systems section, while its own table of + contents and the following "4. Miscellaneous" section imply 3; + correct it to "3.". + +commit 1625a3db8fbb94da8c5558c52d9b7b481ce031cd +Author: Ashlen +Date: Wed Jul 15 12:15:57 2026 -0600 + + fix(permission-hardener): skip hardlinked files instead of aborting + + output_stat returned 1 for a non-directory SUID/SGID file with a + hardlink count > 1. The four call sites invoke output_stat as a bare + command under `set -o errexit`, so that return propagated and + terminated the whole run instead of skipping the file. The following + `if [ -z "${file_name_from_stat}" ]` guard never caught this case + because file_name_from_stat was already populated. + + The surrounding comment states hardlinked files are meant to be + skipped (scanning a hardlink pool is too costly). Blank the output + vars and return 0, matching the existing nonexistent-file skip path, + so the caller's empty-name check continues past the file. Genuine + error paths (stat failure, parse corruption) still return 1 and fail + loud. + +commit 4af4392bc3f2c37784d11a6b49cb1b9eb7d9c3d9 +Author: Ashlen +Date: Wed Jul 15 12:15:22 2026 -0600 + + fix(permission-hardener): prevent fail-open on empty matchwhitelist + + check_nosuid_whitelist iterated with + "${policy_match_white_list[@]:-}". Under `set -o nounset` the `:-` + default expands an empty array to a single empty-string element, so + the loop ran once with an empty entry. The body test + `[[ "${target_file}" == *""* ]]` matches every string, so the + function returned 1 (whitelisted) for every file. Both callers use + `|| continue`, so an effective config with no `matchwhitelist` line + silently skipped all SUID/SGID hardening with exit 0 -- a fail-open. + + Expand with ${arr[@]+"${arr[@]}"} instead, which yields no elements + when the array is empty and does not trip nounset. + +commit 81096c4b8fd58b42c04c486e89b1ff016365f62a +Author: Ashlen +Date: Wed Jul 15 11:45:21 2026 -0600 + + fix(emerg-shutdown): swallow SIGSYS in signal-ignore loop + + max_sig_num is 31, but the SIG_IGN loop used a strict "<" bound, so it + covered signals 1..30 and never touched signal 31 (SIGSYS on Linux). + The real-time loop starts at SIGRTMIN, leaving SIGSYS covered by neither + loop, so it kept its default terminate disposition despite the "Swallow + all signals that we can." intent. + + Use "<=" so the loop reaches 31; SIGSYS is ignorable, and the bound + still stops before the glibc-reserved signals 32 and 33. This is a + robustness fix, not a hardening gain: SIGKILL and SIGSTOP are unblockable + anyway, so an actor able to send SIGSYS can already kill the monitor -- + the value is surviving an internally generated SIGSYS (e.g. a bad + syscall). + +commit 5bb3f0114bc6941506d432018487c35c3c19032d +Author: Ashlen +Date: Wed Jul 15 11:44:40 2026 -0600 + + fix(emerg-shutdown): close fds for non-panic input devices + + The input-device enumeration loop opens a descriptor for every + /dev/input/eventN but only stores it for devices that support the + panic-key combo. The two early-continue paths -- non-key devices and + keyboards lacking the panic keys -- returned without closing tmp_fd, + leaking one descriptor per non-qualifying device. + + The leak is bounded and one-time (the loop runs once at startup, not in + the poll loop) so impact is low, but the descriptors are held for the + whole process lifetime and never reclaimed -- the daemon never execs, + so O_CLOEXEC does not cover them. Close tmp_fd before both continues. + +commit b076e2c0b3a8a83fe2b11dc1b09b1c9f72301db6 +Author: Ashlen +Date: Wed Jul 15 11:25:07 2026 -0600 + + fix(ensure-shutdown): apply timeout default under nounset + + The script runs under 'set -o nounset'. When no config file assigns + ENSURE_SHUTDOWN_TIMEOUT, the bare "${ENSURE_SHUTDOWN_TIMEOUT}" in the + fallback guard raises an unbound-variable error and aborts before the + guard can apply the default, so ExecStart never starts the shutdown + monitor. Add the ':-' default in the -z test so the guard runs and + falls back to 30. The sibling emerg-shutdown wrapper avoids this by + pre-initializing its config variables before sourcing. + +commit 6dc96859dd7f350673cc917a8c41da8144357e62 +Author: Ashlen +Date: Wed Jul 15 10:59:09 2026 -0600 + + fix(virusforget): exit when --user does not exist + + The nonexistent-user branch printed a warning but, unlike every sibling + validation branch, neither exited nor wrote to stderr, so a mistyped + --user proceeded to operate on a bogus /home/ path. Send the error + to stderr and exit 1. + +commit a39b03ac2e18a83f73e4e320481323fc8ef8a795 +Author: Ashlen +Date: Wed Jul 15 10:58:42 2026 -0600 + + fix(virusforget): skip restore when backup is absent + + An extraneous file (present in the home directory but absent from the + committed backup) is deleted and then unconditionally passed to + restore_file, which runs `cp` from a backup path that does not exist. + Under `set -e` this aborts the entire `--clean` run on the first such + file, leaving the system partially cleaned -- the exact + malware-persistence scenario the tool exists to handle. + + Return early from restore_file when no backup exists. Deleting the + extraneous file is the correct action and is already done by the caller + (which keeps a forensic copy under the dangerous/ folder). The guard is + transparent to the missing-file and modified-file callers, which always + have a backup present. + +commit 55c087cc9bda321db860541f9030207a59505cb7 +Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Mon Jul 13 11:48:30 2026 -0400 + + codeql-prepare: multi-line case arms (R-070) + complete strict-mode block (#19) + + Expand the two compact case arms to the fully multi-line form per R-070. + The touched file was 4/6 on the R-010 strict-mode block; add the missing + 'shopt -s inherit_errexit' and 'shopt -s shift_verbose' so it is fully green. + No behavior change. + + Co-authored-by: claude (dev71 31548627-e7c1-43cd-bd41-8b0900c72576) + +commit 59decfa257b7a560691183945e9c4ec1830d7241 +Author: Patrick Schleizer +Date: Wed May 20 22:20:10 2026 +0000 + + bumped changelog version + +commit be771dea0be5bf34c13bb4ab0054199934eb4dc8 +Author: Patrick Schleizer +Date: Wed May 20 16:57:12 2026 -0400 + + genmkfile uch + +commit f4d078d00a6e5c34a8c1e066ebd381604e8c0986 +Author: Patrick Schleizer +Date: Mon May 18 10:14:14 2026 +0000 + + bumped changelog version + +commit a93dca3366d99a5088ca9f03080be2c016c2d5bc +Merge: 8da4e1ef 8276e4e2 +Author: Patrick Schleizer +Date: Sun May 17 16:22:55 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 8276e4e2238fb6c8770189f20cbc9aee22e67c87 +Merge: 8da4e1ef 9ebe7128 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 17 14:02:54 2026 -0400 + + Merge pull request #18 from org-ai-assisted/claude/fix-dependabot-action-UnL7w + + dependabot.yml: drop docker block (sync to new canonical) + +commit 9ebe71282f7b4394e87e6db45f7f9219cd322007 +Author: Claude +Date: Sun May 17 17:59:44 2026 +0000 + + trim file commentary + +commit c67f2ea60336a6819b4724836cec426f12b7f5ed +Author: Claude +Date: Sun May 17 17:43:21 2026 +0000 + + dependabot.yml: drop docker block (sync to new canonical) + + The previous canonical at + developer-meta-files/consumer-templates/.github/dependabot.yml + carried a docker package-ecosystem block on the documented theory + that the block was a "harmless no-op" in repos without a + /Dockerfile. That theory was wrong: the dependabot-action errors + with `dependency_file_not_found` and aborts the whole job - + including the github-actions ecosystem run that shares it - so + this repo lost its github-actions Dependabot coverage too. + + Sync to the new canonical, which carries github-actions only. + + See org-ai-assisted/developer-meta-files PR #105 for the + canonical change and the docker-bearing-repo opt-out mechanism. + +commit 8da4e1ef7b5e1dd3c217d9ae59c3d56ab6b052da +Merge: 2b3e644c 493de5e4 +Author: Patrick Schleizer +Date: Sat May 16 17:15:01 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 493de5e4741a5cf6f1adb20a6c9354760b208678 +Merge: 2b3e644c 6627cff0 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat May 16 16:03:37 2026 -0400 + + Merge pull request #17 from org-ai-assisted/claude/security-misc-real-stdisplay-pyqt-and-install-deps + + ci: real stdisplay + PyQt5 + install-deps composite action; drop conftest stubs + +commit 6627cff0563b4f17b49e36bd5dc768e9de0f69ab +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat May 16 13:54:45 2026 -0400 + + ci: real stdisplay + PyQt5 + install-deps composite action; drop conftest stubs + + ci/tests/fm_shim_frontend/conftest.py stubbed two heavy module-level + imports in fm_shim_frontend.fm_shim_frontend to let the property + tests import the URI-validation function without bringing up Qt or + installing the helper-scripts Debian package: + + - stdisplay (helper-scripts Debian package) - identity stub + - PyQt5.{QtCore,QtGui,QtWidgets,sip} - fake module whose + __getattr__ synthesizes a fresh type() per name + + The file already carried a TODO to remove both: "We can install + helper-scripts before running the tests to get stdisplay, and as + long as the test code paths don't call QApplication(), the crash + during test issue should be avoidable." + + This commit does that: + + - local-python-lint.yml switches from apt-install-with-cache to + the developer-meta-files install-deps composite action, which + installs apt deps + genmkfile + helper-scripts (the latter + provides stdisplay). PyQt5 was already in the apt list + (python3-pyqt5 + python3-pyqt5.sip), so the real Qt classes + are available now too. + + - conftest.py is deleted. Property tests now run against the + production modules end-to-end (the QApplication() call only + fires inside fm_shim_frontend's main(), which the test never + invokes - it imports get_path_list_from_uris directly). + + - local-dbus-fuzz.yml also switches to install-deps for + consistency (same composite-action pattern); ci/dfuzzer-build.sh + header comment updated to point at install-deps instead of + apt-install-with-cache. + + Same shape as the recent msgcollector simplification (PR #21): + let install-deps handle apt + genmkfile + helper-scripts in one + step. + +commit 2b3e644c750962592ad87d0c95cdd7bdd8ecbb77 +Author: Patrick Schleizer +Date: Sat May 16 06:08:34 2026 -0400 + + add .github/dependabot.yml + +commit 86ef7582223b9a3a622bc1b9dd5bedc576776c89 +Author: Patrick Schleizer +Date: Sat May 16 06:01:50 2026 -0400 + + update .github/workflows/consumer-bandit.yml + +commit 873ba695c7e74bcef4efbc93a13557adfd01d658 +Merge: 79a9fb9b a4465cd7 +Author: Patrick Schleizer +Date: Sat May 16 05:27:53 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit a4465cd76fc9c05cb75b7d4f4c8ba0cbbcb6a7c6 +Merge: 79a9fb9b e0ed0b33 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sat May 16 04:42:50 2026 -0400 + + Merge pull request #16 from org-ai-assisted/claude/fix-cppcheck-tar-error-0qNYv + + ci: use apt-install-with-cache composite action; drop broad restore-keys + +commit e0ed0b331aa8bd983fd0ec6624a6bf4481223682 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Fri May 15 20:02:27 2026 -0400 + + ci: use apt-install-with-cache composite action; drop broad restore-keys + + Both local-dbus-fuzz.yml and local-python-lint.yml used + `path: /var/cache/apt/archives` with `sudo chown -R` on the system + dir + a broad `restore-keys:` prefix. Three problems: + + 1. Same `tar: partial/: Permission denied` cache-save warning as + the developer-meta-files reusables (apt\'s _apt:root 0700 + partial/ subdir is unreadable by the runner; chown doesn\'t + help because apt-get install recreates partial/ 0700 every + run). + + 2. `restore-keys:` violates agents/github-actions.md G-A-007 + ("no broad restore-keys, no pull_request_target + cache" - + cache-poisoning risk). The cache-key already includes + hashFiles() so a config change naturally invalidates; + restore-keys would defeat that. + + 3. Duplicated `Prepare apt cache directory` + `Cache apt packages` + YAML across two workflows. + + Fix: replace those steps with one composite-action call: + + - uses: org-ai-assisted/developer-meta-files/.github/actions/apt-install-with-cache@master + with: + packages: \'\' + cache-key: ${{ runner.os }}-apt--${{ hashFiles(...) }} + + The composite action caches `~/.apt-deb-cache` (runner-owned, no + system-dir permission gymnastics) and sudo-copies .debs in/out of + /var/cache/apt/archives around apt-get install. apt\'s normal + permission model is preserved. + + local-dbus-fuzz.yml additionally: + + - ci/dfuzzer-build.sh is refactored to drop its `Phase 1` apt + install. The package list moves into the workflow (passed to + the composite action), where it lives alongside the cache key + that invalidates on changes. dfuzzer-build.sh now only + does the `Phase 2` build from upstream source. + + Depends on org-ai-assisted/developer-meta-files#92 (which adds + the composite action). This PR\'s CI will pass once #92 merges. + +commit 79a9fb9b7b9640e5a56f798ca3c4057ce8e4accb +Author: Patrick Schleizer +Date: Fri May 15 18:40:53 2026 +0000 + + bumped changelog version + +commit 323f4610b6fbdd0b011aef2d2b42228046d1f0eb +Merge: 899959ae 1c732f20 +Author: Patrick Schleizer +Date: Fri May 15 13:14:54 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 1c732f20949a9e5153b42acbafd925db4853daea +Merge: be8ca04a 91184edd +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 19:56:15 2026 -0400 + + Merge pull request #15 from org-ai-assisted/claude/review-github-actions-IQwcy + + local-python-lint: drop paths filter, always run lint + +commit 91184edd4b6604b005e540cef3d8cb0ca9bf45a4 +Author: Claude +Date: Tue May 12 20:19:31 2026 +0000 + + local-python-lint: drop paths filter, always run lint + + The 3-entry paths filter went stale - the workflow filename + reference and the apt cache key both still pointed at + '.github/workflows/lint-python.yml' from before the G-A-005 + three-prefix rename to 'local-python-lint.yml'. Filter-going- + stale silently skips lint on PRs it should cover. + + Drop the filter so push(master) and pull_request(master) always + run lint. Repo is mixed C/AppArmor/scripts but the lint job is + fast (10-min timeout, ~1 min real). Update the cache hashFiles() + to match the new workflow filename so apt cache invalidates + correctly when this workflow is edited. + +commit be8ca04a9ec12753f5ecf65fe345c7e694535e12 +Merge: fb7ad509 d6b44928 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 16:15:08 2026 -0400 + + local-dbus-fuzz: enable path-filtered pull_request trigger (#14) + + local-dbus-fuzz: enable path-filtered pull_request trigger + +commit d6b4492893bc3032d310db54f5415a2d3cb51e63 +Author: Claude +Date: Tue May 12 20:07:40 2026 +0000 + + local-dbus-fuzz: enable path-filtered pull_request trigger + + dfuzzer (D-Bus) workflow has been verified green via workflow_dispatch + on master. Enable the previously commented-out pull_request trigger + so PRs that touch the fm-shim-backend C source, its compile script, + the dfuzzer build/runner, or this workflow itself get fuzz coverage. + + Also: + - fix stale workflow filename reference (.github/workflows/dfuzzer.yml + -> .github/workflows/local-dbus-fuzz.yml; renamed under G-A-005) + - add ci/dfuzzer-build.sh to the paths filter (it builds the dfuzzer + binary from source - changes here invalidate prior runs) + - rewrite the header comment that described the now-historic + workflow_dispatch-only state. + +commit fb7ad5094fa6b27125c5ea741e0596a235baa50a +Merge: c1139823 d6fc7cff +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 15:28:58 2026 -0400 + + Merge pull request #13 from org-ai-assisted/claude/review-github-actions-IQwcy + + workflow triggers: normalize pull_request to branches: [master] + +commit d6fc7cffb26321ff458dd3980a112448e1bbfe38 +Author: Claude +Date: Tue May 12 19:25:57 2026 +0000 + + workflow triggers: normalize pull_request to branches: [master] + + Propagate dmf canonical updates for consumer-claude-code.yml and + consumer-codex-review.yml: bare `pull_request:` -> + `pull_request: branches: [master]`. Matches the byte-identical + canonical in + developer-meta-files/consumer-templates/.github/workflows/. + + Practical impact: PRs targeting feature branches no longer fire + the AI reviews. The org's typical workflow (feature-branch -> + master PR) is unaffected. + +commit c11398236615009bdad1b039f28073a69a06a4b3 +Merge: 00b6339a 2d503860 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 13:48:31 2026 -0400 + + Merge pull request #12 from org-ai-assisted/claude/review-github-actions-IQwcy + + scorecard: remove consumer-scorecard.yml (org-wide opt-out) + +commit 2d50386036b1db6f074604f4078bf01f1d71daff +Author: Claude +Date: Tue May 12 17:46:00 2026 +0000 + + scorecard: remove consumer-scorecard.yml (org-wide opt-out) + + Per the consumer-template architecture's opt-in-by-file-presence + rule, deleting a consumer-*.yml is the opt-out signal: + pkg_update_consumer_workflows refreshes only files that already + exist on the consumer side; the next propagation pass will not + re-create this. + + Org-wide policy: Scorecard's value-to-noise ratio is low (many + false positives, non-actionable signals). Keeping it only in + derivative-maker (the canonical baseline) where the org-wide + supply-chain signal is most useful. + + Spec: + https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +commit 00b6339a01392db4e0f62143ab0fa08b9177386c +Merge: b128c2b5 bc75ea7d +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 12:47:13 2026 -0400 + + Merge pull request #11 from org-ai-assisted/claude/review-github-actions-IQwcy + + workflows: rename legacy unprefixed to consumer- prefix + +commit bc75ea7d6f0918e89032fa65dcc715217e0a0c5e +Author: Claude +Date: Tue May 12 16:44:41 2026 +0000 + + workflows: align consumer-*.yml byte-identical to dmf canonicals + + Follow-up to the rename commit: in addition to renaming the + files, content must be byte-identical to the canonical wrappers + in developer-meta-files/consumer-templates/.github/workflows/. + + Differences absorbed by this commit: + + - scorecard.yml cron slot: per-repo allocation -> uniform + org-wide '0 6 * * 0' (the canonical's slot). + - Header comments: switched to the standard "Managed by + pkg_update_consumer_workflows" template so contributors see + the propagation contract. + + User-facing `name:` fields unchanged. + + Spec: + https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +commit 2dbf8ade8aa5491b0521a1ed693abc4bca5c7cda +Author: Claude +Date: Tue May 12 16:42:53 2026 +0000 + + workflows: rename legacy unprefixed to consumer- prefix + + Per consumer-template architecture (G-A-005, three-prefix + convention): wrappers around developer-meta-files reusables + carry the `consumer-` prefix. This is the bulk rollout of the + prefix to this repo's universal wrappers. + + Each file is byte-identical to its corresponding canonical in + developer-meta-files/consumer-templates/.github/workflows/. + + User-facing `name:` fields unchanged. cron slots converge on + the org-wide singleton (`0 6 * * 0` for Scorecard) per spec + "Scheduling in byte-identical templates" - GitHub queue + serializes; Scorecard's low value-to-noise ratio makes that + contention acceptable. + + Spec: + https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md + +commit b128c2b5eabcec49f6de27fa78bc95147505f674 +Merge: d9025962 1abdf11d +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 12:33:30 2026 -0400 + + Merge pull request #10 from org-ai-assisted/claude/review-github-actions-IQwcy + + codeql: migrate to split consumer-codeql-{python,cpp} wrappers + +commit 1abdf11d05d376c716b6114b71702369f398aa53 +Author: Claude +Date: Tue May 12 16:19:47 2026 +0000 + + workflows: rename dfuzzer+lint-python to local- prefix + + Per consumer-template architecture: workflows that live only in + one repo carry the `local-` prefix. Two renames: + + - dfuzzer.yml -> local-dbus-fuzz.yml + (tool name -> surface name; says what's being fuzzed) + - lint-python.yml -> local-python-lint.yml + (reorder to match local-- pattern used in other + repos, e.g. helper-scripts local-python-checks) + + User-facing `name:` fields unchanged. + +commit f6d6f000617268b1c7a0b81c7a859ac900af99e9 +Author: Claude +Date: Tue May 12 16:06:52 2026 +0000 + + bandit: migrate to consumer-bandit wrapper + + Per dmf #69 (reusable-bandit.yml refactor to shebang-aware + discovery). The old bandit.yml passed + `with: paths: usr/lib/python3/dist-packages/fm_shim_frontend` + and `with: prepare-command: ci/codeql-prepare.sh` to symlink + genmkfile-tagged '*.py#tag' files. Both are no longer needed - + the reusable now discovers Python by extension OR by shebang + on its own. + + Changes: + + - Renamed: .github/workflows/bandit.yml -> consumer-bandit.yml, + byte-identical to dmf canonical (no `with:`). + + Behavior change: bandit now scans the whole repo via shebang + discovery (including any Python outside + `usr/lib/python3/dist-packages/fm_shim_frontend`). If new false + positives surface, suppress per-line with `# nosec`. + + ci/codeql-prepare.sh remains in the repo - it's still used by + codeql-python and codeql-cpp jobs (per .github/dm-consumer.yml). + +commit 51cd4202dd5320bcdd71a2db26eb8d5ef0273725 +Author: Claude +Date: Tue May 12 15:59:23 2026 +0000 + + codeql: migrate to split consumer-codeql-{python,cpp} wrappers + + Per dmf #69 (reusable-codeql.yml hard refactor + single-job + per-language wrappers per design decision 3). The old + codeql.yml had two jobs (python + c-cpp) in one workflow; the + new architecture splits these into two separate workflow files. + + Changes: + + - Deleted: .github/workflows/codeql.yml (old multi-job). + - New: .github/workflows/consumer-codeql-python.yml + (byte-identical to dmf canonical). + - New: .github/workflows/consumer-codeql-cpp.yml + (byte-identical to dmf canonical). + - .github/dm-consumer.yml: add + codeql-python.prepare-command: "ci/codeql-prepare.sh" + codeql-cpp.prepare-command: "ci/codeql-prepare.sh" + codeql-cpp.build-command: "ci/codeql-build.sh" + (the values the old codeql.yml passed via `with:` for each + language job). + + Behavior change: python scan and c-cpp scan now run as separate + Actions UI entries (CodeQL Python / CodeQL c-cpp). A failure in + one no longer fails the other. + +commit d9025962aac47ee531e26f31994ae4d98703150c +Merge: 899959ae 83fc14a9 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Tue May 12 11:45:17 2026 -0400 + + Merge pull request #9 from org-ai-assisted/claude/review-github-actions-IQwcy + + coverity: migrate to consumer-template architecture + +commit 83fc14a99ed7ea91672042d832e9363c0ae12185 +Author: Claude +Date: Tue May 12 15:34:15 2026 +0000 + + cppcheck: migrate to consumer-template architecture + + Per dmf #68 (reusable-cppcheck.yml hard refactor). The old + cppcheck.yml wrapper passed inputs (paths, prepare-command) that + no longer exist on the reusable. Without this migration the + next cppcheck run (PR / master push) would fail because the + reusable's runtime config-load step would not find the cppcheck + section in .github/dm-consumer.yml. + + Changes: + + - .github/dm-consumer.yml: add cppcheck.paths + + cppcheck.prepare-command (the values the old wrapper passed + via `with:`). + - Renamed: .github/workflows/cppcheck.yml -> + consumer-cppcheck.yml, byte-identical to dmf canonical (no + `with:`, just the reusable call). + +commit 74eb7cafbd2b9aee63abd2cfcbbb507bc5c770a7 +Author: Claude +Date: Tue May 12 15:21:30 2026 +0000 + + coverity: migrate to consumer-template architecture + + Per dmf #67 (reusable refactor) + #68 (deadlock hotfix): + + - New: .github/dm-consumer.yml with coverity.project-name + + canonical-repos. + - Renamed: .github/workflows/coverity.yml -> consumer-coverity.yml, + byte-identical to dmf canonical (no `with:`, secrets-only). + + Behavior change: + + - Cron slot moves from '30 6 * * 0' (Sunday 06:30) to + '0 4 * * 5' (Friday 04:00) - the org-wide singleton slot in + the canonical template. + +commit 899959ae8831657f5af884ebba3243e5f1858707 +Author: Patrick Schleizer +Date: Mon May 11 20:28:53 2026 +0000 + + bumped changelog version + +commit 02c34b80ccf838436258991e967a026ff718850d +Merge: 4191b49a c2fa29c0 +Author: Patrick Schleizer +Date: Mon May 11 15:14:00 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit 4191b49a073728192a0fdd76f640b27cc0d4a00b +Merge: 82a56984 9a701e10 +Author: Patrick Schleizer +Date: Mon May 11 13:20:43 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie' + +commit 9a701e10e877b9eb60c4a59c74e8798cc1221df5 +Author: Aaron Rainbolt +Date: Sun May 10 21:50:35 2026 -0400 + + Misc fixes and TODOs + +commit c2fa29c067a24a81a19ec568f2676aa8b6fc877b +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 20:18:59 2026 -0400 + + workflows: add concurrency blocks (#7) + + 5 cancellable + 1 singleton (coverity). + +commit d0bf18601b3b9158292e1a904e39eaaaba717d57 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 17:59:39 2026 -0400 + + codex-review: forward only OPENAI_API_KEY explicitly (#6) + + Replace secrets: inherit with explicit single-secret map. + +commit 2d46c0027ef104526577ab3e22b25f3c43ae02b7 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 17:22:37 2026 -0400 + + workflows: drop "bash" prefix on ci/ scripts; rely on shebang (#5) + + Apply helper-scripts #19 pattern across 5 security-misc workflows (8 invocations). + +commit 82a56984a6a4270ab4d77199abcbe5b1fa24e6ae +Merge: b4fa999c c2513d3b +Author: Patrick Schleizer +Date: Sun May 10 15:31:44 2026 -0400 + + Merge remote-tracking branch 'org-ai-assisted/master' + +commit c2513d3be3adc9e8079aae91895b4818ae4d4d0b +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 15:29:47 2026 -0400 + + coverity: project-name slash form + explicit secrets map (#4) + + Fix Coverity scan: API requires Kicksecure/security-misc (slash) not Kicksecure-security-misc (dash). Explicit COVERITY_SCAN_{TOKEN,EMAIL} secrets map. + +commit f24b820efae19cd6197757a007af976a2a300eb6 +Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com> +Date: Sun May 10 15:29:45 2026 -0400 + + re-apply secrets + apt-cache hardening on top of upstream rebase (#3) + + Re-applied PR#2 hardening on top of upstream Kicksecure/security-misc master b4fa999c. + +commit b4fa999cb5f35276e0fc494806a9f7fdbc876145 +Merge: c21437fd ee1b8549 +Author: Patrick Schleizer +Date: Sun May 10 14:46:07 2026 -0400 + + Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master' + +commit ee1b85491e883f6c5ea431e9a3eeb42a39b36ca1 +Author: Claude +Date: Fri May 8 18:48:08 2026 +0000 + + codeql: drop packages: read + + None of our CodeQL builds pull from ghcr.io (kloak runs + 'bash build.sh', security-misc runs 'bash ci/codeql-build.sh', + helper-scripts and msgcollector are pure-Python). Drop the + defensive 'packages: read' grant in favor of least-privilege. + + A future consumer that genuinely authenticates to GitHub + Packages from a CodeQL build step can re-add it locally. + + Reusable docblock notes the rationale so a future maintainer + doesn't reflexively re-add it. + +commit c864386870b0fd5366441d8e62e6e41869eb06ef +Author: Claude +Date: Fri May 8 15:49:01 2026 +0000 + + claude-code: restore id-token: write + + Reverts the earlier 'drop id-token' commit. Verified against a live + workflow log that the action DOES use OIDC federation: + + Requesting OIDC token... + OIDC token successfully obtained + Exchanging OIDC token for app token... + Using GITHUB_TOKEN from OIDC + + The action federates the runner's id-token to an Anthropic-controlled + GitHub App which mints a higher-privilege GITHUB_TOKEN used to post + review comments. Without id-token: write the next run would have + failed with 'Could not fetch an OIDC token'. + +commit 318322481575fcee29a05a693f47e6a4f4e4fa29 +Author: Claude +Date: Fri May 8 15:33:25 2026 +0000 + + dfuzzer-run.sh: bash style guide compliance + + - R-010 strict-mode quintet: add 'shopt -s inherit_errexit' and + 'shopt -s shift_verbose' to outer script and to the inner + heredoc. + - R-030 printf format: drop embedded format strings (e.g. + 'printf 'foo=%s\n' "${x}"'); pass the entire message in the + data string of 'printf '%s\n' ...'. + - R-051 traps as named functions: extract inline EXIT trap + command-strings into named cleanup functions + (dfuzzer_run_cleanup, dfuzzer_inner_cleanup) registered after + the variables they reference are initialized. + - R-061 split combined short flags: 'rm -rf' -> 'rm -r -f'. + - shellcheck SC2317 (unreachable trap-callback) suppressed + inline. + +commit fb9ac8ecb248b3f4777a9ac80da9f01c09fd4200 +Author: Claude +Date: Fri May 8 15:24:19 2026 +0000 + + scorecard: drop inline cron allocation table + + The org-wide allocation table is single-source-of-truth in + developer-meta-files/.github/workflows/reusable-scorecard.yml. Each + consumer should carry only its own cron line with no commentary. + +commit cff945d545ab6d4513b2e4541e74c26bdd9e6df6 +Author: Claude +Date: Fri May 8 15:21:18 2026 +0000 + + claude-code: drop id-token: write + + The reusable workflow no longer needs id-token: write (the action + authenticates to api.anthropic.com via a static ANTHROPIC_API_KEY; + OIDC federation is unused). Drop the permission to honor + least-privilege - an OIDC token, if forged or leaked, can + authenticate to cloud-provider integrations. + +commit b0c55cb8dc406b5e9019d89d7e75b71f3ff565b8 +Author: Claude +Date: Fri May 8 14:28:16 2026 +0000 + + dfuzzer-run.sh: pass --no-suppressions + + dfuzzer 2.6 treats 'no suppression file found at any of the + 3 candidate paths (./dfuzzer.conf, ~/.dfuzzer.conf, + /etc/dfuzzer.conf)' as a fatal error and exits 1 before fuzzing + anything (verified in upstream src/dfuzzer.c main() - the + df_suppression_load() call returns -1, which prints the literal + 'Exit status: 1' and goto cleanup). On a fresh GitHub runner + none of those paths exist, so the workflow always failed + immediately. We don't want suppressions anyway: we want every + crash / unexpected exit reported. + +commit 167222754f61bd7c7908c74d94e8fb7e762f9f25 +Author: Claude +Date: Fri May 8 14:13:34 2026 +0000 + + dfuzzer-run.sh: pass explicit object path + + dfuzzer defaults to object path '/' which has no methods registered + on fm-shim-backend (its methods are at /org/freedesktop/FileManager1). + Without -o the previous runs exited in milliseconds with no fuzzing + performed. + +commit d8dac7a1a2a8ccd01bddff4d405ca195befd489d +Author: Claude +Date: Fri May 8 14:08:24 2026 +0000 + + dfuzzer-run.sh: diagnostic logging + busctl introspect probe + + After two iterations where dfuzzer exits 1 with no usable + diagnostic ('Cannot open suppression file ... Exit status: 1' + - which is dfuzzer's normal idle output, not the actual error), + add three probes that surface the real state of the world: + + 1. fm-shim-backend stdout/stderr captured to a tmpdir log file + and dumped via ::group::. Without a tty its output is block- + buffered and gets lost when the kill-on-EXIT trap fires; + redirecting to a file flushes on close. + + 2. NameHasOwner poll loop (up to 5 attempts at 1s each) that + confirms the well-known name is registered before dfuzzer + tries to talk to it. Fails fast and surfaces the backend's + stdout if the backend dies during startup. + + 3. 'busctl --user introspect' before dfuzzer to verify the + Introspectable wiring (the just-added handle_introspect() + in fm-shim-backend.c). If busctl can't introspect, dfuzzer + won't be able to either - and we'll see exactly where the + chain breaks. + + This is exactly the diagnostic loop helper-scripts' fuzz.yml + went through during its initial Atheris/CFL bring-up; document + the pattern in agents/fuzzing.md once the dust settles. + +commit 0d3a8a120e5c3c7f1f7919c033b52fcc060db81e +Author: Claude +Date: Fri May 8 14:05:50 2026 +0000 + + fm-shim-backend: implement org.freedesktop.DBus.Introspectable.Introspect + + Real bug found while wiring up the dfuzzer workflow: fm-shim- + backend's hardcoded interface filter rejects every method call + that isn't on org.freedesktop.FileManager1, including the + standard org.freedesktop.DBus.Introspectable.Introspect that + every introspection-aware D-Bus client expects. + + Symptoms before this fix: + - 'busctl introspect --user org.freedesktop.FileManager1 + /org/freedesktop/FileManager1' fails with 'Unknown interface'. + - 'd-feet' / 'qdbusviewer' don't enumerate the service's + methods. + - dfuzzer exits 1 with no usable output (can't introspect -> + doesn't know what to fuzz). + + Fix is conventional: implement Introspect to return a static XML + description of the FileManager1 surface plus the standard + Introspectable interface itself. Argument signatures ('as' for + the URI list, 's' for the startup ID) match the freedesktop.org + file-manager-interface spec. Static string + one extra branch + in dispatch; no runtime cost. + + Discovered by: ci/dfuzzer-run.sh first integration run on + master 6ed21ea (2026-05-08). With this patch dfuzzer can + introspect, enumerate the three methods (ShowFolders, + ShowItems, ShowItemProperties), and proceed to fuzz them. + +commit 6ed21ea68d8b8f5eaa6077e9a171d1bb996bebf5 +Author: Claude +Date: Fri May 8 14:02:06 2026 +0000 + + dfuzzer-run.sh: manual backend launch instead of dbus auto-activation + + XDG-local .service file auto-activation isn't reliable inside + dbus-run-session's transient bus (the dbus-daemon spawned there + seems not to read $XDG_DATA_HOME/dbus-1/services/ - dfuzzer + exits 1 with no meaningful error before any fuzzing happens). + + Switched approach: + 1. Inside dbus-run-session, start fm-shim-backend in the + background. It registers the org.freedesktop.FileManager1 + well-known name on the session bus and enters its dispatch + loop. + 2. sleep 1 + kill -0 check to surface 'backend died during + startup' before dfuzzer's misleading 'name not found' error. + 3. Run dfuzzer against the now-registered name. + 4. EXIT-trap kills the backend at the end. + + Also restructured to avoid multi-level shell quoting: the inner + script lives in a tempfile and gets the binary path + seconds + budget as positional args. Easier to read; bug-class found while + debugging. + + dfuzzer flag now '-I 50' (50 iterations per method, default per- + method coverage on the small FileManager1 surface). Total wall- + clock still bounded by 'timeout --preserve-status' wrapper. + +commit 80089f9e7a452dead2fe5b6c2217e2f02426ed8d +Author: Claude +Date: Fri May 8 13:59:36 2026 +0000 + + dfuzzer-run.sh: fix dfuzzer flag set + use shell timeout + + Three corrections after the v2.6 source-code check: + + 1. dfuzzer 2.6 takes '-n BUS_NAME' (long form '--bus' - misnamed + in upstream; semantically a bus-NAME value). The previous + '--name' / '--bus session' invocation produced + 'unrecognized option' and dfuzzer exited 1 before fuzzing + anything. + + 2. dfuzzer has NO time-bounded flag - only iteration counts. + Wrap with shell 'timeout --preserve-status' to enforce a + per-job time budget. Exit code 124 (budget reached) is + treated as success since hitting the budget means we got + the configured amount of fuzzing. + + 3. Removed '--bus session' - dfuzzer auto-detects the bus from + DBUS_SESSION_BUS_ADDRESS (set by dbus-run-session above), + which is what we want. + + The 'set -o errexit' inside the inner bash -c was also dropped + because we now want the wrapper script (not errexit) to drive + the exit-code interpretation; dfuzzer's real exit code reaches + us via 'rc=$?' and is mapped to a friendly outcome string. + +commit 19f88613f2d0b881614615daf4e24e99025e0b34 +Author: Claude +Date: Fri May 8 13:56:47 2026 +0000 + + dfuzzer.yml: fix binary path (build/dfuzzer not build/src/dfuzzer) + +commit e54cf73996fec5a7737ee19bf2701a5385054d87 +Author: Claude +Date: Fri May 8 13:55:13 2026 +0000 + + dfuzzer.yml: bump tag pin v1.7 -> v2.6 (real latest) + +commit 487a08d1caa42bed0f3b821f2bacfcb09fc990f6 +Author: Claude +Date: Fri May 8 13:53:27 2026 +0000 + + dfuzzer.yml: build dfuzzer from source + + dfuzzer is not in the Ubuntu 24.04 (noble) archive (verified + via packages.ubuntu.com - 'No such package'). Switch from + apt-install to a from-source build pinned at the upstream + v1.7 tag. Build deps (meson/ninja/glib/xsltproc/docbook) + added; runtime apt deps (dbus, libdbus-1-dev, libsystemd-dev, + pkg-config, gcc) kept. + +commit 16a684b4a5fddbdd29bda5ddc01ea1f233f98316 +Author: Claude +Date: Fri May 8 13:51:01 2026 +0000 + + fuzzing: add dfuzzer workflow for fm-shim-backend D-Bus surface + + Wires up dfuzzer (Debian-archive-shipped D-Bus service fuzzer) + against the fm-shim-backend binary's org.freedesktop.FileManager1 + surface. Process-level fuzzing complementing the in-process + Hypothesis suite already covering fm_shim_frontend. + + What gets exercised: + - D-Bus marshaling glue (libdbus-1 path). + - Method dispatch in main()'s message loop. + - sd_notify error path under transient session bus. + - Signal handler interactions. + - Resource lifecycle across method calls (fd leaks etc). + + What's NOT exercised here: + - The frontend prompt logic (covered by Hypothesis tests). + - The in-process parser (libFuzzer harness deferred per + AGENTS.md fuzzing notes). + + Workflow body in ci/dfuzzer-run.sh (R-100): + 1. compile-fm-shim-backend -> tmpdir binary + 2. Write XDG-local D-Bus session service file pointing at + the tmpdir binary so dbus auto-activates it on first + method call. + 3. dbus-run-session boots a transient session bus and runs + dfuzzer --bus session --name org.freedesktop.FileManager1 + --max-time $DFUZZER_SECONDS --verbose. + + Trigger: workflow_dispatch only initially (mirrors helper- + scripts/fuzz.yml). Once a green-baseline run lands, the + commented-out path-filtered pull_request trigger can be + enabled. Default per-method budget 60s; overridable via + workflow_dispatch input. + + Note: dfuzzer is in the Ubuntu universe pocket (apt-installable + on ubuntu-latest by default). No third-party action. + +commit e1ff1f8e1a7c3741ee1d6464a16544069fbda822 +Author: Claude +Date: Fri May 8 13:34:19 2026 +0000 + + ci: switch reusable refs to 'reusable-.yml' + + Seven 'uses:' lines (codeql, scorecard, claude-code-review, + codex-review, coverity, cppcheck, bandit) repointed at the + renamed reusable files in developer-meta-files. + +commit 30d58b0fc48797bf6e9269b0d755792b3ebb6b7c +Author: Claude +Date: Fri May 8 13:27:50 2026 +0000 + + ci: gitignore __pycache__; remove the two stray files just committed + + The Hypothesis test commit accidentally checked in two .pyc + files under ci/tests/fm_shim_frontend/__pycache__/ from the + local validation run. Drop them, add **/__pycache__/ to + .gitignore so the next 'git add -A' does not re-include them. + +commit 3f8233b18d05b7d90c137cf1f49e780a2cc0be6c +Author: Claude +Date: Fri May 8 13:27:31 2026 +0000 + + fuzzing: add Hypothesis property tests; fix ENAMETOOLONG crash + + Adds ci/tests/fm_shim_frontend/test_property.py (six property + tests over get_path_list_from_uris, plus a deterministic + regression suite of nine adversarial inputs) wired into + .github/workflows/lint-python.yml. + + The fuzz suite immediately found a real exploitable bug at + introduction: an attacker who can deliver a URI with a single + path component longer than NAME_MAX (255 bytes on Linux) crashed + the process via an uncaught OSError(ENAMETOOLONG=36) from + Path.exists(). Fixed by wrapping the exists() call in + try/except OSError - any OSError is treated as 'non-existent, + skip' (same path the False branch was already handling). + + The bug is reachable from an attacker process via the + FileManager1 D-Bus surface (other desktop apps can pass URI + lists). Severity: local DoS of the fm-shim-frontend prompt. + + Other infrastructure: + + - ci/tests/fm_shim_frontend/conftest.py stubs out 'stdisplay' + (helper-scripts package, not in the runner's apt) and the + PyQt5 Qt* submodules (a real pyqt5 install would still be + needed for live use, but isn't required for property-testing + the URI validator function in isolation). + - agents/fuzzing.md documents the layout and the local-run + invocation, mirroring helper-scripts' agents/fuzzing.md. + - AGENTS.md gains a Component Notes pointer to the new doc. + + ClusterFuzzLite (Atheris coverage-guided fuzzing) is NOT wired + yet; deferred until the property-test suite has been running + long enough to pick the easy wins. + +commit f4ab12218cef102b30a083f206380ba9e4dc1b76 +Author: Claude +Date: Fri May 8 12:38:25 2026 +0000 + + static-analysis: add cppcheck + bandit wrappers + + Free local-runnable extras complementing CodeQL and Coverity: + + cppcheck - C static analyzer over usr/src/security-misc/. + Re-uses ci/codeql-prepare.sh to symlink the + genmkfile-tagged '*.c#security-misc-shared' + files to clean '*.c' names cppcheck discovers + by extension. + + bandit - Python security-focused analyzer over + usr/lib/python3/dist-packages/fm_shim_frontend/. + Same prepare-command for the '*.py#tag' files. + +commit 767088d43fcb62d82c5a0e664ba46b4939632e2d +Author: Claude +Date: Fri May 8 12:07:44 2026 +0000 + + coverity: use real Coverity Scan project name + + The scan.coverity.com project for this repo is registered under + 'Kicksecure-security-misc' (verified at + https://scan.coverity.com/projects/Kicksecure-security-misc). + The reusable wrapper was passing the bare repo name + 'security-misc' which produced HTTP 401 on cov-build download + because the project+token pair did not match. + +commit cebe274c8bb2c82122ebfa88699ea410f55ca788 +Merge: c21437fd 16cc61e5 +Author: assisted-by-ai (Bot Account) +Date: Fri May 8 08:01:49 2026 -0400 + + Merge pull request #1 from org-ai-assisted/claude/test-github-token-access-HVDXY + + codeql: add static-analysis workflow (python + c-cpp) + +commit 16cc61e58fb990b8c78cb402c20161bacfcaea2f +Author: Claude +Date: Fri May 8 12:00:02 2026 +0000 + + lint-python: use flake8 --select=F; add suppressions to fsw line + + Two fixes for the just-added Python lint workflow. + + 1. Switch from plain pyflakes3 to 'flake8 --select=F'. + + pyflakes by design does not honor any suppression comment - not + '# noqa', not '# pylint: disable', nothing. There is no + escape hatch for intentional violations short of a code + rewrite. flake8 wraps pyflakes (same F-class checks) and adds + '# noqa' support, which is the standard pyflakes-aware + suppression. '--select=F' restricts to F-class rules only + (undefined names, unused imports, unused locals, ...) and + skips E/W PEP8 style noise that would clash with the + codebase's '##' block-comment convention (E266). + + 2. Apply '# noqa: F841 # pylint: disable=unused-variable' to the + intentionally-retained QWindow reference in main(). The binding + is required to keep the QWindow alive while app.exec_() is + running (Qt does not always retain Python wrappers for top- + level windows without a parent). Both pyflakes (F841) and + pylint (unused-variable) flagged it as unused; per-tool + pragmas are needed because the two tools do not share a + common 'intentionally unused local' marker. + + Locally verified: 'flake8 --select=F' returns rc=0 against the + prepared (symlinked) source paths after these changes. + +commit 7892d45da7147905dfe1831455a01f732d83ec38 +Author: Claude +Date: Fri May 8 11:55:32 2026 +0000 + + Revert "TEMP: point coverity wrapper at feature branch for end-to-end test" + + End-to-end test requires both this PR and developer-meta-files PR + to land on master first (workflow_dispatch needs the workflow file + on the default branch per G-A-003). The TEMP @feature-branch ref + becomes obsolete once dev-meta-files PR #7 merges and '@master' + resolves to the new reusable. Reverting now to keep the wrapper + clean for merging. + +commit 40cc7953c788bd61bae7abde24bda981fb9f407f +Author: Claude +Date: Fri May 8 11:54:45 2026 +0000 + + TEMP: point coverity wrapper at feature branch for end-to-end test + + Reverts to '@master' once developer-meta-files PR #7 merges. Used + to validate the reusable resolves and the orchestration scripts + (check-secrets, download, build-python, submit) execute cleanly + end-to-end on a real consumer before the reusable is published. + +commit 2950603574573403c2c82a233fe14f5bd32ba42f +Author: Claude +Date: Fri May 8 11:53:27 2026 +0000 + + lint-python: simple Python lint for fm_shim_frontend + + Two error-only checks (no style noise): + + pyflakes3 - undefined names, unused imports, etc. + pylint --errors - E*** rules only (skips C/W/R categories). + + Apt-installs python3-pyqt5 so the linters can resolve the PyQt5 + imports rather than emitting blanket import-error noise. Re-uses + ci/codeql-prepare.sh to symlink the genmkfile-tagged '*.py#' + sources to extension-clean paths the linters discover. + + Triggers are path-filtered to fm_shim_frontend/ + this workflow + + the prepare script, so unrelated changes do not run it. + +commit de73399046061640a48f630e3e8da7b22da90814 +Author: Claude +Date: Fri May 8 11:46:23 2026 +0000 + + coverity: add Python coverity scan via org-wide reusable + + Adds a Coverity Scan wrapper for the Python sources + (usr/lib/python3/dist-packages/fm_shim_frontend/...). C sources + under usr/src/security-misc/ stay covered by CodeQL only for now; + revisit if the C surface grows enough to justify a multi-language + cov-build. + + Cron slot '30 6 * * 0' offset from helper-scripts ('0 6 * * 0'). + +commit 54aec391d63eec0a73751c352f8684b4fb4ee75e +Author: Claude +Date: Fri May 8 11:35:22 2026 +0000 + + workflows: secrets:inherit + add scorecard wrapper + + - ai-review wrappers: replace explicit secret-mapping with + 'secrets: inherit'. Org-wide ANTHROPIC_API_KEY / + OPENAI_API_KEY propagate without per-repo boilerplate. + - scorecard wrapper added; calls the existing reusable in + developer-meta-files. Cron slot '30 5 * * 0' keeps it offset + from the org's other Scorecard slots. + + Note: this commit is unsigned because security-misc is not yet + registered with the org's commit-signing service. + +commit fc643aaa4603ff7e65706ade6b1edea9ba9eb735 +Author: Claude +Date: Fri May 8 11:27:48 2026 +0000 + + ai-reviews: add Claude + Codex review wrappers + + Two minimal consumer wrappers calling the org-wide reusables in + developer-meta-files: + + .github/workflows/claude-code.yml + .github/workflows/codex-review.yml + + Behavior matches the kloak/helper-scripts setup: pull_request + + comment-triggered Claude review; pull_request + workflow_dispatch + (fork-PR override) Codex review. Allow-lists inherit the + reusable's defaults. + + Requires repo secrets ANTHROPIC_API_KEY and OPENAI_API_KEY to be + set before these produce useful output. + + Note: this commit is unsigned because security-misc is not yet + registered with the org's commit-signing service. + +commit 7b5d353109a82246039de6c9c984f58385dccf9a +Author: Claude +Date: Thu May 7 23:09:37 2026 +0000 + + codeql wrapper: trim to minimal; link to centralized docs + + Drop the scope/#tag/cron-allocation prose - those notes belong in + the reusable's header on developer-meta-files master, not duplicated + here. One-line pointer at the URL is enough; readers needing to + understand the prepare-command + build-command shape follow the + link to the centralized doc. + +commit ad0d004561ce5ffc407f53282fd5d4eecac295ba +Author: Claude +Date: Thu May 7 23:07:20 2026 +0000 + + security-misc: extract C compile step into reusable helpers + + Resolves the TODO atop usr/libexec/security-misc/emerg-shutdown: + + > TODO: Move most of this to a build script that will compile + > and place under /usr/bin rather than /run. + + The motivating use case is also that CodeQL's CI compile path + (ci/codeql-build.sh) was duplicating the gcc command, including + ~70 hardening flags. With ~70 flags in two places, drift was a + matter of when, not if. + + New helpers (no '.sh' extension to match the rest of usr/libexec/ + security-misc/): + + usr/libexec/security-misc/compile-fm-shim-backend + usr/libexec/security-misc/compile-emerg-shutdown + + Each is a pure compile - takes (source, output) positionals, runs + gcc with the project's hardening flag set, exits non-zero on + failure. No chmod, no mv, no install - the caller decides what to + do with the binary. + + Consumers: + + build-fm-shim-backend - keeps mktemp/trap/chmod/mv lifecycle, + delegates the gcc invocation. + emerg-shutdown - keeps the dracut/config/memlockd/exec + logic, delegates the gcc invocation. + The hardening flag array and machine- + type branching go away from this file. + ci/codeql-build.sh - drops the inline gcc, calls both + compile- helpers. Single source of + truth: CI's hardening flags == runtime's. + + Also extends ci/codeql-prepare.sh to symlink '*.c#' to clean + '*.c' names (in addition to '*.py#'). gcc selects driver + behavior by file extension - a '*.c#' source is misclassified + as a linker script ('file format not recognized'). Verified + locally: with the symlinks in place, the helpers produce both + binaries (fm-shim-backend dynamic 49 KB, emerg-shutdown static + 875 KB) without warnings under x86_64-linux-gnu. + + Wires the c-cpp CodeQL job to run codeql-prepare.sh too via the + reusable workflow's prepare-command hook. + +commit f03270a46b476f354065f7b56dca523a50a1af8d +Author: Claude +Date: Thu May 7 22:55:39 2026 +0000 + + codeql: align ci helpers with bash-style-guide + + Per developer-meta-files agents/bash-style-guide.md and pre-push- + checklist: + + - R-002: add the 'AI-Assisted' header marker on the new bash + scripts and the workflow YAML. + - R-010: add 'set -o errtrace' to both ci/codeql-*.sh. + - pkg-config: keep the unquoted '\$(pkg-config ...)' subshells + matching the upstream pattern in build-fm-shim-backend; add a + NOTE comment and a 'shellcheck disable=SC2046' since the rule + fires on the intentional shape (AGENTS.md 'pkg-config quoting + in build script' rule). + +commit 80ce8c9e8d47ee0d27465e69db6425d3ff18ee4a +Author: Claude +Date: Thu May 7 22:50:17 2026 +0000 + + codeql: add static-analysis workflow (python + c-cpp) + + Adds .github/workflows/codeql.yml as a thin wrapper around the + org-wide reusable workflow in developer-meta-files. Two jobs - one + per language - matching the source mix actually present in the + repo: + + python: usr/lib/python3/dist-packages/fm_shim_frontend/ + c-cpp: usr/src/security-misc/{emerg-shutdown,fm-shim-backend}.c + + Source files in this repo carry a '#' suffix per the + genmkfile installable-routing convention; that suffix hides them + from CodeQL's Python extractor (which discovers by file extension). + Two helper scripts handle this: + + ci/codeql-prepare.sh - run via the reusable's pre-init hook; + creates extension-clean symlinks for each '*.py#tag' source. + ci/codeql-build.sh - manual build for c-cpp; installs build + deps and runs gcc -c on each .c file. The C extractor traces + compiler invocations rather than scanning by extension, so + the tagged paths can be passed to gcc verbatim. + + Cron slot picked to avoid collision with the org's existing + CodeQL slots (helper-scripts '17 4 * * 0', kloak '25 3 * * 5'). + + Note: this commit is unsigned because security-misc is not yet + registered with the org's commit-signing service. + +commit c21437fd83c5a86e6573ed76c2ecadcbfddacd45 +Author: Patrick Schleizer +Date: Sat May 2 08:48:24 2026 +0000 + + bumped changelog version + +commit 66d509f1995be49919c6f9d67cb25111678b1172 +Author: Patrick Schleizer +Date: Fri May 1 16:45:03 2026 -0400 + + add CLAUDE.md + +commit 48ba0017a14e3d3084aaf0ee42cc2542d7563cb1 +Author: Patrick Schleizer +Date: Sat Apr 25 09:26:49 2026 +0000 + + bumped changelog version + +commit e085afa9e56144feb1e5d80429341a464aa08d04 +Merge: 11a5c33a 1765046c +Author: Patrick Schleizer +Date: Sat Apr 25 05:13:22 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 1765046c7731cab90a320833763412b288e85930 +Author: Aaron Rainbolt +Date: Fri Apr 24 20:05:15 2026 -0400 + + Bash arithmetic hardening + +commit 11a5c33a566cc5280ee0b5984850ba05c716c106 +Author: Patrick Schleizer +Date: Wed Apr 22 13:16:46 2026 +0000 + + bumped changelog version + +commit 324ee4fdf63a8945af3f1125fab1403bdf87b5e4 +Merge: e5df9643 b43e11e5 +Author: Patrick Schleizer +Date: Wed Apr 22 06:35:15 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit b43e11e59e9f7b50fd1e84d5630c4c10a3f6cf69 +Author: Aaron Rainbolt +Date: Sun Apr 19 19:23:58 2026 -0400 + + Add better Unicode handling to fm-shim-frontend + +commit 9b058e0618062b345e9bd29e5c51f7b5e0df3191 +Author: Aaron Rainbolt +Date: Sun Apr 19 01:23:59 2026 -0400 + + Add better logging to fm_shim_frontend + +commit e5df9643ad2b060f74ed519dd7acc913692724d8 +Author: Patrick Schleizer +Date: Thu Apr 16 12:27:58 2026 +0000 + + bumped changelog version + +commit 36438ea84e610895c7bdd7de8a556f7c5a0c86aa +Author: Patrick Schleizer +Date: Thu Apr 16 01:53:02 2026 -0400 + + readme + +commit a0a6ef0ab92da68460b53b3c304f3c200ee2576e +Author: Patrick Schleizer +Date: Thu Apr 16 01:50:33 2026 -0400 + + readme + +commit 766710a05a83edf128c02041ce5a18a9a76cc9e1 +Author: Patrick Schleizer +Date: Thu Apr 16 01:43:35 2026 -0400 + + readme + +commit d44d9caac299a35d22d2240c2cfd42cefec22850 +Author: Patrick Schleizer +Date: Thu Apr 16 01:30:01 2026 -0400 + + agents + +commit ec3fd3bf2abd81f546b08c351b868218dbffcc68 +Merge: f511bb92 019e8415 +Author: Patrick Schleizer +Date: Thu Apr 16 01:22:03 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 019e84154a516e9a97bc284f2dc90ecf677e8531 +Author: Aaron Rainbolt +Date: Wed Apr 15 01:07:45 2026 -0400 + + Prevent using systemd-journald to write text to other user's terminals + +commit 187129cdebecae9c4906483f01f2d7341c1071f3 +Author: Aaron Rainbolt +Date: Wed Apr 15 00:47:52 2026 -0400 + + Add more compiler hardening flags + +commit b9d5480d9d7ee90c75523548bc69e9d467fda7b0 +Author: Aaron Rainbolt +Date: Mon Apr 13 18:51:43 2026 -0400 + + Remove unused AppArmor aliases + +commit f7a432f4e12407d920e787fcdd1937ae2100b3c9 +Author: Aaron Rainbolt +Date: Sun Apr 12 20:53:09 2026 -0400 + + Fix sysinit-post.target description + +commit fcefea6d468a7f4524c0f78e17bd9311692ce3bc +Author: Aaron Rainbolt +Date: Sun Apr 12 20:52:10 2026 -0400 + + Remove preset block on emerg-shutdown.service + + The block didn't actually work, and the bug that kept emerg-shutdown + from being usable with Calamares appears to no longer be a problem. + +commit 0e8f654d3af4613ca0346d8c9524fb1d116468b7 +Author: Aaron Rainbolt +Date: Sun Apr 12 20:48:24 2026 -0400 + + Documentation updates (mostly from Claude Code) + +commit 1baaaea4bc40e0e67d47ff904fea74f2b241dcdb +Author: Aaron Rainbolt +Date: Sun Apr 12 19:27:00 2026 -0400 + + Modified and squashed commit of the following: + + commit 518290c64b01d3890639b7b22cf90ababb163565 + Author: Claude + Date: Fri Apr 10 10:33:35 2026 +0000 + + Add agents docs for fm-shim security review notes + + Document fm-shim architecture, accepted threat model, and rejected + review suggestions to preserve context for future security reviews. + + https://claude.ai/code/session_01HJPNe7hjMrPvPtuJmPBhNa + +commit b6f5cf1787d2ab12832892ab38b79825a1748e9b +Author: Aaron Rainbolt +Date: Sun Apr 12 15:30:06 2026 -0400 + + Modified and squashed commit of the following: + + commit 63606cd8a818570143ea73211a74bbb5db38242a + Author: Claude + Date: Fri Apr 10 11:03:29 2026 +0000 + + Add AGENTS.md with fm-shim review guidelines + + Captures lessons from PR #358 review feedback to prevent repeating + rejected patterns in future contributions. + + https://claude.ai/code/session_01CgrrFhhVWtqtfhvJdEcBWm + +commit f511bb9218a68c2c027107f5b898eb795302e9c9 +Author: Patrick Schleizer +Date: Sun Apr 12 14:03:30 2026 +0000 + + bumped changelog version + +commit e9d672a5e6a2c76a3668aebd46dcb42c04b97fdc +Author: Patrick Schleizer +Date: Sun Apr 12 03:35:31 2026 -0400 + + comments + +commit 232b01e7df376225ed895bf04ebe02b0943b6074 +Author: Patrick Schleizer +Date: Fri Apr 10 09:21:40 2026 +0000 + + bumped changelog version + +commit 1e23d62307d17fc6ecc86ae923332c07bfc52d60 +Merge: f64fc3e1 972f4c95 +Author: Patrick Schleizer +Date: Fri Apr 10 04:21:34 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 972f4c95fb31d41140d3a30fbdba5c49dbd6bd73 +Author: Aaron Rainbolt +Date: Thu Apr 9 23:37:21 2026 -0400 + + Document fm-shim in README.md + +commit 61dd797310b257fd7614b1769b84d62ce62ef80b +Author: Aaron Rainbolt +Date: Thu Apr 9 23:29:26 2026 -0400 + + Standardize on one form of bullets in README.md + +commit 1a71a3e954060aaf06a3daf491168bdf31942dc5 +Author: Claude +Date: Thu Apr 9 12:06:54 2026 +0000 + + comment out bdev_allow_write_mounted=0 + + Causes breakages with disk management operations such as disk + resizing and VDI compaction in virtual machines. + + https://github.com/Kicksecure/security-misc/pull/334 + https://forums.whonix.org/t/kernel-hardening-security-misc/7296/609 + https://forums.whonix.org/t/how-to-compress-and-prevent-vdi-from-ballooning-after-each-update-deleting-large-files/22675/9 + https://forums.kicksecure.com/t/resizing-disk-for-guest-in-kvm/1657 + + https://claude.ai/code/session_01Cd9ka8sC7zLUvB31V4kxMk + +commit f64fc3e1645ec2661b518e64f4454dc9ef85cf49 +Author: Patrick Schleizer +Date: Thu Apr 9 11:57:57 2026 +0000 + + bumped changelog version + +commit 4c3d4267a19ef56c488779ad28d82eef87b967d9 +Merge: 46c171e4 e718203d +Author: Patrick Schleizer +Date: Thu Apr 9 07:53:33 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit e718203d075ba73ecb7a89e31db6ca4ac588cf78 +Author: Aaron Rainbolt +Date: Wed Apr 8 17:20:10 2026 -0400 + + Add additional compiler hardening flags for fm-shim-backend + +commit cf518cbabae41c6608006adcdf38128c902486c2 +Author: Aaron Rainbolt +Date: Wed Apr 8 17:19:19 2026 -0400 + + Add additional compiler hardening flags for emerg-shutdown + +commit 83b360edf6c3d8a0d1714a3f2d6e9865ae225b64 +Author: Aaron Rainbolt +Date: Wed Apr 8 17:06:00 2026 -0400 + + Fix dead code in emerg-shutdown.c + +commit 46c171e42ab66b0ec3bc10e715e6c54974966a8e +Author: Patrick Schleizer +Date: Wed Apr 8 17:51:28 2026 +0000 + + bumped changelog version + +commit 7b443582fe845d2a6c76c74f96df837bb56ef624 +Author: Patrick Schleizer +Date: Wed Apr 8 10:07:01 2026 -0400 + + remove trailing space + +commit cbcf722f5a895697364891f15d37349d68f8054e +Merge: 3949bf35 17a9da5b +Author: Patrick Schleizer +Date: Wed Apr 8 10:06:09 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 17a9da5bada135774ff71cf094e56d2557048540 +Author: Aaron Rainbolt +Date: Mon Apr 6 22:21:51 2026 -0400 + + More emerg-shutdown bugfixes (from Claude Code) + +commit 55e42610c2949c1f15bc6802dab1006f8d74159e +Author: Aaron Rainbolt +Date: Mon Apr 6 21:28:28 2026 -0400 + + Document reason for not quoting pkg-config subshells + +commit 5c0641795a33a9bd0a01dbbce66fa243978bb59a +Author: Aaron Rainbolt +Date: Mon Apr 6 20:29:12 2026 -0400 + + Minor fixes on fm-shim-backend + +commit af4f229046b8ff64eeea599bc72fe47bd35784fc +Author: Aaron Rainbolt +Date: Sun Apr 5 19:21:41 2026 -0400 + + Improve fm-shim-backend security and D-Bus error handling (mostly from Claude Code) + +commit 83fba23b6f95cda25c7839ac43ae2e02e52b59a1 +Author: Aaron Rainbolt +Date: Sun Apr 5 18:33:50 2026 -0400 + + Only allow the primary fm-shim-backend process to use sd_notify + +commit 3b3b5862cd168d75c768220408314040562cf020 +Author: Aaron Rainbolt +Date: Sun Apr 5 18:15:31 2026 -0400 + + Security hardening: fix buffer handling, input validation, misc bugs (mostly taken from Claude Code) + +commit 4d0ccf65acec9c2ee15608d8b6b601293b8f98da +Author: Aaron Rainbolt +Date: Sun Apr 5 15:45:06 2026 -0400 + + Add user existence check to virusforget (inspired by Claude Code) + +commit 3949bf35e90a50b8ebc534b71fd3ece834f23b8b +Author: Patrick Schleizer +Date: Sun Mar 22 11:13:50 2026 +0000 + + bumped changelog version + +commit 92f6f30f565b1b8598199ac7d1bc35e01bf5a082 +Author: Patrick Schleizer +Date: Sun Mar 22 05:45:45 2026 -0400 + + comment + +commit 140c9cbc8a487585a92eca7acbbdfe18b92e0da9 +Merge: c913e3be 8a81ab4a +Author: Patrick Schleizer +Date: Sun Mar 22 05:44:46 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 8a81ab4af5182a124686857104118c0701e93357 +Author: Aaron Rainbolt +Date: Thu Mar 19 22:17:47 2026 -0400 + + Comments, hardening on fm-shim frontend and backend + +commit 144d04cd84084508a7f1ce892ef1d00296f693de +Merge: 58192e68 c913e3be +Author: Aaron Rainbolt +Date: Thu Mar 19 20:39:37 2026 -0400 + + Merge branch 'master' into arraybolt3/trixie + +commit c913e3bead0dfffee0a46049d30dc8d91e47f5ca +Author: Patrick Schleizer +Date: Thu Mar 19 18:30:25 2026 +0000 + + bumped changelog version + +commit 89908e0938929c6ee6f39dbd510f4bc889ca31c1 +Author: Patrick Schleizer +Date: Thu Mar 19 11:24:36 2026 -0400 + + copyright + +commit 58192e688c0ea32bf6bb9806eb619413d26c2b12 +Author: Aaron Rainbolt +Date: Wed Mar 18 20:28:20 2026 -0400 + + Avoid unintentional HTML rendering in fm-shim-frontend, fix path resolution, fix wrong D-Bus protocol handling in backend, slightly harden backend + +commit 6c0b8dbc50840950756b4d28c5bb7622e035b11d +Author: Patrick Schleizer +Date: Tue Mar 17 13:57:12 2026 -0400 + + remove trailing spaces + +commit 58555692e771846548282dd55e696117d95abff4 +Merge: ce5034d9 b34ee621 +Author: Patrick Schleizer +Date: Tue Mar 17 13:55:43 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit b34ee6216809232cc09453f10437fd14e34ea318 +Author: Aaron Rainbolt +Date: Sun Mar 15 21:03:44 2026 -0400 + + Further fm-shim frontend and backend hardening and bugfixes following ChatGPT code review + +commit c96fb114c820625536a32be406b923055a073081 +Author: Aaron Rainbolt +Date: Sun Mar 15 13:54:30 2026 -0400 + + Integrate hardening suggestions from ChatGPT into fm-shim-backend.c + +commit ce5034d9612488728b3ed7b2a61e009762c33e63 +Author: Patrick Schleizer +Date: Sat Mar 14 12:08:52 2026 +0000 + + bumped changelog version + +commit a6c8ba2c5e348ebc419d8ae8148108fba36f6fed +Author: Patrick Schleizer +Date: Sat Mar 14 07:03:41 2026 -0400 + + remove superfluous file + +commit f9a182cb87d16a498e65fb9cb40a3c174683fe75 +Merge: 0da8cad9 76734023 +Author: Patrick Schleizer +Date: Sat Mar 14 07:03:11 2026 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 767340233fa3b305ac53f56c843c348c44695bf3 +Author: Aaron Rainbolt +Date: Tue Mar 10 00:17:29 2026 -0400 + + Fix unused variable in fm-shim-backend.c + +commit 0bf666a87bcfb6f452a16a37d90c813e372fea89 +Author: Aaron Rainbolt +Date: Mon Mar 9 22:28:52 2026 -0400 + + Add work-in-progress D-Bus shim for org.freedesktop.FileManager1 + +commit 0da8cad962683701a77c29b6ba49a2f80e125690 +Author: Patrick Schleizer +Date: Mon Feb 23 13:34:15 2026 +0000 + + bumped changelog version + +commit ff99577a0aef5b52619fdccc9e933ce8af5aaf2b +Merge: 196ff190 df6ca04d +Author: Patrick Schleizer +Date: Mon Feb 23 06:31:32 2026 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit df6ca04de8c47b83e58f0c35b4736305e41f1645 +Merge: 196ff190 ad1d64fc +Author: Patrick Schleizer +Date: Mon Feb 23 06:30:40 2026 -0500 + + Merge pull request #351 from raja-grewal/cdrom + + Add CD-ROM/DVD hardening settings + +commit ad1d64fc4ffe53ffc0710b5d9654dfff5ff6f617 +Merge: f99e5c48 196ff190 +Author: raja-grewal +Date: Fri Feb 20 11:04:39 2026 +1100 + + Merge branch 'Kicksecure:master' into cdrom + +commit 196ff19056dcaf3bf31174d18be728e4a29159a0 +Merge: 7df34854 c17f2404 +Author: Patrick Schleizer +Date: Thu Feb 19 07:10:42 2026 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit f99e5c48c03b6b7e9e3995e5c61c996a05108e03 +Merge: fe1d9242 c17f2404 +Author: raja-grewal +Date: Wed Feb 18 09:15:23 2026 +1100 + + Merge branch 'Kicksecure:master' into cdrom + +commit c17f2404c4b690ba9315b396408b33c2b8eb449d +Merge: 7df34854 7477128e +Author: Patrick Schleizer +Date: Tue Feb 17 11:03:30 2026 -0500 + + Merge pull request #344 from raja-grewal/docs_update + + Update various docs + +commit fe1d92429d34f66cd9e2cdd085700e6a373bea5f +Author: raja-grewal +Date: Tue Feb 17 07:31:42 2026 +0000 + + sysctl: add cd-rom/dvd hardening settings + +commit 7477128e3e1255156b1e18bb5c049cd74468e9cf +Author: raja-grewal +Date: Mon Feb 16 21:52:39 2026 +0000 + + Simplify links + +commit 32513594d775ecb1817636cccd9b43b5f30d863c +Author: raja-grewal +Date: Mon Feb 16 06:33:58 2026 +0000 + + README: add line + +commit 5a6002d9580373408798511807941ec37ef4aa20 +Author: raja-grewal +Date: Mon Feb 16 04:09:01 2026 +0000 + + Update docs + +commit 369c14ab0231fe605a821d96b3f4ca80fe61854a +Merge: 73d3da10 7df34854 +Author: raja-grewal +Date: Mon Feb 16 14:26:59 2026 +1100 + + Merge branch 'Kicksecure:master' into docs_update + +commit 7df348544fc4bb484d2b955864ff0f598b1aca0b +Author: Patrick Schleizer +Date: Tue Feb 10 12:17:16 2026 +0000 + + bumped changelog version + +commit fb2d44fe2315aa467af733634c5c0bb59a5da65a +Author: Patrick Schleizer +Date: Sun Feb 8 05:14:38 2026 -0500 + + Do not run emerg-shutdown.service in case 'rd.live.ram' or 'rd.live.ram=1' is set. + + https://forums.kicksecure.com/t/how-to-run-iso-live-mode-from-ram/1542/9 + +commit 34440d7cdf662426b147ac8fde65573927b9bfe0 +Author: Patrick Schleizer +Date: Sun Jan 11 16:40:08 2026 +0000 + + bumped changelog version + +commit cbd91974b162cec0144804190f807976ee2788e5 +Author: Patrick Schleizer +Date: Sun Jan 11 10:51:46 2026 -0500 + + typo + +commit a0fd435751e666b72b59afb6658e41ba21e892b4 +Author: Patrick Schleizer +Date: Sun Jan 11 07:09:36 2026 -0500 + + readme + +commit 6c4e7458a10c3a262ecfc0c2f53d1b6181b80ddf +Author: Patrick Schleizer +Date: Mon Jan 5 10:28:53 2026 +0000 + + bumped changelog version + +commit 74533a7efab3f740028d04330752ce18b92dc8fa +Merge: 8a132749 84408cb1 +Author: Patrick Schleizer +Date: Mon Jan 5 03:09:53 2026 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 84408cb1a5228355526815814d2e01ce8d40a175 +Merge: 8a132749 52ef679c +Author: Patrick Schleizer +Date: Mon Jan 5 03:05:02 2026 -0500 + + Merge pull request #345 from Nurmagoz/patch-1 + + debian/control URL fix + +commit 8a132749e0976803173c416cd5f8d4879b7dee3f +Author: Patrick Schleizer +Date: Thu Jan 1 17:28:25 2026 +0000 + + bumped changelog version + +commit e2d31a5b818342037a54e5c3a71ef92df95b9a32 +Author: Patrick Schleizer +Date: Thu Jan 1 12:28:03 2026 -0500 + + genmkfile debinstfile + +commit 6e15c683ab4a682a8ed652559632d7d1e93963c4 +Merge: 97640a9b 436308ae +Author: Patrick Schleizer +Date: Thu Jan 1 12:01:19 2026 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 52ef679c2cd95548e1f0edf48283f0ea5e3a444c +Author: Nurmagoz <11895339+Nurmagoz@users.noreply.github.com> +Date: Wed Dec 31 20:51:34 2025 +0000 + + debian/control URL fix + +commit 436308ae4ec243c80262f3b43dcade0f9ca83859 +Author: Aaron Rainbolt +Date: Mon Dec 29 22:30:00 2025 -0600 + + Minor comment fixes + +commit f8ac896b87e6661704f9b13f775941ea8b4eda06 +Merge: 97640a9b ab98da95 +Author: Aaron Rainbolt +Date: Mon Dec 29 22:23:34 2025 -0600 + + Merge remote-tracking branch 'raja/log_martians' into arraybolt3/trixie-raja-merge + +commit 73d3da104b03c967c56d90d0905336caa802e416 +Author: raja-grewal +Date: Tue Dec 30 03:51:49 2025 +0000 + + Sort file + +commit d0512e4f25ed78d0b27a62e305812dec3e00873a +Author: raja-grewal +Date: Tue Dec 30 03:47:47 2025 +0000 + + Update links to kernel docs + +commit 56df8b624c88b56905d945a0b247714152321c9b +Author: raja-grewal +Date: Mon Dec 29 07:52:15 2025 +0000 + + Re-order boot params as introduced + The ordering was changed due to different merge times. + +commit 8fd95a0b97f339f2609de7e7614fa8a3e86e3157 +Author: raja-grewal +Date: Mon Dec 29 07:44:15 2025 +0000 + + Sort new split package install script for easier readability + +commit e3765131b067083c6a9a7f373cfb154a806e57ad +Author: raja-grewal +Date: Mon Dec 29 07:36:55 2025 +0000 + + Add reference on IOMMU vulnerabilities + +commit 31e268d6246a98d62c23a5bb9e7e4282d0fad282 +Author: raja-grewal +Date: Mon Dec 29 07:34:53 2025 +0000 + + README: typos + +commit cd0a59fd1495db21b8da4b3e8484df61858e7f80 +Author: raja-grewal +Date: Mon Dec 29 07:24:32 2025 +0000 + + Merge Meltdown mitigtions for ARM64 and X86_64 CPUs + +commit 61170e1c6a4869120413cf5236a2d995af26422d +Author: raja-grewal +Date: Mon Dec 29 07:16:54 2025 +0000 + + Reorder panic settings + +commit 6a92e956f3fd41fe416c1e41203687619c7011bc +Author: raja-grewal +Date: Mon Dec 29 07:02:24 2025 +0000 + + Add minor notices to panic on oopses and warnings + +commit 4d49ab56a4be29b03746b99cf6254ef15c93ed74 +Author: raja-grewal +Date: Mon Dec 29 06:52:35 2025 +0000 + + Update docs on `proc_mem.force_override` + +commit 1472d41f030d02aba6576ef481ace35554908e8d +Author: raja-grewal +Date: Mon Dec 29 06:41:33 2025 +0000 + + Add KSPP partial compliance notice for `proc_mem.force_override=ptrace` + +commit 97640a9b5768b7565daf153fbdc9a0655001b790 +Author: Patrick Schleizer +Date: Sun Dec 28 06:36:59 2025 +0000 + + bumped changelog version + +commit c54d6a2258a09867e5b72a8bc1b47df67de6497d +Author: Patrick Schleizer +Date: Sun Dec 28 01:30:43 2025 -0500 + + readme + +commit 7477a6711ad2020fc9a7af19fd98fb88da5b840f +Author: Patrick Schleizer +Date: Sun Dec 28 01:29:26 2025 -0500 + + readme + +commit 885358794f2f4f196e37e6c39b6d95f3b48e325f +Author: Patrick Schleizer +Date: Sun Dec 28 00:55:20 2025 -0500 + + readme + +commit 44837c12bbf63f7e0fd41afad11e19646fd53074 +Author: Patrick Schleizer +Date: Sun Dec 28 00:48:37 2025 -0500 + + genmkfile debinstfile + +commit 7b37965c5c6689533b10e0e592100ee5b94858ee +Merge: d2796afe dddf7979 +Author: Patrick Schleizer +Date: Sun Dec 28 00:47:49 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit dddf79798cb2f2f76bf4432aa90c8a3c61402db1 +Author: Aaron Rainbolt +Date: Sat Dec 27 19:46:55 2025 -0600 + + Document why we disable sudo DNS + +commit 5e45248eb63ecb4b7f924ff9fcba6b40f5bf1244 +Author: Aaron Rainbolt +Date: Sat Dec 27 19:38:19 2025 -0600 + + genmkfile debinstfile + +commit 1b07fd2e73fdfc0d83bd36919080442a14a5ffdf +Author: Aaron Rainbolt +Date: Sat Dec 27 19:38:02 2025 -0600 + + Disable sudo DNS lookups on desktop systems + +commit d2796afe8e4cf5dd55d549adf972e68f86903609 +Author: Patrick Schleizer +Date: Fri Dec 19 11:38:31 2025 +0000 + + bumped changelog version + +commit 68c89cced39a5d2138e22661f4132118628aba64 +Author: Patrick Schleizer +Date: Fri Dec 19 06:30:00 2025 -0500 + + comment + +commit 8aef71c2548807f39a104529e0b6cdf67c201185 +Author: Patrick Schleizer +Date: Fri Dec 19 06:27:14 2025 -0500 + + fix + +commit 55a9755d90d27325010ab19a35b611a9a1df82ae +Author: Patrick Schleizer +Date: Fri Dec 19 06:26:16 2025 -0500 + + refactoring + +commit 6927a5d1adb3dbb96d630e42679c01a6d589232e +Author: Patrick Schleizer +Date: Fri Dec 19 09:56:05 2025 +0000 + + bumped changelog version + +commit 29c12808682fbbd5bd63f1bb821821f5adbfdbc5 +Author: Patrick Schleizer +Date: Fri Dec 19 04:55:41 2025 -0500 + + genmkfile debinstfile + +commit 7ed2d25def0f143dc4cb3695f0e8c5b74682a743 +Merge: b366c5e6 0bf0a73e +Author: Patrick Schleizer +Date: Fri Dec 19 03:42:20 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 0bf0a73eb4683bd7205eaafa692237c57e7d18ae +Author: Aaron Rainbolt +Date: Mon Dec 15 20:18:14 2025 -0600 + + Add a missing quote mark for panic_on_taint + +commit 2106ed5aa651d9910df9965d68cb632808423e77 +Merge: b9d4f0aa 969d4d82 +Author: Aaron Rainbolt +Date: Mon Dec 15 19:41:36 2025 -0600 + + Merge remote-tracking branch 'raja/amd_encrypt_sev' into arraybolt3/trixie-raja-merge + +commit 969d4d82139b1c1793786b7a24c9eee3f4a1101c +Author: raja-grewal +Date: Tue Dec 16 11:49:21 2025 +1100 + + Add references for AMD SME + +commit b9d4f0aaa565ab478a8e0ef4cef27bc49457da42 +Author: Aaron Rainbolt +Date: Sun Dec 14 14:24:33 2025 -0600 + + Add minor clarifications + +commit 005b66c265654514b6450908a75615b71003f372 +Merge: 3f097a35 eaf0f814 +Author: Aaron Rainbolt +Date: Sun Dec 14 14:05:36 2025 -0600 + + Merge remote-tracking branch 'raja/panic_taint' into arraybolt3/trixie-raja-merge + +commit 3f097a35f21582300a87ddf7c70b2698df90e5ff +Author: Aaron Rainbolt +Date: Sun Dec 14 14:03:26 2025 -0600 + + Split up a line in README.md + +commit e7e6d6d3739bebfb8a92f6666e5f2f43ecbc2b52 +Merge: 8e56772c b8f78062 +Author: Aaron Rainbolt +Date: Sun Dec 14 14:01:54 2025 -0600 + + Merge remote-tracking branch 'raja/incomplete_cpu_mitigations' into arraybolt3/trixie-raja-merge + +commit b8f78062673ec3675ff31a0f7d34b853e9f97f04 +Author: raja-grewal +Date: Sun Dec 14 12:38:47 2025 +0000 + + Update usage of `mitigations=auto,nosmt` + +commit eaf0f814bdbe52739d3b3270bb2549bbdc2753f2 +Author: raja-grewal +Date: Sun Dec 14 11:18:08 2025 +0000 + + Update option to `panic_on_taint` + +commit 8e56772c2f0d26b7266403c0dfc5b7ef6d86d1fc +Author: Aaron Rainbolt +Date: Sat Dec 13 19:22:50 2025 -0600 + + README.md typo fix + +commit 4d0a126955e48d790c063b218540a63b514bbd24 +Merge: 39ce5919 8040ba75 +Author: Aaron Rainbolt +Date: Sat Dec 13 18:44:03 2025 -0600 + + Merge remote-tracking branch 'raja/modprobe_refresh' into arraybolt3/trixie-raja-merge + +commit 39ce5919765b7cadac07dfeadb6cbbd29261b81c +Merge: b366c5e6 7d901213 +Author: Aaron Rainbolt +Date: Sat Dec 13 18:27:22 2025 -0600 + + Merge remote-tracking branch 'raja/amd_encrypt_sev' into arraybolt3/trixie-raja-merge + +commit 650b923c7a88820d3a899596e32016e1c3f6cc57 +Author: raja-grewal +Date: Sat Dec 13 04:35:02 2025 +0000 + + Update option to `panic_on_taint` + +commit b366c5e62ad375cef608f5fc435d444de52b056d +Author: Patrick Schleizer +Date: Fri Dec 12 13:17:09 2025 +0000 + + bumped changelog version + +commit 68de32e43e5597c5bda5449cf78eeed94895a63c +Merge: 725565c4 135ee804 +Author: Patrick Schleizer +Date: Fri Dec 12 04:35:53 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 8040ba7579735cafee5fcd9ddf60ca4c88080f70 +Author: raja-grewal +Date: Fri Dec 12 02:04:38 2025 +0000 + + Minor fixes to docs + +commit fe1cfcd1a0f42b4e4938f7b327c33e89936aff76 +Author: raja-grewal +Date: Fri Dec 12 02:03:23 2025 +0000 + + Update docs on CPU MSRs + +commit ab2d44677a3198d6e421bb1c630a18fc4e85065c +Author: raja-grewal +Date: Fri Dec 12 02:01:20 2025 +0000 + + Correct script addition + +commit 5684a12d9db65474392dc9e1ebdc4646e34569eb +Author: raja-grewal +Date: Fri Dec 12 01:59:23 2025 +0000 + + Whitelist `9p` module + +commit 135ee80450c7f7e4c3d71be861fe1b5a6c135d02 +Author: Aaron Rainbolt +Date: Thu Dec 11 18:47:42 2025 -0600 + + Move kernel.panic=-1 setting to sysctl, allow turning panic-on-oops off with systemctl + +commit 7d901213029f17e7d0a4dccc671b3bfd476bab13 +Author: raja-grewal +Date: Thu Dec 11 14:12:18 2025 +0000 + + Add reference for AMD SEV + +commit 72f295a3f04e43307dea9af29657ee96fb1c47a5 +Author: raja-grewal +Date: Thu Dec 11 14:11:47 2025 +0000 + + Provide option to enable AMD SEV-SNP + +commit 6a17255307c1d3b397ad38ab8f3bb8a14a3c5ca5 +Author: raja-grewal +Date: Thu Dec 11 14:11:26 2025 +0000 + + Provide option to enable AMD SEV-ES + +commit 22b1e3dc92c8bffca20f5d70920b6b9be042658e +Merge: 30068ec8 725565c4 +Author: raja-grewal +Date: Thu Dec 11 18:15:35 2025 +1100 + + Merge branch 'master' into panic_taint + +commit 53c4fdbeea0a44ca9e7ab739d80393b9c655482c +Merge: f75e9873 725565c4 +Author: raja-grewal +Date: Thu Dec 11 12:52:14 2025 +1100 + + Merge branch 'Kicksecure:master' into modprobe_refresh + +commit 725565c42e7b3e1bb5036d160cc0388cc001901b +Author: Patrick Schleizer +Date: Tue Dec 9 14:06:55 2025 +0000 + + bumped changelog version + +commit b7b6b6e5fbeba0cfab141bf05d7fb657879ba8e9 +Author: Patrick Schleizer +Date: Mon Dec 8 09:42:59 2025 -0500 + + output + +commit 8f99672cb24242d6cb86d985384ab4ad7d1aca54 +Author: Patrick Schleizer +Date: Fri Dec 5 11:39:12 2025 +0000 + + bumped changelog version + +commit ac128dd873968b1815e4113b30ea69f34fa0b088 +Merge: 17dd7af7 85761a41 +Author: Patrick Schleizer +Date: Fri Dec 5 06:35:03 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 85761a4153a4f19e7b18e91062e97d3376451884 +Author: Aaron Rainbolt +Date: Thu Dec 4 23:27:18 2025 -0600 + + permission-hardener: Fix undo warning logic, minor improvements suggested by ChatGPT Codex + +commit 17dd7af7d1cf37ff30a17e2eaee06732d627ed34 +Author: Patrick Schleizer +Date: Wed Dec 3 08:31:22 2025 +0000 + + bumped changelog version + +commit c44678f92df924e4c10f08960426c526e0292aba +Merge: 6f9732be 0534a34e +Author: Patrick Schleizer +Date: Wed Dec 3 03:22:44 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 0534a34ed7246793db384518cfbecb3adfcb7f3e +Author: Aaron Rainbolt +Date: Tue Dec 2 19:06:30 2025 -0600 + + Fix block-unsafe-logins when running as non-root, add swaylock to list of safe auth services + +commit 6f9732be98cbc344076b89d57491c423368172d5 +Merge: 2089b3a9 b3eb739f +Author: Patrick Schleizer +Date: Tue Dec 2 06:04:07 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit b3eb739fe2662acfbd844de8d87af4720727fc7a +Author: Aaron Rainbolt +Date: Sun Nov 30 00:20:21 2025 -0600 + + Link fix, change some wording + +commit 5f34b4146e895bb935b719071ab2762278944995 +Merge: 2c253b13 29176d2e +Author: Aaron Rainbolt +Date: Sun Nov 30 00:12:18 2025 -0600 + + Merge remote-tracking branch 'raja/docs' into arraybolt3/trixie + +commit 2c253b1312c034cb8395039803380c1157967061 +Merge: 17ab1bb0 c5f91eb3 +Author: Aaron Rainbolt +Date: Sat Nov 29 21:01:51 2025 -0600 + + Merge remote-tracking branch 'raja/vsyscall32' into arraybolt3/trixie + +commit 17ab1bb00fe287c4c941d9cd3813ee3a3ae89ade +Author: Aaron Rainbolt +Date: Sat Nov 29 20:44:30 2025 -0600 + + Documentation fix + +commit 2b2d30afce3d40eb9c2177ad67fd7d89cd4602a0 +Merge: f0d069c7 3fdfebc4 +Author: Aaron Rainbolt +Date: Sat Nov 29 20:23:09 2025 -0600 + + Merge remote-tracking branch 'raja/limit_full_force' into arraybolt3/trixie + +commit f0d069c7968e2ee10d7104ce1ba502d3122b0ab2 +Author: Aaron Rainbolt +Date: Sat Nov 29 20:15:03 2025 -0600 + + Minor README.md corrections + +commit b73a830b0f62fe43b38cc89d56d997bed355570c +Merge: e54cb007 53d90b11 +Author: Aaron Rainbolt +Date: Sat Nov 29 19:59:35 2025 -0600 + + Merge remote-tracking branch 'raja/kpti' into arraybolt3/trixie + +commit e54cb007f9fc351c25c292ffd68abe974be56bb0 +Merge: 84e193c4 e43d4d7f +Author: Aaron Rainbolt +Date: Sat Nov 29 19:54:10 2025 -0600 + + Merge remote-tracking branch 'raja/limit_bdev_writes' into arraybolt3/trixie + +commit 84e193c44ec9ebf676d1fb4a32d6e2f68afd3d0d +Merge: 65c45fc3 5ac02d2d +Author: Aaron Rainbolt +Date: Fri Nov 28 14:21:59 2025 -0600 + + Merge remote-tracking branch 'raja/stop_tw_reuse' into arraybolt3/trixie + +commit 65c45fc3d799cdf6402328cc61cbdd1949a12945 +Author: Aaron Rainbolt +Date: Fri Nov 28 00:13:45 2025 -0600 + + Minor fixes to NMI panic docs + +commit 37b1d055f18c6335e96c41c06174b66e43e4a8ff +Merge: 7280d886 ebc011e6 +Author: Aaron Rainbolt +Date: Fri Nov 28 00:09:43 2025 -0600 + + Merge remote-tracking branch 'raja/panic_nmi' into arraybolt3/trixie + +commit 7280d8867da50e05dd7d3071123d49b15660051d +Merge: 2089b3a9 62dc2d44 +Author: Aaron Rainbolt +Date: Thu Nov 27 23:28:53 2025 -0600 + + Merge remote-tracking branch 'raja/amd_encrypt_ram' into arraybolt3/trixie + +commit 2089b3a9b8e9d10c06850f0329f7e2eb8a8a12cc +Author: Patrick Schleizer +Date: Mon Nov 24 08:44:10 2025 +0000 + + bumped changelog version + +commit cbd35502f19e74b6f95ff40bf03f02806eef3cdc +Author: Patrick Schleizer +Date: Mon Nov 24 03:18:25 2025 -0500 + + comment + +commit cac73c3154b3278ad71edc0fd159afc71d5dbc45 +Author: Patrick Schleizer +Date: Mon Nov 24 03:17:38 2025 -0500 + + minor + +commit d68988e76cda939ce200d970e19310cadba5d08e +Author: Patrick Schleizer +Date: Mon Nov 24 03:17:25 2025 -0500 + + comments + +commit c1ca36d75888b95835b953c3a8a122954c1e5929 +Merge: ec116795 a3417e99 +Author: Patrick Schleizer +Date: Mon Nov 24 03:11:19 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit a3417e997d26e9a88d30da408d470fab98f58d79 +Author: Aaron Rainbolt +Date: Sun Nov 23 16:27:59 2025 -0600 + + Add pkexec remembered permissions fix for permission-hardener, fix some postinst bugs + +commit edda37809fb186f6d85511e774957b701483ca66 +Author: Aaron Rainbolt +Date: Sun Nov 23 14:54:02 2025 -0600 + + Remove obsolete migration code for permission-hardener, add initial permission-hardener state installation code + +commit ec11679514d54c9a61e7c4e35ce81467b12333f4 +Author: Patrick Schleizer +Date: Sun Nov 23 10:26:13 2025 +0000 + + bumped changelog version + +commit 5c4d3162ab3c5178502c1f48e6288dc86cc45bb1 +Author: Patrick Schleizer +Date: Sun Nov 23 05:25:13 2025 -0500 + + fix + +commit 30068ec8cdaa7a6778f0ba0b423f7ab3c3391759 +Author: raja-grewal +Date: Sat Nov 22 15:01:47 2025 +1100 + + Correct bitmask + +commit f75e9873375d187fbbe4b5bfd135d0cd26a93fe6 +Author: raja-grewal +Date: Fri Nov 21 13:06:42 2025 +0000 + + Relabel some disabled module headings + +commit 79be87ec5f2cb22a98ada179b3aa97dfd58299e0 +Author: raja-grewal +Date: Fri Nov 21 13:05:13 2025 +0000 + + Move (optional) CPU MSR module disable list + +commit 1a7b0a9122cc6b6e755a540dd62fd018a1a7536d +Author: raja-grewal +Date: Fri Nov 21 12:43:05 2025 +0000 + + Disable more file systems + +commit 1865cafe446c6a525bc63caa7ce1097ce573b877 +Author: raja-grewal +Date: Fri Nov 21 12:42:10 2025 +0000 + + Move joydev from blacklist to disable + +commit 28476d3d53a0e4796b4396a925c44ccf32f4fe90 +Author: raja-grewal +Date: Fri Nov 21 12:40:12 2025 +0000 + + Update docs on GrapheneOS blacklisted modules + +commit 446d3771bf8c42aba61d248bccfe9fad4eacc88d +Author: raja-grewal +Date: Fri Nov 21 12:38:44 2025 +0000 + + Update docs on CD-ROM/DVD blacklisting + +commit 3646a2fefeaa774aea068d7c6e761c5b76479f55 +Author: raja-grewal +Date: Fri Nov 21 12:37:57 2025 +0000 + + Move superseded brcm80211 to disabled + Split and replaced by brcmsmac and brcmfmac in kernel 2.6.39 + +commit 66ba273d448ff92c249abe9dd0f83a64cc1ee823 +Author: raja-grewal +Date: Fri Nov 21 12:36:57 2025 +0000 + + Add CPU MSR modules + +commit e6aa648d54f076c5c75d45bcd7658d502b701982 +Author: raja-grewal +Date: Fri Nov 21 12:36:32 2025 +0000 + + Update docs on CPU MSR disabling + +commit 59869979bbc2fb16da6b3435276e4930b4088f59 +Author: raja-grewal +Date: Fri Nov 21 12:35:51 2025 +0000 + + Update docs on Vivid disabling + +commit 4597fd16a9b94ebd6b4fae152a64288b665d9c36 +Author: raja-grewal +Date: Fri Nov 21 12:35:03 2025 +0000 + + Sort RDNIS disabling and add docs + +commit 5adc007536578c1e70a8cc6784fbced2033b7a5c +Author: raja-grewal +Date: Fri Nov 21 12:33:15 2025 +0000 + + Update docs on Intel PMT disabling + +commit 31e3aa0c3add48ad26e43e4b83358571843f28de +Author: raja-grewal +Date: Fri Nov 21 12:32:30 2025 +0000 + + Update docs on Bluetooth disabling + +commit 9f85a78c9919d71c3e92099cac8525ac385aea5c +Author: Patrick Schleizer +Date: Wed Nov 19 07:02:14 2025 +0000 + + bumped changelog version + +commit 4e7cfb0d061810ec7c3139379a65db83abc39efc +Merge: d267cf67 936c799c +Author: Patrick Schleizer +Date: Wed Nov 19 01:55:10 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 936c799cb5f48376fa259bb3b92b653526a00509 +Author: Aaron Rainbolt +Date: Tue Nov 18 23:53:03 2025 -0600 + + Don't break passwordless sudo in unrestricted admin mode + +commit 68025d3624e7543deec2fbe43ea0f010344e4160 +Author: raja-grewal +Date: Wed Nov 19 01:16:46 2025 +0000 + + Provide option to `panic_on_taint` + +commit ebc011e67bff659778cbca2240c5e57d663f3f41 +Author: raja-grewal +Date: Wed Nov 19 11:35:04 2025 +1100 + + Typo + +commit 62dc2d448366d190812773ec9eeadd38e1223cbc +Author: raja-grewal +Date: Tue Nov 18 20:31:46 2025 +1100 + + Add note about Intel TME + +commit 29176d2ed29b07c4da9b9c0df1eefd2bda70b984 +Author: raja-grewal +Date: Sat Nov 15 06:30:11 2025 +0000 + + Remove the option to reduce the MCE tolerance level + +commit 9f897c5ccda781d010077446abb3d176cf929c94 +Author: raja-grewal +Date: Sat Nov 15 05:48:33 2025 +0000 + + Update docs on reducing the MCE tolerance level + +commit b6fe1a5a6e164c7a7505b5e27ece582a1b928d82 +Author: raja-grewal +Date: Sat Nov 15 04:51:01 2025 +0000 + + Make panic related settings consistent + Ensures the `sysctl` and boot parameters are equivalent in settings and in description. This should prevent future questions regarding having omitted boot parameters that were actually redundant. + +commit 99e993b885ca1fa30a871120b545f9334371cd5a +Author: raja-grewal +Date: Sat Nov 15 03:16:07 2025 +0000 + + Provide options to enable AMD SME and SEV + +commit d267cf6761076092c299508a0c356c05d0ee713d +Author: Patrick Schleizer +Date: Fri Nov 14 06:21:34 2025 +0000 + + bumped changelog version + +commit efa06a1eae52b15978eb84f6ab4153ae88eb8d6a +Author: Patrick Schleizer +Date: Fri Nov 14 00:44:50 2025 -0500 + + port to package-installed-check + +commit abf5852ebabec81d553a60139fe5a15972d14ab5 +Author: Patrick Schleizer +Date: Wed Nov 12 06:13:05 2025 +0000 + + bumped changelog version + +commit 3af891645503c62ff5510b78e5cbe73774ad72a2 +Merge: fb587f78 3070aa5d +Author: Patrick Schleizer +Date: Tue Nov 11 23:59:50 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit d891313d57b469c28c08993b05d355b29ea08397 +Author: raja-grewal +Date: Tue Nov 11 11:39:21 2025 +0000 + + Provide options to panic upon receiving NMIs + +commit 0b9b9ffb1e87850e3296d0420c305062b66868d5 +Author: raja-grewal +Date: Tue Nov 11 11:32:47 2025 +0000 + + Improve clarity for panic on OOM + +commit 3070aa5d1f988b199030b31baa2fabc2db7b289f +Author: Aaron Rainbolt +Date: Mon Nov 10 22:40:15 2025 -0600 + + Fix passwordless login for sensitive accounts, only deny passwordless privilege escalation + +commit ab98da957c732340ddb7bb43ed445835220c21d1 +Author: raja-grewal +Date: Tue Nov 11 04:28:56 2025 +0000 + + Re-set `net.ipv4.conf.*.log_martians=1` + +commit fb587f78fd11e471b3169f8c67c1772c1ba3729d +Author: Patrick Schleizer +Date: Mon Nov 10 08:00:06 2025 +0000 + + bumped changelog version + +commit fc1b865dd7a7663cbea8948c06ce45e69269a3b1 +Author: Patrick Schleizer +Date: Mon Nov 10 02:21:27 2025 -0500 + + debugging + +commit 45126cede6563a3bfe9c700543fdec09442f1cb3 +Author: Patrick Schleizer +Date: Mon Nov 10 02:19:29 2025 -0500 + + end-of-options + +commit 61637a5ff06b69210f293bed91735a2bf80e8946 +Author: Patrick Schleizer +Date: Mon Nov 10 02:15:30 2025 -0500 + + refactoring + +commit ddb59a3b01444762c7a9da68d2cc34d98f3d8f96 +Author: Patrick Schleizer +Date: Mon Nov 10 02:13:48 2025 -0500 + + comment + +commit ae1e2e3b52ea4c18ed1d4bb2e7cf3c2adf06711c +Author: Patrick Schleizer +Date: Mon Nov 10 02:10:25 2025 -0500 + + output + +commit f2b765854203cfb5be15ad63a260fec860ed0620 +Author: Patrick Schleizer +Date: Mon Nov 10 02:09:54 2025 -0500 + + use long option names + +commit 71ca68bd4aab5adad9a8c1dd20df4dc6990885e7 +Author: Patrick Schleizer +Date: Mon Nov 10 02:09:00 2025 -0500 + + end-of-options + +commit e9e6c12b03fd6f440232221cdf7f34e9bc7661a2 +Author: Patrick Schleizer +Date: Mon Nov 10 02:08:04 2025 -0500 + + output + +commit f5db916bf728f8d09ee48cec5cb0a0a3ee520e33 +Author: Patrick Schleizer +Date: Mon Nov 10 02:06:55 2025 -0500 + + fix + +commit bb0a23fcc80b7963e0fc80f6e7da6931aa88c300 +Author: Patrick Schleizer +Date: Mon Nov 10 02:05:47 2025 -0500 + + chmod +x + +commit 39a6ce002e9ff696104906be252afffce70dd959 +Author: Patrick Schleizer +Date: Mon Nov 10 02:05:03 2025 -0500 + + genmkfile debinstfile + +commit 94de949a4797be1706378a10324ec9c2522834a7 +Merge: 0939883f 5fbd42bb +Author: Patrick Schleizer +Date: Mon Nov 10 02:04:15 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 5ac02d2d528a37fe1c162c4808b3d874a8c53159 +Author: raja-grewal +Date: Mon Nov 10 06:13:35 2025 +0000 + + Set `net.ipv4.tcp_tw_reuse=0` + +commit b89aaea61e83aea6b23ea34a01dbb1e6bce1e2df +Author: raja-grewal +Date: Mon Nov 10 06:03:33 2025 +0000 + + Add docs on logging martian packets + +commit 5fbd42bbec55d66197b70789b10f7cb6705207fb +Author: Aaron Rainbolt +Date: Sun Nov 9 18:38:54 2025 -0600 + + Add kill-vboxdrmclient-on-shutdown.service + +commit 9d86379f5624a6c2b20645c34e1621977c1d4db9 +Author: Aaron Rainbolt +Date: Sun Nov 9 17:46:22 2025 -0600 + + Prevent non-sysmaint logins in sysmaint mode and unsafe passwordless logins in user mode + +commit a3830db09e3f567237caefb687ef2da877573b03 +Author: raja-grewal +Date: Sun Nov 9 13:42:31 2025 +0000 + + Update docs relating to panic on OOM + +commit 0aa0b67df6a33b84a656cfb7055c4af5ca583439 +Merge: a46f678c 0939883f +Author: raja-grewal +Date: Mon Nov 10 00:20:48 2025 +1100 + + Merge branch 'master' into docs + +commit 0939883f0b5e1232e9aa85e61c0cbef551a59357 +Author: Patrick Schleizer +Date: Sun Nov 9 10:47:45 2025 +0000 + + bumped changelog version + +commit 039141188558931b73a9b5897ea3422bbb201dad +Author: Patrick Schleizer +Date: Sun Nov 9 05:47:00 2025 -0500 + + revert Force immediate kernel panic on OOM. + + https://github.com/Kicksecure/security-misc/issues/324#issuecomment-3507949741 + +commit 26b96ce2800e794104e6d3c113c3c2c121795b39 +Author: Patrick Schleizer +Date: Sun Nov 9 08:12:42 2025 +0000 + + bumped changelog version + +commit 1ef974300a157235da6a6c4d1379b62acf0c4c61 +Author: Patrick Schleizer +Date: Sat Nov 8 04:00:47 2025 -0500 + + readme + +commit 48ce12eba38aec099b4afe42e4d42b1d41dcb97f +Author: Patrick Schleizer +Date: Sat Nov 8 07:44:43 2025 +0000 + + bumped changelog version + +commit 69419357e1bb2d0842ecd5db3e42bcaa011f5c11 +Author: Patrick Schleizer +Date: Sat Nov 8 02:42:25 2025 -0500 + + genmkfile debinstfile + +commit d50e6afc8fb0a925e07fc54b7ecc1f450d9aa176 +Author: Patrick Schleizer +Date: Sat Nov 8 01:34:32 2025 -0500 + + sanity test + +commit 12679608428e6927da480ca721b34bab75108687 +Author: Patrick Schleizer +Date: Sat Nov 8 01:32:45 2025 -0500 + + comments + +commit 1e48886c7e77fa7bccfdee3cca6f0fbdba74e4a1 +Author: Patrick Schleizer +Date: Sat Nov 8 01:31:02 2025 -0500 + + long option name + +commit d6c949c791bcc2c76b4f2e81eb0ffd370f8f1a37 +Merge: 5b97e7bd fa32ba6c +Author: Patrick Schleizer +Date: Sat Nov 8 01:29:48 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit fa32ba6c4fccf35111f85ec3819e718963359d7c +Author: Aaron Rainbolt +Date: Fri Nov 7 17:09:22 2025 -0600 + + Suppress usbguard startup unless a USB controller is visible to lspci + +commit 635c216d4e55eb0c6463c543202aea629c572f5e +Author: raja-grewal +Date: Wed Nov 5 01:44:36 2025 +0000 + + Update docs on CPU mitigations + +commit a46f678c7f8715fd1cedd1102f9815b9d845ccb3 +Author: raja-grewal +Date: Wed Nov 5 00:05:17 2025 +0000 + + Update docs on latent entropy + +commit 37b493826ec60397c6019959abb7e0631dd33ed4 +Author: raja-grewal +Date: Wed Nov 5 00:03:54 2025 +0000 + + Spit distrusting entropy settings for clarity + +commit 019a0cf72c99f9f10fd42afbfed96c283e17e458 +Author: raja-grewal +Date: Wed Nov 5 00:03:19 2025 +0000 + + Update docs on entropy + +commit 4c88b911415cbf57eecc93a22c6674322662db50 +Merge: d175d1be 5b97e7bd +Author: raja-grewal +Date: Wed Nov 5 10:10:10 2025 +1100 + + Merge branch 'Kicksecure:master' into docs + +commit e43d4d7f7110de0b23996373e9462aa900b314a6 +Author: raja-grewal +Date: Mon Nov 3 05:46:07 2025 +0000 + + Set `bdev_allow_write_mounted=0` + +commit 53d90b1128d55e352b3eef8ae680a07a825b1ecf +Author: raja-grewal +Date: Mon Nov 3 04:32:49 2025 +0000 + + Update docs on `ssbd=force-on` + +commit 322584db3346aaa1e3d1f9782b3d22ca2153c7da +Author: raja-grewal +Date: Mon Nov 3 04:31:59 2025 +0000 + + Update docs on `pti=on` + +commit 5e87c9bea49b5a06c1400cb8b632f344cccb6db6 +Author: raja-grewal +Date: Mon Nov 3 04:30:58 2025 +0000 + + Set `kpti=1` + +commit 3fdfebc4646d7c1f48806d02810de44fd53482bb +Author: raja-grewal +Date: Mon Nov 3 00:48:49 2025 +0000 + + Set `proc_mem.force_override=ptrace` + +commit 5b97e7bd277038b3b04c80a78ce05bb52277d4f6 +Author: Patrick Schleizer +Date: Sun Nov 2 11:41:51 2025 +0000 + + bumped changelog version + +commit 58d5f738e63d4c18048fab4e2fd134d68722d0fd +Merge: 5121f80f 7beb19b6 +Author: Patrick Schleizer +Date: Sun Nov 2 06:08:46 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 5121f80f28d374d78bb3897a46fe924d750f4643 +Author: Patrick Schleizer +Date: Sun Nov 2 06:00:24 2025 -0500 + + comment + +commit 29685938bdfd5c14828091342dbe21283ed45fd1 +Author: Patrick Schleizer +Date: Sun Nov 2 05:57:52 2025 -0500 + + move usbguard reject rules to the top + +commit c5f91eb33a2ad745af7a6278cf49419d0b366343 +Author: raja-grewal +Date: Sun Nov 2 06:15:06 2025 +0000 + + Add another method to disable 32-bit legacy vsyscalls + +commit d175d1be525edd8fb6140680c31425c8a89cc244 +Author: raja-grewal +Date: Sun Nov 2 15:54:34 2025 +1100 + + Add doc on entropy related failure on AMD Zen 5 CPUs + +commit 7beb19b64a33cb86771488ab558756fa86b577d3 +Author: Aaron Rainbolt +Date: Sat Nov 1 22:06:44 2025 -0500 + + Update README.md with info about flatpak auth hardening + +commit 5a6730450af6e3d1ab76d6e26d4fb1d7175be946 +Author: Patrick Schleizer +Date: Sat Nov 1 10:13:50 2025 +0000 + + bumped changelog version + +commit 7de05e88f57a343ac358ddbd6a8b3a5f0aa68a51 +Author: Patrick Schleizer +Date: Sat Nov 1 06:13:37 2025 -0400 + + fix + +commit fe8b7fda3d16195b7a7e7a6218e2bc12d808bcb8 +Author: Patrick Schleizer +Date: Sat Nov 1 06:08:20 2025 -0400 + + chmod +x + +commit ad0053d93797aaba2f242f8e7c142eee064c1bca +Author: Patrick Schleizer +Date: Sat Nov 1 09:41:23 2025 +0000 + + bumped changelog version + +commit 94918eeefbf962dbd66cbb052f2304496b1e2814 +Author: Patrick Schleizer +Date: Sat Nov 1 05:24:31 2025 -0400 + + lintian + +commit 6cc5eebe22d9af3591a0bd32e3ca7e9c0849fc44 +Author: Patrick Schleizer +Date: Sat Nov 1 09:18:12 2025 +0000 + + bumped changelog version + +commit 81a279ee1f23706c2309c02da536b68f00e3eff3 +Author: Patrick Schleizer +Date: Sat Nov 1 05:10:05 2025 -0400 + + genmkfile debinstfile + +commit e24eee361d1f810b2ba23b257903fe2824e7d703 +Author: Patrick Schleizer +Date: Sat Nov 1 04:10:17 2025 -0400 + + remove unicode + +commit 53d380989185b5040f94dbb628e2bae5556ed0e1 +Merge: dcccad92 8b766fc3 +Author: Patrick Schleizer +Date: Sat Nov 1 04:02:46 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit dcccad926679c10355aac53326f8fd1b79c735b7 +Author: Patrick Schleizer +Date: Sat Nov 1 03:58:33 2025 -0400 + + no longer depend on sudo + +commit cfaa953373f3bf8de1b51be723f210069655eb74 +Author: Patrick Schleizer +Date: Sat Nov 1 03:42:33 2025 -0400 + + output + +commit 8b766fc3ad6b0c9675670f38e886beb6b769494b +Author: Aaron Rainbolt +Date: Fri Oct 31 15:23:12 2025 -0500 + + Lock down flatpak software management + +commit 948c96afe93bcc87cea203dd7b45a741d46543d1 +Author: Patrick Schleizer +Date: Fri Oct 31 14:38:30 2025 +0000 + + bumped changelog version + +commit aae472d9cfb2f42a861af8a886c28acd640da545 +Author: Patrick Schleizer +Date: Fri Oct 31 10:24:31 2025 -0400 + + Revert "Move apparmor-info, apparmor-watch to security-misc, enable systemd-journald audit transport" + + This reverts commit d1e148eba72ff5a095e31842a70afec7f28c8724. + +commit 3b2092ee764fe3ab8d72b912f0dcc4726ba76f4e +Merge: b168c37e d1e148eb +Author: Patrick Schleizer +Date: Fri Oct 31 10:19:08 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit d1e148eba72ff5a095e31842a70afec7f28c8724 +Author: Aaron Rainbolt +Date: Thu Oct 30 23:05:19 2025 -0500 + + Move apparmor-info, apparmor-watch to security-misc, enable systemd-journald audit transport + +commit b168c37e841d971743a8f2fe2d64ab4187e4029b +Author: Patrick Schleizer +Date: Mon Oct 27 11:48:10 2025 +0000 + + bumped changelog version + +commit c9d48ef7fdd2b691a7abd880d5e695c6296332b6 +Author: Patrick Schleizer +Date: Mon Oct 27 07:07:25 2025 -0400 + + readme + +commit 2dda826e02a10a9cebabe3896fc4c850221cc423 +Author: Patrick Schleizer +Date: Sun Oct 26 12:30:29 2025 +0000 + + bumped changelog version + +commit cb70f198375c5b68058a3705258e78464786922b +Author: Patrick Schleizer +Date: Sun Oct 26 08:06:26 2025 -0400 + + more robust, standardized kernel_cmdline variable detection + +commit 53db63196432e3fdf8fc031f0e78b4666b0f1514 +Author: Patrick Schleizer +Date: Thu Oct 23 06:03:26 2025 +0000 + + bumped changelog version + +commit f2b33b1ad54ac94aca200c001311e0794634e6f9 +Author: Patrick Schleizer +Date: Thu Oct 23 01:08:38 2025 -0400 + + update + +commit 1f093f817527d168ede3a682651088a051f40cb9 +Author: Patrick Schleizer +Date: Wed Oct 22 00:37:36 2025 -0400 + + do not start usbguard-notifier if /sys/bus/usb does not exist + +commit 8f78269949217ac11163cc8b6f17147621fef6eb +Author: raja-grewal +Date: Mon Oct 20 05:36:54 2025 +0000 + + Add docs on slab_debug + +commit 7969ffd4a52786f4a92f74931fff85430906a629 +Author: Patrick Schleizer +Date: Sun Oct 19 08:43:36 2025 +0000 + + bumped changelog version + +commit f555c48c51dab3eefc99085eace277f15ef72c33 +Author: Patrick Schleizer +Date: Sun Oct 19 04:42:24 2025 -0400 + + fix USBGuard-notifier `accept` / `reject` buttons + + https://forums.kicksecure.com/t/usbguard-what-should-we-allow-or-disallow-by-default/1248/49 + +commit 9f7480e20adf148dcb7dbe80e704f3f79691b657 +Author: raja-grewal +Date: Sun Oct 19 01:41:58 2025 +0000 + + Make terminology consistent + +commit f2c3eba4f06c38fda7843427c352022a0f869f66 +Merge: 11d9b940 929421bd +Author: raja-grewal +Date: Sun Oct 19 12:23:13 2025 +1100 + + Merge branch 'Kicksecure:master' into docs + +commit 929421bd258a3c0c1f142f707aeff479f2ea3c49 +Author: Patrick Schleizer +Date: Sat Oct 18 09:19:07 2025 +0000 + + bumped changelog version + +commit f5b7aab87ec6640eb1969bb4be05bb5b0ff04a3c +Author: Patrick Schleizer +Date: Sat Oct 18 05:18:55 2025 -0400 + + update + +commit 806eec423a7a6acb0d5eabc5872c9a5d121a4dc3 +Merge: 6cc1c27f 70fbbc23 +Author: Patrick Schleizer +Date: Sat Oct 18 04:44:41 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 70fbbc230c0c5366b7a09d531012d18b1e88e07b +Author: Aaron Rainbolt +Date: Fri Oct 17 15:49:42 2025 -0500 + + Set USBGuard settings to permit USB hubs and Qubes USB passthrough + +commit 11d9b9403854ae7cd2638765e8350257580be35f +Author: raja-grewal +Date: Fri Oct 17 01:01:28 2025 +0000 + + Add docs on entropy + +commit 708e1358dfbc21444f2bf39dfa81ea5053f2bb10 +Author: raja-grewal +Date: Fri Oct 17 00:48:57 2025 +0000 + + Add docs relating `extra_latent_entropy` + +commit 3d5e659b78cf2588f95280c13b1ebdf24060fb6f +Author: Aaron Rainbolt +Date: Wed Oct 15 19:02:48 2025 -0500 + + Remove trailing spaces + +commit 29639fe69e12ff71ec422a0137b5dbaade9179c3 +Merge: 026d55ac 0c8f2f1b +Author: Aaron Rainbolt +Date: Wed Oct 15 19:01:08 2025 -0500 + + Merge remote-tracking branch 'raja/bad_ipv6_ra' into arraybolt3/trixie + +commit 026d55ac410bf747db03c0cf9475b3408bce7f8e +Author: Aaron Rainbolt +Date: Wed Oct 15 18:30:52 2025 -0500 + + Typo fixes + +commit 35fce26476b20eda81544f583bd2b2124b8e96b0 +Merge: 4f63af42 23041741 +Author: Aaron Rainbolt +Date: Wed Oct 15 18:18:33 2025 -0500 + + Merge remote-tracking branch 'raja/stop_ptrace' into arraybolt3/trixie + +commit 4f63af4200de23e2216be6d3e7f1055af02dbc3b +Author: Aaron Rainbolt +Date: Wed Oct 15 17:53:26 2025 -0500 + + Allow listing USB devices via usbguard + +commit f690b58870bd90582018cec51046f4ed67a414d4 +Author: raja-grewal +Date: Mon Oct 13 02:08:44 2025 +0000 + + Add docs relating to panic on OOM + +commit 9db63d97770e62749c0b602dd9e7d2d4d6a1128b +Author: raja-grewal +Date: Mon Oct 13 01:01:14 2025 +0000 + + README: Update KSSP compliance status + +commit 23041741715cc5f3d16378d6bb34719ceaa1642c +Author: raja-grewal +Date: Sun Oct 12 02:32:45 2025 +0000 + + Insert empty new line + +commit 7161430a6000c4ff5e15a9a8c9519529655a1444 +Author: raja-grewal +Date: Sun Oct 12 02:27:48 2025 +0000 + + Seperate `ptrace()` disabling into own file + +commit 6cc1c27fb376d02adc6c5cddf64b030e2e694711 +Author: Patrick Schleizer +Date: Fri Oct 10 12:08:28 2025 +0000 + + bumped changelog version + +commit 4d9c3dc357ae92b735cf96f121491f7eed1be9f5 +Author: Patrick Schleizer +Date: Fri Oct 10 08:08:10 2025 -0400 + + minor + +commit 968de33c659f971fc62b2a6a63cceb7462c3d0f8 +Author: Patrick Schleizer +Date: Fri Oct 10 08:03:03 2025 -0400 + + Force immediate kernel panic on OOM. + This is to avoid security features such as the screen locker, kloak, emerg-shutdown + from being arbitrarily terminated when the system starts running out of memory. + + https://forums.whonix.org/t/screen-locker-in-security-can-we-disable-these-at-least-4-backdoors/8128/14 + + https://github.com/Kicksecure/security-misc/issues/324 + + `vm.panic_on_oom=2` + + implements https://github.com/Kicksecure/security-misc/issues/324 + +commit 98f27c3b2e1420f6d29cabe7d0c60a92989d06e1 +Author: Patrick Schleizer +Date: Fri Oct 10 06:53:04 2025 -0400 + + comment + +commit 28a88c70914ac2ce8c4cfc5b9ed558e026a6d7a9 +Author: Patrick Schleizer +Date: Fri Oct 10 06:52:13 2025 -0400 + + comment + +commit f4a87e77488c9034611c750d018603326cb42067 +Merge: 685070bd 6cf8a623 +Author: Patrick Schleizer +Date: Fri Oct 10 06:51:31 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 6cf8a623feda09abc72a19b3e4c74c3f37b64d26 +Merge: 685070bd e89c7ae0 +Author: Patrick Schleizer +Date: Fri Oct 10 06:50:46 2025 -0400 + + Merge pull request #325 from raja-grewal/hash_pointers + + Docs detailing future improvements to `slab_debug` + +commit e89c7ae0254d41ac1696e23f8b2d4a425413d888 +Author: raja-grewal +Date: Wed Oct 8 02:39:20 2025 +0000 + + Update docs on `slab_debug` for future improvements + +commit 685070bd026e52f007e27428e5479e2f1c2413fe +Author: Patrick Schleizer +Date: Tue Oct 7 08:40:32 2025 +0000 + + bumped changelog version + +commit ba6ec919f0804bf8bbfaf057c86a067683cbb826 +Merge: dd961b84 718772ea +Author: Patrick Schleizer +Date: Tue Oct 7 04:34:51 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 718772ea7824cd879d36e5eeff8270457df9ad33 +Author: Aaron Rainbolt +Date: Mon Oct 6 15:03:31 2025 -0500 + + Remove unsafe sanitizer compiler flags from emerg-shutdown + +commit 0c8f2f1b44049b676251775d64e23651e9225d00 +Author: raja-grewal +Date: Thu Oct 2 07:05:00 2025 +0000 + + Add docs about the risks associated with IPv6 RAs + +commit 4340bf50b7bf9112703d78fae4e8ca4f5e458ab6 +Author: raja-grewal +Date: Mon Sep 29 15:46:06 2025 +1000 + + Warnings about using `mitigations=auto,nosmt` + +commit dd961b84272247f4e8f01d3042d8ca256ccf50d2 +Author: Patrick Schleizer +Date: Sun Sep 28 21:09:46 2025 +0000 + + bumped changelog version + +commit e6ba4dad46ba2e451fd586357913b68ad25d6004 +Merge: 22c98634 60f8153f +Author: Patrick Schleizer +Date: Sun Sep 28 17:00:24 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 60f8153f64667718edbf9c048d5fa1d3c2ca1980 +Author: Aaron Rainbolt +Date: Sun Sep 28 15:05:21 2025 -0500 + + Fix emerg-shutdown gcc build, remove AddressSanitizer from hardening options since it is incompatible with static builds + +commit 7e016b563239e31c650aece115bb19af0395ec52 +Author: Aaron Rainbolt +Date: Sun Sep 28 14:11:10 2025 -0500 + + Allow users in the qubes group to access USBGuard IPC + +commit 194b8fce4e5a8e9c642171853d7b0491debced55 +Author: raja-grewal +Date: Sun Sep 28 03:20:24 2025 +0000 + + Disable the usage of `ptrace()` by all processes + +commit 22c9863493b326d8ec730ecdf721593b836baf99 +Author: Patrick Schleizer +Date: Fri Sep 26 08:40:20 2025 +0000 + + bumped changelog version + +commit 08199dfe9471c5bff1af3e5f065810c47cfa7a12 +Merge: 590aaec7 58cc6731 +Author: Patrick Schleizer +Date: Fri Sep 26 04:31:02 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 58cc6731f27446c3bfbd5df1e669b625af922efe +Author: Aaron Rainbolt +Date: Thu Sep 25 23:55:03 2025 -0500 + + Additional hardening on emerg-shutdown + +commit 78492e0e5656990ecec7ad2641d5f7e46a264aab +Author: raja-grewal +Date: Thu Sep 25 15:35:34 2025 +1000 + + README: Do not rely on `mitigations=auto` + +commit b9deefed61b40127bbb7aaad8dd83f256b68f896 +Author: raja-grewal +Date: Thu Sep 25 15:34:54 2025 +1000 + + Incompleteness of `mitigations=auto,nosmt` + +commit 590aaec73d389ecfa2610cbf7931a2e380af3e8d +Author: Patrick Schleizer +Date: Wed Sep 24 14:32:35 2025 +0000 + + bumped changelog version + +commit 253688039447d69eb6eaf2d8d2e1c6ed04e2f839 +Merge: 275eecc4 17ee63ac +Author: Patrick Schleizer +Date: Wed Sep 24 10:32:12 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 17ee63aca445d0e41af05eb9807849fc3c0f62d3 +Merge: 275eecc4 d31f63fb +Author: Patrick Schleizer +Date: Wed Sep 24 10:31:31 2025 -0400 + + Merge pull request #319 from raja-grewal/release_notice + + Notice on public releases + +commit d31f63fb1052adb186c323349aa4e36fb6fc8551 +Author: raja-grewal +Date: Tue Sep 23 05:47:45 2025 +0000 + + README: Notice on public releases + +commit 275eecc4f8100fe62e64a382c0ba5e8503ad0482 +Author: Patrick Schleizer +Date: Mon Sep 22 17:25:48 2025 +0000 + + bumped changelog version + +commit c45a4ffdd221964cee5ee5e5b70a0e4ba02eec11 +Merge: 5738bb61 2a39d599 +Author: Patrick Schleizer +Date: Mon Sep 22 13:04:33 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 2a39d5997c410da2cf314f82826d1281879f8a6c +Author: Aaron Rainbolt +Date: Sun Sep 21 16:06:11 2025 -0500 + + security-misc split string changes + +commit 5738bb61045fb00d570c61cefd4c80fbc31d92e3 +Author: Patrick Schleizer +Date: Fri Sep 19 18:43:36 2025 +0000 + + bumped changelog version + +commit 9acdfc741b1b9da243d22ec6fed84f241c446b79 +Author: Patrick Schleizer +Date: Fri Sep 19 14:42:35 2025 -0400 + + description + +commit 62ea7e50410cb354d13600a26de27eaa3af8e309 +Author: Patrick Schleizer +Date: Fri Sep 19 14:41:05 2025 -0400 + + `security-misc` -> `security-misc-shared` package migration + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 02d0ba49bb187f46dbc5969fa00d26f668446a71 +Author: Patrick Schleizer +Date: Fri Sep 19 18:10:09 2025 +0000 + + bumped changelog version + +commit 0c7bee33a79dcd4c96cf374203418c83e1f7ca51 +Author: Patrick Schleizer +Date: Fri Sep 19 14:01:16 2025 -0400 + + comment + +commit 35830047961e2648add789bd44bd2f61cad0dc9a +Author: Patrick Schleizer +Date: Fri Sep 19 16:18:37 2025 +0000 + + bumped changelog version + +commit 67b1cb319ddcb94232ee385d5e67a9cec33b2567 +Author: Patrick Schleizer +Date: Fri Sep 19 12:05:29 2025 -0400 + + `Replaces: security-misc` + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 4bd08f8c818cc862ffb45cd47b7346f7cf89dd4f +Author: Patrick Schleizer +Date: Fri Sep 19 12:05:03 2025 -0400 + + wrap-and-sort + +commit 068750543aef8a74e7168cc58c667c940560a92a +Author: Patrick Schleizer +Date: Fri Sep 19 11:59:22 2025 -0400 + + update link + +commit ca90feb8d5cfa91e7ba3e13dd66d7df0c8343c58 +Author: Patrick Schleizer +Date: Fri Sep 19 11:54:04 2025 -0400 + + security-misc-server placeholder + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 4eb9ec15e11548bd472977c411fecd2bd1c527c0 +Author: Patrick Schleizer +Date: Fri Sep 19 11:51:14 2025 -0400 + + packaging + + https://github.com/Kicksecure/security-misc/issues/187 + +commit c2594a022e86c79a44e2023e518da3f1294346aa +Author: Patrick Schleizer +Date: Fri Sep 19 11:29:55 2025 -0400 + + rename + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 41ba668d23efb5f052394cfd9ab494e595058c17 +Author: Patrick Schleizer +Date: Fri Sep 19 11:23:10 2025 -0400 + + rename + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 1b194f9fd6de847b3450ea5b9b3cd51a3fbfb81f +Author: Patrick Schleizer +Date: Fri Sep 19 10:59:23 2025 -0400 + + adjust lintian overrides file + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 80562557ef5ac360aea2ea7c7a5c6faf76bdb2f0 +Author: Patrick Schleizer +Date: Fri Sep 19 10:53:25 2025 -0400 + + make install files executable + + https://github.com/Kicksecure/security-misc/issues/187 + +commit c99ea95410ef8fd8fd5d6134a914c344c8eea174 +Author: Patrick Schleizer +Date: Fri Sep 19 10:49:17 2025 -0400 + + genmkfile debinstfile + +commit 13e926207c606b0d009613fd41759d9f683cfea4 +Author: Patrick Schleizer +Date: Fri Sep 19 10:30:42 2025 -0400 + + packaging + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 55a8ec685d87a1327ac73d942370409b38e9ad3a +Author: Patrick Schleizer +Date: Thu Sep 18 10:53:21 2025 -0400 + + packaging split + + https://github.com/Kicksecure/security-misc/issues/187 + +commit b4a7d84bf507600cd181081fa85aaab26a3c7c59 +Author: Patrick Schleizer +Date: Thu Sep 18 10:53:10 2025 -0400 + + genmkfile debinstfile + +commit 43ed739479f0e764bf4ecc485094a926a1a4634e +Author: Patrick Schleizer +Date: Thu Sep 18 10:38:50 2025 -0400 + + genmkfile debinstfile + +commit ea878c351f73185411defa7e3f7980e85e8e91ae +Author: Patrick Schleizer +Date: Thu Sep 18 10:27:48 2025 -0400 + + genmkfile debinstfile + +commit 06c045f70ffc9b3c6a195dc900f3a6a16a39c4b1 +Author: Patrick Schleizer +Date: Thu Sep 18 10:00:33 2025 -0400 + + genmkfile debdistfile + +commit f70550d0150793874f8bf30e8aecb090b60fa8e5 +Author: Patrick Schleizer +Date: Wed Sep 17 14:49:28 2025 -0400 + + Split the `security-misc` into `security-misc-shared`, `security-misc-desktop` and `security-misc-server`: rename files + + https://github.com/Kicksecure/security-misc/issues/187 + +commit 2de10d5b7b7589a6da03a6554b231ab55f7cc83c +Merge: ad367c0b 24424bcb +Author: Patrick Schleizer +Date: Wed Sep 17 13:32:44 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 24424bcbc072bbb7ad9c00371a3a2adc27432532 +Merge: 2d3b4ee1 21c605e2 +Author: Patrick Schleizer +Date: Wed Sep 17 13:31:27 2025 -0400 + + Merge pull request #318 from raja-grewal/vmscape + + Enable `vmscape=force` + +commit 2d3b4ee12425182c88f1bf7ac632f7672b25e00c +Merge: ad367c0b 7b32e933 +Author: Patrick Schleizer +Date: Wed Sep 17 13:27:13 2025 -0400 + + Merge pull request #317 from raja-grewal/srso_docs + + Update SRSO docs + +commit ad367c0bbc230357098d246f0fa88d19dad412a1 +Author: Patrick Schleizer +Date: Sat Sep 13 08:33:02 2025 +0000 + + bumped changelog version + +commit 95eeb579a6af3079b79a954351ab69646ec8ec09 +Merge: d262db2e 90b6486f +Author: Patrick Schleizer +Date: Sat Sep 13 04:04:10 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 21c605e27efaf10b3fd182e102c49135843ad21f +Author: raja-grewal +Date: Sat Sep 13 03:41:59 2025 +0000 + + Enable `vmscape=force` + +commit 90b6486ffe95bf50bbf1fa60964c80853917c3c8 +Author: Aaron Rainbolt +Date: Fri Sep 12 18:08:00 2025 -0500 + + Allow users in the sudo group to use usbguard-notifier + +commit 7b32e9339e1da769df38ff9afb849a975b1c1668 +Author: raja-grewal +Date: Fri Sep 12 23:10:34 2025 +1000 + + Update SRSO docs + +commit d262db2e6cc88cd58d73f5b53481ac43fa1ebee7 +Author: Patrick Schleizer +Date: Tue Sep 2 15:25:49 2025 +0000 + + bumped changelog version + +commit 75306a3f96038038958aa7e7adee3952e692ad91 +Author: Patrick Schleizer +Date: Sat Aug 30 14:19:31 2025 +0000 + + bumped changelog version + +commit ac6bc65e3c77f4bcbada69525e8cb1d4c273da8a +Merge: 78b66ba1 2319bd91 +Author: Patrick Schleizer +Date: Sat Aug 30 08:01:26 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 2319bd91648f30b85b49aed2ce7ee7864582495d +Author: Aaron Rainbolt +Date: Thu Aug 28 17:34:41 2025 -0500 + + Allow USB devices that are connected at USBGuard start time + +commit 85fd8ea52b6614cb416514e1c541c46da708f502 +Author: Aaron Rainbolt +Date: Thu Aug 28 16:42:16 2025 -0500 + + Enable USB video and audio devices, reject USB RNDIS devices + +commit b95598b6f7536da08026af37ab3c9fb2ba2f2bb3 +Author: Aaron Rainbolt +Date: Thu Aug 28 16:18:14 2025 -0500 + + Disable RNDIS due to unfixable security issues + +commit 78b66ba159d41dc0559a09c038002c702aaa43c2 +Author: Patrick Schleizer +Date: Wed Aug 27 19:31:06 2025 +0000 + + bumped changelog version + +commit 28d695fd2ddbf91b43dcbf8087c3a852f5ab86a9 +Author: Patrick Schleizer +Date: Wed Aug 27 04:29:48 2025 -0400 + + fix + +commit 0a61107b5adf053db71cad63c40b1c8362e9162b +Merge: ef458ce0 94ebb5c8 +Author: Patrick Schleizer +Date: Wed Aug 27 04:28:25 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit 94ebb5c84ca278a840e2158a5d4207fbfed90a22 +Merge: 893faa98 ef458ce0 +Author: Aaron Rainbolt +Date: Tue Aug 26 19:20:41 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit ef458ce0d338009387999789259a3e644861b9d3 +Author: Patrick Schleizer +Date: Tue Aug 26 09:16:15 2025 +0000 + + bumped changelog version + +commit 893faa98223cee2f6c90f0224c94724e32f6e014 +Author: Aaron Rainbolt +Date: Fri Aug 22 19:48:47 2025 -0500 + + Remove initramfs-tools support + +commit cd44a7e1369cd798b06595fdb118e0c7bea52194 +Author: Aaron Rainbolt +Date: Fri Aug 22 16:00:25 2025 -0500 + + Disable memlockd service by default, fix systemd path + +commit 28f44d2e1d54da990cf203d2965431bc12a5d008 +Author: Aaron Rainbolt +Date: Fri Aug 22 15:50:28 2025 -0500 + + Disable emerg-shutdown and ensure-shutdown on Qubes OS + +commit 53e930b4cc30a8857348758ab65d1a5687ed94a1 +Merge: df8a323d 5898a645 +Author: Aaron Rainbolt +Date: Thu Aug 21 20:09:48 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit df8a323d03747858b55d905465c1f9415bbb8022 +Author: Aaron Rainbolt +Date: Thu Aug 21 18:39:28 2025 -0500 + + Fix XDG handling, replace Xfce with LXQt where appropriate, make USBGuard configuration work + +commit 5898a6457a99ab0036b3e62ded09eeb9cdd9522a +Author: Patrick Schleizer +Date: Thu Aug 21 06:45:04 2025 -0400 + + typo + +commit f713dceff42c6c79a5718ba69358d2fe66ad3245 +Merge: f6f4fd77 8cdbbf82 +Author: Patrick Schleizer +Date: Thu Aug 21 06:44:35 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 8cdbbf8292c354224e2d22fad9087d9f542687e2 +Merge: 2baf5cfc e48897cc +Author: Patrick Schleizer +Date: Thu Aug 21 06:43:07 2025 -0400 + + Merge pull request #313 from raja-grewal/panic_limits + + Upgrade `sysctl` settings and docs on kernel panics + +commit 2baf5cfc0bf061b2cc772dfceadaef84a36d9c1e +Merge: f6f4fd77 45fcd163 +Author: Patrick Schleizer +Date: Thu Aug 21 06:42:28 2025 -0400 + + Merge pull request #314 from raja-grewal/trixie_docs + + Update documentation + +commit f6f4fd77e5bd3a7a7d00c33543fc4ce5a685a3d1 +Merge: 81d437fe 7f211209 +Author: Patrick Schleizer +Date: Thu Aug 21 06:40:39 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 7f211209f7942a332e0568a60eba8a78f3a8a15b +Merge: 81d437fe 19b7e4b4 +Author: Patrick Schleizer +Date: Thu Aug 21 06:40:11 2025 -0400 + + Merge pull request #311 from nrz-21/master + + Set soft limit for core dumps to 0 + +commit 19b7e4b4d0b625b8505de122e790a14de63fafdf +Author: Patrick Schleizer +Date: Thu Aug 21 06:39:56 2025 -0400 + + newline + +commit 3229dd8967d15edc6066ab6148df4738774f36b0 +Merge: 8dcd3493 81d437fe +Author: Patrick Schleizer +Date: Thu Aug 21 06:39:13 2025 -0400 + + Merge branch 'master' into master + +commit 81d437fe3efca99b0d1a29b2a1a3e486e91716c1 +Author: Patrick Schleizer +Date: Wed Aug 20 21:40:39 2025 -0400 + + fix + +commit e48897cc44eef10779a28bdadc7e7bbfe007064a +Merge: add05493 c2d5bf38 +Author: raja-grewal +Date: Thu Aug 21 10:27:44 2025 +1000 + + Merge branch 'master' into panic_limits + +commit add054933b69e97e0f856d7cf04d88290d4b1b7c +Author: raja-grewal +Date: Thu Aug 21 00:24:28 2025 +0000 + + Update docs on instant reboot when kernel panic + +commit c2d5bf38f539703c4858818f29d73b21d5776c80 +Author: Patrick Schleizer +Date: Wed Aug 20 10:44:10 2025 -0400 + + comment + +commit 812f05f847de0f1cb5586ccfd4c5b684d507dd46 +Author: Patrick Schleizer +Date: Wed Aug 20 10:11:49 2025 -0400 + + comments + +commit 2b876c74a3ed9ec91954c8d4f776dc803d212fd0 +Author: Patrick Schleizer +Date: Wed Aug 20 10:09:10 2025 -0400 + + readme + +commit 0e4664daa0267fe62888a9559db2b14d5e1ae8ea +Author: Patrick Schleizer +Date: Wed Aug 20 10:07:58 2025 -0400 + + cleanup + +commit 31fd316e72a87323f83e7e63d6a3440bf77cb350 +Author: Patrick Schleizer +Date: Wed Aug 20 09:48:20 2025 -0400 + + comments + +commit 5d67277c9f27a54d373e683a1d4e1ddf8c16ac25 +Author: Patrick Schleizer +Date: Wed Aug 20 09:46:43 2025 -0400 + + comments + +commit f77c71dd15b38db6f1c33602dd0c5623e501c3eb +Merge: e15bdd2d 37c0bc0c +Author: Patrick Schleizer +Date: Wed Aug 20 09:44:37 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie' + +commit e15bdd2de513fbdcdb3b0fed4c1c1c5f74652291 +Author: Patrick Schleizer +Date: Wed Aug 20 06:57:29 2025 -0400 + + bumped Standards-Version + +commit 312586307b2999d46e4673079fb1538f76ff329e +Author: Patrick Schleizer +Date: Wed Aug 20 06:25:35 2025 -0400 + + readme + +commit a4710693783b8817a6a5c9f17b4268b654c4c0c9 +Author: raja-grewal +Date: Tue Aug 19 11:03:05 2025 +1000 + + Remove link + +commit c0ad57779342c138ade0d6ddff0898f75411157a +Author: raja-grewal +Date: Tue Aug 19 11:01:06 2025 +1000 + + Update docs on oops boot parameter + +commit 45fcd163d1422b43ec033166c889a237301ad83d +Author: raja-grewal +Date: Mon Aug 18 20:23:50 2025 +1000 + + Add reference on conntrack helpers + +commit 37c0bc0c5ddfb901d016f8a4edae16840a58f1fa +Merge: b5a36e02 f175d196 +Author: Aaron Rainbolt +Date: Sun Aug 17 14:02:01 2025 -0500 + + Merge remote-tracking branch 'raja/block_32bit' into arraybolt3/trixie + +commit b5a36e02f1be901da1695056877471398deedf1e +Merge: 210aa976 6df3e3cd +Author: Aaron Rainbolt +Date: Sun Aug 17 13:52:01 2025 -0500 + + Merge remote-tracking branch 'raja/panic_limits' into arraybolt3/trixie + +commit 210aa97650b760acb207f29b1e99e1bb2e65e168 +Merge: 7a8dfa52 3de9cd56 +Author: Aaron Rainbolt +Date: Sun Aug 17 13:50:25 2025 -0500 + + Merge remote-tracking branch 'raja/trixie_docs' into arraybolt3/trixie + +commit f175d1961e4e028539f5a90c0db1fcd1f760cdba +Author: raja-grewal +Date: Sun Aug 17 07:08:08 2025 +0000 + + Enable `ia32_emulation=0` + +commit 3de9cd5646ad45fe745711b83f79f4d469fc8473 +Author: raja-grewal +Date: Sun Aug 17 07:06:55 2025 +0000 + + Remove whitespace + +commit e06b78a52225db02415aeafb833160c9ea0280d9 +Author: raja-grewal +Date: Sun Aug 17 07:05:32 2025 +0000 + + Temporarily revert IA32 doc updates + +commit 6df3e3cde8053d6b2771f510457da774336546bf +Author: raja-grewal +Date: Sun Aug 17 06:32:11 2025 +0000 + + Update kernel panic service description + +commit 247015bcc6e924e24874d16ed7ad78165ace58a3 +Author: raja-grewal +Date: Sun Aug 17 06:27:44 2025 +0000 + + Set `sysctl kernel.panic=-1` + +commit 7a8dfa528c629aa0023943dcd34025ef56a1b1e1 +Merge: cba16879 1f75426f +Author: Aaron Rainbolt +Date: Sat Aug 16 21:10:19 2025 -0500 + + Merge remote-tracking branch 'raja/trixie_docs' into arraybolt3/trixie + +commit 8dcd3493f851f78933f9dbf6d4e9f04f741bed5a +Author: nexus$ +Date: Sat Aug 16 09:39:42 2025 +0000 + + Update 30_security-misc.conf + +commit f1de0da69b46f91ea7fd34db601393d23599b3bb +Author: raja-grewal +Date: Sat Aug 16 04:01:12 2025 +0000 + + Clarify description on panics on oopses and warns + +commit c33f7d04e2cef477b675fbf6c2a91583ba3bf808 +Author: raja-grewal +Date: Sat Aug 16 03:32:48 2025 +0000 + + Remove duplicate comment + +commit 1f75426f079d6e0aecd8fac22088ad36a7c16398 +Author: raja-grewal +Date: Sat Aug 16 02:20:00 2025 +0000 + + Clarify docs for disabling 32-bit x86 support + +commit cba16879eff9d3d998c127e41c38d2067cdf04cc +Author: Aaron Rainbolt +Date: Fri Aug 15 17:16:42 2025 -0500 + + Polish USBGuard configuration + +commit b4086b8e779366127c22eb0a43d1b77fe534ef0e +Merge: 66ec5bda 4cae74d6 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:57:34 2025 -0500 + + Merge remote-tracking branch 'monsieuremre/patch-3' into arraybolt3/trixie + +commit 66ec5bda5872bbf51eb480836d3ffb3bb2f934cf +Author: Aaron Rainbolt +Date: Fri Aug 15 16:51:07 2025 -0500 + + Remove obsolete Thunderbird configuration hardening + +commit 94668b2e93c37a3879968f455575c631f9f8bcac +Author: Aaron Rainbolt +Date: Fri Aug 15 16:46:35 2025 -0500 + + Set hard and soft limits on core file size at the same time + +commit e2c65a2a6fcb246cb5925394f00ec2d8401c2dda +Merge: 65afc31b 28ce7064 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:45:18 2025 -0500 + + Merge remote-tracking branch 'nrz/master' into arraybolt3/trixie + +commit 65afc31ba7f8c5ee6dc14627de82a122b4992d21 +Merge: a2a9e844 00c660d4 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:31:50 2025 -0500 + + Merge branch 'kcfi' into arraybolt3/trixie + +commit a2a9e8440b812b07546722f5842e3ddb16ee5bc2 +Merge: c33ea7be 4166d6d1 +Author: Aaron Rainbolt +Date: Fri Aug 15 16:06:35 2025 -0500 + + Merge branch 'trixie_docs' into arraybolt3/trixie + +commit 00c660d40dce06d979fc7b9dbf7a6e952a9e51cc +Author: raja-grewal +Date: Fri Aug 15 11:29:27 2025 +1000 + + Typo + +commit fce86dccb67db0a37601899bf3115bd9f4fa714a +Author: raja-grewal +Date: Wed Aug 13 10:44:40 2025 +1000 + + Typo + +commit c33ea7be6d2a82462042cf482a32bf259bf51bd5 +Author: Aaron Rainbolt +Date: Sun Aug 10 15:23:48 2025 -0500 + + Move security-misc/apt-get-update* to helper-scripts + +commit 51d5ba29df44d021cfeab1dea6f00919d246388e +Merge: 7aa38245 c7bdca32 +Author: Aaron Rainbolt +Date: Sun Aug 10 14:09:41 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit c7bdca32c05ddc70b785a28ebe5be13614407dc8 +Author: Patrick Schleizer +Date: Sun Aug 10 06:34:30 2025 +0000 + + bumped changelog version + +commit 3629f2c3a59d44e265f0c66389435de1b2414998 +Merge: 5dc251c5 c59a3b23 +Author: Patrick Schleizer +Date: Sun Aug 10 02:25:48 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 7aa38245dedab28cce4c96fd9f533a60c9d05ac4 +Merge: 4930703b c59a3b23 +Author: Aaron Rainbolt +Date: Sat Aug 9 23:31:55 2025 -0500 + + Merge branch 'arraybolt3/emerg-shutdown' into arraybolt3/trixie + +commit c59a3b233bd8893d466c020a2e2695ab545c6e60 +Author: Aaron Rainbolt +Date: Sat Aug 9 21:55:03 2025 -0500 + + Fix unexpected shutdowns when booting Kicksecure from optical media + +commit 4930703b8c90766304122e6e74ccd29e87800714 +Merge: 2ada07cf 5dc251c5 +Author: Aaron Rainbolt +Date: Sat Aug 9 21:30:45 2025 -0500 + + Merge branch 'master' into arraybolt3/trixie + +commit 5dc251c5da724092d264481740e4f6ed347aa0a7 +Author: Patrick Schleizer +Date: Sat Aug 9 09:45:35 2025 +0000 + + bumped changelog version + +commit 046c932898290d250a7900e3c59973a698e5c55f +Author: Patrick Schleizer +Date: Sat Aug 9 05:40:11 2025 -0400 + + `disable emerg-shutdown.service`: + + Disabled due to bug: breaks ISO Live Mode Calamares installer + +commit 2ada07cf66727ea66283c55c0ba078489b3db94e +Author: Aaron Rainbolt +Date: Thu Aug 7 22:23:03 2025 -0500 + + Add SSH hardening config + +commit 0cc0a8310020afc10de6512095336e55559a84d9 +Author: Patrick Schleizer +Date: Thu Aug 7 07:08:19 2025 +0000 + + bumped changelog version + +commit 505a2b7d7995ad48a17add86513ced3499f64ee9 +Merge: 42941653 3a77abe5 +Author: Patrick Schleizer +Date: Thu Aug 7 03:08:02 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 5f2425ba6f747bf65b5beb4336d1e7bf6b8cdf71 +Merge: 86f44063 3a77abe5 +Author: Aaron Rainbolt +Date: Wed Aug 6 20:21:01 2025 -0500 + + Merge branch 'arraybolt3/emerg-shutdown' into arraybolt3/trixie + +commit 3a77abe5c9807caec530e69c41d5cf803b625e70 +Author: Aaron Rainbolt +Date: Wed Aug 6 20:05:57 2025 -0500 + + Port hardening options from kloak to emerg-shutdown, fix new compiler warnings + +commit 0c1af00aae50dba2983c3736744e0da320bb9330 +Author: Aaron Rainbolt +Date: Wed Aug 6 19:33:38 2025 -0500 + + Implement paranoid mode in emerg-shutdown + +commit 29480df770047c8ada3e993cf28f87ffbfd71dec +Author: Aaron Rainbolt +Date: Wed Aug 6 19:24:34 2025 -0500 + + Improve emerg-shutdown usage documentation + +commit 2a3bc39eba317d5f9b0e710dd3663c82d92add94 +Author: Aaron Rainbolt +Date: Wed Aug 6 19:10:37 2025 -0500 + + Use Ctrl+Alt+End as the default panic key rather than Ctrl+Alt+Delete + +commit 44e7d3059a5618991a1408f77707132bfea86fef +Author: Aaron Rainbolt +Date: Wed Aug 6 19:10:14 2025 -0500 + + Integrate emerg-shutdown into the initramfs + +commit 42941653621311187650f12e8d7aa39c45cb6984 +Author: Patrick Schleizer +Date: Wed Aug 6 08:27:15 2025 +0000 + + bumped changelog version + +commit 784ff8af3616765a9c22febf66b522376ecedf12 +Merge: c2690efc 5a17e67c +Author: Patrick Schleizer +Date: Wed Aug 6 04:26:37 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 4166d6d1e60d564be4c3fb2ad530e7a180638e6a +Author: raja-grewal +Date: Wed Aug 6 15:53:49 2025 +1000 + + Update docs on recovery restrictions + +commit 86f44063eb753fe1bbdd754ce104670d26aed6ca +Author: Aaron Rainbolt +Date: Tue Aug 5 22:58:06 2025 -0500 + + Port to Trixie. + +commit 498551536c71f1c1ac33f3c1992e18c9277e6618 +Author: raja-grewal +Date: Wed Aug 6 03:12:06 2025 +0000 + + Update docs + +commit 45d20dd972e6501237d35d1605c81d4e3fde43b1 +Author: raja-grewal +Date: Wed Aug 6 02:35:15 2025 +0000 + + Upgrade sysctls and docs on kernel panics + +commit 1f7525722e7027b5c3379460eee5f62669631dee +Author: raja-grewal +Date: Wed Aug 6 01:48:47 2025 +0000 + + Enable `cfi=kcfi` + +commit 5a17e67c0a7678300f6342d5c90ded5494ebc838 +Author: Aaron Rainbolt +Date: Tue Aug 5 20:14:07 2025 -0500 + + Fix local-fs.target dependency in emerg-shutdown.service + +commit c2690efcacbf7be7c57751ba1cee7f910d350cfc +Author: Patrick Schleizer +Date: Mon Aug 4 09:27:11 2025 +0000 + + bumped changelog version + +commit 166bc257b0b2eea87d684cc847bf6da1fba7c4b4 +Merge: d1bca020 63f29093 +Author: Patrick Schleizer +Date: Mon Aug 4 05:26:55 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 63f29093416a5f21ae14b398cf805c864b5541d7 +Author: Aaron Rainbolt +Date: Sun Aug 3 15:00:14 2025 -0500 + + Fix emerg-shutdown and ensure-shutdown libexec scripts, start emerg-shutdown and ensure-shutdown earlier + +commit d1bca0204fa1dac9ec3fb6e9b121af9526778181 +Author: Patrick Schleizer +Date: Sun Aug 3 11:33:03 2025 +0000 + + bumped changelog version + +commit 92bcd824e4af8a90a18a7726d4a5715c0b20e2ca +Author: Patrick Schleizer +Date: Sun Aug 3 07:17:25 2025 -0400 + + also parse /usr/local/etc + +commit 4da810c8fa4fd40b8701e7dfe217125d965ee03e +Author: Patrick Schleizer +Date: Sun Aug 3 07:16:00 2025 -0400 + + comment + +commit b9416fa77a1e8850c5f579314875671799a55c60 +Author: Patrick Schleizer +Date: Sun Aug 3 07:15:41 2025 -0400 + + validate configuration file + +commit 4ba029471e8c12d5691f7ee94897137fb3cbe15f +Merge: c1e76aa5 1a60da71 +Author: Patrick Schleizer +Date: Sun Aug 3 07:04:20 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/emerg-shutdown' + +commit 28ce70644147f637e91bd4941bcbc139d875e5e7 +Author: nexus$ +Date: Fri Aug 1 15:03:26 2025 +0000 + + Set soft limit for core dumps to 0 + +commit 1a60da71eddfcc6fb72a34596c770cd754146887 +Author: Aaron Rainbolt +Date: Tue Jul 29 21:16:51 2025 -0500 + + emerg-shutdown: Add shutdown timeout for preventing stuck shutdowns, briefly document feature set and usage + +commit e42078e90d7d7e5339a7c4682eb93c844fd38580 +Author: Aaron Rainbolt +Date: Mon Jul 28 20:42:14 2025 -0500 + + emerg-shutdown: fix the hang-on-shutdown bug, add autodetection of new keyboards, shutdown key configuration, and instant shutdown option + +commit a1d1c5603300106f06c1a798088521b77430ff95 +Merge: 5889d134 c1e76aa5 +Author: Aaron Rainbolt +Date: Sun Jul 27 21:43:43 2025 -0500 + + Merge branch 'master' into arraybolt3/emerg-shutdown + +commit c1e76aa52cd28f38c1ab6550e0f4de0010a9ea14 +Author: Patrick Schleizer +Date: Mon Jul 21 10:00:25 2025 +0000 + + bumped changelog version + +commit 36114e29a2ce1045b5f5d82372fcf0463efc5ca7 +Merge: e3ce9c38 f851886f +Author: Patrick Schleizer +Date: Mon Jul 21 06:00:11 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit f851886ffd0fc82ba0b0add501964d1c812c6c15 +Merge: e3ce9c38 6f9763f5 +Author: Patrick Schleizer +Date: Mon Jul 21 05:58:44 2025 -0400 + + Merge pull request #310 from raja-grewal/its + + Enable `indirect_target_selection=force` + +commit 5889d134a23b3d4f8db5d81171ea12907bb10d4d +Author: Aaron Rainbolt +Date: Sun Jul 20 14:14:09 2025 -0500 + + emerg-shutdow: Improve recvmsg handling, call reboot syscall directly + +commit 6f9763f525097b8f8ad5f9864c1694a2642e1bd6 +Author: raja-grewal +Date: Sat Jul 19 05:19:27 2025 +0000 + + Enable `indirect_target_selection=force` + +commit b745c8ddae74d5e1684919442fa74d64e95263b8 +Author: Aaron Rainbolt +Date: Mon Jul 14 21:51:52 2025 -0500 + + emerg-shutdown: Enable actual shutdown code, fix infinite loop when started too early + +commit e387086de4b6e6b90b23d4c32ddf8a566beb858c +Author: Aaron Rainbolt +Date: Mon Jul 14 21:05:16 2025 -0500 + + Allow specifying alternative keys in panic key combo, fix optical disk eject handling + +commit dfb6f143f0324d0903ae2dd106bc0fb6907c1cb0 +Author: Aaron Rainbolt +Date: Sun Jul 13 20:53:29 2025 -0500 + + Add panic key handling to emergency shutdown utility + +commit 2a7071055f94f984398fe2ec49c32b206913bea2 +Merge: f3d46ee5 e3ce9c38 +Author: Aaron Rainbolt +Date: Sun Jul 13 15:21:34 2025 -0500 + + Merge branch 'master' into arraybolt3/emerg-shutdown + +commit e3ce9c38c5b241f789945de7229c0ee15fa0a266 +Author: Patrick Schleizer +Date: Wed Jul 2 20:52:17 2025 +0000 + + bumped changelog version + +commit b06fb5428051518390439ce95c9d6894e6338951 +Merge: 115b6f6a 468cf40e +Author: Patrick Schleizer +Date: Wed Jul 2 13:47:12 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 468cf40e2a216625d02066b609b0991e37c50ebc +Merge: 865a052b bb208fb1 +Author: Patrick Schleizer +Date: Wed Jul 2 13:45:28 2025 -0400 + + Merge pull request #306 from raja-grewal/erst + + Set `erst_disable` + +commit 865a052bf47f28c0084b2bbd51e3c606df9eda96 +Merge: 115b6f6a e3c45191 +Author: Patrick Schleizer +Date: Wed Jul 2 13:44:17 2025 -0400 + + Merge pull request #309 from RebornRider/patch-1 + + remove TemporaryTimeout=0 in Bluetooth config + +commit bb208fb134fe25fc3539494f331072a851369064 +Merge: 4314b1e8 115b6f6a +Author: raja-grewal +Date: Wed Jul 2 11:35:50 2025 +1000 + + Merge branch 'Kicksecure:master' into erst + +commit 4314b1e85bd5495832b4398bdbd358c41703dcc9 +Author: raja-grewal +Date: Tue Jul 1 13:36:39 2025 +1000 + + Add comment + +commit e3c451917931aa4e63056fb03470c203694d399f +Author: Kevin Agwaze <7119346+RebornRider@users.noreply.github.com> +Date: Mon Jun 16 10:35:16 2025 +0100 + + remove misleading TemporaryTimeout=0 in Bluetooth config + +commit 115b6f6aa2a4d00ad5690c2c0889e142540c01ca +Author: Patrick Schleizer +Date: Sat Jun 14 11:51:44 2025 +0000 + + bumped changelog version + +commit 4639d1aab572bb4ad751bd1da5b936b9d73d3264 +Merge: 5159de63 109c0134 +Author: Patrick Schleizer +Date: Fri Jun 13 15:09:52 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/approx' + +commit 109c0134677d991c449aa009773cb22babeee8db +Author: Aaron Rainbolt +Date: Thu Jun 12 01:08:34 2025 -0500 + + Add comment related to approx package caching proxy + +commit 72613203b9692d1098b13ff98119499a5a30a6da +Author: raja-grewal +Date: Fri Jun 6 13:07:52 2025 +0000 + + Add reference + +commit dd0b55cc45f9ccd64d0075ba37ab6a4723d94a02 +Author: raja-grewal +Date: Tue Jun 3 12:32:17 2025 +1000 + + Add reference + +commit 5159de63438e8c1274658e7175a80fb693d6554a +Author: Patrick Schleizer +Date: Wed May 28 13:48:11 2025 +0000 + + bumped changelog version + +commit 3e102df76583a14b5efc18238aefbf539ab0d8a1 +Author: Patrick Schleizer +Date: Wed May 28 08:37:03 2025 -0400 + + fix + +commit d5edc243ac2db861f1600d3906a02494eaf9a824 +Author: Patrick Schleizer +Date: Wed May 28 12:12:00 2025 +0000 + + bumped changelog version + +commit eda1d0aef640af1ea73c72d6caa876733de4e5a0 +Merge: e9667748 5a10ad03 +Author: Patrick Schleizer +Date: Wed May 28 07:22:16 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 5a10ad031d67acc8fa4c16f9e2db191bde559caa +Merge: e9667748 3559bc86 +Author: Patrick Schleizer +Date: Wed May 28 07:21:31 2025 -0400 + + Merge pull request #307 from maybebyte/ssh-agent-to-allowlist + + fix(permission-hardener): ssh-agent gets 2755 perms + +commit 3559bc86b7aed8122ff7996ce0ab4a65bdaf05c0 +Author: Ashlen +Date: Tue May 27 15:32:41 2025 -0600 + + fix(permission-hardener): ssh-agent gets 2755 perms + + Change from exactwhitelist to matchwhitelist. Discussion revealed that + there's a good reason to leave setgid in here, which is essentially + defense-in-depth (sometimes users may want to revert Kicksecure's + default of kernel.yama.ptrace_scope=2, e.g. to debug a program, and + Kicksecure should not be less secure than vanilla Debian in that + situation). + +commit c59b2e4bc53cad4c9cc90ddd5abaca0705ccff90 +Merge: 017ee29e e9667748 +Author: maybebyte <99762926+maybebyte@users.noreply.github.com> +Date: Tue May 27 20:33:07 2025 +0000 + + Merge branch 'Kicksecure:master' into ssh-agent-to-allowlist + +commit e96677486201ebddc145af7962ad5e89f6fa253b +Author: Patrick Schleizer +Date: Tue May 27 19:41:25 2025 +0000 + + bumped changelog version + +commit 017ee29eb39d84edc89f128a633a619cad852241 +Merge: 7a079c3d abb22073 +Author: maybebyte <99762926+maybebyte@users.noreply.github.com> +Date: Tue May 27 18:25:47 2025 +0000 + + Merge branch 'Kicksecure:master' into ssh-agent-to-allowlist + +commit 5195977be474e29a29b6392306e909e9f2d05ada +Author: Patrick Schleizer +Date: Tue May 27 11:57:21 2025 -0400 + + protect against grep pipefail + +commit abb2207313810966dad381c3a9f637c445a5834d +Author: Patrick Schleizer +Date: Tue May 27 15:51:50 2025 +0000 + + bumped changelog version + +commit 45016146f7c77d383f2254d19dc66ba9b883b8f2 +Merge: ace45d7c 395169fb +Author: Patrick Schleizer +Date: Tue May 27 11:03:23 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 395169fbce1854bfed727d1784f4e5c0d8e7c6ff +Merge: ace45d7c e14b81b1 +Author: Patrick Schleizer +Date: Tue May 27 10:58:50 2025 -0400 + + Merge pull request #308 from maybebyte/permission-hardener-speedboost + + perf(permission-hardener): optimize string match + +commit 1c353032046f556bb11c32506019310c9f6d47c0 +Merge: 35fa32e4 ace45d7c +Author: raja-grewal +Date: Fri May 23 20:20:19 2025 +1000 + + Merge branch 'Kicksecure:master' into erst + +commit ace45d7c95ed6b83c1897f76da5af4a0c97cab10 +Author: Patrick Schleizer +Date: Wed May 21 22:06:02 2025 +0000 + + bumped changelog version + +commit 142ea2118989faddafa17db48efed379c4ac3f45 +Author: Patrick Schleizer +Date: Wed May 21 12:42:16 2025 -0400 + + fix + +commit a969fa350e28ca296966509821a7c62b68f09a5a +Author: Patrick Schleizer +Date: Wed May 21 12:40:27 2025 -0400 + + fix + +commit f023651c984c52a997bc241f99f118255cf60809 +Author: Patrick Schleizer +Date: Wed May 21 12:35:37 2025 -0400 + + nounset + +commit f086787464191a07e028dd92649c48b145023858 +Author: Patrick Schleizer +Date: Wed May 21 12:35:23 2025 -0400 + + fix + +commit d7643954d184846c8b7fb5eda7200779126274eb +Author: Patrick Schleizer +Date: Wed May 21 12:33:50 2025 -0400 + + minor + +commit aa905fc8875c5c56351f10f4e40e6d2a7dd6d918 +Author: Patrick Schleizer +Date: Wed May 21 12:32:16 2025 -0400 + + further validation of output of `faillock` + +commit 92d3a36a0f43615db622c6b0daa7064b8e8ebbbb +Author: Patrick Schleizer +Date: Wed May 21 12:29:01 2025 -0400 + + fix + +commit 2c1abb23e03cfe449347ba692d35f5ba1f33cff4 +Author: Patrick Schleizer +Date: Wed May 21 12:26:46 2025 -0400 + + output + +commit 0801b96ae74256f36dcf8757d0ba8abc66ea0b9b +Author: Patrick Schleizer +Date: Wed May 21 12:25:49 2025 -0400 + + output + +commit ef8515ba82996b137c386eeb91e6f853d58a515f +Author: Patrick Schleizer +Date: Wed May 21 12:23:45 2025 -0400 + + improve error handling + +commit 784867e24b4d6f2899fa9b215ec9e3c4e2fb9d84 +Author: Patrick Schleizer +Date: Wed May 21 12:21:45 2025 -0400 + + fix + +commit 0eea681ce893a259563f8e9d5a2ec9722fbc635d +Author: Patrick Schleizer +Date: Wed May 21 15:52:16 2025 +0000 + + bumped changelog version + +commit e1bae1c68aabc424924b6386fe4980d657dc2cdf +Author: Patrick Schleizer +Date: Wed May 21 11:50:59 2025 -0400 + + fix + +commit bd01a683054b1f7d5a5f6cc4848da73b1b1ef5ff +Author: Patrick Schleizer +Date: Wed May 21 13:58:18 2025 +0000 + + bumped changelog version + +commit 14cf205579ff65fa765d7574e5d0e301a30a1904 +Author: Patrick Schleizer +Date: Wed May 21 08:36:16 2025 -0400 + + fix + +commit ff6bc5d5b6097bcdddd8e66c2541106c2cbabbaf +Author: Patrick Schleizer +Date: Wed May 21 11:23:39 2025 +0000 + + bumped changelog version + +commit 353b6e83c55d52b47a2a35063406324cec7237c4 +Author: Patrick Schleizer +Date: Wed May 21 07:20:13 2025 -0400 + + test that `wc` is functional + + https://github.com/Kicksecure/security-misc/pull/305#issuecomment-2892378246 + +commit 5930e270521e0e5d6a0a3877c813accbf5253051 +Author: Patrick Schleizer +Date: Wed May 21 07:05:25 2025 -0400 + + pam-info: improve error handling + + https://github.com/Kicksecure/security-misc/pull/305#issuecomment-2892378246 + +commit 5c981e0891ef009c5c2355f5f6383aca22c45638 +Author: Patrick Schleizer +Date: Wed May 21 06:55:09 2025 -0400 + + pam-info: fix, consistently write errors and warnings to stderr + +commit e14b81b15e479afbc4820a2b9bb60f3cf65bfb12 +Author: Ashlen +Date: Tue May 20 21:34:03 2025 -0600 + + perf(permission-hardener): optimize string match + + Replace subprocess grep calls with bash substring matching in + check_nosuid_whitelist function. This eliminates ~10k unneeded + subprocess spawns that were causing significant performance + degradation. + + In testing, it improves overall script execution speed by an + order of magnitude: + + Before patch: + $ sudo hyperfine -- './permission-hardener enable' + Benchmark 1: ./permission-hardener enable + Time (mean _ _): 11.906 s _ 0.974 s [User: 3.639 s, System: 8.728 s] + Range (min _ max): 10.430 s _ 14.090 s 10 runs + + After patch: + $ sudo hyperfine -- './permission-hardener enable' + Benchmark 1: ./permission-hardener enable + Time (mean _ _): 802.8 ms _ 178.5 ms [User: 283.0 ms, System: 471.9 ms] + Range (min _ max): 639.4 ms _ 1092.3 ms 10 runs + +commit 7a079c3de8bd8b4e026a1bd1b932a04610a1e386 +Author: Ashlen +Date: Tue May 20 18:41:48 2025 -0600 + + fix(permission-hardener): add exactwhitelist here + + Without this, the permissions for ssh-agent won't be changed properly. + +commit 94dc9da4ab8fb93760dbb3b325bdeaa155e492cb +Author: Ashlen +Date: Tue May 20 17:07:51 2025 -0600 + + fix(permission-hardener): ssh-agent gets 755 perms + + Replace the commented-out matchwhitelist entry for ssh-agent with an + explicit permission entry (755) for /usr/bin/ssh-agent. + + When ssh-agent's matchwhitelist entry was commented out in commit + 7a5f8b87af, permission-hardener began resetting it to restrictive + defaults (744), preventing non-root users from executing ssh-agent. This + broke split SSH functionality in Qubes OS for me because I was using + Kicksecure in the vault qube, and ssh-agent runs under a non-root user in + that configuration (see https://forum.qubes-os.org/t/split-ssh/19060). + + As noted in the comment, Debian installs with 2755 permissions as a way + to mitigate ptrace attacks, but this rationale doesn't apply due to + kernel.yama.ptrace_scope=2 being set in Kicksecure. + +commit 19d7e1af5d7acf6eb3a20fe3ebf5f14cef041f92 +Author: Patrick Schleizer +Date: Tue May 20 11:40:27 2025 +0000 + + bumped changelog version + +commit 405880e63b92319626332d083a6c5ad5101dbf77 +Author: Patrick Schleizer +Date: Sun May 18 06:44:42 2025 -0400 + + handle case of non-existence of /proc/cmdline + +commit 88235cc97b8b54f3fe78d6ad76f64326e8b53f3e +Author: Patrick Schleizer +Date: Sun May 18 06:44:04 2025 -0400 + + refactoring + +commit 601ea77b005d18b57a85e0701f3981edd61b7881 +Author: Patrick Schleizer +Date: Sun May 18 06:42:39 2025 -0400 + + end-of-options + +commit d8feca12768441b0499ead7cc9f9bce4e89b1edf +Author: Patrick Schleizer +Date: Sun May 18 06:41:41 2025 -0400 + + printf + +commit 7f2ba0980d17360fc014c6a412fc4ee57e1032fd +Author: Patrick Schleizer +Date: Sun May 18 06:40:50 2025 -0400 + + refactoring + +commit 4d1f8c44d28895587abce586ed5b2fe354544f6a +Merge: 341dce33 e4787508 +Author: Patrick Schleizer +Date: Sun May 18 06:36:08 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e478750814798f3d9aa60354b6cecbb84769ed53 +Merge: 341dce33 91a76db6 +Author: Patrick Schleizer +Date: Sun May 18 06:35:23 2025 -0400 + + Merge pull request #305 from DMHalford/pam-info-failed_login_counter-fix + + Prevent erroneous "Login blocked after [negative number] attempts" errors + +commit 35fa32e4ed6333f3ab87d09828f13155aa1e7a72 +Author: raja-grewal +Date: Sat May 17 15:06:49 2025 +1000 + + Reword + +commit a1bde21ccb475fc21a084559dbe766f6315d9287 +Author: raja-grewal +Date: Sat May 17 04:41:06 2025 +0000 + + Set `erst_disable` + +commit 91a76db66bb496ba4650ada38df31636297738cf +Author: DMHalford <161769419+DMHalford@users.noreply.github.com> +Date: Thu May 15 15:42:50 2025 -0400 + + Prevent erroneous "Login blocked after [negative number] attempts" errors + + For root, faillock appears to always* return an empty string (i.e. no table headers are present), yielding a zero-initialized pam_faillock_output_count and thus resulting in the calculation of a negative failed_login_counter value. + + This can cause erroneous errors of the form "ERROR: Login blocked after [negative number] attempts" during sudo-ing and screen unlocking. + + This commit modifies the initialization of failed_login_counter such that it cannot be negative and prevents the display of these incorrect warnings. + + * Only rudimentary local tests were conducted + +commit 6c3be9ced071e73e78451c82e8def9c5a5b02598 +Author: DMHalford <161769419+DMHalford@users.noreply.github.com> +Date: Thu May 15 15:06:10 2025 -0400 + + Prevent erroneous "Login blocked after [negative number] attempts" errors + + For root, faillock appears to always* return an empty string (i.e. no table headers are present), yielding a zero-initialized pam_faillock_output_count and thus resulting in the calculation of a negative failed_login_counter value. + + This can cause erroneous errors of the form "ERROR: Login blocked after [negative number] attempts" during sudo-ing and screen unlocking. + + This commit modifies the initialization of failed_login_counter such that it cannot be negative and prevents the display of these incorrect warnings. + + * Only rudimentary tests were conducted + +commit f3d46ee56233c4ef0552c20304413d137e90acfe +Author: Aaron Rainbolt +Date: Fri May 9 18:46:41 2025 -0500 + + Add emergency shutdown feature, triggered by root device removal + +commit 341dce33fb806ab03822470e6af91604662c22dd +Author: Patrick Schleizer +Date: Fri Apr 25 09:54:23 2025 +0000 + + bumped changelog version + +commit 06e1e44b0039807baa862102b12fc5e199c3ccb3 +Author: Patrick Schleizer +Date: Fri Apr 25 05:51:21 2025 -0400 + + comments + +commit ba1012ca8767baf34ed762d80b25b03bb70e6765 +Author: Patrick Schleizer +Date: Fri Apr 25 08:19:35 2025 +0000 + + bumped changelog version + +commit a8f6132bec1a6f4a639d58295b3e50faf5494d98 +Author: Patrick Schleizer +Date: Fri Apr 25 03:11:27 2025 -0400 + + output + +commit 1d14a9f32435b8131c251e03bff2af5c929bbf49 +Merge: e154d0af 612f5f92 +Author: Patrick Schleizer +Date: Fri Apr 25 02:59:09 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/fix-pkexec-umask' + +commit 612f5f92fde236b86928428fd0247c8e971b0460 +Author: Aaron Rainbolt +Date: Thu Apr 24 20:01:35 2025 -0500 + + Fix umask for pkexec-run commands + +commit e154d0af6dd41e392122fbe3d09219734c5ad588 +Author: Patrick Schleizer +Date: Mon Apr 21 10:21:54 2025 +0000 + + bumped changelog version + +commit 4bf0e3a63667c284d053e5b8517440a884a42441 +Author: Patrick Schleizer +Date: Mon Apr 21 04:57:07 2025 -0400 + + comments + +commit 502f5953c734346edc680a0b898b435e6c6f6e27 +Author: Patrick Schleizer +Date: Mon Apr 21 04:55:19 2025 -0400 + + comments + +commit abb0c83619b820b7b66258efa9e141850eaa8b6c +Author: Patrick Schleizer +Date: Mon Apr 21 04:54:06 2025 -0400 + + comments + +commit efa2967fca36c776d43419dd5bf12696bc61c426 +Author: Patrick Schleizer +Date: Mon Apr 21 04:53:04 2025 -0400 + + comments + +commit dc7e8579040a96630ab1bbf7b4b901e3e3abe8c7 +Author: Patrick Schleizer +Date: Sat Apr 19 17:33:56 2025 +0000 + + bumped changelog version + +commit 9948ae114d4c6bbd650022c9985137c0fdea5675 +Author: Patrick Schleizer +Date: Sat Apr 19 13:24:17 2025 -0400 + + fix + +commit 4aca622706f33e85832e67650259a7751ba87a72 +Author: Patrick Schleizer +Date: Sat Apr 19 13:23:26 2025 -0400 + + fix + +commit 701f4a0e88a32e4c9312fd92b73cef5d4f755f0a +Author: Patrick Schleizer +Date: Sat Apr 19 13:20:04 2025 -0400 + + output + +commit a670c0d873eba8d84bde90ebbeecc7aecc22349e +Author: Patrick Schleizer +Date: Sat Apr 19 13:18:23 2025 -0400 + + comment + +commit 4799f3ce02e5683dad0fff13f5d7fe0aadb0a0db +Author: Patrick Schleizer +Date: Sat Apr 19 13:17:28 2025 -0400 + + make `/usr/libexec/security-misc/apt-get-update` more reliable + +commit c4f0e1d16f6999b055b0fa310456870f12a6dbea +Author: Patrick Schleizer +Date: Sat Apr 19 12:57:14 2025 -0400 + + refactoring + +commit 81634930fa13a240b9fff9a878dd84af1dccc6b3 +Author: Patrick Schleizer +Date: Sat Apr 19 12:55:32 2025 -0400 + + refactoring + +commit 90330a1ec958f82f9322ecc62bcfb7169d641af4 +Author: Patrick Schleizer +Date: Sat Apr 19 12:49:18 2025 -0400 + + refactoring + +commit ce2c9a21a357b3981335336eaf7ac8a6a3bcb052 +Author: Patrick Schleizer +Date: Sat Apr 19 12:47:40 2025 -0400 + + /usr/libexec/security-misc/apt-get-update: use `/run/helper-scripts` folder for pid file instead of `$TMP` + + to avoid permission issues + +commit 96ff7c8dc67809a3199d0b7f22d9e50483634a9c +Author: Patrick Schleizer +Date: Sat Apr 19 12:45:06 2025 -0400 + + refactoring + +commit 5a37790e6bd80ffd4f74d9596523ef72366d35d9 +Author: Patrick Schleizer +Date: Sat Apr 19 12:43:15 2025 -0400 + + cleanup + +commit 7512aa67572c97267fd176e63ae4862b6d37f8ae +Author: Patrick Schleizer +Date: Tue Apr 15 20:59:37 2025 +0000 + + bumped changelog version + +commit e0e2a9b61c61b34a6fe10782e294d58adff15cfe +Merge: 5e88dfe8 9f2836d2 +Author: Patrick Schleizer +Date: Tue Apr 15 15:27:10 2025 -0400 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 9f2836d2baae900222cbae74d7a32bcdc69e589f +Merge: 5e88dfe8 aa0ffff4 +Author: Patrick Schleizer +Date: Tue Apr 15 15:17:25 2025 -0400 + + Merge pull request #304 from raja-grewal/stop_pstore + + Disable PStore + +commit 5e88dfe809a762aeebf62ea2de131cfbdea9ae32 +Author: Patrick Schleizer +Date: Thu Apr 10 11:38:17 2025 +0000 + + bumped changelog version + +commit c0a18c5a7122fe3c7b52d0e02ca5e8817efb3996 +Merge: da9dd3c3 74ca63d1 +Author: Patrick Schleizer +Date: Thu Apr 10 06:07:55 2025 -0400 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/rename-boot-modes' + +commit 74ca63d12c716017d022f5dfc5348ae7b787e220 +Author: Aaron Rainbolt +Date: Wed Apr 9 21:01:41 2025 -0500 + + Mass-change "PERSISTENCE mode USERNAME" to "PERSISTENCE Mode - USERNAME Session" + +commit aa0ffff42753f68e67bc92680a22986a5b9ef9e0 +Author: raja-grewal +Date: Thu Apr 10 11:49:45 2025 +1000 + + README.md: Revert error + +commit da9dd3c3f14103701ad82af775b4fb547f5b3e2e +Author: Patrick Schleizer +Date: Wed Apr 9 15:16:00 2025 +0000 + + bumped changelog version + +commit 163d51f32a1888a52ea78ba32a4e4a2d72aea87d +Author: Patrick Schleizer +Date: Wed Apr 9 09:47:52 2025 -0400 + + newline at the end + +commit 4d2b2e65468522b1d1beda63b0b16cfa12b1d535 +Author: Patrick Schleizer +Date: Tue Apr 8 14:08:24 2025 +0000 + + bumped changelog version + +commit 39f4f5b60739c387f02970018e14f1ae93677e00 +Author: Patrick Schleizer +Date: Tue Apr 8 06:53:08 2025 -0400 + + comments + +commit 173606891ad0c064a22b4ec0aee772105d8be54a +Author: Patrick Schleizer +Date: Tue Apr 8 06:48:29 2025 -0400 + + output + +commit f0d17c7e4134d8a54ce7331c1e9d3ce932278987 +Author: raja-grewal +Date: Sun Mar 16 03:31:24 2025 +0000 + + README: Fix a few links + +commit df2fc2cf6b0437d23c7641118ebd24d2e3a670ce +Author: raja-grewal +Date: Sun Mar 16 03:30:04 2025 +0000 + + Set `efi_pstore.pstore_disable=1` + +commit f643ebc2f923ba4d7231e5aeaf1d91d1a9d1d0df +Author: raja-grewal +Date: Sun Mar 16 03:28:39 2025 +0000 + + Disable pstore processing by systemd-pstore service + +commit d927fe238cc5369f7fe1632a4173fe4bdf0ffdfb +Author: Patrick Schleizer +Date: Mon Mar 3 11:00:38 2025 +0000 + + bumped changelog version + +commit cd0ba94ac5e7e8360183ac6f440d941b4067025b +Author: Patrick Schleizer +Date: Mon Mar 3 05:57:59 2025 -0500 + + no longer disable `vivid` kernel module by default, + because it breaks Qubes Video Companion + + Thanks to @marmarek for the bug report! + + https://forums.whonix.org/t/testing-qubes-video-companion-on-whonix/21393 + + fixes https://github.com/Kicksecure/security-misc/issues/298 + +commit 3e7d1b4e23e1e8ef4ad138dbe4119eee7e72511c +Author: Patrick Schleizer +Date: Sun Feb 9 23:04:36 2025 +0000 + + bumped changelog version + +commit 0615e6e995eb25d8e1bff181ecc49ff51e4029cc +Merge: 2a4a228b 4d62ee3a +Author: Patrick Schleizer +Date: Sun Feb 9 18:01:43 2025 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 4d62ee3ab31bde80eebde265c2513233f10f751a +Merge: 2a4a228b ce4b57d1 +Author: Patrick Schleizer +Date: Sun Feb 9 18:00:59 2025 -0500 + + Merge pull request #297 from raja-grewal/warn_path + + Update docs on kernel panics + +commit ce4b57d1cb179f18c1ac41681626d01054355fe6 +Author: raja-grewal +Date: Mon Feb 3 00:31:45 2025 +0000 + + Update docs on kernel panics + +commit 2a4a228b150e06c7ff796315719d41e825dd8ad3 +Author: Patrick Schleizer +Date: Fri Jan 31 19:38:42 2025 +0000 + + bumped changelog version + +commit 041caf286b343268e6db69f2957f23c1dd20812a +Author: Patrick Schleizer +Date: Fri Jan 31 14:33:54 2025 -0500 + + update pkg_installed function + +commit ac1493fcfc194b8d1a680d7e8bf53a90caa984ac +Author: Patrick Schleizer +Date: Fri Jan 31 14:33:17 2025 -0500 + + comment + +commit c0f2f110146410428fc12815b30aaba67ff16126 +Author: Patrick Schleizer +Date: Thu Jan 30 12:58:48 2025 +0000 + + bumped changelog version + +commit 9f5e522b83ba969112abf6a9fba77c1eff31b14d +Author: Patrick Schleizer +Date: Thu Jan 30 07:53:04 2025 -0500 + + LC_ALL=C + +commit 7c150d116d1d1f95e2fb729934906eb4391a389a +Author: Patrick Schleizer +Date: Thu Jan 30 07:45:08 2025 -0500 + + LANG=C str_replace: no longer requires LANG=C, therefore removed + +commit 6aaf7082177fe4d02415aac4317cde74665f495c +Author: Patrick Schleizer +Date: Wed Jan 29 14:36:41 2025 +0000 + + bumped changelog version + +commit 10508cb5801c28f8fff306957e867a1626aa6489 +Merge: 6b4fa1ef b9dee263 +Author: Patrick Schleizer +Date: Wed Jan 29 09:36:28 2025 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit b9dee2633128577245763bad41cf3cb6b49751f3 +Merge: 6b4fa1ef 4b1e5306 +Author: Patrick Schleizer +Date: Wed Jan 29 09:35:50 2025 -0500 + + Merge pull request #296 from raja-grewal/cpu_details + + Hardware-related Documentation + +commit 6b4fa1ef0055d36a45d65481129dabfee77027e4 +Author: Patrick Schleizer +Date: Thu Jan 23 16:28:58 2025 +0000 + + bumped changelog version + +commit b10f5489a3e3317f01339ea34a0e5c7bfb850a01 +Author: Patrick Schleizer +Date: Thu Jan 23 11:12:26 2025 -0500 + + copyright + +commit 3c18734db32b2d19c3a30e282435f083d307d86e +Author: Patrick Schleizer +Date: Wed Jan 22 14:11:21 2025 +0000 + + bumped changelog version + +commit f90ffacac3d3c12f62f62106a69cb6caeca69041 +Author: Patrick Schleizer +Date: Wed Jan 22 09:09:56 2025 -0500 + + bump permission hardner migration code version + +commit 3a056c9d9c17ed3968f48ac332cee94f714320c7 +Author: Patrick Schleizer +Date: Wed Jan 22 09:05:50 2025 -0500 + + bump permission hardner migration code version + +commit d5ad29a7324dfbece3185026a3f4c58121c453b6 +Author: Patrick Schleizer +Date: Wed Jan 22 09:04:44 2025 -0500 + + add /usr/lib/polkit-1/polkit-agent-helper-1 to permission hardener hardcoded statoverride file + +commit c8a2483cf6735b29ef9b265cc09b58b00b14b6f0 +Author: Patrick Schleizer +Date: Wed Jan 22 13:52:29 2025 +0000 + + bumped changelog version + +commit 80bd314436b99b723359f25e52bbd14683929b56 +Author: Patrick Schleizer +Date: Wed Jan 22 08:25:14 2025 -0500 + + add `.whonix` files to hardcoded files + +commit 9b012bdeee03e73de537e7fe65c0bb8d16b38e79 +Merge: 507130a1 42f34f5a +Author: Patrick Schleizer +Date: Wed Jan 22 08:23:49 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-symlink-fix' + +commit 507130a1cc0592bd4a4b280da7496dade470e637 +Merge: f1b6bff3 ed767e00 +Author: Patrick Schleizer +Date: Wed Jan 22 08:21:39 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-diag' + +commit 42f34f5a4ccf95d504e28a26aeb0747fef4685ba +Author: Aaron Rainbolt +Date: Tue Jan 21 21:49:03 2025 -0600 + + Don't handle files with multiple hardlinks + +commit 5e60416c864a7d06f635161a185864fc36d5685c +Author: Aaron Rainbolt +Date: Tue Jan 21 21:05:03 2025 -0600 + + Make permission-hardener always apply changes to real files, not symlinks + +commit ed767e00b0260d29c18c710efe07d68a9beffb34 +Author: Aaron Rainbolt +Date: Tue Jan 21 16:41:30 2025 -0600 + + Add some local variable declarations + +commit 4b1e530674146d4d2b62ff4a87fe3add5667403c +Author: raja-grewal +Date: Tue Jan 21 12:39:06 2025 +0000 + + README.md: List CPU mitigations + +commit 15d13a8571d1f38b2bc36387f61bce24c86be97b +Author: raja-grewal +Date: Tue Jan 21 12:36:04 2025 +0000 + + Add info on DBX updates via the UEFI Revocation List + +commit a97620a2e491cc039adb15af94958f26b39319a2 +Author: Aaron Rainbolt +Date: Mon Jan 20 22:43:55 2025 -0600 + + Add print-diagnostics command to permission-hardener + +commit f1b6bff30b1891bfbe870de9edd78fa7dbd66e7c +Author: Patrick Schleizer +Date: Mon Jan 20 11:35:08 2025 +0000 + + bumped changelog version + +commit df9d058ed9635b168508ded20277c174a24cf3f5 +Author: Patrick Schleizer +Date: Mon Jan 20 06:28:16 2025 -0500 + + usrmerge + +commit 8ff5f3b22125488f64cd384ffbfcbd8f2ecd61a6 +Author: Patrick Schleizer +Date: Mon Jan 20 10:11:43 2025 +0000 + + bumped changelog version + +commit 4e0d5a196ccb8ef3fdf2b67d974f28d02a532f91 +Author: Patrick Schleizer +Date: Mon Jan 20 04:30:26 2025 -0500 + + delete comment only configuration file (moved to user-sysmaint-split) + +commit 1b4d1edfc316f125ff5039bf17897802205750e2 +Author: Patrick Schleizer +Date: Mon Jan 20 04:29:42 2025 -0500 + + comments + +commit 51c7010e8f47ce6e6a28e6267c735e897dcfb053 +Author: Patrick Schleizer +Date: Fri Jan 17 13:35:28 2025 +0000 + + bumped changelog version + +commit 876d596a071ac916f7d220ee2449358aedba7efe +Author: Patrick Schleizer +Date: Fri Jan 17 07:55:54 2025 -0500 + + comment + +commit c9e2f82bd01813682998c775f75bac0841239e5e +Merge: 59718697 bf73f1f2 +Author: Patrick Schleizer +Date: Fri Jan 17 07:53:59 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/master' + +commit bf73f1f2b5e429caaf01bfbcdc7d5d032e3c0efb +Author: Aaron Rainbolt +Date: Wed Jan 15 19:10:41 2025 -0600 + + Avoid impossible-to-satisfy dependency on helper-scripts, improve string handling robustness in postinst + +commit 597186972e463ce7a0b44662f7656f351ddf1030 +Author: Patrick Schleizer +Date: Wed Jan 15 15:02:44 2025 +0000 + + bumped changelog version + +commit ca257164105c4f66576024b64c52a42921455d16 +Author: Patrick Schleizer +Date: Wed Jan 15 09:44:48 2025 -0500 + + improve permission hardener migration code + +commit 2dfd30a44ae332faa50bc4920486cdd9480c7e5d +Merge: a84d3ba7 328f7471 +Author: Patrick Schleizer +Date: Wed Jan 15 09:33:57 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/more-permission-hardener' + +commit 328f747179ffb2e7705a73bc9a0c5133a17da829 +Author: Aaron Rainbolt +Date: Tue Jan 14 20:35:28 2025 -0600 + + Restore permission-hardener's notice about how to compare old and new states + +commit c6f09748f383fdf7c1b07441c73477b3f18d2768 +Author: Aaron Rainbolt +Date: Tue Jan 14 20:27:53 2025 -0600 + + Handle de-corruption of new_mode a bit better + +commit a0f81958dfb020d311d86cbd00d4f86f678d8be9 +Author: Aaron Rainbolt +Date: Tue Jan 14 19:25:15 2025 -0600 + + De-corrupt the new_mode permission-hardener statoverride database too + +commit 396372c1295e2a09d596f3e23fccc26794a26f05 +Author: Aaron Rainbolt +Date: Tue Jan 14 18:50:24 2025 -0600 + + Avoid scanning unnecessary packages for modified permission-hardener config + +commit a84d3ba732bcbd2fb93ea2bc145a0db0f33f1b77 +Author: Patrick Schleizer +Date: Tue Jan 14 14:32:13 2025 +0000 + + bumped changelog version + +commit 709036c79f8efc9fefa9e7709780a75f9f5004d2 +Author: Patrick Schleizer +Date: Tue Jan 14 09:31:58 2025 -0500 + + debconf-updatepo + +commit 659c7037c6956f6d905e55a1ebb13ebe6a273dee +Author: Patrick Schleizer +Date: Tue Jan 14 14:30:58 2025 +0000 + + bumped changelog version + +commit 86d3db15bf94dc0f4547105e18ef5f26ca124fa8 +Author: Patrick Schleizer +Date: Tue Jan 14 09:30:46 2025 -0500 + + output + +commit 876c0b618785fc71d1d399ff7ab649382104a714 +Author: Patrick Schleizer +Date: Tue Jan 14 09:29:35 2025 -0500 + + output + +commit c46178dee46f88e8d0007a12a48addc2493faab7 +Author: Patrick Schleizer +Date: Tue Jan 14 09:27:37 2025 -0500 + + output + +commit f3c07a2451fd2818daca6bc248cbbcba213516e7 +Author: Patrick Schleizer +Date: Tue Jan 14 09:24:06 2025 -0500 + + update link + +commit bbc4ad7c2a0827d079ccbb18dce4aaae042a2253 +Author: Patrick Schleizer +Date: Tue Jan 14 14:16:45 2025 +0000 + + bumped changelog version + +commit 9bb92e91a8f364a9d9e5d69e907fe8ed8a3c58a2 +Author: Patrick Schleizer +Date: Tue Jan 14 09:16:25 2025 -0500 + + debhelper + +commit 95dd8f419fc7e9832d8ce6f74d35af9b36752f3f +Author: Patrick Schleizer +Date: Tue Jan 14 14:07:50 2025 +0000 + + bumped changelog version + +commit 0a2f06b456854f1cec3ff93952edef928ac7a184 +Author: Patrick Schleizer +Date: Tue Jan 14 09:07:32 2025 -0500 + + use pre.bsh + +commit 6a4f9c1bd8c48bb1a711eee077ea7a05646b0598 +Author: Patrick Schleizer +Date: Tue Jan 14 14:06:50 2025 +0000 + + bumped changelog version + +commit e60183ec073d278f8d69a5475aa52d75870cd9b0 +Author: Patrick Schleizer +Date: Tue Jan 14 09:06:41 2025 -0500 + + output + +commit a812961beabacca052b4b25b78ecd2c35184d5d5 +Author: Patrick Schleizer +Date: Tue Jan 14 09:06:12 2025 -0500 + + verbose + +commit 0e4dfc59dd9c06dd732affd8ca7f72a1a70a95b0 +Author: Patrick Schleizer +Date: Tue Jan 14 13:53:49 2025 +0000 + + bumped changelog version + +commit cdf179f1277bcae3ef681d35aeca6289d55b3a6a +Author: Patrick Schleizer +Date: Tue Jan 14 08:53:38 2025 -0500 + + fix + +commit 41cd09933a506d55bab1f8bf101840cf4bbbf028 +Author: Patrick Schleizer +Date: Tue Jan 14 09:26:05 2025 +0000 + + bumped changelog version + +commit eec2e2c8ee621c6ebb152abbfe3951fa0322a0d0 +Author: Patrick Schleizer +Date: Tue Jan 14 04:13:39 2025 -0500 + + comment + +commit 6d282226ef653accf1de32582b999ff31775f60f +Author: Patrick Schleizer +Date: Tue Jan 14 04:12:12 2025 -0500 + + comment + +commit 466308e4f9ebd496ff54dd9f77881ce10a558802 +Author: Patrick Schleizer +Date: Tue Jan 14 04:09:57 2025 -0500 + + permission hardener: disable SUID for `chrome-sandbox` + +commit 7a5f8b87af7142ce973bd88abf98279ce15559a9 +Author: Patrick Schleizer +Date: Tue Jan 14 04:06:44 2025 -0500 + + permission hardener: disable SUID for `ssh-agent`, `ssh-keysign`, `/lib/openssh/*` + + This might break SSH host-based authentication. + +commit d89ffcde30f6115c25c1bc807eb30b18c21e2b6e +Author: Patrick Schleizer +Date: Tue Jan 14 04:04:09 2025 -0500 + + comment + +commit 9f1759ba0ea7ecee87c8777226eb8a56482deeb5 +Author: Patrick Schleizer +Date: Tue Jan 14 03:56:55 2025 -0500 + + comment + +commit 0ac85ea9f56abdf621ec1b4f2acf08a2450067ba +Author: Patrick Schleizer +Date: Tue Jan 14 03:54:35 2025 -0500 + + comment + +commit fce6a5f8303cd891efd8bbfef861e357dc90e88e +Author: Patrick Schleizer +Date: Tue Jan 14 03:51:43 2025 -0500 + + comment + +commit 1e9940481318d8d7a443b98f0906089759f27a5d +Author: Patrick Schleizer +Date: Tue Jan 14 03:50:16 2025 -0500 + + comment + +commit b198591537a01f5b35c9301ca28a24c70864bcbd +Author: Patrick Schleizer +Date: Tue Jan 14 03:49:42 2025 -0500 + + comment + +commit 7d44db2cb268c4eb31b50bbd44b87b8001dc068c +Author: Patrick Schleizer +Date: Tue Jan 14 03:49:15 2025 -0500 + + usrmerge + +commit 7e7632a55396e10e20a6e9d8d563011694cccc85 +Author: Patrick Schleizer +Date: Tue Jan 14 08:24:05 2025 +0000 + + bumped changelog version + +commit 420cb3f86f69c4505702a8f38271fb095316cb6f +Author: Patrick Schleizer +Date: Tue Jan 14 03:19:21 2025 -0500 + + refactoring + +commit b7e7b2767eb957dd1401f5abcff07bfcb47a4c00 +Author: Patrick Schleizer +Date: Tue Jan 14 03:18:17 2025 -0500 + + refactoring + +commit b2a1a0ec9f8db1d84c222e734737b7ed149f6d92 +Author: Patrick Schleizer +Date: Tue Jan 14 03:17:00 2025 -0500 + + refactoring + +commit 69ae2d9ea0826aa81c70e957bb5a9241a84346ad +Merge: de1f31e3 de9ebabd +Author: Patrick Schleizer +Date: Tue Jan 14 03:15:45 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-migrate' + +commit de9ebabd46798ff2afa259907b6a7b976070e7f0 +Author: Aaron Rainbolt +Date: Mon Jan 13 21:57:10 2025 -0600 + + Fix minor migration bugs, don't run the migration code on new image builds + +commit a9e87e9d308f5e61a2d2054fa038dae6faadad3a +Author: Aaron Rainbolt +Date: Sun Jan 12 21:13:43 2025 -0600 + + Prevent installation failures when installing non-interactively + +commit 5570d3e5b9f97f14c772facff16dc45df66d42e9 +Author: Aaron Rainbolt +Date: Sun Jan 12 20:40:41 2025 -0600 + + Add a forgotten set -e + +commit 07786de03953b91310588e0b37b9e150bf1b4736 +Author: Aaron Rainbolt +Date: Sun Jan 12 19:34:41 2025 -0600 + + Enable smooth migration from permission-hardener-v1 to permission-hardener-v2 + +commit de1f31e3df1a0fba0a4c6e41b9b46e076266cfd4 +Author: Patrick Schleizer +Date: Sun Jan 12 11:47:18 2025 +0000 + + bumped changelog version + +commit b0baa8baa57937358dc988b88adab4858a1d8cae +Author: Patrick Schleizer +Date: Sun Jan 12 05:38:35 2025 -0500 + + add link + +commit d6a7cd3e0d1e677c1fa8c1fb3b307cdbe0f45031 +Author: Patrick Schleizer +Date: Sun Jan 12 05:36:16 2025 -0500 + + formatting. + + use chapter to make allow for deep linking + +commit 485d9abd1d14e445b48f0fd63290a985b05a5ac7 +Author: Patrick Schleizer +Date: Fri Jan 10 15:34:21 2025 +0000 + + bumped changelog version + +commit c17485baa118e76cc8074ce3e72ac3ac38c577cd +Merge: 482960d0 e9ef3602 +Author: Patrick Schleizer +Date: Fri Jan 10 10:32:26 2025 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e9ef3602dd1661de0c0c3781d7e0246720643354 +Merge: 1b33e835 cf435a8f +Author: Patrick Schleizer +Date: Fri Jan 10 10:30:34 2025 -0500 + + Merge pull request #292 from raja-grewal/cpu_table + + Add link to tabular comparison of CPU mitigations + +commit 1b33e83529d652dab4468e0b386e333b3ca4745b +Merge: 486757bf 2e6e1701 +Author: Patrick Schleizer +Date: Fri Jan 10 10:29:30 2025 -0500 + + Merge pull request #291 from raja-grewal/drop_gratuitous_arp + + Drop gratuitous ARP packets + +commit 486757bfae5e7ecc389b16c49704e742fd267565 +Merge: 17ff2491 c37f4efa +Author: Patrick Schleizer +Date: Fri Jan 10 10:29:12 2025 -0500 + + Merge pull request #290 from raja-grewal/arp_ignore + + Respond to ARP requests only if the target IP address is on-link + +commit 17ff24915062736a32d4d54da7163fe34aa70fd3 +Merge: 27d19ba5 1f8eee47 +Author: Patrick Schleizer +Date: Fri Jan 10 10:28:48 2025 -0500 + + Merge pull request #289 from raja-grewal/arp_filter + + Enable ARP filtering + +commit 27d19ba568e601c37035a310ae6cdd7d953be286 +Merge: 482960d0 5e3785d7 +Author: Patrick Schleizer +Date: Fri Jan 10 10:28:05 2025 -0500 + + Merge pull request #288 from raja-grewal/shared_media + + Deny sending and receiving shared media redirects + +commit 482960d056ec8d624f127bfe9b1c69a4c30c7e34 +Author: Patrick Schleizer +Date: Fri Jan 10 10:21:12 2025 -0500 + + permission-hardener: move to new state folder `/var/lib/permission-hardener-v2` without migration + + https://github.com/Kicksecure/security-misc/pull/294 + +commit cf435a8fa8e6f795a25ef004cf44a65d461dd32c +Author: raja-grewal +Date: Fri Jan 10 13:22:21 2025 +1100 + + README.md: Note importance of microcode updates + +commit 3a31cc99b34617cdd3c5f8e8950a37158849cb56 +Merge: c4cfb859 5941195e +Author: Patrick Schleizer +Date: Thu Jan 9 09:30:58 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/usrmerge' + +commit 538b312349a97bcecb12e62519d77840afcd6ca3 +Author: raja-grewal +Date: Thu Jan 9 15:28:56 2025 +1100 + + Add comment about microcode updates + +commit 1f8eee47200221e2e38291a31e852e9c222d8c64 +Author: raja-grewal +Date: Wed Jan 8 18:36:00 2025 +1100 + + Add missing sentence full stop + +commit 5e3785d76e616f49407e720b37138f35a50fe4fb +Author: raja-grewal +Date: Wed Jan 8 18:35:52 2025 +1100 + + README.md: Remove double space + +commit 5941195e96880b8beb2a791d3c21f3a4c6d429eb +Author: Aaron Rainbolt +Date: Tue Jan 7 14:10:46 2025 -0600 + + Don't worry about files under /bin anymore, Bookworm uses a merged /usr directory + +commit c4cfb8597d1a8631a4cbfa7e88212b798e2bc514 +Merge: c6be6219 93ebf176 +Author: Patrick Schleizer +Date: Mon Jan 6 08:43:54 2025 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/permission-hardener-refactor' + +commit c6be621968c898f792ef1a450d2e1be5cd6056da +Author: Patrick Schleizer +Date: Mon Jan 6 10:31:40 2025 +0000 + + bumped changelog version + +commit 6e0787957b53a64132b64e2a29bafe3e4b66d178 +Author: Patrick Schleizer +Date: Mon Jan 6 05:29:40 2025 -0500 + + increase priority of pam wheel so it is checked even before faillock + + in case of attemtping to use `su` without being a member of the required group `sudo`, it's useful to abort the PAM stack as early as possible to avoid needlessly propmting for a password to later + be rejected tu to lack of group membership + +commit d4767b75206b46f1a006cd91b00239a7b828fc89 +Author: Patrick Schleizer +Date: Mon Jan 6 04:24:44 2025 -0500 + + fix: apply PAM wheal only to `su` PAM service + +commit 93ebf176c5f38bd268e5394e01421e46b9ae7dff +Author: Aaron Rainbolt +Date: Thu Jan 2 20:41:40 2025 -0500 + + Make the main field count check in permission-hardener a bit more elegant + +commit 895c0f541fb34f9ebfee9c7ef79c053d5af4a7cc +Merge: 717e6fcf 40b23cfa +Author: Aaron Rainbolt +Date: Wed Jan 1 15:04:01 2025 -0600 + + Merge branch 'master' into arraybolt3/permission-hardener-refactor + +commit 40b23cfad40825eefc3686e562d78250b58bbc82 +Author: Patrick Schleizer +Date: Tue Dec 31 18:42:01 2024 +0000 + + bumped changelog version + +commit 33114f771aaeb4dccb0b465861d1239129deb8b2 +Author: Patrick Schleizer +Date: Tue Dec 31 13:26:21 2024 -0500 + + copyright + +commit bb24bff2965ca31de6337820eafd787a11a44a2b +Author: Patrick Schleizer +Date: Tue Dec 31 14:09:34 2024 +0000 + + bumped changelog version + +commit 0640964c35b0d977ba718629d4a8791e67700202 +Author: Patrick Schleizer +Date: Tue Dec 31 06:14:29 2024 -0500 + + readme + +commit 717e6fcfbea38cef9d3e201cf2e2b725e3da2267 +Author: Aaron Rainbolt +Date: Mon Dec 30 19:23:20 2024 -0600 + + Post-review improvements to permission-hardener + +commit dbcb612517abbf8d162cfb31ba0585c518df8817 +Author: Aaron Rainbolt +Date: Wed Dec 25 19:48:28 2024 -0600 + + Polish permission-hardener refactor + +commit 397b476a822c9f7e41ec911f5d689b67026660ad +Author: Patrick Schleizer +Date: Thu Dec 26 04:12:02 2024 +0000 + + bumped changelog version + +commit 66f8c18c65f33676d242b57ebb1d4410876461b3 +Merge: aa82202e 6602fb10 +Author: Patrick Schleizer +Date: Wed Dec 25 22:43:04 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sysmaint' + +commit 83d386795940099e0835c51f3522aae3d9217dc8 +Author: Aaron Rainbolt +Date: Tue Dec 24 20:14:57 2024 -0600 + + Refactor permission-hardener to be more idempotent + +commit 6602fb102dedc21300ae4c4519f3d9ef4e668045 +Author: Aaron Rainbolt +Date: Tue Dec 24 20:52:34 2024 -0600 + + Adjust pam-info messaging for sysmaint mode + +commit aa82202e701167eacb63eac208469844e983ca43 +Author: Patrick Schleizer +Date: Tue Dec 24 05:16:22 2024 +0000 + + bumped changelog version + +commit 27d015d58ebc5e750d9d06f042b761720473941d +Merge: 3c73c0cd 2f3a2bce +Author: Patrick Schleizer +Date: Tue Dec 24 00:08:58 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sysmaint' + +commit 2f3a2bce7756efe75cd8aaf5066b599b4c49bbdc +Author: Aaron Rainbolt +Date: Fri Dec 20 11:04:22 2024 -0600 + + Add warning about using non-sysmaint accounts in sysmaint mode + +commit 3c73c0cd3a845d1a484551ff50f59e5f2ef56a68 +Author: Patrick Schleizer +Date: Fri Dec 20 06:01:27 2024 +0000 + + bumped changelog version + +commit a4c76c617a18a49168e0ffdba2d8b0ae834f2877 +Author: Patrick Schleizer +Date: Fri Dec 20 01:01:13 2024 -0500 + + syntax fix + +commit b40bc0a2c9b17b3569918a6839bce1c67af5c9df +Author: Patrick Schleizer +Date: Fri Dec 20 05:58:24 2024 +0000 + + bumped changelog version + +commit b21c394ea52401c0d77b6ec396af6a49335f5e0b +Author: Patrick Schleizer +Date: Fri Dec 20 00:56:20 2024 -0500 + + Trigger permission hardener when new configuration files are being installed. + +commit cd027b86e710b6f6b8fac6dd0ebcdcd691e86dd3 +Author: Patrick Schleizer +Date: Fri Dec 20 05:48:48 2024 +0000 + + bumped changelog version + +commit ad6e1f5ad490e12fc5e69b82da5dc1830cc41c96 +Author: Patrick Schleizer +Date: Fri Dec 20 00:41:06 2024 -0500 + + move from `/etc/permission-hardener.d` to `/usr/lib/permission-hardener.d` + +commit a2c1e8c218117a47ef70dd767d753be5d084adfa +Author: Patrick Schleizer +Date: Fri Dec 20 00:39:51 2024 -0500 + + clean up old files in `/etc/permission-hardener.d` + because will be moved to `/usr/lib/permission-hardener.d` + +commit 6de5d2d0763539d6d0d4b19b501bb316ed3b2c94 +Author: Patrick Schleizer +Date: Fri Dec 20 00:37:44 2024 -0500 + + permission hardener: also parse `/usr/lib/permission-hardener.d/*.conf` folder + +commit 721b100fb64136b7c36c8d43c90c716a1fed42d0 +Author: Patrick Schleizer +Date: Thu Dec 19 10:58:50 2024 +0000 + + bumped changelog version + +commit 642b4eeedc43e69bb82ea259b52c0946ce638983 +Author: raja-grewal +Date: Thu Dec 19 21:57:25 2024 +1100 + + Add link to tabular comparison of CPU mitigations + +commit 175b442d5bb9dfcb4e9b524ec2077e72c74598cc +Author: Patrick Schleizer +Date: Thu Dec 19 05:56:50 2024 -0500 + + use long option name + +commit c99021bb0c1d5b6bf361cc483449330cdd218ee6 +Merge: 95b53576 9d69cd19 +Author: Patrick Schleizer +Date: Thu Dec 19 05:56:01 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sysmaint' + +commit 2e6e1701a052ef32711f6c3abaad693a773323f6 +Author: raja-grewal +Date: Thu Dec 19 10:35:08 2024 +0000 + + Set `net.ipv4.conf.*.drop_gratuitous_arp=1` + +commit c37f4efadf8f046168732871172cb66f58eb7c78 +Author: raja-grewal +Date: Thu Dec 19 10:33:49 2024 +0000 + + Set `net.ipv4.conf.*.arp_ignore=2` + +commit af1d06973bdd46af3e39b0bdfda81b950ccac996 +Author: raja-grewal +Date: Thu Dec 19 10:31:43 2024 +0000 + + Set `net.ipv4.conf.*.arp_filter=1` + +commit 750367a9066ca2a0ff819b438a92cb1f6c325edb +Author: raja-grewal +Date: Thu Dec 19 10:29:56 2024 +0000 + + Set `net.ipv4.conf.*.shared_media=0` + +commit 95b535764c8a98b67a71ee1fd57b7f01da464106 +Author: Patrick Schleizer +Date: Thu Dec 19 09:43:26 2024 +0000 + + bumped changelog version + +commit daf0a0900b780a9d44d0d9b49b3fca6ddbd20d18 +Author: Patrick Schleizer +Date: Thu Dec 19 04:39:34 2024 -0500 + + fix apt-get-update for non-English locale + + https://forums.kicksecure.com/t/systemcheck-reports-warning-debian-package-update-check-result-apt-get-reports-that-packages-can-be-updated-but-system-is-already-fully-upgraded/785 + +commit e9a5b14a0db6f071424c19e6f4b006386afb6ab4 +Author: Patrick Schleizer +Date: Thu Dec 19 06:57:42 2024 +0000 + + bumped changelog version + +commit 3135a03e21f9e5816097e25aaa7f4a1671f8f87d +Merge: f0c611d9 c7f71964 +Author: Patrick Schleizer +Date: Thu Dec 19 00:34:56 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit c7f7196471b07a580c6d4a5d86739215508142cd +Merge: e5b67e04 3749f8ff +Author: Patrick Schleizer +Date: Thu Dec 19 00:31:25 2024 -0500 + + Merge pull request #287 from raja-grewal/patch + + Refactor and add two CPU mitigations + +commit f0c611d9edb5fd7a3e00d13b248c65abda2c9d8a +Author: Patrick Schleizer +Date: Thu Dec 19 00:18:25 2024 -0500 + + comment + +commit 4f681be77429984695a1b0f689065051884e7bf7 +Merge: 4c3ca684 4cf57575 +Author: Patrick Schleizer +Date: Thu Dec 19 00:17:44 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit e5b67e044bb5011dd667879a73a670f2c5f74057 +Merge: 4cf57575 c1167968 +Author: Patrick Schleizer +Date: Thu Dec 19 00:15:02 2024 -0500 + + Merge pull request #279 from raja-grewal/arp + + Provide network-related hardening options via `sysctl`'s + +commit 4cf5757575c1257a14331f0169a9d8d163e1326d +Merge: 9d06341c 1708a03e +Author: Patrick Schleizer +Date: Thu Dec 19 00:08:56 2024 -0500 + + Merge pull request #282 from ArrayBolt3/arraybolt3/umask + + Enable umask hardening + +commit 9d69cd1912ab657e7916b38f56b477c2b7abd0a3 +Author: Aaron Rainbolt +Date: Wed Dec 18 21:34:16 2024 -0600 + + Add sysmaint account lock detection + +commit 3749f8ff097551a843e5ed80de52c6770a32e0c6 +Author: raja-grewal +Date: Wed Dec 18 03:36:09 2024 +0000 + + Update presentation on user namespaces + +commit 0dff2cd28fd769955757cdef1b7f9d637a1180c5 +Author: raja-grewal +Date: Wed Dec 18 03:32:35 2024 +0000 + + Minor additions + +commit 3e96fdd9ccb6268403d6c4f9a061c4a33e6f6dd2 +Author: raja-grewal +Date: Tue Dec 17 11:44:11 2024 +0000 + + Enable `kvm.mitigate_smt_rsb=1` + +commit 45355aabdc180a6a2fdd4a374c6f7d72f4d36240 +Author: raja-grewal +Date: Tue Dec 17 11:42:52 2024 +0000 + + Enable `kvm-intel.vmentry_l1d_flush=always` + +commit defba1f2450b2c8bbc668bf5f6f6f0d101338cc7 +Author: raja-grewal +Date: Tue Dec 17 11:42:03 2024 +0000 + + Refactor CPU mitigations + +commit 943c421889ce5dfe3869380e4587ca22724f2ce7 +Author: raja-grewal +Date: Tue Dec 17 11:40:38 2024 +0000 + + Minor refactoring + +commit ca3a73ac13d805515f71f1be7ecedc33d3a1b519 +Author: raja-grewal +Date: Tue Dec 17 11:37:10 2024 +0000 + + Typo + +commit 4c3ca68453b44074025a1ec9f31451c57344f3cf +Author: Aaron Rainbolt +Date: Mon Dec 9 12:37:11 2024 -0600 + + Disable unnecessary sudoers exceptions + +commit 9d06341c91b51f9c737fe67457045924323635f0 +Merge: a9dd592a 5b88e92e +Author: Patrick Schleizer +Date: Sat Dec 14 15:18:56 2024 -0500 + + Merge pull request #285 from Kicksecure/permission-hardener-mount + + Permission Hardener: treat mount same as umount + +commit c1167968542a62d0677517e11505f6e9222ec378 +Author: raja-grewal +Date: Thu Dec 12 06:36:47 2024 +0000 + + `arp_ignore`: Add reference to 2024-12-10 Mullvad VPN audit details + +commit a9dd592a8b49226f326e90111178aebba3cc144f +Author: Patrick Schleizer +Date: Tue Dec 10 19:19:10 2024 +0000 + + bumped changelog version + +commit 58722324ec0be98c3e44938df8cb60ca9b261210 +Merge: 518224b8 439fa7f3 +Author: Patrick Schleizer +Date: Tue Dec 10 14:18:50 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/no-recovery-mode' + +commit 518224b8cf9e99a830b584d8d54b5dea2925c8f5 +Author: Patrick Schleizer +Date: Tue Dec 10 19:17:10 2024 +0000 + + bumped changelog version + +commit 439fa7f3be74f5eba4b98f73c0bb50fd37e8b0e1 +Author: Aaron Rainbolt +Date: Sun Dec 8 03:21:27 2024 -0600 + + Harden/disable recovery mode options + +commit 7902311c570edd4286ba36f0cb85223d1e909a03 +Author: Patrick Schleizer +Date: Sat Dec 7 04:54:47 2024 -0500 + + do not create /etc/sysctl.d/30-lkrg-virtualbox.conf if LKRG is not installed + +commit 1ce37d42cd2c132eca8c45ddb04fdb594349d08f +Author: Patrick Schleizer +Date: Sat Dec 7 04:50:40 2024 -0500 + + . + +commit 5b88e92e5c4b951e659e1574fc248bd11158dfb2 +Author: Patrick Schleizer +Date: Fri Dec 6 09:48:58 2024 -0500 + + permission hardner: treat `mount` the same way we treat `umount` + + Thanks to @the-moog for the bug report! + + fixes https://github.com/Kicksecure/security-misc/issues/284 + +commit 93b51819d4693955936456916188b4118fe68a66 +Author: Patrick Schleizer +Date: Fri Dec 6 09:47:08 2024 -0500 + + permission hardener mount chmod change from `745` to `755` + + https://github.com/Kicksecure/security-misc/issues/284 + +commit 1708a03e1edda821ef091f10c46d32f740511d38 +Author: Aaron Rainbolt +Date: Thu Nov 28 15:20:57 2024 -0600 + + Enable umask hardening + +commit 59299a6639fef31565b8f3cef857c9faa331e0f7 +Author: Patrick Schleizer +Date: Mon Nov 25 21:07:42 2024 +0000 + + bumped changelog version + +commit 98d7c245ee11f16e566422a17543aaed2c155d88 +Author: Patrick Schleizer +Date: Mon Nov 25 15:57:30 2024 -0500 + + "|| exit 1" no longer required thanks to errexit + +commit f9b5d7d3f4f2ed8d1baae67d8427f13cf26aee8d +Author: Patrick Schleizer +Date: Mon Nov 25 15:48:01 2024 -0500 + + use strict shell options + +commit d32cb8c95b09721e52c4d682a0ddd39d590a4368 +Author: Patrick Schleizer +Date: Mon Nov 25 15:44:00 2024 -0500 + + use TMP, sponge, refactoring + +commit 62a551cfe39a6a640f32e6e97f3e915aa8673514 +Merge: af43472d d7475e25 +Author: Patrick Schleizer +Date: Mon Nov 25 15:38:01 2024 -0500 + + Merge remote-tracking branch 'ArrayBolt3/arraybolt3/sudoers' + +commit d7475e252a64e296913ed8893261e52e72163d55 +Author: Aaron Rainbolt +Date: Thu Nov 21 20:03:42 2024 -0600 + + Make apt-get-update able to be terminated securely + +commit af43472d0ccdecb1725a200d10aeeb1b8d51f31a +Author: Patrick Schleizer +Date: Thu Nov 14 22:24:50 2024 +0000 + + bumped changelog version + +commit c7e9460b2ae8dcb96196fef69a7e0ed992c1b43b +Author: Patrick Schleizer +Date: Thu Nov 14 16:31:12 2024 -0500 + + output + +commit 31804e30ecc9c5a1c5a8e1e014d3dcb85cee4f36 +Author: Patrick Schleizer +Date: Thu Nov 14 20:46:26 2024 +0000 + + bumped changelog version + +commit ef95b3f9a5aed9652c541cf4bf05b20011718466 +Author: Patrick Schleizer +Date: Thu Nov 14 14:41:14 2024 -0500 + + Revert "fix `panic-on-oops.service`" + + This reverts commit 862d23cb10b7687084f8e7e207d1e2c9c1ef6751. + +commit 412b371e85044962f6620386b767369b9e25d71e +Merge: 141b84c4 57e1edde +Author: raja-grewal +Date: Wed Nov 13 16:47:57 2024 +1100 + + Merge branch 'Kicksecure:master' into arp + +commit 141b84c40de76988ec78bdccf1c1d67fc4367b3f +Author: raja-grewal +Date: Wed Nov 13 05:42:56 2024 +0000 + + Provide option to deny sending and receiving shared media redirects + +commit 18aec201bfb0477fee8800ad1388099e11920016 +Author: raja-grewal +Date: Wed Nov 13 05:41:25 2024 +0000 + + Provide option to harden response to ARP requests + +commit a25d4f8df88908e83e56049204aa625f1196a948 +Author: raja-grewal +Date: Wed Nov 13 05:40:21 2024 +0000 + + Provide option to enable ARP filtering + +commit c2aae73ce161811571e4c85609a0b043399c1b65 +Author: raja-grewal +Date: Wed Nov 13 05:38:03 2024 +0000 + + Add reference and move text + +commit 57e1edde23aa3f313ce087e00ebc14d158356d6c +Author: Patrick Schleizer +Date: Tue Nov 12 09:11:57 2024 +0000 + + bumped changelog version + +commit 7987a3914d364e674eb7479b15708c450041af02 +Author: Patrick Schleizer +Date: Tue Nov 12 02:29:42 2024 -0500 + + deleted no longer used and out-commented `/etc/sudoers.d/xfce-security-misc` leftover + +commit 8c2e8e69798e5255529ab3dbee6ca07b8b293100 +Author: Patrick Schleizer +Date: Tue Nov 12 01:41:12 2024 -0500 + + deleted no longer used and out-commented `etc/sudoers.d/pkexec-security-misc` leftover + +commit 65fc0419a84d62e07c61d7e37ef27d144b6b6794 +Author: Patrick Schleizer +Date: Mon Nov 11 11:07:57 2024 +0000 + + bumped changelog version + +commit 50161f5d79eea2ab796863e4eb30eccc17e0b41d +Author: Patrick Schleizer +Date: Mon Nov 11 05:48:11 2024 -0500 + + moved /etc/dkms/framework.conf.d/30_security-misc.conf (renamed) to usability-misc + +commit 7c06e22c7d11c345428f3ad42ba43805ebc8d810 +Author: Patrick Schleizer +Date: Mon Nov 11 05:43:25 2024 -0500 + + deleted `/usr/bin/pkexec.security-misc` + + This was not used anymore for anything. In the past, we used to `config-package-dev` `replace` `/usr/bin/pkexec` with `/usr/bin/pkexec.security-misc` for the purpose of: + + > Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with hidepid. + + * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 + * https://forums.whonix.org/t/cannot-use-pkexec/8129 + + This was a worthwhile effort, interesting approach but ultimately a dead-end. + +commit ef05b1a160b24d5aa42da9cc15009d94a37cf120 +Author: Patrick Schleizer +Date: Mon Nov 11 05:40:41 2024 -0500 + + disable legacy matroxfb_base framebuffer driver + + fix typo matroxfb_bases -> matroxfb_base + + Thanks to @ArrayBolt3 for the bug report! + +commit 862d23cb10b7687084f8e7e207d1e2c9c1ef6751 +Author: Patrick Schleizer +Date: Mon Nov 11 05:36:41 2024 -0500 + + fix `panic-on-oops.service` + + remove `After=multi-user.target` because already using `WantedBy=multi-user.target` + + Thanks to @ArrayBolt3 for the bug report! + +commit 29ae5f5980d521f6a4b468f5bf41210f78fdf10a +Author: Patrick Schleizer +Date: Mon Nov 11 05:28:31 2024 -0500 + + fix optional opt-in `harden-module-loading.service` + + by making `/usr/libexec/security-misc/disable-kernel-module-loading` executable + + Thanks to @ArrayBolt3 for the bug report! + +commit 4c649577f053af12bcd02c20576bf2d8aec1476d +Author: Patrick Schleizer +Date: Sun Nov 10 11:52:42 2024 +0000 + + bumped changelog version + +commit 29b1f1ec5f3a4bf3991fc1b862751c8eb9769ecd +Merge: 5bd0a277 238f32e8 +Author: Patrick Schleizer +Date: Sun Nov 10 06:32:30 2024 -0500 + + Merge remote-tracking branch 'github-kicksecure/master' + +commit 5bd0a277bf39812c6adf40a7a3ef6390935fa08e +Author: Patrick Schleizer +Date: Sun Nov 10 06:29:17 2024 -0500 + + fix permission-hardener issue "Removing capabilities failed. File: '/bin/ping'" + + no longer user end-of-options marker (`--`) for `setcap` + since setcap does not support it + + Fixes https://github.com/QubesOS/qubes-issues/issues/9569 + + https://forums.whonix.org/t/permission-hardener-error/20719 + +commit 238f32e81d835e5b9d3bc43a0654d05efa4c4313 +Merge: 3af26841 8107782f +Author: Patrick Schleizer +Date: Fri Nov 8 07:39:40 2024 -0500 + + Merge pull request #280 from raja-grewal/ssbd + + Enable `ssbd=force-on` + +commit 8107782fa54ec0e21893e6bd4a6baabb71eb864b +Author: raja-grewal +Date: Fri Nov 8 15:36:04 2024 +1100 + + Enable `ssbd=force-on` + +commit a1d1f97955fd9fd3cee77dc04e2eb5e5fa29d243 +Author: raja-grewal +Date: Fri Nov 8 03:58:23 2024 +0000 + + Provide option to drop gratuitous ARP packets + +commit 3af2684134279ba6f5b18b40986f02a50baa5604 +Author: Patrick Schleizer +Date: Wed Oct 30 09:43:05 2024 +0000 + + bumped changelog version + +commit 71c58442ca6d57cd95b72a76ed87f8c248cdbd98 +Author: Patrick Schleizer +Date: Mon Oct 28 05:10:19 2024 -0400 + + minor + +commit cfe19e31d858d7899f4d95e21117c992d236d328 +Author: Patrick Schleizer +Date: Mon Oct 28 05:09:53 2024 -0400 + + shell options + +commit 0d506156587f87a303184f22259ffb57dd92cbc8 +Author: Patrick Schleizer +Date: Mon Oct 28 05:07:00 2024 -0400 + + local + +commit ef0eb5f7a0c5a62c5d26bf6dc534f6aa3decc4b0 +Author: Patrick Schleizer +Date: Mon Oct 28 05:06:26 2024 -0400 + + refactoring + +commit fdd1f4b7f88efc22bb57c2ad3e83c0c2e8cbb064 +Author: Patrick Schleizer +Date: Mon Oct 28 05:06:05 2024 -0400 + + refactoring + +commit d00235897d686895a7e2e7da7435832fee008164 +Author: Patrick Schleizer +Date: Mon Oct 28 05:03:59 2024 -0400 + + hide-hardware-info: also parse `/usr/local/etc/hide-hardware-info.d/*.conf` + +commit 6c2e808b9f34900840bd2857fed10d1ffd4cc4c2 +Author: Patrick Schleizer +Date: Mon Oct 28 05:03:20 2024 -0400 + + refactoring + +commit b44e507900defe3db68f31f3e110b1c3e5aa684c +Author: Patrick Schleizer +Date: Wed Oct 23 09:56:05 2024 +0000 + + bumped changelog version + +commit 566cda5e4bc69f54d63d72f1e30703074fdf0ce8 +Author: Patrick Schleizer +Date: Mon Oct 21 05:47:38 2024 -0400 + + output + +commit 5991a23049491dd04c19d9ea80f7d7381dd494a0 +Author: Patrick Schleizer +Date: Mon Oct 21 05:47:25 2024 -0400 + + comment + +commit fd34baff8ff17ed572469d9d6d884e6c0d881d20 +Merge: b6433309 690e8dd8 +Author: Patrick Schleizer +Date: Mon Oct 21 05:43:53 2024 -0400 + + Merge remote-tracking branch 'ArrayBolt3/master' + +commit 690e8dd826d1cb39c0c12c03792781862cc2dd23 +Author: Aaron Rainbolt +Date: Sat Oct 19 23:49:07 2024 -0500 + + Avoid faillock lock/tally reset on reboot or timeout + +commit b6433309fd7d6839cfba89e1197590e1ff62ef58 +Author: Patrick Schleizer +Date: Fri Oct 18 12:45:02 2024 -0400 + + use end-of-options + +commit 0cfcdf4f89dc75f2a8e3f8a9e8c69dc3ba3da78a +Author: Patrick Schleizer +Date: Wed Oct 16 10:57:20 2024 +0000 + + bumped changelog version + commit 0adb9b7c0609a51d503b61ab40ae7d8e55635043 -Merge: 263335f e50ad80 +Merge: 263335f7 e50ad807 Author: Patrick Schleizer Date: Wed Oct 16 06:31:09 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit e50ad807c01b5753c67d579126d7b79d38070c0a -Merge: 263335f eb72163 +Merge: 263335f7 eb72163d Author: Patrick Schleizer Date: Wed Oct 16 06:29:25 2024 -0400 Merge pull request #276 from raja-grewal/KSPP_header - + Clarify KSPP compliance header commit eb72163d5707c7673db1f12405d2e04261bd43c8 @@ -39,23 +7942,23 @@ Date: Tue Oct 8 11:24:56 2024 +0000 bumped changelog version commit 9169611645d0cd5a308ff48862f351ef5ea5f7e8 -Merge: 8a2d432 8227a3d +Merge: 8a2d432f 8227a3dd Author: Patrick Schleizer Date: Tue Oct 8 05:54:50 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 8227a3dde2995ceb113164baf49591d52c2b53e1 -Merge: 8a2d432 0c0774f +Merge: 8a2d432f 0c0774f6 Author: Patrick Schleizer Date: Tue Oct 8 05:53:48 2024 -0400 Merge pull request #273 from raja-grewal/text_2 - + Documentation update 2 commit 0c0774f6c0927ed1cc599f931175985b8f01ec30 -Merge: dc470ca 8a2d432 +Merge: dc470cac 8a2d432f Author: raja-grewal Date: Sun Oct 6 10:48:52 2024 +0000 @@ -78,9 +7981,9 @@ Author: Patrick Schleizer Date: Thu Oct 3 02:58:58 2024 -0400 no longer set `kernel.unprivileged_userns_clone=0` - + because it breaks too much - + fixes https://github.com/Kicksecure/security-misc/issues/274 commit f401d94d5e0d0f26e93be55deda440fe565a6b22 @@ -88,7 +7991,7 @@ Author: Patrick Schleizer Date: Thu Oct 3 02:44:06 2024 -0400 expand documentation on `kernel.unprivileged_userns_clone=0` sysctl - + https://github.com/Kicksecure/security-misc/issues/274 commit ac1378743c7448c9a7e7e02bebcf3270592d42a5 @@ -122,19 +8025,19 @@ Date: Wed Sep 25 01:03:42 2024 +0000 bumped changelog version commit e04f9cd4c17305d5201aa973c34778e81508734b -Merge: 18d426f 65aa910 +Merge: 18d426f5 65aa9105 Author: Patrick Schleizer Date: Tue Sep 24 20:16:06 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 65aa910503c07f708abf20f78be2f519ef58764a -Merge: 18d426f 870ff88 +Merge: 18d426f5 870ff886 Author: Patrick Schleizer Date: Tue Sep 24 20:15:03 2024 -0400 Merge pull request #272 from raja-grewal/text - + Documentation update commit 870ff88605b8167c8882162cc3da005d71ca0cd3 @@ -160,12 +8063,12 @@ Author: Patrick Schleizer Date: Fri Sep 13 22:52:47 2024 -0400 Fix VirtualBox audio device ICH AC97. - + no longer `blacklist snd_intel8x0` - + Breaks VirtualBox audio device ICH AC97, which is unfortunately still required by some users. https://www.kicksecure.com/wiki/Dev/audio - + Fixes https://github.com/Kicksecure/security-misc/issues/271 commit 1bc694fa124eaeb6e1517d2191a8fd97446872c4 @@ -185,7 +8088,7 @@ Author: Patrick Schleizer Date: Thu Sep 5 06:03:05 2024 -0400 add KSPP compliance status to readme based on comment by @raja-grewal - + https://github.com/Kicksecure/security-misc/issues/256#issuecomment-2330376651 commit 40fb14c654df94e9bdfb30ae55fc3bc4f0a0aef4 @@ -195,44 +8098,44 @@ Date: Wed Sep 4 14:13:15 2024 +0000 bumped changelog version commit 5a255d4831470449a26b324a8f16594432bf834b -Merge: d618f9f 563a898 +Merge: d618f9f3 563a8980 Author: Patrick Schleizer Date: Wed Sep 4 10:12:34 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 563a8980133e15e33ac95a631e37ecfff88f6f8f -Merge: 175945e e61027a +Merge: 175945ec e61027a4 Author: Patrick Schleizer Date: Wed Sep 4 10:11:48 2024 -0400 Merge pull request #265 from raja-grewal/mmap_min_addr - + Set `sysctl vm.mmap_min_addr=65536` commit d618f9f35b8e8c6eee1e164a6ec300d63b1ee797 -Merge: 59374ce 175945e +Merge: 59374ce9 175945ec Author: Patrick Schleizer Date: Wed Sep 4 10:07:50 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 175945ec9a28bf1e5b0fa0d2ae2bd6546d6c6172 -Merge: b0a8544 3101035 +Merge: b0a85441 3101035a Author: Patrick Schleizer Date: Wed Sep 4 10:05:47 2024 -0400 Merge pull request #268 from raja-grewal/panic_on_warn - + Enable `panic_on_warn=1` commit b0a8544182f6ff3c8c3f1068176ff5e9e4f557ef -Merge: 59374ce 7393ba1 +Merge: 59374ce9 7393ba15 Author: Patrick Schleizer Date: Wed Sep 4 10:04:45 2024 -0400 Merge pull request #270 from raja-grewal/typo - + Small typo commit 7393ba159192fdfc45ef31a3fa60786f899dbf25 @@ -248,19 +8151,19 @@ Date: Thu Aug 29 09:49:51 2024 +0000 bumped changelog version commit 7e2838ec077b53e41d468d5655290152761c8745 -Merge: 9c918eb 0762794 +Merge: 9c918eb4 0762794f Author: Patrick Schleizer Date: Thu Aug 29 05:06:07 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 0762794ff684049a62b5b92b61177615a5376ad7 -Merge: 9c918eb 6294729 +Merge: 9c918eb4 6294729c Author: Patrick Schleizer Date: Thu Aug 29 04:46:26 2024 -0400 Merge pull request #269 from raja-grewal/tidy - + Minor correction commit 6294729c8ef24077cd342b4557653806c3aacd34 @@ -287,27 +8190,27 @@ Date: Wed Aug 28 06:49:50 2024 -0400 no longer set sysctl `fs.binfmt_misc.status=0` / no longer disallow registering interpreters for miscellaneous binary formats - + causing file/folder permissions issue `d????????? ? ? ? ? ? .` - + Firefox no longer starting (probably not not a Firefox issue) - + https://github.com/Kicksecure/security-misc/issues/267 commit 463aa58f28b6389d0925fed87096b348b652cc16 -Merge: cf824dd 328840c +Merge: cf824ddb 328840c9 Author: Patrick Schleizer Date: Wed Aug 28 06:42:49 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 328840c933a583adc5458aa08c63fb627b31b298 -Merge: cf824dd 9e91c98 +Merge: cf824ddb 9e91c98c Author: Patrick Schleizer Date: Wed Aug 28 06:38:57 2024 -0400 Merge pull request #264 from raja-grewal/kspp_compliance - + Add KSPP compliance notices to corresponding parameters and `sysctls` commit 9e91c98cc926e7a166458cd78e3c1d1ced23c753 @@ -335,7 +8238,7 @@ Date: Mon Aug 26 11:19:20 2024 +1000 Add detail on disabling user namespaces breaking UPower commit 9dbd200be415c86e7039463c6269fad8395a4373 -Merge: 32de5e7 cf824dd +Merge: 32de5e7c cf824ddb Author: raja-grewal Date: Mon Aug 26 11:08:21 2024 +1000 @@ -348,30 +8251,30 @@ Date: Sun Aug 25 15:34:55 2024 +0000 bumped changelog version commit 500568e322b2e3623fc649209d671c7b9d9fa097 -Merge: 43d13b7 73900b5 +Merge: 43d13b70 73900b59 Author: Patrick Schleizer Date: Sun Aug 25 11:01:58 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 73900b59db37d77bc24bd5088aae3cc760aacc69 -Merge: 43d13b7 1f51d4e +Merge: 43d13b70 1f51d4ee Author: Patrick Schleizer Date: Sun Aug 25 11:00:51 2024 -0400 Merge pull request #263 from raja-grewal/max_user_namespaces - + Provide option to disable user namespaces commit 43d13b70f12d2198a800054ce4d1ff901cc474f9 -Merge: 8353764 fae586c +Merge: 83537641 fae586c3 Author: Patrick Schleizer Date: Sun Aug 25 10:55:52 2024 -0400 Merge remote-tracking branch 'raja/syntax' commit 835376418d616699023f8e638666f43d34241863 -Merge: ae85fd5 342caf8 +Merge: ae85fd5b 342caf82 Author: Patrick Schleizer Date: Sun Aug 25 10:48:25 2024 -0400 @@ -480,51 +8383,51 @@ Date: Fri Aug 16 08:38:12 2024 +0000 bumped changelog version commit 40b12f5a2a4a40d7033569b11ad4e1c228e7389b -Merge: 12296c6 305467c +Merge: 12296c68 305467c6 Author: Patrick Schleizer Date: Fri Aug 16 04:30:29 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 305467c652af933bb5aa5a677b10a992a5f19cab -Merge: 12296c6 a5373af +Merge: 12296c68 a5373afc Author: Patrick Schleizer Date: Fri Aug 16 04:25:43 2024 -0400 Merge pull request #245 from raja-grewal/blacklist_to_disable - + Update `/etc/modprobe.d/*` commit 12296c68dc0aaa3703e1c36f854a02de8db412fe -Merge: 4bc12b0 036bcea +Merge: 4bc12b07 036bcea4 Author: Patrick Schleizer Date: Fri Aug 16 04:22:43 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 036bcea4e6757de094fcafdadcf56aaa90729d79 -Merge: ef60c5b 81bf7a8 +Merge: ef60c5b1 81bf7a8f Author: Patrick Schleizer Date: Fri Aug 16 04:20:32 2024 -0400 Merge pull request #262 from raja-grewal/docs - + Miscellaneous updates to presentation commit 81bf7a8f90098a7107dcb3c783b87a168f5c090f -Merge: cea8e75 ef60c5b +Merge: cea8e753 ef60c5b1 Author: raja-grewal Date: Fri Aug 16 16:57:01 2024 +1000 Merge branch 'Kicksecure:master' into docs commit ef60c5b153a521e1cfd522ac471a8ca6dc076d90 -Merge: 4bc12b0 b552b92 +Merge: 4bc12b07 b552b924 Author: Patrick Schleizer Date: Fri Aug 16 02:43:57 2024 -0400 Merge pull request #249 from raja-grewal/binfmt_misc - + Disallow registering interpreters for miscellaneous binary formats commit cea8e753786d100ebe961ad74a99925e54d47771 @@ -564,7 +8467,7 @@ Date: Fri Aug 16 12:41:36 2024 +1000 Clarify DMA hardening commit be9308e490f79a7b7788a744524d1d91cc870726 -Merge: 73db68d 4bc12b0 +Merge: 73db68db 4bc12b07 Author: raja-grewal Date: Fri Aug 16 11:45:43 2024 +1000 @@ -577,19 +8480,19 @@ Date: Thu Aug 15 17:51:18 2024 +0000 bumped changelog version commit 9e61e37c17524b57f185b796f2ac19ba193205a8 -Merge: 89e816d dfd1c97 +Merge: 89e816dd dfd1c971 Author: Patrick Schleizer Date: Thu Aug 15 13:47:33 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit dfd1c97168249b229495cbd873d4d8493e244663 -Merge: 89e816d ec3038c +Merge: 89e816dd ec3038c7 Author: Patrick Schleizer Date: Thu Aug 15 13:46:30 2024 -0400 Merge pull request #248 from raja-grewal/secure_redirects - + Re-enable (default) `secure_redirects` for ICMP redirect messages commit b552b92401f67d59e12ac6fda2f7fe1c54b0c8a7 @@ -603,7 +8506,7 @@ Author: Raja Grewal Date: Thu Aug 15 11:46:56 2024 +1000 Revert "Provide optional `sysctl fs.binfmt_misc.status=0`" - + This reverts commit debd7a7b7ae8b03e04d2c8597bcccf2c79000570. commit 73db68dbf9a1f9ded95a593db36a4960ce06a173 @@ -691,46 +8594,46 @@ Date: Tue Aug 6 14:01:39 2024 +0000 bumped changelog version commit 967f9e257b09bc73ddb579292d507f7cb9832643 -Merge: fa90918 a25aaf9 +Merge: fa909186 a25aaf90 Author: Patrick Schleizer Date: Tue Aug 6 09:57:56 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit a25aaf900a12666046278a9fab6933b3d5670679 -Merge: 6bc039a 8559079 +Merge: 6bc039a4 85590793 Author: Patrick Schleizer Date: Tue Aug 6 09:55:20 2024 -0400 Merge pull request #260 from raja-grewal/vdso32 - + Enable `vdso32=0` commit 6bc039a430289342f06857a52a5f13829d6e50f5 -Merge: ce60d56 d102ec1 +Merge: ce60d561 d102ec19 Author: Patrick Schleizer Date: Tue Aug 6 09:52:56 2024 -0400 Merge pull request #259 from raja-grewal/kfence - + Enable `kfence.sample_interval=100` commit ce60d5615fe99e41c48d459f562d581a688c295a -Merge: b027842 c0d140f +Merge: b0278428 c0d140f2 Author: Patrick Schleizer Date: Tue Aug 6 09:48:08 2024 -0400 Merge pull request #258 from raja-grewal/legacy_tiocsti - + Enable `dev.tty.legacy_tiocsti=0` commit b0278428a73cd3d329aaa36626005e0c593331f0 -Merge: fa90918 aa34d86 +Merge: fa909186 aa34d865 Author: Patrick Schleizer Date: Tue Aug 6 09:39:04 2024 -0400 Merge pull request #257 from raja-grewal/slab_debug - + Enable `slab_debug=FZ` commit 8559079312adb4ed92e5f478120b408dfe7a1124 @@ -764,51 +8667,51 @@ Date: Mon Aug 5 14:16:33 2024 +1000 Add reference commit fa9091869d417c6494840d0cb32623037d70c8be -Merge: 06f0c27 725118c +Merge: 06f0c271 725118c5 Author: Patrick Schleizer Date: Sun Aug 4 16:20:36 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 725118c5759b45118bbd2804492526ea2a7c1a81 -Merge: 6d97408 6d211fa +Merge: 6d97408a 6d211faf Author: Patrick Schleizer Date: Sun Aug 4 16:19:52 2024 -0400 Merge pull request #243 from raja-grewal/namespaces - + Restrict unprivileged user namespaces commit 06f0c27128a66c1074f405de3139651519e48204 -Merge: 8abc5ae 6d97408 +Merge: 8abc5ae8 6d97408a Author: Patrick Schleizer Date: Sun Aug 4 16:15:01 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 6d97408a6d2f002461ae6ca1d647fbf24bf1b99e -Merge: 8abc5ae 6f14d68 +Merge: 8abc5ae8 6f14d68c Author: Patrick Schleizer Date: Sun Aug 4 16:11:46 2024 -0400 Merge pull request #255 from raja-grewal/SLUB - + Restore option to enable `slub_debug=FZ` commit 8abc5ae8f0f152c68f855f0e8d993880589c5d5c -Merge: de6f3ea eab66da +Merge: de6f3ea7 eab66dad Author: Patrick Schleizer Date: Sun Aug 4 16:09:52 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit eab66dad0994e408c1beaade3fdcf2cd1d605b31 -Merge: de6f3ea ca2179b +Merge: de6f3ea7 ca2179bb Author: Patrick Schleizer Date: Sun Aug 4 16:08:32 2024 -0400 Merge pull request #254 from raja-grewal/patch - + Updates to kernel and `sysctl` hardening commit 6f14d68cdcad3784311e33029eba6906ea0784c2 @@ -828,7 +8731,7 @@ Author: Raja Grewal Date: Sat Aug 3 14:49:48 2024 +1000 Revert "Remove the optional `slub_debug` parameter since it is no longer recommended" - + This reverts commit 48e1ac416314d2c66f3a0d5044a3c51cb6fb4093. commit ca2179bb6a01e3ebbb1e04e3507cc305f25bca4e @@ -868,19 +8771,19 @@ Date: Sun Jul 28 20:50:22 2024 +0000 bumped changelog version commit d036094089e3e3a74df981c50882481273fcb6c0 -Merge: e60ce50 0f86fbd +Merge: e60ce50d 0f86fbd8 Author: Patrick Schleizer Date: Sun Jul 28 15:44:40 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 0f86fbd8ceea3157ee035eb9f4a0ff13024f1bc9 -Merge: e60ce50 73979d4 +Merge: e60ce50d 73979d43 Author: Patrick Schleizer Date: Sun Jul 28 15:43:54 2024 -0400 Merge pull request #242 from raja-grewal/ptrace - + Disable the usage of `ptrace()` by all processes commit 9cabaa1bd15a0639c87bf2e965755d06ff0a7bb4 @@ -930,7 +8833,7 @@ Author: Raja Grewal Date: Sat Jul 27 13:24:08 2024 +1000 Revert "Disable the usage of `ptrace()` by all processes" - + This reverts commit b04828f858fa6d101099773d3156841fd6d33b6f. commit 330cf14eab248d035fa467dba4f7bc3eb92a33bb @@ -940,35 +8843,35 @@ Date: Fri Jul 26 15:40:24 2024 +0000 bumped changelog version commit 62bb4bc6269a0603c15f1efaad7ca365ea15c9d7 -Merge: 7969e86 886f609 +Merge: 7969e860 886f6095 Author: Patrick Schleizer Date: Fri Jul 26 11:10:25 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 886f6095dba71d76d5fd98277374417657e0cd31 -Merge: 7969e86 ed33366 +Merge: 7969e860 ed333669 Author: Patrick Schleizer Date: Fri Jul 26 11:08:30 2024 -0400 Merge pull request #250 from raja-grewal/Panik-Kalm - + Add details on "oopes" and kernel panics commit 7969e8607160eae0cb5a3adddeec8d07c1d6e097 -Merge: e2ae93a 0318f57 +Merge: e2ae93a9 0318f577 Author: Patrick Schleizer Date: Fri Jul 26 11:06:13 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 0318f577ab554ae2ac0f9417b18134723ea2b580 -Merge: e2ae93a 4397de0 +Merge: e2ae93a9 4397de01 Author: Patrick Schleizer Date: Fri Jul 26 11:04:29 2024 -0400 Merge pull request #246 from raja-grewal/cfi - + Provide the option to change the default CFI implementation in the future commit e2ae93a9571f2f0c9077ea61436a540a3be5a894 @@ -1008,7 +8911,7 @@ Date: Fri Jul 26 10:16:20 2024 -0400 use `find` with `safe_echo_nonewline` commit 20454fb81157f1f962f36d9c37d34f4ac650a1e6 -Merge: 28b25bd 6bbf176 +Merge: 28b25bda 6bbf176e Author: raja-grewal Date: Sat Jul 27 00:09:30 2024 +1000 @@ -1037,7 +8940,7 @@ Author: Patrick Schleizer Date: Fri Jul 26 08:58:44 2024 -0400 Skip file names starting with '--', - + because this would be interpreted by dpkg-statoverride as an option. commit 82d401a7de58b74448113bed36c8f0cc073c7f82 @@ -1117,7 +9020,7 @@ Author: Patrick Schleizer Date: Fri Jul 26 08:07:08 2024 -0400 code simplification - + https://github.com/Kicksecure/security-misc/pull/251 commit 9694cf0cd1a225c68d45814e0f4d6995659a0066 @@ -1127,7 +9030,7 @@ Date: Fri Jul 26 07:43:59 2024 -0400 output commit bdfe764f9d805b14dca4196e623e81ce95145d9b -Merge: 9f13523 652a06c +Merge: 9f135231 652a06c8 Author: Patrick Schleizer Date: Fri Jul 26 07:19:05 2024 -0400 @@ -1138,11 +9041,11 @@ Author: Patrick Schleizer Date: Fri Jul 26 06:43:01 2024 -0400 no longer disable Intel ME related kernel modules - + because that might break firmware updates - + This reverts commit 64f8b2eb5870664fca06aa060f2f50af358ced55. - + https://github.com/Kicksecure/security-misc/issues/239 commit f616da7c0690fc0dffc21be59174ed8754ec55fb @@ -1234,7 +9137,7 @@ Author: Patrick Schleizer Date: Wed Jul 24 11:45:13 2024 -0400 cannot use NULL inside a bash variable - + use custom delimiter instead commit 4a5312b3a9419c8b3e07dda2b650d5fbf9a38d34 @@ -1248,7 +9151,7 @@ Author: Patrick Schleizer Date: Wed Jul 24 11:20:26 2024 -0400 downgrade warning of non-existing folders to info - + to avoid all users by default getting a warning for expected non-existing folders commit 151ca659a9f5565744ff57f3b581c8c051def148 @@ -1262,7 +9165,7 @@ Author: Patrick Schleizer Date: Wed Jul 24 11:13:35 2024 -0400 downgrade warning of non-existing files to info - + to avoid all users by default getting a warning for expected non-existing files commit 721392901be384014298f59deb57747b825c8b37 @@ -1282,7 +9185,7 @@ Author: Patrick Schleizer Date: Wed Jul 24 11:10:56 2024 -0400 modify call of stat to use NUL delimiter - + for more robust string parsing commit d5366835112cc5fabef7ec46a9c582c08121cb14 @@ -1320,7 +9223,7 @@ Author: Patrick Schleizer Date: Wed Jul 24 10:56:08 2024 -0400 modify call of stat to use NUL delimiter - + for more robust string parsing commit 1135d34ab334c9b39e51a147dc94df568f982512 @@ -1336,7 +9239,7 @@ Date: Wed Jul 24 09:15:02 2024 -0400 output commit 1b6161c2dcd9a0686503c84cda4c9f6a29fe4e02 -Merge: d2563ed 8be21b6 +Merge: d2563ed9 8be21b6e Author: Patrick Schleizer Date: Wed Jul 24 09:13:48 2024 -0400 @@ -1391,7 +9294,7 @@ Date: Mon Jul 22 17:26:00 2024 +1000 Add option to switch (back) to using kCFI in the future commit f582e543434ba20a2fb7f7300058f7c8a7d62878 -Merge: a189956 d2563ed +Merge: a189956a d2563ed9 Author: raja-grewal Date: Mon Jul 22 15:12:00 2024 +1000 @@ -1408,13 +9311,19 @@ Author: Patrick Schleizer Date: Sun Jul 21 06:36:22 2024 -0400 Revert "no longer disable Intel ME related kernel modules" - + This reverts commit 6157e328f40a7f3780208489b1ffecef8e6d738a. - + https://www.kicksecure.com/wiki/Out-of-band_Management_Technology#Intel_ME_Kernel_Modules - + https://github.com/Kicksecure/security-misc/issues/239 +commit 4cae74d610ad37066e8a334019cfa5c82f088a2e +Author: monsieuremre +Date: Sun Jul 21 11:19:32 2024 +0200 + + Update 30_security-misc.conf + commit 04fb00572f2e4c9bdfaaa0f6da8007999daab641 Author: Patrick Schleizer Date: Sat Jul 20 17:02:05 2024 +0000 @@ -1426,7 +9335,7 @@ Author: Patrick Schleizer Date: Sat Jul 20 12:57:56 2024 -0400 permission hardener: allow postfix - + postqueue matchwhitelist postdrop matchwhitelist @@ -1455,13 +9364,13 @@ Author: Patrick Schleizer Date: Fri Jul 19 07:20:59 2024 -0400 undo io_uring related changes - + as these should be done in a separate pull request (if apprpriate) - + https://github.com/Kicksecure/security-misc/pull/244#issuecomment-2238889062 commit 8791aecb38a41aa0b0c108505726bc6a1ace903e -Merge: 2d11436 06894d1 +Merge: 2d114364 06894d1c Author: Patrick Schleizer Date: Fri Jul 19 07:19:09 2024 -0400 @@ -1606,14 +9515,14 @@ Date: Wed Jul 17 10:43:16 2024 -0400 spelling commit 9a387f95e9346030e2adc3252a45942949561b52 -Merge: fd41acd 4afe257 +Merge: fd41acdc 4afe257a Author: Patrick Schleizer Date: Wed Jul 17 10:32:26 2024 -0400 Merge remote-tracking branch 'raja/miscellaneous' commit fd41acdc721a6463813bc347cb965b6211fb9447 -Merge: 0da22c2 1087387 +Merge: 0da22c20 1087387b Author: Patrick Schleizer Date: Wed Jul 17 10:27:31 2024 -0400 @@ -1650,19 +9559,19 @@ Date: Wed Jul 17 09:07:31 2024 -0400 minor commit c336b266f61528cce27e1cafac6377370927a787 -Merge: afe3c25 df80385 +Merge: afe3c25a df803852 Author: Patrick Schleizer Date: Wed Jul 17 09:06:44 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit df80385289717fee0266436d056c9aedd0fb06af -Merge: afe3c25 724435e +Merge: afe3c25a 724435e5 Author: Patrick Schleizer Date: Wed Jul 17 09:04:18 2024 -0400 Merge pull request #237 from raja-grewal/intel_pmt - + Disable some Intel PMT kernel modules commit afe3c25a49940f7f322414c08e8dbd631e696215 @@ -1670,7 +9579,7 @@ Author: Patrick Schleizer Date: Wed Jul 17 08:58:00 2024 -0400 update readme - + https://github.com/Kicksecure/security-misc/issues/239 commit f7772fb85a1fe6d3c0749e5f34fc29111b6a8125 @@ -1684,39 +9593,39 @@ Author: Patrick Schleizer Date: Wed Jul 17 08:52:11 2024 -0400 no longer disable Intel ME related kernel modules - + https://github.com/Kicksecure/security-misc/issues/239 commit daee8b900b3057235aedc17b1231c3c05599140c -Merge: 954ff1b a4ba6e4 +Merge: 954ff1be a4ba6e48 Author: Patrick Schleizer Date: Wed Jul 17 08:47:55 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit a4ba6e485d94512fdf737b9f66137c3f692c9904 -Merge: 9a75135 abafb19 +Merge: 9a751356 abafb194 Author: Patrick Schleizer Date: Wed Jul 17 08:46:27 2024 -0400 Merge pull request #236 from raja-grewal/intel_me - + Disable more Intel ME kernel modules commit 954ff1be41288b5fa2e50d492d92544915f93bb5 -Merge: d29a616 9a75135 +Merge: d29a6161 9a751356 Author: Patrick Schleizer Date: Wed Jul 17 08:42:52 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 9a75135633ad172f7cbf318e1206865493c28bb4 -Merge: d29a616 a340899 +Merge: d29a6161 a3408990 Author: Patrick Schleizer Date: Wed Jul 17 08:41:43 2024 -0400 Merge pull request #238 from raja-grewal/uvcvideo_2 - + Minor additions to `30_security-misc_disable.conf` commit d29a616142562492db6c45c299f002100e905828 @@ -1726,7 +9635,7 @@ Date: Wed Jul 17 08:39:20 2024 -0400 minor commit a2802f352fc7021ead0d431c665cc16b2821ae0b -Merge: 0b873b7 81a3715 +Merge: 0b873b76 81a3715c Author: Patrick Schleizer Date: Wed Jul 17 08:38:23 2024 -0400 @@ -1739,7 +9648,7 @@ Date: Wed Jul 17 08:05:27 2024 -0400 minor commit 070bb46a08afcd84fb638472c39bd543bad4fb17 -Merge: 6d6e547 25fd532 +Merge: 6d6e5473 25fd532c Author: Patrick Schleizer Date: Wed Jul 17 08:02:45 2024 -0400 @@ -1752,7 +9661,7 @@ Date: Wed Jul 17 08:00:24 2024 -0400 minor commit cf5f0edbb85589a72ec891e9c3e090f9e81c4fda -Merge: fe5c840 693b47e +Merge: fe5c840b 693b47e6 Author: Patrick Schleizer Date: Wed Jul 17 07:59:35 2024 -0400 @@ -1832,7 +9741,7 @@ Date: Mon Jul 15 21:18:55 2024 +0000 bumped changelog version commit 6e63fc8985b97902dbae2553ded51950168dc222 -Merge: fe0846c b7796a5 +Merge: fe0846c8 b7796a53 Author: Patrick Schleizer Date: Mon Jul 15 17:14:25 2024 -0400 @@ -1843,7 +9752,7 @@ Author: Patrick Schleizer Date: Mon Jul 15 12:30:38 2024 -0400 fix - + https://github.com/Kicksecure/security-misc/pull/234#discussion_r1678065395 commit 94df2e3d244f5e6e8e4320c1f28cc11dba00dd36 @@ -1851,11 +9760,11 @@ Author: Patrick Schleizer Date: Mon Jul 15 12:29:52 2024 -0400 further discussion required - + https://github.com/Kicksecure/security-misc/pull/234#issuecomment-2228909249 commit 41f0b53dd62d2968a6ff88a6fd907ca42f581847 -Merge: 5ba5a85 9300c20 +Merge: 5ba5a85a 9300c208 Author: Patrick Schleizer Date: Mon Jul 15 12:28:03 2024 -0400 @@ -2079,7 +9988,7 @@ Date: Sat Jul 13 15:01:16 2024 +0000 bumped changelog version commit ad860063aba0443a8ac8b9cf191d008617d6d904 -Merge: f34b9d7 9f58266 +Merge: f34b9d7c 9f582665 Author: Patrick Schleizer Date: Sat Jul 13 10:55:45 2024 -0400 @@ -2110,7 +10019,7 @@ Date: Sat Jul 13 22:41:40 2024 +1000 Refactor existing sysctl for clarity commit f34b9d7c45cd723535eedd3df99896ee7f852388 -Merge: 05c1711 5f10cc8 +Merge: 05c1711b 5f10cc8b Author: Patrick Schleizer Date: Sat Jul 13 06:14:43 2024 -0400 @@ -2171,19 +10080,19 @@ Date: Tue Jun 11 12:56:56 2024 +0000 bumped changelog version commit e48115588caae8e51bb980ac84b1f0f415ca0d17 -Merge: b316352 cad8d85 +Merge: b316352e cad8d857 Author: Patrick Schleizer Date: Tue Jun 11 07:25:47 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit cad8d857556e29544f742fdac8fe82758a4f885c -Merge: b316352 e198447 +Merge: b316352e e1984478 Author: Patrick Schleizer Date: Tue Jun 11 07:25:07 2024 -0400 Merge pull request #227 from 3uryd1ce/fix-pam.d-path - + fix(etc): delete typo in /etc/apparmor.d tunables commit e1984478662fc51e6eacc989bc6bba0ca1fc07cd @@ -2191,7 +10100,7 @@ Author: Ashlen Date: Sat Jun 8 22:17:05 2024 -0600 fix(etc): delete typo in /etc/apparmor.d tunables - + /etc/pam.d was present twice in a row ("/etc/pam.d//etc/pam.d") in this file: /etc/apparmor.d/tunables/home.d/security-misc. @@ -2226,19 +10135,19 @@ Date: Tue May 28 12:04:53 2024 +0000 bumped changelog version commit ae24a97d4d0ffcfb3d1cc92edb61e7ecf4535ee7 -Merge: bfca98e a735857 +Merge: bfca98ea a7358578 Author: Patrick Schleizer Date: Tue May 28 08:02:21 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit a7358578520294b51e1001199670a0bbeeb43eb1 -Merge: bfca98e 4efa293 +Merge: bfca98ea 4efa293f Author: Patrick Schleizer Date: Tue May 28 07:55:31 2024 -0400 Merge pull request #226 from Kicksecure/gitconfig - + add `/etc/gitconfig` by default for better `git` security commit 4efa293f3b76814bc5399a959482d7db6e7431ec @@ -2246,11 +10155,11 @@ Author: Patrick Schleizer Date: Tue May 28 07:51:06 2024 -0400 add `/etc/gitconfig` by default for better `git` security - + ``` [core] symlinks = false - + [transfer] fsckobjects = true fsckobjects = true @@ -2261,9 +10170,9 @@ Date: Tue May 28 07:51:06 2024 -0400 fsckobjects = true fsckobjects = true ``` - + + additional suggestions as comments - + fixes https://github.com/Kicksecure/security-misc/issues/225 commit bfca98ea89cea0f8604ecca0c8640860320e8e33 @@ -2273,19 +10182,19 @@ Date: Sat May 18 20:45:12 2024 +0000 bumped changelog version commit eb82884fb2e3d3bb4fa5555d8212146042ba8aa4 -Merge: 5867b1b 12e006e +Merge: 5867b1b0 12e006ef Author: Patrick Schleizer Date: Sat May 18 16:42:41 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 12e006ef9cabbbcbe9cb45d9a6631e9a7a47cf3a -Merge: 5867b1b 2f71605 +Merge: 5867b1b0 2f716050 Author: Patrick Schleizer Date: Sat May 18 16:30:07 2024 -0400 Merge pull request #222 from raja-grewal/text - + Update Readme and Copyright commit 2f716050d17016be6f550a7de8e0c1030e869e8f @@ -2325,46 +10234,46 @@ Date: Fri May 10 06:48:26 2024 -0400 chmod +x commit 8a28c1bc38b87bf55f25764c96a0e81e22137232 -Merge: a9886a3 0f1119f +Merge: a9886a31 0f1119f3 Author: Patrick Schleizer Date: Fri May 10 06:48:04 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 0f1119f326cd769db8995e8eb54ff35503c70562 -Merge: 547757f 677f75a +Merge: 547757f4 677f75ae Author: Patrick Schleizer Date: Fri May 10 06:45:57 2024 -0400 Merge pull request #221 from raja-grewal/firewire - + Disable Firewire Module commit 547757f4514a54437d044656c5e2b6d413a4cc30 -Merge: 7b9fe44 06f13bb +Merge: 7b9fe44a 06f13bb7 Author: Patrick Schleizer Date: Fri May 10 06:45:34 2024 -0400 Merge pull request #220 from raja-grewal/block_gps - + Block Several GPS-related Modules commit 7b9fe44a20f3caf67f386969a5fc7c980e5f0282 -Merge: 62ea4dc 132b41a +Merge: 62ea4dc1 132b41ae Author: Patrick Schleizer Date: Fri May 10 06:43:43 2024 -0400 Merge pull request #219 from raja-grewal/logging_martians - + Revert Logging of Martians commit 62ea4dc1768f69bb28a69c20e55c87ae692cc0c8 -Merge: a9886a3 4694268 +Merge: a9886a31 4694268b Author: Patrick Schleizer Date: Fri May 10 06:43:15 2024 -0400 Merge pull request #218 from raja-grewal/secure_cpu - + More CPU Mitigations and Additional References commit 677f75ae8ed64af599f837ced15f34990df498e5 @@ -2452,19 +10361,19 @@ Date: Fri Apr 12 06:56:39 2024 +0000 bumped changelog version commit 5cbdf3c1262d26ae03b28baee87b1d268329da40 -Merge: 7fba04d ab8b6da +Merge: 7fba04d1 ab8b6da4 Author: Patrick Schleizer Date: Fri Apr 12 02:54:17 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit ab8b6da484a90e9a62f8ba515c757aa3758baf48 -Merge: 7fba04d 4935768 +Merge: 7fba04d1 49357683 Author: Patrick Schleizer Date: Fri Apr 12 02:53:08 2024 -0400 Merge pull request #216 from raja-grewal/spectre_bhi - + BHI mitigation on Intel CPUs commit 493576836c90653f9c3514fcd5b3bf816e56d689 @@ -2484,7 +10393,7 @@ Author: Patrick Schleizer Date: Mon Apr 1 02:55:59 2024 -0400 no longer disable MSR by default - + fixes https://github.com/Kicksecure/security-misc/issues/215 commit d9ac01ba5c26f9730feb17fe573d447e625e59f8 @@ -2506,19 +10415,19 @@ Date: Mon Mar 11 15:07:50 2024 +0000 bumped changelog version commit 0a018bdebca167d671d8bda81a2b0d929d396945 -Merge: 57fc487 0b81316 +Merge: 57fc487e 0b813163 Author: Patrick Schleizer Date: Mon Mar 11 10:13:57 2024 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 0b8131630041dbd80f1aa61dcedde446208c06f7 -Merge: 57fc487 03ed546 +Merge: 57fc487e 03ed546c Author: Patrick Schleizer Date: Mon Mar 11 10:12:46 2024 -0400 Merge pull request #211 from wryMitts/patch-1 - + Create proc group on install commit 03ed546cd8992b29855ca1c2748ed988dd3c765d @@ -2526,7 +10435,7 @@ Author: wryMitts <158655396+wryMitts@users.noreply.github.com> Date: Sun Mar 10 16:55:10 2024 -0400 Create proc group on install - + Fixes https://github.com/Kicksecure/security-misc/issues/210 commit 57fc487e5e5ffad765f1418236744319cc666871 @@ -2540,9 +10449,9 @@ Author: Patrick Schleizer Date: Sun Mar 10 08:44:53 2024 -0400 `proc-hidepid.service` add `gid=proc` - + This allows users that are a member of the `proc` group to be excluded from `hidepid` protections. - + https://github.com/Kicksecure/security-misc/issues/208 commit 0f0d9ca2a42cf9fc04e405ae90f3d67bc0794e12 @@ -2556,11 +10465,11 @@ Author: Patrick Schleizer Date: Mon Mar 4 06:44:26 2024 -0500 fix panic-on-oops started every 10s in Qubes-Whonix - + by changing from a /etc/profile.d etc. related mechanism to start to a systemd unit file based approach - + Thanks to @marmarek for the bug report! - + https://forums.whonix.org/t/panic-on-oops-started-every-10s/19450 commit af6c6971a741c69a584ba3f92dbfed12e40784dc @@ -2586,7 +10495,7 @@ Author: Patrick Schleizer Date: Mon Feb 26 08:11:26 2024 -0500 use long options - + https://github.com/Kicksecure/security-misc/issues/172 commit 2d1d1b246f3fe061d4f817da5cecf46010839e1d @@ -2594,7 +10503,7 @@ Author: Patrick Schleizer Date: Mon Feb 26 08:07:29 2024 -0500 improve output - + https://github.com/Kicksecure/security-misc/issues/172 commit d8f5376c4f36f5deb734e6dead42a62566d13480 @@ -2602,7 +10511,7 @@ Author: Patrick Schleizer Date: Mon Feb 26 07:58:06 2024 -0500 improve output - + https://github.com/Kicksecure/security-misc/issues/172 commit cf84762a3a84d2be3b9510dddb32bdc433170dfa @@ -2610,7 +10519,7 @@ Author: Patrick Schleizer Date: Mon Feb 26 07:52:41 2024 -0500 improve output - + https://github.com/Kicksecure/security-misc/issues/172 commit f2958bbfa5e67ee10380a25d996826233469080a @@ -2620,19 +10529,19 @@ Date: Mon Feb 26 07:49:30 2024 -0500 comment commit bc8f9edc3197e33e75ea1d691834d9abbdcdefd0 -Merge: 02d6f67 b23d167 +Merge: 02d6f677 b23d1673 Author: Patrick Schleizer Date: Mon Feb 26 07:48:19 2024 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit b23d167342ef242a1e9d4e91b6a4b945e80c3e7e -Merge: 02d6f67 ef44ece +Merge: 02d6f677 ef44ecea Author: Patrick Schleizer Date: Mon Feb 26 07:46:02 2024 -0500 Merge pull request #204 from DanWin/sysfs-mount - + Make /sys hardening optional and allow access to /sys/fs to make polkit work commit 02d6f67741ef93d9ab39e02ac56b27c551a19dca @@ -2724,7 +10633,7 @@ Author: Patrick Schleizer Date: Thu Feb 22 09:13:56 2024 -0500 mount --make-private - + https://github.com/Kicksecure/security-misc/issues/172 commit c0f98b05b609c7c8ac6f86e123af9e0642d82697 @@ -2732,7 +10641,7 @@ Author: Patrick Schleizer Date: Thu Feb 22 06:03:59 2024 -0500 comment - + https://github.com/Kicksecure/security-misc/pull/202 commit 1e1613aa93dca1e7fe7f24dbd32028a0cadd21fd @@ -2740,7 +10649,7 @@ Author: Patrick Schleizer Date: Thu Feb 22 06:02:28 2024 -0500 allow /opt exec as usually optional binaries are placed there such as firefox - + https://github.com/Kicksecure/security-misc/pull/202 commit 7c7b4b24b4959f3ef96ff7ef0b11fa4c0bd48c8e @@ -2748,7 +10657,7 @@ Author: Patrick Schleizer Date: Thu Feb 22 06:01:00 2024 -0500 fix home_noexec_maybe -> most_noexec_maybe - + https://github.com/Kicksecure/security-misc/pull/202 commit 38783faf60b85c4e855bf78c87e1c07765776b50 @@ -2756,7 +10665,7 @@ Author: Patrick Schleizer Date: Thu Feb 22 05:58:53 2024 -0500 add more bind mounts of mount options hardening - + as suggested in https://github.com/Kicksecure/security-misc/pull/202 commit ad9d913902d7e696f1114da74d84f9cdcb22bc25 @@ -2766,19 +10675,19 @@ Date: Sat Feb 3 18:28:27 2024 +0000 bumped changelog version commit 02090da08cfd411314ffeeb6df95f73c701f06c6 -Merge: 8037ce5 ba13657 +Merge: 8037ce52 ba13657d Author: Patrick Schleizer Date: Sat Feb 3 12:51:07 2024 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit ba13657d894f2f30d8deb7c08b85e5fbc1dcea21 -Merge: 8037ce5 b16c99a +Merge: 8037ce52 b16c99ab Author: Patrick Schleizer Date: Sat Feb 3 12:50:28 2024 -0500 Merge pull request #197 from raja-grewal/mitigations - + Additional Explicit CPU Mitigations commit b16c99ab62a902b1f61b9d4fe63273cd614e757c @@ -2822,7 +10731,7 @@ Author: Patrick Schleizer Date: Thu Jan 25 06:54:36 2024 -0500 use `interest-noawait` instead of `interest-await` - + fixes https://github.com/Kicksecure/security-misc/issues/196 commit 64e41b113cae893d1f27f441f99340389ba8b9b3 @@ -2848,9 +10757,9 @@ Author: Patrick Schleizer Date: Wed Jan 17 14:03:09 2024 -0500 use wildcards - + instead of outdated, incomplete list - + https://github.com/Kicksecure/security-misc/issues/160 commit 08619d6a7307b6ab05a3ba7e71ea33b00db20b27 @@ -2858,7 +10767,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:59:36 2024 -0500 minor RPM updates - + https://github.com/Kicksecure/security-misc/issues/160 commit 3048e0ac76e4eba1c53b43ba2424157505578cdd @@ -2866,7 +10775,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:54:07 2024 -0500 usrmerge - + https://github.com/Kicksecure/security-misc/issues/190 commit 5a6cd4c2abd243c91575e9477a921aa290c68ba5 @@ -2874,7 +10783,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:51:30 2024 -0500 remove now empty /bin from copying since it is empty after usrmerge - + https://github.com/Kicksecure/security-misc/issues/190 commit 071b984a1eaaa8a8ea6a40e4ee36eabcde2d630d @@ -2882,7 +10791,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:49:05 2024 -0500 `sort -d` - + https://github.com/Kicksecure/security-misc/issues/190 commit 011e55e3e52485ccd728b4bb249efbc816f38806 @@ -2890,7 +10799,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:45:17 2024 -0500 remove duplicates after usrmerge - + https://github.com/Kicksecure/security-misc/issues/190 commit 0efee2f50fd38feade7700c2f033cc3d4c200d34 @@ -2898,7 +10807,7 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:39:56 2024 -0500 usrmerge - + fixes https://github.com/Kicksecure/security-misc/issues/190 commit 18a06935e0cca3dc090643aad406d861e4583085 @@ -2906,9 +10815,9 @@ Author: Patrick Schleizer Date: Wed Jan 17 13:23:20 2024 -0500 run permission hardener when new packages are install files to /usr or /opt - + (basically anywhere) - + fixes https://github.com/Kicksecure/security-misc/issues/189 commit 66e6371221c3395a0523e30e8ef1a051d3e6cdd0 @@ -2928,11 +10837,11 @@ Author: Patrick Schleizer Date: Tue Jan 16 09:23:54 2024 -0500 update permission-hardener.service - + Which is now only an additional opt-in systemd unit, because permission-hardener is run by default at security-misc package installation time. - + https://github.com/Kicksecure/security-misc/pull/181 commit 186f6015da7b3314c95c2833032c6fe953a71afd @@ -2946,7 +10855,7 @@ Author: Patrick Schleizer Date: Tue Jan 16 09:10:59 2024 -0500 delete legacy folder /etc/permission-hardening.d if empty - + https://github.com/Kicksecure/security-misc/pull/181 commit 9cafd78fe21baa3c2a36853f57e0638b2facfe5c @@ -2954,7 +10863,7 @@ Author: Patrick Schleizer Date: Tue Jan 16 09:05:09 2024 -0500 rm_conffile /etc/permission-hardening.d - + https://github.com/Kicksecure/security-misc/pull/181 commit fa53848b5cda135fbb8a3855e8508692084fc7e9 @@ -2974,9 +10883,9 @@ Author: Patrick Schleizer Date: Tue Jan 16 08:45:13 2024 -0500 permission-hardening -> permission-hardener migration - + mv --verbose /var/lib/permission-hardening /var/lib/permission-hardener - + https://github.com/Kicksecure/security-misc/pull/181 commit a90cd43631216f28a18a1b3f066b9f6ef3301ac4 @@ -2984,11 +10893,11 @@ Author: Patrick Schleizer Date: Tue Jan 16 08:32:52 2024 -0500 fix postinst for new permission-hardener - + https://github.com/Kicksecure/security-misc/pull/181 commit 862bf6b5ab29917138325023eb3507f5fbd5653c -Merge: dc8d9ee bc02c72 +Merge: dc8d9eec bc02c720 Author: Patrick Schleizer Date: Tue Jan 16 08:19:28 2024 -0500 @@ -3005,7 +10914,7 @@ Author: Patrick Schleizer Date: Sun Jan 7 06:37:34 2024 -0500 undo IPv6 privacy due to potential server issues - + https://github.com/Kicksecure/security-misc/issues/184 commit 128bb01b35d20e97351dfb53768f35482f9756a2 @@ -3013,7 +10922,7 @@ Author: Patrick Schleizer Date: Sun Jan 7 06:36:25 2024 -0500 undo IPv6 privacy due to potential server issues - + https://github.com/Kicksecure/security-misc/issues/184 commit df0f9d3267644c4aea87add2dcade86044c496f0 @@ -3027,9 +10936,9 @@ Author: Patrick Schleizer Date: Sat Jan 6 09:10:45 2024 -0500 revert umask 027 by default - + because broken because this also happens for root while it should not - + https://github.com/Kicksecure/security-misc/issues/185 commit 3f1304403fbf04f15dac01963c66f82cd84452d4 @@ -3037,7 +10946,7 @@ Author: Patrick Schleizer Date: Sat Jan 6 08:15:31 2024 -0500 disable MAC randomization in Network Manager (NM) because it breaks VirtualBox DHCP - + https://github.com/Kicksecure/security-misc/issues/184 commit e8f8dcd0fb1c23a62974849f55516da9dce5948e @@ -3047,19 +10956,19 @@ Date: Thu Jan 4 02:03:26 2024 +0000 bumped changelog version commit 70a86fa994c0a894643e876fc86226ad0443a741 -Merge: db0503e 71060f1 +Merge: db0503e7 71060f1f Author: Patrick Schleizer Date: Wed Jan 3 05:12:48 2024 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 71060f1f53ca7a275f10c4b6ab3e6c25585d5440 -Merge: db0503e 74afcc9 +Merge: db0503e7 74afcc9c Author: Patrick Schleizer Date: Wed Jan 3 05:00:41 2024 -0500 Merge pull request #182 from raja-grewal/io_uring - + Clarify validity of disabling io_uring commit 74afcc9c63ad064f20778ad2870690925c3cee81 @@ -3073,7 +10982,7 @@ Author: Ben Grande Date: Tue Jan 2 17:08:45 2024 +0100 Fix unbound variable - + - Run messages preceded by INFO; - Comment unknown unused variables; - Remove unnecessary variables; and @@ -3090,7 +10999,7 @@ Author: Ben Grande Date: Tue Jan 2 13:34:29 2024 +0100 Rename file permission hardening script - + Hardener as the script is the agent that is hardening the file permissions. @@ -3099,7 +11008,7 @@ Author: Ben Grande Date: Tue Jan 2 12:17:16 2024 +0100 Refactor permission-hardener - + - Organize comments from default configuration; - Apply and undo changes from a single file controlled by parameters; - Arrays should be evaluated as arrays and not normal variables; @@ -3114,19 +11023,19 @@ Date: Tue Jan 2 12:17:16 2024 +0100 - Use long options for "set" command; commit a94f2a3f4626a9292660bc7f98a6513f34d0f5b2 -Merge: 94c0e26 8daf97a +Merge: 94c0e26a 8daf97ab Author: Patrick Schleizer Date: Tue Jan 2 05:30:49 2024 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 8daf97ab0181a9cbb9e9dec57f1f00270dbb3a50 -Merge: 94c0e26 f055fe5 +Merge: 94c0e26a f055fe5d Author: Patrick Schleizer Date: Tue Jan 2 05:29:35 2024 -0500 Merge pull request #178 from raja-grewal/io_uring - + Disable asynchronous I/O commit 94c0e26a082f61f71e89b1fb7386a58166ffa411 @@ -3140,7 +11049,7 @@ Author: Patrick Schleizer Date: Fri Dec 29 14:57:38 2023 -0500 /dev/, /dev/shm, /tmp - + https://github.com/Kicksecure/security-misc/issues/157#issuecomment-1869073716 commit e15596e7af6fc645dd652c043397baaa91954915 @@ -3160,7 +11069,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 10:31:58 2023 -0500 formatting - + https://github.com/Kicksecure/security-misc/issues/157 commit 971ff687b1423499c54495a03e5e6fafcbfefb2a @@ -3168,7 +11077,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 10:30:35 2023 -0500 do not mount /dev/cdrom by default - + https://github.com/Kicksecure/security-misc/issues/157 commit 9fce67fcd942a7e3e0dd2e874226fcdab5e33ba3 @@ -3176,7 +11085,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 10:28:47 2023 -0500 remove superfluous, broken `remount` mount option - + https://github.com/Kicksecure/security-misc/issues/157 commit 40fd8cb6081512e2bc0ef1a7a1ee17cd317024c2 @@ -3184,9 +11093,9 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:51:09 2023 -0500 no `nofail` mount option to avoid breaking the boot of a system - + unit testing belongs elsewhere - + https://github.com/Kicksecure/security-misc/issues/157 commit 4aa645f29ff741b6e5cdf629deade1923fdcc234 @@ -3194,7 +11103,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:46:33 2023 -0500 comment - + https://github.com/Kicksecure/security-misc/issues/157 commit 2b7aeedb4a543d0a43a35918999338097d13bb16 @@ -3203,10 +11112,10 @@ Date: Mon Dec 25 09:44:51 2023 -0500 mount /dev/cdrom to /mnt/cdrom (instead of /mnt/cdrom0) and nodev,nosuid,noexec - + as per: https://www.debian.org/doc/manuals/securing-debian-manual/ch04s10.en.html - + https://github.com/Kicksecure/security-misc/issues/157 commit 0d9e9780daca563a726470a3a5d6fa8c20487240 @@ -3214,7 +11123,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:37:14 2023 -0500 formatting - + https://github.com/Kicksecure/security-misc/issues/157 commit 00f9ab43947795c1144d797547968c7c149d6f21 @@ -3222,7 +11131,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:36:05 2023 -0500 /dev devtmpfs - + https://github.com/Kicksecure/security-misc/issues/157 commit 55709b3aa0acd6cad0c9fedb8782c49fbea79689 @@ -3230,7 +11139,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:30:57 2023 -0500 /tmp tmpfs - + https://github.com/Kicksecure/security-misc/issues/157 commit b0dd967611c27f5b8e2472bb74a664aead7a229e @@ -3238,7 +11147,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:27:45 2023 -0500 usrmerge - + https://github.com/Kicksecure/security-misc/issues/157 commit 269fada14a616c53d7421e88e662f6893eb1fd88 @@ -3246,7 +11155,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:25:14 2023 -0500 combine bind lines - + https://github.com/Kicksecure/security-misc/issues/157 commit 0810c1ce3c9e19c745b8f0d2cd9410353b172779 @@ -3254,7 +11163,7 @@ Author: Patrick Schleizer Date: Mon Dec 25 09:10:31 2023 -0500 fix bluetooth in readme - + fixes https://github.com/Kicksecure/security-misc/issues/180 commit 37b4ab15a823134e616a2a0fe1dda18d5ebfa3c0 @@ -3286,9 +11195,9 @@ Author: Patrick Schleizer Date: Mon Dec 25 08:26:03 2023 -0500 improve bluetooth in readme - + as suggested by @monsieuremre - + https://github.com/Kicksecure/security-misc/issues/180 commit 7fa597deca7ff2b2932a5f5fad56be57bd78b6cf @@ -3302,7 +11211,7 @@ Author: Patrick Schleizer Date: Fri Dec 22 08:31:58 2023 -0500 exclude hardened malloc from SUID disabler - + fixes https://github.com/Kicksecure/security-misc/issues/179 commit f055fe5da2219b68f46c3c577d79fcfd7e79cfc6 @@ -3310,7 +11219,7 @@ Author: Raja Grewal Date: Fri Dec 15 08:33:36 2023 +0000 Disable asynchronous I/O - + io_uring creation is disabled for all processes. io_uring_setup always fails with -EPERM. Existing io_uring instances can still be used. commit 99f2edd4f685cdc9a47b32107125408e12a294c2 @@ -3324,13 +11233,13 @@ Author: Patrick Schleizer Date: Tue Dec 12 11:50:11 2023 -0500 add hardened fstab `/usr/share/doc/security-misc/fstab-vm` - + to the documentation folder as an example - + not directly used by security-misc - + will later be used by Kicksecure VM build process - + https://github.com/Kicksecure/security-misc/issues/157 commit dcaafa6c8bf380dd990942e9c10e280943b442a6 @@ -3344,7 +11253,7 @@ Author: Patrick Schleizer Date: Mon Dec 4 11:38:49 2023 -0500 move to `/usr/lib/issue.d/20_security-misc.issue` - + https://github.com/Kicksecure/security-misc/pull/167 commit dfaea492c76a277b9cbe84982a135cb4f03a557c @@ -3352,23 +11261,23 @@ Author: Patrick Schleizer Date: Mon Dec 4 11:37:02 2023 -0500 remove `etc/issue.net.d/20_security-misc` - + since not mentioned on debian.org commit 69c895af09f05000ace5f273f3e5032aabf8c64e -Merge: c9ea7a4 36850f8 +Merge: c9ea7a4d 36850f89 Author: Patrick Schleizer Date: Mon Dec 4 11:27:53 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 36850f89fb07678ca24eb580a18247e593eac608 -Merge: c9ea7a4 0d7af97 +Merge: c9ea7a4d 0d7af970 Author: Patrick Schleizer Date: Mon Dec 4 11:27:16 2023 -0500 Merge pull request #167 from monsieuremre/patch-4 - + Non-Identifiable and Generic Issue Banners that include the Recommended Keywords commit c9ea7a4dca6e985c3a1044a3b4ddda83909fbc51 @@ -3376,25 +11285,25 @@ Author: Patrick Schleizer Date: Mon Dec 4 11:02:55 2023 -0500 use `amd_iommu=force_isolation` instead of `amd_iommu=force_enable` - + because we set `iommu=force` already anyhow - + fixes https://github.com/Kicksecure/security-misc/issues/175 commit e83c1d7ed662bb0533c670dd5b7a6745a75e9ca4 -Merge: c4e21ca befd21e +Merge: c4e21ca5 befd21e0 Author: Patrick Schleizer Date: Mon Dec 4 11:01:02 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit befd21e0c0c38eaf91c7096e9f60120f533a5842 -Merge: c4e21ca f2ad838 +Merge: c4e21ca5 f2ad8383 Author: Patrick Schleizer Date: Mon Dec 4 11:00:29 2023 -0500 Merge pull request #176 from monsieuremre/patch-1 - + Iommu Kernel Parameters commit c4e21ca5f49fbc2d67853eebca647539acbca815 @@ -3402,7 +11311,7 @@ Author: Patrick Schleizer Date: Mon Dec 4 10:58:16 2023 -0500 added development philosophy - + https://github.com/Kicksecure/security-misc/issues/154 commit feab1432f9d0966118ca233c9f88270b98c3f120 @@ -3410,7 +11319,7 @@ Author: Patrick Schleizer Date: Mon Dec 4 10:48:27 2023 -0500 clarify scope - + https://github.com/Kicksecure/security-misc/issues/154 commit dc04040cb3644c9e3be9b44a34da4a5f7b61f2cc @@ -3456,7 +11365,7 @@ Date: Sun Dec 3 19:30:55 2023 +0000 Update 20_security-misc commit 7963f811e1bb6f5e0e2ba41e96b14e4a3a70f847 -Merge: c8b9f5a 82bd913 +Merge: c8b9f5a9 82bd9138 Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> Date: Sun Dec 3 19:30:22 2023 +0000 @@ -3473,7 +11382,7 @@ Author: Patrick Schleizer Date: Mon Nov 20 04:40:28 2023 -0500 moved libpam-tmpdir dependency to kicksecure-meta-packages - + https://github.com/Kicksecure/security-misc/pull/147 commit c8b9f5a917e6c415575d6763a65930f1a91a7c78 @@ -3488,6 +11397,18 @@ Date: Sat Nov 18 10:02:16 2023 +0000 20_security-misc +commit 7c8b9b294678056d684fd3dc22f012d75da40426 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Nov 17 17:14:01 2023 +0000 + + 30_security-misc.conf + +commit 7d31e17fc5a8fe3055568c1a0f541dea064f30a0 +Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> +Date: Fri Nov 17 17:02:41 2023 +0000 + + usbguard + commit 4e4df5dd7c6b5cf1deb179a2c3f8fe7a8844884d Author: Patrick Schleizer Date: Sat Nov 11 22:29:57 2023 +0000 @@ -3517,7 +11438,7 @@ Author: Patrick Schleizer Date: Sat Nov 11 13:41:28 2023 -0500 change license to AGPL-3+ - + https://forums.whonix.org/t/license-change-to-agplv3/17455 commit 20f804f19c046e3ef2b38c367de9d5c80cccccd9 @@ -3603,7 +11524,7 @@ Author: Patrick Schleizer Date: Mon Nov 6 16:22:42 2023 -0500 remount-secure systemd unit - + https://github.com/Kicksecure/security-misc/pull/152 commit 79f9c1fb3adac319342a22c099401cb21af4429f @@ -3611,7 +11532,7 @@ Author: Patrick Schleizer Date: Mon Nov 6 15:48:09 2023 -0500 add sysinit-post.target - + https://github.com/Kicksecure/security-misc/pull/152 commit 2de5ab41201c561a2684f15196ce37b0f34038a9 @@ -3619,7 +11540,7 @@ Author: Patrick Schleizer Date: Mon Nov 6 13:47:30 2023 -0500 clarify scope of application specific hardening - + fixes https://github.com/Kicksecure/security-misc/issues/154 commit 5a96616b39e7188903bd0d35c9812a02fddc02f9 @@ -3633,7 +11554,7 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:55:55 2023 -0500 readme - + https://github.com/Kicksecure/security-misc/pull/152 commit be023c77223c4ec0e26ffe2a88acd94653efee9a @@ -3641,7 +11562,7 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:54:43 2023 -0500 readme - + https://github.com/Kicksecure/security-misc/issues/159 commit e1f413c1ee5107468cb2a9c4aa8bd061d0dc911b @@ -3649,9 +11570,9 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:53:26 2023 -0500 disable harden-module-loading.service for now - + due to issues - + https://github.com/Kicksecure/security-misc/issues/159 commit f2ea1abc9b3efc035f4d1381bece458de9b89ff3 @@ -3665,9 +11586,9 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:49:36 2023 -0500 Revert "remove no longer required remount-service systemd unit" - + This reverts commit 479ab61a1d0c91d26c2cd200d97b39b2b786e073. - + https://github.com/Kicksecure/security-misc/pull/152 commit 24b4d59ce41bc95e0b0aadf401223dc40b0f9c8f @@ -3687,7 +11608,7 @@ Author: Patrick Schleizer Date: Sun Nov 5 20:12:03 2023 -0500 fix systemd unit - + https://github.com/Kicksecure/security-misc/issues/159 commit 2571bbf315693f65f564ef4ad1b2ff4941f2ebc3 @@ -3733,19 +11654,19 @@ Date: Sun Nov 5 17:43:07 2023 -0500 set -e commit 18a2d814cc0c477599b276bb319ed8bdd34499ea -Merge: 4fda9d2 36f3c30 +Merge: 4fda9d2e 36f3c304 Author: Patrick Schleizer Date: Sun Nov 5 17:42:28 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 36f3c30440e73c8bf4946742095f0495994fed99 -Merge: 4fda9d2 2e64d89 +Merge: 4fda9d2e 2e64d89b Author: Patrick Schleizer Date: Sun Nov 5 17:41:56 2023 -0500 Merge pull request #148 from monsieuremre/module-loading-hardening - + Harden the loading of new modules to the kernel after install commit 4fda9d2e8459c043ec27178ceb87483229b45d5f @@ -3819,9 +11740,9 @@ Author: Patrick Schleizer Date: Sun Nov 5 15:27:09 2023 -0500 disable remount-secure dracut modules - + pending new systemd based implementation - + https://github.com/Kicksecure/security-misc/pull/152 commit 949c1633701ac168e908794d4dd74c5a9b09a437 @@ -3841,7 +11762,7 @@ Author: Patrick Schleizer Date: Sun Nov 5 15:09:29 2023 -0500 lower verbosity of permission hardener - + fixes https://github.com/Kicksecure/security-misc/issues/158 commit 0544657123100b333211a91ef32054dc7e14c7db @@ -3871,19 +11792,19 @@ Date: Sun Nov 5 14:50:13 2023 -0500 cleanup commit 811d1cd0dd0dcb9021d2f72638dd6c12b734964c -Merge: 9343795 5a75bcf +Merge: 93437952 5a75bcfb Author: Patrick Schleizer Date: Sun Nov 5 14:49:43 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 5a75bcfb19ac6c555a52cb1600e4efd13a8cfc06 -Merge: 9343795 229032d +Merge: 93437952 229032d6 Author: Patrick Schleizer Date: Sun Nov 5 14:49:00 2023 -0500 Merge pull request #145 from monsieuremre/wifi-and-bluetooth - + Wifi and Bluetooth Patch | Security and Privacy commit 93437952b4f64866dfe6067d8caf19415112418d @@ -3893,51 +11814,51 @@ Date: Sun Nov 5 14:41:01 2023 -0500 readme commit f32b5438872ad0b9e10cb7b0519f1f18fce1913e -Merge: 56b90ee 4946f85 +Merge: 56b90eec 4946f85d Author: Patrick Schleizer Date: Sun Nov 5 14:38:20 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 4946f85d43083c64bc3f8f02e26b08f79b622bfe -Merge: 817ca11 1abac79 +Merge: 817ca116 1abac794 Author: Patrick Schleizer Date: Sun Nov 5 14:37:47 2023 -0500 Merge pull request #146 from monsieuremre/thunderbird - + Thunderbird Hardening commit 56b90eecbfb21e546d52d1f41ce9361f2843cd71 -Merge: 3178677 817ca11 +Merge: 31786775 817ca116 Author: Patrick Schleizer Date: Sun Nov 5 14:35:23 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 817ca116f693893e6dcb69254ee91815d200b8a1 -Merge: d9b5d77 fbd9e5d +Merge: d9b5d770 fbd9e5d0 Author: Patrick Schleizer Date: Sun Nov 5 14:34:13 2023 -0500 Merge pull request #153 from monsieuremre/readme - + Updated Readme commit 317867758478619fe1df4ebdb5e22240c40104c0 -Merge: dcead44 d9b5d77 +Merge: dcead44c d9b5d770 Author: Patrick Schleizer Date: Sun Nov 5 14:32:21 2023 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit d9b5d770cfd5f7747f1d606f3136a93034928f30 -Merge: dcead44 ac224b2 +Merge: dcead44c ac224b27 Author: Patrick Schleizer Date: Sun Nov 5 14:31:26 2023 -0500 Merge pull request #150 from monsieuremre/sysreq - + Disable SysRq by default commit dcead44cc6d4272b0966562046f9dab1792845b6 @@ -3981,11 +11902,11 @@ Author: Patrick Schleizer Date: Fri Nov 3 15:55:17 2023 -0400 revert enabling kernel module signature enforcement - + due to issues - + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/63 - + https://github.com/dell/dkms/issues/359 commit 978e3e4abd8f55a877dfe0d6e39b45ee9f58ba6d @@ -3999,7 +11920,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 14:51:14 2023 -0400 port to DKMS drop-in folder - + undisplace /etc/dkms/framework.conf.security-misc moved to /etc/dkms/framework.conf.d/30_security-misc.conf @@ -4008,7 +11929,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 12:55:34 2023 -0400 /usr/sbin/pam-tmpdir-helper exactwhitelist - + https://github.com/Kicksecure/security-misc/pull/147 commit 48adb44c6fd157673cdf7fab3b86ecf7c6b31966 @@ -4022,7 +11943,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 12:17:00 2023 -0400 Revert "allow loading unsigned modules due to issues" - + This reverts commit 661bcd8603425934188cf139f33e20675ff4b765. commit 04b210ee88589ef9e6e214d3a5a614780244abc9 @@ -4032,19 +11953,19 @@ Date: Fri Nov 3 12:10:48 2023 -0400 bumped changelog version commit 5e73f78ed9282bf0895b01d44d9c261ea0050cce -Merge: ceffd2b 8e66a41 +Merge: ceffd2b3 8e66a417 Author: Patrick Schleizer Date: Fri Nov 3 12:10:33 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 8e66a4177868ee7b51dafdb06062b0cb7cbc7415 -Merge: ceffd2b 7dc99d5 +Merge: ceffd2b3 7dc99d54 Author: Patrick Schleizer Date: Fri Nov 3 12:10:00 2023 -0400 Merge pull request #147 from monsieuremre/PAM-tmp-files-hardening - + Depend on libpam-tmpdir for very solid extra security commit 7dc99d54c0358842745ee48c7cc24f589fd63d14 @@ -4054,7 +11975,7 @@ Date: Fri Nov 3 12:09:39 2023 -0400 fix commit 2a602e78d6ca0f87f11de9a30ae2114468243075 -Merge: 3ee4be6 ceffd2b +Merge: 3ee4be65 ceffd2b3 Author: Patrick Schleizer Date: Fri Nov 3 12:08:50 2023 -0400 @@ -4095,9 +12016,9 @@ Author: Patrick Schleizer Date: Fri Nov 3 10:31:59 2023 -0400 do not change default umask for root - + since this causes permission issues in `/etc/` - + https://github.com/Kicksecure/security-misc/pull/151 commit 07540db90d60b10cbd10881b0024d8e8871330de @@ -4105,7 +12026,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 09:45:12 2023 -0400 Revert "Revert "set default umask to 027"" - + This reverts commit f8913ceb2e2fdd274011377c41b5d08e7459e4af. commit f8913ceb2e2fdd274011377c41b5d08e7459e4af @@ -4113,7 +12034,7 @@ Author: Patrick Schleizer Date: Fri Nov 3 09:43:44 2023 -0400 Revert "set default umask to 027" - + This reverts commit cd216095eb8d9387437e653d7764ec765ce42a10. commit 43bd789c30a562aa60349d019107277a428aece8 @@ -4127,11 +12048,11 @@ Author: Patrick Schleizer Date: Fri Nov 3 09:12:24 2023 -0400 set default umask to 027 - + using package libpam-umask - + https://www.debian.org/doc/manuals/securing-debian-manual/ch04s11.en.html#id-1.5.14.19 - + https://github.com/Kicksecure/security-misc/pull/151 commit ac224b270a3a0945d187202f8cca89af0e71a166 @@ -4145,7 +12066,7 @@ Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> Date: Thu Nov 2 10:44:19 2023 +0000 enable service on install - + not sure if this would be the right way to do it commit 9f063584c1f96267b04f8f7fe0eee773f9345370 @@ -4203,19 +12124,19 @@ Date: Wed Nov 1 12:26:21 2023 -0400 bumped changelog version commit bb14a058520b13e242fea9f3022c439c4677bd1d -Merge: 5ed2a5c 44906e8 +Merge: 5ed2a5ce 44906e8f Author: Patrick Schleizer Date: Wed Nov 1 11:11:54 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 44906e8f398aae6e9565b131b82124e738e2d0d1 -Merge: 5ed2a5c f2c23a2 +Merge: 5ed2a5ce f2c23a28 Author: Patrick Schleizer Date: Wed Nov 1 11:11:27 2023 -0400 Merge pull request #142 from monsieuremre/patch-5 - + ssh config commit 5ed2a5ce4a24a1a9c3e722a30aa9c6af1dc5d78a @@ -4225,19 +12146,19 @@ Date: Wed Nov 1 11:10:36 2023 -0400 bumped changelog version commit bb1161986b6d108c4fc5a16a48cdac55f98ab35d -Merge: 7d57684 b7cddd6 +Merge: 7d576842 b7cddd6e Author: Patrick Schleizer Date: Wed Nov 1 10:31:04 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit b7cddd6e552cb5f5139de91ef2aeae6fde691136 -Merge: 7d57684 c975c3c +Merge: 7d576842 c975c3c0 Author: Patrick Schleizer Date: Wed Nov 1 10:30:26 2023 -0400 Merge pull request #143 from monsieuremre/patch-6 - + new lines 990-security-misc.conf commit fc8e201e84e4c777c087fd113c539ca368fd3a31 @@ -4287,7 +12208,7 @@ Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> Date: Fri Oct 27 11:07:53 2023 +0000 new lines 990-security-misc.conf - + added new recommended hardening settings with comments commit f2c23a28319e359c642da2dde424456a1064763f @@ -4309,19 +12230,19 @@ Date: Thu Oct 26 19:31:14 2023 -0400 remove duplicates commit 928cdb81d43dfd337c82917182d2914d9c9d0915 -Merge: a330a9f 39fed05 +Merge: a330a9fd 39fed058 Author: Patrick Schleizer Date: Thu Oct 26 19:29:55 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 39fed058f4734029b303fac4ea9a1b11f652fab4 -Merge: 92a6ecc 99355c6 +Merge: 92a6ecc4 99355c61 Author: Patrick Schleizer Date: Thu Oct 26 19:27:41 2023 -0400 Merge pull request #140 from monsieuremre/patch-3 - + New lines in default permission config commit a330a9fd75314931639e7e873adc31c5cc65d555 @@ -4331,19 +12252,19 @@ Date: Thu Oct 26 19:20:21 2023 -0400 refactor permission-lockdown commit 8bf5ff82be706599f33228ecd6df42be0dc29f39 -Merge: 1123d23 92a6ecc +Merge: 1123d231 92a6ecc4 Author: Patrick Schleizer Date: Thu Oct 26 19:15:04 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 92a6ecc40a4d3bd4d8f3cec7dd9b1334c72399dc -Merge: ca9603a 91c4452 +Merge: ca9603af 91c44524 Author: Patrick Schleizer Date: Thu Oct 26 19:13:34 2023 -0400 Merge pull request #141 from monsieuremre/patch-4 - + New permission-lockdown commit 1123d23114201988ac3f5f50ab6e74a5307d3d52 @@ -4405,9 +12326,9 @@ Author: Patrick Schleizer Date: Thu Oct 26 12:20:48 2023 -0400 enable SUID Disabler and Permission Hardener by default - + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener - + https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706 commit e5d989af5ac2899985c48d60311856fb86e0ddeb @@ -4429,7 +12350,7 @@ Date: Wed Oct 25 17:41:05 2023 -0400 comment commit 5d71217e597aa3366658524ec5395c9f76dd527b -Merge: 6a22351 a2f811a +Merge: 6a22351d a2f811af Author: Patrick Schleizer Date: Wed Oct 25 17:40:13 2023 -0400 @@ -4450,12 +12371,12 @@ Date: Wed Oct 25 17:28:43 2023 -0400 renamed: etc/sysctl.d/30_silent-kernel-printk.conf -> usr/lib/sysctl.d/30_silent-kernel-printk.conf commit a2f811aff0cb4e73c3975093012c223127495707 -Merge: 3317332 ee6716e +Merge: 3317332c ee6716e1 Author: Patrick Schleizer Date: Wed Oct 25 17:26:46 2023 -0400 Merge pull request #135 from monsieuremre/kernel-fix - + Kernel hardening fix commit ee6716e178806912da08b671ae31504ed2f3ac56 @@ -4471,19 +12392,19 @@ Date: Tue Oct 24 05:51:11 2023 -0400 bumped changelog version commit 42c802cd1eca3d2586abde871e4842cdf83490c4 -Merge: f3b40f1 5320c11 +Merge: f3b40f12 5320c11f Author: Patrick Schleizer Date: Tue Oct 24 05:30:15 2023 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 5320c11f3f92b66b7dcab7ca1f67fcba2de5deba -Merge: f3b40f1 f0857fd +Merge: f3b40f12 f0857fd5 Author: Patrick Schleizer Date: Tue Oct 24 05:22:33 2023 -0400 Merge pull request #134 from monsieuremre/patch-1 - + Fix double mount issue for /var/log and /var/tmp commit 1f489719efb37492b9c040ba4e332e8dd70fde1f @@ -4509,7 +12430,7 @@ Author: monsieuremre <130907164+monsieuremre@users.noreply.github.com> Date: Mon Oct 23 15:33:05 2023 +0000 Fix double mount issue for /var/log and /var/tmp - + Mounting var with bind and mounting a subdirectory causes /var/tmp and /var/log bind mounted twice each. can be checked with lsblk. When we bind mount var only after having mounted the subdirectories, everything is mounted only one. commit f3b40f12cb4bad0f2f00d4ba2dec59fb315c0798 @@ -5174,19 +13095,19 @@ Date: Mon May 15 17:31:59 2023 +0000 bumped changelog version commit b11a336b4ff6c748d20aade6e98b25c251bd8c8e -Merge: c921d4e b0b73db +Merge: c921d4e9 b0b73db3 Author: Patrick Schleizer Date: Mon May 15 16:58:11 2023 +0000 Merge remote-tracking branch 'github-kicksecure/master' commit b0b73db3c84f8cc7594b6b181e0e495cd7e92571 -Merge: c921d4e cf003df +Merge: c921d4e9 cf003dfa Author: Patrick Schleizer Date: Mon May 15 12:57:46 2023 -0400 Merge pull request #126 from raja-grewal/Comment - + Update comments commit cf003dfad85434f5a52524fdd97a7f619ba82429 @@ -5202,28 +13123,28 @@ Date: Mon May 15 11:56:30 2023 +0000 bumped changelog version commit 39676395f814007f74ce1edb0aee0ada4d4fa478 -Merge: 6511dac 1f38fcf +Merge: 6511dac1 1f38fcfe Author: Patrick Schleizer Date: Mon May 15 11:34:57 2023 +0000 Merge remote-tracking branch 'github-kicksecure/master' commit 1f38fcfefa1ccd732e4500522cc0978bda69ab0b -Merge: d66a9ba 6ab400c +Merge: d66a9bac 6ab400c9 Author: Patrick Schleizer Date: Mon May 15 07:34:16 2023 -0400 Merge pull request #125 from JeremyRand/typo - + mmap-rnd-bits: Fix typo in error message commit d66a9bac551e7544eed592a69f576d27880e2bf3 -Merge: 6511dac 9d23717 +Merge: 6511dac1 9d23717b Author: Patrick Schleizer Date: Mon May 15 07:34:00 2023 -0400 Merge pull request #124 from JeremyRand/doc-aslr - + README: Document mmap-rnd-bits commit 6ab400c9d982bde16271052f181c87255046037e @@ -5329,19 +13250,19 @@ Date: Fri May 5 14:44:29 2023 +0000 minor mmap-rnd-bits improvements commit 15d0ee100834e01e3f17ee179c3120f37eb3cae5 -Merge: 1137e6c 2d40bbc +Merge: 1137e6c9 2d40bbc8 Author: Patrick Schleizer Date: Fri May 5 14:37:34 2023 +0000 Merge remote-tracking branch 'github-kicksecure/master' commit 2d40bbc8fec7ceea47b64fdebc9e751b26e0cf27 -Merge: 5c6db28 48a68ba +Merge: 5c6db288 48a68ba2 Author: Patrick Schleizer Date: Fri May 5 10:14:43 2023 -0400 Merge pull request #120 from JeremyRand/aslr-ppc64le - + vm.mmap_rnd_bits: Fix ppc64le commit 48a68ba237895c0c6c24ebd256ae6a9adec2628f @@ -5373,25 +13294,25 @@ Author: Jeremy Rand Date: Fri Mar 24 12:32:58 2023 +0000 vm.mmap_rnd_bits: Fix ppc64le - + Probably fixes a bunch of other non-x86_64 arches too. commit 5c6db28881463e8c764872a8cd268c23ac64b8f1 -Merge: 8a34d6c ed5f8be +Merge: 8a34d6c0 ed5f8be9 Author: Patrick Schleizer Date: Fri Mar 31 04:52:55 2023 -0400 Merge pull request #122 from raja-grewal/tcp - + Remove outdated comment about SACK, DSACK, and FACK commit 8a34d6c067bdebc513f34cd3c434b0675f118e10 -Merge: 1137e6c 7a4212d +Merge: 1137e6c9 7a4212dd Author: Patrick Schleizer Date: Fri Mar 31 04:52:18 2023 -0400 Merge pull request #121 from raja-grewal/copyright - + Update Copyright commit ed5f8be9ebd4f34c8b8de78abe0a8df0775b80aa @@ -5423,7 +13344,7 @@ Author: Patrick Schleizer Date: Wed Jan 25 15:13:19 2023 -0500 move kexec disabling to dedicated file `/etc/sysctl.d/30_security-misc_kexec-disable.conf` - + so ram-wipe can `config-package-dev` `hide` this config file commit 56c7c57b3a3929f57c9173f9156b2b9f7f7f854e @@ -5479,7 +13400,7 @@ Author: Patrick Schleizer Date: Mon Jan 9 06:37:45 2023 -0500 disable kexec (revert enabling kexec) - + remove kexec-utils for ram-wipe since moved to its own package commit 87c4e77c017aba7d57ae1fc7cf41a1f3143f1a04 @@ -5499,7 +13420,7 @@ Author: Patrick Schleizer Date: Mon Jan 9 05:34:07 2023 -0500 use warn instead of info for now - + because dracut does not show info messages when kernel parameter quiet is set commit 7fa6946694a997e04b17ecb3a167d767543093a2 @@ -5729,7 +13650,7 @@ Author: Patrick Schleizer Date: Sat Jan 7 15:32:25 2023 -0500 Depends: kexec-tools - + required for cold boot attack defense second RAM wipe after reboot commit b0630f58c136d6c7a964447806ec8ee603a73aa8 @@ -5931,7 +13852,7 @@ Date: Sat Jan 7 12:43:07 2023 -0500 minor commit 450ff378b067070618e4a972f8131acac5b292e0 -Merge: 929f49f b8e82ff +Merge: 929f49f3 b8e82fff Author: Patrick Schleizer Date: Sat Jan 7 12:38:14 2023 -0500 @@ -6100,23 +14021,23 @@ Date: Sun Dec 18 14:37:51 2022 -0500 bumped changelog version commit 75beb52bd5b7cee4a48eead53dbbe7fac9f6cc9e -Merge: 98f753d 58b622f +Merge: 98f753d8 58b622f0 Author: Patrick Schleizer Date: Sun Dec 18 06:24:41 2022 -0500 Merge remote-tracking branch 'github-kicksecure/master' commit 58b622f0fe373b6e2fb30b9564b22f1064f690b0 -Merge: 98f753d f81714b +Merge: 98f753d8 f81714be Author: Patrick Schleizer Date: Sun Dec 18 06:23:26 2022 -0500 Merge pull request #114 from raja-grewal/framebuffer - + Add some framebuffer drivers into blacklist commit f81714be506d1b15c0e79cbe8378bf8a18a2256f -Merge: d67845f 98f753d +Merge: d67845fe 98f753d8 Author: Raja Grewal Date: Tue Dec 13 05:14:56 2022 +0000 @@ -6283,7 +14204,7 @@ Author: Patrick Schleizer Date: Tue Nov 15 12:29:41 2022 -0500 pam-info: create debug log file ~/pam-info-debug.txt - + when file /etc/pam-info-debug exists commit 2872c2ab52ae9a1eaa25ea8b9852401e82d5616a @@ -6303,7 +14224,7 @@ Author: Raja Grewal Date: Wed Nov 9 20:43:59 2022 +1100 Include several framebuffer drivers into blacklist - + These were previously commented out to test for compatibility issues. commit 2319458e9f1a0ae2b60cf5786122c19459bbaea1 @@ -6313,19 +14234,19 @@ Date: Wed Aug 24 18:28:39 2022 -0400 bumped changelog version commit cdfc175953a8ab358bb8e6db2610df11733ba258 -Merge: ff84514 ae4d498 +Merge: ff845146 ae4d4989 Author: Patrick Schleizer Date: Mon Aug 22 06:09:30 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit ae4d4989b0e8ea79b5661f098e9814379ff9401e -Merge: ff84514 d500205 +Merge: ff845146 d500205f Author: Patrick Schleizer Date: Mon Aug 22 06:09:40 2022 -0400 Merge pull request #113 from raja-grewal/master - + Comment out machine check exception commit d500205f556ba896417eb0bae1df0144b00ef7b9 @@ -6393,25 +14314,25 @@ Author: Patrick Schleizer Date: Sat Jul 23 07:49:56 2022 -0400 undo `"force kernel to panic on "oopses"` - + because implemented differently already - + https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713 commit c1c04b4619eea4c79a0dbb5cced3ebb77482877c -Merge: 465775c bfe6b88 +Merge: 465775c9 bfe6b888 Author: Patrick Schleizer Date: Sat Jul 23 07:43:19 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit bfe6b888395abf554623a9e530fe7e6605047e12 -Merge: 465775c ca764d8 +Merge: 465775c9 ca764d8d Author: Patrick Schleizer Date: Sat Jul 23 07:27:24 2022 -0400 Merge pull request #111 from raja-grewal/harden - + Increased kernel hardening at boot commit ca764d8de0f17bb7e6d44e3d79ea1805276fc521 @@ -6457,7 +14378,7 @@ Date: Tue Jul 19 02:29:46 2022 +1000 shuffle and rewording commit 39314b291263a93fcb11756ce12bd8691a1fa0f6 -Merge: bb831d5 c4a1094 +Merge: bb831d57 c4a10947 Author: Raja Grewal Date: Tue Jul 19 00:49:08 2022 +1000 @@ -6476,7 +14397,7 @@ Date: Tue Jul 19 00:37:31 2022 +1000 enforce default net.ipv6.icmp_ignore_bogus_error_responses commit c4a10947608b0d5508ef5b18e0ab34a2ee4f35de -Merge: 2b23703 465775c +Merge: 2b237039 465775c9 Author: Raja Grewal Date: Mon Jul 18 13:36:23 2022 +0000 @@ -6489,19 +14410,19 @@ Date: Sat Jul 16 08:00:16 2022 -0400 bumped changelog version commit 1fafb5f53bbec57812f535e79bfb475628cc58e3 -Merge: 24d6a93 27aa523 +Merge: 24d6a93e 27aa5231 Author: Patrick Schleizer Date: Fri Jul 15 08:09:16 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 27aa5231e2d1dafd89ba19c8d6becf461e781605 -Merge: 24d6a93 a72bbb1 +Merge: 24d6a93e a72bbb18 Author: Patrick Schleizer Date: Fri Jul 15 08:06:08 2022 -0400 Merge pull request #112 from raja-grewal/blacklist - + Corrected kernel module disabling commit a72bbb1883613ee56be29949c153e0edb2d72a29 @@ -6523,27 +14444,27 @@ Date: Wed Jul 13 22:25:53 2022 +1000 Update README.md commit 8f31e5d1d172eb117bde63702f63081da182d5c5 -Merge: 6aa9a94 c410890 +Merge: 6aa9a947 c410890a Author: Patrick Schleizer Date: Wed Jul 13 07:26:58 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit c410890a8ade6d4be13dc99a7003f03ebded8153 -Merge: 6aa9a94 fe0cc10 +Merge: 6aa9a947 fe0cc108 Author: Patrick Schleizer Date: Wed Jul 13 07:24:12 2022 -0400 Merge pull request #110 from raja-grewal/master - - Incorporated Ubuntu’s kernel module blacklists and more verbose errors + + Incorporated Ubuntu_s kernel module blacklists and more verbose errors commit 4e93b4d37e4c6d23a0ac76ddb2144c6504a66ad1 Author: Raja Grewal Date: Wed Jul 13 21:10:39 2022 +1000 Revert "enforce defualt net.ipv4.ip_forward" - + This reverts commit 57b5b2145c4e6779f0b879ee4199d46938f20965. commit a47922ad28fc9ebba93615a6ffdaaeb4887cc140 @@ -6622,7 +14543,7 @@ commit 61ef9bd59f9ff39c140f782ff5b41d0a3c6d97bc Author: Raja Grewal Date: Sun Jul 10 04:52:00 2022 +1000 - Incorporated Ubuntu’s kernel module blacklists + Incorporated Ubuntu_s kernel module blacklists commit 6aa9a9472f10d4d6270dd59fbcd94d9001aca9e6 Author: Patrick Schleizer @@ -6661,19 +14582,19 @@ Date: Sat Jul 9 11:38:04 2022 -0400 fix commit 52c46e4706d5799d452f260616a3909c9a3bc78f -Merge: 1b8500c dc41a58 +Merge: 1b8500cc dc41a581 Author: Patrick Schleizer Date: Sat Jul 9 11:37:41 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit dc41a58102a114e21209aabeef9ad6b851365898 -Merge: 1b8500c e5f8004 +Merge: 1b8500cc e5f8004a Author: Patrick Schleizer Date: Sat Jul 9 11:37:57 2022 -0400 Merge pull request #108 from Krish-sysadmin/master - + Continue for loop if unable to change one directory's permission commit 1b8500cc22fdd6a51ec66ae1b04abccb9a529150 @@ -6699,7 +14620,7 @@ Author: Patrick Schleizer Date: Thu Jul 7 15:39:40 2022 -0400 not blacklist CD-ROM / DVD yet - + https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31 commit d5c16503411bee4199c35a51226fc59924d6e142 @@ -6715,7 +14636,7 @@ Date: Thu Jul 7 15:27:15 2022 -0400 shuffle commit d018bdaf73e109a61c0687a171af843c890729e0 -Merge: 1b287a6 780dc8e +Merge: 1b287a64 780dc8ee Author: Patrick Schleizer Date: Thu Jul 7 15:26:08 2022 -0400 @@ -6738,7 +14659,7 @@ Author: Raja Grewal Date: Fri Jul 8 02:12:04 2022 +1000 Revert "replace /bin/false -> /bin/true" - + This reverts commit f0511635a9725f79863c41a7b8d9f8a077ba8788. commit 28381e81d4a57c59929a37745fa8ba5f3e0b25cb @@ -6848,10 +14769,10 @@ Author: Patrick Schleizer Date: Sat Jul 2 18:12:36 2022 -0400 wipe RAM at shutdown: Ensure any remaining disk cache is erased by Linux' memory poisoning - + by running: `echo 3 > /proc/sys/vm/drop_caches` - + Inspired by Tails: https://gitlab.tails.boum.org/tails/tails/-/blob/master/config/chroot_local-includes/usr/local/lib/initramfs-pre-shutdown-hook @@ -6939,7 +14860,7 @@ Author: Patrick Schleizer Date: Thu Jun 30 13:50:18 2022 -0400 skip ram wipe inside VMs - + https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596/40 commit e06405c7be683450e6c6f737171b4f10513254e7 @@ -7103,9 +15024,9 @@ Author: Patrick Schleizer Date: Wed Jun 29 14:13:30 2022 -0400 ram wipe on shutdown: fix, added `need_shutdown` hook - + Otherwise dracut does not run on shutdown. - + Without `need_shutdown` file `/run/initramfs/.need_shutdown` does not get created. And without that file `/usr/lib/dracut/dracut-initramfs-restore`, which itself is started by `/lib/systemd/system/dracut-shutdown.service` does nothing. @@ -7199,7 +15120,7 @@ Author: Patrick Schleizer Date: Wed Jun 29 09:35:08 2022 -0400 add shebang /bin/sh - + to fix lintian warning security-misc: executable-not-elf-or-script usr/lib/dracut/modules.d/40sdmem-security-misc/wipe.sh @@ -7209,11 +15130,11 @@ Date: Wed Jun 29 09:32:55 2022 -0400 - Wipe LUKS Disk Encryption Key for Root Disk from RAM during Shutdown to defeat Cold Boot Attacks - Confirm in console output if encrypted mounts (root disk) is unmounted. (Because that is a pre-condition for wiping the LUKS full disk encryption key from RAM.) - + Thanks to @friedy10! - + https://github.com/friedy10/dracut/tree/master/modules.d/40sdmem - + https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596 commit adca1ebdf6c83c5c1c846cdb29f3e16ea9cdf32f @@ -7235,19 +15156,19 @@ Date: Wed Jun 8 09:04:03 2022 -0400 remove unicode commit fcaec49675ce7e240bdd049aab184fbee0945c7d -Merge: 5c43197 995e4ba +Merge: 5c43197f 995e4ba7 Author: Patrick Schleizer Date: Wed Jun 8 08:20:24 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 995e4ba7fafc1bf4f691b83dde415c57cebed63d -Merge: 616fe85 6e8f584 +Merge: 616fe857 6e8f584d Author: Patrick Schleizer Date: Wed Jun 8 08:19:03 2022 -0400 Merge pull request #104 from ntninja/patch-1 - + Fix issues found with permission-hardening on my system commit 5c43197f10df3a49704a66ef3e3d56f122be4775 @@ -7299,19 +15220,19 @@ Date: Fri May 20 14:46:38 2022 -0400 copyright commit 78a9956b73498bad471ee1cb0fa0993f2e5ce3c0 -Merge: 4a3ed17 7651308 +Merge: 4a3ed171 76513087 Author: Patrick Schleizer Date: Thu May 19 19:41:33 2022 -0400 Merge remote-tracking branch 'github-kicksecure/master' commit 76513087872943442df32451de5af158c2bbe944 -Merge: 4a3ed17 93efa50 +Merge: 4a3ed171 93efa506 Author: Patrick Schleizer Date: Thu May 19 19:39:42 2022 -0400 Merge pull request #103 from 0xC0ncord/bugfix/selinuxfs_restrictions - + hide-hardware-info: re-enable restrictions on sysfs when using SELinux commit 4a3ed17160c14ba7122d770665b53bde96038307 @@ -7355,11 +15276,11 @@ Author: Patrick Schleizer Date: Thu Feb 10 13:44:55 2022 -0500 fix, skip deletion of system.map files on read-only filesystems - + This is required for Qubes /lib/modules read-only implementation at time of writing. - + Thanks to @marmarek for the bug report! - + https://forums.whonix.org/t/remove-system-map-cannot-work-lib-modules-is-mounted-read-only/13324 commit 356232677a036cd1a673d805caa4d74a327ea096 @@ -7379,7 +15300,7 @@ Author: 0xC0ncord Date: Fri Oct 8 22:11:58 2021 -0400 hide-hardware-info: re-enable restrictions on sysfs when using SELinux - + When using SELinux, restrict the parts of sysfs explicitly to ensure restrictions are working as expected. @@ -7436,7 +15357,7 @@ Author: Patrick Schleizer Date: Mon Sep 6 08:22:55 2021 -0400 do not set kernel parameter `quiet loglevel=0` for recovery boot option - + for easier debugging commit 49902b8c56512c3ee8b3d16b0ca513e44349c66d @@ -7504,7 +15425,7 @@ Author: Patrick Schleizer Date: Wed Sep 1 15:55:53 2021 -0400 fix faillock implementation - + dovecot / ssh are exempted commit 8b104f544a9e4e8da1691659fefa4999a4f6f085 @@ -7512,7 +15433,7 @@ Author: Patrick Schleizer Date: Wed Sep 1 15:45:36 2021 -0400 fix, add sshd to pam_service_exclusion_list - + to avoid faillock commit 224ae730c13f4add672fffaf58206eeb7ae24090 @@ -7544,11 +15465,11 @@ Author: Patrick Schleizer Date: Tue Aug 17 15:21:26 2021 -0400 add hardened malloc compatibility for haveged workaround - + `/lib/systemd/system/haveged.service.d/30_security-misc.conf` - + `SystemCallFilter=getrandom` - + Otherwise haveged will exit with a core dump. commit 8676beef90040bdf0782e0a9c683c6463ddb48b5 @@ -7562,7 +15483,7 @@ Author: Patrick Schleizer Date: Tue Aug 10 17:13:00 2021 -0400 port from pam_tally2 to pam_faillock - + since pam_tally2 was deprecated upstream commit 2bf0e7471cbd3b813ce385d994e43e48636f7a0b @@ -7570,7 +15491,7 @@ Author: Patrick Schleizer Date: Tue Aug 10 15:11:01 2021 -0400 port from pam_tally2 to pam_faillock - + since pam_tally2 was deprecated upstream commit 2aea74bd715d865f44f91aaab6ca1bf0a00a2b0b @@ -7592,7 +15513,7 @@ Author: Patrick Schleizer Date: Tue Aug 3 13:04:34 2021 -0400 `lintian --suppress-tags obsolete-command-in-modprobe.d-file` - + https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/24 commit 50bdd097df4c87cd4507311df9c0b14d237c534b @@ -7618,11 +15539,11 @@ Author: Patrick Schleizer Date: Tue Aug 3 12:37:39 2021 -0400 enable "`apt-get --error-on=any`" by default - + makes apt exit non-zero for transient failures - + `/etc/apt/apt.conf.d/40error-on-any` - + https://forums.whonix.org/t/debian-bullseye-apt-get-error-on-any/12068 commit 240ec7672a4d513e7e6cca280aca3d67c265d1cc @@ -7690,7 +15611,7 @@ Author: Patrick Schleizer Date: Sun Jul 25 11:26:20 2021 -0400 improve LKRG VirtualBox host configuration - + as per https://github.com/openwall/lkrg/issues/82#issuecomment-886188999 commit 3ebe9e7c530b39f1b0429a97eab2627f2bbd1635 @@ -7704,7 +15625,7 @@ Author: Patrick Schleizer Date: Sat Jul 24 18:03:40 2021 -0400 add LKRG compatibility settings automation for VirtualBox hosts - + https://github.com/openwall/lkrg/issues/82 commit 0f86ffef04e533be1c88584b6419c276d176fc05 @@ -7718,7 +15639,7 @@ Author: Patrick Schleizer Date: Sun Jun 20 11:18:56 2021 -0400 pam-abort-on-locked-password: more descriptive error handling - + https://forums.whonix.org/t/restrict-root-access/7658/1 commit 0f3dbfc4a1fb08b5542e265dfbeab4e7f401549d @@ -7740,19 +15661,19 @@ Date: Mon Jun 7 12:13:37 2021 -0400 bumped changelog version commit 30d1ce36af7835d47e0b53af475f3a7e99617b77 -Merge: 0305baf 70a1eb2 +Merge: 0305baf2 70a1eb25 Author: Patrick Schleizer Date: Mon Jun 7 12:11:58 2021 -0400 Merge remote-tracking branch 'github-whonix/master' commit 70a1eb25a5976e0461056ff2c56bd82ab5df6c2c -Merge: 0305baf 97d8db3 +Merge: 0305baf2 97d8db3f Author: Patrick Schleizer Date: Sat Jun 5 15:55:41 2021 -0400 Merge pull request #101 from madaidan/sudo - + Restrict sudo's file permissions commit 97d8db3f74b9fc00c8f4416cb72966e62c7de88e @@ -7790,7 +15711,7 @@ Author: Patrick Schleizer Date: Thu Apr 29 11:17:30 2021 -0400 config-package-dev displace /etc/dkms/framework.conf - + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 commit e2afd00627b097f75467cd0e2fe7e15977141026 @@ -7798,17 +15719,17 @@ Author: Patrick Schleizer Date: Thu Apr 29 11:14:30 2021 -0400 modify DKMS configuration file `/etc/dkms/framework.conf` - + Lower parallel compilation jobs to 1 if less than 2 GB RAM to avoid freezing of virtual machines. - + `parallel_jobs=1` - + This does not necessarily belong into security-misc, however likely security-misc will need to modify `/etc/dkms/framework.conf` in the future to enable kernel module signing. - + https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/26 - + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 commit 3ba3b371873d221db6845fb0fe52191b8b349b0a @@ -7816,11 +15737,11 @@ Author: Patrick Schleizer Date: Thu Apr 29 11:08:30 2021 -0400 add `/etc/dkms/framework.conf.security-misc` - + original, from - https://github.com/dell/dkms/blob/master/dkms_framework.conf - https://raw.githubusercontent.com/dell/dkms/master/dkms_framework.conf - + https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/58 commit 1d35bdf2912d1dfd0b49ce727338f86d17decd72 @@ -7834,9 +15755,9 @@ Author: Patrick Schleizer Date: Sat Apr 3 11:44:13 2021 -0400 systemd RemainAfterExit=yes - + for better usability - + https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/33 commit e8ea94325b1df7bc0c47eabdfbd7c24b2fe51539 @@ -7864,19 +15785,19 @@ Date: Mon Mar 1 09:15:44 2021 -0500 comment commit 3382192b89de3891d45261f138652bdb48c5674b -Merge: 7f30d70 2e8e3c0 +Merge: 7f30d702 2e8e3c07 Author: Patrick Schleizer Date: Mon Mar 1 09:12:18 2021 -0500 Merge remote-tracking branch 'github/master' commit 2e8e3c07c4dda7f8500237dfa7a1d2bc7aecef5d -Merge: 7f30d70 4db7d6b +Merge: 7f30d702 4db7d6be Author: Patrick Schleizer Date: Mon Mar 1 14:11:28 2021 +0000 Merge pull request #100 from 0xC0ncord/bugfix/selinuxfs_restrictions - + hide-hardware-info: allow unrestricting selinuxfs commit 7f30d702953b2e46255e3e8e71ee47af3f5a5725 @@ -7896,7 +15817,7 @@ Author: Kenton Groombridge Date: Sat Feb 6 03:02:08 2021 -0500 hide-hardware-info: allow unrestricting selinuxfs - + On SELinux systems, the /sys/fs/selinux directory must be visible to userspace utilities in order to function properly. @@ -7935,9 +15856,9 @@ Author: Patrick Schleizer Date: Wed Jan 27 05:49:34 2021 -0500 skip counting failed login attempts from dovecot - + Failed dovecot logins should not result in account getting locked. - + revert "use pam_tally2 only for login" commit 480f74cab6d79886fe29eeecc5b7ebc1f138f8dd @@ -7951,7 +15872,7 @@ Author: Patrick Schleizer Date: Sun Jan 24 05:04:48 2021 -0500 use pam_tally2 only for login - + to skip counting failed login attempts over ssh and mail login commit 126c31c37d17a55b0980dcae8c546aeed4282a99 @@ -7997,19 +15918,19 @@ Date: Tue Jan 12 03:19:31 2021 -0500 new file: README_generic.md commit 94627f0875e69c9314faab8b0dc2dbe22af5c88f -Merge: 353e74f 79876f7 +Merge: 353e74fb 79876f7b Author: Patrick Schleizer Date: Tue Jan 12 03:18:41 2021 -0500 Merge remote-tracking branch 'github/master' commit 79876f7b1261006885a713dbfda97609c8e81f3f -Merge: 353e74f 3066b5a +Merge: 353e74fb 3066b5ad Author: Patrick Schleizer Date: Tue Jan 12 08:17:04 2021 +0000 Merge pull request #99 from madaidan/docs - + Overhaul documentation commit 3066b5ad972f16069361999afbca0978986db862 @@ -8065,7 +15986,7 @@ Author: Patrick Schleizer Date: Sun Dec 6 04:08:58 2020 -0500 /opt - + https://forums.whonix.org/t/suid-disabler-and-permission-hardener/7706/68 commit 261ef85c14ff9c13d3d7734d8c9eba5a54497187 @@ -8079,7 +16000,7 @@ Author: Patrick Schleizer Date: Tue Dec 1 05:14:48 2020 -0500 SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists - + `whitelists_disable_all=true` commit b09cc0de6af2d7e12110a0f3030234539288abad @@ -8087,7 +16008,7 @@ Author: Patrick Schleizer Date: Tue Dec 1 05:10:26 2020 -0500 Revert "SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists" - + This reverts commit 36a471ebce883f7a1660977f486b21ece320d0c2. commit 704f0500ba4e23a1e5b33688db02e03b1169046d @@ -8095,7 +16016,7 @@ Author: Patrick Schleizer Date: Tue Dec 1 05:03:16 2020 -0500 fix, rename 40_default_whitelist_[...].conf to 25_default_whitelist_[...].conf - + since whitelist needs to be defined before SUID removal commands commit 36a471ebce883f7a1660977f486b21ece320d0c2 @@ -8103,7 +16024,7 @@ Author: Patrick Schleizer Date: Tue Dec 1 05:02:34 2020 -0500 SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists - + `whitelists_disable_all=true` commit 318ab570aacd48b7f163331dc2ba8b012e0d2336 @@ -8111,11 +16032,11 @@ Author: Patrick Schleizer Date: Tue Dec 1 04:28:15 2020 -0500 simplify disabling of SUID Disabler and Permission Hardener whitelist - + split `/etc/permission-hardening.d/30_default.conf` into multiple files - + `/etc/permission-hardening.d/40_default_whitelist_[...].conf` - + therefore make it easier to delete any whitelisted SUID binaries commit cf07e977bd6697af7a4326d7705447d500d35593 @@ -8123,7 +16044,7 @@ Author: Patrick Schleizer Date: Sun Nov 29 09:09:42 2020 -0500 add `/bin/pkexec exactwhitelist` for consistency - + since there is already `/usr/bin/pkexec exactwhitelist` commit fe274838861ada125eccdca11ba044123fdae663 @@ -8137,9 +16058,9 @@ Author: Patrick Schleizer Date: Sat Nov 28 05:31:12 2020 -0500 add feature `/usr/lib/security-misc/permission-hardening-undo /path/to/filename` - + to allow removing 1 SUID - + fix, show INFO message if file does not exist during removal rather than ERROR commit 0ef35f877066ddac21737e707829c4571bb76abd @@ -8165,11 +16086,11 @@ Author: Patrick Schleizer Date: Thu Nov 5 06:42:47 2020 -0500 fix, no longer unconditionally abort pam for user accounts with locked passwords - + as locked user accounts might have valid sudoers exceptions - + Thanks to @mimp for the bug report! - + https://forums.whonix.org/t/pam-abort-on-locked-password-and-running-privileged-command-from-web-browser/10521 commit 211769dc65a5c98cbdb55ce62e83c9e2a9fa1540 @@ -8222,19 +16143,19 @@ Date: Mon Oct 5 07:03:37 2020 -0400 bumped changelog version commit 3adb2c92d9551f649b177753fede18da3cc4b0eb -Merge: feb7cea 5856013 +Merge: feb7cea4 58560138 Author: Patrick Schleizer Date: Sat Oct 3 14:10:32 2020 -0400 Merge remote-tracking branch 'github/master' commit 58560138cdc36fa5f6142f75f0fed53bcad96363 -Merge: feb7cea 06ffd5d +Merge: feb7cea4 06ffd5d2 Author: Patrick Schleizer Date: Sat Oct 3 18:09:07 2020 +0000 Merge pull request #77 from madaidan/debugfs - + Restrict access to debugfs commit 06ffd5d2201152c60eb4309860b8c42be386dccb @@ -8254,7 +16175,7 @@ Author: Patrick Schleizer Date: Mon Sep 28 10:29:50 2020 -0400 unblacklist squashfs as this would likely break Whonix-Host ISO - + https://github.com/Whonix/security-misc/pull/75#issuecomment-700044182 commit 4070133ed65af409adeb6f8c7970d3bc7074b02b @@ -8262,32 +16183,32 @@ Author: Patrick Schleizer Date: Mon Sep 28 10:25:57 2020 -0400 unblacklist vfat - + https://github.com/Whonix/security-misc/pull/75#issuecomment-695201068 commit 77d461ec08ffdf0eb6a5d124927d9f9748c0dd3c -Merge: 5fc7b79 3684ab5 +Merge: 5fc7b791 3684ab58 Author: Patrick Schleizer Date: Mon Sep 28 10:24:59 2020 -0400 Merge remote-tracking branch 'github/master' commit 3684ab585eeab46ff17a1d410ce1bcff1a63968c -Merge: ae90107 a813e7d +Merge: ae90107e a813e7da Author: Patrick Schleizer Date: Mon Sep 28 14:24:15 2020 +0000 Merge pull request #75 from flawedworld/patch-1 - + Blacklist more modules (based on OpenSCAP for RHEL 8) commit ae90107e6df4d312a6734985df38b8533d1283c8 -Merge: 5fc7b79 8f7727e +Merge: 5fc7b791 8f7727e8 Author: Patrick Schleizer Date: Mon Sep 28 14:23:42 2020 +0000 Merge pull request #76 from flawedworld/patch-2 - + Add IPv6 sysctl options and enforce kernel.perf_event_paranoid=3 commit a813e7da07a39e96e0cd7937aee7568307a00287 @@ -8303,19 +16224,19 @@ Date: Sat Sep 19 09:28:27 2020 -0400 bumped changelog version commit bff6ce7abb920d55edc49b19340a1e9251a4cd8c -Merge: 98c0dec 9239c8b +Merge: 98c0deca 9239c8b8 Author: Patrick Schleizer Date: Sat Sep 19 06:54:50 2020 -0400 Merge remote-tracking branch 'github/master' commit 9239c8b8074018090d4fa1381aa06e66a99359cc -Merge: 98c0dec 8dfdec1 +Merge: 98c0deca 8dfdec1d Author: Patrick Schleizer Date: Sat Sep 19 10:54:21 2020 +0000 Merge pull request #71 from onions-knight/patch-1 - + Update thunar.xml commit 8f7727e823a86a1826686d5c95d0070721c7acba @@ -8329,7 +16250,7 @@ Author: flawedworld <38294951+flawedworld@users.noreply.github.com> Date: Fri Sep 18 23:29:04 2020 +0100 Disallow kernel profiling by users without CAP_SYS_ADMIN - + It's the default on a lot of stuff, but still nice to have. commit 98c0decaa46c6fb839062ff9af0556d821c254e6 @@ -8343,11 +16264,11 @@ Author: Patrick Schleizer Date: Mon Aug 3 08:12:19 2020 -0400 fix, allow group `sudo` and `console` to use consoles - + fix /etc/security/access-security-misc.conf syntax error - + Thanks to @81a989 for the bug report! - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/31 commit b09f5ddc154d6561fd97b436feeb6a6225f89206 @@ -8373,9 +16294,9 @@ Author: Patrick Schleizer Date: Thu May 14 13:47:58 2020 -0400 move "kernel.printk = 3 3 3 3" to separate file /etc/sysctl.d/30_silent-kernel-printk.conf - + so package debug-misc can easily disable it - + https://phabricator.whonix.org/T950 commit 81cb6ad2462a900f9c5193278de70ada62a5585b @@ -8389,9 +16310,9 @@ Author: Patrick Schleizer Date: Thu Apr 23 12:26:31 2020 -0400 Prevent kernel info leaks in console during boot. - + add kernel parameter `quiet loglevel=0` - + https://phabricator.whonix.org/T950 commit aa5631b02b0127b4681ae08c973b08b23befd701 @@ -8405,11 +16326,11 @@ Author: Patrick Schleizer Date: Thu Apr 16 08:00:31 2020 -0400 Prevent kernel info leaks in console during boot. - + By setting `kernel.printk = 3 3 3 3`. - + https://phabricator.whonix.org/T950 - + Thanks to @madaidan for the suggestion! commit 4898a9e753e9399e83e4a39d8fa340e1ad9d4f6d @@ -8417,9 +16338,9 @@ Author: Patrick Schleizer Date: Thu Apr 16 07:54:33 2020 -0400 fix, sysctl-initramfs: switch log to /run/initramfs/sysctl-initramfs-error.log - + since ephemeral, in RAM, not written to disk, no conflict with grub-live - + https://forums.whonix.org/t/kernel-hardening/7296/435 commit 701da5f6cc911e3946904c152078dc6c637e5070 @@ -8463,13 +16384,13 @@ Author: Patrick Schleizer Date: Mon Apr 13 06:50:32 2020 -0400 /etc/security/access-security-misc.conf white list ttyS0 etc. - + ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9 - + Thanks to @subpar_marlin for the bug report and helping to fix this! - + https://forums.whonix.org/t/how-do-i-enter-the-whonix-shell-from-cli/7271/43 - + https://forums.whonix.org/t/etc-security-hardening/8592 commit b3ce18f0f9f1da0552a4a1bd882a5b5dda13626e @@ -8477,7 +16398,7 @@ Author: Patrick Schleizer Date: Sun Apr 12 16:54:10 2020 -0400 disable proc-hidepid by default because incompatible with pkexec - + and undo pkexec wrapper commit 442931529121e9e402e7ac56e27df3dcec43167b @@ -8485,7 +16406,7 @@ Author: Patrick Schleizer Date: Sun Apr 12 16:52:55 2020 -0400 disable proc-hidepid by default because incompatible with pkexec - + and undo pkexec wrapper commit 72be31e870057b035651c1b5a7e9a9db149e9d25 @@ -8493,7 +16414,7 @@ Author: Patrick Schleizer Date: Sun Apr 12 16:48:13 2020 -0400 disable proc-hidepid by default because incompatible with pkexec - + and undo pkexec wrapper commit 938e929f39ff68296ab01a4b619f963ad3bdf535 @@ -8501,7 +16422,7 @@ Author: Patrick Schleizer Date: Sun Apr 12 16:37:51 2020 -0400 add pkexec to suid default whitelist - + /usr/bin/pkexec exactwhitelist /usr/bin/pkexec.security-misc-orig exactwhitelist @@ -8522,9 +16443,9 @@ Author: Patrick Schleizer Date: Wed Apr 8 21:04:02 2020 +0000 vm.swappiness=1 - + import from swappiness-lowest - + https://forums.whonix.org/t/vm-swappiness-1-set-swapiness-to-lowest-setting-still-useful-swappiness-lowest/9278 commit 642d4d8d939f33c19564dcc5a0ed46d85feb80aa @@ -8550,7 +16471,7 @@ Author: Patrick Schleizer Date: Wed Apr 8 16:46:11 2020 +0000 fix etc/default/grub.d/40_kernel_hardening.cfg - + in Qubes if no kernel package is installed commit bfd6018d8d108ee8691556529121fe2a679de1d2 @@ -8618,11 +16539,11 @@ Author: Patrick Schleizer Date: Thu Apr 2 06:04:45 2020 -0400 console lockdown: allow members of group `sudo` to use console - + https://forums.whonix.org/t/etc-security-hardening/8592 - + https://github.com/Whonix/security-misc/pull/74#issuecomment-607748407 - + https://www.whonix.org/wiki/Dev/Strong_Linux_User_Account_Isolation#Console_Lockdown commit 7764ee0d202193dc67f5805fc23be2b804962186 @@ -8742,19 +16663,19 @@ Date: Sat Mar 21 14:12:42 2020 -0400 remove trailing space commit 7c25fc517e6f42d4364a55407f6bf0c84d130c8e -Merge: 20f0c57 1cbc7f6 +Merge: 20f0c574 1cbc7f6b Author: Patrick Schleizer Date: Sat Mar 21 14:12:25 2020 -0400 Merge remote-tracking branch 'origin/master' commit 1cbc7f6bed8acc112b610e05f527cffc6e9e1e87 -Merge: 20f0c57 89ada11 +Merge: 20f0c574 89ada11c Author: Patrick Schleizer Date: Sat Mar 21 18:11:57 2020 +0000 Merge pull request #73 from madaidan/sysctl-initramfs - + Only remount in sysctl-initramfs if already mounted read-only commit 89ada11cf9a76cf02b3d5f92fd5c66194fe40ff0 @@ -8764,19 +16685,19 @@ Date: Sat Mar 21 17:49:07 2020 +0000 Only remount if already mounted read-only commit 20f0c574d5424c78ab6b4d3829a6662615967ba5 -Merge: e4118cb 2938182 +Merge: e4118cb2 2938182c Author: Patrick Schleizer Date: Sat Mar 21 13:28:43 2020 -0400 Merge remote-tracking branch 'origin/master' commit 2938182ce6303e6e55086e2e9e82f8263a3c8e76 -Merge: e4118cb c8826d6 +Merge: e4118cb2 c8826d67 Author: Patrick Schleizer Date: Sat Mar 21 17:26:37 2020 +0000 Merge pull request #72 from madaidan/master - + Fix sysctl-initramfs logs commit c8826d6702ebaf280994effb22aea39b4cfd2dac @@ -8790,7 +16711,7 @@ Author: onions-knight <38859709+onions-knight@users.noreply.github.com> Date: Tue Mar 17 16:38:53 2020 +0000 Update thunar.xml - + Adding Delete option for thunar on right mouse click (removed in Debian 10). See https://forums.whonix.org/t/whonix-host-calamares-branding-suggestion/7772/26 commit e4118cb21eb8765bc8f4e7b5e05d464d72575824 @@ -8800,19 +16721,19 @@ Date: Thu Mar 12 04:43:08 2020 -0400 bumped changelog version commit e6e7886a6e3dca1a75943c5a04c4d29ab8682cec -Merge: 04a87f7 711e786 +Merge: 04a87f70 711e786b Author: Patrick Schleizer Date: Wed Mar 11 09:08:41 2020 -0400 Merge remote-tracking branch 'origin/master' commit 711e786be504179c832172acb39d567b323520e6 -Merge: 04a87f7 4d0de87 +Merge: 04a87f70 4d0de87f Author: Patrick Schleizer Date: Wed Mar 11 13:06:23 2020 +0000 Merge pull request #70 from madaidan/userfaultfd - + Fix unprivileged_userfaultfd commit 4d0de87f799d8032731140e9a5815d4773d91baa @@ -8838,13 +16759,13 @@ Author: Patrick Schleizer Date: Sun Mar 8 08:07:10 2020 -0400 disable `vm.unprivileged_userfaultfd=0` for now - + because broken - + https://forums.whonix.org/t/kernel-hardening/7296/406 - + reverts "Restrict the userfaultfd() syscall to root as it can make heap sprays easier." - + https://duasynt.com/blog/linux-kernel-heap-spray commit 44351ec9b78d59aeeef44675e8e203c7ace243f0 @@ -8902,23 +16823,23 @@ Date: Tue Mar 3 09:07:42 2020 -0500 readme commit 63c6405ab74f0dd5f3ec3838135b29304a3d1fc8 -Merge: e3e39f2 453aa8a +Merge: e3e39f22 453aa8a4 Author: Patrick Schleizer Date: Sat Feb 29 07:34:46 2020 -0500 Merge remote-tracking branch 'origin/master' commit 453aa8a4eb76fe56ad67f1aea8abfeb122e68a9c -Merge: e3e39f2 60fbf8b +Merge: e3e39f22 60fbf8b0 Author: Patrick Schleizer Date: Sat Feb 29 12:28:32 2020 +0000 Merge pull request #65 from madaidan/userfaultfd - + Restrict the userfaultfd() syscall to root commit e3e39f22354595c9f21c243d7bdadc1487374db8 -Merge: 649ec5d bd7678c +Merge: 649ec5df bd7678c5 Author: Patrick Schleizer Date: Sat Feb 29 05:01:41 2020 -0500 @@ -8929,10 +16850,10 @@ Author: Patrick Schleizer Date: Sat Feb 29 04:59:56 2020 -0500 pkexec wrapper: fix gdebi / synaptic - + but at cost of checking for passwordless sudo /etc/suders /etc/sudoers.d exceptions. - + http://forums.whonix.org/t/cannot-use-pkexec/8129/53 commit 32269d32b63e549f76b4090b675dd53256fbc42d @@ -8948,12 +16869,12 @@ Date: Sat Feb 29 04:59:02 2020 -0500 description commit bd7678c574819298b364185fe7e3362c7e8d4930 -Merge: d04d4bf 42d3b98 +Merge: d04d4bf0 42d3b986 Author: Patrick Schleizer Date: Fri Feb 28 12:04:05 2020 +0000 Merge pull request #66 from madaidan/mce - + Fix docs commit 42d3b986c41854fc2990557d2333874e9379793b @@ -8993,19 +16914,19 @@ Date: Mon Feb 24 18:23:15 2020 +0000 Restrict the userfaultfd() syscall to root commit 221000db5b184664c09dfe9cb7055de45331a7e1 -Merge: 01eaee9 c7f2537 +Merge: 01eaee99 c7f25379 Author: Patrick Schleizer Date: Mon Feb 17 03:17:11 2020 -0500 Merge remote-tracking branch 'origin/master' commit c7f2537930925e3ec250db81791a107af003079b -Merge: 01eaee9 8ea4e50 +Merge: 01eaee99 8ea4e50c Author: Patrick Schleizer Date: Mon Feb 17 08:16:34 2020 +0000 Merge pull request #64 from madaidan/extra_latent_entropy - + Gather more entropy during boot commit 8ea4e50c8e9c3c9ee650b665a32b78f67aedc1aa @@ -9027,7 +16948,7 @@ Date: Sat Feb 15 15:35:44 2020 -0500 bumped changelog version commit 412a83923dd09f36a25ebf9ce1991369d09c5e34 -Merge: dce54d5 4399a51 +Merge: dce54d5d 4399a512 Author: Patrick Schleizer Date: Sat Feb 15 15:30:32 2020 -0500 @@ -9046,12 +16967,12 @@ Date: Sat Feb 15 15:28:30 2020 -0500 readme commit 4399a512bef77ddec428bd4150cacebb77fc22da -Merge: 757df8f a79ce7f +Merge: 757df8fc a79ce7fa Author: Patrick Schleizer Date: Sat Feb 15 19:43:05 2020 +0000 Merge pull request #63 from madaidan/ldisc_autoload - + Document ldisc_autoload better commit a79ce7fa68c22048d3e10789fe209b14b818d0fb @@ -9061,23 +16982,23 @@ Date: Sat Feb 15 17:30:21 2020 +0000 Document ldisc_autoload better commit 757df8fceb29d9b6143cf26e73cb31dde69d0a71 -Merge: 9bbae90 a9a1581 +Merge: 9bbae903 a9a15817 Author: Patrick Schleizer Date: Sat Feb 15 05:43:43 2020 -0500 Merge remote-tracking branch 'origin/master' commit a9a1581720739966e94f18be556552e9d75d63b1 -Merge: 9bbae90 1e5946c +Merge: 9bbae903 1e5946c7 Author: Patrick Schleizer Date: Sat Feb 15 10:42:20 2020 +0000 Merge pull request #60 from madaidan/sysrq - + Restrict the SysRq key commit 1e5946c795e3962fdc2229146b9331d36a1d6c41 -Merge: 0f49736 9bbae90 +Merge: 0f497369 9bbae903 Author: Patrick Schleizer Date: Sat Feb 15 10:41:52 2020 +0000 @@ -9090,37 +17011,37 @@ Date: Sat Feb 15 05:29:48 2020 -0500 remove-system.map: lower verbosity output commit cce35e5109489df44916a08722d9016bb1e578ec -Merge: 14140ad e403517 +Merge: 14140ad4 e4035179 Author: Patrick Schleizer Date: Sat Feb 15 05:27:52 2020 -0500 Merge remote-tracking branch 'origin/master' commit e40351796e297673e1ec45dee7483079e96d9639 -Merge: 5124f8c 31009f0 +Merge: 5124f8ce 31009f0b Author: Patrick Schleizer Date: Sat Feb 15 10:25:15 2020 +0000 Merge pull request #62 from madaidan/shred - + Shred System.map files commit 5124f8cebcf6113547d11fc5193f83af1a2b6f84 -Merge: ac8757a 9b76713 +Merge: ac8757a0 9b767139 Author: Patrick Schleizer Date: Sat Feb 15 10:18:56 2020 +0000 Merge pull request #61 from madaidan/disable_early_pci_dma - + Avoid holes in IOMMU commit ac8757a031a02c6cbad564e6a857954c0cf01a54 -Merge: ad6b766 ace6211 +Merge: ad6b7668 ace62111 Author: Patrick Schleizer Date: Sat Feb 15 10:09:46 2020 +0000 Merge pull request #59 from madaidan/ldisc - + Restrict loading line disciplines to CAP_SYS_MODULE commit 31009f0bfa10e7b67f5823a5be92273e5414fff3 @@ -9160,12 +17081,12 @@ Date: Fri Feb 14 17:50:19 2020 +0000 Restrict loading line disciplines to CAP_SYS_MODULE commit ad6b76688677cd4f9f0b2f2524c0f6b0a381bf29 -Merge: 14140ad 14f8458 +Merge: 14140ad4 14f84583 Author: Patrick Schleizer Date: Thu Feb 13 18:40:58 2020 +0000 Merge pull request #57 from madaidan/sysctl - + Prevent symlink/hardlink TOCTOU races commit 14140ad41ba45b2457570a7df28b42cfd3bf3155 @@ -9181,19 +17102,19 @@ Date: Thu Feb 13 13:38:21 2020 -0500 readme commit 76a51a3b45113b4f771397bf32daae3fb38af6a6 -Merge: 163e20b 5ebab39 +Merge: 163e20b8 5ebab397 Author: Patrick Schleizer Date: Thu Feb 13 13:37:34 2020 -0500 Merge remote-tracking branch 'origin/master' commit 5ebab397b201f431e3d0ca3bebfb71fa61a7ed2b -Merge: 163e20b 2796c2d +Merge: 163e20b8 2796c2dd Author: Patrick Schleizer Date: Thu Feb 13 18:36:41 2020 +0000 Merge pull request #58 from madaidan/mitigations - + Improve CPU mitigations documentation commit 2796c2dd00fca0bb458bdb4ea5c2cdbd35854bef @@ -9233,19 +17154,19 @@ Date: Wed Feb 5 06:31:48 2020 -0500 bumped changelog version commit 3024006f63be34f0c9d2968b1839a855419792dd -Merge: 8c5cd86 024576e +Merge: 8c5cd865 024576e3 Author: Patrick Schleizer Date: Tue Feb 4 00:24:50 2020 -0500 Merge remote-tracking branch 'origin/master' commit 024576e3307e45c90b97ed8658ee82ceb1ed00aa -Merge: 8c5cd86 e4c6e89 +Merge: 8c5cd865 e4c6e897 Author: Patrick Schleizer Date: Tue Feb 4 05:24:05 2020 +0000 Merge pull request #56 from HulaHoop0/patch-1 - + kvm.nx_huge_pages=force commit e4c6e897cf37cbf5de6d90888a0ddbe56db11c2f @@ -9307,16 +17228,16 @@ Author: Patrick Schleizer Date: Thu Jan 30 05:55:13 2020 -0500 unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...) - + this might reduce performance - + * `spectre_v2=on` * `spec_store_bypass_disable=on` * `tsx=off` * `tsx_async_abort=full,nosmt` - + Thanks to @madaidan for the suggestion! - + https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647 commit 2711d0f7f08362f97383fbae81ce9d520b19dcbc @@ -9336,7 +17257,7 @@ Author: Patrick Schleizer Date: Thu Jan 30 00:46:48 2020 -0500 set kernel boot parameter `l1tf=full,force` and `nosmt=force` - + https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 commit efc40da4fb1fffcc760685cda0e49dc04da4c5fe @@ -9404,9 +17325,9 @@ Author: Patrick Schleizer Date: Fri Jan 24 04:30:36 2020 -0500 merge the many modprobe.d config files into 1 - + and use a name starting with double digits - + to make it easier to disable settings using a lexically higher config file commit 6a4c493213929b354a3c8d2acf2325473ae63cfd @@ -9414,9 +17335,9 @@ Author: Patrick Schleizer Date: Fri Jan 24 04:26:36 2020 -0500 merge the many sysctl config files into 1 - + and use a name starting with double digits - + to make it easier to disable settings using a lexically higher config file commit f653b94e7747436323e2083d416ab86560e3cd71 @@ -9454,7 +17375,7 @@ Author: Patrick Schleizer Date: Wed Jan 22 07:08:08 2020 -0500 add update initramfs trigger - + https://github.com/Whonix/security-misc/pull/53 commit df0b2afda1e1d5a3fddfd8c48b62a5de8295d687 @@ -9480,10 +17401,10 @@ Author: Patrick Schleizer Date: Mon Jan 20 08:49:02 2020 -0500 fix Whonix / Kicksecure - + /var/lib/dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted. /var/lib/dpkg/tmp.ci/preinst: ERROR: You probably want to run: - + sudo adduser user console commit 960e1ff6e82f8593c2d242a6a0f1e1cf5805c85b @@ -9505,19 +17426,19 @@ Date: Wed Jan 15 15:54:06 2020 -0500 error handling commit 7211f6e0199d2ccb50437c7a5b0842050590b5dc -Merge: e110ea0 f6cc76a +Merge: e110ea0b f6cc76ac Author: Patrick Schleizer Date: Wed Jan 15 15:53:36 2020 -0500 Merge remote-tracking branch 'origin/master' commit f6cc76acd729428f83d3497a2e83bfc4b14f1ff8 -Merge: e110ea0 1df48a2 +Merge: e110ea0b 1df48a22 Author: Patrick Schleizer Date: Wed Jan 15 20:52:33 2020 +0000 Merge pull request #55 from madaidan/sysctl.conf - + Process sysctl.conf in initramfs commit 1df48a226d83b98dadc8bfb8dbc479dd656e2313 @@ -9563,23 +17484,23 @@ Date: Wed Jan 15 10:08:57 2020 -0500 readme commit 8ab4623f8e81ad1b67858b458f2ae4085e7c8e65 -Merge: 8015954 087465a +Merge: 80159545 087465a0 Author: Patrick Schleizer Date: Wed Jan 15 06:06:39 2020 -0500 Merge remote-tracking branch 'origin/master' commit 087465a0cdecc4765f7b659256cdd5e8cdef73ab -Merge: 8015954 528c5fc +Merge: 80159545 528c5fc4 Author: Patrick Schleizer Date: Wed Jan 15 11:02:30 2020 +0000 Merge pull request #53 from madaidan/sysctl-initramfs - + Set sysctl values in initramfs commit 528c5fc4c41026396a63ac91af7c156dd0d4f191 -Merge: 9dc43ea 8015954 +Merge: 9dc43eae 80159545 Author: Patrick Schleizer Date: Wed Jan 15 11:02:03 2020 +0000 @@ -9590,11 +17511,11 @@ Author: Patrick Schleizer Date: Wed Jan 15 02:42:10 2020 -0500 fix xfce4-power-manager xfpm-power-backlight-helper pkexec lxsudo popup - + https://forums.whonix.org/t/xfce4-power-manager-xfpm-power-backlight-helper-pkexec-lxsudo-popup/8764 - + do show lxqt-sudo password prompt if there is a sudoers exceptoin - + improved pkexec wrapper logging commit d90ca4b1ad18289d6bcfcef51cfb032a0b4423eb @@ -9646,19 +17567,19 @@ Date: Tue Jan 14 09:18:30 2020 -0500 readme commit c377c5ff83437a5447ecc9c873150421f4f1e691 -Merge: 8341242 539f24b +Merge: 8341242a 539f24b6 Author: Patrick Schleizer Date: Tue Jan 14 09:01:38 2020 -0500 Merge remote-tracking branch 'origin/master' commit 539f24b65ee7739487d8038fcb1fdfb1ed62ab22 -Merge: 8341242 0953bbe +Merge: 8341242a 0953bbe1 Author: Patrick Schleizer Date: Tue Jan 14 14:01:17 2020 +0000 Merge pull request #54 from madaidan/panic_on_oops - + Document panic_on_oops commit 0953bbe1d7f3e789aef2218a65c14c586dab4bcb @@ -9698,19 +17619,19 @@ Date: Sat Jan 11 15:15:12 2020 -0500 lintian commit 3fae8e771ffbdd3023921b296e46cf982034d2ac -Merge: 13a1e13 e9f4dbd +Merge: 13a1e132 e9f4dbdd Author: Patrick Schleizer Date: Sat Jan 11 15:14:43 2020 -0500 Merge remote-tracking branch 'origin/master' commit e9f4dbdda579db83f330054253100bc7c5d1e2be -Merge: 13a1e13 6088444 +Merge: 13a1e132 6088444c Author: Patrick Schleizer Date: Sat Jan 11 20:14:10 2020 +0000 Merge pull request #52 from madaidan/vivid - + Blacklist the vivid kernel module commit 6088444c371f021ca23daa3a0ab1ee431d429a61 @@ -9760,7 +17681,7 @@ Author: Patrick Schleizer Date: Tue Dec 31 05:55:44 2019 -0500 add user "user" to group "console" in Whonix and Kicksecure - + enable Console Lockdown in Whonix and Kicksecure commit b5a2d1dc581b53974aaa148f6d8f3054c9d1c5fe @@ -9780,7 +17701,7 @@ Author: Patrick Schleizer Date: Tue Dec 31 02:46:32 2019 -0500 group ssh check was removed - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/27 commit 06ed728d791abe0ad3c93091fd8ebc088f73c4ef @@ -9794,15 +17715,15 @@ Author: Patrick Schleizer Date: Mon Dec 30 06:39:24 2019 -0500 Protect /bin/mount from 'chmod -x'. - + /bin/mount exactwhitelist /usr/bin/mount exactwhitelist - + Remove SUID from 'mount' but keep executable. - + /bin/mount 745 root root /usr/bin/mount 745 root root - + https://forums.whonix.org/t/disable-suid-binaries/7706/61 commit e4e9c4e3b09138af25e94a6db81b0f759ddb4d1b @@ -9876,7 +17797,7 @@ Author: Patrick Schleizer Date: Sun Dec 29 04:35:46 2019 -0500 exit with error if a config line cannot be processed rather than skipping - + https://forums.whonix.org/t/disable-suid-binaries/7706/59 commit d5c99f3a60372a00ded4b1b4340775aab1421d31 @@ -9902,9 +17823,9 @@ Author: Patrick Schleizer Date: Thu Dec 26 05:44:35 2019 -0500 /fusermount matchwhitelist - + unbreak AppImages such as electrum Bitcoin wallet - + https://forums.whonix.org/t/disable-suid-binaries/7706/57 commit 507a30d6e39f17fcb09b92033fe1d831e7d4baf4 @@ -9944,37 +17865,37 @@ Date: Tue Dec 24 06:00:41 2019 -0500 no longer hardcode amd64 commit d03a3d9ac03bc29ba349107855936dd194e12271 -Merge: 9d77d88 27a42a9 +Merge: 9d77d88a 27a42a9d Author: Patrick Schleizer Date: Tue Dec 24 05:57:24 2019 -0500 Merge remote-tracking branch 'origin/master' commit 27a42a9da82bc1f22135ffa509925f63177f25d9 -Merge: ac49c55 79241c5 +Merge: ac49c55d 79241c5d Author: Patrick Schleizer Date: Tue Dec 24 10:55:11 2019 +0000 Merge pull request #50 from madaidan/modules - + Make /lib/modules unreadable commit ac49c55d1fafff5f36bd7c595f50db295ff616a2 -Merge: 0c3d4ad 98e88d1 +Merge: 0c3d4ad2 98e88d14 Author: Patrick Schleizer Date: Tue Dec 24 10:55:03 2019 +0000 Merge pull request #49 from madaidan/kver - + Detect kernel upgrades commit 0c3d4ad255de75b57a2e316bf8a7fd77a2fc0d4d -Merge: 9d77d88 d1a0650 +Merge: 9d77d88a d1a0650f Author: Patrick Schleizer Date: Tue Dec 24 10:54:23 2019 +0000 Merge pull request #48 from madaidan/kernel-hardening - + Use only one slub_debug parameter commit 79241c5d09c4a7123cf90b45289b53d893135efb @@ -10050,7 +17971,7 @@ Date: Mon Dec 23 03:38:49 2019 -0500 description: lockdown not enabled yet commit b05669accfe6fac8070003bbd57939ca2c621445 -Merge: 11b4192 1ff51ee +Merge: 11b4192f 1ff51ee0 Author: Patrick Schleizer Date: Mon Dec 23 03:38:04 2019 -0500 @@ -10097,9 +18018,9 @@ Author: Patrick Schleizer Date: Mon Dec 23 02:29:47 2019 -0500 rename keyword whitelist to exactwhitelist - + add new keyword disablewhitelist - + refactoring commit 175d1c284552a08881286e8c3ca5d8eb9b97a144 @@ -10119,7 +18040,7 @@ Author: Patrick Schleizer Date: Mon Dec 23 01:42:03 2019 -0500 polkit-agent-helper-1 matchwhitelist to match both - + - /usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist - /lib/policykit-1/polkit-agent-helper-1 @@ -10128,7 +18049,7 @@ Author: Patrick Schleizer Date: Mon Dec 23 01:38:31 2019 -0500 matchwhitelist /qubes/qfile-unpacker to match both - + - /usr/lib/qubes/qfile-unpacker whitelist - /lib/qubes/qfile-unpacker @@ -10209,7 +18130,7 @@ Author: Patrick Schleizer Date: Mon Dec 23 00:47:49 2019 -0500 fix capability removal error handling - + https://forums.whonix.org/t/disable-suid-binaries/7706/45 commit b631e2ecd8ae0e08850edd81bf64b02666fb6234 @@ -10229,14 +18150,14 @@ Author: Patrick Schleizer Date: Sun Dec 22 19:42:40 2019 -0500 Remove suid / gid and execute permission for 'group' and 'others'. - + Similar to: chmod og-ugx /path/to/filename - + Removing execution permission is useful to make binaries such as 'su' fail closed rather than fail open if suid was removed from these. - + Do not remove read access since no security benefit and easier to manually undo for users. - + chmod 744 commit 58a4e0bc7d1b87d4d169f31dc5935c75e929c0b4 @@ -10256,26 +18177,26 @@ Author: Patrick Schleizer Date: Sun Dec 22 18:56:36 2019 -0500 suid utempter/utempter matchwhitelist - + to cover both: - + /usr/lib/x86_64-linux-gnu/utempter/utempter /lib/x86_64-linux-gnu/utempter/utempter commit 9409209b48fb8f803b88d72c0e7febaa74f5bd2c -Merge: 008ce48 bce02ff +Merge: 008ce481 bce02ffd Author: Patrick Schleizer Date: Sun Dec 22 10:29:08 2019 -0500 Merge remote-tracking branch 'origin/master' commit bce02ffdc01c22c8d5528eb5eaa7729a6b3137dd -Merge: 008ce48 8f11a52 +Merge: 008ce481 8f11a520 Author: Patrick Schleizer Date: Sun Dec 22 15:26:07 2019 +0000 Merge pull request #47 from madaidan/msr - + Blacklist CPU MSRs commit 8f11a520f4c406fa3187ad530f945a564b78a28c @@ -10325,23 +18246,23 @@ Author: Patrick Schleizer Date: Sat Dec 21 14:06:10 2019 -0500 no longer remount /lib - + https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25 commit 10c19d6a8fc6b6bc03067dc3be88f486aa78d438 -Merge: b2260f4 fffdf50 +Merge: b2260f48 fffdf509 Author: Patrick Schleizer Date: Sat Dec 21 13:00:41 2019 -0500 Merge remote-tracking branch 'origin/master' commit fffdf5090c707c698de4adacfd5837809b33aa99 -Merge: 1c99b56 f5a52ae +Merge: 1c99b56c f5a52aed Author: Patrick Schleizer Date: Sat Dec 21 17:59:56 2019 +0000 Merge pull request #46 from madaidan/remount-secure - + Don't remount /sys/kernel/security commit f5a52aeddc4742b4dbd8a0075d759b2ceaaae691 @@ -10355,7 +18276,7 @@ Author: Patrick Schleizer Date: Sat Dec 21 08:03:33 2019 -0500 add support for /etc/exec / /usr/local/etc/exec - + to allow enabling exec on a per VM basis commit 1c99b56c9b99cceab6fe38580d06197dd4bcfb77 @@ -10424,23 +18345,23 @@ Date: Sat Dec 21 06:58:01 2019 -0500 rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown - + https://github.com/Whonix/security-misc/pull/45 commit 2350e0f5d06d9625835ba1547aab0054b795c0c5 -Merge: 3ea5871 efd65a3 +Merge: 3ea58718 efd65a3f Author: Patrick Schleizer Date: Sat Dec 21 06:57:10 2019 -0500 Merge remote-tracking branch 'origin/master' commit efd65a3f15fc9380e2019c9d7ad0bf82adcc230d -Merge: c336bc4 c28ddf5 +Merge: c336bc4f c28ddf5c Author: Patrick Schleizer Date: Sat Dec 21 11:56:31 2019 +0000 Merge pull request #45 from madaidan/apparmor - + Delete apparmor profiles commit 3ea587187e9d0a927799a66d15d163ee56a41978 @@ -10448,7 +18369,7 @@ Author: Patrick Schleizer Date: Sat Dec 21 06:53:07 2019 -0500 no need to exclude xorg nosuid on Debian - + http://forums.whonix.org/t/permission-hardening/8655/25 commit c336bc4fd229d9a6370df5520aaa4e872465de5a @@ -10660,7 +18581,7 @@ Author: Patrick Schleizer Date: Sat Dec 21 04:08:35 2019 -0500 record existing modes in separate dpkg-statoverwrite databases - + to have a history of what was modified and to allow to undo changes commit 89be5f2ecb998c46ff4864996cd86b97fa56d176 @@ -10698,9 +18619,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 12:59:27 2019 -0500 add "/usr/lib/xorg/Xorg.wrap whitelist" - + until this is researched - + https://manpages.debian.org/buster/xserver-xorg-legacy/Xorg.wrap.1.en.html https://lwn.net/Articles/590315/ @@ -10709,7 +18630,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 12:57:24 2019 -0500 add matchwhitelist feature - + add "/usr/lib/virtualbox/ matchwhitelist" commit 3fab3876693f20303c95f03c45af9adb9ae680e2 @@ -10717,7 +18638,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 12:50:35 2019 -0500 suid /usr/bin/firejail whitelist - + There is a controversy about firejail but those who choose to install it should be able to use it. https://www.whonix.org/wiki/Dev/Firejail#Security @@ -10745,9 +18666,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 11:58:07 2019 -0500 fix terminology, sguid -> sgid - + Thanks to @madaidan for the bug report! - + https://forums.whonix.org/t/permission-hardening/8655/21 commit 1cd5fb6a0020504c7897acf169772d39b67f4bd4 @@ -10863,7 +18784,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 10:31:26 2019 -0500 speed up setuid removal by using find with '-perm /u=s,g=s' - + https://forums.whonix.org/t/permission-hardening/8655/19 commit 4cfdf2c65b57f410163653304871ee3eb1d3f6ea @@ -10895,7 +18816,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 09:43:23 2019 -0500 fix missing processing files bug - + https://forums.whonix.org/t/permission-hardening/8655/16 commit fbe2479f486add30cd29f5c4063a140c42c502fe @@ -10903,7 +18824,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 08:54:56 2019 -0500 count processed file system objects - + to be able to verify if any were "forgotten" commit 195ea522f5a8582851792b53047185717a6f679e @@ -10935,7 +18856,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 08:13:23 2019 -0500 do not remove suid from whitelisted binaries ever - + https://forums.whonix.org/t/permission-hardening/8655/13 commit d5f1bd8dd29a4f9e1ccb6fed82a255f7b7abfe6f @@ -10943,9 +18864,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 08:02:30 2019 -0500 fix mode sanity check - + no longer use seq due to issue - + https://forums.whonix.org/t/permission-hardening/8655/13 commit ddc0eec63d744e4600f3b1b8cdf60fef6d647cbe @@ -11073,9 +18994,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:32:26 2019 -0500 remove hardening-enable - + please invent package security-paranoid instead - + https://forums.whonix.org/t/security-hardening-tool-usr-bin-hardening-enable-by-security-misc/8609 commit 6c8127e3cd32c04a6eb4641ad856c7bf2c777fee @@ -11083,7 +19004,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:29:37 2019 -0500 remove "/lib/ nosuid" from permission hardening - + Takes 1 minute to parse. No SUID binaries there by default. remount-secure mounts it with nosuid anyhow. Therefore no processing it here. @@ -11093,7 +19014,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:27:11 2019 -0500 remount /lib with nosuid,nodev - + https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/22 commit 7f201604779e442660c4c13798b2b48d706576ac @@ -11107,7 +19028,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 05:22:59 2019 -0500 use must manually enable permission-hardening.service - + until development finished commit fa6f1e156898572513cacb1d65b042482896011a @@ -11133,10 +19054,10 @@ Author: Patrick Schleizer Date: Fri Dec 20 04:48:02 2019 -0500 fix - + fso: /lib/ usr/lib/security-misc/permission-hardening: line 19: /usr/bin/stat: Argument list too long - + https://forums.whonix.org/t/kernel-hardening/7296/326 commit e74d2e4f94f4cdb2f3a83f27e17e19e9e4078961 @@ -11294,7 +19215,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 02:57:57 2019 -0500 skip symlinks - + https://forums.whonix.org/t/kernel-hardening/7296/323? commit cc8f795799e76d61b60f31e718effb88478b0fea @@ -11320,7 +19241,7 @@ Author: Patrick Schleizer Date: Fri Dec 20 02:39:53 2019 -0500 check string length of permission variable - + https://forums.whonix.org/t/kernel-hardening/7296/322 commit a89befd902f6976ebef303b22ee9f9cbc3a1cc23 @@ -11388,9 +19309,9 @@ Author: Patrick Schleizer Date: Fri Dec 20 02:01:36 2019 -0500 exit non-zero if some line cannot be parsed - + therefore make systemd notice this - + therefore allow the sysadmin to notice this commit 66bcba831317cf4810e9123b305597ee85fc94bf @@ -11418,19 +19339,19 @@ Date: Fri Dec 20 01:31:37 2019 -0500 refactoring commit c5d1e9dda7059d18fad303128f6f09c98fe955b7 -Merge: 62eb462 a20b300 +Merge: 62eb4629 a20b3001 Author: Patrick Schleizer Date: Fri Dec 20 01:30:31 2019 -0500 Merge remote-tracking branch 'origin/master' commit a20b30013f9ae229d1fe86cc5992aac474a9d8e6 -Merge: 62eb462 9df7407 +Merge: 62eb4629 9df74072 Author: Patrick Schleizer Date: Fri Dec 20 06:29:58 2019 +0000 Merge pull request #44 from madaidan/permission-hardening - + Remove SUID bits commit 9df74072862b31871d0aad7bed8333fc8344ffec @@ -11474,9 +19395,9 @@ Author: Patrick Schleizer Date: Mon Dec 16 03:52:09 2019 -0500 remount /sys/kernel/security with nodev,nosuid[,noexec] - + as suggested by @madaidan - + http://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/238 commit 2c4170e6f3366709c391db396a74547d4fed9589 @@ -11496,11 +19417,11 @@ Author: Patrick Schleizer Date: Thu Dec 12 09:29:00 2019 -0500 increase priority of pam-abort-on-locked-password-security-misc - + since it has its own user help output - + so it shows before pam tally2 info - + to avoid duplicate non-applicable help text commit a10597de92c316cc32ab552865a6658b38b19f5e @@ -11570,7 +19491,7 @@ Author: Patrick Schleizer Date: Mon Dec 9 02:23:43 2019 -0500 read -r; refactoring - + as per https://mywiki.wooledge.org/BashFAQ/001 commit 7467252122cb2e7600ce5ab3dce9dac2aa7a0676 @@ -11580,19 +19501,19 @@ Date: Mon Dec 9 02:22:16 2019 -0500 quotes commit 9bea9960173cf06dcbc0aefa2fb3b10df1f84c69 -Merge: 6f94423 af62da3 +Merge: 6f944234 af62da34 Author: Patrick Schleizer Date: Mon Dec 9 02:21:47 2019 -0500 Merge remote-tracking branch 'origin/master' commit af62da34457a56fee43a6003036a3bb387b23b32 -Merge: 6f94423 d7e2dea +Merge: 6f944234 d7e2deae Author: Patrick Schleizer Date: Sun Dec 8 20:45:16 2019 +0000 Merge pull request #42 from madaidan/permission-hardening - + File permission hardening commit d7e2deae9250abd79ab83c2025b98476dde710d3 @@ -11630,20 +19551,20 @@ Author: Patrick Schleizer Date: Sun Dec 8 05:21:35 2019 -0500 security-misc `/usr/share/pam-configs/permission-lockdown-security-misc` is no longer required, removed. - + Thereby fix apparmor issue. - + > Dec 08 09:47:50 host audit[3232]: AVC apparmor="DENIED" operation="exec" profile="/usr/bin/whonixcheck" name="/usr/lib/security-misc/permission-lockdown" pid=3232 comm="sudo" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 > Dec 08 09:47:50 host sudo[3232]: pam_exec(sudo:session): execve(/usr/lib/security-misc/permission-lockdown,...) failed: Permission denied - + It is no longer required, because... - + existing linux user accounts: - + * Get permission lock down because security-misc `debian/security-misc.postinst` calls `/usr/lib/security-misc/permission-lockdown`. - + new linux user accounts (created at first boot): - + * security-misc `/usr/share/pam-configs/mkhomedir-security-misc` pam mkhomedir sets secure permissions using `umask=027`. commit edcc2de71dea9cf2f94ec008d2817a0cdfdf5b7c @@ -11669,9 +19590,9 @@ Author: Patrick Schleizer Date: Sun Dec 8 04:25:19 2019 -0500 skip sudo_users_check in Qubes - + Qubes users can use dom0 to get a root terminal emulator. - + For example: qvm-run -u root debian-10 xterm @@ -11710,7 +19631,7 @@ Author: Patrick Schleizer Date: Sun Dec 8 03:15:53 2019 -0500 higher priority usr/share/pam-configs/tally2-security-misc - + so it can give info before pam stack gets aborted by other pam modules commit 3bd0b3f837d5ad8c87e59b99c6baef1e2c74507b @@ -11742,7 +19663,7 @@ Author: Patrick Schleizer Date: Sun Dec 8 02:38:19 2019 -0500 abort installation if no user is a member of group "console"; output - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/7 commit 1dbca1ea2d80ff7f60a0f426b444994d6bd97d30 @@ -11830,19 +19751,19 @@ Date: Sun Dec 8 01:30:42 2019 -0500 description commit 491dd4d93d133ca23eaf5c501b7ab3d3bbf52a27 -Merge: 9432d16 a78a7e5 +Merge: 9432d163 a78a7e55 Author: Patrick Schleizer Date: Sun Dec 8 01:22:16 2019 -0500 Merge remote-tracking branch 'origin/master' commit a78a7e5571b178cbf4cddd065306d130431bc185 -Merge: 373e873 6846a94 +Merge: 373e8733 6846a943 Author: Patrick Schleizer Date: Sun Dec 8 06:21:44 2019 +0000 Merge pull request #41 from madaidan/system.map - + Check for more locations of System.map commit 6846a943277c5ad9049cbf3e21fcd739c316cf44 @@ -11858,19 +19779,19 @@ Date: Sat Dec 7 12:13:42 2019 -0500 /usr/bin/cat mrix, commit 373e8733d37cb795c7c48642346b0b6dc6dce30c -Merge: c1800b1 447eb14 +Merge: c1800b13 447eb144 Author: Patrick Schleizer Date: Sat Dec 7 11:34:42 2019 -0500 Merge remote-tracking branch 'origin/master' commit 447eb144325a532b0aaf7ce772d5a04005b2af1f -Merge: c1800b1 668b642 +Merge: c1800b13 668b6420 Author: Patrick Schleizer Date: Sat Dec 7 16:34:21 2019 +0000 Merge pull request #40 from madaidan/system.map - + Remove hyphen from remove-system.map commit c1800b13fe33a1c129dcb30c51dbead7f894b818 @@ -11878,9 +19799,9 @@ Author: Patrick Schleizer Date: Sat Dec 7 11:26:39 2019 -0500 separate group "ssh" for incoming ssh console permission - + Thanks to @madaidan - + https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/16 commit 668b6420de8024fdeaf948f1750beb8b62d9ffb7 @@ -11978,22 +19899,22 @@ Author: Patrick Schleizer Date: Sat Dec 7 05:40:20 2019 -0500 Console Lockdown. - + Allow members of group 'console' to use tty1 to tty7. Everyone else except members of group 'console-unrestricted' are restricted from using console using ancient, unpopular login methods such as using /bin/login over networks, which might be exploitable. (CVE-2001-0797) - + Not enabled by default in this package since this package does not know which users shall be added to group 'console'. - + In new Whonix builds, user 'user" will be added to group 'console' and pam console-lockdown enabled by package anon-base-files. - + /usr/share/pam-configs/console-lockdown - + /etc/security/access-security-misc.conf - + https://forums.whonix.org/t/etc-security-hardening/8592 commit 52934c9288a596b233c1ce3b5f68a29248602c96 @@ -12085,7 +20006,7 @@ Author: Patrick Schleizer Date: Fri Dec 6 05:14:02 2019 -0500 remount /home /tmp /dev/shm /run with nosuid,nodev (default) and noexec (opt-in) - + https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 commit 8cf5ed990a3940c108d661c6c169b5720b1459d1 @@ -12095,19 +20016,19 @@ Date: Thu Dec 5 15:52:24 2019 -0500 comment commit 19add3299c9215d05208e3c2e748527bf87e66b5 -Merge: 0c25a96 9679292 +Merge: 0c25a96b 96792928 Author: Patrick Schleizer Date: Thu Dec 5 15:46:19 2019 -0500 Merge remote-tracking branch 'origin/master' commit 96792928787c1c129a964bd81e97450d2edb29a6 -Merge: 0c25a96 af9e19c +Merge: 0c25a96b af9e19c5 Author: Patrick Schleizer Date: Thu Dec 5 20:33:47 2019 +0000 Merge pull request #39 from madaidan/rp_filter - + Enable reverse path filtering commit af9e19c51f256504c5c2206e31da1911872b6ef8 @@ -12129,19 +20050,19 @@ Date: Tue Dec 3 02:18:32 2019 -0500 description / comments commit d26ba05c4776cdff0750b872f3da70fd25fca1f4 -Merge: 6ca48ff 73c6410 +Merge: 6ca48fff 73c6410a Author: Patrick Schleizer Date: Tue Dec 3 01:52:04 2019 -0500 Merge remote-tracking branch 'origin/master' commit 73c6410a0e1e6e56529ba8ea98681867bd8acb37 -Merge: 6ca48ff 8d63da3 +Merge: 6ca48fff 8d63da3c Author: Patrick Schleizer Date: Tue Dec 3 06:51:31 2019 +0000 Merge pull request #38 from madaidan/distrust-cpu - + Distrust the CPU for initial entropy commit 8d63da3cef6e114deaa6943ea9a633d6620a974b @@ -12191,25 +20112,25 @@ Author: Patrick Schleizer Date: Wed Nov 27 10:22:31 2019 -0500 fix, make sure to undo pam changes on package removal - + Thanks to minimal for the bug report! - + https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/11 commit 62b924eea7d50f58649e089ff9cf8d73075cac63 -Merge: 9091f69 ba02dcb +Merge: 9091f69e ba02dcb2 Author: Patrick Schleizer Date: Tue Nov 26 13:00:36 2019 -0500 Merge remote-tracking branch 'origin/master' commit ba02dcb267a95d332bd01bb3fc725e051ccb3246 -Merge: 9091f69 d9d6d07 +Merge: 9091f69e d9d6d077 Author: Patrick Schleizer Date: Tue Nov 26 18:00:11 2019 +0000 Merge pull request #37 from madaidan/apparmor-fixes - + Fix permission-lockdown commit d9d6d0771433700f49c4ddf156a0b5bc7098d94b @@ -12235,7 +20156,7 @@ Author: Patrick Schleizer Date: Mon Nov 25 01:39:53 2019 -0500 Lock user accounts after 50 rather than 100 failed login attempts. - + https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698/19 commit 6277db1383451822769948bbebac31f719e98e74 @@ -12255,11 +20176,11 @@ Author: Patrick Schleizer Date: Sat Nov 23 11:20:32 2019 +0000 load jitterentropy_rng kernel module for better entropy collection - + https://www.whonix.org/wiki/Dev/Entropy - + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972 - + https://forums.whonix.org/t/jitterentropy-rngd/7204 commit d32024a3da3cdfbb07f61dd3e9a52535e747de6b @@ -12267,7 +20188,7 @@ Author: Patrick Schleizer Date: Sat Nov 23 05:53:19 2019 -0500 /usr/sbin/pam_tally2 mrix, - + https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/152 commit 03e80238477bef26cf14a86a136d2ab688c87d08 @@ -12301,19 +20222,19 @@ Date: Mon Nov 18 19:16:16 2019 +0000 bumped changelog version commit 9a20b85fe16584dda909fd5f1aa6bbb62d06bcf0 -Merge: 477d476 2b17c0f +Merge: 477d476b 2b17c0f3 Author: Patrick Schleizer Date: Sun Nov 17 11:20:17 2019 -0500 Merge remote-tracking branch 'origin/master' commit 2b17c0f3e4dcd7cb9f2239da649b4a885c27e7cf -Merge: 477d476 e92022a +Merge: 477d476b e92022a2 Author: Patrick Schleizer Date: Sun Nov 17 16:19:55 2019 +0000 Merge pull request #36 from madaidan/hidepid-fix - + Remove proc-hidepid systemd sandboxing commit e92022a21cbe2df76026b36482f5c71e3471b344 @@ -12369,7 +20290,7 @@ Author: Patrick Schleizer Date: Tue Nov 5 10:02:55 2019 -0500 do not set kernel boot parameter page_poison=1 in Qubes since does not work - + https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012 commit f57702c1589047f5d0eff7a7bdffb928117532f6 @@ -12407,9 +20328,9 @@ Author: Patrick Schleizer Date: Sun Nov 3 04:34:31 2019 -0500 add /var/cache/security-misc/state-files/placeholder file - + to make sure folder already exists to avoid AppArmor issue - + https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/76 commit 7c0ec7e50797c0da719f389e61445ff7d8e252b3 @@ -12425,7 +20346,7 @@ Date: Sun Nov 3 02:50:51 2019 -0500 Enables punycode (`network.IDN_show_punycode`) by default in Thunderbird to make phising attacks more difficult. Fixing URL not showing real Domain Name (Homograph attack). - + https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415 commit bf62306d4fc3b3168204254ca354028a1fe857a7 @@ -12439,7 +20360,7 @@ Author: Patrick Schleizer Date: Thu Oct 31 16:32:28 2019 +0000 apparmor fix - + https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/67 commit 6e5d8b357d977991953e153d618dbdda2b05c0e6 @@ -12455,19 +20376,19 @@ Date: Thu Oct 31 11:19:44 2019 -0400 copyright commit f001250ae61789bef7b2b19d5c40831273b0acca -Merge: d832ab9 5a3cbe8 +Merge: d832ab91 5a3cbe81 Author: Patrick Schleizer Date: Mon Oct 28 10:31:30 2019 -0400 Merge remote-tracking branch 'origin/master' commit 5a3cbe81000c3a9bbc69ba03c944c6c5ae9115bf -Merge: d832ab9 0e49bdc +Merge: d832ab91 0e49bdc4 Author: Patrick Schleizer Date: Mon Oct 28 14:30:45 2019 +0000 Merge pull request #35 from madaidan/apparmor - + Apparmor profiles commit 0e49bdc45f6c94b3f6c2874fd48a6b1c75519790 @@ -12583,11 +20504,11 @@ Author: Patrick Schleizer Date: Mon Oct 21 05:46:49 2019 -0400 Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with hidepid. - + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 - + https://forums.whonix.org/t/cannot-use-pkexec/8129 - + Thanks to AnonymousUser for the bug report! commit 31b771ac2e1cd692851f0d58191c3147d4a09335 @@ -12607,7 +20528,7 @@ Author: Patrick Schleizer Date: Fri Oct 18 10:38:25 2019 +0000 fix lintian warning - + W: security-misc: maintainer-script-should-not-parse-etc-passwd-or-group preinst:19 commit d301e7f3653bdb4b56c42deab9d0566ff1b27380 @@ -12633,9 +20554,9 @@ Author: Patrick Schleizer Date: Thu Oct 17 06:46:47 2019 -0400 abort installation if no user is part of group sudo - + https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 - + Thanks to minimal for the bug report! commit a5045dc26e3b7d6acd6ae2c5727920824f992cc7 @@ -12674,7 +20595,7 @@ Author: Patrick Schleizer Date: Thu Oct 17 06:08:55 2019 -0400 shuffle - + https://forums.whonix.org/t/restrict-hardware-information-to-root/7329/80 commit 28a440091dd98fd4f3284cce01d692c08aa96bf1 @@ -12690,28 +20611,28 @@ Date: Thu Oct 17 06:05:23 2019 -0400 remove trailing spaces commit c8e0303d6d59e3303c0582ff8ab2664762199c81 -Merge: 4b1b3b7 8a42c5b +Merge: 4b1b3b7d 8a42c5b0 Author: Patrick Schleizer Date: Thu Oct 17 06:04:34 2019 -0400 Merge remote-tracking branch 'origin/master' commit 8a42c5b02387da454ff5661057be88a7c6fe9d9c -Merge: 994ca02 61f7423 +Merge: 994ca024 61f74230 Author: Patrick Schleizer Date: Thu Oct 17 09:59:12 2019 +0000 Merge pull request #34 from madaidan/whitelist - + Add a whitelist for /sys and /proc/cpuinfo commit 994ca024c24cf80075b2f03bc65475a5d9980d94 -Merge: 4b1b3b7 259b1f2 +Merge: 4b1b3b7d 259b1f2c Author: Patrick Schleizer Date: Thu Oct 17 06:19:46 2019 +0000 Merge pull request #33 from madaidan/documentation - + Improve documentation commit 61f742304d26e73df8433bd6fa03d33d39e39625 @@ -12827,7 +20748,7 @@ Author: Patrick Schleizer Date: Sat Oct 5 13:15:34 2019 +0000 comment out sack by default - + https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109/8?u=patrick commit 02096f8d7c7ee1f61285cf96564616f2828aa6c2 @@ -12835,7 +20756,7 @@ Author: Patrick Schleizer Date: Sat Oct 5 13:13:46 2019 +0000 Revert "undo Disabling TCP SACK, DSACK, FACK" - + This reverts commit 5fb4eb8e561e7c37cea977072944501fc32ee883. commit 62a0239207ee355e3d07e0097c963a0ded496e76 @@ -12855,23 +20776,23 @@ Author: Patrick Schleizer Date: Sat Oct 5 07:00:47 2019 -0400 undo Disabling TCP SACK, DSACK, FACK - + https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109/5 commit c19942f72b8d74056dd8da8c3cd9ac7e0fbe8991 -Merge: 213aef6 a33851a +Merge: 213aef6e a33851a3 Author: Patrick Schleizer Date: Sat Oct 5 06:58:27 2019 -0400 Merge remote-tracking branch 'origin/master' commit a33851a3c99a5eb9021d2d28b3164ed10025fbd9 -Merge: 213aef6 d0c6bb1 +Merge: 213aef6e d0c6bb1e Author: Patrick Schleizer Date: Sat Oct 5 10:58:08 2019 +0000 Merge pull request #32 from madaidan/disable-dsack-fack - + Disable TCP DSACK and FACK commit 213aef6eb9288efffe9fb0458f0aa8a44a6dafa6 @@ -12905,19 +20826,19 @@ Date: Sat Oct 5 09:14:41 2019 +0000 chmod +x usr/lib/security-misc/hide-hardware-info commit ffe0d62c8148ec60f7528002e988b969ebb868ca -Merge: ddc778b 7bcf73d +Merge: ddc778b4 7bcf73de Author: Patrick Schleizer Date: Sat Oct 5 04:49:05 2019 -0400 Merge remote-tracking branch 'origin/master' commit 7bcf73deaa1c77f9c650d8844ad94d24e38746fd -Merge: ddc778b 7345287 +Merge: ddc778b4 73452875 Author: Patrick Schleizer Date: Sat Oct 5 08:46:21 2019 +0000 Merge pull request #31 from madaidan/hide-hardware-info - + Restrict /proc/cpuinfo, /proc/bus, /proc/scsi and /sys to root commit d0c6bb1e9064ffdf45f7ac606f708c3f5e7dc247 @@ -12997,17 +20918,17 @@ Author: Patrick Schleizer Date: Mon Sep 16 12:30:23 2019 +0000 pam_tally2-info: fix, do nothing when started as user "user" - + xscreensaver runs as user "user", therefore pam_tally2 cannot function. xscreensaver has its own failed login counter. - + as user "user" /sbin/pam_tally2 -u user pam_tally2: Error opening /var/log/tallylog for update: Permission denied /sbin/pam_tally2: Authentication error - + https://askubuntu.com/questions/983183/how-lock-the-unlock-screen-after-wrong-password-attempts - + https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698 commit c2e444479cf723a7ddb3c51cd6394795daba108e @@ -13051,7 +20972,7 @@ Author: Patrick Schleizer Date: Tue Sep 10 12:35:42 2019 -0400 undo SysRq restrictions - + https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079 commit fbd1a5bde922be9c571d54567c977618e2c4bfc5 @@ -13067,19 +20988,19 @@ Date: Mon Sep 9 12:10:24 2019 +0000 bumped changelog version commit 1b4391417619a51cfe22d9eee21d9fa644d145b6 -Merge: 9d875d7 d0b3bc7 +Merge: 9d875d7c d0b3bc7d Author: Patrick Schleizer Date: Mon Sep 9 11:45:36 2019 +0000 Merge remote-tracking branch 'origin/master' commit d0b3bc7d3da6a4e3a04adb85cc5c7aa6c22bb466 -Merge: 9d875d7 60db7e6 +Merge: 9d875d7c 60db7e62 Author: Patrick Schleizer Date: Mon Sep 9 11:45:19 2019 +0000 Merge pull request #30 from madaidan/patch-23 - + fix typo commit 60db7e6294ab405a862c1cbc62140c9e89208b25 @@ -13105,7 +21026,7 @@ Author: Patrick Schleizer Date: Sat Sep 7 05:47:34 2019 +0000 blacklist modules with /bin/false rather than /bin/true to fail with error - + message rather than failing without notification commit 8132052ce01215a98cb4464e5f78d75349e77b10 @@ -13119,7 +21040,7 @@ Author: Patrick Schleizer Date: Sat Sep 7 05:39:56 2019 +0000 allow loading unsigned modules due to issues - + https://forums.whonix.org/t/allow-loading-signed-kernel-modules-by-default-disallow-kernel-module-loading-by-default/7880/23 commit 9ee9309f542472a8c8045df44573a5ec38e32a90 @@ -13241,9 +21162,9 @@ Author: Patrick Schleizer Date: Sat Aug 24 12:14:22 2019 -0400 remove umask changes since these are causing issues are are not needed anymore - + thanks to home folder permission lockdown - + https://forums.whonix.org/t/change-default-umask/7416/45 commit 41c4682280b7bc8e700d9ed41b55e464c0511b69 @@ -13259,7 +21180,7 @@ Date: Fri Aug 23 16:53:55 2019 +0000 readme commit 793c9b6801ffda5d75d389b8e7a2a6d140d8d382 -Merge: a74b983 44d62e0 +Merge: a74b9832 44d62e05 Author: Patrick Schleizer Date: Mon Aug 19 12:48:23 2019 +0000 @@ -13270,22 +21191,22 @@ Author: Patrick Schleizer Date: Mon Aug 19 12:46:59 2019 +0000 remove LLC - IEEE 802.2 from blacklist - + since required by KVM - + https://forums.whonix.org/t/whonix-desktop-installer-with-calamares-field-report/7350/107 - + https://forums.whonix.org/t/blacklist-uncommon-network-protocols/7391/22 - + https://github.com/Whonix/security-misc/pull/29 commit 44d62e05b5a60a3d45afd829fb67970afa7678b7 -Merge: 0140df8 a8b6281 +Merge: 0140df86 a8b62811 Author: Patrick Schleizer Date: Mon Aug 19 12:45:52 2019 +0000 Merge pull request #29 from onions-knight/patch-1 - + Update uncommon-network-protocols.conf commit a8b62811199b6c4e5d86439cd0fc9e9c18dc027b @@ -13293,7 +21214,7 @@ Author: onions-knight <38859709+onions-knight@users.noreply.github.com> Date: Mon Aug 19 11:30:57 2019 +0000 Update uncommon-network-protocols.conf - + Removing llc from blacklisted network protocols as it is needed by KVM for networking. See https://hub.packtpub.com/kvm-networking-libvirt/ and https://forums.whonix.org/t/whonix-desktop-installer-with-calamares-field-report/7350/107 @@ -13332,7 +21253,7 @@ Author: Patrick Schleizer Date: Mon Aug 19 07:47:20 2019 +0000 keep cache folder outside of reach of user since even user can remove files - + owned by root in its home folder commit 1fa1efa58e6f719766394bc8b94d4aa4076bdc0d @@ -13388,9 +21309,9 @@ Author: Patrick Schleizer Date: Sat Aug 17 10:33:47 2019 +0000 PAM: abort on locked password - + to avoid needlessly bumping pam_tally2 counter - + https://forums.whonix.org/t/restrict-root-access/7658/1 commit e0e25364e2d14459b918eea2cb63cbe10b8371f3 @@ -13410,9 +21331,9 @@ Author: Patrick Schleizer Date: Sat Aug 17 09:55:20 2019 +0000 change default umask to 027 - + as per: - + https://forums.whonix.org/t/change-default-umask/7416/47 commit b9127faac300024f7d8851d41037bebd5d3fe05c @@ -13450,7 +21371,7 @@ Author: Patrick Schleizer Date: Fri Aug 16 11:15:25 2019 -0400 sudo default umask 006 - + https://forums.whonix.org/t/change-default-umask/7416/43 commit 17cfcb63b6358f51a65df9623bc23ddf869b06cc @@ -13460,23 +21381,23 @@ Date: Fri Aug 16 10:50:56 2019 -0400 code simplification; report locked account earlier commit 5754671c460c67bd7d8e064841383ea7b7f90824 -Merge: 34672b8 9781598 +Merge: 34672b88 97815986 Author: Patrick Schleizer Date: Fri Aug 16 10:36:43 2019 -0400 Merge remote-tracking branch 'origin/master' commit 97815986321b6daf9c1f0c6f33a4b282ca05438c -Merge: 34672b8 85502ad +Merge: 34672b88 85502ad4 Author: Patrick Schleizer Date: Fri Aug 16 14:36:00 2019 +0000 Merge pull request #27 from madaidan/patch-21 - + Blacklist bluetooth commit 85502ad430f560070806c8b95b7fed3fe7028587 -Merge: 4a6f87f 34672b8 +Merge: 4a6f87f3 34672b88 Author: Patrick Schleizer Date: Fri Aug 16 14:35:51 2019 +0000 @@ -13499,7 +21420,7 @@ Author: Patrick Schleizer Date: Thu Aug 15 13:37:28 2019 +0000 informational output during PAM: - + * Show failed and remaining password attempts. * Document unlock procedure if Linux user account got locked. * Point out, that there is no password feedback for `su`. @@ -13518,7 +21439,7 @@ Author: Patrick Schleizer Date: Thu Aug 15 07:30:56 2019 +0000 use requisite rather than required to avoid asking for password needlessly - + if login will fail anyhow commit ce4a30d3cecb7e9bddb96c79aab871804cb90bd4 @@ -13544,7 +21465,7 @@ Author: Patrick Schleizer Date: Wed Aug 14 11:10:18 2019 +0000 add Depends: apparmor-profile-anondist to fix apparmor issue - + sudo[19806]: pam_exec(sudo:session): execve(/usr/lib/security-misc/permission-lockdown,...) failed: Permission denied sudo[18961]: pam_exec(sudo:session): /usr/lib/security-misc/permission-lockdown failed: exit code 13 kernel: audit: type=1400 audit(1565780860.972:224): apparmor="DENIED" operation="exec" profile="/usr/bin/whonixcheck" name="/usr/lib/security-misc/permission-lockdown" pid=19806 comm="sudo" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 @@ -13644,7 +21565,7 @@ Author: Patrick Schleizer Date: Wed Aug 14 08:34:03 2019 +0000 run permission lockdown during pam - + https://forums.whonix.org/t/change-default-umask/7416 commit 42f2d5f6664f15baebdaf200a5690cf32cdbe284 @@ -13670,12 +21591,12 @@ Author: Patrick Schleizer Date: Wed Aug 14 07:22:14 2019 +0000 add hook etc/kernel/postinst.d/30_remove-system-map to remove system.map - + on kernel package upgrade; - + self-document this package: during upgrade the following will be written to stdout: - + Setting up linux-image-4.19.0-5-amd64 (4.19.37-5+deb10u2) ... /etc/kernel/postinst.d/30_remove-system-map: removed '/boot/System.map-4.19.0-5-amd64 @@ -13699,19 +21620,19 @@ Date: Wed Aug 14 07:01:25 2019 +0000 description commit ff8c0979435b491cf462c5ef6e8e02f6d85f1d81 -Merge: 6f8acf0 a8ea379 +Merge: 6f8acf06 a8ea3795 Author: Patrick Schleizer Date: Wed Aug 14 06:59:50 2019 +0000 Merge remote-tracking branch 'origin/master' commit a8ea37952669b3f40a452cb580442126ec44233a -Merge: 6f8acf0 9a49b8e +Merge: 6f8acf06 9a49b8ec Author: Patrick Schleizer Date: Wed Aug 14 06:59:34 2019 +0000 Merge pull request #28 from madaidan/patch-22 - + Require all loaded kernel modules to be signed with a valid key. commit 9a49b8ecbb863a995862a4d380c6a03f6c0991ac @@ -13719,7 +21640,7 @@ Author: madaidan <50278627+madaidan@users.noreply.github.com> Date: Tue Aug 13 13:33:07 2019 +0000 Create 40_only_allow_signed_modules.cfg - + Require all loaded kernel modules to be signed with a valid key. commit 6f8acf06d79c77e3bee15cc8696a433271e2b7c9 @@ -13782,11 +21703,11 @@ Author: Patrick Schleizer Date: Sat Aug 10 07:07:28 2019 -0400 pam_tally2.so deny=100 - + during testing, due to issues - + https://github.com/Whonix/security-misc/commit/d17e25272b9b7bbb6abc4dccd500a6b34311a7dd - + https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698/12 commit d17e25272b9b7bbb6abc4dccd500a6b34311a7dd @@ -13794,12 +21715,12 @@ Author: Patrick Schleizer Date: Sat Aug 10 06:06:39 2019 -0400 effectively (not directly) add "required pam_tally2.so debug" to /etc/pam.d/common-account - + This is required because otherwise something like "sudo bash" would count as a failed login for pam_tally2 even though it was successful. - + https://bugzilla.redhat.com/show_bug.cgi?id=707660 - + https://forums.whonix.org/t/restrict-root-access/7658 commit 0f896a9d8d6f7c125311a0e226755f8a00214f3c @@ -13938,33 +21859,33 @@ Date: Mon Jul 22 01:16:18 2019 +0000 bumped changelog version commit f38f307b37d2efb036c5b4e85f48921b0acfadeb -Merge: 8c538ba b2582fb +Merge: 8c538ba3 b2582fbd Author: Patrick Schleizer Date: Sun Jul 21 09:12:33 2019 -0400 Merge remote-tracking branch 'origin/master' commit b2582fbd4c2364c7bca95b4038eec2ef2a2fae41 -Merge: 8c538ba 077899c +Merge: 8c538ba3 077899c2 Author: Patrick Schleizer Date: Sun Jul 21 12:40:37 2019 +0000 Merge pull request #26 from fepitre/fix-files - + Fix files commit 077899c23d518416cd9ee801a3607585d3a51aab -Author: Frédéric Pierret (fepitre) +Author: Fr_d_ric Pierret (fepitre) Date: Sun Jul 21 11:23:06 2019 +0200 Add .gitignore commit 5fbe7537613a2034d80983e095cdd8d2971b1bcc -Author: Frédéric Pierret (fepitre) +Author: Fr_d_ric Pierret (fepitre) Date: Sun Jul 21 11:19:35 2019 +0200 spec: update %files section - + QubesOS/qubes-issues#1885 commit 8c538ba318e5524d07034f2f718e4b5ae483176d @@ -14044,10 +21965,10 @@ Author: Patrick Schleizer Date: Wed Jul 17 20:36:51 2019 +0000 passwordless recovery / emergency console - + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 https://salsa.debian.org/ah/user-setup/commit/bc5ca2de85ec27845d0b46059cb7cc02bae7b44d - + https://forums.whonix.org/t/restrict-root-access/7658/46 commit 50036b2934410b57936a4909d022d436cd27cdfc @@ -14061,7 +21982,7 @@ Author: Patrick Schleizer Date: Wed Jul 17 14:25:19 2019 -0400 Revert "set back to default group "root" rather than group "sudo" membership required to use su" - + This reverts commit 2f276cdb10aedf0d30c01d25e50b17cac7d1c62c. commit 1b772c6a9aac9e6c203c0c89b49e589a2b6e83d3 @@ -14117,11 +22038,11 @@ Author: Patrick Schleizer Date: Mon Jul 15 08:44:28 2019 -0400 set back to default group "root" rather than group "sudo" membership required to use su - + since root login will be locked by default anyhow - + Thanks to @madaidan for providing the rationale! - + https://forums.whonix.org/t/restrict-root-access/7658/42 commit 6d1e8ac9a4657bb3d49a9674ce3a1500350d4bba @@ -14135,7 +22056,7 @@ Author: Patrick Schleizer Date: Sun Jul 14 11:11:59 2019 +0000 fix, add 'group=sudo' and 'debug' for debugging - + https://forums.whonix.org/t/restrict-root-access/7658 commit 1731196c9fda93233917bcf6dba48834be03a448 @@ -14204,9 +22125,9 @@ Date: Sat Jul 13 16:21:34 2019 +0000 removed: The amount of hashing rounds used by shadow is bumped to 65536. This increases the security of hashed passwords. - + Since we do not do that currently. - + https://forums.whonix.org/t/restrict-root-access/7658/37 commit 3f031a297dc2d54346e9c9b3d566c3fa3a469240 @@ -14262,7 +22183,7 @@ Author: Patrick Schleizer Date: Sat Jul 13 10:35:10 2019 -0400 port umask from /etc/pam.d to /usr/share/pam-configs implementation - + https://forums.whonix.org/t/change-default-umask/7416 commit ac25733de871b0da5ef42e2e0283a44d94ac3112 @@ -14270,9 +22191,9 @@ Author: Patrick Schleizer Date: Sat Jul 13 14:01:53 2019 +0000 remove etc/pam.d/common-password.security-misc rounds=65536 - + due to unclean implementation, see: - + https://forums.whonix.org/t/restrict-root-access/7658/37 commit 69b97981f3b5e4efc75954d6957659f1bb8e7d18 @@ -14280,7 +22201,7 @@ Author: Patrick Schleizer Date: Sat Jul 13 12:33:51 2019 +0000 convert etc/pam.d/su.security-misc to usr/share/pam-configs/wheel - + https://forums.whonix.org/t/restrict-root-access/7658/32 commit 4079632d1aed4f3e50ea21de674a9b6d537d3e05 @@ -14290,7 +22211,7 @@ Date: Sat Jul 13 11:41:37 2019 +0000 remove modifying to /etc/pam.d directly (unrelased) config-package-dev displace /etc/securetty remove trailing spaces - + https://forums.whonix.org/t/restrict-root-access/7658/31 commit cdb7c6f7eb8e61bd203c9a4cb755da0b97cc9a3d @@ -14306,19 +22227,19 @@ Date: Thu Jul 11 18:26:17 2019 +0000 fix lintian warning commit a40a04aaec0c30ceb47266a3f9b2b714e9b89888 -Merge: f5356ce 93190eb +Merge: f5356cee 93190ebf Author: Patrick Schleizer Date: Thu Jul 11 14:08:30 2019 -0400 Merge remote-tracking branch 'origin/master' commit 93190ebf1019f76b73cf0f1e4491f15fd36bcae1 -Merge: f5356ce 1aee08f +Merge: f5356cee 1aee08fa Author: Patrick Schleizer Date: Thu Jul 11 18:08:01 2019 +0000 Merge pull request #25 from madaidan/patch-20 - + Improve documentation of blacklisting uncommon network protocols commit 1aee08fa5e46cbd9439c36df9bcbb7a513270e1b @@ -14358,28 +22279,28 @@ Date: Thu Jul 11 07:07:01 2019 +0000 fix lintian warning commit 2a893c0562438aaf0c34a25538a8e21bb11ba197 -Merge: 3df6a44 a54500c +Merge: 3df6a44e a54500c6 Author: Patrick Schleizer Date: Thu Jul 11 06:50:35 2019 +0000 Merge remote-tracking branch 'origin/master' commit a54500c6f18719520ae66c335870d3e8f03e9e14 -Merge: 7d3a615 1e4d349 +Merge: 7d3a6156 1e4d3495 Author: Patrick Schleizer Date: Thu Jul 11 06:41:37 2019 +0000 Merge pull request #23 from madaidan/patch-18 - + Blacklist more uncommon network protocols commit 7d3a61564dc01b899466defe957a7bc65d38dc89 -Merge: 3df6a44 932524c +Merge: 3df6a44e 932524cb Author: Patrick Schleizer Date: Thu Jul 11 06:41:08 2019 +0000 Merge pull request #24 from madaidan/patch-19 - + Move disable-coredumps.conf to correct position commit 932524cbd1b15df06bd4e395dc391dd489ba100f @@ -14425,42 +22346,42 @@ Date: Tue Jul 9 06:56:23 2019 -0400 also allow members of group sudo to run /usr/lib/security-misc/panic-on-oops commit 5fb500ac32a8935ef989770b2b9d17df4fa1698c -Merge: 8793708 e4bb770 +Merge: 87937089 e4bb7703 Author: Patrick Schleizer Date: Tue Jul 9 06:55:27 2019 -0400 Merge remote-tracking branch 'origin/master' commit e4bb77037e9327eea7b8fd92961192613d6e0763 -Merge: a9441e7 0f15303 +Merge: a9441e7b 0f15303e Author: Patrick Schleizer Date: Tue Jul 9 10:54:48 2019 +0000 Merge pull request #21 from madaidan/patch-16 - + Make the kernel panic on oopses commit 0f15303eb4dd5701cae5b3985be47918e2e4700a -Merge: 45f8102 a9441e7 +Merge: 45f8102d a9441e7b Author: Patrick Schleizer Date: Tue Jul 9 10:54:24 2019 +0000 Merge branch 'master' into patch-16 commit 8793708906d037746a2e946177d8a4d1884b391a -Merge: 50c00fc a9441e7 +Merge: 50c00fcf a9441e7b Author: Patrick Schleizer Date: Tue Jul 9 03:23:26 2019 -0400 Merge remote-tracking branch 'origin/master' commit a9441e7be4794e88f782f1ff5dd95f00e3928279 -Merge: 50c00fc 24b326d +Merge: 50c00fcf 24b326d9 Author: Patrick Schleizer Date: Tue Jul 9 07:21:47 2019 +0000 Merge pull request #22 from madaidan/patch-17 - + Restrict access to the root account commit 24b326d906375bb543b936936519231f51154dcd @@ -14534,7 +22455,7 @@ Author: Patrick Schleizer Date: Sun Jul 7 23:39:58 2019 +0000 add 'Depends: libpam-cgfs' - + https://forums.whonix.org/t/change-default-umask/7416/30?u=patrick commit d31a16f264ea23a2fc890ffd6664deac3f4c4bdf @@ -14554,7 +22475,7 @@ Author: Patrick Schleizer Date: Sun Jul 7 21:31:56 2019 +0000 move to pam-auth-update --force - + --package hangs in Qubes updater since it starts whiptail for interactive dpkg configuration dialog. commit 8399a1136788dfbbfd5dfb5c11356776e90326cc @@ -14568,7 +22489,7 @@ Author: Patrick Schleizer Date: Sun Jul 7 21:09:26 2019 +0000 add "Depends: libpam-runtime" so pam-auth-update is available - + for Debian maintainer script commit f68b96241c6afc7dffa8831f35d38bf1bf49508a @@ -14584,7 +22505,7 @@ Date: Sun Jul 7 16:51:40 2019 -0400 Due to error: Jul 07 20:35:39 host sudo[16090]: PAM unable to dlopen(pam_cgfs.so): /lib/security/pam_cgfs.so: cannot open shared object file: No such file or directory Jul 07 20:35:39 host sudo[16090]: PAM adding faulty module: pam_cgfs.so - + run: pam-auth-update --package from Debian maintainer scripts @@ -14606,9 +22527,9 @@ Author: Patrick Schleizer Date: Sun Jul 7 09:37:25 2019 +0000 Enable APT seccomp sandboxing. - + Thanks to @torjunkie for the suggestion! - + https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702 commit 93e81b433036ef2f226d0a2b1422034aba54ea3a @@ -14630,19 +22551,19 @@ Date: Sat Jul 6 13:53:10 2019 +0000 bumped changelog version commit 7b0b9da32c660e527741a56543c78ee3ac93d541 -Merge: 6df7b3c 649878f +Merge: 6df7b3c2 649878fd Author: Patrick Schleizer Date: Sat Jul 6 07:06:54 2019 -0400 Merge remote-tracking branch 'origin/master' commit 649878fdcb81ac621af9bc1481a3b6b41d3e22a0 -Merge: 6df7b3c 8888147 +Merge: 6df7b3c2 8888147e Author: Patrick Schleizer Date: Sat Jul 6 11:06:25 2019 +0000 Merge pull request #20 from madaidan/patch-15 - + Blacklist HDLC and use "install" for blacklisting firewire/thunderbolt commit 8888147e1e1102fa852dce14c3ca1cb91cd1ff3b @@ -14704,7 +22625,7 @@ Author: Patrick Schleizer Date: Mon Jul 1 13:35:45 2019 +0000 config-package-dev displace files for change umask - + https://forums.whonix.org/t/change-default-umask/7416 commit a73f0566e978afb6d5b9693bf432a2496bedd61f @@ -14712,9 +22633,9 @@ Author: Patrick Schleizer Date: Mon Jul 1 13:25:23 2019 +0000 change default umask to 006 - + session optional pam_umask.so usergroups - + https://forums.whonix.org/t/change-default-umask/7416/17 commit 41b61e32776c15a8dcde4479841b71c7e9ca28d4 @@ -14724,19 +22645,19 @@ Date: Mon Jul 1 13:24:29 2019 +0000 revert to Debian buster original commit 88a78b1c87e8419bbb70daa77f7ddfb2332668ae -Merge: 24cc8e3 8c60e7c +Merge: 24cc8e38 8c60e7c6 Author: Patrick Schleizer Date: Mon Jul 1 09:21:05 2019 -0400 Merge remote-tracking branch 'origin/master' commit 8c60e7c67f692aa9e70316bdde29cdc41eff2a75 -Merge: 24cc8e3 cfaafe4 +Merge: 24cc8e38 cfaafe40 Author: Patrick Schleizer Date: Mon Jul 1 13:20:21 2019 +0000 Merge pull request #18 from madaidan/patch-14 - + Change the default umask to 006 commit 24cc8e380df8706cd8e9765d89bd44ac78c58936 @@ -14744,13 +22665,13 @@ Author: Patrick Schleizer Date: Mon Jul 1 03:43:02 2019 -0400 comment out proc-hidepid.service hardening for now - + since broken in Qubes Debian AppVMs - + https://forums.whonix.org/t/kernel-hardening/7296/104 commit 0bffc7a9303d0b32427da04694bbefcf6a3104c8 -Merge: 3c176ce 344d009 +Merge: 3c176ce1 344d0090 Author: Patrick Schleizer Date: Mon Jul 1 03:08:26 2019 -0400 @@ -14761,16 +22682,16 @@ Author: Patrick Schleizer Date: Mon Jul 1 03:07:14 2019 -0400 allow permissions openat mkdir - + since required in Qubes Debian templates commit 344d00903250d699fc64d7fa9fad80475ade92e5 -Merge: f26ad14 b8f2aee +Merge: f26ad14d b8f2aee9 Author: Patrick Schleizer Date: Mon Jul 1 06:39:28 2019 +0000 Merge pull request #19 from madaidan/patch-15 - + Add licensing to proc-hidepid.service commit b8f2aee905b78034a115e1e2c1d6ecb7fa624122 @@ -14846,35 +22767,35 @@ Date: Sun Jun 30 04:11:38 2019 -0400 fix package description commit e47339706170c92b8db44f014942ea7d94d1ff9e -Merge: 24b19c5 ec78a3e +Merge: 24b19c59 ec78a3e4 Author: Patrick Schleizer Date: Sun Jun 30 04:11:12 2019 -0400 Merge remote-tracking branch 'origin/master' commit ec78a3e42e23a270a245dc254046ac1d7fc6ceec -Merge: 9525ff8 67de524 +Merge: 9525ff87 67de5247 Author: Patrick Schleizer Date: Sun Jun 30 08:10:28 2019 +0000 Merge pull request #17 from madaidan/patch-13 - + Disable coredumps commit 67de5247c8e7cd68c851a3d62168e9de69000afe -Merge: dbfb9e1 9525ff8 +Merge: dbfb9e1c 9525ff87 Author: Patrick Schleizer Date: Sun Jun 30 08:10:04 2019 +0000 Merge branch 'master' into patch-13 commit 9525ff87c6ae3cd6538a0a8f294e6b8610e79a32 -Merge: 24b19c5 22267c8 +Merge: 24b19c59 22267c89 Author: Patrick Schleizer Date: Sun Jun 30 08:09:23 2019 +0000 Merge pull request #16 from madaidan/patch-12 - + Mount /proc with hidepid=2 commit dbfb9e1cdf1e042c8985e2e69b7f5f5f1eaed860 @@ -14944,19 +22865,19 @@ Date: Sat Jun 29 10:34:48 2019 +0000 fix lintian warning commit 250919b821a00c93ee4fe7d92f6f3ed812110aac -Merge: ecf5d80 60e6dfc +Merge: ecf5d80f 60e6dfcb Author: Patrick Schleizer Date: Sat Jun 29 06:06:02 2019 -0400 Merge remote-tracking branch 'origin/master' commit 60e6dfcbff08dd4526e60c3302741e40d98c8b3e -Merge: ecf5d80 9e9c854 +Merge: ecf5d80f 9e9c854d Author: Patrick Schleizer Date: Sat Jun 29 10:05:34 2019 +0000 Merge pull request #15 from madaidan/patch-11 - + Update control commit 9e9c854d274d7322759a9e5d2c49bcbd60e63e0d @@ -15002,37 +22923,37 @@ Date: Fri Jun 28 03:02:49 2019 -0400 update files list commit ccb89cfd5574ed5a7b3802edc3bf188250edfddd -Merge: 0a0be1a ab31223 +Merge: 0a0be1ad ab312235 Author: Patrick Schleizer Date: Fri Jun 28 03:00:21 2019 -0400 Merge remote-tracking branch 'origin/master' commit ab312235ba89d62b7b83c26f8e9b8a8ff0ec985b -Merge: 5e02100 3801a53 +Merge: 5e02100e 3801a53a Author: Patrick Schleizer Date: Fri Jun 28 06:59:16 2019 +0000 Merge pull request #14 from madaidan/patch-10 - + Add some hardening for other distributions commit 5e02100e34776bf410ba05d7a3f7ee7f696ca0fc -Merge: 7e12e16 b809185 +Merge: 7e12e16d b8091850 Author: Patrick Schleizer Date: Fri Jun 28 06:58:32 2019 +0000 Merge pull request #13 from madaidan/patch-9 - + Remove System.map and restrict the SysRq key. commit 7e12e16dc0513f0a6936e576e3c8fa8ee44509d2 -Merge: 0a0be1a 641407c +Merge: 0a0be1ad 641407c8 Author: Patrick Schleizer Date: Fri Jun 28 06:57:42 2019 +0000 Merge pull request #11 from madaidan/patch-7 - + Protect against DMA attacks commit 3801a53a9e01aafa3783276059a7907f5b20b96e @@ -15102,19 +23023,19 @@ Date: Sun Jun 23 19:47:05 2019 +0000 debian/control syntax fix commit a098b18560e30ef238f693bf8f05933489027dd4 -Merge: 2a62899 90d676e +Merge: 2a628998 90d676ec Author: Patrick Schleizer Date: Sun Jun 23 19:46:30 2019 +0000 Merge remote-tracking branch 'origin/master' commit 90d676ec1864bd915310673d134d62d10a17a42f -Merge: 2a62899 1a07d90 +Merge: 2a628998 1a07d90e Author: Patrick Schleizer Date: Sun Jun 23 19:45:31 2019 +0000 Merge pull request #12 from madaidan/patch-8 - + Update control commit 1a07d90ed2da597db6d58c5f2da6dc3b32a8104b @@ -15128,25 +23049,25 @@ Author: Patrick Schleizer Date: Sun Jun 23 18:46:52 2019 +0000 syntax fix - + GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" - + https://forums.whonix.org/t/kernel-hardening/7296/70 commit f1147318c04642f355eae96786c26ec1cb53977c -Merge: cd73466 aec6da2 +Merge: cd734669 aec6da28 Author: Patrick Schleizer Date: Sun Jun 23 18:45:41 2019 +0000 Merge remote-tracking branch 'origin/master' commit aec6da28e9ac4f8289d7b7aaa77bcef2562cda74 -Merge: cd73466 2178fb3 +Merge: cd734669 2178fb37 Author: Patrick Schleizer Date: Sun Jun 23 18:45:24 2019 +0000 Merge pull request #10 from madaidan/patch-6 - + Enable more kernel hardening parameters commit 641407c8e9c728429ec86e7c89e431896d88e116 @@ -15186,19 +23107,19 @@ Date: Sun Jun 23 08:38:01 2019 +0000 bumped changelog version commit ae50d8134294d3746235d383c18fc187c18717d7 -Merge: 5269cfe cd7172c +Merge: 5269cfee cd7172c0 Author: Patrick Schleizer Date: Sun Jun 23 03:59:58 2019 -0400 Merge remote-tracking branch 'origin/master' commit cd7172c00cbf0cb69e159b6159ef0bfff663a507 -Merge: 5269cfe 807ac7d +Merge: 5269cfee 807ac7d6 Author: Patrick Schleizer Date: Sun Jun 23 07:59:35 2019 +0000 Merge pull request #9 from madaidan/patch-5 - + Disables SACK. commit 807ac7d65916071e4294f42d62b8b2353255c4bc @@ -15214,35 +23135,35 @@ Date: Fri Jun 21 05:40:04 2019 +0000 bumped changelog version commit 0a5b15ff45dc1b30867b0093d238b95dde7c0810 -Merge: ca1aa1e f9dc1b6 +Merge: ca1aa1e5 f9dc1b63 Author: Patrick Schleizer Date: Fri Jun 21 04:05:50 2019 +0000 Merge remote-tracking branch 'origin/master' commit f9dc1b6322961ff0e6c7a5be122f9d1031ba87ea -Merge: ca1aa1e 2e81885 +Merge: ca1aa1e5 2e81885f Author: Patrick Schleizer Date: Thu Jun 20 23:54:58 2019 -0400 Merge pull request #8 from marmarek/packaging - + qubes-builder integration commit 2e81885f691201e2229dadfd5ec7b554980ac689 -Author: Marek Marczykowski-Górecki +Author: Marek Marczykowski-G_recki Date: Fri Jun 21 04:52:01 2019 +0200 Add rpm packaging - + QubesOS/qubes-issues#1885 commit 27e68a39fe005a58cac02336fc6c468a4b2f5d31 -Author: Marek Marczykowski-Górecki +Author: Marek Marczykowski-G_recki Date: Fri Jun 21 04:51:33 2019 +0200 Add Makefile.builder for qubes-builder (Debian) - + QubesOS/qubes-issues#1885 commit ca1aa1e577179d92f4ec002221b8c4207e6ce1d6 @@ -15268,7 +23189,7 @@ Author: Patrick Schleizer Date: Sun Jun 9 10:06:58 2019 +0000 solve package file conflict - + https://github.com/QubesOS/qubes-issues/issues/1885#issuecomment-500200375 commit d5127e716632af2f494e9b41571c44a56a887667 @@ -15302,19 +23223,19 @@ Date: Thu May 23 22:38:13 2019 +0000 bumped changelog version commit 0a200e09ecf745d23e5e880d521f1aec2a7b25a9 -Merge: 65d7eb8 244234c +Merge: 65d7eb81 244234c8 Author: Patrick Schleizer Date: Thu May 23 18:25:47 2019 -0400 Merge remote-tracking branch 'origin/master' commit 244234c8b709a425feed4f3cfb87389f4fb2c6f5 -Merge: 65d7eb8 7177c60 +Merge: 65d7eb81 7177c604 Author: Patrick Schleizer Date: Thu May 23 22:25:13 2019 +0000 Merge pull request #7 from madaidan/patch-3 - + Disable uncommon network protocols commit 7177c6041a9b086a4cb90504a492136b4da732a2 @@ -15330,19 +23251,19 @@ Date: Thu May 16 20:25:46 2019 +0000 bumped changelog version commit a2b184e5bb9942aa63a36fb918b203053a53f1e4 -Merge: 71bf635 7d7b899 +Merge: 71bf6351 7d7b899d Author: Patrick Schleizer Date: Thu May 16 19:53:27 2019 +0000 Merge remote-tracking branch 'origin/master' commit 7d7b899dd13f7123822bf269a639c68ff5cb737e -Merge: 71bf635 b814f33 +Merge: 71bf6351 b814f338 Author: Patrick Schleizer Date: Thu May 16 19:52:52 2019 +0000 Merge pull request #6 from madaidan/patch-2 - + Even more kernel hardening commit b814f338b803ae33380551919b00144bb63a53b8 @@ -15386,11 +23307,11 @@ Author: Patrick Schleizer Date: Wed May 8 21:38:25 2019 -0400 port to /etc/xdg/xfce4/xfconf/xfce-perchannel-xml - + https://forums.whonix.org/t/whonix-xfce-development/6213/84?u=patrick commit 3bd4da6794067708f517b099548c0aa2a2b65146 -Merge: c80b746 b00a264 +Merge: c80b7465 b00a264c Author: Patrick Schleizer Date: Wed May 8 21:32:29 2019 -0400 @@ -15439,19 +23360,19 @@ Date: Mon May 6 05:51:14 2019 -0400 remove trailing spaces commit 83e12f8e89cf0269daeca36946cdef07e23075b3 -Merge: 74cdecf 5177444 +Merge: 74cdecfd 5177444d Author: Patrick Schleizer Date: Mon May 6 05:50:35 2019 -0400 Merge remote-tracking branch 'origin/master' commit 5177444d624a8a935c461ebe1065d451d2f8da0f -Merge: 74cdecf 02e8888 +Merge: 74cdecfd 02e8888b Author: Patrick Schleizer Date: Mon May 6 05:46:03 2019 -0400 Merge pull request #5 from madaidan/patch-1 - + More kernel hardening commit 02e8888b0bc4f0dfadccbebc9e6e75849d32ba76 @@ -15549,18 +23470,18 @@ Author: Patrick Schleizer Date: Fri Mar 1 14:32:41 2019 +0000 add improved legal protections clauses - + The license for software created by Whonix is the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version with additional terms applicable per GNU GPL version 3 section 7. - + The additional terms are based on the Doom 3 license which is Debian refers to as `GPL-3+-with-id-software-additional-terms`, which is Debian DFSG [1] (The Debian Free Software Guidelines) approved and which is therefore suitable for Debian `main`. Whonix made applied minimal changes to it: - + * Rewrite `The Doom 3 BFG Edition GPL Source Code` to the more common `this program` which is used throughout the GPL. * Added a "trump clause" [2], in other words, any conflicts or disputes between the additional terms and the GPLv3 shall be resolved in favor of the GPLv3 by adding `Notwithstanding any other provision of this License` (as mentioned in GPL FAQ [3]) at the beginning of the additional terms. - + [1] https://www.debian.org/social_contract#guidelines [2] https://www.fsf.org/news/canonical-updated-licensing-terms [3] https://www.gnu.org/licenses/gpl-faq.html#v3Notwithstanding - + For more considerations, see also: https://www.whonix.org/wiki/Dev/Licensing @@ -15575,7 +23496,7 @@ Author: Patrick Schleizer Date: Mon Nov 19 06:27:52 2018 -0500 fix hiding network bookmark in thunar by default - + Thanks to @Algernon for suggesting the fix! commit daf7fc002b2d946c2946b9effe3fecc5cebe4cf2 @@ -15591,19 +23512,19 @@ Date: Thu Nov 8 09:55:41 2018 +0000 bumped changelog version commit 0c020af885b3dfb2924102e6cf41a5af114cc140 -Merge: f9e1877 6f240c0 +Merge: f9e18772 6f240c0c Author: Patrick Schleizer Date: Thu Nov 8 09:53:47 2018 +0000 Merge remote-tracking branch 'origin/master' commit 6f240c0c4c88df2946fdd673f833ee05dd8340bb -Merge: f9e1877 f84f988 +Merge: f9e18772 f84f9881 Author: Patrick Schleizer Date: Thu Nov 8 04:53:25 2018 -0500 Merge pull request #4 from Algernon-01/master - + Enable hidden files and volume management again. commit f84f988118e30a2a3d4d74ed008c1a626c35c365 @@ -15715,19 +23636,19 @@ Date: Wed Jul 26 14:37:34 2017 +0000 bumped changelog version commit dc2c9a9992551f5967e09b31a90721a9aadaf962 -Merge: 61bd4d0 91ff0c2 +Merge: 61bd4d05 91ff0c25 Author: Patrick Schleizer Date: Tue Mar 14 13:43:18 2017 +0000 Merge remote-tracking branch 'origin/master' commit 91ff0c2571b41710440006e770b8295c03b3a295 -Merge: 61bd4d0 6e5e5d6 +Merge: 61bd4d05 6e5e5d6e Author: Patrick Schleizer Date: Tue Mar 14 13:42:37 2017 +0000 Merge pull request #2 from HulaHoopWhonix/patch-2 - + Update README.md commit 6e5e5d6ea65a0fee4c76e5ad74c444344ff1f462 @@ -15765,7 +23686,7 @@ Author: Patrick Schleizer Date: Mon Feb 27 23:57:04 2017 +0000 No longer ignore duplicate apt sources in apt-get-wrapper. - + No longer acceptable because these generate lots of noise in the terminal. commit 191918027c1971bfb871abb438c4917e5b98bb74 @@ -15779,7 +23700,7 @@ Author: Patrick Schleizer Date: Mon Feb 27 23:16:32 2017 +0000 use python rather than unbuffer - + because unbuffer eats exit code when process is killed commit cc351165dc78a8b7158a2b9bfdd9e4f0b3866239 @@ -15807,7 +23728,7 @@ Author: Patrick Schleizer Date: Sun Feb 26 23:57:17 2017 +0000 fix, show progress during apt-get-wrapper - + fix, propagate signals to apt-get child process commit 49cde21078ccc9f623add6f587ee719843647ee7 @@ -15815,7 +23736,7 @@ Author: Patrick Schleizer Date: Tue Feb 21 19:54:41 2017 +0000 Whonix 14 KDE plasma 5 fixes - + https://phabricator.whonix.org/T633 commit 0228e87d477f634d1e1db7c1cf6f213275d40dd9 @@ -15829,7 +23750,7 @@ Author: Patrick Schleizer Date: Sun Feb 19 22:32:04 2017 +0000 override glib-compile-schemas with || true in postinst - + https://phabricator.whonix.org/T500 commit 5ba2a5b6ff53df37ad38f082ad86ff2227158d93 @@ -15837,13 +23758,13 @@ Author: Patrick Schleizer Date: Sun Feb 19 22:25:28 2017 +0000 disable previews in nautilus by default for better security - + copied solution by @unman - + https://github.com/QubesOS/qubes-issues/issues/1108 - + https://github.com/QubesOS/qubes-core-agent-linux/pull/39 - + https://phabricator.whonix.org/T500 commit 91adab0d1bab6c6b31903f1e165944b3f8c8adb1 @@ -15857,7 +23778,7 @@ Author: Patrick Schleizer Date: Wed Feb 15 20:46:22 2017 +0000 Debian stretch / kde plasma5 fix: KDEDIRS -> XDG_CONFIG_DIRS - + https://phabricator.whonix.org/T633 commit bddbba84a6fad680359bc8eee0c395fcc4d79ca9 @@ -15871,7 +23792,7 @@ Author: Patrick Schleizer Date: Tue Feb 14 02:37:08 2017 +0000 add usr/lib/security-misc/apt-get-update-sanity-test - + a CVE-2016-1252 sanity test script commit 5e076415536e1513463c59dba6e8afc4e90b7f1a @@ -15885,7 +23806,7 @@ Author: Patrick Schleizer Date: Fri Feb 10 15:47:52 2017 +0000 remove faketime from Build-Depends: - + since no longer used for reproducible builds commit be8084ad1c136ee4a18cb24abcc0c14c522b8089 @@ -15899,7 +23820,7 @@ Author: Patrick Schleizer Date: Wed Feb 8 14:26:26 2017 +0000 double apt-get-update wrapper timeout from 120 to 240 seconds - + since it takes a bit longer than 120 seconds for me on a fast connection commit 1e66e03da14ae2e3f7b315e443836c35f954b84f @@ -15967,7 +23888,7 @@ Author: Patrick Schleizer Date: Mon Oct 10 16:10:30 2016 +0000 disable conntrack helper for better security - + https://phabricator.whonix.org/T486 commit 0d66fc60b9ea65e826560986698c11cea7ca4ea6 @@ -15981,7 +23902,7 @@ Author: Patrick Schleizer Date: Mon Apr 25 23:19:54 2016 +0000 /etc/sysctl.d/nf_conntrack_helper.conf disabled for now as it needs more work - + https://phabricator.whonix.org/T486 commit 492ce128909cfda8645738b092fd9e8722c64aa0 @@ -16001,27 +23922,27 @@ Author: Patrick Schleizer Date: Thu Mar 31 15:36:59 2016 +0000 added 'Replaces: tcp-timestamps-disable' - + https://phabricator.whonix.org/T486 commit 7b54755841907c2b86b12eed5035860e17445193 -Merge: 10c87b8 be086ae +Merge: 10c87b84 be086aea Author: Patrick Schleizer Date: Thu Mar 31 15:35:07 2016 +0000 merged tcp-timestamps-disable package into security-misc package - + disable conntrack helper for better security - + https://phabricator.whonix.org/T486 commit be086aea597ff5e4db29f56fa57399c67568d4b6 -Merge: 10c87b8 d0eceae +Merge: 10c87b84 d0eceae0 Author: Patrick Schleizer Date: Thu Mar 31 15:34:17 2016 +0000 Merge pull request #1 from HulaHoopWhonix/patch-1 - + Create tcp_timestamps.conf commit d0eceae0c84a42bce4ade28c593fd6ba002a67b9 diff --git a/ci/codeql-build.sh b/ci/codeql-build.sh new file mode 100755 index 00000000..08c3e151 --- /dev/null +++ b/ci/codeql-build.sh @@ -0,0 +1,46 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## CodeQL manual build for the C sources in this repo. +## +## Delegates the actual gcc invocations to the upstream compile +## helpers under usr/libexec/security-misc/. Those helpers also run +## at install-time / first-run (out of build-fm-shim-backend and +## emerg-shutdown). Single source of truth means CI cannot drift on +## hardening flags vs runtime. +## +## Source-tree prep: +## +## ci/codeql-prepare.sh has already symlinked '*.c#' to clean +## '*.c' names by the time we run (the workflow runs prepare via +## the reusable's pre-init hook). gcc selects its driver behavior +## by file extension - a '.c#tag' source gets misclassified as a +## linker script - so the symlink is required even though gcc +## tolerates the tagged name in error messages. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +set -o xtrace + +sudo --non-interactive apt-get update --error-on=any +sudo --non-interactive apt-get install --yes --no-install-recommends \ + pkg-config libdbus-1-dev libsystemd-dev libc6-dev linux-libc-dev + +build_dir="$(mktemp -d)" +trap 'rm -rf -- "${build_dir}"' EXIT + +bash 'usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared' \ + usr/src/security-misc/fm-shim-backend.c \ + "${build_dir}/fm-shim-backend" + +bash 'usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared' \ + usr/src/security-misc/emerg-shutdown.c \ + "${build_dir}/emerg-shutdown" + +ls -l -- "${build_dir}" diff --git a/ci/codeql-prepare.sh b/ci/codeql-prepare.sh new file mode 100755 index 00000000..e4b63923 --- /dev/null +++ b/ci/codeql-prepare.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## CodeQL pre-init source-tree prep. +## +## This repo names installable files with a '#' suffix +## (Kicksecure/genmkfile convention - the suffix routes the file to +## the correct Debian binary package at build time). The suffix +## breaks two CodeQL paths: +## +## * Python extractor discovers source files by the '.py' +## extension; 'foo.py#security-misc-shared' is invisible. +## * gcc selects driver behavior by extension; 'foo.c#tag' is +## treated by ld as a linker script ("file format not +## recognized"). The compile helpers used by ci/codeql-build.sh +## receive their .c source by path argument, so a clean +## '.c'-extension symlink is required here too. +## +## Walk the tracked file list and create same-directory symlinks +## without the '#tag' suffix so both extractors and gcc see the +## source under its conventional name. Symlinks point at the +## original tagged file via basename so the link resolves regardless +## of how the tree is later moved. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(git rev-parse --show-toplevel)" +cd -- "${repo_root}" + +linked=0 +skipped=0 +while IFS= read -r tagged; do + ## Only files where the suffix immediately follows a known + ## source-language extension. Other tagged files (config files, + ## scripts without an extension, etc.) need no rename. + case "${tagged}" in + *'.py#'*|*'.c#'*|*'.h#'*) + ;; + *) + continue + ;; + esac + + clean="${tagged%#*}" + + ## Do not clobber a real (untagged) file. + if [ -e "${clean}" ] && [ ! -L "${clean}" ]; then + skipped=$((skipped + 1)) + continue + fi + + ## Symlink target must be relative to the link's directory. + target="$(basename -- "${tagged}")" + ln -snf -- "${target}" "${clean}" + linked=$((linked + 1)) +done < <(git ls-files -- '*.py#*' '*.c#*' '*.h#*') + +printf 'codeql-prepare: linked=%d skipped=%d\n' "${linked}" "${skipped}" diff --git a/ci/dfuzzer-build.sh b/ci/dfuzzer-build.sh new file mode 100755 index 00000000..607fe9ad --- /dev/null +++ b/ci/dfuzzer-build.sh @@ -0,0 +1,61 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Build dfuzzer from upstream source. Run from +## .github/workflows/local-dbus-fuzz.yml (R-100; no inline scripts +## in the YAML). +## +## Build / runtime deps are installed by the caller workflow via +## developer-meta-files/.github/actions/install-deps (genmkfile + +## helper-scripts + apt packages); the apt list lives in the +## caller workflow. +## +## Required apt deps for this script: +## - meson ninja-build # build system +## - xsltproc docbook-xsl # man-page generation +## - libglib2.0-dev # dfuzzer dep +## - dbus dbus-x11 # dfuzzer runtime +## - libdbus-1-dev libsystemd-dev pkg-config gcc # for the +## # fm-shim-backend +## # build below +## +## dfuzzer is NOT packaged in Ubuntu 24.04 noble (verified via +## packages.ubuntu.com - 'No such package'); hence the from-source +## build. Pinned to upstream tag v2.6 AND its exact commit (verified +## below); latest release as of 2026-05-08. Bump both DFUZZER_TAG and +## DFUZZER_COMMIT together when a new release lands. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## style-ok: no-tmp-hardcode (ephemeral CI build clone under /tmp/dfuzzer) + +if [ "${CI:-}" != "true" ] && [ "${ALLOW_LOCAL:-}" != "true" ]; then + printf '%s\n' "${BASH_SOURCE[0]}: refusing to run outside CI. Set ALLOW_LOCAL=true to override." >&2 + exit 1 +fi + +DFUZZER_TAG="${DFUZZER_TAG:-v2.6}" +DFUZZER_COMMIT="${DFUZZER_COMMIT:-a955a80f7dd20fd7aeffad91da1c495aab5dbbd3}" + +git clone --depth 1 --branch "${DFUZZER_TAG}" \ + https://github.com/dbus-fuzzer/dfuzzer /tmp/dfuzzer + +dfuzzer_actual_commit="$(git -C /tmp/dfuzzer rev-parse --verify HEAD)" +if [ "${dfuzzer_actual_commit}" != "${DFUZZER_COMMIT}" ]; then + printf '%s\n' "${BASH_SOURCE[0]}: dfuzzer tag ${DFUZZER_TAG} resolved to ${dfuzzer_actual_commit}, expected ${DFUZZER_COMMIT} -- refusing (tag moved?)." >&2 + exit 1 +fi + +meson setup --buildtype=release /tmp/dfuzzer/build /tmp/dfuzzer +ninja -C /tmp/dfuzzer/build -v +sudo install -m 0755 /tmp/dfuzzer/build/dfuzzer /usr/local/bin/dfuzzer +dfuzzer --version || dfuzzer -V || true diff --git a/ci/dfuzzer-run.sh b/ci/dfuzzer-run.sh new file mode 100755 index 00000000..9a293290 --- /dev/null +++ b/ci/dfuzzer-run.sh @@ -0,0 +1,194 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Run dfuzzer against fm-shim-backend's D-Bus surface. +## +## fm-shim-backend implements org.freedesktop.FileManager1 on the +## session bus. dfuzzer is the standard D-Bus service fuzzer +## (Debian-archive-shipped); given a bus name it iterates every +## method and signal on every interface the service exposes, sends +## type-correct adversarial payloads (overflow, mangled UTF-8, +## empty / max-length strings, weird container nesting), and +## flags any case where the service crashes, hangs, or returns +## an unexpected error. +## +## This is process-level fuzzing - we boot the actual binary +## under a transient D-Bus session bus rather than driving the +## function dispatcher in-process. Catches the integration +## surface (D-Bus marshaling glue, sd_notify, signal handlers, +## leaks across method calls) that an in-process libFuzzer +## harness on the parser alone would miss. +## +## Cwd contract: caller workflow runs this with the +## security-misc repo checkout as cwd. ci/codeql-prepare.sh +## must have run first to create the .c symlink the upstream +## compile script expects. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## CI guard. +if [ "${CI:-}" != "true" ] && [ "${ALLOW_LOCAL:-}" != "true" ]; then + printf '%s\n' "${BASH_SOURCE[0]}: refusing to run outside CI (CI != 'true'). Set ALLOW_LOCAL=true to override." >&2 + exit 1 +fi + +dfuzzer_seconds="${DFUZZER_SECONDS:-60}" + +work="$(mktemp -d)" + +dfuzzer_run_cleanup() { + # shellcheck disable=SC2317 ## invoked via 'trap' + rm -r -f -- "${work}" +} + +trap dfuzzer_run_cleanup EXIT + +printf '%s\n' "::group::Build fm-shim-backend" +bash 'usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared' \ + usr/src/security-misc/fm-shim-backend.c \ + "${work}/fm-shim-backend" +chmod 0755 -- "${work}/fm-shim-backend" +ls -l -- "${work}/fm-shim-backend" +printf '%s\n' "::endgroup::" + +## Inner script that runs INSIDE dbus-run-session's transient +## session bus. Manually starts fm-shim-backend in the background +## (auto-activation via XDG service files turned out to be +## flaky inside dbus-run-session) and fuzzes it. +## +## Written to a temp file rather than passed inline via 'bash -c' +## to avoid the multi-level shell quoting that was hiding bugs +## during initial debugging. +inner="${work}/dfuzzer-inner.sh" +cat > "${inner}" <<'INNER' +#!/bin/bash +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## Args (positional) from outer script: +## $1 = backend binary path +## $2 = dfuzzer seconds budget +backend_bin="$1" +seconds="$2" + +printf '%s\n' "DBUS_SESSION_BUS_ADDRESS=${DBUS_SESSION_BUS_ADDRESS}" + +backend_log="$(dirname -- "${backend_bin}")/fm-shim-backend.log" + +## Start fm-shim-backend in the background. Capture its stdout + +## stderr so we can surface them in the workflow log if dfuzzer +## fails to connect (without a tty the backend's output is +## block-buffered and would otherwise be lost on kill). +"${backend_bin}" >"${backend_log}" 2>&1 & +backend_pid=$! + +dfuzzer_inner_cleanup() { + kill "${backend_pid}" 2>/dev/null || true +} + +trap dfuzzer_inner_cleanup EXIT + +## Wait up to 5s for the backend to register the well-known name +## on the bus. dbus-run-session-internal name registration is +## usually < 100ms but allow a generous budget for slow runners. +for _i in {1..5}; do + sleep 1 + if ! kill -0 "${backend_pid}" 2>/dev/null; then + printf '%s\n' "::error::fm-shim-backend exited during startup" + cat -- "${backend_log}" || true + wait "${backend_pid}" 2>/dev/null + exit 1 + fi + if dbus-send --session --print-reply --dest=org.freedesktop.DBus \ + /org/freedesktop/DBus org.freedesktop.DBus.NameHasOwner \ + string:org.freedesktop.FileManager1 2>/dev/null \ + | grep -q 'boolean true'; then + printf '%s\n' "fm-shim-backend registered (after ${_i}s)" + break + fi +done + +## Sanity-check: confirm the name is actually owned and dump the +## backend's startup output to the workflow log. If anything +## subsequent fails, this gives a maintainer enough to triage. +printf '%s\n' "::group::backend startup log" +cat -- "${backend_log}" 2>/dev/null || printf '%s\n' "(no log lines flushed yet)" +printf '%s\n' "::endgroup::" + +printf '%s\n' "::group::busctl introspect (verifies Introspectable wiring)" +busctl --user --no-pager introspect \ + org.freedesktop.FileManager1 /org/freedesktop/FileManager1 || true +printf '%s\n' "::endgroup::" + +## Run the actual fuzzer. Iteration-bounded by default (-I 50 +## per method gives enough coverage on the small FileManager1 +## surface; bumpable per consumer). Total wall-clock bounded +## by the outer timeout wrapper. +rc=0 +## -n bus name (required) +## -o object path - dfuzzer defaults to '/' if omitted, which is +## empty for fm-shim-backend (its methods are at +## /org/freedesktop/FileManager1). Without -o the previous +## runs exited in milliseconds because there was nothing to +## fuzz at the default path. +## -s --no-suppressions. Without this flag dfuzzer 2.6 treats +## "no suppression file found at ./dfuzzer.conf, +## ~/.dfuzzer.conf, or /etc/dfuzzer.conf" as a fatal error +## and exits 1 before fuzzing anything. None of those paths +## exist on a fresh GitHub runner. We don't need suppressions +## anyway - we want every error reported. +## -I iterations per method. +## -v verbose per-method progress. +timeout --preserve-status "${seconds}" \ + dfuzzer \ + -n org.freedesktop.FileManager1 \ + -o /org/freedesktop/FileManager1 \ + -s \ + -I 50 \ + -v || rc=$? + +printf '%s\n' "::group::backend log after fuzz" +cat -- "${backend_log}" 2>/dev/null || true +printf '%s\n' "::endgroup::" + +printf '%s\n' "dfuzzer raw exit code: ${rc}" +exit "${rc}" +INNER +chmod +x "${inner}" + +printf '%s\n' "::group::dfuzzer (org.freedesktop.FileManager1, ${dfuzzer_seconds}s)" +rc=0 +dbus-run-session -- "${inner}" "${work}/fm-shim-backend" "${dfuzzer_seconds}" || rc=$? +printf '%s\n' "::endgroup::" +printf '%s\n' "dfuzzer wrapper exit code: ${rc}" + +case "${rc}" in + 0) + printf '%s\n' "dfuzzer: completed cleanly; no crashes / exceptions detected." + ;; + 124) + ## 'timeout --preserve-status' surfaces 124 when the wall- + ## clock budget is reached. Treat as 'budget reached, no + ## crash detected within window'. + printf '%s\n' "dfuzzer: ${dfuzzer_seconds}s budget reached; no crash detected within window." + rc=0 + ;; + *) + printf '%s\n' "::error::dfuzzer reported a finding (exit ${rc}). See log above for the failing method." + ;; +esac + +exit "${rc}" diff --git a/ci/tests/fm_shim_frontend/test_property.py b/ci/tests/fm_shim_frontend/test_property.py new file mode 100644 index 00000000..1361258e --- /dev/null +++ b/ci/tests/fm_shim_frontend/test_property.py @@ -0,0 +1,194 @@ +#!/usr/bin/python3 -Bsu + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Hypothesis property tests for fm_shim_frontend.get_path_list_from_uris. +## +## Target rationale: get_path_list_from_uris is the URI-validation +## chokepoint between the FileManager1 D-Bus surface and the user- +## facing dialog. It runs urllib.parse.urlsplit + urllib.parse.unquote +## on attacker-supplied strings, then enforces three independent +## invariants (no Unicode/control chars, no newlines/NUL post-decode, +## absolute-path-only) before the value is shown to the user or +## passed to a file manager. A property-test pass over Hypothesis- +## generated URI lists is the right shape to catch invariant +## violations: the function should never raise on any input (must +## degrade gracefully), and several output properties must hold for +## EVERY entry in the returned list - regardless of input pathology. + +# pylint: disable=missing-function-docstring,missing-class-docstring + +from pathlib import Path + +import pytest +from hypothesis import given, settings, HealthCheck, strategies as st + +from fm_shim_frontend.fm_shim_frontend import get_path_list_from_uris + + +## ---------------------------------------------------------------- +## Hypothesis strategies +## ---------------------------------------------------------------- + +## Arbitrary text that may include Unicode, control chars, NULs, +## newlines, percent escapes, etc. - explicitly UNSANITIZED so we +## probe the function's defensive behavior. +adversarial_text = st.text( + min_size=0, max_size=200, + alphabet=st.characters(blacklist_categories=()), +) + +## URIs that look plausibly file:// shaped so we exercise the +## post-urlsplit branches (most adversarial_text values fail at the +## scheme/netloc gate). Use 7-bit-ASCII for the URI body and let +## the unquoted path become arbitrary text via percent-escapes. +ascii_safe = st.text( + min_size=0, max_size=120, + alphabet=st.characters(min_codepoint=0x20, max_codepoint=0x7E), +) + +handler_modes = st.sampled_from([ + "--show-folders", + "--show-items", + "--show-item-properties", +]) + + +def _file_uri_from_text(t: str) -> str: + ## Always produce a file:// URI shape so the input survives the + ## scheme-check gate at least often enough for the inner code + ## paths to get exercised. + import urllib.parse as up + return "file://" + up.quote(t, safe="/-._~") + + +file_uri = ascii_safe.map(_file_uri_from_text) + +## Mix the two pools: half-and-half adversarial vs file-uri-shaped. +uri_strategy = st.one_of(adversarial_text, file_uri) + +uri_list_strategy = st.lists(uri_strategy, min_size=0, max_size=8) + + +## ---------------------------------------------------------------- +## Properties +## ---------------------------------------------------------------- + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_never_raises(handler_mode: str, uri_list: list[str]) -> None: + ## Foundational invariant: no input may crash the function. It + ## must always return a (possibly empty) list. Hypothesis will + ## try empty lists, lists of "", lists of malformed URIs, + ## arbitrary unicode, percent-escaped control chars, etc. + result = get_path_list_from_uris(handler_mode, uri_list) + assert isinstance(result, list) + for p in result: + assert isinstance(p, Path) + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_output_paths_are_absolute(handler_mode: str, uri_list: list[str]) -> None: + ## Domain invariant: every Path returned must be absolute. The + ## function explicitly skips relative paths; this property + ## guards against future refactors that drop the guard. + for p in get_path_list_from_uris(handler_mode, uri_list): + assert p.is_absolute(), f"non-absolute path leaked: {p!r}" + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_output_has_no_dangerous_chars( + handler_mode: str, uri_list: list[str] +) -> None: + ## Domain invariant: no path in the output may contain a newline + ## or a NUL byte. Both are explicitly filtered post-unquote; + ## this property catches a regression where the filter is moved + ## or weakened. + for p in get_path_list_from_uris(handler_mode, uri_list): + s = str(p) + assert "\n" not in s, f"newline leaked in output: {s!r}" + assert "\x00" not in s, f"NUL leaked in output: {s!r}" + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_output_unique_and_sorted( + handler_mode: str, uri_list: list[str] +) -> None: + ## Domain invariant: output is deduplicated and sorted (function + ## docs the dedup via 'set'; the sort is documented at the end). + ## A regression that drops either property would surprise + ## downstream callers that rely on stable iteration order. + out = get_path_list_from_uris(handler_mode, uri_list) + assert out == sorted(set(out)), \ + f"output not sorted-unique: {out!r}" + + +@settings( + max_examples=300, + deadline=None, + suppress_health_check=[HealthCheck.too_slow], +) +@given(handler_mode=handler_modes, uri_list=uri_list_strategy) +def test_idempotent_when_paths_are_string_form( + handler_mode: str, uri_list: list[str] +) -> None: + ## If we feed the function back its own output (re-encoded as + ## file:// URIs), the result should be a subset of the original + ## output (filesystem state may have changed; some entries may + ## have disappeared, but no NEW entries should appear). This + ## catches refactors that introduce non-idempotent behavior. + import urllib.parse as up + first = get_path_list_from_uris(handler_mode, uri_list) + re_uris = ["file://" + up.quote(str(p), safe="/-._~") for p in first] + second = get_path_list_from_uris(handler_mode, re_uris) + assert set(second).issubset(set(first)), \ + f"second pass introduced paths not in first: " \ + f"first={first!r} second={second!r}" + + +## ---------------------------------------------------------------- +## Targeted regressions +## ---------------------------------------------------------------- + +@pytest.mark.parametrize("uri", [ + "", # empty + "file:///\nevil", # newline post-decode + "file:///%00etc/passwd", # NUL post-decode + "file:///etc/passwd?query=1", # query component + "file:///etc/passwd#frag", # fragment component + "http://example.com/etc/passwd", # non-file scheme + "file://attacker.example/etc/passwd", # non-localhost netloc + "file:relative/path", # relative + "file:///" + "A" * 10000, # very long + "file:///%C3%A9clair", # non-ASCII percent-escape +]) +def test_known_adversarial_inputs_rejected(uri: str) -> None: + ## Concrete fixed-input regressions for the categories the + ## function explicitly defends against. These are NOT + ## Hypothesis-generated; they nail down specific past or + ## anticipated bug shapes so a regression is caught immediately + ## rather than waiting for Hypothesis to rediscover them. + out = get_path_list_from_uris("--show-folders", [uri]) + assert out == [], f"adversarial URI not rejected: {uri!r} -> {out!r}" diff --git a/ci/tests/permission_hardener/test_state_spaced_filename.sh b/ci/tests/permission_hardener/test_state_spaced_filename.sh new file mode 100755 index 00000000..bfd77155 --- /dev/null +++ b/ci/tests/permission_hardener/test_state_spaced_filename.sh @@ -0,0 +1,70 @@ +#!/bin/bash +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## WARNING: Not human-reviewed, MUST be moved to dist-ai. + +## Regression test: a hardened file whose path contains spaces must be +## un-hardenable via 'disable'. +## +## load_state_without_policy() reads the dpkg-statoverride state DB, one entry +## per line as 'owner group mode path'. A plain 4-field split drops any spaced +## path, so 'disable' never finds the entry and the file can never be restored. +## +## Seeds one spaced entry (mode 0744) into the state DB, sets the file to 0600, +## runs 'disable', and asserts the mode is restored to 0744 -- which only +## happens if load_state_without_policy read the spaced path back. +## +## Requires root: writes the state DB and chmod/chowns the target file. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" +ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}" + +if [ ! -f "${ph_bin}" ]; then + printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2 + exit 1 +fi + +## Must match store_dir in the script under test. +existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode' +mkdir -p -- "${existing_mode_admindir}" + +test_dir="$(mktemp -d -t ph-state-test.XXXXXX)" +spaced_file="${test_dir}/spaced tool" +touch -- "${spaced_file}" +chmod 0600 -- "${spaced_file}" + +## invoked indirectly via 'trap ... EXIT' +# shellcheck disable=SC2317 +cleanup() { + ## undo touches the master and new_mode DBs, not existing_mode, so remove the + ## seeded entry explicitly. + dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \ + "${spaced_file}" >/dev/null 2>&1 || true + safe-rm -rf -- "${test_dir}" +} +trap cleanup EXIT + +## Seed the state DB: this is the record 'enable' would have written. +dpkg-statoverride --admindir "${existing_mode_admindir}" --add \ + root root 0744 "${spaced_file}" + +"${ph_bin}" disable "${spaced_file}" >/dev/null 2>&1 || true + +actual_mode="$(stat -c '%a' -- "${spaced_file}")" +if [ "${actual_mode}" = '744' ]; then + printf '%s\n' "PASS: spaced-path state entry read back; mode restored to 744." + exit 0 +fi + +printf '%s\n' "FAIL: mode is '${actual_mode}', expected '744' -- spaced state entry not read back, file cannot be un-hardened." >&2 +exit 1 diff --git a/ci/tests/permission_hardener/test_whitelists_disable_all.sh b/ci/tests/permission_hardener/test_whitelists_disable_all.sh new file mode 100755 index 00000000..e69b200c --- /dev/null +++ b/ci/tests/permission_hardener/test_whitelists_disable_all.sh @@ -0,0 +1,91 @@ +#!/bin/bash +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## WARNING: Not human-reviewed, MUST be moved to dist-ai. + +## Regression test: the documented special directive 'whitelists_disable_all=true' +## must be honored, not rejected. +## +## The line contains '=', which is outside the config character-class allow-set. +## The directive check must run BEFORE that character-class validation; otherwise +## the documented line trips "invalid characters" and aborts the whole hardener +## (exit 200), so every other hardening rule in every conf is dropped too. +## +## Drives the REAL script via 'print-policy' with a conf that holds the directive +## plus one ordinary entry, and asserts print-policy exits 0 with the ordinary +## entry present. +## +## Requires root: writes a temporary config under /etc/permission-hardener.d/ +## and needs helper-scripts installed (sourced by permission-hardener). + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" +ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}" + +if [ ! -f "${ph_bin}" ]; then + printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2 + exit 1 +fi + +test_dir="$(mktemp -d -t ph-wda-test.XXXXXX)" +ordinary_file="${test_dir}/ordinary" +touch -- "${ordinary_file}" + +config_dir="/etc/permission-hardener.d" +config_file="${config_dir}/zz-ai-whitelists-disable-all-test.conf" +mkdir -p -- "${config_dir}" + +## print-policy captures the file's current mode into this DB (must match +## store_dir in the script under test); remove the entry so a test run does not +## leave a stale root-owned override pointing at a deleted temp file. +existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode' + +## invoked indirectly via 'trap ... EXIT' +# shellcheck disable=SC2317 +cleanup() { + dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \ + "${ordinary_file}" >/dev/null 2>&1 || true + safe-rm -f -- "${config_file}" + safe-rm -rf -- "${test_dir}" +} +trap cleanup EXIT + +{ + printf '%s\n' 'whitelists_disable_all=true' + printf '%s\n' "${ordinary_file} 0744 root root" +} > "${config_file}" + +## The directive line aborts the whole run (exit 200) on the buggy ordering; +## capture the status via an 'if' condition (errexit stays enabled). +if policy_output="$( "${ph_bin}" print-policy 2>/dev/null )"; then + ph_rc=0 +else + ph_rc=$? +fi + +test_status=0 +if [ "${ph_rc}" -ne 0 ]; then + printf '%s\n' "FAIL: print-policy exited ${ph_rc} (directive rejected as invalid characters)." >&2 + test_status=1 +fi +if printf '%s\n' "${policy_output}" | grep --quiet --fixed-strings -- "${ordinary_file}"$'\t'; then + printf '%s\n' "PASS: whitelists_disable_all=true accepted; ordinary entry present." +else + printf '%s\n' "FAIL: ordinary entry '${ordinary_file}' missing from print-policy output." >&2 + test_status=1 +fi + +if [ "${test_status}" -ne 0 ]; then + printf '%s\n' "----- print-policy output -----" >&2 + printf '%s\n' "${policy_output}" >&2 +fi +exit "${test_status}" diff --git a/ci/tests/permission_hardener/test_whitespace_filename.sh b/ci/tests/permission_hardener/test_whitespace_filename.sh new file mode 100755 index 00000000..6d2a63b6 --- /dev/null +++ b/ci/tests/permission_hardener/test_whitespace_filename.sh @@ -0,0 +1,138 @@ +#!/bin/bash +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## WARNING: Not human-reviewed, MUST be moved to dist-ai. + +## Regression test: permission-hardener must parse a config filename that +## contains spaces. +## +## load_state() recovers the filename by reading the option fields from the +## right (a trailing whitelist keyword, or the mode/owner/group[/capability] +## tail anchored by the octal mode). A space in the filename must NOT split it +## into the wrong fields -- that drops the entry silently, leaving a SUID +## binary un-hardened. +## +## Drives the REAL script via 'print-policy' with a mode-form entry +## ( ) whose filename contains a space, and +## asserts the recovered filename appears in the printed policy. +## +## Requires root: writes a temporary config under /etc/permission-hardener.d/ +## and needs helper-scripts installed (sourced by permission-hardener). + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" +ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}" + +if [ ! -f "${ph_bin}" ]; then + printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2 + exit 1 +fi + +test_dir="$(mktemp -d -t ph-ws-test.XXXXXX)" +## The space in the directory name is the property under test. +spaced_file="${test_dir}/some space/binary" +mkdir -p -- "${test_dir}/some space" +touch -- "${spaced_file}" + +## A filename whose space-split yields a BARE octal chunk ('744'). The mode +## must be anchored from the RIGHT: a left-to-right scan anchors on that chunk +## instead of the real mode at the end, fails the field-count check, and aborts +## the whole hardener (exit 200) rather than parsing the entry. +octal_chunk_file="${test_dir}/a 744 name" +touch -- "${octal_chunk_file}" + +## A space-free filename with a 4-option (capability) tail whose OWNER is a +## numeric id that looks octal ('0755'). Right-anchoring must NOT treat that +## owner as the mode: it would fold the real mode into the filename, the folded +## path does not exist, and the entry is silently dropped -- leaving the file +## un-hardened. The line is already well formed, so no recovery must happen. +numeric_owner_file="${test_dir}/numowner" +touch -- "${numeric_owner_file}" + +## The mirror-image of the numeric-owner case: a SPACED filename whose second +## component (field index 1) is a bare octal, with a 3-field tail. Here field 1 +## is NOT the mode, so recovery must happen. Existence disambiguates: the spaced +## name exists, its no-recovery prefix does not. +octal_second_file="${test_dir}/a 744" +touch -- "${octal_second_file}" + +## Six fields: a SPACED filename plus a numeric octal-looking owner and a +## capability tail. The rightmost octal candidate (field_count-3) is the owner, +## not the mode; anchoring there folds the mode into the filename and drops the +## entry. Existence must select field_count-4 (the real mode) instead. +numeric_owner_spaced_file="${test_dir}/x y" +touch -- "${numeric_owner_spaced_file}" + +config_dir="/etc/permission-hardener.d" +config_file="${config_dir}/zz-ai-whitespace-regression-test.conf" +mkdir -p -- "${config_dir}" + +## print-policy captures each file's current mode into this DB (must match +## store_dir in the script under test); remove the entries so a test run does +## not leave stale root-owned overrides pointing at deleted temp files. +existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode' + +## invoked indirectly via 'trap ... EXIT' +# shellcheck disable=SC2317 +cleanup() { + local leaked_file + for leaked_file in "${spaced_file}" "${octal_chunk_file}" \ + "${numeric_owner_file}" "${octal_second_file}" \ + "${numeric_owner_spaced_file}"; do + dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \ + "${leaked_file}" >/dev/null 2>&1 || true + done + safe-rm -f -- "${config_file}" + safe-rm -rf -- "${test_dir}" +} +trap cleanup EXIT + +## mode-form entries: [capability] +{ + printf '%s\n' "${spaced_file} 0744 root root" + printf '%s\n' "${octal_chunk_file} 0744 root root" + printf '%s\n' "${numeric_owner_file} 0744 0755 root cap_net_raw" + printf '%s\n' "${octal_second_file} 0644 root root" + printf '%s\n' "${numeric_owner_spaced_file} 0744 0755 root cap_net_raw" +} > "${config_file}" + +## A parse failure on any line aborts the whole run with exit 200; capture the +## status via an 'if' condition (errexit stays enabled) so the failure is +## reported cleanly rather than aborting the test. +if policy_output="$( "${ph_bin}" print-policy 2>/dev/null )"; then + ph_rc=0 +else + ph_rc=$? +fi + +test_status=0 +if [ "${ph_rc}" -ne 0 ]; then + printf '%s\n' "FAIL: print-policy exited ${ph_rc} (parse aborted the whole run)." >&2 + test_status=1 +fi +## print-policy prints tab-separated columns (FileUser...), so match +## each filename as the whole first field (trailing TAB). A bare substring match +## would let '/a 744' spuriously match the '/a 744 name' entry. +for expected_file in "${spaced_file}" "${octal_chunk_file}" "${numeric_owner_file}" "${octal_second_file}" "${numeric_owner_spaced_file}"; do + if printf '%s\n' "${policy_output}" | grep --quiet --fixed-strings -- "${expected_file}"$'\t'; then + printf '%s\n' "PASS: filename '${expected_file}' parsed and present in policy." + else + printf '%s\n' "FAIL: filename '${expected_file}' missing from print-policy output." >&2 + test_status=1 + fi +done + +if [ "${test_status}" -ne 0 ]; then + printf '%s\n' "----- print-policy output -----" >&2 + printf '%s\n' "${policy_output}" >&2 +fi +exit "${test_status}" diff --git a/debian/changelog b/debian/changelog index 6931cd64..3d05dca1 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,849 @@ +security-misc (3:54.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 30 Sep 2026 08:33:58 +0000 + +security-misc (3:54.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 29 Sep 2026 08:08:57 +0000 + +security-misc (3:54.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 19 Sep 2026 14:09:17 +0000 + +security-misc (3:53.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 15 Sep 2026 14:32:35 +0000 + +security-misc (3:53.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 15 Sep 2026 12:00:54 +0000 + +security-misc (3:53.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 09 Sep 2026 11:05:43 +0000 + +security-misc (3:53.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 08 Sep 2026 15:30:04 +0000 + +security-misc (3:53.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 06 Sep 2026 16:58:23 +0000 + +security-misc (3:53.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 16 Aug 2026 08:24:20 +0000 + +security-misc (3:53.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Aug 2026 08:12:04 +0000 + +security-misc (3:53.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 28 Jul 2026 13:20:23 +0000 + +security-misc (3:53.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 21 Jul 2026 09:23:19 +0000 + +security-misc (3:53.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 20 May 2026 22:20:09 +0000 + +security-misc (3:52.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 18 May 2026 10:14:14 +0000 + +security-misc (3:52.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 15 May 2026 18:40:53 +0000 + +security-misc (3:52.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 11 May 2026 20:28:53 +0000 + +security-misc (3:52.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 02 May 2026 08:48:24 +0000 + +security-misc (3:52.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 25 Apr 2026 09:26:49 +0000 + +security-misc (3:52.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 22 Apr 2026 13:16:45 +0000 + +security-misc (3:52.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 16 Apr 2026 12:27:58 +0000 + +security-misc (3:52.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 12 Apr 2026 14:03:30 +0000 + +security-misc (3:52.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 Apr 2026 09:21:40 +0000 + +security-misc (3:52.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 09 Apr 2026 11:57:57 +0000 + +security-misc (3:51.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 08 Apr 2026 17:51:28 +0000 + +security-misc (3:51.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 22 Mar 2026 11:13:50 +0000 + +security-misc (3:51.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Mar 2026 18:30:25 +0000 + +security-misc (3:51.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 14 Mar 2026 12:08:52 +0000 + +security-misc (3:51.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 23 Feb 2026 13:34:15 +0000 + +security-misc (3:51.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Feb 2026 12:17:16 +0000 + +security-misc (3:51.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 11 Jan 2026 16:40:08 +0000 + +security-misc (3:51.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 05 Jan 2026 10:28:53 +0000 + +security-misc (3:51.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 01 Jan 2026 17:28:24 +0000 + +security-misc (3:51.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 28 Dec 2025 06:36:59 +0000 + +security-misc (3:50.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Dec 2025 11:38:31 +0000 + +security-misc (3:50.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Dec 2025 09:56:05 +0000 + +security-misc (3:50.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 12 Dec 2025 13:17:08 +0000 + +security-misc (3:50.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 09 Dec 2025 14:06:55 +0000 + +security-misc (3:50.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 05 Dec 2025 11:39:12 +0000 + +security-misc (3:50.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 03 Dec 2025 08:31:21 +0000 + +security-misc (3:50.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 24 Nov 2025 08:44:09 +0000 + +security-misc (3:50.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 23 Nov 2025 10:26:13 +0000 + +security-misc (3:50.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 19 Nov 2025 07:02:14 +0000 + +security-misc (3:50.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 14 Nov 2025 06:21:34 +0000 + +security-misc (3:49.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 12 Nov 2025 06:13:05 +0000 + +security-misc (3:49.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 10 Nov 2025 08:00:05 +0000 + +security-misc (3:49.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 09 Nov 2025 10:47:45 +0000 + +security-misc (3:49.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 09 Nov 2025 08:12:41 +0000 + +security-misc (3:49.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 08 Nov 2025 07:44:43 +0000 + +security-misc (3:49.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 02 Nov 2025 11:41:51 +0000 + +security-misc (3:49.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Nov 2025 10:13:49 +0000 + +security-misc (3:49.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Nov 2025 09:41:23 +0000 + +security-misc (3:49.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 01 Nov 2025 09:18:12 +0000 + +security-misc (3:49.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 31 Oct 2025 14:38:30 +0000 + +security-misc (3:48.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 27 Oct 2025 11:48:10 +0000 + +security-misc (3:48.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 26 Oct 2025 12:30:29 +0000 + +security-misc (3:48.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 23 Oct 2025 06:03:25 +0000 + +security-misc (3:48.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 19 Oct 2025 08:43:36 +0000 + +security-misc (3:48.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 18 Oct 2025 09:19:07 +0000 + +security-misc (3:48.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 Oct 2025 12:08:28 +0000 + +security-misc (3:48.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 07 Oct 2025 08:40:31 +0000 + +security-misc (3:48.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 28 Sep 2025 21:09:45 +0000 + +security-misc (3:48.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 26 Sep 2025 08:40:20 +0000 + +security-misc (3:48.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 24 Sep 2025 14:32:34 +0000 + +security-misc (3:47.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 22 Sep 2025 17:25:48 +0000 + +security-misc (3:47.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Sep 2025 18:43:35 +0000 + +security-misc (3:47.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Sep 2025 18:10:09 +0000 + +security-misc (3:47.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 19 Sep 2025 16:18:37 +0000 + +security-misc (3:47.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 13 Sep 2025 08:33:02 +0000 + +security-misc (3:47.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 02 Sep 2025 15:25:49 +0000 + +security-misc (3:47.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 30 Aug 2025 14:19:30 +0000 + +security-misc (3:47.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 27 Aug 2025 19:31:06 +0000 + +security-misc (3:47.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 26 Aug 2025 09:16:15 +0000 + +security-misc (3:47.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 10 Aug 2025 06:34:30 +0000 + +security-misc (3:46.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 09 Aug 2025 09:45:34 +0000 + +security-misc (3:46.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 07 Aug 2025 07:08:19 +0000 + +security-misc (3:46.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 06 Aug 2025 08:27:15 +0000 + +security-misc (3:46.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 04 Aug 2025 09:27:11 +0000 + +security-misc (3:46.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 03 Aug 2025 11:33:03 +0000 + +security-misc (3:46.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 21 Jul 2025 10:00:25 +0000 + +security-misc (3:46.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 02 Jul 2025 20:52:17 +0000 + +security-misc (3:46.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 14 Jun 2025 11:51:44 +0000 + +security-misc (3:46.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 28 May 2025 13:48:11 +0000 + +security-misc (3:46.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 28 May 2025 12:12:00 +0000 + +security-misc (3:45.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 27 May 2025 19:41:25 +0000 + +security-misc (3:45.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 27 May 2025 15:51:50 +0000 + +security-misc (3:45.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 22:06:01 +0000 + +security-misc (3:45.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 15:52:16 +0000 + +security-misc (3:45.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 13:58:18 +0000 + +security-misc (3:45.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 21 May 2025 11:23:39 +0000 + +security-misc (3:45.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 20 May 2025 11:40:27 +0000 + +security-misc (3:45.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 25 Apr 2025 09:54:23 +0000 + +security-misc (3:45.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 25 Apr 2025 08:19:34 +0000 + +security-misc (3:45.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 21 Apr 2025 10:21:54 +0000 + +security-misc (3:44.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sat, 19 Apr 2025 17:33:56 +0000 + +security-misc (3:44.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 15 Apr 2025 20:59:37 +0000 + +security-misc (3:44.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 10 Apr 2025 11:38:17 +0000 + +security-misc (3:44.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 09 Apr 2025 15:15:59 +0000 + +security-misc (3:44.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 08 Apr 2025 14:08:24 +0000 + +security-misc (3:44.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 03 Mar 2025 11:00:37 +0000 + +security-misc (3:44.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 09 Feb 2025 23:04:36 +0000 + +security-misc (3:44.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 31 Jan 2025 19:38:41 +0000 + +security-misc (3:44.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 30 Jan 2025 12:58:48 +0000 + +security-misc (3:44.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 29 Jan 2025 14:36:41 +0000 + +security-misc (3:43.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 23 Jan 2025 16:28:58 +0000 + +security-misc (3:43.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 22 Jan 2025 14:11:21 +0000 + +security-misc (3:43.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 22 Jan 2025 13:52:29 +0000 + +security-misc (3:43.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 20 Jan 2025 11:35:08 +0000 + +security-misc (3:43.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 20 Jan 2025 10:11:42 +0000 + +security-misc (3:43.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 17 Jan 2025 13:35:27 +0000 + +security-misc (3:43.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 15 Jan 2025 15:02:43 +0000 + +security-misc (3:43.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:32:12 +0000 + +security-misc (3:43.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:30:58 +0000 + +security-misc (3:43.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:16:45 +0000 + +security-misc (3:42.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:07:50 +0000 + +security-misc (3:42.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 14:06:50 +0000 + +security-misc (3:42.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 13:53:49 +0000 + +security-misc (3:42.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 09:26:05 +0000 + +security-misc (3:42.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 14 Jan 2025 08:24:05 +0000 + +security-misc (3:42.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 12 Jan 2025 11:47:17 +0000 + +security-misc (3:42.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 10 Jan 2025 15:34:20 +0000 + +security-misc (3:42.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 06 Jan 2025 10:31:40 +0000 + +security-misc (3:42.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 31 Dec 2024 18:42:01 +0000 + +security-misc (3:42.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 31 Dec 2024 14:09:34 +0000 + +security-misc (3:41.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 26 Dec 2024 04:12:02 +0000 + +security-misc (3:41.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 24 Dec 2024 05:16:21 +0000 + +security-misc (3:41.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 20 Dec 2024 06:01:27 +0000 + +security-misc (3:41.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 20 Dec 2024 05:58:24 +0000 + +security-misc (3:41.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Fri, 20 Dec 2024 05:48:48 +0000 + +security-misc (3:41.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Dec 2024 10:58:50 +0000 + +security-misc (3:41.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Dec 2024 09:43:26 +0000 + +security-misc (3:41.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 19 Dec 2024 06:57:42 +0000 + +security-misc (3:41.1-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Dec 2024 19:19:10 +0000 + +security-misc (3:41.0-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 10 Dec 2024 19:17:10 +0000 + +security-misc (3:40.9-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 25 Nov 2024 21:07:41 +0000 + +security-misc (3:40.8-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 14 Nov 2024 22:24:50 +0000 + +security-misc (3:40.7-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Thu, 14 Nov 2024 20:46:26 +0000 + +security-misc (3:40.6-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Tue, 12 Nov 2024 09:11:57 +0000 + +security-misc (3:40.5-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Mon, 11 Nov 2024 11:07:57 +0000 + +security-misc (3:40.4-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Sun, 10 Nov 2024 11:52:42 +0000 + +security-misc (3:40.3-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 30 Oct 2024 09:43:05 +0000 + +security-misc (3:40.2-1) unstable; urgency=medium + + * New upstream version (local package). + + -- Patrick Schleizer Wed, 23 Oct 2024 09:56:05 +0000 + security-misc (3:40.1-1) unstable; urgency=medium * New upstream version (local package). diff --git a/debian/control b/debian/control index 4909511f..1673ab33 100644 --- a/debian/control +++ b/debian/control @@ -1,42 +1,82 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. Source: security-misc Section: misc Priority: optional Maintainer: Patrick Schleizer -Build-Depends: config-package-dev, - debhelper (>= 13), +Build-Depends: debhelper (>= 13), debhelper-compat (= 13), - dh-apparmor + dh-apparmor, + dh-exec, + config-package-dev, + po-debconf Homepage: https://www.kicksecure.com/wiki/Security-misc Vcs-Browser: https://github.com/Kicksecure/security-misc Vcs-Git: https://github.com/Kicksecure/security-misc.git -Standards-Version: 4.6.2 +Standards-Version: 4.7.2 Rules-Requires-Root: no -Package: security-misc +## 'Package: security-misc-shared' Comments +## +## 'Conflicts: security-misc' is needed. +## > dpkg-divert: error: 'diversion of /etc/securetty to /etc/securetty.security-misc-orig by security-misc-shared' clashes with 'diversion of /etc/securetty to /etc/securetty.security-misc-orig by security-misc' +## +## 'Provides: security-misc' is useful. +## sudo dpkg -i /home/user/derivative-binary/genmkfile-packages-result/security-misc-shared_47.7-1_all.deb +## > dpkg: considering removing security-misc in favour of security-misc-shared ... +## > dpkg: no, cannot proceed with removal of security-misc (--auto-deconfigure will help): +## > systemcheck depends on security-misc +## > security-misc is to be removed +Package: security-misc-shared Architecture: all +Pre-Depends: helper-scripts Depends: adduser, apparmor-profile-dist, + build-essential, dmsetup, - helper-scripts, libcap2-bin, + libdbus-1-dev, libglib2.0-bin, libpam-modules-bin, libpam-runtime, libpam-umask, + libsystemd-dev, + memlockd, + pkgconf, python3, secure-delete, - sudo, ${misc:Depends} -Replaces: anon-gpg-tweaks, swappiness-lowest, tcp-timestamps-disable +Replaces: anon-gpg-tweaks, + security-misc, + swappiness-lowest, + tcp-timestamps-disable +Conflicts: security-misc +Provides: security-misc Description: Enhances Miscellaneous Security Settings https://github.com/Kicksecure/security-misc/blob/master/README.md . https://www.kicksecure.com/wiki/Security-misc . + Package security-misc-desktop and/or security-misc-server may also be useful. + . Discussion: . Happening primarily in Whonix forums. - https://forums.whonix.org/t/kernel-hardening/7296 + https://forums.whonix.org/t/kernel-hardening-security-misc/7296 + +Package: security-misc-desktop +Architecture: all +Depends: security-misc-shared, ${misc:Depends} +Description: Security improvements for desktops + For desktops. + . + (Or servers running a desktop?) + +Package: security-misc-server +Architecture: all +Depends: security-misc-shared, ${misc:Depends} +Description: Security improvements for servers + For servers. + . + (Or desktops running a server?) diff --git a/debian/copyright b/debian/copyright index bf111380..829d9096 100644 --- a/debian/copyright +++ b/debian/copyright @@ -1,7 +1,7 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Files: * -Copyright: 2012 - 2024 ENCRYPTED SUPPORT LP +Copyright: 2012 - 2025 ENCRYPTED SUPPORT LLC License: AGPL-3+ License: AGPL-3+ diff --git a/debian/make-helper-overrides.bsh b/debian/make-helper-overrides.bsh index ca24e427..4804b3e2 100755 --- a/debian/make-helper-overrides.bsh +++ b/debian/make-helper-overrides.bsh @@ -1,7 +1,7 @@ #!/bin/bash -## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/24 -genmkfile_lintian_post_opts+=" --suppress-tags obsolete-command-in-modprobe.d-file" +genmkfile_lintian_post_opts+=" --suppress-tags obsolete-command-in-modprobe.d-file --suppress-tags no-complete-debconf-translation" diff --git a/debian/po/POTFILES.in b/debian/po/POTFILES.in new file mode 100644 index 00000000..2d13c3f1 --- /dev/null +++ b/debian/po/POTFILES.in @@ -0,0 +1 @@ +[type: gettext/rfc822deb] security-misc-shared.templates diff --git a/debian/po/templates.pot b/debian/po/templates.pot new file mode 100644 index 00000000..6d99cfe5 --- /dev/null +++ b/debian/po/templates.pot @@ -0,0 +1,36 @@ +# SOME DESCRIPTIVE TITLE. +# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER +# This file is distributed under the same license as the security-misc-shared package. +# FIRST AUTHOR , YEAR. +# +#, fuzzy +msgid "" +msgstr "" +"Project-Id-Version: security-misc-shared\n" +"Report-Msgid-Bugs-To: security-misc-shared@packages.debian.org\n" +"POT-Creation-Date: 2025-01-14 09:31-0500\n" +"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" +"Last-Translator: FULL NAME \n" +"Language-Team: LANGUAGE \n" +"Language: \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=CHARSET\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Type: note +#. Description +#: ../security-misc-shared.templates:1001 +msgid "Manual intervention may be required for permission-hardener update" +msgstr "" + +#. Type: note +#. Description +#: ../security-misc-shared.templates:1001 +msgid "" +"No need to panic. Nothing is broken. A rare condition has been encountered. " +"permission-hardener is being updated to fix a minor bug that caused " +"corruption in the permission-hardener state file. If you installed your own " +"custom permission-hardener configuration, some manual intervention may be " +"required. See: https://www.kicksecure.com/wiki/" +"SUID_Disabler_and_Permission_Hardener#fixing_state_files" +msgstr "" diff --git a/debian/rules b/debian/rules index 60f46e03..ca5e85c2 100755 --- a/debian/rules +++ b/debian/rules @@ -1,6 +1,6 @@ #!/usr/bin/make -f -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. #export DH_VERBOSE=1 diff --git a/debian/security-misc-desktop.install b/debian/security-misc-desktop.install new file mode 100755 index 00000000..609f3f7c --- /dev/null +++ b/debian/security-misc-desktop.install @@ -0,0 +1,12 @@ +#!/usr/bin/dh-exec + +## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file was generated using 'genmkfile debinstfile'. + +etc/bluetooth/30_security-misc.conf#security-misc-desktop => /etc/bluetooth/30_security-misc.conf +etc/sudoers.d/security-misc-desktop#security-misc-desktop => /etc/sudoers.d/security-misc-desktop +usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop => /usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf +usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop => /usr/lib/NetworkManager/conf.d/80_randomize-mac.conf +usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop => /usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf diff --git a/debian/security-misc-server.install b/debian/security-misc-server.install new file mode 100755 index 00000000..5e86b45a --- /dev/null +++ b/debian/security-misc-server.install @@ -0,0 +1,8 @@ +#!/usr/bin/dh-exec + +## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file was generated using 'genmkfile debinstfile'. + +usr/libexec/security-misc/placeholder#security-misc-server => /usr/libexec/security-misc/placeholder diff --git a/debian/security-misc-shared.config b/debian/security-misc-shared.config new file mode 100755 index 00000000..71d76190 --- /dev/null +++ b/debian/security-misc-shared.config @@ -0,0 +1,190 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + source /usr/libexec/helper-scripts/pre.bsh +fi + +source /usr/share/debconf/confmodule + +set -e + +## Not set by DPKG for '.config' script. +DPKG_MAINTSCRIPT_PACKAGE="security-misc-shared" +DPKG_MAINTSCRIPT_NAME="config" + +true " +##################################################################### +## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $* +##################################################################### +" + +## NOTE: Code duplication. +## Copied from: helper-scripts /usr/libexec/helper-scripts/package_installed_check.sh +## +## '.config' scripts are run very early. Even 'Pre-Depends: helper-scripts' would be insufficient. +## Therefore the code is duplicated here. +pkg_installed() { + local package_name dpkg_query_output + local requested_action status error_state + + package_name="$1" + ## Cannot use '&>' because it is a bashism. + dpkg_query_output="$(dpkg-query --show --showformat='${Status}' "$package_name" 2>/dev/null)" || true + ## dpkg_query_output Examples: + ## install ok half-configured + ## install ok installed + + requested_action=$(printf '%s' "$dpkg_query_output" | awk '{print $1}') + status=$(printf '%s' "$dpkg_query_output" | awk '{print $2}') + error_state=$(printf '%s' "$dpkg_query_output" | awk '{print $3}') + + if [ "$requested_action" = 'install' ]; then + true "$0: INFO: $package_name is installed, ok." + return 0 + fi + + true "$0: INFO: $package_name is not installed, ok." + return 1 +} + +check_migrate_permission_hardener_state() { + local pkg_list modified_pkg_data_str custom_hardening_arr config_file + + ## If folder /var/lib/permission-hardener (version 1) does not exist, this migration is unneeded. + if [ ! -d '/var/lib/permission-hardener' ]; then + return 0 + fi + + local orig_hardening_arr custom_hardening_arr config_file custom_config_file + if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" ]; then + return 0 + fi + mkdir --parents '/var/lib/security-misc/do_once' + + orig_hardening_arr=( + '/usr/lib/permission-hardener.d/25_default_passwd.conf' + '/usr/lib/permission-hardener.d/25_default_sudo.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_selinux.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf' + '/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf' + '/usr/lib/permission-hardener.d/20_user-sysmaint-split.conf' + '/usr/lib/permission-hardener.d/30_ping.conf' + '/usr/lib/permission-hardener.d/30_default.conf' + '/etc/permission-hardener.d/25_default_passwd.conf' + '/etc/permission-hardener.d/25_default_sudo.conf' + '/etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf' + '/etc/permission-hardener.d/25_default_whitelist_chromium.conf' + '/etc/permission-hardener.d/25_default_whitelist_dbus.conf' + '/etc/permission-hardener.d/25_default_whitelist_firejail.conf' + '/etc/permission-hardener.d/25_default_whitelist_fuse.conf' + '/etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf' + '/etc/permission-hardener.d/25_default_whitelist_mount.conf' + '/etc/permission-hardener.d/25_default_whitelist_pam.conf' + '/etc/permission-hardener.d/25_default_whitelist_passwd.conf' + '/etc/permission-hardener.d/25_default_whitelist_policykit.conf' + '/etc/permission-hardener.d/25_default_whitelist_postfix.conf' + '/etc/permission-hardener.d/25_default_whitelist_qubes.conf' + '/etc/permission-hardener.d/25_default_whitelist_selinux.conf' + '/etc/permission-hardener.d/25_default_whitelist_spice.conf' + '/etc/permission-hardener.d/25_default_whitelist_ssh.conf' + '/etc/permission-hardener.d/25_default_whitelist_sudo.conf' + '/etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf' + '/etc/permission-hardener.d/25_default_whitelist_virtualbox.conf' + '/etc/permission-hardener.d/20_user-sysmaint-split.conf' + '/etc/permission-hardener.d/30_ping.conf' + '/etc/permission-hardener.d/30_default.conf' + ) + + pkg_list=( "security-misc-shared" ) + if pkg_installed user-sysmaint-split ; then + pkg_list+=( "user-sysmaint-split" ) + fi + if pkg_installed anon-apps-config ; then + pkg_list+=( "anon-apps-config" ) + fi + + ## This will exit non-zero if some of the packages don't exist, but we + ## don't care. The packages that *are* installed will still be scanned. + modified_pkg_data_str="$(dpkg --verify "${pkg_list[@]}")" || true + + ## Example modified_pkg_data_str: + #modified_pkg_data_str='missing /usr/lib/permission-hardener.d/20_user-sysmaint-split.conf' + + readarray -t custom_hardening_arr < <(awk '/permission-hardener.d/{ print $NF }' <<< "${modified_pkg_data_str}") + + ## If the above `dpkg --verify` command doesn't return any permission-hardener + ## related lines, the array will contain no meaningful info, just a single + ## blank element at the start. Set the array to be explicitly empty in + ## this scenario. + if [ -z "${custom_hardening_arr[0]}" ]; then + custom_hardening_arr=() + fi + + for config_file in \ + /usr/lib/permission-hardener.d/*.conf \ + /etc/permission-hardener.d/*.conf \ + /usr/local/etc/permission-hardener.d/*.conf \ + /etc/permission-hardening.d/*.conf \ + /usr/local/etc/permission-hardening.d/*.conf + do + # shellcheck disable=SC2076 + if ! [[ " ${orig_hardening_arr[*]} " =~ " ${config_file} " ]]; then + if [ -f "${config_file}" ]; then + custom_hardening_arr+=( "${config_file}" ) + fi + fi + done + + if [ "${#custom_hardening_arr[@]}" != '0' ]; then + for custom_config_file in "${custom_hardening_arr[@]}"; do + if ! test -e "${custom_config_file}" ; then + echo "$0: INFO: Possible missing configuration file found: '${custom_config_file}'" + else + echo "$0: INFO: Possible custom configuration file found: '${custom_config_file}'" + fi + done + ## db_input will return code 30 if the message won't be displayed, which + ## causes a non-interactive install to error out if you don't use || true + db_input critical security-misc-shared/alert-on-permission-hardener-v2-upgrade || true + ## db_go can return code 30 too in some instances, we don't care here + # shellcheck disable=SC2119 + db_go || true + fi + + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" +} + +check_migrate_permission_hardener_state + +true "INFO: debhelper beginning here." + +#DEBHELPER# + +true "INFO: Done with debhelper." + +true " +##################################################################### +## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $* +##################################################################### +" + +## Explicitly "exit 0", so eventually trapped errors can be ignored. +exit 0 diff --git a/debian/security-misc-shared.displace b/debian/security-misc-shared.displace new file mode 100644 index 00000000..29bac069 --- /dev/null +++ b/debian/security-misc-shared.displace @@ -0,0 +1,7 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +/etc/securetty.security-misc +/etc/security/faillock.conf.security-misc +/etc/usbguard/usbguard-daemon.conf.security-misc +/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc diff --git a/debian/security-misc.displace-extension b/debian/security-misc-shared.displace-extension similarity index 100% rename from debian/security-misc.displace-extension rename to debian/security-misc-shared.displace-extension diff --git a/debian/security-misc.gconf-defaults b/debian/security-misc-shared.gconf-defaults similarity index 68% rename from debian/security-misc.gconf-defaults rename to debian/security-misc-shared.gconf-defaults index ebfb7f30..b79536a9 100644 --- a/debian/security-misc.gconf-defaults +++ b/debian/security-misc-shared.gconf-defaults @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. /apps/nautilus/preview_sound never diff --git a/debian/security-misc-shared.hide b/debian/security-misc-shared.hide new file mode 100644 index 00000000..7beb77ee --- /dev/null +++ b/debian/security-misc-shared.hide @@ -0,0 +1,6 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Allows users in the 'sudo' group to install Flatpak software without +## authorization. Breaks user/sysmaint separation, thus disabled. +/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules diff --git a/debian/security-misc-shared.install b/debian/security-misc-shared.install new file mode 100755 index 00000000..b141aba2 --- /dev/null +++ b/debian/security-misc-shared.install @@ -0,0 +1,153 @@ +#!/usr/bin/dh-exec + +## Copyright (C) 2020 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file was generated using 'genmkfile debinstfile'. + +etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared => /etc/apparmor.d/tunables/home.d/security-misc +etc/apt/apt.conf.d/40error-on-any#security-misc-shared => /etc/apt/apt.conf.d/40error-on-any +etc/apt/apt.conf.d/40sandbox#security-misc-shared => /etc/apt/apt.conf.d/40sandbox +etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared => /etc/default/grub.d/40_cpu_mitigations.cfg +etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared => /etc/default/grub.d/40_kernel_hardening.cfg +etc/default/grub.d/40_remount_secure.cfg#security-misc-shared => /etc/default/grub.d/40_remount_secure.cfg +etc/default/grub.d/40_signed_modules.cfg#security-misc-shared => /etc/default/grub.d/40_signed_modules.cfg +etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared => /etc/default/grub.d/41_quiet_boot.cfg +etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared => /etc/default/grub.d/41_recovery_restrict.cfg +etc/dracut.conf.d/30-security-misc.conf#security-misc-shared => /etc/dracut.conf.d/30-security-misc.conf +etc/gitconfig#security-misc-shared => /etc/gitconfig +etc/hide-hardware-info.d/30_default.conf#security-misc-shared => /etc/hide-hardware-info.d/30_default.conf +etc/kernel/postinst.d/30_remove-system-map#security-misc-shared => /etc/kernel/postinst.d/30_remove-system-map +etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared => /etc/modprobe.d/30_security-misc_blacklist.conf +etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared => /etc/modprobe.d/30_security-misc_conntrack.conf +etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared => /etc/modprobe.d/30_security-misc_disable.conf +etc/profile.d/30_security-misc.sh#security-misc-shared => /etc/profile.d/30_security-misc.sh +etc/securetty.security-misc#security-misc-shared => /etc/securetty.security-misc +etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared => /etc/security-misc/emerg-shutdown/30_security_misc.conf +etc/security/access-security-misc.conf#security-misc-shared => /etc/security/access-security-misc.conf +etc/security/faillock.conf.security-misc#security-misc-shared => /etc/security/faillock.conf.security-misc +etc/security/limits.d/30_security-misc.conf#security-misc-shared => /etc/security/limits.d/30_security-misc.conf +etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared => /etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml +etc/skel/.gnupg/gpg.conf#security-misc-shared => /etc/skel/.gnupg/gpg.conf +etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared => /etc/ssh/ssh_config.d/30_security-misc.conf +etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared => /etc/ssh/sshd_config.d/30_security-misc.conf +etc/sudoers.d/security-misc#security-misc-shared => /etc/sudoers.d/security-misc +etc/systemd/system/emergency.service.d/override.conf#security-misc-shared => /etc/systemd/system/emergency.service.d/override.conf +etc/systemd/system/rescue.service.d/override.conf#security-misc-shared => /etc/systemd/system/rescue.service.d/override.conf +etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared => /etc/usbguard/IPCAccessControl.d/:qubes +etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared => /etc/usbguard/IPCAccessControl.d/:sudo +etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared => /etc/usbguard/rules.d/30_security-misc.conf +etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared => /etc/usbguard/usbguard-daemon.conf.security-misc +usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared => /usr/bin/disabled-bluetooth-by-security-misc +usr/bin/disabled-cdrom-by-security-misc#security-misc-shared => /usr/bin/disabled-cdrom-by-security-misc +usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared => /usr/bin/disabled-cpumsr-by-security-misc +usr/bin/disabled-filesys-by-security-misc#security-misc-shared => /usr/bin/disabled-filesys-by-security-misc +usr/bin/disabled-firewire-by-security-misc#security-misc-shared => /usr/bin/disabled-firewire-by-security-misc +usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared => /usr/bin/disabled-framebuffer-by-security-misc +usr/bin/disabled-gps-by-security-misc#security-misc-shared => /usr/bin/disabled-gps-by-security-misc +usr/bin/disabled-intelme-by-security-misc#security-misc-shared => /usr/bin/disabled-intelme-by-security-misc +usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared => /usr/bin/disabled-intelpmt-by-security-misc +usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared => /usr/bin/disabled-miscellaneous-by-security-misc +usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared => /usr/bin/disabled-netfilesys-by-security-misc +usr/bin/disabled-network-by-security-misc#security-misc-shared => /usr/bin/disabled-network-by-security-misc +usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared => /usr/bin/disabled-thunderbolt-by-security-misc +usr/bin/fm-shim-frontend#security-misc-shared => /usr/bin/fm-shim-frontend +usr/bin/permission-hardener#security-misc-shared => /usr/bin/permission-hardener +usr/bin/remount-secure#security-misc-shared => /usr/bin/remount-secure +usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared => /usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh +usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared => /usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh +usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared => /usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh +usr/lib/issue.d/20_security-misc.issue#security-misc-shared => /usr/lib/issue.d/20_security-misc.issue +usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared => /usr/lib/modules-load.d/30_security-misc.conf +usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf +usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf +usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf +usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf +usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf +usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf +usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_mount.conf +usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_pam.conf +usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf +usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf +usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf +usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf +usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_spice.conf +usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf +usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf +usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf +usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared => /usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf +usr/lib/permission-hardener.d/30_default.conf#security-misc-shared => /usr/lib/permission-hardener.d/30_default.conf +usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py#security-misc-shared => /usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py +usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared => /usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py +usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared => /usr/lib/sysctl.d/30_security-misc_kexec-disable.conf +usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared => /usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf +usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared => /usr/lib/sysctl.d/30_silent-kernel-printk.conf +usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared => /usr/lib/sysctl.d/990-security-misc.conf +usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/coredump.conf.d/30_security-misc.conf +usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/journald.conf.d/30_security-misc.conf +usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/pstore.conf.d/30_security-misc.conf +usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared => /usr/lib/systemd/system-preset/50-security-misc.preset +usr/lib/systemd/system/block-shutdown.service#security-misc-shared => /usr/lib/systemd/system/block-shutdown.service +usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared => /usr/lib/systemd/system/emerg-shutdown.service +usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared => /usr/lib/systemd/system/ensure-shutdown-trigger.service +usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared => /usr/lib/systemd/system/ensure-shutdown.service +usr/lib/systemd/system/harden-module-loading.service#security-misc-shared => /usr/lib/systemd/system/harden-module-loading.service +usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/system/haveged.service.d/30_security-misc.conf +usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared => /usr/lib/systemd/system/hide-hardware-info.service +usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared => /usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service +usr/lib/systemd/system/panic-on-oops.service#security-misc-shared => /usr/lib/systemd/system/panic-on-oops.service +usr/lib/systemd/system/permission-hardener.service#security-misc-shared => /usr/lib/systemd/system/permission-hardener.service +usr/lib/systemd/system/proc-hidepid.service#security-misc-shared => /usr/lib/systemd/system/proc-hidepid.service +usr/lib/systemd/system/remount-secure.service#security-misc-shared => /usr/lib/systemd/system/remount-secure.service +usr/lib/systemd/system/remove-system-map.service#security-misc-shared => /usr/lib/systemd/system/remove-system-map.service +usr/lib/systemd/system/sysinit-post.target#security-misc-shared => /usr/lib/systemd/system/sysinit-post.target +usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf +usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared => /usr/lib/systemd/system/user@.service.d/sysfs.conf +usr/lib/systemd/user/fm-shim.service#security-misc-shared => /usr/lib/systemd/user/fm-shim.service +usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf +usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared => /usr/lib/udev/rules.d/95-emerg-shutdown.rules +usr/libexec/security-misc/askpass#security-misc-shared => /usr/libexec/security-misc/askpass +usr/libexec/security-misc/block-unsafe-logins#security-misc-shared => /usr/libexec/security-misc/block-unsafe-logins +usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared => /usr/libexec/security-misc/build-emerg-shutdown +usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared => /usr/libexec/security-misc/build-fm-shim-backend +usr/libexec/security-misc/check-for-usb-controller#security-misc-shared => /usr/libexec/security-misc/check-for-usb-controller +usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared => /usr/libexec/security-misc/compile-emerg-shutdown +usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared => /usr/libexec/security-misc/compile-fm-shim-backend +usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared => /usr/libexec/security-misc/disable-kernel-module-loading +usr/libexec/security-misc/echo-path#security-misc-shared => /usr/libexec/security-misc/echo-path +usr/libexec/security-misc/emerg-shutdown#security-misc-shared => /usr/libexec/security-misc/emerg-shutdown +usr/libexec/security-misc/ensure-shutdown#security-misc-shared => /usr/libexec/security-misc/ensure-shutdown +usr/libexec/security-misc/hide-hardware-info#security-misc-shared => /usr/libexec/security-misc/hide-hardware-info +usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared => /usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown +usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared => /usr/libexec/security-misc/mmap-rnd-bits +usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared => /usr/libexec/security-misc/pam-abort-on-locked-password +usr/libexec/security-misc/pam-info#security-misc-shared => /usr/libexec/security-misc/pam-info +usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared => /usr/libexec/security-misc/pam_faillock_not_if_x +usr/libexec/security-misc/pam_only_if_login#security-misc-shared => /usr/libexec/security-misc/pam_only_if_login +usr/libexec/security-misc/pam_only_if_su#security-misc-shared => /usr/libexec/security-misc/pam_only_if_su +usr/libexec/security-misc/panic-on-oops#security-misc-shared => /usr/libexec/security-misc/panic-on-oops +usr/libexec/security-misc/permission-lockdown#security-misc-shared => /usr/libexec/security-misc/permission-lockdown +usr/libexec/security-misc/remove-system.map#security-misc-shared => /usr/libexec/security-misc/remove-system.map +usr/libexec/security-misc/virusforget#security-misc-shared => /usr/libexec/security-misc/virusforget +usr/share/doc/security-misc/fstab-vm#security-misc-shared => /usr/share/doc/security-misc/fstab-vm +usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared => /usr/share/glib-2.0/schemas/30_security-misc.gschema.override +usr/share/lintian/overrides/security-misc-shared#security-misc-shared => /usr/share/lintian/overrides/security-misc-shared +usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared => /usr/share/pam-configs/block-unsafe-logins-security-misc +usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared => /usr/share/pam-configs/console-lockdown-security-misc +usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared => /usr/share/pam-configs/faillock-preauth-security-misc +usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared => /usr/share/pam-configs/mkhomedir-security-misc +usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared => /usr/share/pam-configs/pam-abort-on-locked-password-security-misc +usr/share/pam-configs/umask-security-misc#security-misc-shared => /usr/share/pam-configs/umask-security-misc +usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared => /usr/share/pam-configs/unix-faillock-security-misc +usr/share/pam-configs/wheel-security-misc#security-misc-shared => /usr/share/pam-configs/wheel-security-misc +usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared => /usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc +usr/share/security-misc/dolphinrc#security-misc-shared => /usr/share/security-misc/dolphinrc +usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared => /usr/share/security-misc/emerg-shutdown-initramfs.service +usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared => /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf +usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared => /usr/share/security-misc/lkrg/lkrg-virtualbox +usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared => /usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded +usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared => /usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded +usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared => /usr/share/security-misc/security-misc-memlockd.cfg +usr/src/security-misc/emerg-shutdown.c#security-misc-shared => /usr/src/security-misc/emerg-shutdown.c +usr/src/security-misc/fm-shim-backend.c#security-misc-shared => /usr/src/security-misc/fm-shim-backend.c +var/cache/security-misc/state-files/placeholder#security-misc-shared => /var/cache/security-misc/state-files/placeholder diff --git a/debian/security-misc.links b/debian/security-misc-shared.links similarity index 72% rename from debian/security-misc.links rename to debian/security-misc-shared.links index 467193f6..c3369df2 100644 --- a/debian/security-misc.links +++ b/debian/security-misc-shared.links @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. /etc/profile.d/30_security-misc.sh /etc/zprofile.d/30_security-misc.zsh diff --git a/debian/security-misc.maintscript b/debian/security-misc-shared.maintscript similarity index 68% rename from debian/security-misc.maintscript rename to debian/security-misc-shared.maintscript index b875fd4d..f1c61145 100644 --- a/debian/security-misc.maintscript +++ b/debian/security-misc-shared.maintscript @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. rm_conffile /etc/sudoers.d/umask-security-misc @@ -6,7 +6,7 @@ rm_conffile /etc/sudoers.d/umask-security-misc ## https://forums.whonix.org/t/sysrq-magic-sysrq-key/8079 rm_conffile /etc/sysctl.d/sysrq.conf -## https://github.com/Whonix/security-misc/pull/45 +## https://github.com/Kicksecure/security-misc/pull/45 rm_conffile /etc/apparmor.d/usr.lib.security-misc.pam_tally2-info rm_conffile /etc/apparmor.d/usr.lib.security-misc.permission-lockdown @@ -68,6 +68,28 @@ rm_conffile /etc/permission-hardening.d/25_default_whitelist_unix_chkpwd.conf rm_conffile /etc/permission-hardening.d/25_default_whitelist_virtualbox.conf rm_conffile /etc/permission-hardening.d/30_default.conf +## moved to /usr/lib/permission-hardener.d +rm_conffile /etc/permission-hardener.d/25_default_passwd.conf +rm_conffile /etc/permission-hardener.d/25_default_sudo.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_chromium.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_dbus.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_firejail.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_fuse.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_mount.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_pam.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_policykit.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_postfix.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_qubes.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_selinux.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_spice.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_ssh.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_sudo.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf +rm_conffile /etc/permission-hardener.d/25_default_whitelist_virtualbox.conf +rm_conffile /etc/permission-hardener.d/30_default.conf + ## merged into 1 file /etc/default/grub.d/40_kernel_hardening.cfg rm_conffile /etc/default/grub.d/40_distrust_bootloader.cfg rm_conffile /etc/default/grub.d/40_distrust_cpu.cfg @@ -81,3 +103,9 @@ rm_conffile /etc/default/grub.d/40_only_allow_signed_modules.cfg ## renamed to /etc/default/grub.d/41_quiet_boot.cfg rm_conffile /etc/default/grub.d/41_quiet.cfg + +## moved to usability-misc +rm_conffile /etc/dkms/framework.conf.d/30_security-misc.conf + +## renamed to reflect the fact that this uses a whitelist +rm_conffile /usr/lib/permission-hardener.d/25_default_passwd.conf diff --git a/debian/security-misc-shared.postinst b/debian/security-misc-shared.postinst new file mode 100755 index 00000000..0b1567c7 --- /dev/null +++ b/debian/security-misc-shared.postinst @@ -0,0 +1,231 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## style-ok: no-has - has.bsh isn't reliably available in maintainer scripts +## style-ok: no-strict - full strict block could leak into APT/debconf + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + source /usr/libexec/helper-scripts/pre.bsh +fi + +## Required since this package uses debconf - this is mandatory even though +## the postinst itself does not use debconf commands. +source /usr/share/debconf/confmodule + +set -o errexit + +true " +##################################################################### +## INFO: BEGIN: ${DPKG_MAINTSCRIPT_PACKAGE} ${DPKG_MAINTSCRIPT_NAME} $* +##################################################################### +" + +permission_hardening_legacy_config_folder() { + if ! test -d /etc/permission-hardening.d ; then + return 0 + fi + rmdir --verbose --ignore-fail-on-non-empty /etc/permission-hardening.d || true +} + +permission_hardening() { + printf '%s\n' "Running SUID Disabler and Permission Hardener... See also:" + printf '%s\n' "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener" + printf '%s\n' "$0: INFO: running: permission-hardener enable" + ## By design: report error but return 0 to avoid breaking APT. + ## A failing postinst would leave the package in a broken state. + if ! permission-hardener enable ; then + printf '%s\n' "$0: ERROR: Permission hardening failed." >&2 + return 0 + fi + printf '%s\n' "$0: INFO: Permission hardening success." +} + +fix_pkexec_remembered_permissions() { + if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" ]; then + return 0 + fi + mkdir --parents '/var/lib/security-misc/do_once' + + if ! [ -f "/var/lib/permission-hardener-v2/existing_mode/statoverride" ]; then + ## 'statoverride' file does not exist yet. Therefore no need to fix it using 'str_replace'. + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" + return 0 + fi + + ## The existing_mode database may incorrectly list the original permissions + ## of pkexec as '755'. They should be '4755'. Fix this with str_replace. If + ## this issue is not present, str_replace will do nothing. + str_replace 'root root 755 /usr/bin/pkexec' \ + 'root root 4755 /usr/bin/pkexec' \ + /var/lib/permission-hardener-v2/existing_mode/statoverride + + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" +} + +install_permission_hardener_base_state() { + local state_str + + if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" ]; then + return 0 + fi + mkdir --parents '/var/lib/security-misc/do_once' + + if [ -f "/var/lib/permission-hardener-v2/existing_mode/statoverride" ]; then + ## 'statoverride' file already exists. Therefore no need to pre-populate it. + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" + return 0 + fi + + mkdir --parents -- '/var/lib/permission-hardener-v2/existing_mode' + state_str="root root 644 /etc/passwd- +root root 755 /etc/cron.monthly +root root 755 /etc/sudoers.d +root shadow 2755 /usr/bin/expiry +root root 4755 /usr/bin/umount +root root 4755 /usr/bin/gpasswd +root root 755 /usr/lib/modules +root root 644 /etc/issue.net +root root 644 /etc/group- +root root 4755 /usr/bin/newgrp +root root 755 /etc/cron.weekly +root root 4755 /usr/lib/polkit-1/polkit-agent-helper-1 +root root 644 /etc/hosts.deny +root root 4755 /usr/bin/newgidmap +root root 644 /etc/issue.kicksecure +root root 4755 /usr/bin/pkexec +root root 4755 /usr/bin/su +root root 644 /etc/hosts.allow +root root 700 /root +root root 755 /etc/cron.daily +root root 644 /etc/motd +root root 4755 /usr/bin/newuidmap +root root 755 /boot +root root 755 /home +root shadow 2755 /usr/bin/chage +root root 4755 /usr/lib/openssh/ssh-keysign +root root 4755 /usr/bin/ntfs-3g +root root 4755 /usr/bin/chsh +root root 644 /etc/motd.kicksecure +root root 755 /usr/bin/su-to-root +root root 4755 /usr/bin/passwd +root root 4755 /usr/bin/chfn +root root 644 /etc/group +root root 4755 /usr/bin/sudo +root root 644 /etc/passwd +root root 755 /usr/src +root root 4755 /usr/bin/mount +root root 644 /etc/issue +root root 755 /etc/cron.d" + + printf '%s\n' "${state_str}" | tee /var/lib/permission-hardener-v2/existing_mode/statoverride + + touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_1" +} + +build_fm_shim_backend() { + /usr/libexec/security-misc/build-fm-shim-backend +} + +build_emerg_shutdown() { + /usr/libexec/security-misc/build-emerg-shutdown +} + +case "$1" in + configure) + if [ -d /etc/skel/.gnupg ]; then + ## Lintian warns against use of chmod --recursive. + chmod 700 /etc/skel/.gnupg + fi + + ## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override + glib-compile-schemas /usr/share/glib-2.0/schemas || true + + ## state dir for PAM 'faillock' + mkdir -p /var/lib/security-misc/faillock + + ## Fix pkexec remembered permissions if necessary. + fix_pkexec_remembered_permissions + + ## Pre-populate permission-hardener state on first postinst run. + ## Necessary because the first permission-hardener run may occur + ## before all permissions are set properly by package postinst + ## scripts. In particular, pkexec is not SUID-root until after its + ## postinst runs. + install_permission_hardener_base_state + + ## Fix usbguard config permissions, this seemingly can't be done + ## during the unpack stage + usbguard_config_file_list=( + '/etc/usbguard/rules.d/30_security-misc.conf' + '/etc/usbguard/usbguard-daemon.conf.security-misc' + '/etc/usbguard/IPCAccessControl.d/:sudo' + '/etc/usbguard/IPCAccessControl.d/:qubes' + ) + for usbguard_config_file in "${usbguard_config_file_list[@]}"; do + if test -f "${usbguard_config_file}"; then + chmod 0600 "${usbguard_config_file}" + fi + done + + ## Build the org.freedesktop.FileManager1 shim backend. + build_fm_shim_backend + + ## Pre-compile emerg-shutdown. + build_emerg_shutdown + ;; + + abort-upgrade|abort-remove|abort-deconfigure) + ;; + + triggered) + printf '%s\n' "INFO: triggered ${DPKG_MAINTSCRIPT_PACKAGE}: '${DPKG_MAINTSCRIPT_PACKAGE}' ${DPKG_MAINTSCRIPT_PACKAGE} DPKG_MAINTSCRIPT_NAME: '${DPKG_MAINTSCRIPT_NAME}' $\*: '$*' 2: '$2'" + /usr/share/security-misc/lkrg/lkrg-virtualbox || true + /usr/libexec/security-misc/mmap-rnd-bits || true + permission_hardening + exit 0 + ;; + + *) + printf '%s\n' "${DPKG_MAINTSCRIPT_NAME} called with unknown argument \`$1'" >&2 + exit 1 + ;; +esac + +pam-auth-update --package + +/usr/libexec/security-misc/permission-lockdown + +permission_hardening + +## https://phabricator.whonix.org/T377 +## Debian has no update-grub trigger yet: +## https://bugs.debian.org/481542 +if command -v update-grub >/dev/null 2>&1; then + update-grub || \ + printf '%s\n' "${DPKG_MAINTSCRIPT_PACKAGE} ${DPKG_MAINTSCRIPT_NAME} ERROR: Running \ +'update-grub' failed with exit code $?. ${DPKG_MAINTSCRIPT_PACKAGE} is most \ +likely only the trigger, not the cause. Unless you know this is not an issue, \ +you should fix running 'update-grub', otherwise your system might no longer \ +boot." >&2 +fi + +/usr/libexec/security-misc/mmap-rnd-bits || true + +true "INFO: debhelper beginning here." + +#DEBHELPER# + +true "INFO: Done with debhelper." + +permission_hardening_legacy_config_folder + +true " +##################################################################### +## INFO: END : ${DPKG_MAINTSCRIPT_PACKAGE} ${DPKG_MAINTSCRIPT_NAME} $* +##################################################################### +" + +## Explicitly "exit 0", so eventually trapped errors can be ignored. +exit 0 diff --git a/debian/security-misc.postrm b/debian/security-misc-shared.postrm old mode 100644 new mode 100755 similarity index 85% rename from debian/security-misc.postrm rename to debian/security-misc-shared.postrm index d4745478..0be096ef --- a/debian/security-misc.postrm +++ b/debian/security-misc-shared.postrm @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then @@ -16,7 +16,9 @@ true " " ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/11 -pam-auth-update --package --remove "$DPKG_MAINTSCRIPT_PACKAGE" +if command -v pam-auth-update >/dev/null 2>&1; then + pam-auth-update --package +fi rm -f /etc/sysctl.d/30_security-misc_aslr-mmap.conf diff --git a/debian/security-misc.preinst b/debian/security-misc-shared.preinst old mode 100644 new mode 100755 similarity index 50% rename from debian/security-misc.preinst rename to debian/security-misc-shared.preinst index f10ff110..43a07ff6 --- a/debian/security-misc.preinst +++ b/debian/security-misc-shared.preinst @@ -1,17 +1,24 @@ #!/bin/bash -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. -if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then - source /usr/libexec/helper-scripts/pre.bsh -fi +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C -set -e +## helper-scripts is a Pre-Depends. +source /usr/libexec/helper-scripts/pre.bsh +source /usr/libexec/helper-scripts/has.bsh +source /usr/libexec/helper-scripts/accountctl.sh true " ##################################################################### -## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ +## INFO: BEGIN: ${DPKG_MAINTSCRIPT_PACKAGE:-} ${DPKG_MAINTSCRIPT_NAME:-} $* ##################################################################### " @@ -23,6 +30,14 @@ user_groups_modifications() { ## /usr/lib/systemd/system/proc-hidepid.service addgroup --system proc + ## Avoid 'debian/control' file 'Depends:' 'sudo'. + ## + ## Could use '/usr/libexec/helper-scripts/user_create.bsh' in preinst? Looks more complex. Avoided. + ## group 'sudo' is not a system group. + #addgroup --system sudo + ## Function 'is_group' is complex. Hence, use '2>/dev/null || true'. + addgroup sudo 2>/dev/null || true + ## group 'sudo' membership required to use 'su' ## /usr/share/pam-configs/wheel-security-misc adduser root sudo @@ -47,71 +62,48 @@ user_groups_modifications() { ## an "empty" /etc/securetty. ## In case a system administrator edits /etc/securetty, there is no need to ## block for this to be still blocked by console lockdown. See also: - ## https://www.whonix.org/wiki/Root#Root_Login + ## https://www.kicksecure.com/wiki/Root#Root_Login adduser root console } output_skip_checks() { - echo "security-misc '$0' INFO: Allow installation of security-misc anyway." >&2 - echo "security-misc '$0' INFO: (technical reason: $@)" >&2 - echo "security-misc '$0' INFO: If this is a chroot this is probably OK." >&2 - echo "security-misc '$0' INFO: Otherwise you might not be able to login." >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: Allow installation of security-misc-shared anyway." >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: (technical reason: $*)" >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: If this is a chroot this is probably OK." >&2 + printf '%s\n' "security-misc-shared '${0}' INFO: Otherwise you might not be able to login." >&2 } sudo_users_check () { - if command -v "qubesdb-read" &>/dev/null; then + if has qubesdb-read; then ## Qubes users can use dom0 to get a root terminal emulator. ## For example: ## qvm-run -u root debian-10 xterm return 0 fi - local sudo_users user_with_sudo are_there_any_sudo_users OLD_IFS - - sudo_users="$(getent group sudo | cut -d: -f4)" - ## example sudo_users: - ## user,root - - OLD_IFS="$IFS" - IFS="," - export IFS - - for user_with_sudo in $sudo_users ; do - if [ "$user_with_sudo" = "root" ]; then - ## root login is also restricted. - ## Therefore user "root" being member of group "sudo" is - ## considered insufficient. - continue - fi - are_there_any_sudo_users=yes - break - done - - IFS="$OLD_IFS" - export IFS - - if [ "$are_there_any_sudo_users" = "yes" ]; then + if group_has_nonroot_member sudo; then return 0 fi ## Prevent users from locking themselves out. ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 - echo "$0: ERROR: No user is a member of group 'sudo'. Installation aborted." >&2 - echo "$0: ERROR: You probably want to run:" >&2 - echo "$0: NOTE: Replace user 'user' with your actual Linux user account name." >&2 - echo "" >&2 - echo "sudo adduser user sudo" >&2 - echo "sudo adduser user console" >&2 - echo "" >&2 - echo "$0: ERROR: See also installation instructions:" >&2 - echo "https://www.kicksecure.com/wiki/security-misc#install" >&2 - - if [ "$SECURITY_MISC_INSTALL" = "force" ]; then + printf '%s\n' "${0}: ERROR: No account is a member of group 'sudo'. Installation aborted." >&2 + printf '%s\n' "${0}: ERROR: You probably want to run:" >&2 + printf '%s\n' "${0}: NOTE: Replace account 'user' with your actual Linux user account name." >&2 + printf '%s\n' "" >&2 + printf '%s\n' "sudo adduser user sudo" >&2 + printf '%s\n' "sudo adduser user console" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "${0}: ERROR: See also installation instructions:" >&2 + printf '%s\n' "https://www.kicksecure.com/wiki/security-misc#install" >&2 + + if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'." return 0 fi - if test -f "/var/lib/security-misc/skip_install_check" ; then - output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists." + if test -f "/var/lib/security-misc/skip_install_check" \ + || [ "${dist_build_iso:-}" = "true" ] ; then + output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists or this is an ISO/live build (dist_build_iso=true)." return 0 fi @@ -119,64 +111,42 @@ sudo_users_check () { } console_users_check() { - if [ "$SECURITY_MISC_INSTALL" = "force" ]; then + if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then return 0 fi - if test -f "/var/lib/security-misc/skip_install_check" ; then + if test -f "/var/lib/security-misc/skip_install_check" \ + || [ "${dist_build_iso:-}" = "true" ] ; then return 0 fi - if command -v "qubesdb-read" &>/dev/null; then + if has qubesdb-read; then ## Qubes users can use dom0 to get a root terminal emulator. ## For example: ## qvm-run -u root debian-10 xterm return 0 fi - local console_users console_unrestricted_users user_with_console are_there_any_console_users OLD_IFS - - console_users="$(getent group console | cut -d: -f4)" - ## example console_users: - ## user - console_unrestricted_users="$(getent group console-unrestricted | cut -d: -f4)" - - OLD_IFS="$IFS" - IFS="," - export IFS - - for user_with_console in $console_users $console_unrestricted_users ; do - if [ "$user_with_console" = "root" ]; then - ## root login is also restricted. - ## Therefore user "root" being member of group "console" is - ## considered insufficient. - continue - fi - are_there_any_console_users=yes - break - done - - IFS="$OLD_IFS" - export IFS - ## Prevent users from locking themselves out. ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4 - if [ "$are_there_any_console_users" = "yes" ]; then + if group_has_nonroot_member console \ + || group_has_nonroot_member console-unrestricted; then return 0 fi - echo "$0: ERROR: No user is a member of group 'console'. Installation aborted." >&2 - echo "$0: ERROR: You probably want to run:" >&2 - echo "" >&2 - echo "sudo adduser user console" >&2 - echo "" >&2 - echo "$0: ERROR: See also installation instructions:" >&2 - echo "https://www.whonix.org/wiki/security-misc#install" >&2 + printf '%s\n' "${0}: ERROR: No account is a member of group 'console'. Installation aborted." >&2 + printf '%s\n' "${0}: ERROR: You probably want to run:" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "sudo adduser user console" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "${0}: ERROR: See also installation instructions:" >&2 + printf '%s\n' "https://www.whonix.org/wiki/security-misc#install" >&2 - if [ "$SECURITY_MISC_INSTALL" = "force" ]; then + if [ "${SECURITY_MISC_INSTALL:-}" = "force" ]; then output_skip_checks "Environment variable SECURITY_MISC_INSTALL is set to 'force'." return 0 fi - if test -f "/var/lib/security-misc/skip_install_check" ; then - output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists." + if test -f "/var/lib/security-misc/skip_install_check" \ + || [ "${dist_build_iso:-}" = "true" ] ; then + output_skip_checks "File '/var/lib/security-misc/skip_install_check' exists or this is an ISO/live build (dist_build_iso=true)." return 0 fi @@ -184,7 +154,7 @@ console_users_check() { } legacy() { - if [ -f "/var/lib/legacy/do_once/${FUNCNAME}_version_1" ]; then + if [ -f "/var/lib/legacy/do_once/${FUNCNAME[0]}_version_1" ]; then return 0 fi @@ -197,11 +167,11 @@ legacy() { continue_yes=true fi - if [ ! "$continue_yes" = "true" ]; then + if [ ! "${continue_yes:-}" = "true" ]; then return 0 fi - if command -v "qubesdb-read" &>/dev/null; then + if has qubesdb-read; then ## Qubes users can use dom0 to get a root terminal emulator. ## For example: ## qvm-run -u root debian-10 xterm @@ -212,23 +182,23 @@ legacy() { user_to_be_created=user - if ! id "$user_to_be_created" &>/dev/null ; then - true "INFO: user '$user_to_be_created' does not exist. Skipping adduser console and pam-auth-update." + if ! id "${user_to_be_created}" &>/dev/null ; then + true "INFO: Account '${user_to_be_created}' does not exist. Skipping adding account '${user_to_be_created}' to group 'console' and also skipping 'pam-auth-update --enable console-lockdown-security-misc'." return 0 fi - adduser "$user_to_be_created" console + adduser "${user_to_be_created}" console pam-auth-update --enable console-lockdown-security-misc mkdir --parents "/var/lib/legacy/do_once" - touch "/var/lib/legacy/do_once/${FUNCNAME}_version_1" + touch "/var/lib/legacy/do_once/${FUNCNAME[0]}_version_1" } user_groups_modifications legacy -if [ "$1" = "install" ] || [ "$1" = "upgrade" ]; then +if [ "${1:-}" = "install" ] || [ "${1:-}" = "upgrade" ]; then sudo_users_check console_users_check fi @@ -241,7 +211,7 @@ true "INFO: Done with debhelper." true " ##################################################################### -## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ +## INFO: END : ${DPKG_MAINTSCRIPT_PACKAGE:-} ${DPKG_MAINTSCRIPT_NAME:-} $* ##################################################################### " diff --git a/debian/security-misc.prerm b/debian/security-misc-shared.prerm old mode 100644 new mode 100755 similarity index 60% rename from debian/security-misc.prerm rename to debian/security-misc-shared.prerm index b1f7db33..a4106c3e --- a/debian/security-misc.prerm +++ b/debian/security-misc-shared.prerm @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then @@ -16,7 +16,17 @@ true " " if [ "$1" = remove ]; then - pam-auth-update --package --remove "$DPKG_MAINTSCRIPT_PACKAGE" + ## REMINDER: This list of policies must be kept in sync with the contents of + ## usr/share/pam-configs. + pam-auth-update --package --remove \ + block-unsafe-logins-security-misc \ + console-lockdown-security-misc \ + faillock-preauth-security-misc \ + mkhomedir-security-misc \ + pam-abort-on-locked-password-security-misc \ + umask-security-misc \ + unix-faillock-security-misc \ + wheel-security-misc fi true "INFO: debhelper beginning here." diff --git a/debian/security-misc-shared.templates b/debian/security-misc-shared.templates new file mode 100644 index 00000000..d45dfa17 --- /dev/null +++ b/debian/security-misc-shared.templates @@ -0,0 +1,9 @@ +Template: security-misc-shared/alert-on-permission-hardener-v2-upgrade +Type: note +_Description: Manual intervention may be required for permission-hardener update + No need to panic. Nothing is broken. A rare condition has been encountered. + permission-hardener is being updated to fix a minor bug that caused + corruption in the permission-hardener state file. If you installed your own + custom permission-hardener configuration, some manual intervention may be + required. See: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#fixing_state_files diff --git a/debian/security-misc-shared.triggers b/debian/security-misc-shared.triggers new file mode 100644 index 00000000..1f4a5921 --- /dev/null +++ b/debian/security-misc-shared.triggers @@ -0,0 +1,16 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## use noawait +## https://github.com/Kicksecure/security-misc/issues/196 + +## Trigger permission hardener when new binaries are being installed. +interest-noawait /usr +interest-noawait /opt + +## Trigger permission hardener when new configuration files are being installed. +interest-noawait /usr/lib/permission-hardener.d +interest-noawait /etc/permission-hardener.d +interest-noawait /usr/local/etc/permission-hardener.d +interest-noawait /etc/permission-hardening.d +interest-noawait /usr/local/etc/permission-hardening.d diff --git a/debian/security-misc.undisplace b/debian/security-misc-shared.undisplace similarity index 66% rename from debian/security-misc.undisplace rename to debian/security-misc-shared.undisplace index 6db93547..990101a0 100644 --- a/debian/security-misc.undisplace +++ b/debian/security-misc-shared.undisplace @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. /etc/login.defs.security-misc diff --git a/debian/security-misc.displace b/debian/security-misc.displace deleted file mode 100644 index 29392d5c..00000000 --- a/debian/security-misc.displace +++ /dev/null @@ -1,5 +0,0 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -/etc/securetty.security-misc -/etc/security/faillock.conf.security-misc diff --git a/debian/security-misc.install b/debian/security-misc.install deleted file mode 100644 index 51e61ce3..00000000 --- a/debian/security-misc.install +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2020 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## This file was generated using 'genmkfile debinstfile'. - -etc/* -usr/* -var/* diff --git a/debian/security-misc.postinst b/debian/security-misc.postinst deleted file mode 100644 index e2327784..00000000 --- a/debian/security-misc.postinst +++ /dev/null @@ -1,110 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then - source /usr/libexec/helper-scripts/pre.bsh -fi - -set -e - -true " -##################################################################### -## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -permission_hardening_legacy_state_files() { - if test -d /var/lib/permission-hardener ; then - return 0 - fi - if ! test -d /var/lib/permission-hardening ; then - return 0 - fi - mv --verbose /var/lib/permission-hardening /var/lib/permission-hardener -} - -permission_hardening_legacy_config_folder() { - if ! test -d /etc/permission-hardening.d ; then - return 0 - fi - rmdir --verbose --ignore-fail-on-non-empty /etc/permission-hardening.d || true -} - -permission_hardening() { - echo "Running SUID Disabler and Permission Hardener... See also:" - echo "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener" - echo "$0: INFO: running: permission-hardener enable" - if ! permission-hardener enable ; then - echo "$0: ERROR: Permission hardening failed." >&2 - return 0 - fi - echo "$0: INFO: Permission hardening success." -} - -case "$1" in - configure) - if [ -d /etc/skel/.gnupg ]; then - ## Lintian warns against use of chmod --recursive. - chmod 700 /etc/skel/.gnupg - fi - - ## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override - glib-compile-schemas /usr/share/glib-2.0/schemas || true - ;; - - abort-upgrade|abort-remove|abort-deconfigure) - ;; - - triggered) - echo "INFO: triggered $DPKG_MAINTSCRIPT_PACKAGE: '$DPKG_MAINTSCRIPT_PACKAGE' $DPKG_MAINTSCRIPT_PACKAGE DPKG_MAINTSCRIPT_NAME: '$DPKG_MAINTSCRIPT_NAME' $\@: '$@' 2: '$2'" - /usr/share/security-misc/lkrg/lkrg-virtualbox || true - /usr/libexec/security-misc/mmap-rnd-bits || true - permission_hardening - exit 0 - ;; - - *) - echo "$DPKG_MAINTSCRIPT_NAME called with unknown argument \`$1'" >&2 - exit 1 - ;; -esac - -pam-auth-update --package - -/usr/libexec/security-misc/permission-lockdown -permission_hardening_legacy_state_files - -permission_hardening - -## https://phabricator.whonix.org/T377 -## Debian has no update-grub trigger yet: -## https://bugs.debian.org/481542 -if command -v update-grub >/dev/null 2>&1; then - update-grub || \ - echo "$DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME ERROR: Running \ -'update-grub' failed with exit code $?. $DPKG_MAINTSCRIPT_PACKAGE is most \ -likely only the trigger, not the cause. Unless you know this is not an issue, \ -you should fix running 'update-grub', otherwise your system might no longer \ -boot." >&2 -fi - -/usr/libexec/security-misc/mmap-rnd-bits || true - -true "INFO: debhelper beginning here." - -#DEBHELPER# - -true "INFO: Done with debhelper." - -permission_hardening_legacy_config_folder - -true " -##################################################################### -## INFO: END : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@ -##################################################################### -" - -## Explicitly "exit 0", so eventually trapped errors can be ignored. -exit 0 diff --git a/debian/security-misc.triggers b/debian/security-misc.triggers deleted file mode 100644 index f4250764..00000000 --- a/debian/security-misc.triggers +++ /dev/null @@ -1,6 +0,0 @@ -## Copyright (C) 2024 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://github.com/Kicksecure/security-misc/issues/196 -interest-noawait /usr -interest-noawait /opt diff --git a/debian/watch b/debian/watch index e38736e5..ea85f6bb 100644 --- a/debian/watch +++ b/debian/watch @@ -1,6 +1,6 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. version=4 opts=filenamemangle=s/.+\/v?(\d\S+)\.tar\.gz/security-misc-$1\.tar\.gz/ \ - https://github.com/Whonix/security-misc/tags .*/v?(\d\S+)\.tar\.gz + https://github.com/Kicksecure/security-misc/tags .*/v?(\d\S+)\.tar\.gz diff --git a/etc/apparmor.d/tunables/home.d/security-misc b/etc/apparmor.d/tunables/home.d/security-misc deleted file mode 100644 index 5256089b..00000000 --- a/etc/apparmor.d/tunables/home.d/security-misc +++ /dev/null @@ -1,7 +0,0 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -alias /etc/pam.d/common-session -> /etc/pam.d/common-session.security-misc, -alias /etc/pam.d/common-session-noninteractive -> /etc/pam.d/common-session-noninteractive.security-misc, -alias /etc/login.defs -> /etc/login.defs.security-misc, -alias /etc/securetty -> /etc/securetty.security-misc, diff --git a/etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared b/etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared new file mode 100644 index 00000000..b8b97362 --- /dev/null +++ b/etc/apparmor.d/tunables/home.d/security-misc#security-misc-shared @@ -0,0 +1,4 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +alias /etc/securetty -> /etc/securetty.security-misc, diff --git a/etc/apt/apt.conf.d/40error-on-any b/etc/apt/apt.conf.d/40error-on-any#security-misc-shared similarity index 84% rename from etc/apt/apt.conf.d/40error-on-any rename to etc/apt/apt.conf.d/40error-on-any#security-misc-shared index 85de3bee..f1be4729 100644 --- a/etc/apt/apt.conf.d/40error-on-any +++ b/etc/apt/apt.conf.d/40error-on-any#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Make "sudo apt-get update" exit non-zero for transient failures. diff --git a/etc/apt/apt.conf.d/40sandbox b/etc/apt/apt.conf.d/40sandbox#security-misc-shared similarity index 65% rename from etc/apt/apt.conf.d/40sandbox rename to etc/apt/apt.conf.d/40sandbox#security-misc-shared index e8025ac3..43150ec6 100644 --- a/etc/apt/apt.conf.d/40sandbox +++ b/etc/apt/apt.conf.d/40sandbox#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://forums.whonix.org/t/apt-seccomp-bpf-sandboxing/7702 diff --git a/etc/bluetooth/30_security-misc.conf b/etc/bluetooth/30_security-misc.conf#security-misc-desktop similarity index 81% rename from etc/bluetooth/30_security-misc.conf rename to etc/bluetooth/30_security-misc.conf#security-misc-desktop index 8f45502a..8de8384c 100644 --- a/etc/bluetooth/30_security-misc.conf +++ b/etc/bluetooth/30_security-misc.conf#security-misc-desktop @@ -1,4 +1,4 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [General] @@ -16,11 +16,6 @@ DiscoverableTimeout = 30 # Default=0 (unlimited) MaxControllers=1 -# How long to keep temporary devices around -# The value is in seconds. Default is 30. -# 0 = disable timer, i.e. never keep temporary devices -TemporaryTimeout = 0 - [Policy] # AutoEnable defines option to enable all controllers when they are found. # This includes adapters present on start as well as adapters that are plugged diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg b/etc/default/grub.d/40_cpu_mitigations.cfg deleted file mode 100644 index e426673e..00000000 --- a/etc/default/grub.d/40_cpu_mitigations.cfg +++ /dev/null @@ -1,129 +0,0 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Definitions: -## KSPP=yes: compliant with recommendations by the KSPP -## KSPP=partial: partially compliant with recommendations by the KSPP -## KSPP=no: not (currently) compliant with recommendations by the KSPP -## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. - -## Enable known mitigations for CPU vulnerabilities. -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html -## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html -## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647 - -## Check for potential updates directly from AMD and Intel. -## https://www.amd.com/en/resources/product-security.html -## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html -## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html - -## Enable a subset of known mitigations for CPU vulnerabilities and disable SMT. -## -## KSPP=yes -## KSPP sets the kernel parameters. -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt" - -## Disable SMT as it has been the cause of and amplified numerous CPU exploits. -## The only full mitigation of cross-HT attacks is to disable SMT. -## Disabling will significantly decrease system performance on multi-threaded tasks. -## To enable SMT, remove this line and all other occurrences of "nosmt" in this file. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html -## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 -## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365 -## -## KSPP=yes -## KSPP sets the kernel parameter. -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force" - -## Enable mitigations for both Spectre Variant 2 (indirect branch speculation) -## and Intel branch history injection (BHI) vulnerabilities. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on" -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on" - -## Disable Speculative Store Bypass (Spectre Variant 4). -## -## https://www.suse.com/support/kb/doc/?id=000019189 -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on" - -## Enable mitigations for the L1TF vulnerability through disabling SMT -## and L1D flush runtime control. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force" - -## Enable mitigations for the MDS vulnerability through clearing buffer cache -## and disabling SMT. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" - -## Patches the TAA vulnerability by disabling TSX and enables mitigations using -## TSX Async Abort along with disabling SMT. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off" -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt" - -## Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force" - -## Mitigations for SRBDS to prevent MDS attacks on RDRAND and RDSEED instructions -## are only possible through microcode updates from Intel. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/special-register-buffer-data-sampling.html -## https://access.redhat.com/solutions/5142691 - -## Enable the prctl() interface to prevent leaks from L1D on context switches. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on" - -## Mitigate numerous MMIO Stale Data vulnerabilities and disable SMT. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt" - -## Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with -## Return Instructions) vulnerability and disable SMT. -## -## https://www.suse.com/support/kb/doc/?id=000020693 -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt" - -## Control RAS overflow mitigation on AMD Zen CPUs. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html -## -## The default kernel setting will be utilized until provided sufficient evidence to modify. -## -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_rstack_overflow=safe-ret" - -## Enable Gather Data Sampling (GDS) mitigation. -## Note for systems that have not received a suitable microcode update this will -## entirely disable use of the AVX instructions set. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/gather_data_sampling.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX gather_data_sampling=force" - -## Enable Register File Data Sampling (RFDS) mitigation on Intel Atom CPUs which -## encompasses E-cores on hybrid architectures. -## -## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/reg-file-data-sampling.html -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX reg_file_data_sampling=on" diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared b/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared new file mode 100644 index 00000000..9d78a8ff --- /dev/null +++ b/etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared @@ -0,0 +1,232 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Enable known mitigations for CPU vulnerabilities. +## Note, the mitigations for SSB and Retbleed are not currently mentioned in the first link. +## https://docs.kernel.org/admin-guide/hw-vuln/index.html +## https://docs.kernel.org/admin-guide/kernel-parameters.html +## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647 + +## Check for potential updates directly from AMD and Intel. +## https://www.amd.com/en/resources/product-security.html +## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html +## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html + +## Tabular comparison between the utility and functionality of various mitigations. +## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/587 + +## For complete protection, users must install the latest relevant security microcode update. +## BIOS/UEFI updates should only be obtained directly from OEMs and/or motherboard manufacturers. +## Note that incorrectly performing system BIOS/UEFI updates can potentially lead to serious functionality issues. +## The parameters below only provide (partial) protection at both the kernel and user space level. + +## If using Secure Boot, users must also ensure the Secure Boot Forbidden Signature Database (DBX) is up to date. +## The UEFI Revocation List contains signatures of now revoked firmware and software used in booting systems. +## If using compatible hardware, the database can be updated directly in user space using fwupd. +## Note that incorrectly performing DBX updates can potentially lead to serious functionality issues. +## https://github.com/microsoft/secureboot_objects +## https://uefi.org/revocationlistfile +## https://github.com/fwupd/fwupd + +## Enable a subset of known default mitigations for some CPU vulnerabilities and disable SMT. +## Note that this redundant parameter simply applies each mitigation at the already applied default settings. +## The default values are not always the strictest and so we reapply each below to their highest setting. +## We retain it here for completeness as many other distributions heavily rely on this for many CPU mitigations. +## +## https://github.com/Kicksecure/security-misc/issues/199#issuecomment-3327391859 +## https://github.com/secureblue/secureblue/issues/1405 +## https://docs.kernel.org/admin-guide/hw-vuln/attack_vector_controls.html +## +## KSPP=yes +## KSPP sets the kernel parameters. +## +## WARNING: Do not rely on this parameter, it is presented here only for educational purposes. +## WARNING: Parameters are applied consecutively and so do not ever move this setting down. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt" + +## Disable SMT as it has been the cause of and amplified numerous CPU exploits. +## The only full mitigation of cross-HT attacks is to disable SMT. +## Disabling will significantly decrease system performance on multi-threaded tasks. +## Note, this setting will prevent re-enabling SMT via the sysfs interface. +## +## https://docs.kernel.org/admin-guide/hw-vuln/core-scheduling.html +## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17 +## https://github.com/anthraxx/linux-hardened/issues/37#issuecomment-619597365 +## +## KSPP=yes +## KSPP sets the kernel parameter. +## +## To re-enable SMT: +## - Remove "nosmt=force". +## - Remove all occurrences of ",nosmt" in this file (note the comma ","). +## - Downgrade "l1tf=full,force" protection to "l1tf=flush". +## - Regenerate the dracut initramfs and then reboot system. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force" + +## Spectre Side Channels (BTI and BHI): +## Unconditionally enable mitigation for Spectre Variant 2 (branch target injection). +## Enable mitigation for the Intel branch history injection vulnerability. +## Currently affects both AMD and Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/spectre.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_v2=on" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spectre_bhi=on" + +## Meltdown: +## Mitigate Spectre Variant 3 using kernel page table isolation (PTI). +## Enables kernel PTI to harden against kernel ASLR (KASLR) bypasses. +## Force enables PTI of user and kernel address spaces on all ARM cores. +## Currently affects AMD, ARM64, and Intel CPUs. +## +## https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability) +## https://en.wikipedia.org/wiki/Kernel_page-table_isolation +## +## KSPP=yes +## KSPP sets "pti=on", CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y, and CONFIG_UNMAP_KERNEL_AT_EL0=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kpti=1" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on" + +## Speculative Store Bypass (SSB): +## Mitigate Spectre Variant 4 by disabling speculative store bypass system-wide. +## Unconditionally enable the mitigation for both kernel and userspace. +## Currently affects AMD, ARM64, and Intel CPUs. +## +## https://en.wikipedia.org/wiki/Speculative_Store_Bypass +## https://www.suse.com/support/kb/doc/?id=000019189 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_store_bypass_disable=on" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ssbd=force-on" + +## L1 Terminal Fault (L1TF): +## Mitigate the vulnerability by disabling L1D flush runtime control and SMT. +## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/l1tf.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always" + +## Microarchitectural Data Sampling (MDS): +## Mitigate the vulnerability by clearing the CPU buffer cache and disabling SMT. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/mds.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt" + +## TSX Asynchronous Abort (TAA): +## Mitigate the vulnerability by disabling TSX. +## If TSX is enabled, clear CPU buffer rings on transitions and disable SMT. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/tsx_async_abort.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt" + +## iTLB Multihit: +## Mitigate the vulnerability by marking all huge pages in the EPT as non-executable. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/multihit.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force" + +## Special Register Buffer Data Sampling (SRBDS): +## Mitigation of the vulnerability is only possible via microcode update from Intel. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/special-register-buffer-data-sampling.html +## https://access.redhat.com/solutions/5142691 + +## L1D Flushing: +## Mitigate leaks from the L1D cache on context switches by enabling the prctl() interface. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/l1d_flush.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on" + +## Processor MMIO Stale Data: +## Mitigate the vulnerabilities by appropriately clearing the CPU buffer and disabling SMT. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/processor_mmio_stale_data.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt" + +## Arbitrary Speculative Code Execution with Return Instructions (Retbleed): +## Mitigate the vulnerability through CPU-dependent implementation and disable SMT. +## Currently affects both AMD Zen 1-2 and Intel CPUs. +## +## https://en.wikipedia.org/wiki/Retbleed +## https://comsec.ethz.ch/research/microarch/retbleed/ +## https://www.suse.com/support/kb/doc/?id=000020693 +## https://access.redhat.com/solutions/retbleed +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt" + +## Cross-Thread Return Address Predictions: +## Mitigate the vulnerability for certain KVM hypervisor configurations. +## Currently affects AMD Zen 1-2 CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/cross-thread-rsb.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.mitigate_smt_rsb=1" + +## Speculative Return Stack Overflow (SRSO): +## Mitigate the vulnerability by ensuring all RET instructions speculate to a controlled location. +## Currently affects AMD Zen 1-4 CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/srso.html +## +## The default kernel setting will be utilized until provided sufficient evidence to modify. +## Using "spec_rstack_overflow=ibpb" may provide superior protection to the default software-based approach. +## The use of hardware barriers may be more effective while possibly incurring a greater performance loss. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_rstack_overflow=safe-ret" + +## Gather Data Sampling (GDS): +## Mitigate the vulnerability either via microcode update or by disabling AVX. +## Note, without a suitable microcode update, this will entirely disable use of the AVX instructions set. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/gather_data_sampling.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX gather_data_sampling=force" + +## Register File Data Sampling (RFDS): +## Mitigate the vulnerability by appropriately clearing the CPU buffer. +## Currently affects Intel Atom CPUs (which encompasses E-cores on hybrid architectures). +## +## https://docs.kernel.org/admin-guide/hw-vuln/reg-file-data-sampling.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX reg_file_data_sampling=on" + +## Indirect Target Selection (ITS): +## Mitigate the vulnerability by not allowing indirect branches in the lower half of the cacheline. +## Currently affects Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/indirect-target-selection.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX indirect_target_selection=force" + +## VMScape: +## Mitigate the vulnerability by flushing branch predictors before returning to userspace when exiting guests. +## Comprehensive protection may also require disabling SMT to limit cross-thread attacks. +## Currently affects both AMD and Intel CPUs. +## +## https://docs.kernel.org/admin-guide/hw-vuln/vmscape.html +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vmscape=force" diff --git a/etc/default/grub.d/40_kernel_hardening.cfg b/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared similarity index 50% rename from etc/default/grub.d/40_kernel_hardening.cfg rename to etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared index e41dabb9..ecbddc7a 100644 --- a/etc/default/grub.d/40_kernel_hardening.cfg +++ b/etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. kpkg="linux-image-$(dpkg --print-architecture)" || true @@ -18,7 +18,7 @@ kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || tru ## 4. Networking ## See the documentation below for details on the majority of the selected commands: -## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html +## https://docs.kernel.org/admin-guide/kernel-parameters.html ## https://wiki.archlinux.org/title/Kernel_parameters#GRUB ## 1. Kernel Space: @@ -38,19 +38,27 @@ kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || tru ## GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_nomerge" -## Enable sanity checks and red zoning of slabs via debugging options to detect corruption. -## As a by product of debugging, this will implicitly disabling kernel pointer hashing. -## Enabling will therefore leak exact and all kernel memory addresses to root. -## Has the potential to cause a noticeable performance decrease. -## -## https://www.kernel.org/doc/html/latest/mm/slub.html +## Enable sanity checks and red zoning of slabs via debugging options to detect memory corruption. +## Sanity checks force additional verification steps on every memory allocation and free operation. +## Red zoning adds extra metadata to each object to detect writes beyond the object's boundaries. +## As a by product of debugging, this will implicitly disabling kernel pointer hashing unless manually re-enabled. +## Enabling this (for now) will therefore leak exact and all kernel memory addresses to root. +## Introduces a noticeable performance overhead during all memory allocation and deallocation operations. +## +## https://docs.kernel.org/mm/slub.html +## https://www.kernel.org/doc/Documentation/vm/slub.txt ## https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u +## https://blogs.oracle.com/linux/post/linux-slub-allocator-internals-and-debugging-2 ## https://gitlab.tails.boum.org/tails/tails/-/issues/19613 ## https://github.com/Kicksecure/security-misc/issues/253 ## -## KSPP=yes +## KSPP=partial ## KSPP sets the kernel parameters and CONFIG_SLUB_DEBUG. ## +## REMINDER: Debian forky / 14 +## The first parameter is applicable when using Linux kernel >= 6.17 (retained here for future-proofing and completeness). +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX hash_pointers=always" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX slab_debug=FZ" ## Zero memory at allocation time and free time. @@ -78,16 +86,6 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX init_on_free=1" ## GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX page_alloc.shuffle=1" -## Enable kernel page table isolation to harden against kernel ASLR (KASLR) bypasses. -## Mitigates the Meltdown CPU vulnerability. -## -## https://en.wikipedia.org/wiki/Kernel_page-table_isolation -## -## KSPP=yes -## KSPP sets the kernel parameter and CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y. -## -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX pti=on" - ## Enable randomization of the kernel stack offset on syscall entries. ## Hardens against memory corruption attacks due to increased entropy. ## Limits attacks relying on deterministic stack addresses or cross-syscall address exposure. @@ -118,37 +116,71 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vsyscall=none" ## GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off" -## Force the kernel to panic on "oopses". -## Can sometimes potentially indicate and thwart certain kernel exploitation attempts. +## Force immediate system reboots on the occurrence of a single kernel panic. +## Increases resilience and limits impact of denial of service attacks as system automatically restarts. +## Ensures the system does not hang forever if a panic occurs, reducing susceptibility to both cold and warm boot attacks. +## Immediate rebooting also prevents persistent information disclosure on panic details that were dumped to screen. +## +## KSPP=yes +## KSPP sets CONFIG_PANIC_TIMEOUT=-1. +## +## See /usr/lib/sysctl.d/990-security-misc.conf for implementation. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic=-1" + +## Force the kernel to immediately panic on "oopses" and kernel warnings in the WARN() path. ## Panics may be due to false-positives such as bad drivers. +## Both allowed limits are set to one so that panics occur on the single first instance of either scenario. +## Oopses are serious but non-fatal errors. +## Certain "oopses" can sometimes indicate and thwart potential kernel exploitation attempts. +## Warnings are messages generated by the kernel to indicate unexpected conditions or errors. +## By default, code execution continues regardless of warnings emitted by macros like WARN() and WARN_ON(). +## Note that by forcing kernel panics on oopses and warnings, this exposes the system to targeted denial of service attacks. ## ## https://en.wikipedia.org/wiki/Kernel_panic#Linux ## https://en.wikipedia.org/wiki/Linux_kernel_oops +## https://lwn.net/Articles/876209/ +## https://git.sr.ht/~gregkh/presentation-security/tree/3fdaf81a2f8b2c8d64cdb2f529cc714624868aa8/item/security-stuff.pdf ## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713 ## -## KSPP=partial -## KSPP sets CONFIG_PANIC_ON_OOPS=y, but also requires CONFIG_PANIC_TIMEOUT=-1. +## KSPP=yes +## KSPP sets CONFIG_PANIC_ON_OOPS=y. +## +## Note that this must be used with panic=-1 for it to function as intended. ## ## See /usr/libexec/security-misc/panic-on-oops for implementation. ## #GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX oops=panic" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic_on_warn=1" -## Modify machine check exception handler. -## Can decide whether the system should panic or not based on the occurrence of an exception. -## -## https://www.kernel.org/doc/html/latest/arch/x86/x86_64/machinecheck.html -## https://www.kernel.org/doc/html/latest/arch/x86/x86_64/boot-options.html#machine-check -## https://forums.whonix.org/t/kernel-hardening/7296/494 -## -## The default kernel setting will be utilized until provided sufficient evidence to modify. -## -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mce=0" +## Force the kernel to immediately panic if it becomes tainted. +## Using kernel documentation, one can select a subset of taints to create a security policy. +## Requires summing the numbers for each taint state and then converting it to a hexadecimal bitmask. +## Some example combinations are shown below. +## S - Panic on using out of specification hardware: 4 = 0x4. +## B - On the above and bad page faults or some unexpected page flags: 36 = 0x24. +## A - On the above and ACPI tables are overridden by users: 292 = 0x124. +## I - On the above and severe firmware bugs: 2340 = 0x924. +## N - On the above and in-kernel tests have been run: 264484 = 0x40924. +## J - On the above and userspace has used a mutating debug operation in fwctl: 788772 = 0xC0924. +## G/P, O - On the above and the loading of proprietary or out-of-tree modules: 792869 = 0xC1925. +## All must first be tested to ensure there are no pre-existing issues on user hardware. +## After confirming stability this reduces attack surface. +## +## https://docs.kernel.org/admin-guide/tainted-kernels.html +## https://support.scc.suse.com/s/kb/Tainted-kernel-1583239310621?language=en_US +## https://lore.kernel.org/all/20200515175502.146720-1-aquini@redhat.com/T/ +## https://github.com/Kicksecure/security-misc/pull/339 +## +## Note that this must be used with panic=-1 for it to function as intended. +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX panic_on_taint=0xC0924" ## Prevent sensitive kernel information leaks in the console during boot. ## Must be used in combination with the kernel.printk sysctl. ## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation. ## -## https://www.kernel.org/doc/html/latest/core-api/printk-basics.html +## https://docs.kernel.org/core-api/printk-basics.html ## https://wiki.archlinux.org/title/silent_boot ## ## See /etc/default/grub.d/41_quiet_boot.cfg for implementation. @@ -161,7 +193,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX debugfs=off" ## Aims to have very low processing overhead at each sampling interval. ## Sampling interval is set to occur every 100 milliseconds as per KSPP recommendation. ## -## https://www.kernel.org/doc/html/latest/dev-tools/kfence.html +## https://docs.kernel.org/dev-tools/kfence.html ## https://google.github.io/kernel-sanitizers/KFENCE.html ## https://blogs.oracle.com/linux/post/linux-slub-allocator-internals-and-debugging-4 ## https://lwn.net/Articles/835542/ @@ -180,21 +212,22 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kfence.sample_interval=100" ## KSPP=yes ## KSPP sets the kernel parameter and does not set CONFIG_COMPAT_VDSO. ## +## See /usr/lib/sysctl.d/990-security-misc.conf for another additional implementation. +## GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0" ## Switch (back) to using kCFI as the default Control Flow Integrity (CFI) implementation. ## The default implementation is FineIBT as of Linux kernel 6.2. ## The Intel-developed IBT (Indirect Branch Tracking) is only used if supported by the CPU. ## kCFI is software-only while FineIBT is a hybrid software/hardware implementation. -## FineIBT may result in some performance benefits as it only performs checking at destinations. +## FineIBT may result in some performance benefits as it only performs hash checks at the destinations. +## kCFI mandates hash validation at the source (which is randomized), making it more difficult to bypass. ## FineIBT is considered weaker against attacks that can write arbitrary executables into memory. -## Upstream hardening work has provided users the ability to disable FineIBT based on requests. -## Choice of CFI implementation is highly dependent on user threat model as there are pros/cons to both. -## Do not modify from the default setting if unsure of implications. ## -## https://lore.kernel.org/all/20221027092842.699804264@infradead.org/ +## https://lwn.net/Articles/891976/ ## https://lore.kernel.org/lkml/202210010918.4918F847C4@keescook/T/#u ## https://lore.kernel.org/lkml/202210182217.486CBA50@keescook/T/ +## https://lore.kernel.org/all/20221027092842.699804264@infradead.org/ ## https://lore.kernel.org/lkml/202407150933.E1871BE@keescook/ ## https://isopenbsdsecu.re/mitigations/forward_edge_cfi/ ## https://docs.kernel.org/next/x86/shstk.html @@ -205,12 +238,9 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0" ## KSPP=yes ## KSPP sets the kernel parameter. ## -## TODO: Debian 13 Trixie -## Applicable when using Linux kernel >= 6.2 (retained here for future-proofing and completeness). -## -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cfi=kcfi" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cfi=kcfi" -## Disable support for x86 processes and syscalls. +## Disable support for all 32-bit x86 processes and syscalls. ## Unconditionally disables IA32 emulation to substantially reduce attack surface. ## ## https://lore.kernel.org/all/20230623111409.3047467-7-nik.borisov@suse.com/ @@ -218,10 +248,83 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX vdso32=0" ## KSPP=yes ## KSPP does not set CONFIG_COMPAT, CONFIG_IA32_EMULATION, CONFIG_X86_X32, CONFIG_X86_X32_ABI, and CONFIG_MODIFY_LDT_SYSCALL. ## -## TODO: Debian 13 Trixie -## Applicable when using Linux kernel >= 6.7 (retained here for future-proofing and completeness). +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0" + +## Disable EFI persistent storage feature. +## Disable Error Record Serialization Table (ERST) support as a form of defense-in-depth. +## Prevents the kernel from writing crash logs and other persistent data to the storage backend. +## Both the UEFI variable storage and ACPI ERST backends are deactivated. +## +## https://blogs.oracle.com/linux/post/pstore-linux-kernel-persistent-storage-file-system +## https://www.ais.com/understanding-pstore-linux-kernel-persistent-storage-file-system/ +## https://lwn.net/Articles/434821/ +## https://manpages.debian.org/testing/systemd/systemd-pstore.service.8.en.html +## https://gitlab.tails.boum.org/tails/tails/-/issues/20813 +## https://github.com/Kicksecure/security-misc/issues/299 +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi_pstore.pstore_disable=1" +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable" + +## Restrict processes from modifying their own memory mappings. +## Prevents using /proc/PID/mem to write to protected pages unless via ptrace() for debugging. +## Increases the difficulty in tricking applications into overwriting their own memory. +## Limit self-modification which can be used trigger existing vulnerabilities. +## +## https://lore.kernel.org/lkml/20240712-vfs-procfs-ce7e6c7cf26b@brauner/ +## https://lwn.net/Articles/983169/ +## https://github.com/a13xp0p0v/kernel-hardening-checker/pull/201 +## https://github.com/Kicksecure/security-misc/issues/330 ## -#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ia32_emulation=0" +## KSPP=partial +## KSPP sets the stricter kernel parameter "proc_mem.force_override=never". +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX proc_mem.force_override=ptrace" + +## Prevent processes from writing to block devices that are mounted by filesystems. +## Enhances system stability and security by protecting against runaway privileged processes. +## Allowing processes to write to the buffer cache can cause filesystem corruption and kernel crashes. +## Does not prevent data modifications using direct SCSI commands or lower-level storage stack access. +## May lead to breakages in certain limited scenarios. +## +## https://github.com/torvalds/linux/commit/ed5cc702d311c14b653323d76062b0294effa66e +## https://lore.kernel.org/lkml/20240105-vfs-super-4092d802972c@brauner/ +## https://github.com/a13xp0p0v/kernel-hardening-checker/issues/186 +## +## https://github.com/Kicksecure/security-misc/pull/334 +## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/609 +## https://forums.whonix.org/t/how-to-compress-and-prevent-vdi-from-ballooning-after-each-update-deleting-large-files/22675/9 +## https://forums.kicksecure.com/t/resizing-disk-for-guest-in-kvm/1657 +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX bdev_allow_write_mounted=0" + +## Enable AMD Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV). +## SME encrypts memory with a single key at the kernel level to protect against cold boot attacks. +## SEV extends SME to VMs by encrypting the memory of each with a unique key for guest isolation. +## SEV-ES (Encrypted State) extends SEV by encrypting each guests virtual CPU register state during VM exits. +## SEV-SNP (Secure Nested Paging) extends SEV by activating hardware-level memory integrity. +## This is hardware-based encryption managed by the proprietary and closed-source AMD Platform Security Processor (PSP). +## Both require a compatible AMD CPU and support for SME to first be enabled in the BIOS/UEFI. +## Likely unavailable in consumer-grade AMD CPUs where Transparent SME (TSME) can be enabled in the BIOS/UEFI to achieve SME. +## Note the corresponding Intel Total Memory Encryption (TME) can also be enabled via the BIOS/UEFI. +## May cause boot failure on certain hardware with incompatible DMA masks especially if IOMMU is disabled. +## +## https://www.kernel.org/doc/html/next/x86/amd-memory-encryption.html +## https://docs.kernel.org/virt/kvm/x86/amd-memory-encryption.html +## https://docs.amd.com/v/u/en-US/memory-encryption-white-paper +## https://docs.amd.com/v/u/en-US/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more +## https://github.com/AMDESE/AMDSEV +## https://en.wikichip.org/wiki/x86/sme +## https://lore.kernel.org/all/YWRgN63FOrQGO8jS@zn.tnic/ +## https://lore.kernel.org/lkml/YWvy9bSRaC+m1sV+@zn.tnic/T/#m01bcb37040b6b0d119d385d9a34b9c7ac4ce5f84 +## https://mricher.fr/post/amd-memory-encryption/ +## https://www.kicksecure.com/wiki/Dev/confidential_computing#AMD +## https://github.com/secureblue/secureblue/pull/1631#issuecomment-3655501478 +## https://forums.whonix.org/t/enable-secure-memory-encryption-sme-kernel-parameter-mem-encrypt-by-default/10393 +## +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mem_encrypt=on" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev=1" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_es=1" +#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm_amd.sev_snp=1" ## 2. Direct Memory Access: ## @@ -242,6 +345,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on" ## https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit ## https://en.wikipedia.org/wiki/DMA_attack ## https://lenovopress.lenovo.com/lp1467.pdf +## https://www.kb.cert.org/vuls/id/382314 ## ## KSPP=yes ## KSPP sets the kernel parameters, CONFIG_IOMMU_SUPPORT=y, CONFIG_IOMMU_DEFAULT_DMA_STRICT=y, and does not set CONFIG_IOMMU_DEFAULT_PASSTHROUGH. @@ -268,32 +372,48 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX efi=disable_early_pci_dma" ## ## https://madaidans-insecurities.github.io/guides/linux-hardening.html#rdrand -## Do not credit the CPU or bootloader seeds as entropy sources at boot. -## The RDRAND CPU (RNG) instructions are proprietary and closed-source. -## Numerous implementations of RDRAND have a long history of being defective. -## The RNG seed passed by the bootloader could also potentially be tampered. +## Do not credit the CPU seeds as an entropy sources at boot. +## The RDRAND and RDSEED CPU (RNG) instructions are proprietary and closed-source. +## Numerous implementations of RDRAND and RDSEED have a long history of being defective. ## Maximizing the entropy pool at boot is desirable for all cryptographic operations. -## These settings ensure additional entropy is obtained from other sources to initialize the RNG. -## Note that distrusting these (relatively fast) sources of entropy will increase boot time. +## This ensures additional entropy is obtained from other sources to initialize the Linux CRNG. +## Note that distrusting this (relatively fast) source of entropy will increase boot time. ## -## https://en.wikipedia.org/wiki/RDRAND#Reception +## https://en.wikipedia.org/wiki/RDRAND ## https://systemd.io/RANDOM_SEEDS/ ## https://www.kicksecure.com/wiki/Dev/Entropy#RDRAND -## https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/ -## https://x.com/pid_eins/status/1149649806056280069 ## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html ## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566 +## https://lkml.org/lkml/2022/6/5/271 +## https://lwn.net/Articles/961121/ +## https://lore.kernel.org/lkml/aPFDn-4Cm6n0_3_e@gourry-fedora-PF4VCD3F/ +## https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7055.html +## +## KSPP=yes +## KSPP sets CONFIG_RANDOM_TRUST_CPU=y. +## +GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off" + +## Do not credit the bootloader seeds as an entropy source at boot. +## The RNG seed passed by the bootloader could potentially be tampered. +## Maximizing the entropy pool at boot is desirable for all cryptographic operations. +## This ensures additional entropy is obtained from other sources to initialize the Linux CRNG. +## Note that distrusting this (relatively fast) source of entropy will increase boot time. +## +## https://systemd.io/RANDOM_SEEDS/ ## https://github.com/NixOS/nixpkgs/pull/165355 ## https://lkml.org/lkml/2022/6/5/271 ## ## KSPP=yes -## KSPP sets CONFIG_RANDOM_TRUST_BOOTLOADER=y and CONFIG_RANDOM_TRUST_CPU=y. +## KSPP sets CONFIG_RANDOM_TRUST_BOOTLOADER=y. ## GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_bootloader=off" -GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off" ## Obtain more entropy during boot as the runtime memory allocator is being initialized. -## Entropy will be extracted from up to the first 4GB of RAM. +## Entropy will be extracted from up to the first 4GB of RAM as another source. +## Note that entropy extracted this way is not cryptographically secure and so is not credited. +## Maximizing the entropy pool at boot is desirable for all cryptographic operations. +## This will increase boot time due to interrupting the boot process. ## Requires the linux-hardened kernel patch. ## ## https://www.kicksecure.com/wiki/Hardened-kernel#linux-hardened @@ -309,7 +429,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy" ## Disable the entire IPv6 stack functionality. ## Removes attack surface associated with the IPv6 module. ## -## https://www.kernel.org/doc/html/latest/networking/ipv6.html +## https://docs.kernel.org/networking/ipv6.html ## https://wiki.archlinux.org/title/IPv6#Disable_IPv6 ## ## Enabling makes redundant many network hardening sysctl's in /usr/lib/sysctl.d/990-security-misc.conf. diff --git a/etc/default/grub.d/40_remount_secure.cfg b/etc/default/grub.d/40_remount_secure.cfg#security-misc-shared similarity index 93% rename from etc/default/grub.d/40_remount_secure.cfg rename to etc/default/grub.d/40_remount_secure.cfg#security-misc-shared index f06235bc..c3cc30a7 100644 --- a/etc/default/grub.d/40_remount_secure.cfg +++ b/etc/default/grub.d/40_remount_secure.cfg#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Definitions: diff --git a/etc/default/grub.d/40_signed_modules.cfg b/etc/default/grub.d/40_signed_modules.cfg#security-misc-shared similarity index 95% rename from etc/default/grub.d/40_signed_modules.cfg rename to etc/default/grub.d/40_signed_modules.cfg#security-misc-shared index 75cd3bb9..36af7f33 100644 --- a/etc/default/grub.d/40_signed_modules.cfg +++ b/etc/default/grub.d/40_signed_modules.cfg#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Definitions: diff --git a/etc/default/grub.d/41_quiet_boot.cfg b/etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared similarity index 86% rename from etc/default/grub.d/41_quiet_boot.cfg rename to etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared index 96236251..21b73f5b 100644 --- a/etc/default/grub.d/41_quiet_boot.cfg +++ b/etc/default/grub.d/41_quiet_boot.cfg#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Definitions: @@ -9,17 +9,17 @@ ## Some default configuration files automatically include the "quiet" parameter. ## Therefore, first remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT since "quiet" must be first. -## LANG=C str_replace is provided by package helper-scripts. +## str_replace is provided by package helper-scripts. ## ## https://github.com/Kicksecure/security-misc/pull/233#issuecomment-2228792461 ## -GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | LANG=C str_replace "quiet" "")" +GRUB_CMDLINE_LINUX_DEFAULT="$(echo "$GRUB_CMDLINE_LINUX_DEFAULT" | str_replace "quiet" "")" ## Prevent sensitive kernel information leaks in the console during boot. ## Must be used in combination with the kernel.printk sysctl. ## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation. ## -## https://www.kernel.org/doc/html/latest/core-api/printk-basics.html +## https://docs.kernel.org/core-api/printk-basics.html ## https://wiki.archlinux.org/title/silent_boot ## ## For easier debugging, these are not applied to the recovery boot option. diff --git a/etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared b/etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared new file mode 100644 index 00000000..5da19e7e --- /dev/null +++ b/etc/default/grub.d/41_recovery_restrict.cfg#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Disable access to the GRUB single-user (recovery) mode menu entries. +## +## https://forums.kicksecure.com/t/remove-linux-recovery-mode-boot-option-from-default-grub-boot-menu/727 +## +GRUB_DISABLE_RECOVERY="true" + +## Disable access to Dracut's recovery console. +## Prevents the emergency shell from starting automatically during boot failures. +## +## https://insinuator.net/2025/07/insecure-boot-injecting-initramfs-from-a-debug-shell/ +## https://serverfault.com/questions/554853/how-can-i-secure-the-dracut-shell +## https://forums.kicksecure.com/t/harden-dracut-initramfs-generator-by-disabling-recovery-console/724 +## +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.emergency=halt" +GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.shell=0" diff --git a/etc/dkms/framework.conf.d/30_security-misc.conf b/etc/dkms/framework.conf.d/30_security-misc.conf deleted file mode 100644 index abf9a788..00000000 --- a/etc/dkms/framework.conf.d/30_security-misc.conf +++ /dev/null @@ -1,20 +0,0 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Lower parallel compilation jobs to 1 if less than 2 GB RAM to avoid freezing of virtual machines. -## This does not necessarily belong into security-misc. -## -## Example here: -## https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/26 -## -## This might no longer be possible in the future. See: -## "Stop handling dkms.conf as a bash/shell script" -## https://github.com/dell/dkms/issues/414 -ENOUGH_RAM="1950" -total_ram="$(free -m | sed -n -e '/^Mem:/s/^[^0-9]*\([0-9]*\) .*/\1/p')" -if [ "$total_ram" -ge "$ENOUGH_RAM" ]; then - true "INFO: Enough RAM available. Not lowering compilation cores." -else - true "INFO: Not enough RAM available. Lowering compilation cores to 1." - parallel_jobs=1 -fi diff --git a/etc/dracut.conf.d/30-security-misc.conf b/etc/dracut.conf.d/30-security-misc.conf#security-misc-shared similarity index 57% rename from etc/dracut.conf.d/30-security-misc.conf rename to etc/dracut.conf.d/30-security-misc.conf#security-misc-shared index 4e247997..5b3c7b5a 100644 --- a/etc/dracut.conf.d/30-security-misc.conf +++ b/etc/dracut.conf.d/30-security-misc.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. reproducible=yes diff --git a/etc/gitconfig b/etc/gitconfig#security-misc-shared similarity index 84% rename from etc/gitconfig rename to etc/gitconfig#security-misc-shared index 49551999..c7a8c5d8 100644 --- a/etc/gitconfig +++ b/etc/gitconfig#security-misc-shared @@ -1,13 +1,15 @@ -## Copyright (C) 2024 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Lines starting with a hash symbol ('#') are comments. ## https://github.com/Kicksecure/security-misc/issues/225 [core] -## https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm + ## https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm symlinks = false + #hooksPath = /home/user/.config/git/hooks + ## https://forums.whonix.org/t/git-users-enable-fsck-by-default-for-better-security/2066 [transfer] fsckobjects = true @@ -20,7 +22,7 @@ ## Listed here as suggestions what users should put into their ~/.gitconfig ## file. -## Not enabled by default because it requires essential knowledge about OpenPG +## Not enabled by default because it requires essential knowledge about OpenPGP ## and an already existing local signing key. Otherwise would prevent all new ## commits. #[commit] diff --git a/etc/hide-hardware-info.d/30_default.conf b/etc/hide-hardware-info.d/30_default.conf#security-misc-shared similarity index 64% rename from etc/hide-hardware-info.d/30_default.conf rename to etc/hide-hardware-info.d/30_default.conf#security-misc-shared index 07e1c7e2..d1bc221c 100644 --- a/etc/hide-hardware-info.d/30_default.conf +++ b/etc/hide-hardware-info.d/30_default.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Disable the /sys whitelist. @@ -11,5 +11,5 @@ #sysfs=0 ## Disable selinux mode. -## https://www.whonix.org/wiki/Security-misc#selinux +## https://www.kicksecure.com/wiki/Security-misc#selinux #selinux=0 diff --git a/etc/initramfs-tools/hooks/sysctl-initramfs b/etc/initramfs-tools/hooks/sysctl-initramfs deleted file mode 100755 index 22ceaf1e..00000000 --- a/etc/initramfs-tools/hooks/sysctl-initramfs +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh - -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -PREREQ="" -prereqs() -{ - echo "$PREREQ" -} -case $1 in -prereqs) - prereqs - exit 0 - ;; -esac - -. /usr/share/initramfs-tools/hook-functions -copy_exec /usr/sbin/sysctl /usr/sbin diff --git a/etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs b/etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs deleted file mode 100755 index 88d01624..00000000 --- a/etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh - -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -PREREQ="" -prereqs() -{ - echo "$PREREQ" -} -case $1 in -prereqs) - prereqs - exit 0 - ;; -esac - -## Write to '/run/initramfs' folder. -## https://forums.whonix.org/t/kernel-hardening/7296/435 - -sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null 2> "/run/initramfs/sysctl-initramfs-error.log" -sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null 2>> "/run/initramfs/sysctl-initramfs-error.log" - -grep -v "unprivileged_userfaultfd" "/run/initramfs/sysctl-initramfs-error.log" - -true diff --git a/etc/kernel/postinst.d/30_remove-system-map b/etc/kernel/postinst.d/30_remove-system-map deleted file mode 100755 index f5e3d968..00000000 --- a/etc/kernel/postinst.d/30_remove-system-map +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if test -x /usr/libexec/security-misc/remove-system.map ; then - /usr/libexec/security-misc/remove-system.map -fi diff --git a/etc/kernel/postinst.d/30_remove-system-map#security-misc-shared b/etc/kernel/postinst.d/30_remove-system-map#security-misc-shared new file mode 100755 index 00000000..e2d1228d --- /dev/null +++ b/etc/kernel/postinst.d/30_remove-system-map#security-misc-shared @@ -0,0 +1,15 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +if test -x /usr/libexec/security-misc/remove-system.map ; then + /usr/libexec/security-misc/remove-system.map +fi diff --git a/etc/modprobe.d/30_security-misc_blacklist.conf b/etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared similarity index 78% rename from etc/modprobe.d/30_security-misc_blacklist.conf rename to etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared index af312b22..f3bd87bf 100644 --- a/etc/modprobe.d/30_security-misc_blacklist.conf +++ b/etc/modprobe.d/30_security-misc_blacklist.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## See the following links for a community discussion and overview regarding the selections. @@ -10,14 +10,14 @@ ## CD-ROM/DVD: ## Blacklist CD-ROM and DVD modules. -## Do not disable by default for potential future ISO plans. +## Not disabled by default due to potential future ISO plans. +## Can uncomment the bottom pair to disable both modules. ## ## https://nvd.nist.gov/vuln/detail/CVE-2018-11506 ## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31 ## blacklist cdrom blacklist sr_mod -## #install cdrom /usr/bin/disabled-cdrom-by-security-misc #install sr_mod /usr/bin/disabled-cdrom-by-security-misc @@ -26,21 +26,17 @@ blacklist sr_mod ## GrapheneOS: ## Partial selection of their infrastructure blacklist. ## Duplicate and already disabled modules have been omitted. +## Currently snd_intel8x0 is required by some users for VirtualBox audio device ICH AC97. ## -## https://github.com/GrapheneOS/infrastructure/blob/main/modprobe.d/local.conf +## https://github.com/GrapheneOS/infrastructure/tree/main/etc/modprobe.d +## https://www.kicksecure.com/wiki/Dev/audio +## https://github.com/Kicksecure/security-misc/issues/271 ## #blacklist cfg80211 #blacklist intel_agp #blacklist ip_tables -blacklist joydev #blacklist mousedev #blacklist psmouse -## TODO: Re-check in Debian trixie -## In GrapheneOS list, yes, "should" be out-commented here. -## But not actually out-commented. -## Breaks VirtualBox audio device ICH AC97, which is unfortunately still required by some users. -## https://www.kicksecure.com/wiki/Dev/audio -## https://github.com/Kicksecure/security-misc/issues/271 #blacklist snd_intel8x0 #blacklist tls #blacklist virtio_balloon diff --git a/etc/modprobe.d/30_security-misc_conntrack.conf b/etc/modprobe.d/30_security-misc_conntrack.conf deleted file mode 100644 index c1a641bb..00000000 --- a/etc/modprobe.d/30_security-misc_conntrack.conf +++ /dev/null @@ -1,11 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Conntrack: -## Disable Netfilter's automatic connection tracking helper assignment. -## Increases kernel attack surface by enabling superfluous functionality such as IRC parsing in the kernel. -## -## https://conntrack-tools.netfilter.org/manual.html -## https://forums.whonix.org/t/disable-conntrack-helper/18917 -## -options nf_conntrack nf_conntrack_helper=0 diff --git a/etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared b/etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared new file mode 100644 index 00000000..7c51595e --- /dev/null +++ b/etc/modprobe.d/30_security-misc_conntrack.conf#security-misc-shared @@ -0,0 +1,13 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Conntrack: +## Disable Netfilter's automatic connection tracking helper assignment. +## This functionality adds unnecessary features, such as IRC protocol parsing, into the kernel. +## Disabling it reduces the kernel attack surface and improves security. +## +## https://conntrack-tools.netfilter.org/manual.html +## https://home.regit.org/netfilter-en/secure-use-of-helpers/ +## https://forums.whonix.org/t/disable-conntrack-helper/18917 +## +options nf_conntrack nf_conntrack_helper=0 diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared similarity index 72% rename from etc/modprobe.d/30_security-misc_disable.conf rename to etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared index 3df5a51c..4396c473 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared @@ -1,7 +1,7 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. -## See the following links for a community discussion and overview regarding the selections. +## See the following links for a community discussion and overview regarding the selections: ## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989 ## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules @@ -17,11 +17,10 @@ ## 1. Hardware: ## Bluetooth: -## Disable Bluetooth to reduce attack surface due to extended history of security vulnerabilities. +## Disable Bluetooth to reduce the attack surface due to its long history of security vulnerabilities. +## Replaced with a privacy and security preserving default Bluetooth configuration for better usability. ## ## https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns -## -## Now replaced by a privacy and security preserving default Bluetooth configuration for better usability. ## https://github.com/Kicksecure/security-misc/pull/145 ## #install bluetooth /usr/bin/disabled-bluetooth-by-security-misc @@ -42,8 +41,22 @@ #install btusb /usr/bin/disabled-bluetooth-by-security-misc #install virtio_bt /usr/bin/disabled-bluetooth-by-security-misc +## CPU Model-Specific Registers (MSRs): +## User-level read access to MSRs can allow malicious unprivileged applications to access other trust domains. +## MSRs can also be abused to write to arbitrary memory. +## +## https://en.wikipedia.org/wiki/Model-specific_register +## https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/running-average-power-limit-energy-reporting.html +## https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/reading-writing-msrs-in-linux.html +## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode +## https://github.com/Kicksecure/security-misc/issues/215 +## +#install intel_rapl_msr /usr/bin/disabled-cpumsr-by-security-misc +#install isst_if_mbox_msr /usr/bin/disabled-cpumsr-by-security-misc +#install msr /usr/bin/disabled-cpumsr-by-security-misc + ## FireWire (IEEE 1394): -## Disable IEEE 1394 (FireWire/i.LINK/Lynx) modules to prevent some DMA attacks. +## Disable IEEE 1394 (FireWire/i.LINK/Lynx) modules to prevent certain DMA attacks. ## ## https://en.wikipedia.org/wiki/IEEE_1394#Security_issues ## @@ -70,11 +83,11 @@ install gnss-usb /usr/bin/disabled-gps-by-security-misc ## Intel Management Engine (ME): ## Partially disable the Intel ME interface with the OS. -## ME functionality has increasing become more intertwined with basic Intel system operation. -## Disabling may lead to breakages in numerous places without clear debugging/error messages. -## May cause issues with firmware updates, security, power management, display, and DRM. +## ME functionality has increasingly become intertwined with basic Intel system operation. +## Disabling it may lead to breakages in various components without clear debugging/error messages. +## It may affect firmware updates, security, power management, display, and DRM. ## -## https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html +## https://docs.kernel.org/driver-api/mei/mei.html ## https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities ## https://www.kicksecure.com/wiki/Out-of-band_Management_Technology#Intel_ME_Disabling_Disadvantages ## https://github.com/Kicksecure/security-misc/pull/236#issuecomment-2229092813 @@ -94,8 +107,9 @@ install gnss-usb /usr/bin/disabled-gps-by-security-misc #install microread_mei /usr/bin/disabled-intelme-by-security-misc ## Intel Platform Monitoring Technology (PMT) Telemetry: -## Disable some functionality of the Intel PMT components. +## Disable certain functionalities of the Intel PMT components. ## +## https://www.intel.com/content/www/us/en/content-details/710389/intel-platform-monitoring-technology-intel-pmt-technical-specification.html ## https://github.com/intel/Intel-PMT ## install pmt_class /usr/bin/disabled-intelpmt-by-security-misc @@ -103,7 +117,7 @@ install pmt_crashlog /usr/bin/disabled-intelpmt-by-security-misc install pmt_telemetry /usr/bin/disabled-intelpmt-by-security-misc ## Thunderbolt: -## Disables Thunderbolt modules to prevent some DMA attacks. +## Disable Thunderbolt modules to prevent certain DMA attacks. ## ## https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Security_vulnerabilities ## @@ -117,28 +131,52 @@ install thunderbolt_net /usr/bin/disabled-thunderbolt-by-security-misc ## Disable uncommon file systems to reduce attack surface. ## HFS/HFS+ are legacy Apple file systems that may be required depending on the EFI partition format. ## +## https://docs.kernel.org/filesystems/index.html +## https://github.com/secureblue/secureblue/tree/live/files/system/usr/lib/modprobe.d +## +install adfs /usr/bin/disabled-filesys-by-security-misc +install affs /usr/bin/disabled-filesys-by-security-misc +install afs /usr/bin/disabled-filesys-by-security-misc +install befs /usr/bin/disabled-filesys-by-security-misc +install ceph /usr/bin/disabled-filesys-by-security-misc +install coda /usr/bin/disabled-filesys-by-security-misc install cramfs /usr/bin/disabled-filesys-by-security-misc +install ecryptfs /usr/bin/disabled-filesys-by-security-misc install freevxfs /usr/bin/disabled-filesys-by-security-misc install hfs /usr/bin/disabled-filesys-by-security-misc install hfsplus /usr/bin/disabled-filesys-by-security-misc install jffs2 /usr/bin/disabled-filesys-by-security-misc install jfs /usr/bin/disabled-filesys-by-security-misc +install kafs /usr/bin/disabled-filesys-by-security-misc +install minix /usr/bin/disabled-filesys-by-security-misc +install nilfs2 /usr/bin/disabled-filesys-by-security-misc +install ocfs2 /usr/bin/disabled-filesys-by-security-misc +install orangefs /usr/bin/disabled-filesys-by-security-misc install reiserfs /usr/bin/disabled-filesys-by-security-misc +install romfs /usr/bin/disabled-filesys-by-security-misc +install sysv /usr/bin/disabled-filesys-by-security-misc +install ubifs /usr/bin/disabled-filesys-by-security-misc install udf /usr/bin/disabled-filesys-by-security-misc +install ufs /usr/bin/disabled-filesys-by-security-misc +install zonefs /usr/bin/disabled-filesys-by-security-misc ## Network File Systems: ## Disable uncommon network file systems to reduce attack surface. +## Currently 9p is required for KVM shared folders in Whonix. +## +## https://www.whonix.org/wiki/KVM#Shared_Folder ## +#install 9p /usr/bin/disabled-netfilesys-by-security-misc install gfs2 /usr/bin/disabled-netfilesys-by-security-misc install ksmbd /usr/bin/disabled-netfilesys-by-security-misc -## -## Common Internet File System (CIFS): + +## Network File System - Common Internet File System (CIFS): ## install cifs /usr/bin/disabled-netfilesys-by-security-misc install cifs_arc4 /usr/bin/disabled-netfilesys-by-security-misc install cifs_md4 /usr/bin/disabled-netfilesys-by-security-misc -## -## Network File System (NFS): + +## Network File System - Network File System (NFS): ## install nfs /usr/bin/disabled-netfilesys-by-security-misc install nfs_acl /usr/bin/disabled-netfilesys-by-security-misc @@ -149,10 +187,10 @@ install nfsv2 /usr/bin/disabled-netfilesys-by-security-misc install nfsv3 /usr/bin/disabled-netfilesys-by-security-misc install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc -## 2. Networking: +## 3. Networking: ## Network Protocols: -## Disables rare and unneeded network protocols that are a common source of unknown vulnerabilities. +## Disable rare and unneeded network protocols that are a common source of unknown vulnerabilities. ## Previously had blacklisted eepro100 and eth1394. ## ## https://tails.boum.org/blueprint/blacklist_modules/ @@ -163,7 +201,6 @@ install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc install af_802154 /usr/bin/disabled-network-by-security-misc install appletalk /usr/bin/disabled-network-by-security-misc install ax25 /usr/bin/disabled-network-by-security-misc -#install brcm80211 /usr/bin/disabled-network-by-security-misc install decnet /usr/bin/disabled-network-by-security-misc install dccp /usr/bin/disabled-network-by-security-misc install econet /usr/bin/disabled-network-by-security-misc @@ -177,15 +214,15 @@ install p8023 /usr/bin/disabled-network-by-security-misc install psnap /usr/bin/disabled-network-by-security-misc install rose /usr/bin/disabled-network-by-security-misc install x25 /usr/bin/disabled-network-by-security-misc -## -## Asynchronous Transfer Mode (ATM): + +## Network Protocol - Asynchronous Transfer Mode (ATM): ## install atm /usr/bin/disabled-network-by-security-misc install ueagle-atm /usr/bin/disabled-network-by-security-misc install usbatm /usr/bin/disabled-network-by-security-misc install xusbatm /usr/bin/disabled-network-by-security-misc -## -## Controller Area Network (CAN) Protocol: + +## Network Protocol - Controller Area Network (CAN): ## install c_can /usr/bin/disabled-network-by-security-misc install c_can_pci /usr/bin/disabled-network-by-security-misc @@ -208,19 +245,19 @@ install slcan /usr/bin/disabled-network-by-security-misc install ucan /usr/bin/disabled-network-by-security-misc install vxcan /usr/bin/disabled-network-by-security-misc install vcan /usr/bin/disabled-network-by-security-misc -## -## Transparent Inter Process Communication (TIPC): + +## Network Protocol - Transparent Inter Process Communication (TIPC): ## install tipc /usr/bin/disabled-network-by-security-misc install tipc_diag /usr/bin/disabled-network-by-security-misc -## -## Reliable Datagram Sockets (RDS): + +## Network Protocol - Reliable Datagram Sockets (RDS): ## install rds /usr/bin/disabled-network-by-security-misc install rds_rdma /usr/bin/disabled-network-by-security-misc install rds_tcp /usr/bin/disabled-network-by-security-misc -## -## Stream Control Transmission Protocol (SCTP): + +## Network Protocol - Stream Control Transmission Protocol (SCTP): ## install sctp /usr/bin/disabled-network-by-security-misc install sctp_diag /usr/bin/disabled-network-by-security-misc @@ -231,14 +268,6 @@ install sctp_diag /usr/bin/disabled-network-by-security-misc ## install hamradio /usr/bin/disabled-miscellaneous-by-security-misc -## CPU Model-Specific Registers (MSRs): -## Disable CPU MSRs as they can be abused to write to arbitrary memory. -## -## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode -## https://github.com/Kicksecure/security-misc/issues/215 -## -#install msr /usr/bin/disabled-miscellaneous-by-security-misc - ## Floppy Disks: ## install floppy /usr/bin/disabled-miscellaneous-by-security-misc @@ -262,7 +291,7 @@ install i810fb /usr/bin/disabled-framebuffer-by-security-misc install intelfb /usr/bin/disabled-framebuffer-by-security-misc install kyrofb /usr/bin/disabled-framebuffer-by-security-misc install lxfb /usr/bin/disabled-framebuffer-by-security-misc -install matroxfb_bases /usr/bin/disabled-framebuffer-by-security-misc +install matroxfb_base /usr/bin/disabled-framebuffer-by-security-misc install neofb /usr/bin/disabled-framebuffer-by-security-misc install nvidiafb /usr/bin/disabled-framebuffer-by-security-misc install pm2fb /usr/bin/disabled-framebuffer-by-security-misc @@ -280,27 +309,48 @@ install viafb /usr/bin/disabled-framebuffer-by-security-misc install vt8623fb /usr/bin/disabled-framebuffer-by-security-misc install udlfb /usr/bin/disabled-framebuffer-by-security-misc +## Joysticks: +## +## https://docs.kernel.org/input/joydev/joystick.html +## +install joydev /usr/bin/disabled-miscellaneous-by-security-misc + ## Replaced Modules: ## These legacy drivers have all been entirely replaced and superseded by newer drivers. -## These were all previously blacklisted. +## Many of these were previously blacklisted. ## ## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco ## install asus_acpi /usr/bin/disabled-miscellaneous-by-security-misc install bcm43xx /usr/bin/disabled-miscellaneous-by-security-misc +install brcm80211 /usr/bin/disabled-miscellaneous-by-security-misc install de4x5 /usr/bin/disabled-miscellaneous-by-security-misc install prism54 /usr/bin/disabled-miscellaneous-by-security-misc +## RNDIS: +## Disable as believed to have unfixable buffer overflow issues impossible to make secure. +## Used by some network devices common with Android USB tethering. +## +## https://en.wikipedia.org/wiki/RNDIS +## https://lkml.org/lkml/2022/11/23/728 +## https://lore.kernel.org/lkml/2023071333-wildly-playroom-878b@gregkh/ +## +install rndis_host /usr/bin/disabled-miscellaneous-by-security-misc +install usb_f_rndis /usr/bin/disabled-miscellaneous-by-security-misc + ## USB Video Device Class: -## Disables the USB-based video streaming driver for devices like some webcams and digital camcorders. +## Disable the USB-based video streaming driver for devices like some webcams and digital camcorders. ## #install uvcvideo /usr/bin/disabled-miscellaneous-by-security-misc ## Vivid: -## Disables the vivid kernel module since it has been the cause of multiple vulnerabilities. +## Disable the vivid kernel module since it has been the cause of multiple vulnerabilities. +## Required only for running tests associated with the Qubes Video Companion. ## ## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233 ## https://www.openwall.com/lists/oss-security/2019/11/02/1 ## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 +## https://forums.whonix.org/t/testing-qubes-video-companion-on-whonix/21393 +## https://github.com/Kicksecure/security-misc/issues/298 ## -install vivid /usr/bin/disabled-miscellaneous-by-security-misc +#install vivid /usr/bin/disabled-miscellaneous-by-security-misc diff --git a/etc/permission-hardener.d/25_default_sudo.conf b/etc/permission-hardener.d/25_default_sudo.conf deleted file mode 100644 index ee46b0ed..00000000 --- a/etc/permission-hardener.d/25_default_sudo.conf +++ /dev/null @@ -1,20 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## https://forums.whonix.org/t/restrict-root-access/7658/116 -## This restricts the file permissions of the sudo executable so that a vulnerability -## in the program will not be exploitable by any users not in the "sudo" group. sudo -## is a very complex program and is setuid so vulnerabilities in it can allow privilege -## escalation, regardless of other root access restrictions. For example, the following -## buffer overflow vulnerability could have been exploited by any user on the system: -## https://www.openwall.com/lists/oss-security/2021/01/26/3 -## With this restriction, only users explicitly permitted to use sudo by being added to -## the "sudo" group could exploit such vulnerabilities. For example, this would prevent a -## compromised network-facing daemon (such as web servers, time synchronization daemons, -## etc.) running as its own user from exploiting sudo to escalate privileges. -#/usr/bin/sudo 4750 root sudo -#/bin/sudo 4750 root sudo diff --git a/etc/permission-hardener.d/25_default_whitelist_chromium.conf b/etc/permission-hardener.d/25_default_whitelist_chromium.conf deleted file mode 100644 index 68f54edd..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_chromium.conf +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -chrome-sandbox matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_dbus.conf b/etc/permission-hardener.d/25_default_whitelist_dbus.conf deleted file mode 100644 index 4c185cac..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_dbus.conf +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -dbus-daemon-launch-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_fuse.conf b/etc/permission-hardener.d/25_default_whitelist_fuse.conf deleted file mode 100644 index a8b41b16..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_fuse.conf +++ /dev/null @@ -1,10 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## required for AppImages such as electrum Bitcoin wallet -## https://forums.whonix.org/t/disable-suid-binaries/7706/57 -/fusermount matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_pam.conf b/etc/permission-hardener.d/25_default_whitelist_pam.conf deleted file mode 100644 index f9d8a08f..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_pam.conf +++ /dev/null @@ -1,9 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## Without this, Xfce fails to start with a dbus-launch error. -pam-tmpdir-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_policykit.conf b/etc/permission-hardener.d/25_default_whitelist_policykit.conf deleted file mode 100644 index 227b5fc0..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_policykit.conf +++ /dev/null @@ -1,17 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -/usr/bin/pkexec exactwhitelist -/bin/pkexec exactwhitelist -/usr/bin/pkexec.security-misc-orig exactwhitelist -/bin/pkexec.security-misc-orig exactwhitelist - -## TODO: research -## match both: -#/usr/lib/policykit-1/polkit-agent-helper-1 matchwhitelist -#/lib/policykit-1/polkit-agent-helper-1 -polkit-agent-helper-1 matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_postfix.conf b/etc/permission-hardener.d/25_default_whitelist_postfix.conf deleted file mode 100644 index d15b5643..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_postfix.conf +++ /dev/null @@ -1,9 +0,0 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -postqueue matchwhitelist -postdrop matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_qubes.conf b/etc/permission-hardener.d/25_default_whitelist_qubes.conf deleted file mode 100644 index ec847336..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_qubes.conf +++ /dev/null @@ -1,18 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## TODO: research -## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c -## -## Qubes upstream security issue: -## qfile-unpacker allows unprivileged users in VMs to gain root privileges -## https://github.com/QubesOS/qubes-issues/issues/8633 -## -## match both: -#/usr/lib/qubes/qfile-unpacker whitelist -#/lib/qubes/qfile-unpacker -qfile-unpacker matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_selinux.conf b/etc/permission-hardener.d/25_default_whitelist_selinux.conf deleted file mode 100644 index 0259ef19..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_selinux.conf +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -/utempter/utempter matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_spice.conf b/etc/permission-hardener.d/25_default_whitelist_spice.conf deleted file mode 100644 index 85e01977..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_spice.conf +++ /dev/null @@ -1,8 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -spice-client-glib-usb-acl-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_ssh.conf b/etc/permission-hardener.d/25_default_whitelist_ssh.conf deleted file mode 100644 index 8d9eba5f..00000000 --- a/etc/permission-hardener.d/25_default_whitelist_ssh.conf +++ /dev/null @@ -1,11 +0,0 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Please use "/etc/permission-hardener.d/20_user.conf" or -## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. - -## TODO: research -ssh-agent matchwhitelist -ssh-keysign matchwhitelist -/lib/openssh matchwhitelist diff --git a/etc/profile.d/30_security-misc.sh b/etc/profile.d/30_security-misc.sh deleted file mode 100755 index 41aa6ac0..00000000 --- a/etc/profile.d/30_security-misc.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/sh - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -z "$XDG_CONFIG_DIRS" ]; then - XDG_CONFIG_DIRS=/etc/xdg -fi -if ! echo "$XDG_CONFIG_DIRS" | grep --quiet /usr/share/security-misc/ ; then - export XDG_CONFIG_DIRS=/usr/share/security-misc/:$XDG_CONFIG_DIRS -fi diff --git a/etc/profile.d/30_security-misc.sh#security-misc-shared b/etc/profile.d/30_security-misc.sh#security-misc-shared new file mode 100755 index 00000000..39ee52ba --- /dev/null +++ b/etc/profile.d/30_security-misc.sh#security-misc-shared @@ -0,0 +1,11 @@ +#!/bin/sh + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +if [ -z "$XDG_CONFIG_DIRS" ]; then + XDG_CONFIG_DIRS="/etc:/etc/xdg:/usr/share" +fi +if ! printf '%s\n' "$XDG_CONFIG_DIRS" | grep -- "/usr/share/security-misc/" >/dev/null 2>/dev/null ; then + export XDG_CONFIG_DIRS="/usr/share/security-misc/:$XDG_CONFIG_DIRS" +fi diff --git a/etc/securetty.security-misc b/etc/securetty.security-misc#security-misc-shared similarity index 67% rename from etc/securetty.security-misc rename to etc/securetty.security-misc#security-misc-shared index e32ca296..c98d20d3 100644 --- a/etc/securetty.security-misc +++ b/etc/securetty.security-misc#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. # /etc/securetty: list of terminals on which root is allowed to login. diff --git a/etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared b/etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared new file mode 100644 index 00000000..e8b4b486 --- /dev/null +++ b/etc/security-misc/emerg-shutdown/30_security_misc.conf#security-misc-shared @@ -0,0 +1,34 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/security-misc/emerg-shutdown/50_user.conf" or +## "/usr/local/etc/security-misc/emerg-shutdown/50_user.conf" +## for your custom configuration, which will override the defaults found here. +## When Kicksecure is updated, this file may be overwritten. + +## Set the key combo for forcing immediate shutdown. See the "Keys and +## buttons" section of "/usr/include/linux/input-event-codes.h" for possibly +## supported values. Not all keys are supported. +## +## All specified keys must be depressed at the same time to trigger a +## shutdown. Use a comma (",") to separate keys. If you want to alias certain +## keys to each other from emerg-shutdown's standpoint, use a pipe +## character("|"). +## +## The default key sequence triggers a shutdown when Ctrl+Alt+Delete is +## pressed, allowing the use of either the left or right Ctrl and Alt keys. +EMERG_SHUTDOWN_KEYS="KEY_LEFTCTRL|KEY_RIGHTCTRL,KEY_LEFTALT|KEY_RIGHTALT,KEY_END" + +## Set the maximum number of seconds shutdown can take. If shutdown gets stuck +## for longer than this, the system will forcibly power down. +## +## NOTE: This requires ensure-shutdown.service and +## ensure-shutdown-trigger.service to be enabled, which is not done by +## default. Enabling ensure-shutdown.service will cause shutdown to always +## take at least as long as systemd's DefaultTimeoutStopSec (which by default +## is 90 seconds). If you are going to enable ensure-shutdown.service, it is +## highly recommended to set DefaultTimeoutStopSec to a much smaller value, +## such as 5 seconds. The maximum shutdown time set here should be at least 10 +## seconds *longer* than DefaultTimeoutStopSec, to give normal shutdown a +## chance to actually succeed before forcibly shutting down the system. +ENSURE_SHUTDOWN_TIMEOUT=30 diff --git a/etc/security/access-security-misc.conf b/etc/security/access-security-misc.conf#security-misc-shared similarity index 88% rename from etc/security/access-security-misc.conf rename to etc/security/access-security-misc.conf#security-misc-shared index a78abd1d..d34325e9 100644 --- a/etc/security/access-security-misc.conf +++ b/etc/security/access-security-misc.conf#security-misc-shared @@ -1,8 +1,8 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## To enable root login, see: -## https://www.whonix.org/wiki/Root#Root_Login +## https://www.kicksecure.com/wiki/Root#Root_Login ## Console Lockdown ## https://forums.whonix.org/t/etc-security-hardening/8592 @@ -33,7 +33,7 @@ +:(console):console tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9 ## Same as above also for members of group `sudo`. -## https://github.com/Whonix/security-misc/pull/74#issuecomment-607748407 +## https://github.com/Kicksecure/security-misc/pull/74#issuecomment-607748407 +:(sudo):console tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 ttyS9 ## Everyone else except members of group 'console-unrestricted' diff --git a/etc/security/faillock.conf.security-misc b/etc/security/faillock.conf.security-misc#security-misc-shared similarity index 80% rename from etc/security/faillock.conf.security-misc rename to etc/security/faillock.conf.security-misc#security-misc-shared index d52c1967..4b70cdee 100644 --- a/etc/security/faillock.conf.security-misc +++ b/etc/security/faillock.conf.security-misc#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. # Configuration for locking the user after multiple failed @@ -6,7 +6,7 @@ # # The directory where the user files with the failure records are kept. # The default is /var/run/faillock. -# dir = /var/run/faillock +dir = /var/lib/security-misc/faillock # # Will log the user name into the system log if the user is not found. # Enabled if option is present. @@ -38,14 +38,19 @@ deny = 50 # authentication failures must happen for the user account # lock out is n seconds. # The default is 900 (15 minutes). -# fail_interval = 900 +# security-misc note: the interval should be set to infinity if possible, +# however pam_faillock arbitrarily limits this variable to a maximum of 604800 +# seconds (7 days). See +# https://github.com/linux-pam/linux-pam/blob/539816e4a0a277dbb632412be91e482fff9d9d09/modules/pam_faillock/faillock_config.h#L59 +# for details. Therefore we set this to the maximum allowable value of 7 days. +fail_interval = 604800 # # The access will be re-enabled after n seconds after the lock out. # The value 0 has the same meaning as value `never` - the access # will not be re-enabled without resetting the faillock # entries by the `faillock` command. # The default is 600 (10 minutes). -# unlock_time = 600 +unlock_time = never # # Root account can become locked as well as regular accounts. # Enabled if option is present. diff --git a/etc/security/limits.d/30_security-misc.conf b/etc/security/limits.d/30_security-misc.conf deleted file mode 100644 index 91a08a36..00000000 --- a/etc/security/limits.d/30_security-misc.conf +++ /dev/null @@ -1,5 +0,0 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Disable coredumps. -* hard core 0 diff --git a/etc/security/limits.d/30_security-misc.conf#security-misc-shared b/etc/security/limits.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..632b8736 --- /dev/null +++ b/etc/security/limits.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,7 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Disable core dumps. +## `-` in the second field sets both hard and soft limits at the same time. +## See `man 5 limits.conf`. +* - core 0 diff --git a/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml b/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared similarity index 90% rename from etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml rename to etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared index 0f588ae1..dd943495 100644 --- a/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml +++ b/etc/skel/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml#security-misc-shared @@ -1,6 +1,6 @@ - + diff --git a/etc/skel/.gnupg/gpg.conf b/etc/skel/.gnupg/gpg.conf#security-misc-shared similarity index 100% rename from etc/skel/.gnupg/gpg.conf rename to etc/skel/.gnupg/gpg.conf#security-misc-shared diff --git a/etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared b/etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..67ad1e86 --- /dev/null +++ b/etc/ssh/ssh_config.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Don't edit this file; to overwrite any options, edit a file with a higher +## number that is read earlier by SSH, such as +## '/etc/ssh/ssh_config.d/10_user.conf'. If your configuration changes do not +## need to be system-wide, you may also consider placing overrides in +## ~/.ssh/config. + +## See also: +## https://www.kicksecure.com/wiki/SSH#Client_Configuration_File + +Host * + VisualHostKey yes + ## Ciphers that are Terrapin-vulnerable when an outdated client or server are + ## used are intentionally retained. Connecting to a Terrapin-vulnerable + ## server cannot be made secure (as any Terrapin-vulnerable server will be + ## vulnerable to other issues as well) and is therefore unsupported. + Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr + MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com + ## Only post-quantum-sequre KexAlgorithms are allowed. + KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256 + HostKeyAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519 + PubkeyAcceptedAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519 diff --git a/etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared b/etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..6d52003d --- /dev/null +++ b/etc/ssh/sshd_config.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,80 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Don't edit this file; to overwrite any options, edit a file with a lower +## number that is read earlier by sshd, such as +## '/etc/ssh/sshd_config.d/10_user.conf'. + +## See also: +## https://www.kicksecure.com/wiki/SSH#Server_Configuration_File + +## Number of allowed login attempts per connection. +MaxAuthTries 3 + +## Require strong ciphers and algorithms. +HostKey /etc/ssh/ssh_host_ed25519_key +HostKeyAlgorithms ssh-ed25519 +PubkeyAcceptedAlgorithms ssh-ed25519,sk-ssh-ed25519@openssh.com +## Ciphers that are Terrapin-vulnerable when an outdated client or server are +## used are intentionally retained. Connections from a Terrapin-vulnerable +## client cannot be made secure (as any Terrapin-vulnerable client will be +## vulnerable to other issues as well) and is therefore unsupported. +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com +MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com +## Only post-quantum-sequre KexAlgorithms are allowed. +KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256 + +## Override with 'no' to fully deny root login, or leave this as +## 'prohibit-password' for denying root password login but still allowing +## other authentication methods such as public key. +PermitRootLogin prohibit-password + +## Public key authentication is transparent, non-interactive and more secure. +PasswordAuthentication no + +## Change to 'yes' to enable challenge-response passwords (beware issues with +## some PAM modules and threads) +KbdInteractiveAuthentication no + +## PAM can be used for account and session processing when using +## ChallengeResponseAuthentication or PasswordAuthentication. +## +## Depending on your PAM configuration, PAM authentication via +## ChallengeResponseAuthentication may bypass the setting of "PermitRootLogin +## without-password". +## +## If you want PAM account and session checks to run without PAM +## authentication, then enable this but set PasswordAuthentication and +## ChallengeResponseAuthentication to 'no'. +## +## The default upstream is 'no', Debian sets this to 'yes'. If using a locked +## account, read: +## https://www.kicksecure.com/wiki/SSH#SSH_Login_Comparison_Table +## We set it to 'yes' to work with libpam-tmpdir. +## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#libpam-tmpdir +## Also folders such as '/run/user/1000' will exist thanks to PAM. +## The absence of that folder can lead to issues (such as with msgcollector). +UsePAM yes + +## Block dangerous forwarding. +AllowAgentForwarding no +AllowTcpForwarding no +X11Forwarding no + +## Hide unnecessary login banners. +PrintMotd no +#Banner /etc/issue.net +#Hiding Debian version from SSH banner (obscurity) +DebianBanner no + +## Some options are dangerous but may be required in certain circumstances. As +## an example, if forwarding is required, selectively allow it with a 'Match' +## block. Consider a new separate user named 'tunnel' which wants to forward +## its local port to be available on the server on port 443. Note that a +## tunnel user doesn't even require a TTY nor a shell, so don't forget to +## change the 'tunnel' shell to something that prevents login such as +## '/usr/sbin/nologin'. +#Match User tunnel +# AllowTcpForwarding yes +# PermitListen localhost:443 +# PermitTTY no diff --git a/etc/sudoers.d/pkexec-security-misc b/etc/sudoers.d/pkexec-security-misc deleted file mode 100644 index bd78bde9..00000000 --- a/etc/sudoers.d/pkexec-security-misc +++ /dev/null @@ -1,11 +0,0 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## REVIEW: is it ok that users can find out the PATH setting of root? -#%sudo ALL=NOPASSWD: /usr/libexec/security-misc/echo-path - -## xfpm-power-backlight-helper demands environment variable PKEXEC_UID to be -## set. Would otherwise error out with the following error message: -## "This program must only be run through pkexec" -## REVIEW: Can bad things be done by spoofing PKEXEC_UID? -#Defaults:ALL env_keep += "PKEXEC_UID" diff --git a/etc/sudoers.d/security-misc b/etc/sudoers.d/security-misc deleted file mode 100644 index 7084b1f2..00000000 --- a/etc/sudoers.d/security-misc +++ /dev/null @@ -1,5 +0,0 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -user ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops -%sudo ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops diff --git a/etc/sudoers.d/security-misc#security-misc-shared b/etc/sudoers.d/security-misc#security-misc-shared new file mode 100644 index 00000000..1fa2146e --- /dev/null +++ b/etc/sudoers.d/security-misc#security-misc-shared @@ -0,0 +1,12 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Neither of these are needed. +#user ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops +#%sudo ALL=NOPASSWD: /usr/libexec/security-misc/panic-on-oops + +## Use a more open umask when executing commands with sudo +## Can be overridden on a per-user basis using .[z]profile if desirable +## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#umask_hardening +Defaults umask_override +Defaults umask=0022 diff --git a/etc/sudoers.d/security-misc-desktop#security-misc-desktop b/etc/sudoers.d/security-misc-desktop#security-misc-desktop new file mode 100644 index 00000000..cab7ca7c --- /dev/null +++ b/etc/sudoers.d/security-misc-desktop#security-misc-desktop @@ -0,0 +1,6 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Don't attempt to determine the local machine's FQDN via DNS. This can leak +## the machine's hostname in cleartext to the configured DNS server. +Defaults !fqdn diff --git a/etc/sudoers.d/xfce-security-misc b/etc/sudoers.d/xfce-security-misc deleted file mode 100644 index 3d26d7b9..00000000 --- a/etc/sudoers.d/xfce-security-misc +++ /dev/null @@ -1,19 +0,0 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://forums.whonix.org/t/xfce4-power-manager-xfpm-power-backlight-helper-pkexec-lxsudo-popup/8764 -## /usr/share/polkit-1/actions/org.xfce.power.policy - -## Feel free to out comment this if you are not using xfce4-power-manager or Xfce. - -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]] -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]] -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]][[\:digit\:]] - -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]] -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]] -#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]][[\:digit\:]] - -## XXX: Should we allow this? -#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --suspend -#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --hibernate diff --git a/etc/systemd/system/rescue.service.d/override.conf b/etc/systemd/system/emergency.service.d/override.conf#security-misc-shared similarity index 76% rename from etc/systemd/system/rescue.service.d/override.conf rename to etc/systemd/system/emergency.service.d/override.conf#security-misc-shared index a7d44699..42fefd44 100644 --- a/etc/systemd/system/rescue.service.d/override.conf +++ b/etc/systemd/system/emergency.service.d/override.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 diff --git a/etc/systemd/system/emergency.service.d/override.conf b/etc/systemd/system/rescue.service.d/override.conf#security-misc-shared similarity index 76% rename from etc/systemd/system/emergency.service.d/override.conf rename to etc/systemd/system/rescue.service.d/override.conf#security-misc-shared index a7d44699..42fefd44 100644 --- a/etc/systemd/system/emergency.service.d/override.conf +++ b/etc/systemd/system/rescue.service.d/override.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211 diff --git a/etc/thunderbird/pref/40_security-misc.js b/etc/thunderbird/pref/40_security-misc.js deleted file mode 100644 index 49df52d7..00000000 --- a/etc/thunderbird/pref/40_security-misc.js +++ /dev/null @@ -1,59 +0,0 @@ -//#### Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -//#### See the file COPYING for copying conditions. - -//#### meta start -//#### project Whonix and Kicksecure -//#### category security and apps -//#### description https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415 -//#### meta end - -// https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415 -pref("network.IDN_show_punycode", true); - -// Disable all and any kind of telemetry by default -pref("toolkit.telemetry.enabled", false); -pref("toolkit.telemetry.unified", false); -pref("toolkit.telemetry.shutdownPingSender.enabled", false); -pref("toolkit.telemetry.updatePing.enabled", false); -pref("toolkit.telemetry.archive.enabled", false); -pref("toolkit.telemetry.bhrPing.enabled", false); -pref("toolkit.telemetry.firstShutdownPing.enabled", false); -pref("toolkit.telemetry.newProfilePing.enabled", false); -pref("toolkit.telemetry.server", ""); // Defense in depth -pref("toolkit.telemetry.server_owner", ""); // Defense in depth -pref("datareporting.healthreport.uploadEnabled", false); -pref("datareporting.policy.dataSubmissionEnabled", false); -pref("toolkit.telemetry.coverage.opt-out", true); // from Firefox -pref("toolkit.coverage.opt-out", true); // from Firefox - -// Disable implicit outbound traffic -pref("network.connectivity-service.enabled", false); -pref("network.prefetch-next", false); -pref("network.dns.disablePrefetch", true); -pref("network.predictor.enabled", false); - -// No need to explain the problems with javascript -// If you want javascript, use your browser -// Thunderbird needs no javascript -// pref("javascript.enabled", false); // Will break setting up services that require redirecting to their javascripted webpage for login, like gmail etc. So commented out for now. - -// Disable scripting when viewing pdf files -user_pref("pdfjs.enableScripting", false); - -// If you want cookies, use your browser -pref("network.cookie.cookieBehavior", 2); - -// Do not send user agent information -// For email clients, this is more like a relic of the past -// Completely not necessary and just exposes a lot of information about the client -// Since v115.0 Thunderbird already minimizes the user agent -// But we want it gone for good for no information leak at all -// https://hg.mozilla.org/comm-central/rev/cbbbc8d93cd7 -pref("mailnews.headers.sendUserAgent", false); - -// Normally we send emails after marking them with a time stamp -// That includes our local time zone -// This option makes our local time zone appear as UTC -// And rounds the time stamp to the closes minute -// https://hg.mozilla.org/comm-central/rev/98aa0bf2e719 -pref("mail.sanitize_date_header", true); diff --git a/etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared b/etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared new file mode 100644 index 00000000..1d7596d4 --- /dev/null +++ b/etc/usbguard/IPCAccessControl.d/:qubes#security-misc-shared @@ -0,0 +1 @@ +Devices=listen,list,modify diff --git a/etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared b/etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared new file mode 100644 index 00000000..1d7596d4 --- /dev/null +++ b/etc/usbguard/IPCAccessControl.d/:sudo#security-misc-shared @@ -0,0 +1 @@ +Devices=listen,list,modify diff --git a/etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared b/etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..7315d9d5 --- /dev/null +++ b/etc/usbguard/rules.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,76 @@ +## We allow devices that were plugged in before the daemon starts. Everything +## is blocked as the default. Following rules apply on top of this. + +## First match wins. Therefore, reject rules should be on the top. +## Quote: +## https://usbguard.github.io/documentation/rule-language +## > the daemon scans the existing rules sequentially + +## Explicitly reject any interface that is not documented and/or defined by +## USB.org. +## Note: Most probably superfluous. +reject with-interface none-of { 00:*:* 01:*:* 02:*:* 03:*:* 05:*:* 06:*:* 07:*:* 08:*:* 09:*:* 0a:*:* 0b:*:* 0d:*:* 0e:*:* 0f:*:* 10:*:* 11:*:* 12:*:* 13:*:* 14:*:* 3c:*:* dc:*:* e0:*:* ef:*:* fe:*:* ff:*:* } + +## Explicitly reject any device with a mouse/keyboard interface in +## combination with some other interface. +## Mice and keyboards should likely never have non-HID interfaces provided +## alongside them. +reject with-interface all-of { 03:*:* 00:*:* } +reject with-interface all-of { 03:*:* 01:*:* } +reject with-interface all-of { 03:*:* 02:*:* } +reject with-interface all-of { 03:*:* 05:*:* } +reject with-interface all-of { 03:*:* 06:*:* } +reject with-interface all-of { 03:*:* 07:*:* } +reject with-interface all-of { 03:*:* 08:*:* } +reject with-interface all-of { 03:*:* 09:*:* } +reject with-interface all-of { 03:*:* 0a:*:* } +reject with-interface all-of { 03:*:* 0b:*:* } +reject with-interface all-of { 03:*:* 0d:*:* } +reject with-interface all-of { 03:*:* 0e:*:* } +reject with-interface all-of { 03:*:* 0f:*:* } +reject with-interface all-of { 03:*:* 10:*:* } +reject with-interface all-of { 03:*:* 11:*:* } +reject with-interface all-of { 03:*:* 12:*:* } +reject with-interface all-of { 03:*:* 13:*:* } +reject with-interface all-of { 03:*:* 14:*:* } +reject with-interface all-of { 03:*:* 3c:*:* } +reject with-interface all-of { 03:*:* dc:*:* } +reject with-interface all-of { 03:*:* e0:*:* } +reject with-interface all-of { 03:*:* ef:*:* } +reject with-interface all-of { 03:*:* fe:*:* } +reject with-interface all-of { 03:*:* ff:*:* } + +## Explicitly reject any device with an RNDIS interface. RNDIS is believed to +## have protocol-level buffer overflow vulnerabilities that cannot be fixed. +reject with-interface one-of { ef:04:* } + +## Allow all mouses and keyboards, in a sense, so the user can conveniently +## change them without restrating the daemon. + +## Allow only one keyboard to be connected +allow with-interface equals { 03:01:01 } if !allowed-matches(with-interface equals { 03:01:01 }) +## Allow only one mouse to be connected +allow with-interface equals { 03:01:02 } if !allowed-matches(with-interface equals { 03:01:02 }) +## NOTE: Some HID devices will have an interface of 03:00:00 - these are HID +## devices that do not support a "boot interface". **These are blocked +## entirely.** It is very likely that this will cause issues with some mice +## and keyboards. Also note, all HID devices other than mice and keyboards +## will be blocked, **including touchscreens.** + +## Allow USB audio devices. The intended functionality of these devices is +## unlikely to be usable in a malicious capacity without having already +## compromised the machine. +allow with-interface equals { 01:*:* } + +## Allow USB video devices (i.e. webcams). Also tricky to use in a malicious +## manner without having already compromised the machine. +allow with-interface equals { 0e:*:* } + +## Allow USB mass storage, if and only if the USB device only has the mass +## storage interface and nothing extra. +## Suspicious interface combinations with mass storage are blocked. +allow with-interface equals { 08:*:* } + +## Allow USB hubs, these are likely safe and are required for Qubes OS USB +## passthrough to work. +allow with-interface equals { 09:*:* } diff --git a/etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared b/etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared new file mode 100644 index 00000000..f2c1406b --- /dev/null +++ b/etc/usbguard/usbguard-daemon.conf.security-misc#security-misc-shared @@ -0,0 +1,218 @@ +# +# Rule set file path. +# +# The USBGuard daemon will use this file to load the policy +# rule set from it and to write new rules received via the +# IPC interface. +# +# RuleFile=/path/to/rules.conf +# +RuleFile=/etc/usbguard/rules.conf + +# +# Rule set folder path. +# +# The USBGuard daemon will use this folder to load the policy +# rule set from it and to write new rules received via the +# IPC interface. Usually, we set the option to +# /etc/usbguard/rules.d/. The USBGuard daemon is supposed to +# behave like any other standard Linux daemon therefore it +# loads rule files in alphanumeric order. File names inside +# RuleFolder directory should start with a two-digit number +# prefix indicating the position, in which the rules are +# scanned by the daemon. +# +# RuleFolder=/path/to/rulesfolder/ +# +RuleFolder=/etc/usbguard/rules.d/ + + + +# +# Implicit policy target. +# +# How to treat devices that don't match any rule in the +# policy. One of: +# +# * allow - authorize the device +# * block - block the device +# * reject - remove the device +# +ImplicitPolicyTarget=block + +# +# Present device policy. +# +# How to treat devices that are already connected when the +# daemon starts. One of: +# +# * allow - authorize every present device +# * block - deauthorize every present device +# * reject - remove every present device +# * keep - just sync the internal state and leave it +# * apply-policy - evaluate the ruleset for every present +# device +# +# Overridden by Kicksecure to allow all devices that are connected at startup. +# +PresentDevicePolicy=allow + +# +# Present controller policy. +# +# How to treat USB controllers that are already connected +# when the daemon starts. One of: +# +# * allow - authorize every present device +# * block - deauthorize every present device +# * reject - remove every present device +# * keep - just sync the internal state and leave it +# * apply-policy - evaluate the ruleset for every present +# device +# +PresentControllerPolicy=keep + +# +# Inserted device policy. +# +# How to treat USB devices that are already connected +# *after* the daemon starts. One of: +# +# * block - deauthorize every present device +# * reject - remove every present device +# * apply-policy - evaluate the ruleset for every present +# device +# +InsertedDevicePolicy=apply-policy + +# +# Control which devices are authorized by default. +# +# The USBGuard daemon modifies some the default authorization state attributes +# of controller devices. This setting, enables you to define what value the +# default authorization is set to. +# +# * keep - do not change the authorization state +# * none - every new device starts out deauthorized +# * all - every new device starts out authorized +# * internal - internal devices start out authorized, external devices start +# out deauthorized (this requires the ACPI tables to properly +# label internal devices, and kernel support) +# +AuthorizedDefault=none + +# +# Restore controller device state. +# +# The USBGuard daemon modifies some attributes of controller +# devices like the default authorization state of new child device +# instances. Using this setting, you can control whether the +# daemon will try to restore the attribute values to the state +# before modification on shutdown. +# +# SECURITY CONSIDERATIONS: If set to true, the USB authorization +# policy could be bypassed by performing some sort of attack on the +# daemon (via a local exploit or via a USB device) to make it shutdown +# and restore to the operating-system default state (known to be permissive). +# +RestoreControllerDeviceState=false + +# +# Device manager backend +# +# Which device manager backend implementation to use. One of: +# +# * uevent - Netlink based implementation which uses sysfs to scan for present +# devices and an uevent netlink socket for receiving USB device +# related events. +# * umockdev - umockdev based device manager capable of simulating devices based +# on umockdev-record files. Useful for testing. +# +DeviceManagerBackend=uevent + +#!!! WARNING: It's good practice to set at least one of the !!! +#!!! two options below. If none of them are set, !!! +#!!! the daemon will accept IPC connections from !!! +#!!! anyone, thus allowing anyone to modify the !!! +#!!! rule set and (de)authorize USB devices. !!! + +# +# Users allowed to use the IPC interface. +# +# A space delimited list of usernames that the daemon will +# accept IPC connections from. +# +# IPCAllowedUsers=username1 username2 ... +# +IPCAllowedUsers=root + +# +# Groups allowed to use the IPC interface. +# +# A space delimited list of groupnames that the daemon will +# accept IPC connections from. +# +# IPCAllowedGroups=groupname1 groupname2 ... +# +IPCAllowedGroups=root plugdev + +# +# IPC access control definition files path. +# +# The files at this location will be interpreted by the USBGuard +# daemon as access control definition files for the IPC interface. +# The (base)name of a file should be in the form: +# +# [user][:] +# +# where user is either username or UID and group is either groupname or GID. +# IPC access control files should contain lines in the form: +# +#
=[privilege1][,privilege2] ... +# +# This way each file defines who is able to connect to the IPC +# bus and what privileges he has. Note that the IPC access control +# files need to have file permissions set to 0600. +# +IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/ + +# +# Generate device specific rules including the "via-port" +# attribute. +# +# This option modifies the behavior of the allowDevice +# action. When instructed to generate a permanent rule, +# the action can generate a port specific rule. Because +# some systems have unstable port numbering, the generated +# rule might not match the device after rebooting the system. +# +# If set to false, the generated rule will still contain +# the "parent-hash" attribute which also defines an association +# to the parent device. See usbguard-rules.conf(5) for more +# details. +# +DeviceRulesWithPort=false + +# +# USBGuard Audit events log backend +# +# One of: +# +# * FileAudit - Log audit events into a file specified by +# AuditFilePath setting (see below) +# * LinuxAudit - Log audit events using the Linux Audit +# subsystem (using audit_log_user_message) +# +AuditBackend=FileAudit + +# +# USBGuard audit events log file path. +# +AuditFilePath=/var/log/usbguard/usbguard-audit.log + +# +# Hides personally identifiable information such as device serial numbers and +# hashes of descriptors (which include the serial number) from audit entries. +# +HidePII=false + diff --git a/usr/bin/disabled-bluetooth-by-security-misc b/usr/bin/disabled-bluetooth-by-security-misc deleted file mode 100755 index d576b261..00000000 --- a/usr/bin/disabled-bluetooth-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This Bluetooth kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared b/usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared new file mode 100755 index 00000000..f52a6b1d --- /dev/null +++ b/usr/bin/disabled-bluetooth-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Bluetooth kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-cdrom-by-security-misc b/usr/bin/disabled-cdrom-by-security-misc deleted file mode 100755 index af27e08f..00000000 --- a/usr/bin/disabled-cdrom-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This CD-ROM/DVD kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-cdrom-by-security-misc#security-misc-shared b/usr/bin/disabled-cdrom-by-security-misc#security-misc-shared new file mode 100755 index 00000000..bb4db834 --- /dev/null +++ b/usr/bin/disabled-cdrom-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This CD-ROM/DVD kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared b/usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared new file mode 100755 index 00000000..7e5bdadd --- /dev/null +++ b/usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This CPU MSR kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-filesys-by-security-misc b/usr/bin/disabled-filesys-by-security-misc deleted file mode 100755 index faffe585..00000000 --- a/usr/bin/disabled-filesys-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This file system kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-filesys-by-security-misc#security-misc-shared b/usr/bin/disabled-filesys-by-security-misc#security-misc-shared new file mode 100755 index 00000000..d85a951a --- /dev/null +++ b/usr/bin/disabled-filesys-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This file system kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-firewire-by-security-misc b/usr/bin/disabled-firewire-by-security-misc deleted file mode 100755 index 4886755e..00000000 --- a/usr/bin/disabled-firewire-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This FireWire (IEEE 1394) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-firewire-by-security-misc#security-misc-shared b/usr/bin/disabled-firewire-by-security-misc#security-misc-shared new file mode 100755 index 00000000..ecd429e1 --- /dev/null +++ b/usr/bin/disabled-firewire-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This FireWire (IEEE 1394) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-framebuffer-by-security-misc b/usr/bin/disabled-framebuffer-by-security-misc deleted file mode 100755 index 681bc409..00000000 --- a/usr/bin/disabled-framebuffer-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2024 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This framebuffer (fbdev) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared b/usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared new file mode 100755 index 00000000..97e5869a --- /dev/null +++ b/usr/bin/disabled-framebuffer-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This framebuffer (fbdev) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-gps-by-security-misc b/usr/bin/disabled-gps-by-security-misc deleted file mode 100755 index 51997c10..00000000 --- a/usr/bin/disabled-gps-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This Global Positioning System (GPS) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-gps-by-security-misc#security-misc-shared b/usr/bin/disabled-gps-by-security-misc#security-misc-shared new file mode 100755 index 00000000..9a29b36d --- /dev/null +++ b/usr/bin/disabled-gps-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Global Positioning System (GPS) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-intelme-by-security-misc b/usr/bin/disabled-intelme-by-security-misc deleted file mode 100755 index dc2bb727..00000000 --- a/usr/bin/disabled-intelme-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This Intel Management Engine (ME) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-intelme-by-security-misc#security-misc-shared b/usr/bin/disabled-intelme-by-security-misc#security-misc-shared new file mode 100755 index 00000000..b50fbbd0 --- /dev/null +++ b/usr/bin/disabled-intelme-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Intel Management Engine (ME) kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-intelpmt-by-security-misc b/usr/bin/disabled-intelpmt-by-security-misc deleted file mode 100755 index 76daa06d..00000000 --- a/usr/bin/disabled-intelpmt-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2024 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This Intel Platform Monitoring Technology (PMT) Telemetry kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared b/usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared new file mode 100755 index 00000000..edee2680 --- /dev/null +++ b/usr/bin/disabled-intelpmt-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Intel Platform Monitoring Technology (PMT) Telemetry kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-miscellaneous-by-security-misc b/usr/bin/disabled-miscellaneous-by-security-misc deleted file mode 100755 index 6eff13c8..00000000 --- a/usr/bin/disabled-miscellaneous-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared b/usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared new file mode 100755 index 00000000..04b627c8 --- /dev/null +++ b/usr/bin/disabled-miscellaneous-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-netfilesys-by-security-misc b/usr/bin/disabled-netfilesys-by-security-misc deleted file mode 100755 index 8775acbf..00000000 --- a/usr/bin/disabled-netfilesys-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This network file system kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared b/usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared new file mode 100755 index 00000000..de4db437 --- /dev/null +++ b/usr/bin/disabled-netfilesys-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This network file system kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-network-by-security-misc b/usr/bin/disabled-network-by-security-misc deleted file mode 100755 index a6a87db4..00000000 --- a/usr/bin/disabled-network-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This network protocol kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-network-by-security-misc#security-misc-shared b/usr/bin/disabled-network-by-security-misc#security-misc-shared new file mode 100755 index 00000000..3d2e342a --- /dev/null +++ b/usr/bin/disabled-network-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This network protocol kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/disabled-thunderbolt-by-security-misc b/usr/bin/disabled-thunderbolt-by-security-misc deleted file mode 100755 index 5bac6568..00000000 --- a/usr/bin/disabled-thunderbolt-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. - -echo "$0: ALERT: This Thunderbolt kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 - -exit 1 diff --git a/usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared b/usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared new file mode 100755 index 00000000..faa380bc --- /dev/null +++ b/usr/bin/disabled-thunderbolt-by-security-misc#security-misc-shared @@ -0,0 +1,17 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "$0: ALERT: This Thunderbolt kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $*" >&2 + +exit 1 diff --git a/usr/bin/fm-shim-frontend#security-misc-shared b/usr/bin/fm-shim-frontend#security-misc-shared new file mode 100755 index 00000000..fadcd9e0 --- /dev/null +++ b/usr/bin/fm-shim-frontend#security-misc-shared @@ -0,0 +1,10 @@ +#!/usr/bin/python3 -Bsu + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Shell-invocation guard. +"exec" "bash" "-c" "printf '%s\n' '$0: ERROR: Do not execute this script with bash!' >&2; exit 1" + +from fm_shim_frontend.fm_shim_frontend import main +main() diff --git a/usr/bin/permission-hardener b/usr/bin/permission-hardener deleted file mode 100755 index ad6f9b80..00000000 --- a/usr/bin/permission-hardener +++ /dev/null @@ -1,742 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://forums.whonix.org/t/disable-suid-binaries/7706 -## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 - -## dpkg-statoverride does not support end-of-options ("--"). - -set -o errexit -o nounset -o pipefail - -exit_code=0 -store_dir="/var/lib/permission-hardener" -dpkg_admindir_parameter_existing_mode="--admindir ${store_dir}/existing_mode" -dpkg_admindir_parameter_new_mode="--admindir ${store_dir}/new_mode" -delimiter="#permission-hardener-delimiter#" - -# shellcheck disable=SC1091 -source /usr/libexec/helper-scripts/safe_echo.sh -# shellcheck disable=SC2034 -log_level=notice -# shellcheck disable=SC1091 -source /usr/libexec/helper-scripts/log_run_die.sh - -echo_wrapper_ignore() { - if test "${1}" = "verbose"; then - shift - log notice "Run: $*" - else - shift - fi - "$@" 2>/dev/null || true -} - -echo_wrapper_audit() { - if test "${1}" = "verbose"; then - shift - log notice "Run: $*" - else - shift - fi - return_code=0 - "$@" || - { - return_code="$?" - exit_code=203 - log error "Command '$*' failed with exit code '${return_code}'! calling function name: '${FUNCNAME[1]}'" >&2 - } -} - -make_store_dir(){ - mkdir --parents "${store_dir}/private" - mkdir --parents "${store_dir}/existing_mode" - mkdir --parents "${store_dir}/new_mode" -} - -## Some tools may fail on newlines and even variable assignment to array may -## fail if a variable that will be assigned to an array element contains -## characters that are used as delimiters. -block_newlines(){ - local newline_variable newline_value - newline_variable="${1}" - newline_value="${2}" - ## dpkg-statoverride: error: path may not contain newlines - #if [[ "${newline_value}" == *$'\n'* ]]; then - if [[ "${newline_value}" != "${newline_value//$'\n'/NEWLINE}" ]]; then - log warn "Skipping ${newline_variable} that contains newlines: '${newline_value}'" >&2 - return 1 - fi -} - -output_stat(){ - local file_name - file_name="${1}" - - if test -z "${file_name}"; then - log error "File name is empty. file_name: '${file_name}'" >&2 - return 1 - fi - - block_newlines file "${file_name}" - - ## dpkg-statoverride can actually handle '--file-name'. -# if [[ $file_name == --* ]]; then -# log warn "File name starts with '--'. This would be interpreted by dpkg-statoverride as an option. Skipping. file_name: '${file_name}'" >&2 -# return 1 -# fi - - declare -a arr - local file_name_from_stat stat_output stat_output_newlined - - if ! stat_output="$(stat --format="%a${delimiter}%U${delimiter}%G${delimiter}%n${delimiter}" -- "${file_name}")"; then - log error "Failed to run 'stat' on file: '${file_name}'!" >&2 - return 1 - fi - - if [ "$stat_output" = "" ]; then - log error "stat_output is empty. -File name: '${file_name}' -Stat output: '${stat_output}' -stat_output_newlined: '${stat_output_newlined}' -line: '${line}' -" >&2 - return 1 - fi - - stat_output_newlined="$(printf '%s\n' "${stat_output//${delimiter}/$'\n'}")" - - if test "${stat_output_newlined}" = ""; then - log error "stat_output_newlined is empty. -File name: '${file_name}' -Stat output: '${stat_output}' -stat_output_newlined: '${stat_output_newlined}' -line: '${line}' -" >&2 - return 1 - fi - - readarray -t arr <<< "${stat_output_newlined}" - - if test "${#arr[@]}" = 0; then - log error "Array length is 0. -File name: '${file_name}' -Stat output: '${stat_output}' -stat_output_newlined: '${stat_output_newlined}' -line: '${line}' -" >&2 - return 1 - fi - - existing_mode="${arr[0]}" - existing_owner="${arr[1]}" - existing_group="${arr[2]}" - file_name_from_stat="${arr[3]}" - - if [ ! "$file_name" = "$file_name_from_stat" ]; then - log error "\ -File name is different from file name received from stat: -File name: '${file_name}' -File name from stat: '${file_name_from_stat}' -line: '${line}' -" >&2 - return 1 - fi - - if test -z "${existing_mode}"; then - log error "Existing mode is empty. Stat output: '${stat_output}', line: '${line}'" >&2 - return 1 - fi - if test -z "${existing_owner}"; then - log error "Existing owner is empty. Stat output: '${stat_output}', line: '${line}'" >&2 - return 1 - fi - if test -z "${existing_group}"; then - log error "Existing group is empty. Stat output: '${stat_output}', line: '${line}'" >&2 - return 1 - fi -} - -sanity_tests() { - echo_wrapper_audit silent \ - which \ - capsh getcap setcap stat find dpkg-statoverride getent grep 1>/dev/null -} - -add_nosuid_statoverride_entry() { - local fso_to_process - fso_to_process="${fso}" - local should_be_counter - should_be_counter=0 - local counter_actual - counter_actual=0 - - local dummy_line - while IFS="" read -r -d "" dummy_line; do - log info "Test would parse line: '${dummy_line}'" - should_be_counter=$((should_be_counter + 1)) - done < <(safe_echo_nonewline "${fso_to_process}" | find -files0-from - -perm /u=s,g=s -print0) - ## False positive on SC2185 (find without path argument) #1748 - ## https://github.com/koalaman/shellcheck/issues/1748 - ## - ## /usr/lib will hit ARG_MAX if using bash 'shopt -s globstar' and '/usr/lib/**'. - ## Using 'find' with '-perm /u=s,g=s' is faster and avoids ARG_MAX. - ## https://forums.whonix.org/t/disable-suid-binaries/7706/17 - - local line - while IFS="" read -r -d "" file_name; do - counter_actual=$((counter_actual + 1)) - - ## sets: - ## exiting_mode - ## existing_owner - ## existing_group - output_stat "${file_name}" - - ## -h file True if file is a symbolic Link. - ## -u file True if file has its set-user-id bit set. - ## -g file True if file has its set-group-id bit set. - - if test -h "${file_name}"; then - ## https://forums.whonix.org/t/disable-suid-binaries/7706/14 - log info "Skip symlink: '${file_name}'" - continue - fi - - if test -d "${file_name}"; then - log info "Skip directory: '${file_name}'" - continue - fi - - local setuid setgid - setuid="" - if test -u "${file_name}"; then - setuid=true - fi - setgid="" - if test -g "${file_name}"; then - setgid=true - fi - - local setuid_or_setgid - setuid_or_setgid="" - if test "${setuid}" = "true" || test "${setgid}" = "true"; then - setuid_or_setgid=true - fi - if test -z "${setuid_or_setgid}"; then - log info "Neither setuid nor setgid. Skipping. file_name: '${file_name}'" - continue - fi - - ## Remove suid / gid and execute permission for 'group' and 'others'. - ## Similar to: chmod og-ugx /path/to/filename - ## Removing execution permission is useful to make binaries such as 'su' - ## fail closed rather than fail open if suid was removed from these. - ## Do not remove read access since no security benefit and easier to - ## manually undo for users. - ## Are there suid or sgid binaries which are still useful if suid / sgid - ## has been removed from these? - new_mode="744" - - local is_exact_whitelisted - is_exact_whitelisted="" - for white_list_entry in "${exact_white_list[@]:-}"; do - if test -z "${white_list_entry}"; then - log info "white_list_entry unset. Skipping. file_name: '${file_name}'" - continue - fi - if test "${file_name}" = "${white_list_entry}"; then - is_exact_whitelisted="true" - log info "is_exact_whitelisted=true. Skipping. file_name: '${file_name}'" - ## Stop looping through the whitelist. - break - fi - done - - local is_match_whitelisted - is_match_whitelisted="" - for matchwhite_list_entry in "${match_white_list[@]:-}"; do - if test -z "${matchwhite_list_entry}"; then - log info "matchwhite_list_entry unset. Skipping. file_name: '${file_name}'" - continue - fi - if safe_echo "${file_name}" | grep --quiet --fixed-strings -- "${matchwhite_list_entry}"; then - is_match_whitelisted="true" - log info "is_match_whitelisted=true. Skipping. file_name: '${file_name}'" - ## Stop looping through the match_white_list. - break - fi - done - - local is_disable_whitelisted - is_disable_whitelisted="" - for disablematch_list_entry in "${disable_white_list[@]:-}"; do - if test -z "${disablematch_list_entry}"; then - log info "disablematch_list_entry unset. Skipping. file_name: '${file_name}'" - continue - fi - if safe_echo "${file_name}" | grep --quiet --fixed-strings -- "${disablematch_list_entry}"; then - is_disable_whitelisted="true" - log info "is_disable_whitelisted=true. Skipping. file_name: '${file_name}'" - ## Stop looping through the disablewhitelist. - break - fi - done - - local clean_output_prefix clean_output - clean_output_prefix="Managing (S|G)UID of line:" - clean_output="${setuid:+setuid='true'} ${setgid:+setgid='true'} existing_mode='${existing_mode}' new_mode='${new_mode}' file='${file_name}'" - if test "${whitelists_disable_all:-}" = "true"; then - log info "${clean_output_prefix} whitelists_disable_all=true ${clean_output}" - elif test "${is_disable_whitelisted}" = "true"; then - log info "${clean_output_prefix} is_disable_whitelisted=true ${clean_output}" - else - if test "${is_exact_whitelisted}" = "true"; then - log info "${clean_output_prefix} is_exact_whitelisted=true ${clean_output}" - continue - fi - if test "${is_match_whitelisted}" = "true"; then - log info "${clean_output_prefix} is_match_whitelisted=true matchwhite_list_entry='${matchwhite_list_entry}' ${clean_output}" - continue - fi - fi - - log notice "${clean_output_prefix} ${clean_output}" - - # shellcheck disable=SC2086 - if dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --list "${file_name}" >/dev/null; then - log info "Existing mode already saved previously. Not saving again." - else - ## Save existing_mode in separate database. - ## Not using --update as not intending to enforce existing_mode. - # shellcheck disable=SC2086 - echo_wrapper_audit silent dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --add "${existing_owner}" "${existing_group}" "${existing_mode}" "${file_name}" - fi - - ## No need to check "dpkg-statoverride --list" for existing entries. - ## If existing_mode was correct already, we would not have reached this - ## point. Since existing_mode is incorrect, remove from dpkg-statoverride - ## and re-add. - - ## Remove from real database. - echo_wrapper_ignore silent dpkg-statoverride --remove "${file_name}" - - ## Remove from separate database. - # shellcheck disable=SC2086 - echo_wrapper_ignore silent dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --remove "${file_name}" - - ## Add to real database and use --update to make changes on disk. - echo_wrapper_audit verbose dpkg-statoverride --add --update "${existing_owner}" "${existing_group}" "${new_mode}" "${file_name}" - - ## Not using --update as this is only for recording. - # shellcheck disable=SC2086 - echo_wrapper_audit silent dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --add "${existing_owner}" "${existing_group}" "${new_mode}" "${file_name}" - done < <(safe_echo_nonewline "${fso_to_process}" | find -files0-from - -perm /u=s,g=s -print0) - - ## Sanity test. - if test ! "${should_be_counter}" = "${counter_actual}"; then - log info "File (parsed/wanted): '${fso_to_process}': (${counter_actual}/${should_be_counter})" - log error "Expected number of files to be parsed was not met." >&2 - exit_code=202 - fi -} - -set_file_perms() { - log info "START parsing config file: '${config_file}'" - - local line - while read -r line || test -n "${line}"; do - if test -z "${line}"; then - true "DEBUG: line is empty. Skipping." - continue - fi - - if [[ "${line}" =~ ^\s*# ]]; then - continue - fi - - if ! [[ "${line}" =~ [0-9a-zA-Z/] ]]; then - exit_code=200 - log error "Line contains invalid characters: '${line}'" >&2 - ## Safer to exit with error in this case. - ## https://forums.whonix.org/t/disable-suid-binaries/7706/59 - exit "${exit_code}" - fi - - if test "${line}" = 'whitelists_disable_all=true'; then - whitelists_disable_all=true - log info "whitelists_disable_all=true" - continue - fi - - #global fso - local mode_from_config owner_from_config group_from_config capability_from_config - if ! read -r fso mode_from_config owner_from_config group_from_config capability_from_config <<<"${line}"; then - exit_code=201 - log error "Cannot parse line: '${line}'" >&2 - ## Debugging. - du -hs /tmp || true - safe_echo "test -w /tmp: '$(test -w /tmp)'" >&2 || true - ## Safer to exit with error in this case. - ## https://forums.whonix.org/t/disable-suid-binaries/7706/59 - exit "${exit_code}" - fi - - log info "Parsing line: fso='${fso}' mode_from_config='${mode_from_config}' owner_from_config='${owner_from_config}' group_from_config='${group_from_config}' capability_from_config='${capability_from_config}'" - - ## Debugging. - #safe_echo "line: '${line}'" - #safe_echo "fso: '${fso}'" - #safe_echo "mode_from_config: '${mode_from_config}'" - #safe_echo "owner_from_config: '${owner_from_config}'" - - local fso_without_trailing_slash - fso_without_trailing_slash="${fso%/}" - - declare -g disable_white_list exact_white_list match_white_list - case "${mode_from_config}" in - disablewhitelist) - disable_white_list+=("${fso}") - continue - ;; - exactwhitelist) - exact_white_list+=("${fso}") - continue - ;; - matchwhitelist) - match_white_list+=("${fso}") - continue - ;; - esac - - if test ! -e "${fso}"; then - log info "File does not exist: '${fso}'" - continue - fi - - ## Use dpkg-statoverride so permissions are not reset during upgrades. - - if test "${mode_from_config}" = "nosuid"; then - ## If mode_from_config is "nosuid" the config does not set owner and - ## group. Therefore do not enforce owner/group check. - add_nosuid_statoverride_entry - else - local string_length_of_mode_from_config - string_length_of_mode_from_config="${#mode_from_config}" - if test "${string_length_of_mode_from_config}" -gt "4"; then - log error "Invalid mode: '${mode_from_config}'" >&2 - continue - fi - if test "${string_length_of_mode_from_config}" -lt "3"; then - log error "Invalid mode: '${mode_from_config}'" >&2 - continue - fi - - if ! grep --quiet --fixed-strings -- "${owner_from_config}:" "${store_dir}/private/passwd"; then - log error "Owner from config does not exist: '${owner_from_config}'" >&2 - continue - fi - - if ! grep --quiet --fixed-strings -- "${group_from_config}:" "${store_dir}/private/group"; then - log error "Group from config does not exist: '${group_from_config}'" >&2 - continue - fi - - local mode_for_grep - mode_for_grep="${mode_from_config}" - first_character_of_mode_from_config="${mode_from_config::1}" - if test "${first_character_of_mode_from_config}" = "0"; then - ## Remove leading '0'. - mode_for_grep="${mode_from_config:1}" - fi - - file_name="${fso_without_trailing_slash}" - - ## sets: - ## exiting_mode - ## existing_owner - ## existing_group - output_stat "${file_name}" - - ## Check there is an entry for the fso. - ## - ## example: dpkg-statoverride --list | grep /home - ## output: - ## root root 755 /home - ## - ## dpkg-statoverride does not show leading '0'. - local dpkg_statoverride_list_output="" - local dpkg_statoverride_list_exit_code=0 - dpkg_statoverride_list_output="$(dpkg-statoverride --list "${fso_without_trailing_slash}")" || { - dpkg_statoverride_list_exit_code=$? - true - } - - if test "${dpkg_statoverride_list_exit_code}" = "0"; then - local grep_line - grep_line="${owner_from_config} ${group_from_config} ${mode_for_grep} ${fso_without_trailing_slash}" - if safe_echo "${dpkg_statoverride_list_output}" | grep --quiet --fixed-strings -- "${grep_line}"; then - log info "The owner/group/mode matches fso entry. No further action required." - else - log info "The owner/group/mode does not match fso entry, updating entry." - ## fso_without_trailing_slash instead of fso to prevent - ## "dpkg-statoverride: warning: stripping trailing /" - - # shellcheck disable=SC2086 - if dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --list "${fso_without_trailing_slash}" >/dev/null; then - log info "Existing mode already saved previously. Not saving again." - else - ## Save existing_mode in separate database. - ## Not using --update as not intending to enforce existing_mode. - # shellcheck disable=SC2086 - echo_wrapper_audit silent dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --add "${existing_owner}" "${existing_group}" "${existing_mode}" "${fso_without_trailing_slash}" - fi - - # shellcheck disable=SC2086 - echo_wrapper_ignore silent dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --remove "${fso_without_trailing_slash}" - - ## Remove from and add to real database. - echo_wrapper_ignore silent dpkg-statoverride --remove "${fso_without_trailing_slash}" - echo_wrapper_audit verbose dpkg-statoverride --add --update "${owner_from_config}" "${group_from_config}" "${mode_from_config}" "${fso_without_trailing_slash}" - - ## Save in separate database. - ## Not using --update as this is only for saving. - # shellcheck disable=SC2086 - echo_wrapper_audit silent dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --add "${owner_from_config}" "${group_from_config}" "${mode_from_config}" "${fso_without_trailing_slash}" - fi - else - log info "There is no fso entry, adding one." - - # shellcheck disable=SC2086 - if dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --list "${fso_without_trailing_slash}" >/dev/null; then - log info "Existing mode already saved previously. Not saving again." - else - ## Save existing_mode in separate database. - ## Not using --update as not intending to enforce existing_mode. - # shellcheck disable=SC2086 - echo_wrapper_audit silent dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --add "${existing_owner}" "${existing_group}" "${existing_mode}" "${fso_without_trailing_slash}" - fi - - ## Add to real database. - echo_wrapper_audit verbose dpkg-statoverride --add --update "${owner_from_config}" "${group_from_config}" "${mode_from_config}" "${fso_without_trailing_slash}" - - ## Save in separate database. - ## Not using --update as this is only for saving. - # shellcheck disable=SC2086 - echo_wrapper_audit silent dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --add "${owner_from_config}" "${group_from_config}" "${mode_from_config}" "${fso_without_trailing_slash}" - fi - fi - if test -z "${capability_from_config}"; then - log info "capability_from_config is empty. Skipping. file_name: '${file_name}'" - continue - fi - - if test "${capability_from_config}" = "none"; then - ## https://forums.whonix.org/t/disable-suid-binaries/7706/45 - ## sudo setcap -r /bin/ping 2>/dev/null - ## Failed to set capabilities on file '/bin/ping' (No data available) - ## The value of the capability argument is not permitted for a file. Or - ## the file is not a regular (non-symlink) file - ## Therefore use echo_wrapper_ignore. - echo_wrapper_ignore verbose setcap -r -- "${fso}" - getcap_output="$(getcap -- "${fso}")" - if test -n "${getcap_output}"; then - exit_code=205 - log error "Removing capabilities failed. File: '${fso}'" >&2 - continue - fi - else - if ! capsh --print | grep --fixed-strings -- "Bounding set" | grep --quiet -- "${capability_from_config}"; then - log error "Capability from config does not exist: '${capability_from_config}'" >&2 - continue - fi - - ## feature request: dpkg-statoverride: support for capabilities - ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502580 - echo_wrapper_audit verbose setcap "${capability_from_config}+ep" -- "${fso}" - fi - - done <"${config_file}" - log info "END parsing config file: '${config_file}'" -} - -parse_config_folder() { - touch "${store_dir}/private/passwd" - chmod og-rwx "${store_dir}/private/passwd" - touch "${store_dir}/private/group" - chmod og-rwx "${store_dir}/private/group" - - local passwd_file_contents_temp - ## Query contents of password and group databases only once and buffer them - ## - ## If we don't buffer we sometimes get incorrect results when checking for - ## entries using 'if getent passwd | grep --quiet -- '^root:'; ...' since - ## 'grep' exits after the first match in this case causing 'getent' to - ## receive SIGPIPE, which then fails the pipeline since 'set -o pipefail' is - ## set for this script. - passwd_file_contents_temp="$(getent passwd)" - safe_echo "${passwd_file_contents_temp}" | tee -- "${store_dir}/private/passwd" >/dev/null - group_file_contents_temp="$(getent group)" - safe_echo "${group_file_contents_temp}" | tee -- "${store_dir}/private/group" >/dev/null - - #passwd_file_contents="$(cat "${store_dir}/private/passwd")" - #group_file_contents="$(cat "${store_dir}/private/group")" - - shopt -s nullglob - for config_file in \ - /etc/permission-hardener.d/*.conf \ - /usr/local/etc/permission-hardener.d/*.conf \ - /etc/permission-hardening.d/*.conf \ - /usr/local/etc/permission-hardening.d/*.conf - do - set_file_perms - - done -} - -apply() { - check_root - make_store_dir - sanity_tests - parse_config_folder - - log notice "\ -To compare the current and previous permission modes, install 'meld' (or preferred diff tool) for comparison of file mode changes: - sudo apt install --no-install-recommends meld - meld ${store_dir}/existing_mode/statoverride ${store_dir}/new_mode/statoverride" -} - -spare() { - check_root - make_store_dir - - remove_file="${1}" - exit_code=0 - dpkg_admindir_parameter_existing_mode="--admindir ${store_dir}/existing_mode" - dpkg_admindir_parameter_new_mode="--admindir ${store_dir}/new_mode" - - if test ! -f "${store_dir}/existing_mode/statoverride"; then - true "DEBUG: Stat file does not exist, hardening was not applied before." - return 0 - fi - - local line - while read -r line; do - ## example line: - ## root root 4755 /usr/lib/eject/dmcrypt-get-device - - local owner group mode file_name - if ! read -r owner group mode file_name <<< "${line}"; then - exit_code=201 - log error "Cannot parse line: '${line}'" >&2 - continue - fi - log info "Parsing line: owner='${owner}' group='${group}' mode='${mode}' file_name='${file_name}'" - - if test "${remove_file}" = "all"; then - verbose="" - remove_one=false - else - if test "${remove_file}" = "${file_name}"; then - verbose="--verbose" - remove_one=true - safe_echo "${remove_one}" | tee -- "${store_dir}/remove_one" >/dev/null - else - safe_echo "false" | tee -- "${store_dir}/remove_one" >/dev/null - continue - fi - fi - - if test "${remove_one}" = "true"; then - set -o xtrace - fi - - if test -e "${file_name}"; then - # shellcheck disable=SC2086 - chown ${verbose} "${owner}:${group}" "${file_name}" || exit_code=202 - ## chmod need to be run after chown since chown removes suid. - ## https://unix.stackexchange.com/questions/53665/chown-removes-setuid-bit-bug-or-feature - # shellcheck disable=SC2086 - chmod ${verbose} "${mode}" "${file_name}" || exit_code=203 - else - log info "File does not exist: '${file_name}'" - fi - - dpkg-statoverride --remove "${file_name}" &>/dev/null || true - # shellcheck disable=SC2086 - dpkg-statoverride ${dpkg_admindir_parameter_existing_mode} --remove "${file_name}" &>/dev/null || true - # shellcheck disable=SC2086 - dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --remove "${file_name}" &>/dev/null || true - - if test "${remove_one}" = "true"; then - set +o xtrace - break - fi - - done < "${store_dir}/existing_mode/statoverride" - - if test ! "${remove_file}" = "all"; then - if test "$(cat "${store_dir}/remove_one")" = "false"; then - log info "No file was removed. - - File '${remove_file}' has not been removed from SUID Disabler and Permission Hardener during this invocation. This is expected if already done earlier. - - This program expects the full path to the file. Example: - $0 disable /usr/bin/newgrp # absolute path: works - $0 disable newgrp # relative path: does not work - - To remove all: - $0 disable all - - This change might not be permanent. For full instructions, see: - https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener - - To view list of changed by SUID Disabler and Permission Hardener: - https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#View_List_of_Permissions_Changed_by_SUID_Disabler_and_Permission_Hardener - - For re-enabling any specific SUID binary: - https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Re-Enable_Specific_SUID_Binaries - - For completely disabling SUID Disabler and Permission Hardener: - https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Disable_SUID_Disabler_and_Permission_Hardener" - fi - fi -} - -check_root(){ - if test "$(id -u)" != "0"; then - log error "Not running as root, aborting." - exit 1 - fi -} - -usage(){ - safe_echo "Usage: ${0##*/} enable - ${0##*/} disable [FILE|all] - -Examples: - ${0##*/} enable - ${0##*/} disable all - ${0##*/} disable /usr/bin/newgrp" >&2 - exit "${1}" -} - -case "${1:-}" in - enable) shift; apply "$@";; - disable) - shift - case "${1:-}" in - "") usage 1;; - *) spare "${1}";; - esac - ;; - -h|--help) usage 0;; - *) usage 1;; -esac - -if test "${exit_code}" != "0"; then - log error "Exiting with non-zero exit code: '${exit_code}'" >&2 -fi - -exit "${exit_code}" diff --git a/usr/bin/permission-hardener#security-misc-shared b/usr/bin/permission-hardener#security-misc-shared new file mode 100755 index 00000000..7e92e0a5 --- /dev/null +++ b/usr/bin/permission-hardener#security-misc-shared @@ -0,0 +1,1096 @@ +#!/bin/bash +# shellcheck disable=SC2076 + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## https://forums.whonix.org/t/disable-suid-binaries/7706 +## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 + +## dpkg-statoverride does not support end-of-options ("--"). + +## SC2076 is disabled because ShellCheck seems to think that any use of +## [[ ... =~ ... ]] is supposed to be a regex match. But [[ '...' =~ '...' ]] +## works very well for literal matching, and it is used that way extensively +## throughout this script. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## Constants +# shellcheck disable=SC2034 +log_level=notice +store_dir="/var/lib/permission-hardener-v2" +state_file="${store_dir}/existing_mode/statoverride" +dpkg_admindir_parameter_existing_mode="--admindir ${store_dir}/existing_mode" +dpkg_admindir_parameter_new_mode="--admindir ${store_dir}/new_mode" +delimiter="#permission-hardener-delimiter#" + +## Library imports +# shellcheck source=../../../helper-scripts/usr/libexec/helper-scripts/safe_echo.sh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/safe_echo.sh +# shellcheck source=../../../helper-scripts/usr/libexec/helper-scripts/log_run_die.sh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/log_run_die.sh +# shellcheck source=../../../helper-scripts/usr/libexec/helper-scripts/strings.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/strings.bsh + +## Functions +echo_wrapper_ignore() { + if [ "${1}" = 'verbose' ]; then + shift + log notice "Executing: $*" + elif [ "${1}" = 'silent' ]; then + shift + else + log error "Unrecognized command '${1}'! calling function name: '${FUNCNAME[1]}'" >&2 + return + fi + "$@" 2>/dev/null || true +} + +echo_wrapper_audit() { + local return_code + if [ "${1}" = 'verbose' ]; then + shift + log notice "Executing: $*" + elif [ "${1}" = 'silent' ]; then + shift + else + log error "Unrecognized command '${1}'! calling function name: '${FUNCNAME[1]}'" >&2 + return + fi + return_code=0 + "$@" || + { + return_code="$?" + exit_code=203 + log error "Command '$*' failed with exit code '${return_code}'! calling function name: '${FUNCNAME[1]}'" >&2 + } +} + +## Some tools may fail on newlines and even variable assignment to array may +## fail if a variable that will be assigned to an array element contains +## characters that are used as delimiters. +block_newlines() { + local newline_variable newline_value + newline_variable="${1:-}" + newline_value="${2:-}" + ## dpkg-statoverride: error: path may not contain newlines + if [[ "${newline_value}" != "${newline_value//$'\n'/NEWLINE}" ]]; then + log warn "Skipping ${newline_variable} that contains newlines: '${newline_value}'" >&2 + return 1 + fi +} + +output_stat() { + local file_name stat_output stat_output_newlined hardlink_count + declare -a arr + file_name="${1:-}" + + if [ -z "${file_name}" ]; then + log error "File name is empty. file_name: '${file_name}'" >&2 + return 1 + fi + + if ! block_newlines file "${file_name}"; then + existing_mode='' + existing_owner='' + existing_group='' + file_name_from_stat='' + return 0 + fi + + if [ ! -e "${file_name}" ]; then + log info "File does not exist. file_name: '${file_name}'" >&2 + existing_mode='' + existing_owner='' + existing_group='' + file_name_from_stat='' + return 0 + fi + + if ! stat_output="$(stat -L \ + --format="%a${delimiter}%U${delimiter}%G${delimiter}%n${delimiter}%h${delimiter}" \ + -- "${file_name}")"; then + log error "Failed to run 'stat' on file: '${file_name}'!" >&2 + return 1 + fi + + if [ -z "${stat_output}" ]; then + log error "stat_output is empty. +File name: '${file_name}' +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + stat_output_newlined="$(printf '%s\n' "${stat_output//${delimiter}/$'\n'}")" + + if [ -z "${stat_output_newlined}" ]; then + log error "stat_output_newlined is empty. +File name: '${file_name}' +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + readarray -t arr <<< "${stat_output_newlined}" + + if [ "${#arr[@]}" = '0' ]; then + log error "Array length is 0. +File name: '${file_name}' +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + existing_mode="${arr[0]}" + existing_owner="${arr[1]}" + existing_group="${arr[2]}" + file_name_from_stat="${arr[3]}" + hardlink_count="${arr[4]}" + + if ! is_whole_number "${hardlink_count}"; then + log error "\ +hardlink_count returned by stat is not an integer. +Stat output: '${stat_output}' +stat_output_newlined: '${stat_output_newlined}' +line: '${processed_config_line}' +hardlink_count: '${hardlink_count}' +" >&2 + return 1 + fi + + if [ "${file_name}" != "${file_name_from_stat}" ]; then + log error "\ +File name is different from file name received from stat: +File name: '${file_name}' +File name from stat: '${file_name_from_stat}' +line: '${processed_config_line}' +" >&2 + return 1 + fi + + ## We can't handle files with hardlinks because figuring out all of the files + ## in a "hardlink pool" requires scanning the whole filesystem, which would + ## result in an unacceptable performance hit for this script. We don't check + ## directory hardlinks since directories can't have traditional hardlinks. + if [ ! -d "${file_name_from_stat}" ]; then + if (( hardlink_count > 1 )); then + log info "File has unexpected hardlinks, cannot handle. file_name: '${file_name}'" >&2 + existing_mode='' + existing_owner='' + existing_group='' + file_name_from_stat='' + return 0 + fi + fi + + if [ -z "${existing_mode}" ]; then + log error "Existing mode is empty. Stat output: '${stat_output}', line: '${processed_config_line}'" >&2 + return 1 + fi + if [ -z "${existing_owner}" ]; then + log error "Existing owner is empty. Stat output: '${stat_output}', line: '${processed_config_line}'" >&2 + return 1 + fi + if [ -z "${existing_group}" ]; then + log error "Existing group is empty. Stat output: '${stat_output}', line: '${processed_config_line}'" >&2 + return 1 + fi + + ## If a symlink was passed as input, return the original file's path rather + ## than the symlink to avoid problems stemming from using the wrong path + if [ -h "${file_name_from_stat}" ]; then + file_name_from_stat="$(realpath "${file_name_from_stat}")" + fi +} + +print_usage(){ + safe_echo "Usage: ${0##*/} enable + ${0##*/} disable [FILE|all] + ${0##*/} print-policy + ${0##*/} print-state + ${0##*/} print-policy-applied-state + ${0##*/} print-diagnostics + +Examples: + ${0##*/} enable + ${0##*/} disable all + ${0##*/} disable /usr/bin/newgrp" >&2 +} + +add_to_policy() { + local file_name file_mode file_owner file_group updated_entry policy_idx \ + file_capabilities + file_name="${1:-}" + file_mode="${2:-}" + file_owner="${3:-}" + file_group="${4:-}" + file_capabilities="${5:-}" + updated_entry=false + + if [ -z "${file_name}" ]; then + exit_code=207 + log error "Attempted to add a policy entry with an empty filename! file_mode='${file_mode}' file_onwer='${file_owner}' file_group='${file_group}' file_capabilities='${file_capabilities}'" >&2 + exit "${exit_code}" + fi + + if [ -h "${file_name}" ]; then + file_name="$(realpath "${file_name}")" || return 1 + fi + + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + if [ "${policy_file_list[policy_idx]}" = "${file_name}" ]; then + policy_mode_list[policy_idx]="${file_mode}" + policy_user_owner_list[policy_idx]="${file_owner}" + policy_group_owner_list[policy_idx]="${file_group}" + policy_capability_list[policy_idx]="${file_capabilities}" + updated_entry=true + break + fi + done + + if [ "${updated_entry}" != 'true' ]; then + policy_file_list+=( "${file_name}" ) + policy_mode_list+=( "${file_mode}" ) + policy_user_owner_list+=( "${file_owner}" ) + policy_group_owner_list+=( "${file_group}" ) + policy_capability_list+=( "${file_capabilities}" ) + fi +} + +check_nosuid_whitelist() { + local target_file match_white_list_entry + + target_file="${1:-}" + + ## Handle whitelists, if we're supposed to + [ "${whitelists_disable_all}" = 'true' ] && return 0 + + ## literal matching is intentional here + [[ " ${policy_disable_white_list[*]} " =~ " ${target_file} " ]] && return 0 + + ## literal matching is intentional here too + [[ " ${policy_exact_white_list[*]} " =~ " ${target_file} " ]] && return 1 + + for match_white_list_entry in "${policy_match_white_list[@]}"; do + if [[ "${target_file}" == *"${match_white_list_entry}"* ]]; then + return 1 + fi + done + + return 0 +} + +load_early_nosuid_policy() { + local target_file find_list_item + + target_file="${1:-}" + + # shellcheck disable=SC2185 + while IFS="" read -r -d "" find_list_item; do + check_nosuid_whitelist "${find_list_item}" || continue + + ## sets: + ## exiting_mode + ## existing_owner + ## existing_group + output_stat "${find_list_item}" + if [ -z "${file_name_from_stat}" ]; then + continue + fi + + ## -h file True if file is a symbolic link. + if [ -h "${find_list_item}" ]; then + ## https://forums.whonix.org/t/disable-suid-binaries/7706/14 + log info "Skip symlink: '${find_list_item}'" + continue + fi + + if [ -d "${find_list_item}" ]; then + log info "Skip directory: '${find_list_item}'" + continue + fi + + ## Remove suid / gid and execute permission for 'group' and 'others'. + ## Similar to: chmod og-ugx /path/to/filename + ## Removing execution permission is useful to make binaries such as 'su' + ## fail closed rather than fail open if suid was removed from these. + ## Do not remove read access since no security benefit and easier to + ## manually undo for users. + ## Are there suid or sgid binaries which are still useful if suid / sgid + ## has been removed from these? + local new_mode + new_mode='744' + + add_to_policy "${file_name_from_stat}" "${new_mode}" "${existing_owner}" \ + "${existing_group}" + done < <(safe_echo_nonewline "${target_file}" \ + | find -files0-from - -perm /u=s,g=s -print0) +} + +## If the "target file" matches the start of the state file name, that's a +## likely match. This is used by load_late_nosuid_policy for detecting info +## about files that need SUID-locked that are in the state. +match_dir() { + local base_str match_str base_arr match_arr base_idx + + base_str="${1}" + match_str="${2}" + if [ -z "${base_str}" ] || [ -z "${match_str}" ]; then + exit_code=207 + log error "Empty base_str or match_str provided to match_dir! base_str: '${base_str}' match_str: '${match_str}'" >&2 + exit "${exit_code}" + fi + [[ "${base_str}" =~ '//' ]] && return 1 + [[ "${match_str}" =~ '//' ]] && return 1 + + IFS='/' read -r -a base_arr <<< "${base_str}" + IFS='/' read -r -a match_arr <<< "${match_str}" + (( ${#base_arr[@]} > ${#match_arr[@]} )) && return 1 + + for (( base_idx=0; base_idx < ${#base_arr[@]}; base_idx++ )); do + if [ "${base_arr[base_idx]}" != "${match_arr[base_idx]}" ]; then + return 1 + fi + done + + return 0 +} + +load_late_nosuid_policy() { + local target_file state_idx state_file_item state_user_owner_item \ + state_group_owner_item new_mode + + target_file="${1:-}" + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + check_nosuid_whitelist "${state_file_item}" || continue + + match_dir "${target_file}" "${state_file_item}" || continue + + if [ -h "${state_file_item}" ]; then + ## https://forums.whonix.org/t/disable-suid-binaries/7706/14 + log info "Skip symlink: '${state_file_item}'" + continue + fi + + if [ -d "${state_file_item}" ]; then + log info "Skip directory: '${state_file_item}'" + continue + fi + + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + new_mode='744' + add_to_policy "${state_file_item}" "${new_mode}" \ + "${state_user_owner_item}" "${state_group_owner_item}" + done +} + +load_state_without_policy() { + local line sf_owner sf_group sf_mode sf_path + + ## Load the state file from disk. + if [ -f "${state_file}" ]; then + while read -r line; do + read -r sf_owner sf_group sf_mode sf_path <<< "${line}" + if [ -z "${sf_path}" ]; then + log info \ + "Invalid number of fields in state file line: '${line}'. Skipping." + continue + fi + state_user_owner_list+=( "${sf_owner}" ) + state_group_owner_list+=( "${sf_group}" ) + state_mode_list+=( "${sf_mode}" ) + state_file_list+=( "${sf_path}" ) + done < "${state_file}" + fi +} + +load_state() { + ## Config format: + ## path options + ## where options is one of: + ## filemode user_owner group_owner [capability-setting] + ## [nosuid|exactwhitelist|matchwhitelist|disablewhitelist] + ## + ## Additionally, the special value 'whitelists_disable_all=true' is understood + ## to mean that all whitelisting should be ignored. + + local config_file line field_list policy_nosuid_file_item policy_file_item + local one_field field_count fso_name meta_list field_index hit_barrier + + ## Load configuration, deferring whitelist handling until later + for config_file in \ + /usr/lib/permission-hardener.d/*.conf \ + /etc/permission-hardener.d/*.conf \ + /usr/local/etc/permission-hardener.d/*.conf \ + /etc/permission-hardening.d/*.conf \ + /usr/local/etc/permission-hardening.d/*.conf + do + if [ ! -f "${config_file}" ]; then + continue + fi + + while read -r line; do + if [ -z "${line}" ]; then + true 'DEBUG: line is empty. Skipping.' + continue + fi + + if [[ "${line}" =~ ^\s*# ]]; then + continue + fi + + if [ "${line}" = 'whitelists_disable_all=true' ]; then + whitelists_disable_all=true + log info "whitelists_disable_all=true" + continue + fi + + if ! [[ "${line}" =~ ^[-0-9a-zA-Z._/[:space:]]*$ ]]; then + exit_code=200 + log error "Line contains invalid characters: '${line}'" >&2 + ## Safer to exit with error in this case. + ## https://forums.whonix.org/t/disable-suid-binaries/7706/59 + exit "${exit_code}" + fi + + processed_config_line="${line}" + + ## We can handle filenames with spaces. This is because the first item + ## after a filename is either an octal file mode or a keyword, and we + ## only support user/group names, not UIDs and GIDs, as owner + ## identifiers. This means that we can scan from right to left for the + ## furthest-right octal integer or keyword field and use it to separate + ## the filename from the rest of the options. (If usernames could + ## themselves be octal integers, this would break, but adduser.conf's + ## default NAME_REGEX forbids this. This is definitely a hack, but the + ## alternative is to change the format of the policy files, which would + ## break custom config for users. + ## + ## Do not attempt to reimplement this in a way that copes with usernames + ## that look identical to UIDs. Systems containing such usernames are + ## very broken and unsupported. + ## + ## 'read' will collapse consecutive spaces when splitting on spaces. + ## Convert spaces into newlines first, then split on newlines with a + ## loop. + field_list=() + while IFS= read -r one_field; do + field_list+=( "${one_field}" ) + done < <(printf '%s\n' "${line}" | tr ' ' '\n') + field_count="${#field_list[@]}" + + hit_barrier='false' + fso_name="" + meta_list=() + for (( field_index = field_count - 1; field_index >= 0; \ + field_index-- )); do + if [ "${hit_barrier}" = 'false' ]; then + if [[ "${field_list[field_index]}" =~ ^[0-7]{3,4}$ ]] \ + || [[ "${field_list[field_index]}" =~ ^(nosuid|exactwhitelist|matchwhitelist|disablewhitelist)$ ]]; then + hit_barrier='true' + fi + meta_list=( "${field_list[field_index]}" "${meta_list[@]}" ) + else + fso_name="${field_list[field_index]}${fso_name:+" ${fso_name}"}" + fi + done + + case "${#meta_list[@]}" in + 1|3|4) + true + ;; + *) + exit_code=200 + log error "Line contains an invalid number of fields: '${line}'" >&2 + exit "${exit_code}" + ;; + esac + + # Strip trailing slash if appropriate + fso_name="${fso_name%/}" + + case "${meta_list[0]}" in + 'exactwhitelist') + [ ! -e "${fso_name}" ] && continue + policy_exact_white_list+=( "${fso_name}" ) + continue + ;; + 'matchwhitelist') + policy_match_white_list+=( "${fso_name}" ) + continue + ;; + 'disablewhitelist') + policy_disable_white_list+=( "${fso_name}" ) + continue + ;; + 'nosuid') + [ ! -e "${fso_name}" ] && continue + policy_nosuid_file_list+=( "${fso_name}" ) + ;; + *) + [ ! -e "${fso_name}" ] && continue + add_to_policy "${fso_name}" "${meta_list[@]}" + ;; + esac + done < "${config_file}" + done + + ## We have to handle nosuid files at the end since the whitelist arrays need + ## built first. + for policy_nosuid_file_item in "${policy_nosuid_file_list[@]}"; do + load_early_nosuid_policy "${policy_nosuid_file_item}" + done + + load_state_without_policy + + ## Find any files in the policy that don't already have a matching file in + ## the state. Add those files to the state, and save them to the state file + ## as well. + for policy_file_item in "${policy_file_list[@]}"; do + if [[ " ${state_file_list[*]} " =~ " ${policy_file_item} " ]]; then + continue + fi + output_stat "${policy_file_item}" + if [ -z "${file_name_from_stat}" ]; then + continue + fi + state_file_list+=( "${file_name_from_stat}" ) + state_user_owner_list+=( "${existing_owner}" ) + state_group_owner_list+=( "${existing_group}" ) + state_mode_list+=( "${existing_mode}" ) + # shellcheck disable=SC2086 + echo_wrapper_audit silent dpkg-statoverride \ + ${dpkg_admindir_parameter_existing_mode} \ + --add "${existing_owner}" "${existing_group}" "${existing_mode}" \ + "${file_name_from_stat}" + done + + ## Fix up nosuid policies using state information + for policy_nosuid_file_item in "${policy_nosuid_file_list[@]}"; do + load_late_nosuid_policy "${policy_nosuid_file_item}" + done +} + +apply_policy() { + local policy_idx did_state_update state_idx + + ## Modify the in-memory state so that all items that the policy affects match + ## the policy. DO NOT save these changes to the state file! + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + did_state_update=false + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + if [ "${state_file_list[state_idx]}" = "${policy_file_list[policy_idx]}" ]; then + state_user_owner_list[state_idx]="${policy_user_owner_list[policy_idx]}" + state_group_owner_list[state_idx]="${policy_group_owner_list[policy_idx]}" + state_mode_list[state_idx]="${policy_mode_list[policy_idx]}" + did_state_update=true + break + fi + done + if [ "${did_state_update}" = 'false' ]; then + exit_code=206 + log error \ + "File exists in policy but not in state! File: '${policy_file_list[policy_idx]}'" + exit "${exit_code}" + fi + done +} + +commit_policy() { + local policy_idx state_idx state_file_item \ + state_user_owner_item state_group_owner_item \ + state_mode_item orig_main_statoverride_db orig_new_statoverride_db \ + policy_file_item policy_capability_item + + ## Check each file on the filesystem against the state, and update it if the + ## state does not match. Also ensure the consistency of the new_mode database + ## so that people can compare the original permissions of files with the new + ## permissions. + orig_main_statoverride_db="$(dpkg-statoverride --list)" || true + # shellcheck disable=SC2086 + orig_new_statoverride_db="$(dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --list)" || true + + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + state_mode_item="${state_mode_list[state_idx]}" + + ## Get rid of leading zeros, stat doesn't output them due to how we use it. + ## Using BASH_REMATCH is faster than sed. We capture all leading zeros into + ## one group, and the rest of the string into a second group. The second + ## group is the string we want. BASH_REMATCH[0] is the entire string, + ## BASH_REMATCH[1] is the first match that we want to discard, and + ## BASH_REMATCH[2] is the desired second group. + if [[ "${state_mode_item}" =~ ^(0*)(.*) ]]; then + state_mode_item="${BASH_REMATCH[2]}" + else + exit_code=208 + log error "'Impossible' regex match failure in commit_policy! Regex: '^(0*)(.*)' String (state_mode_item): '${state_mode_item}'" >&2 + exit "${exit_code}" + fi + + output_stat "${state_file_item}" + if [ -z "${file_name_from_stat}" ]; then + continue + fi + + if [ "${existing_owner}" != "${state_user_owner_item}" ] \ + || [ "${existing_group}" != "${state_group_owner_item}" ] \ + || [ "${existing_mode}" != "${state_mode_item}" ]; then + ## Anchor user/group lookups to line boundaries to prevent substring + ## matches (e.g. 'oot' must not match 'root:...') + if ! [[ $'\n'"${passwd_file_contents}" \ + =~ $'\n'"${state_user_owner_item}:" ]]; then + log error "Owner from config does not exist: '${state_user_owner_item}'" >&2 + continue + fi + + if ! [[ $'\n'"${group_file_contents}" \ + =~ $'\n'"${state_group_owner_item}:" ]]; then + log error "Group from config does not exist: '${state_group_owner_item}'" >&2 + continue + fi + ## Remove and reapply in main list + ## Anchor to file field and line boundary to prevent substring path + ## matches + if [[ "${orig_main_statoverride_db}"$'\n' \ + =~ [[:space:]]"${file_name_from_stat}"$'\n' ]]; then + echo_wrapper_ignore silent dpkg-statoverride --remove \ + "${file_name_from_stat}" + fi + echo_wrapper_audit verbose dpkg-statoverride --add --update \ + "${state_user_owner_item}" "${state_group_owner_item}" \ + "${state_mode_item}" "${file_name_from_stat}" + + ## Update item in secondary list + if [[ "${orig_new_statoverride_db}"$'\n' \ + =~ [[:space:]]"${file_name_from_stat}"$'\n' ]]; then + # shellcheck disable=SC2086 + echo_wrapper_ignore silent dpkg-statoverride \ + ${dpkg_admindir_parameter_new_mode} --remove \ + "${file_name_from_stat}" + fi + # shellcheck disable=SC2086 + echo_wrapper_audit verbose dpkg-statoverride \ + ${dpkg_admindir_parameter_new_mode} --add \ + "${state_user_owner_item}" "${state_group_owner_item}" \ + "${state_mode_item}" "${file_name_from_stat}" + fi + done + + ## Apply capability hardening, dpkg-statoverride can't handle this so we have + ## to do this manually + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + policy_file_item="${policy_file_list[policy_idx]}" + policy_capability_item="${policy_capability_list[policy_idx]}" + if [ -z "${policy_capability_item}" ]; then + continue + fi + + if [ "${policy_capability_item}" = 'none' ]; then + echo_wrapper_ignore verbose setcap -r "${policy_file_item}" + if [ -n "$(getcap -- "${policy_file_item}")" ]; then + exit_code=205 + log error \ + "Removing capabilities failed. File: '${policy_file_item}'" >&2 + continue + fi + else + if ! capsh --print \ + | grep --fixed-strings -- "Bounding set" \ + | grep -- "${policy_capability_item}" >/dev/null; then + log error \ + "Capability from config does not exist: '${policy_capability_item}'" \ + >&2 + continue + fi + + ## feature request: dpkg-statoverride: support for capabilities + ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502580 + echo_wrapper_audit verbose setcap "${policy_capability_item}+ep" \ + -- "${policy_file_item}" + fi + done + + log notice "\ +To compare the current and previous permission modes, install 'meld' (or preferred diff tool) for comparison of file mode changes: + sudo apt install --no-install-recommends meld + meld ${store_dir}/existing_mode/statoverride ${store_dir}/new_mode/statoverride" +} + +undo_policy_for_file() { + local undo_file state_idx state_file_item did_undo \ + undo_all verbose orig_main_statoverride_db orig_new_statoverride_db \ + state_user_owner_item state_group_owner_item state_mode_item + + undo_file="${1}" + undo_all=false + verbose=('--verbose') + if [ "${undo_file}" = 'all' ]; then + undo_all=true + verbose=() + fi + + if [ ! -f "${state_file}" ]; then + true 'DEBUG: State file does not exist, hardening was not applied before.' + return 0 + fi + + did_undo=false + + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + if [ "${undo_all}" = 'true' ]; then + undo_file="${state_file_item}" + fi + + if [ "${state_file_item}" = "${undo_file}" ]; then + orig_main_statoverride_db="$(dpkg-statoverride --list)" || true + # shellcheck disable=SC2086 + orig_new_statoverride_db="$(dpkg-statoverride ${dpkg_admindir_parameter_new_mode} --list)" || true + + if [[ "${orig_main_statoverride_db}"$'\n' \ + =~ [[:space:]]"${undo_file}"$'\n' ]]; then + echo_wrapper_ignore silent dpkg-statoverride --remove \ + "${undo_file}" + fi + + if [[ "${orig_new_statoverride_db}"$'\n' \ + =~ [[:space:]]"${undo_file}"$'\n' ]]; then + # shellcheck disable=SC2086 + echo_wrapper_ignore silent dpkg-statoverride \ + ${dpkg_admindir_parameter_new_mode} --remove \ + "${undo_file}" + fi + + if [ -e "${undo_file}" ]; then + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + state_mode_item="${state_mode_list[state_idx]}" + chown "${verbose[@]}" -- "${state_user_owner_item}:${state_group_owner_item}" \ + "${undo_file}" || exit_code=202 + ## chmod needs to be run after chown since chown removes suid. + chmod "${verbose[@]}" "${state_mode_item}" "${undo_file}" || exit_code=203 + else + log info "File does not exist: '${undo_file}'" + fi + did_undo=true + + if [ "${undo_all}" = 'false' ]; then + break + fi + fi + done + + if [ "${did_undo}" = 'false' ]; then + log notice "The specified file is not hardened, leaving unchanged. + + File '${undo_file}' has not been removed from SUID Disabler and Permission Hardener during this invocation. This is expected if no policy was ever applied to the file before. + + This program expects the full path to the file. Example: + $0 disable /usr/bin/newgrp # absolute path: works + $0 disable newgrp # relative path: does not work + + To remove all: + $0 disable all + + This change might not be permanent. For full instructions, see: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener + + To view list of changed by SUID Disabler and Permission Hardener: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#View_List_of_Permissions_Changed_by_SUID_Disabler_and_Permission_Hardener + + For re-enabling any specific SUID binary: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Re-Enable_Specific_SUID_Binaries + + For completely disabling SUID Disabler and Permission Hardener: + https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#Disable_SUID_Disabler_and_Permission_Hardener" + fi +} + +print_columns() { + local format_str + format_str='' + for _ in "$@"; do + format_str="${format_str}%s\t" + done + format_str="${format_str}\n" + ## Using a dynamically generated format string on purpose. + ## style-ok: printf-format + # shellcheck disable=SC2059 + printf "${format_str}" "$@" +} + +print_policy() { + local policy_idx + + print_columns 'File' 'User' 'Group' 'Mode' 'Capabilities' + + for (( policy_idx=0; policy_idx < ${#policy_file_list[@]}; policy_idx++ )); do + print_columns \ + "${policy_file_list[policy_idx]}" \ + "${policy_user_owner_list[policy_idx]}" \ + "${policy_group_owner_list[policy_idx]}" \ + "${policy_mode_list[policy_idx]}" \ + "${policy_capability_list[policy_idx]}" + done +} + +print_state() { + local state_idx + + print_columns 'File' 'User' 'Group' 'Mode' + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + print_columns \ + "${state_file_list[state_idx]}" \ + "${state_user_owner_list[state_idx]}" \ + "${state_group_owner_list[state_idx]}" \ + "${state_mode_list[state_idx]}" + done +} + +print_raw_policy_config() { + local config_file + for config_file in \ + /usr/lib/permission-hardener.d/*.conf \ + /etc/permission-hardener.d/*.conf \ + /usr/local/etc/permission-hardener.d/*.conf \ + /etc/permission-hardening.d/*.conf \ + /usr/local/etc/permission-hardening.d/*.conf + do + if [ ! -f "${config_file}" ]; then + continue + fi + printf '%s\n' "*** begin ${config_file} ***" + cat "${config_file}" + printf '%s\n' "*** end ${config_file} ***" + done +} + +print_raw_state() { + local state_file + for state_file in "${store_dir}/existing_mode/statoverride" \ + "${store_dir}/new_mode/statoverride"; do + printf '%s\n' "*** begin ${state_file} ***" + if [ -f "${state_file}" ]; then + cat "${state_file}" + else + printf '%s\n' '(file does not exist)' + fi + printf '%s\n' "*** end ${state_file} ***" + done +} + +print_fs_audit() { + local state_idx state_file_item state_user_owner_item state_group_owner_item \ + state_mode_item + + printf '%s\n' 'Legend:' + printf '%s\n' '... - Warning about an unusual, but not necessarily wrong, condition' + printf '%s\n' '!!! - Warning about an unusual and definitely wrong condition' + printf '%s\n' '*** - File permission data, actual state on filesystem is consistent with policy' + printf '%s\n' '^^^ - File permission data, actual state on filesystem is inconsistent with policy' + printf '%s\n' 'vvv - File permissions specified by state, always shown after a ^^^ item' + printf '%s\n' '' + + for (( state_idx=0; state_idx < ${#state_file_list[@]}; state_idx++ )); do + state_file_item="${state_file_list[state_idx]}" + state_user_owner_item="${state_user_owner_list[state_idx]}" + state_group_owner_item="${state_group_owner_list[state_idx]}" + state_mode_item="${state_mode_list[state_idx]}" + + ## Get rid of leading zeros, stat doesn't output them due to how we use it. + ## Using BASH_REMATCH is faster than sed. We capture all leading zeros into + ## one group, and the rest of the string into a second group. The second + ## group is the string we want. BASH_REMATCH[0] is the entire string, + ## BASH_REMATCH[1] is the first match that we want to discard, and + ## BASH_REMATCH[2] is the desired second group. + if [[ "${state_mode_item}" =~ ^(0*)(.*) ]]; then + state_mode_item="${BASH_REMATCH[2]}" + else + exit_code=208 + log error "'Impossible' regex match failure in print_fs_audit! Regex: '^(0*)(.*)' String (state_mode_item): '${state_mode_item}'" >&2 + exit "${exit_code}" + fi + + output_stat "${state_file_item}" + if [ -z "${file_name_from_stat}" ]; then + printf '%s\n' "... '${state_file_item}' does not exist or has multiple hardlinks" + continue + fi + + if [ "${existing_owner}" != "${state_user_owner_item}" ] \ + || [ "${existing_group}" != "${state_group_owner_item}" ] \ + || [ "${existing_mode}" != "${state_mode_item}" ]; then + if ! [[ $'\n'"${passwd_file_contents}" \ + =~ $'\n'"${state_user_owner_item}:" ]]; then + printf '%s\n' "!!! Owner from config does not exist: '${state_user_owner_item}'" + continue + fi + + if ! [[ $'\n'"${group_file_contents}" \ + =~ $'\n'"${state_group_owner_item}:" ]]; then + printf '%s\n' "!!! Group from config does not exist: '${state_group_owner_item}'" + continue + fi + + printf '%s\n' "^^^ ${file_name_from_stat} ${existing_owner}:${existing_group} ${existing_mode}" + printf '%s\n' "vvv ${file_name_from_stat} ${state_user_owner_item}:${state_group_owner_item} ${state_mode_item}" + else + printf '%s\n' "*** ${file_name_from_stat} ${existing_owner}:${existing_group} ${existing_mode}" + fi + done +} + +reset_global_vars() { + ## Global variables + policy_file_list=() + policy_user_owner_list=() + policy_group_owner_list=() + policy_mode_list=() + policy_capability_list=() + policy_exact_white_list=() + policy_match_white_list=() + policy_disable_white_list=() + policy_nosuid_file_list=() + state_file_list=() + state_user_owner_list=() + state_group_owner_list=() + state_mode_list=() + whitelists_disable_all=false + existing_mode='' + existing_owner='' + existing_group='' + processed_config_line='' + file_name_from_stat='' + passwd_file_contents="$(getent passwd)" + group_file_contents="$(getent group)" + exit_code=0 +} + +reset_global_vars + +## Setup and sanity checking +if [ "$(id -u)" != '0' ]; then + log error "Not running as root, aborting." + exit 1 +fi + +mkdir --parents "${store_dir}/existing_mode" +mkdir --parents "${store_dir}/new_mode" + +echo_wrapper_audit silent which capsh getcap setcap stat find \ + dpkg-statoverride getent grep 1>/dev/null + +## Command parsing and execution +case "${1:-}" in + enable) + shift + load_state + apply_policy + commit_policy + ;; + disable) + shift + case "${1:-}" in + "") + print_usage + exit 1 + ;; + *) + load_state_without_policy + undo_policy_for_file "${1}" + ;; + esac + ;; + print-policy) + load_state + print_policy + ;; + print-state) + load_state + print_state + ;; + print-policy-applied-state) + load_state + apply_policy + print_state + ;; + print-diagnostics) + printf '%s\n' '=== BEGIN PERMISSION-HARDENER DIAGNOSTICS ===' + + printf '%s\n' '--- BEGIN State without policy ---' + load_state_without_policy + print_state + printf '%s\n' '--- END State without policy ---' + + reset_global_vars + + printf '%s\n' '--- BEGIN Policy without state ---' + load_state + print_policy + printf '%s\n' '--- END Policy without state ---' + + reset_global_vars + + printf '%s\n' '--- BEGIN Policy-applied-state ---' + load_state + apply_policy + print_state + printf '%s\n' '--- END Policy-applied state ---' + + reset_global_vars + + printf '%s\n' '--- BEGIN Master dpkg-statoverride database ---' + dpkg-statoverride --list + printf '%s\n' '--- END Master dpkg-statoverride database ---' + + printf '%s\n' '--- BEGIN Raw policy configuration ---' + print_raw_policy_config + printf '%s\n' '--- END Raw policy configuration ---' + + printf '%s\n' '--- BEGIN Raw state data ---' + print_raw_state + printf '%s\n' '--- END Raw state data ---' + + printf '%s\n' '--- BEGIN Filesystem state audit ---' + load_state + apply_policy + print_fs_audit + printf '%s\n' '--- END Filesystem state audit ---' + + printf '%s\n' '=== END PERMISSION-HARDENER DIAGNOSTICS ===' + ;; + -h|--help) + print_usage + exit 0 + ;; + *) + print_usage + exit 1 + ;; +esac + +## Exit +if test "${exit_code}" != "0"; then + log error "Exiting with non-zero exit code: '${exit_code}'" >&2 +fi + +exit "${exit_code}" diff --git a/usr/bin/pkexec.security-misc b/usr/bin/pkexec.security-misc deleted file mode 100755 index 3739391d..00000000 --- a/usr/bin/pkexec.security-misc +++ /dev/null @@ -1,132 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with -## hidepid. -## * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040 -## * https://forums.whonix.org/t/cannot-use-pkexec/8129 - -set -e - -my_real_path="$(realpath "$0")" || true -identifier="$my_real_path wrapper" -exec > >(systemd-cat --identifier="$identifier output by program:") 2>&1 - -log_to_journal() { - echo "$@" | systemd-cat --identifier="$identifier output by wrapper:" || true -} - -log_to_journal "$0 $@" -log_to_journal "DISPLAY: '$DISPLAY'" -my_pstree="$(pstree -p $$)" || true -log_to_journal "my_pstree: '$my_pstree'" - -## If hidepid is not in use, just use pkexec normally. -if ! mount | grep "/proc" | grep "hidepid=2" &>/dev/null ; then - pkexec.security-misc-orig "$@" - exit $? -fi - -switch_user=false - -original_args="$@" - -## Thanks to: -## https://mywiki.wooledge.org/BashFAQ/035 - -while : -do - case $1 in - ## Should show 'pkexec --version' or fail? - --version) - shift - pkexec.security-misc-orig "$original_args" - exit $? - ;; - ## Should show 'pkexec --help' or fail? - --help) - shift - pkexec.security-misc-orig "$original_args" - exit $? - ;; - ## Drop --disable-internal-agent as not needed and breaking both, - ## lxqt-sudo and sudo. - --disable-internal-agent) - shift - ;; - --user) - ## lxqt-sudo does not support "--user". - ## We should not make this wrapper run something as root which - ## is supposed to run under a different user. Try using - ## "sudo -A --user user --set-home" instead. - user_pkexec_wrapper="$2" - if [ "$user_pkexec_wrapper" = "" ]; then - shift - else - shift 2 - fi - switch_user=true - maybe_switch_to_user="--user $user_pkexec_wrapper" - ;; - --) - shift - break - ;; - *) - break - ;; - esac -done - -## If there are input files (for example) that follow the options, they -## will remain in the "$@" positional parameters. - -if [ "$PKEXEC_UID" = "" ]; then - if [ ! "$user_pkexec_wrapper" = "" ]; then - PKEXEC_UID="$user_pkexec_wrapper" - elif [ ! "$SUDO_USER" = "" ]; then - PKEXEC_UID="$SUDO_USER" - else - PKEXEC_UID="$(whoami)" - fi -fi -export PKEXEC_UID - -if [[ "$@" = "" ]]; then - ## Call original pkexec in case there are no arguments. - pkexec.security-misc-orig $original_args - exit $? -fi - -exit_code=0 - -## lxqt-sudo does not check /etc/sudoers / /etc/sudoers.d exceptions. -## Therefore use 'sudo -l' to see if there is any already existing sudoers exception. -## Did not work. 'sudo -l' will always exit with exit code '0'. -# if sudo -l --non-interactive $maybe_switch_to_user --set-home PKEXEC_UID="$PKEXEC_UID" "$@" ; then -# log_to_journal "sudoers exception: yes" -# sudo --non-interactive $maybe_switch_to_user --set-home PKEXEC_UID="$PKEXEC_UID" "$@" || { exit_code=$? ; true; }; -# log_to_journal "sudo --user | exit_code: '$exit_code'" -# exit "$exit_code" -# fi -# -# log_to_journal "sudoers exception: no" - -if [ "$switch_user" = "true" ]; then - ## 'sudo --user user' clears environment variables such as PATH. - lxqt-sudo sudo $maybe_switch_to_user --set-home PKEXEC_UID="$PKEXEC_UID" "$@" || { exit_code=$? ; true; }; -else - ## set PATH same as root - ## This is required for gdebi. - ## REVIEW: is it ok that users can find out the PATH setting of root? - ## lxqt-sudo does not clear environment variable PATH. - PATH="$(sudo --non-interactive /usr/libexec/security-misc/echo-path)" - export PATH - lxqt-sudo "$@" || { exit_code=$? ; true; }; -fi - -log_to_journal "exit_code: '$exit_code'" - -exit "$exit_code" diff --git a/usr/bin/remount-secure b/usr/bin/remount-secure#security-misc-shared similarity index 60% rename from usr/bin/remount-secure rename to usr/bin/remount-secure#security-misc-shared index 14da1fe0..5d1322ab 100755 --- a/usr/bin/remount-secure +++ b/usr/bin/remount-secure#security-misc-shared @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## features: @@ -26,24 +26,33 @@ ## https://www.kicksecure.com/wiki/Dev/remount-secure ## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 +## style-ok: no-has - may run in dracut without helper-scripts + +## Mount helper functions (_boot, _sys, _usr, ...) are invoked indirectly via +## the dispatch in main(). +# shellcheck disable=SC2317 + #set -x -set -e -set -o pipefail +set -o errexit set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose init() { if test -o xtrace ; then - output_command=true + output_command=( true ) else - output_command=echo + output_command=( printf '%s\n' ) fi - $output_command "$0: INFO: START" + "${output_command[@]}" "$0: INFO: START" ## dracut does not have id. Saving space in initial ramdisk. if command -v id &>/dev/null ; then if [ "$(id -u)" != "0" ]; then - $output_command "ERROR: must be run as root! sudo $0" + "${output_command[@]}" "ERROR: must be run as root! sudo $0" exit 1 fi fi @@ -53,10 +62,10 @@ init() { ## dracut sets NEWROOT=/sysroot [[ -v NEWROOT ]] || NEWROOT="" - if [ "$NEWROOT" = "" ]; then - $output_command "INFO: dracut detected: no" + if [ "${NEWROOT}" = "" ]; then + "${output_command[@]}" "INFO: dracut detected: no" else - $output_command "INFO: dracut detected: yes - NEWROOT: '$NEWROOT'" + "${output_command[@]}" "INFO: dracut detected: yes - NEWROOT: '${NEWROOT}'" fi ## Debugging. @@ -76,33 +85,33 @@ parse_options() { do case ${1:-} in 0) - $output_command "WARNING: Not using remount-secure." + "${output_command[@]}" "WARNING: Not using remount-secure." exit 0 shift ;; 1) - $output_command "INFO: level 1/3 (low)" + "${output_command[@]}" "INFO: level 1/3 (low)" most_noexec_maybe="" home_noexec_maybe="" parsed=true shift ;; 2) - $output_command "INFO: level 2/3 (medium)" + "${output_command[@]}" "INFO: level 2/3 (medium)" most_noexec_maybe=",noexec" home_noexec_maybe="" parsed=true shift ;; 3) - $output_command "INFO: level 3/3 (high)" + "${output_command[@]}" "INFO: level 3/3 (high)" most_noexec_maybe=",noexec" home_noexec_maybe=",noexec" parsed=true shift ;; --force) - $output_command "INFO: --force" + "${output_command[@]}" "INFO: --force" option_force=true shift ;; @@ -111,7 +120,7 @@ parse_options() { break ;; -*) - echo "ERROR: unknown option: $1" >&2 + "${output_command[@]}" "ERROR: unknown option: ${1}" >&2 exit 1 ;; *) @@ -125,27 +134,27 @@ parse_options() { [[ -v home_noexec_maybe ]] || home_noexec_maybe="" [[ -v most_noexec_maybe ]] || most_noexec_maybe="" - $output_command "INFO: using nosuid,nodev: yes" + "${output_command[@]}" "INFO: using nosuid,nodev: yes" - if [ "$home_noexec_maybe" = "" ]; then - $output_command "INFO: using noexec for all: no" + if [ "${home_noexec_maybe}" = "" ]; then + "${output_command[@]}" "INFO: using noexec for all: no" else - $output_command "INFO: using noexec for all: yes" + "${output_command[@]}" "INFO: using noexec for all: yes" return 0 fi - if [ "$most_noexec_maybe" = "" ]; then - $output_command "INFO: using noexec for most: no" + if [ "${most_noexec_maybe}" = "" ]; then + "${output_command[@]}" "INFO: using noexec for most: no" else - $output_command "INFO: using noexec for most (not all): yes" + "${output_command[@]}" "INFO: using noexec for most (not all): yes" return 0 fi - if [ "$parsed" = "true" ]; then + if [ "${parsed}" = "true" ]; then return 0 fi - $output_command "ERROR: syntax error. use either: + "${output_command[@]}" "ERROR: syntax error. use either: $0 0 $0 1 $0 2 @@ -156,14 +165,14 @@ $0 3" preparation() { ## Debugging. - #$output_command "INFO: 'findmnt --list' output at the START." - #$output_command "$(findmnt --list)" - #$output_command "" + #"${output_command[@]}" "INFO: 'findmnt --list' output at the START." + #"${output_command[@]}" "$(findmnt --list)" + #"${output_command[@]}" "" true } remount_secure() { - $output_command "" + "${output_command[@]}" "" ## ${FUNCNAME[1]} is the name of the calling function. I.e. the function ## which called this function. @@ -174,52 +183,52 @@ remount_secure() { ## example status_file_full_path: ## /run/remount-secure/_home - old_mount_options="$(findmnt --noheadings --output options -- "$mount_folder")" || true + old_mount_options="$(findmnt --noheadings --output options -- "${mount_folder}")" || true ## example old_mount_options: ## rw,nosuid,nodev,relatime,discard - $output_command "INFO: '$mount_folder' old_mount_options: '$old_mount_options'" + "${output_command[@]}" "INFO: '${mount_folder}' old_mount_options: '${old_mount_options}'" - if echo "$old_mount_options" | grep --quiet "$intended_mount_options" ; then - $output_command "INFO: '$mount_folder' has already intended mount options. ('$intended_mount_options')" + if printf '%s\n' "${old_mount_options}" | grep "${intended_mount_options}" >/dev/null 2>/dev/null ; then + "${output_command[@]}" "INFO: '${mount_folder}' has already intended mount options. ('${intended_mount_options}')" return 0 fi ## When this package is upgraded, the systemd unit will run again. ## If the user meanwhile manually relaxed mount options, this should not be undone. - if [ ! "$option_force" == "true" ]; then - if [ -e "$status_file_full_path" ]; then - $output_command "INFO: '$mount_folder' already remounted earlier. Not remounting again. Use --force if this is what you want." + if [ ! "${option_force}" == "true" ]; then + if [ -e "${status_file_full_path}" ]; then + "${output_command[@]}" "INFO: '${mount_folder}' already remounted earlier. Not remounting again. Use --force if this is what you want." return 0 fi fi - if ! test -d "$mount_folder" ; then + if ! test -d "${mount_folder}" ; then ## For example /boot/efi does not always exist on all systems. - $output_command "INFO: '$mount_folder' folder exists: no" + "${output_command[@]}" "INFO: '${mount_folder}' folder exists: no" return 0 fi - $output_command "INFO: '$mount_folder' folder exists: yes" + "${output_command[@]}" "INFO: '${mount_folder}' folder exists: yes" - if findmnt --noheadings "$mount_folder" >/dev/null ; then - $output_command "INFO: '$mount_folder' already mounted, therefore using remount." - $output_command INFO: Executing: mount --make-private --options "remount,${intended_mount_options}" "$mount_folder" - mount --make-private --options "remount,${intended_mount_options}" "$mount_folder" || exit_code=100 + if findmnt --noheadings "${mount_folder}" >/dev/null ; then + "${output_command[@]}" "INFO: '${mount_folder}' already mounted, therefore using remount." + "${output_command[@]}" "INFO: Executing: mount --make-private --options remount,${intended_mount_options} ${mount_folder}" + mount --make-private --options "remount,${intended_mount_options}" "${mount_folder}" || exit_code=100 else - $output_command "INFO: '$mount_folder' not yet mounted, therefore using mount bind." - $output_command INFO: Executing: mount --make-private --options "$intended_mount_options" --bind "$mount_folder" "$mount_folder" - mount --make-private --options "$intended_mount_options" --bind "$mount_folder" "$mount_folder" || exit_code=101 + "${output_command[@]}" "INFO: '${mount_folder}' not yet mounted, therefore using mount bind." + "${output_command[@]}" "INFO: Executing: mount --make-private --options ${intended_mount_options} --bind ${mount_folder} ${mount_folder}" + mount --make-private --options "${intended_mount_options}" --bind "${mount_folder}" "${mount_folder}" || exit_code=101 fi - new_mount_options="$(findmnt --noheadings --output options -- "$mount_folder")" || true - $output_command "INFO: '$mount_folder' new_mount_options: '$new_mount_options'" + new_mount_options="$(findmnt --noheadings --output options -- "${mount_folder}")" || true + "${output_command[@]}" "INFO: '${mount_folder}' new_mount_options: '${new_mount_options}'" - touch "$status_file_full_path" + touch "${status_file_full_path}" } _boot() { - mount_folder="$NEWROOT/boot" + mount_folder="${NEWROOT}/boot" ## https://lists.freedesktop.org/archives/systemd-devel/2015-February/028456.html intended_mount_options="nosuid,nodev,noexec" remount_secure @@ -227,7 +236,7 @@ _boot() { _boot_efi() { ## TODO: new, test - mount_folder="$NEWROOT/boot/efi" + mount_folder="${NEWROOT}/boot/efi" intended_mount_options="nosuid,nodev,noexec" remount_secure } @@ -261,25 +270,25 @@ _sys() { } _tmp() { - mount_folder="$NEWROOT/tmp" + mount_folder="${NEWROOT}/tmp" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _var_tmp() { - mount_folder="$NEWROOT/var/tmp" + mount_folder="${NEWROOT}/var/tmp" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _var_log() { - mount_folder="$NEWROOT/var/log" + mount_folder="${NEWROOT}/var/log" intended_mount_options="nosuid,nodev,noexec" remount_secure } _var() { - mount_folder="$NEWROOT/var" + mount_folder="${NEWROOT}/var" ## noexec: Not possible. Reason: ## Debian stores executable maintainer scripts in /var/lib/dpkg/info folder. intended_mount_options="nosuid,nodev" @@ -288,48 +297,48 @@ _var() { _usr() { ## TODO: new, test - mount_folder="$NEWROOT/usr" + mount_folder="${NEWROOT}/usr" intended_mount_options="nodev" remount_secure } _home() { - mount_folder="$NEWROOT/home" + mount_folder="${NEWROOT}/home" intended_mount_options="nosuid,nodev${home_noexec_maybe}" remount_secure } _root() { ## TODO: new, test - mount_folder="$NEWROOT/root" + mount_folder="${NEWROOT}/root" intended_mount_options="nosuid,nodev${home_noexec_maybe}" remount_secure } _srv() { ## TODO: new, test - mount_folder="$NEWROOT/srv" + mount_folder="${NEWROOT}/srv" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _media() { ## TODO: new, test - mount_folder="$NEWROOT/media" + mount_folder="${NEWROOT}/media" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _mnt() { ## TODO: new, test - mount_folder="$NEWROOT/mnt" + mount_folder="${NEWROOT}/mnt" intended_mount_options="nosuid,nodev${most_noexec_maybe}" remount_secure } _opt() { ## TODO: new, test - mount_folder="$NEWROOT/opt" + mount_folder="${NEWROOT}/opt" ## Allow /opt exec as usually optional binaries are placed there such as Firefox ## when manually installed from tarball. intended_mount_options="nosuid,nodev" @@ -340,20 +349,20 @@ _etc() { ## TODO: new, test ## /etc cannot be noexec because various executables are there. To find, run: ## sudo find /etc -executable - mount_folder="$NEWROOT/etc" + mount_folder="${NEWROOT}/etc" intended_mount_options="nosuid,nodev" remount_secure } end() { ## Debugging. - #$output_command "INFO: 'findmnt --list' output at the END." - #$output_command "$(findmnt --list)" + #"${output_command[@]}" "INFO: 'findmnt --list' output at the END." + #"${output_command[@]}" "$(findmnt --list)" - $output_command "" - $output_command "INFO: exit_code: $exit_code" - $output_command "$0: INFO: END" - exit $exit_code + "${output_command[@]}" "" + "${output_command[@]}" "INFO: exit_code: ${exit_code}" + "${output_command[@]}" "$0: INFO: END" + exit "${exit_code}" } main() { @@ -382,7 +391,7 @@ main() { end } -## TODO: see also hidepid /usr/lib/systemd/system/proc-hidepid.service +## REMINDER: see also hidepid /usr/lib/systemd/system/proc-hidepid.service #mount --options defaults,nosuid,nodev,noexec,remount,subset=pid /proc main "$@" diff --git a/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf b/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop similarity index 69% rename from usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf rename to usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop index 246eaf24..5bd18739 100644 --- a/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf +++ b/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf#security-misc-desktop @@ -1,4 +1,4 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## MAC randomisation breaks root server and VirtualBox DHCP likely due to IPv6 Privacy Extensions. @@ -7,7 +7,7 @@ ## https://github.com/Kicksecure/security-misc/pull/145 ## https://github.com/Kicksecure/security-misc/issues/184 ## -## The use of IPv6 Privacy Extenstions is currently diasbled due to these breakages. +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. #[connection] #ipv6.ip6-privacy=2 diff --git a/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf b/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop similarity index 75% rename from usr/lib/NetworkManager/conf.d/80_randomize-mac.conf rename to usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop index dfeda10d..c664e9b7 100644 --- a/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf +++ b/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf#security-misc-desktop @@ -1,4 +1,4 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## MAC randomisation breaks root server and VirtualBox DHCP likely due to IPv6 Privacy Extensions. @@ -7,7 +7,7 @@ ## https://github.com/Kicksecure/security-misc/pull/145 ## https://github.com/Kicksecure/security-misc/issues/184 ## -## The use of IPv6 Privacy Extenstions is currently diasbled due to these breakages. +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. #[device-mac-randomization] #wifi.scan-rand-mac-address=yes diff --git a/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh b/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared similarity index 92% rename from usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh rename to usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared index e5a41885..89170912 100755 --- a/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh +++ b/usr/lib/dracut/modules.d-disabled/20remount-secure/module-setup.sh#security-misc-shared @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. # called by dracut diff --git a/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh b/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared similarity index 89% rename from usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh rename to usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared index de44d46a..0e0a0c17 100755 --- a/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh +++ b/usr/lib/dracut/modules.d-disabled/20remount-secure/remount-secure.sh#security-misc-shared @@ -1,6 +1,6 @@ #!/bin/sh -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## This script is intended to remount specified mount points with more secure diff --git a/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared b/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared new file mode 100755 index 00000000..092b610f --- /dev/null +++ b/usr/lib/dracut/modules.d/99emerg-shutdown/module-setup.sh#security-misc-shared @@ -0,0 +1,50 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## style-ok: no-strict (sourced by dracut) + +## called by dracut +check() { + require_binaries /usr/bin/emerg-shutdown || return 1 + return 255 +} + +## called by dracut +depends() { + printf '%s\n' 'systemd bash' + return 0 +} + +## called by dracut +install() { + local config_file + + inst systemd-notify + + inst_simple /usr/libexec/security-misc/emerg-shutdown + inst_simple /usr/share/security-misc/emerg-shutdown-initramfs.service /usr/lib/systemd/system/emerg-shutdown-initramfs.service + inst_simple /usr/bin/emerg-shutdown /emerg-shutdown + + for config_file in /etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + inst_multiple /etc/security-misc/emerg-shutdown/*.conf + break + fi + done + for config_file in /usr/local/etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + inst_multiple /usr/local/etc/security-misc/emerg-shutdown/*.conf + break + fi + done + + mkdir -p "${initdir}/usr/lib/systemd/system/initrd.target.wants" + ln -s '../emerg-shutdown-initramfs.service' "${initdir}/usr/lib/systemd/system/initrd.target.wants/emerg-shutdown-initramfs.service" +} + +## called by dracut +installkernel () { + hostonly='' instmods evdev +} diff --git a/usr/lib/issue.d/20_security-misc.issue b/usr/lib/issue.d/20_security-misc.issue#security-misc-shared similarity index 100% rename from usr/lib/issue.d/20_security-misc.issue rename to usr/lib/issue.d/20_security-misc.issue#security-misc-shared diff --git a/usr/lib/modules-load.d/30_security-misc.conf b/usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared similarity index 60% rename from usr/lib/modules-load.d/30_security-misc.conf rename to usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared index 08ee22a8..6ee13ca8 100644 --- a/usr/lib/modules-load.d/30_security-misc.conf +++ b/usr/lib/modules-load.d/30_security-misc.conf#security-misc-shared @@ -1,7 +1,7 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. -## https://www.whonix.org/wiki/Dev/Entropy +## https://www.kicksecure.com/wiki/Dev/Entropy ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972 ## https://forums.whonix.org/t/jitterentropy-rngd/7204 jitterentropy_rng diff --git a/etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf b/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared similarity index 54% rename from etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared index 57ad396f..e45baa3f 100644 --- a/etc/permission-hardener.d/25_default_whitelist_bubblewrap.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_bubblewrap.conf#security-misc-shared @@ -1,9 +1,9 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. /usr/bin/bwrap exactwhitelist -/bin/bwrap exactwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared new file mode 100644 index 00000000..0c00e338 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_chromium.conf#security-misc-shared @@ -0,0 +1,18 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Chrome/Chromium now uses namespace-based sandboxing rather than a SUID +## sandbox for most use cases, and while the SUID sandbox is still technically +## supported [1], it's also virtually unused [2]. Chromium still works fine +## when it is stripped of its SUID bit and rendered no longer executable, +## and opening `chrome://sandbox` while in this state shows that sandboxing is +## still working perfectly fine. +## +## [1] https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_sandboxing.md +## [2] https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_suid_sandbox.md +#chrome-sandbox matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared new file mode 100644 index 00000000..8d370cd4 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_dbus.conf#security-misc-shared @@ -0,0 +1,17 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Needed for D-Bus system activation to work. +## https://dbus.freedesktop.org/doc/system-activation.txt +## +## May be vital for desktop features to work normally. +## +## Appears to have been designed with security in mind and can only be called +## by root or a user in the `messagebus` group (which currently has one member, +## namely user `messagebus`). +dbus-daemon-launch-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_firejail.conf b/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared similarity index 59% rename from etc/permission-hardener.d/25_default_whitelist_firejail.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared index fbece5c5..79517913 100644 --- a/etc/permission-hardener.d/25_default_whitelist_firejail.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_firejail.conf#security-misc-shared @@ -1,11 +1,12 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. ## There is a controversy about firejail but those who choose to install it ## should be able to use it. -## https://www.whonix.org/wiki/Dev/Firejail#Security +## https://www.kicksecure.com/wiki/Dev/Firejail#Security /usr/bin/firejail exactwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared new file mode 100644 index 00000000..785df830 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_fuse.conf#security-misc-shared @@ -0,0 +1,18 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Critical component of FUSE (Filesystem in USErspace) +## +## Used by things such as: +## - AppImages +## - such as electrum Bitcoin wallet +## - Docker +## If not SUID, unprivileged users will be unable to use FUSE any longer. +## +## https://forums.whonix.org/t/disable-suid-binaries/7706/57 +/fusermount matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf b/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared similarity index 61% rename from etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared index 54374365..3d8eae38 100644 --- a/etc/permission-hardener.d/25_default_whitelist_hardened_malloc.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_hardened_malloc.conf#security-misc-shared @@ -1,9 +1,10 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. libhardened_malloc.so matchwhitelist libhardened_malloc-light.so matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_mount.conf b/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared similarity index 65% rename from etc/permission-hardener.d/25_default_whitelist_mount.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared index 54b22a69..d1955e28 100644 --- a/etc/permission-hardener.d/25_default_whitelist_mount.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_mount.conf#security-misc-shared @@ -1,17 +1,18 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. ## https://forums.whonix.org/t/disable-suid-binaries/7706/61 ## Protect from 'chmod -x' (and SUID removal). ## SUID will be removed below in separate step. -/bin/mount exactwhitelist /usr/bin/mount exactwhitelist +/usr/bin/umount exactwhitelist ## Remove SUID from 'mount' but keep executable. ## https://forums.whonix.org/t/disable-suid-binaries/7706/61 -/bin/mount 745 root root -/usr/bin/mount 745 root root +/usr/bin/mount 755 root root +/usr/bin/umount 755 root root diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared new file mode 100644 index 00000000..a851cbb6 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_pam.conf#security-misc-shared @@ -0,0 +1,23 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Used by the pam_tmpdir module to create a secure temporary directory for the +## user that is logging in. +## https://manpages.ubuntu.com/manpages/oracular/man8/pam-tmpdir-helper.8.html +## Apparently specific to Debian, there isn't actually any Git repo with this +## code in it, it's just a "floating" package in the Debian archive. Written by +## the same person who maintains the package. Almost certainly cannot be +## disabled without causing serious problems, but may be worth auditing. +## (Worthy of note, it doesn't seem this program takes any user input, but +## relies solely on the calling user's UID and GID, though this could require +## further review.) +## +## Without this, LXQt fails to start with a dbus-launch error. +## +## TODO-HUMAN-DEVELOPER-ONLY: source audit pam-tmpdir-helper +pam-tmpdir-helper matchwhitelist diff --git a/etc/permission-hardener.d/25_default_passwd.conf b/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared similarity index 57% rename from etc/permission-hardener.d/25_default_passwd.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared index 6313e15e..4cd8d358 100644 --- a/etc/permission-hardener.d/25_default_passwd.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_passwd.conf#security-misc-shared @@ -1,14 +1,16 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. # Keep the `passwd` utility executable to prevent issues with the # /usr/libexec/security-misc/pam-abort-on-locked-password script blocking -# user logins with `su` and KScreenLocker +# user logins with `su` and KScreenLocker. exactwhitelist is needed to keep +# the nosuid rule on /usr/bin from fighting with these rules. # # See also: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#passwd +/usr/bin/passwd exactwhitelist /usr/bin/passwd 0755 root root -/bin/passwd 0755 root root diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared new file mode 100644 index 00000000..e328564a --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_policykit.conf#security-misc-shared @@ -0,0 +1,28 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## user-sysmaint-split hardens this further. +/usr/bin/pkexec exactwhitelist +/usr/bin/pkexec.security-misc-orig exactwhitelist + +## Required for PolicyKit (Polkit) to function. +## +## https://polkit-devel.freedesktop.narkive.com/zXO4yEg7/documentation-on-polkit-agent-helper-1-and-suid# +## https://gitlab.freedesktop.org/polkit/polkit/-/issues/168 +## https://cgit.freedesktop.org/polkit/tree/src/polkitagent/polkitagenthelper-pam.c#n93 +## +## Changing permissions here may break more than just normal privilege escalation. +## May be safe to disable for users other than sysmaint similar to what was done with pkexec and sudo, +## however even that might not be safe. +## +## matches both: +## - /usr/lib/policykit-1/polkit-agent-helper-1 +## - /lib/policykit-1/polkit-agent-helper-1 +## +## user-sysmaint-split hardens this further. +polkit-agent-helper-1 matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared new file mode 100644 index 00000000..e4508770 --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_postfix.conf#security-misc-shared @@ -0,0 +1,12 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Ref: https://www.postfix.org/postconf.5.html (setgid_group) +## TODO-HUMAN-DEVELOPER-ONLY: research +postqueue matchwhitelist +postdrop matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared new file mode 100644 index 00000000..82be6d2e --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## qfile-unpacker is written by Qubes and is trusted. Needed as part of copying +## files between VMs. +## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c +## +## Historic Qubes upstream security issue: +## qfile-unpacker allows unprivileged users in VMs to gain root privileges +## https://github.com/QubesOS/qubes-issues/issues/8633 +## +## matches both: +## - /usr/lib/qubes/qfile-unpacker whitelist +## - Not bit-for-bit identical to /usr/lib/qubes/qfile-unpacker. +## - Stripping SUID from this does *not* break file copying. +## - TODO-HUMAN-DEVELOPER-ONLY: further research required on its purpose +## - /usr/bin/qfile-unpacker +## - Appears to be an integral part of file transfer between qubes, stripping +## SUID from this in an AppVM results in that AppVM being unable to receive +## files any longer. (It can still send files to other qubes though.) +qfile-unpacker matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared new file mode 100644 index 00000000..6265587f --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_spice.conf#security-misc-shared @@ -0,0 +1,11 @@ +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Ref: https://packages.debian.org/trixie/spice-client-glib-usb-acl-helper +## TODO-HUMAN-DEVELOPER-ONLY: research +spice-client-glib-usb-acl-helper matchwhitelist diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared b/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared new file mode 100644 index 00000000..6a987f3e --- /dev/null +++ b/usr/lib/permission-hardener.d/25_default_whitelist_ssh.conf#security-misc-shared @@ -0,0 +1,22 @@ +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Please use "/etc/permission-hardener.d/20_user.conf" or +## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom +## configuration. When security-misc-shared is updated, this file may be +## overwritten. + +## Used for SSH client key management +## https://manpages.debian.org/ssh-agent +## Debian installs ssh-agent with setgid permissions (2755) and with +## _ssh as the group to help mitigate ptrace attacks that could extract +## private keys from the agent's memory. +ssh-agent matchwhitelist + +## Used only for SSH host-based authentication +## https://manpages.debian.org/ssh-keysign +## Needed to allow access to the machine's host key for use in the +## authentication process. This is a non-default method of authenticating to +## SSH, and is likely rarely used, thus this should be safe to disable. +#ssh-keysign matchwhitelist +#/usr/lib/openssh matchwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_sudo.conf b/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared similarity index 50% rename from etc/permission-hardener.d/25_default_whitelist_sudo.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared index 70038619..84e74975 100644 --- a/etc/permission-hardener.d/25_default_whitelist_sudo.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_sudo.conf#security-misc-shared @@ -1,9 +1,10 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. +## user-sysmaint-split hardens this further. /usr/bin/sudo exactwhitelist -/bin/sudo exactwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf b/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared similarity index 64% rename from etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared index 5953d850..0733fc9a 100644 --- a/etc/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_unix_chkpwd.conf#security-misc-shared @@ -1,11 +1,11 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. ## required for performing password validation from unprivileged user ## processes such as KScreenLocker's unlock prompt /usr/sbin/unix_chkpwd exactwhitelist -/sbin/unix_chkpwd exactwhitelist diff --git a/etc/permission-hardener.d/25_default_whitelist_virtualbox.conf b/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared similarity index 65% rename from etc/permission-hardener.d/25_default_whitelist_virtualbox.conf rename to usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared index d9c68bc7..6e27e081 100644 --- a/etc/permission-hardener.d/25_default_whitelist_virtualbox.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_virtualbox.conf#security-misc-shared @@ -1,13 +1,13 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. -## TODO: research +## TODO-HUMAN-DEVELOPER-ONLY: research /usr/lib/virtualbox/ matchwhitelist -/lib/virtualbox/ matchwhitelist VirtualBoxVM matchwhitelist VBoxSDL matchwhitelist VBoxNetNAT matchwhitelist diff --git a/etc/permission-hardener.d/30_default.conf b/usr/lib/permission-hardener.d/30_default.conf#security-misc-shared similarity index 88% rename from etc/permission-hardener.d/30_default.conf rename to usr/lib/permission-hardener.d/30_default.conf#security-misc-shared index d35ee5a9..91e15eb5 100644 --- a/etc/permission-hardener.d/30_default.conf +++ b/usr/lib/permission-hardener.d/30_default.conf#security-misc-shared @@ -1,9 +1,10 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Please use "/etc/permission-hardener.d/20_user.conf" or ## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom -## configuration. When security-misc is updated, this file may be overwritten. +## configuration. When security-misc-shared is updated, this file may be +## overwritten. ## File permission hardening. ## @@ -11,7 +12,8 @@ ## [filename] [mode] [owner] [group] [capability] ## [filename] [exactwhitelist|matchwhitelist|disablewhitelist|nosuid] ## -## TODO: white spaces inside file name untested and probably will not work. +## White spaces inside a file name are supported, no quoting or escaping is +## necessary (or permitted). ###################################################################### # Global Settings @@ -23,10 +25,6 @@ # SUID disables below (or in lexically higher) files: disablewhitelist ###################################################################### -## For example, if you are not using SELinux the following might make sense to -## enable. TODO: research -#/utempter/utempter disablewhitelist - ## If you are not going to use AppImages such as electrum Bitcoin wallet. #/fusermount disablewhitelist @@ -118,5 +116,5 @@ ## anon-apps-config does this. #/usr/bin/ping 0744 root root none -## TODO: research -#/usr/lib/x86_64-linux-gnu/gstreamer1.0/grstreamer-1.0/gst-ptp-helper 0744 root root none +## TODO-HUMAN-DEVELOPER-ONLY: research +#/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper 0744 root root none diff --git a/usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py#security-misc-shared b/usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py#security-misc-shared new file mode 100644 index 00000000..e69de29b diff --git a/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared b/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared new file mode 100755 index 00000000..3fb3053e --- /dev/null +++ b/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py#security-misc-shared @@ -0,0 +1,724 @@ +#!/usr/bin/python3 -Bsu + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +# pylint: disable=broad-exception-caught + +## Notes for reviewers: +## +## * Local denial-of-service is out of scope. There are easier ways for +## malware to pop up lots of windows or consume huge amounts of RAM. +## * The shim's primary purpose is to ensure that files aren't accidentally +## opened when trying to view the contents of a directory. We do not care if +## the exact directory that exists at launch time is the directory that gets +## opened when the user chooses to open it. Therefore replacement attacks +## involving swapping one directory with another or with a symlink to a +## directory are out of scope. +## * Python version lower than 3.13.5 are out of scope. + +""" +fm_shim_frontend.py - Prompts the user if they want to open one or more +directories in the default file manager. +""" + +import sys +import os +import signal +import subprocess +import traceback +import urllib.parse +from pathlib import Path +from typing import NoReturn, cast +from types import FrameType + +from PyQt5.QtCore import QTimer, QObject, QEvent, Qt +from PyQt5.QtGui import QFontDatabase, QBrush, QColor +from PyQt5.QtWidgets import ( + QApplication, + QCheckBox, + QDialog, + QLabel, + QListWidget, + QListWidgetItem, + QPushButton, + QSizePolicy, + QTextEdit, + QVBoxLayout, + QHBoxLayout, + QWidget, + QScrollBar, + QLayout, + QMessageBox, +) + +from stdisplay.stdisplay import stdisplay + + +class WidgetShowBinding(QObject): + """ + Detects when a widget is shown or hidden, and shows or hides another + widget in response. + """ + + def __init__( + self, bound_widget: QWidget, parent: QObject | None = None + ) -> None: + """ + ScrollBarEventFilter constructor. + """ + + super().__init__(parent) + + self.bound_widget = bound_widget + + # pylint: disable=invalid-name, unused-argument + def eventFilter(self, obj: QObject | None, event: QEvent | None) -> bool: + """ + Shows or hides the bound widget when the binding widget is shown or + hidden. + """ + + if event is None: + return False + + # pylint: disable=no-member + do_recalc_layout: bool = False + if event.type() == QEvent.Type.Show: + self.bound_widget.show() + do_recalc_layout = True + # pylint: disable=no-member + elif event.type() == QEvent.Type.Hide: + self.bound_widget.hide() + do_recalc_layout = True + if do_recalc_layout: + parent_object: QObject | None = self.bound_widget.parent() + assert parent_object is not None + parent_widget: QWidget = cast(QWidget, parent_object) + parent_layout: QLayout | None = parent_widget.layout() + assert parent_layout is not None + parent_layout.update() + return False + + +class AnalyzePathsWindow(QDialog): + """ + Helper window for analyzing unsafe characters in paths. + """ + + def __init__( + self, dir_list: list[Path], parent: QDialog | None = None + ) -> None: + """ + AnalyzePathsWindow constructor. + """ + + super().__init__(parent) + + self.dir_list: list[Path] = dir_list + self.has_unsafe_chars_list: list[bool] = [] + + self.core_layout: QVBoxLayout = QVBoxLayout() + self.dir_list_view: QListWidget = QListWidget() + self.dir_list_view.resize(1, 50) + # pylint: disable=no-member + self.dir_list_view.setSizePolicy( + QSizePolicy.Policy.Expanding, + QSizePolicy.Policy.Fixed, + ) + self.dir_list_view.currentRowChanged.connect( + self.populate_unicode_show_view + ) + self.core_layout.addWidget(self.dir_list_view) + + self.unicode_show_view: QTextEdit = QTextEdit() + self.unicode_show_view.setReadOnly(True) + # pylint: disable=no-member + self.unicode_show_view.setLineWrapMode(QTextEdit.LineWrapMode.NoWrap) + # pylint: disable=no-member + self.unicode_show_view.setCurrentFont( + QFontDatabase.systemFont(QFontDatabase.SystemFont.FixedFont) + ) + self.core_layout.addWidget(self.unicode_show_view) + + self.button_layout: QHBoxLayout = QHBoxLayout() + self.button_layout.addStretch() + self.done_button: QPushButton = QPushButton("Done") + self.done_button.clicked.connect(self.accept) + self.button_layout.addWidget(self.done_button) + self.core_layout.addLayout(self.button_layout) + + self.setLayout(self.core_layout) + self.setWindowTitle("Analyze Paths") + self.resize(690, 500) + + for dir_path in self.dir_list: + qlwi: QListWidgetItem = QListWidgetItem( + stdisplay(str(dir_path), sgr=-1) + ) + if any( + (not 0x20 <= ord(path_char) <= 0x7E) + for path_char in str(dir_path) + ): + qlwi.setBackground(QBrush(QColor(255, 128, 128))) + self.has_unsafe_chars_list.append(True) + else: + self.has_unsafe_chars_list.append(False) + self.dir_list_view.addItem(qlwi) + + self.populate_unicode_show_view(-1) + + def populate_unicode_show_view(self, path_idx: int) -> None: + """ + Runs the path through unicode-show and populates info about it in the + unicode_show_view widget. + """ + + if path_idx < 0 or path_idx >= len(self.dir_list): + self.unicode_show_view.setPlainText( + "Select a file path to analyze above.\n" + + "Paths highlighted in red contain potentially unsafe " + + "characters." + ) + return + + if self.has_unsafe_chars_list[path_idx]: + try: + unicode_show_output: str = subprocess.run( + ["/usr/bin/unicode-show"], + input=str(self.dir_list[path_idx]), + capture_output=True, + check=False, + encoding="utf-8", + ).stdout + self.unicode_show_view.setPlainText(unicode_show_output) + except Exception: + traceback.print_exc(file=sys.stderr) + self.unicode_show_view.setPlainText( + "Unable to check this path for unsafe chars!\n" + + "See logs in 'journalctl --user --boot fm-shim.service' " + + "for more information." + ) + else: + self.unicode_show_view.setPlainText( + "No unsafe chars found in the selected path." + ) + + +# pylint: disable=too-many-instance-attributes +class FmShimWindow(QDialog): + """ + Core fm_shim_frontend window. + """ + + # pylint: disable=too-many-statements + def __init__( + self, dir_list: list[Path], parent: QDialog | None = None + ) -> None: + """ + FmShimWindow constructor. + """ + + super().__init__(parent) + + self.dir_list: list[Path] = dir_list + + self.core_layout: QVBoxLayout = QVBoxLayout() + self.head_label: QLabel = QLabel( + "An application has requested to open the following directories " + + "with the default file manager:" + ) + self.core_layout.addWidget(self.head_label) + + self.dir_list_view: QTextEdit = QTextEdit() + self.dir_list_view.setReadOnly(True) + # pylint: disable=no-member + self.dir_list_view.setLineWrapMode(QTextEdit.LineWrapMode.NoWrap) + # pylint: disable=no-member + self.dir_list_view.setCurrentFont( + QFontDatabase.systemFont(QFontDatabase.SystemFont.FixedFont) + ) + self.core_layout.addWidget(self.dir_list_view) + + self.sanitized_text_label: QLabel = QLabel( + "Note: Any spaces in the above filenames are displayed as " + + '"middle dot" (\N{MIDDLE DOT}) characters. Potentially ' + + "unsafe characters are displayed as underscores (_)." + ) + self.sanitized_text_label.setWordWrap(True) + self.sanitized_text_label.setVisible(False) + self.core_layout.addWidget(self.sanitized_text_label) + + self.unsafe_text_label: QLabel = QLabel( + 'WARNING: Some of the listed paths ' + + "contain Unicode or ASCII control characters. These can be " + + 'malicious. Use the "Analyze Paths" button for more details. ' + + 'If you are sure the text is safe, check "Display raw path ' + + 'text" below.' + ) + self.unsafe_text_label.setWordWrap(True) + self.unsafe_text_label.setVisible(False) + self.core_layout.addWidget(self.unsafe_text_label) + + horiz_scroll_bar: QScrollBar | None = ( + self.dir_list_view.horizontalScrollBar() + ) + assert horiz_scroll_bar is not None + self.horiz_overflow_warning_label: QLabel = QLabel( + 'WARNING: Some of the paths listed ' + + "above are too long to display all at once. Double-check that " + + "the paths do not look suspicious." + ) + self.horiz_overflow_warning_label.setWordWrap(True) + self.core_layout.addWidget(self.horiz_overflow_warning_label) + self.horiz_overflow_warning_label.setVisible( + horiz_scroll_bar.isVisible() + ) + self.horiz_overflow_warning_binding: WidgetShowBinding = ( + WidgetShowBinding(self.horiz_overflow_warning_label, self) + ) + horiz_scroll_bar.installEventFilter(self.horiz_overflow_warning_binding) + + vert_scroll_bar: QScrollBar | None = ( + self.dir_list_view.verticalScrollBar() + ) + assert vert_scroll_bar is not None + self.vert_overflow_warning_label: QLabel = QLabel( + 'WARNING: Too many paths are listed ' + + "above to display all at once. A new file manager window will " + + "be opened for every listed path. Double-check that this is " + + "what you want." + ) + self.vert_overflow_warning_label.setWordWrap(True) + self.core_layout.addWidget(self.vert_overflow_warning_label) + self.vert_overflow_warning_label.setVisible(vert_scroll_bar.isVisible()) + self.vert_overflow_warning_binding: WidgetShowBinding = ( + WidgetShowBinding(self.vert_overflow_warning_label, self) + ) + vert_scroll_bar.installEventFilter(self.vert_overflow_warning_binding) + + self.foot_label: QLabel = QLabel( + "Would you like to open these directories? A separate file " + + "manager window will be opened for every listed path." + ) + self.core_layout.addWidget(self.foot_label) + + self.button_layout: QHBoxLayout = QHBoxLayout() + self.display_raw_checkbox: QCheckBox = QCheckBox( + "Display raw path text" + ) + self.display_raw_checkbox.stateChanged.connect(self.toggle_display_raw) + self.button_layout.addWidget(self.display_raw_checkbox) + + self.analyze_paths_button: QPushButton = QPushButton("Analyze Paths") + self.analyze_paths_button.clicked.connect(self.analyze_paths) + self.analyze_paths_button.setVisible(False) + self.button_layout.addWidget(self.analyze_paths_button) + self.button_layout.addStretch() + + self.open_button: QPushButton = QPushButton("Open") + self.open_button.clicked.connect(self.open_dir_list) + self.cancel_button: QPushButton = QPushButton("Cancel") + self.cancel_button.clicked.connect(self.exit_app) + self.button_layout.addWidget(self.open_button) + self.button_layout.addWidget(self.cancel_button) + self.core_layout.addLayout(self.button_layout) + + self.setLayout(self.core_layout) + self.setWindowTitle("Open Directories") + + for dir_path in self.dir_list: + if any( + (not 0x20 <= ord(path_char) <= 0x7E) + for path_char in str(dir_path) + ): + self.unsafe_text_label.setVisible(True) + self.analyze_paths_button.setVisible(True) + + self.resize(690, 500) + + self.display_sanitized_dir_paths() + self.show() + + def display_sanitized_dir_paths(self) -> None: + """ + Sanitizes the paths in the dir list from all unsafe characters, + replaces spaces with middle dot characters, displays them to the user, + and displays a note about text sanitization. + """ + + sanitized_string: str = stdisplay( + "\n".join([str(x) for x in self.dir_list]), sgr=-1 + ) + self.dir_list_view.setPlainText( + sanitized_string.replace(" ", "\N{MIDDLE DOT}") + ) + self.sanitized_text_label.setVisible(True) + + def display_unsanitized_dir_paths(self) -> None: + """ + Displays the paths in the dir list unsanitized, and hides the text + sanitization note. + """ + + self.dir_list_view.setPlainText( + "\n".join([str(x) for x in self.dir_list]) + ) + self.sanitized_text_label.setVisible(False) + + def toggle_display_raw(self, new_state: int) -> None: + """ + Turns text sanitization on or off. + """ + + if new_state == 0: + self.display_sanitized_dir_paths() + else: + self.display_unsanitized_dir_paths() + + def analyze_paths(self) -> None: + """ + Opens a new window where the user can analyze potentially unsafe paths + before opening them with PCManFM-Qt. + """ + + apw: AnalyzePathsWindow = AnalyzePathsWindow(self.dir_list) + apw.exec() + + # pylint: disable=too-many-branches + def open_dir_list(self) -> None: + """ + Opens all specified directories using the default file manager. + """ + + try: + default_fm_desktop_file: str = subprocess.run( + ["/usr/bin/xdg-mime", "query", "default", "inode/directory"], + check=True, + capture_output=True, + encoding="utf-8", + ).stdout.strip() + except Exception: + print( + "ERROR: Unable to get default file manager!", + file=sys.stderr, + ) + sys.exit(1) + + ## Expect a plain desktop filename, not a path. + if ( + default_fm_desktop_file == "" + or "/" in default_fm_desktop_file + or not default_fm_desktop_file.endswith(".desktop") + ): + print( + "ERROR: Invalid default file manager desktop file name!", + file=sys.stderr, + ) + sys.exit(1) + + search_dir_list: list[str] = [] + + ## "" rather than None is intentional here, as + ## os.environ["XDG_DATA_HOME"] may be "", not None. + xdg_data_home: str = "" + try: + xdg_data_home = os.environ["XDG_DATA_HOME"] + except KeyError: + pass + if xdg_data_home == "": + home_env_var = "" + try: + home_env_var = os.environ["HOME"] + except KeyError: + pass + if home_env_var == "": + print( + "ERROR: Both the XDG_DATA_HOME and HOME environment " + + "variables are either undefined or empty!", + file=sys.stderr, + ) + sys.exit(1) + xdg_data_home = home_env_var + "/.local/share" + if not xdg_data_home.startswith("/"): + print( + "ERROR: XDG_DATA_HOME is not an absolute path!", file=sys.stderr + ) + sys.exit(1) + search_dir_list.append(xdg_data_home) + + ## Again, using "" rather than None is intentional here. + xdg_data_dirs: str = "" + try: + xdg_data_dirs = os.environ["XDG_DATA_DIRS"] + except Exception: + pass + xdg_data_dir_list = [p for p in xdg_data_dirs.split(":") if p != ""] + if len(xdg_data_dir_list) == 0: + xdg_data_dir_list = ["/usr/local/share", "/usr/share"] + if not all(x.startswith("/") for x in xdg_data_dir_list): + print( + "ERROR: XDG_DATA_DIRS contains non-absolute paths!", + file=sys.stderr, + ) + sys.exit(1) + search_dir_list.extend(xdg_data_dir_list) + + found_desktop_file: bool = False + for search_dir in search_dir_list: + default_fm_path: Path = Path( + search_dir + "/applications/" + default_fm_desktop_file + ) + if default_fm_path.is_file(): + found_desktop_file = True + break + if not found_desktop_file: + print( + "ERROR: Cannot find default file manager's desktop file!", + file=sys.stderr, + ) + sys.exit(1) + + for target_dir in self.dir_list: + if target_dir.is_dir(): + subprocess.run( + ["/usr/bin/gio", "launch", str(default_fm_path), str(target_dir)], + check=False, + ) + else: + QMessageBox.warning( + self, + "Open Directories", + Qt.convertFromPlainText( # type: ignore + "ERROR: The following path was no longer a dir when " + + "checked before opening:\n" + + "\n" + + f"{stdisplay(str(target_dir), sgr=-1)}\n" + + "\n" + + "This may be the result of an attempted attack. No " + + "further directories will be opened." + ), + ) + sys.exit(1) + + sys.exit(0) + + @staticmethod + def exit_app() -> None: + """ + Exits the application. + """ + + sys.exit(0) + + +# pylint: disable=unused-argument +def signal_handler(sig: int, frame: FrameType | None) -> None: + """ + Handles SIGINT and SIGTERM. + """ + + print("Received SIGINT or SIGTERM, exiting.", file=sys.stderr) + sys.exit(128 + sig) + + +def get_path_list_from_uris( + handler_mode: str, uri_list: list[str] +) -> list[Path]: + """ + Converts a list of URIs into a list of paths, discarding any invalid URIs + that are encountered in the process. + """ + + path_set: set[Path] = set() + + for uri in uri_list: + ## Do not permit Unicode or control characters in URIs. While the + ## files pointed to by URIs may contain Unicode in their filenames, + ## Unicode characters beyond 7-bit ASCII are forbidden in URIs. The + ## org.freedesktop.FileManager1 spec says that we should expect URI + ## strings here, not IRI strings (which can contain Unicode), so this + ## is safe. + if any((not 0x20 <= ord(uri_char) <= 0x7E) for uri_char in uri): + print( + "WARNING: Path URI contains Unicode or control characters, " + + f"skipping. Sanitized URI: '{stdisplay(uri, sgr=-1)}'", + file=sys.stderr, + ) + continue + + uri_components: urllib.parse.SplitResult = urllib.parse.urlsplit(uri) + + ## Sanity-check the URI (must be a local file URI, must not have a + ## query or fragment component) + if ( + uri_components.scheme != "file" + or uri_components.netloc not in ("", "localhost") + or uri_components.query != "" + or uri_components.fragment != "" + ): + print( + f"WARNING: Path URI '{uri}' does not look like a local file " + + "URI, skipping.", + file=sys.stderr, + ) + continue + + path_str: str = urllib.parse.unquote(uri_components.path) + + ## Do not permit newlines in the path. It is unlikely that these will + ## be used in practice, and they can easily be used to confuse the + ## user. + if "\n" in path_str: + print( + "WARNING: Decoded path string contains newlines, skipping. " + + f"Path: {stdisplay(path_str, sgr=-1)}", + file=sys.stderr, + ) + continue + + ## Do not permit NUL characters in the path. + if "\x00" in path_str: + print( + "WARNING: Decoded path string contains NUL characters, " + + f"skipping. Path: {stdisplay(path_str, sgr=-1)}", + file=sys.stderr, + ) + continue + + ## Ensure path_str is absolute. + if not path_str.startswith("/"): + print( + f"WARNING: Path '{stdisplay(path_str, sgr=-1)}' is not " + + "absolute, skipping.", + file=sys.stderr, + ) + continue + + ## Ensure the path is valid, exists, and is accessible. + path_item: Path = Path(path_str) + try: + path_exists = path_item.exists(follow_symlinks=False) + except OSError as exc: + ## Under Python 3.13, Path.exists() can raise on pathological + ## inputs - in particular ENAMETOOLONG (errno 36) when any single + ## path component exceeds NAME_MAX. An attacker who can inject a + ## URI here (D-Bus FileManager1 calls from another desktop app) + ## could otherwise crash this process by sending one long path. + ## Treat as "non-existent, skip" - same as the False branch. This + ## issue does not exist in Python 3.14, so we can remove this + ## check in Forky. + print( + f"WARNING: Path could not be checked (errno " + f"{exc.errno}: {exc.strerror}), skipping. Sanitized " + f"path: '{stdisplay(path_str, sgr=-1)}'", + file=sys.stderr, + ) + continue + if not path_exists: + print( + f"WARNING: Path '{stdisplay(path_str, sgr=-1)}' does not " + + "exist, skipping.", + file=sys.stderr, + ) + continue + + ## Grab the parent dir if necessary. Note that we aren't able to + ## actually highlight items or show item properties with the API that + ## PCManFM-Qt provides us, but we are able to open the parent + ## directories, which at least gets the user closer to the intended + ## action. + if handler_mode in ("--show-items", "--show-item-properties"): + path_item = path_item.parent + + ## Resolve symlinks and '..' components of the path so the user sees + ## what they're actually going to open. + try: + path_item = path_item.resolve(strict=True) + except OSError: + print( + "WARNING: Could not resolve path " + + f"'{stdisplay(str(path_item), sgr=-1)}', skipping.", + file=sys.stderr, + ) + continue + + ## Only respect directories that we can access the contents of. + if not path_item.is_dir(): + print( + f"WARNING: Path '{stdisplay(str(path_item), sgr=-1)}' does " + + "not point to a directory, skipping.", + file=sys.stderr, + ) + continue + if not os.access(path_item, os.R_OK | os.X_OK): + print( + f"WARNING: Path '{stdisplay(str(path_item), sgr=-1)}' cannot " + + "be accessed by us, skipping.", + file=sys.stderr, + ) + continue + + path_set.add(path_item) + + output_list: list[Path] = list(path_set) + output_list.sort() + return output_list + + +def main() -> NoReturn: + """ + Main function. + """ + + handler_mode: str | None = None + uri_list: list[str] = [] + + for arg_idx, arg in enumerate(sys.argv): + if arg_idx == 0: + continue + if arg in ("--show-folders", "--show-items", "--show-item-properties"): + if handler_mode is not None: + print( + f"ERROR: {arg} and {handler_mode} are mutually exclusive!", + file=sys.stderr, + ) + sys.exit(1) + handler_mode = arg + elif arg == "--": + uri_list = sys.argv[arg_idx + 1 :] + break + else: + uri_list = sys.argv[arg_idx:] + break + + if len(uri_list) == 0: + print("ERROR: No URIs provided!", file=sys.stderr) + sys.exit(1) + if handler_mode is None: + print("ERROR: No handler mode provided!", file=sys.stderr) + sys.exit(1) + + path_list: list[Path] = get_path_list_from_uris(handler_mode, uri_list) + if len(path_list) == 0: + print("ERROR: All provided URIs were invalid!", file=sys.stderr) + sys.exit(1) + + app: QApplication = QApplication(sys.argv) + + signal.signal(signal.SIGINT, signal_handler) + signal.signal(signal.SIGTERM, signal_handler) + + timer: QTimer = QTimer() + timer.timeout.connect(lambda: None) + timer.start(500) + + ## Keep a reference to the window so it isn't garbage-collected. + # pylint: disable=unused-variable + fsw: FmShimWindow = FmShimWindow(path_list) # noqa: F841 + app.exec_() + sys.exit(0) + + +if __name__ == "__main__": + main() diff --git a/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf b/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared similarity index 93% rename from usr/lib/sysctl.d/30_security-misc_kexec-disable.conf rename to usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared index 5c38e386..0ef99dab 100644 --- a/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf +++ b/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Definitions: diff --git a/usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared b/usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared new file mode 100644 index 00000000..724e0f14 --- /dev/null +++ b/usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf#security-misc-shared @@ -0,0 +1,24 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Definitions: +## KSPP=yes: compliant with recommendations by the KSPP +## KSPP=partial: partially compliant with recommendations by the KSPP +## KSPP=no: not (currently) compliant with recommendations by the KSPP +## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. + +## Disable the usage of the ptrace() system call by all processes. +## Restrict ptrace() as it enables programs to inspect and modify other active processes. +## Prevents native code debugging which some programs use as a method to detect tampering. +## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE. +## +## https://docs.kernel.org/admin-guide/LSM/Yama.html#ptrace-scope +## https://en.wikipedia.org/wiki/Ptrace +## https://grapheneos.org/features#attack-surface-reduction +## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928 +## https://github.com/netblue30/firejail/issues/2860 +## +## KSPP=yes +## KSPP sets the sysctl. +## +kernel.yama.ptrace_scope=3 diff --git a/usr/lib/sysctl.d/30_silent-kernel-printk.conf b/usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared similarity index 84% rename from usr/lib/sysctl.d/30_silent-kernel-printk.conf rename to usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared index a1fd57e6..3e424917 100644 --- a/usr/lib/sysctl.d/30_silent-kernel-printk.conf +++ b/usr/lib/sysctl.d/30_silent-kernel-printk.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Definitions: @@ -11,7 +11,7 @@ ## Must be used in conjunction with kernel boot parameters. ## See /etc/default/grub.d/41_quiet_boot.cfg for implementation. ## -## https://www.kernel.org/doc/html/latest/core-api/printk-basics.html +## https://docs.kernel.org/core-api/printk-basics.html ## kernel.printk=3 3 3 3 diff --git a/usr/lib/sysctl.d/990-security-misc.conf b/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared similarity index 63% rename from usr/lib/sysctl.d/990-security-misc.conf rename to usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared index 6009fc43..4dc06302 100644 --- a/usr/lib/sysctl.d/990-security-misc.conf +++ b/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## NOTE: @@ -12,19 +12,17 @@ ## KSPP=no: not (currently) compliant with recommendations by the KSPP ## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. -## This configuration file is divided into 5 sections: +## This configuration file is divided into 6 sections: ## 1. Kernel Space ## 2. User Space ## 3. Core Dumps ## 4. Swap Space ## 5. Networking +## 6. CD-ROM/DVD ## For detailed explanations of most of the selected commands, refer to: -## https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html -## https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html -## https://www.kernel.org/doc/html/latest/admin-guide/sysctl/net.html -## https://www.kernel.org/doc/html/latest/admin-guide/sysctl/vm.html -## https://www.kernel.org/doc/html/latest//networking/ip-sysctl.html +## https://docs.kernel.org/admin-guide/sysctl/index.html +## https://docs.kernel.org/networking/ip-sysctl.html ## 1. Kernel Space: ## @@ -54,7 +52,7 @@ kernel.dmesg_restrict=1 ## Must be used in conjunction with kernel boot parameters. ## See /etc/default/grub.d/41_quiet_boot.cfg for implementation. ## -## https://www.kernel.org/doc/html/latest/core-api/printk-basics.html +## https://docs.kernel.org/core-api/printk-basics.html ## ## See /usr/lib/sysctl.d/30_silent-kernel-printk.conf for implementation. ## @@ -108,7 +106,7 @@ vm.unprivileged_userfaultfd=0 ## Disable the SysRq key to prevent leakage of kernel information. ## The Secure Attention Key (SAK) can no longer be utilized. ## -## https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html +## https://docs.kernel.org/admin-guide/sysrq.html ## https://www.kicksecure.com/wiki/SysRq ## https://github.com/xairy/unlockdown ## @@ -117,47 +115,46 @@ vm.unprivileged_userfaultfd=0 ## kernel.sysrq=0 -## Restrict user namespaces to users with CAP_SYS_ADMIN. +## Disable user namespaces entirely. ## User namespaces aim to improve sandboxing and accessibility for unprivileged users. -## Unprivileged user namespaces pose substantial privilege escalation risks. -## Restricting may lead to breakages in numerous software packages. -## -## Flatpak requires unprivileged users to create new user namespaces for sandboxing. -## https://github.com/flatpak/flatpak/wiki/User-namespace-requirements -## https://salsa.debian.org/debian/bubblewrap/-/blob/debian/latest/debian/README.Debian -## https://forums.kicksecure.com/t/can-not-run-flatpak-apps-after-kicksecure-update/592 -## ## Disabling entirely will reduce compatibility with some AppArmor profiles. ## Disabling entirely is known to break the UPower systemd service. -## -## Also breaks (some?) AppImages. -## https://forums.kicksecure.com/t/cannot-run-some-appimage-apps-after-kicksecure-upate/594 -## -## Might also break evolution (e-mail client): -## https://forums.kicksecure.com/t/impossible-to-start-evolution-app-since-the-last-update/601 +## Not recommended due to well-known breakages across numerous software packages. ## ## https://lwn.net/Articles/673597/ ## https://madaidans-insecurities.github.io/linux.html#kernel -## https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction ## https://github.com/a13xp0p0v/kernel-hardening-checker#questions-and-answers ## https://github.com/NixOS/nixpkgs/pull/84522#issuecomment-614640601 -## https://github.com/flatpak/flatpak/wiki/User-namespace-requirements ## https://github.com/Kicksecure/security-misc/pull/263 -## https://github.com/Kicksecure/security-misc/issues/274 ## ## KSPP=no -## KSPP sets user.max_user_namespaces=0 sysctl, a Linux mainline, stricter setting. +## KSPP sets the sysctl. ## -## kernel.unprivileged_userns_clone is a Debian specific kernel feature. Not Linux mainline. -#kernel.unprivileged_userns_clone=0 -## Uncomment the following sysctl to entirely disable user namespaces. #user.max_user_namespaces=0 +## Restrict user namespaces to users with CAP_SYS_ADMIN. +## See the user.max_user_namespaces setting for more details. +## This is a Debian-specific kernel feature, not a Linux mainline setting. +## Unprivileged user namespaces pose substantial privilege escalation risks. +## Flatpak requires unprivileged users to create new user namespaces for sandboxing. +## Restricting is known to cause breakages in some AppImages and the Evolution Email Client. +## Not recommended due to widespread breakages across many software packages. +## +## https://salsa.debian.org/debian/bubblewrap/-/blob/debian/latest/debian/README.Debian +## https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction +## https://github.com/flatpak/flatpak/wiki/User-namespace-requirements +## https://forums.kicksecure.com/t/can-not-run-flatpak-apps-after-kicksecure-update/592 +## https://forums.kicksecure.com/t/cannot-run-some-appimage-apps-after-kicksecure-upate/594 +## https://forums.kicksecure.com/t/impossible-to-start-evolution-app-since-the-last-update/601 +## https://github.com/Kicksecure/security-misc/issues/274 +## +#kernel.unprivileged_userns_clone=0 + ## Restricts kernel profiling to users with CAP_PERFMON. ## The performance events system should not be accessible by unprivileged users. ## Other distributions such as Ubuntu and Fedora may permit further restricting. ## -## https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html#unprivileged-users +## https://docs.kernel.org/admin-guide/perf-security.html#unprivileged-users ## https://lore.kernel.org/kernel-hardening/1469630746-32279-1-git-send-email-jeffv@google.com/ ## ## KSPP=yes @@ -165,47 +162,93 @@ kernel.sysrq=0 ## kernel.perf_event_paranoid=3 -## Force the kernel to panic on "oopses" and kernel warnings in the WARN() path. -## Can sometimes potentially indicate and thwart certain kernel exploitation attempts. +## Force immediate system reboots on the occurrence of a single kernel panic. +## Increases resilience and limits impact of denial-of-service attacks as system automatically restarts. +## Ensures the system does not hang forever if a panic occurs, reducing susceptibility to both cold and warm boot attacks. +## Immediate rebooting also prevents persistent information disclosure on panic details that were dumped to screen. +## +## KSPP=yes +## KSPP sets CONFIG_PANIC_TIMEOUT=-1. +## +kernel.panic=-1 + +## Force the kernel to immediately panic on "oopses" and kernel warnings in the WARN() path. ## Panics may be due to false-positives such as bad drivers. +## Both allowed limits are set to one so that panics occur on the single first instance of either scenario. ## Oopses are serious but non-fatal errors. -## Kernel warnings are useful to avoid a when attempting to access the location of a WARN(). +## Certain "oopses" can sometimes indicate and thwart potential kernel exploitation attempts. +## Warnings are messages generated by the kernel to indicate unexpected conditions or errors. +## By default, code execution continues regardless of warnings emitted by macros like WARN() and WARN_ON(). +## Note that by forcing kernel panics on oopses and warnings, this exposes the system to targeted denial-of-service attacks. ## ## https://en.wikipedia.org/wiki/Kernel_panic#Linux ## https://en.wikipedia.org/wiki/Linux_kernel_oops -## https://en.wikipedia.org/wiki/Kdump_(Linux) +## https://lwn.net/Articles/876209/ +## https://git.sr.ht/~gregkh/presentation-security/tree/3fdaf81a2f8b2c8d64cdb2f529cc714624868aa8/item/security-stuff.pdf ## https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panisc-on-oops-1-sysctl-for-better-security/7713 ## -## KSPP=partial -## KSPP sets the sysctls, CONFIG_PANIC_ON_OOPS=y, but also requires CONFIG_PANIC_TIMEOUT=-1. +## KSPP=yes +## KSPP sets the sysctls and CONFIG_PANIC_ON_OOPS=y +## +## Note that this must be used with kernel.panic=-1 for it to function as intended. ## ## See /usr/libexec/security-misc/panic-on-oops for implementation. ## -## TODO: Debian 13 Trixie -## The limits are applicable when using Linux kernel >= 6.2 (retained here for future-proofing and completeness). -## -#kernel.panic=-1 -#kernel.panic_on_oops=1 -#kernel.panic_on_warn=1 #kernel.oops_limit=1 #kernel.warn_limit=1 +## Force immediate kernel panic on OOM (out of memory) scenarios. +## Registers a kernel panic whenever the oom_killer is triggered to kill some rogue process based on their OOM score. +## This prevents security features such as the screen locker, kloak, and emerg-shutdown from being arbitrarily terminated. +## Enabling these two together creates a risk of userspace-based denial-of-service attacks that maliciously fill memory. +## This forces immediate system reboot rather than placing any reliance on the oom_killer. +## Known to cause extreme user experience problems with certain applications as the Tor Browser. +## Enabling by default requires improved upstream handling of user space OOM better accounting for desktop users. +## +## https://en.wikipedia.org/wiki/Out_of_memory +## https://forums.whonix.org/t/screen-locker-in-security-can-we-disable-these-at-least-4-backdoors/8128/14 +## https://github.com/KSPP/kspp.github.io/issues/9 +## https://github.com/Kicksecure/security-misc/issues/324 +## +## Note that this must be used with kernel.panic=-1 for it to function as intended. +## +#vm.panic_on_oom=2 + +## Force immediate kernel panic on certain NMIs (Non-Maskable Interrupts). +## NMIs are hardware interrupts that cannot be ignored by standard interrupt-masking techniques. +## NMIs are reserved for critical events that require immediate attention. +## Panic upon a NMI indicating a serious hardware-level I/O issue to prevent data corruption. +## Panic upon a NMI indicating uncorrectable memory and hardware errors to prevent data corruption. +## Panic upon receiving an undefined or unknown NMI. +## All three must first be tested to ensure there are no pre-existing issues on user hardware. +## After confirming stability of each they can then be used to prevent data corruption from hardware sources. +## These are valuable for high-reliability systems where data integrity is critical. +## +## https://en.wikipedia.org/wiki/Non-maskable_interrupt +## https://docs.kernel.org/trace/events-nmi.html +## https://0xax.gitbook.io/linux-insides/summary/interrupts/linux-interrupts-6 +## https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_for_real_time/7/html/reference_guide/non-maskable_interrupts +## +## Note that these must be used with kernel.panic=-1 for them to function as intended. +## +#kernel.panic_on_io_nmi=1 +#kernel.panic_on_unrecovered_nmi=1 +#kernel.unknown_nmi_panic=1 + ## Disable the use of legacy TIOCSTI operations which can be used to inject keypresses. ## Can lead to privilege escalation by pushing characters into a controlling TTY. ## Will break out-dated screen readers that continue to rely on this legacy functionality. +## Note this was already disabled by default as of Linux kernel 6.2. ## ## https://lore.kernel.org/lkml/20221228205726.rfevry7ud6gmttg5@begin/T/ ## ## KSPP=yes ## KSPP sets the sysctl and does not set CONFIG_LEGACY_TIOCSTI. ## -## TODO: Debian 13 Trixie -## This is disabled by default when using Linux kernel >= 6.2. -## dev.tty.legacy_tiocsti=0 ## Disable asynchronous I/O for all processes. -## Leading cause of numerous kernel exploits. +## Use of io_uring has been the leading cause of numerous kernel exploits. ## Disabling will reduce the read/write performance of storage devices. ## ## https://en.wikipedia.org/wiki/Io_uring#Security @@ -214,33 +257,42 @@ dev.tty.legacy_tiocsti=0 ## https://github.com/moby/moby/pull/46762 ## https://forums.whonix.org/t/io-uring-security-vulnerabilties/16890 ## -## TODO: Debian 13 Trixie -## Applicable when using Linux kernel >= 6.6 (retained here for future-proofing and completeness). -## kernel.io_uring_disabled=2 +## Disable 32-bit Virtual Dynamic Shared Object (vDSO) mappings. +## Legacy compatibility feature for superseded glibc versions. +## +## https://lore.kernel.org/lkml/20080409082927.BD59E26F992@magilla.localdomain/T/ +## https://lists.openwall.net/linux-kernel/2014/03/11/3 +## +## KSPP=yes +## KSPP sets the kernel parameter and does not set CONFIG_COMPAT_VDSO. +## +## See /etc/default/grub.d/40_kernel_hardening.cfg for another additional implementation. +## +abi.vsyscall32=0 + ## 2. User Space: ## ## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-userspace -## Restrict usage of the ptrace() system call to only processes with CAP_SYS_PTRACE. -## Limit ptrace() as it enables programs to inspect and modify other active processes. +## Disable the usage of the ptrace() system call by all processes. +## Restrict ptrace() as it enables programs to inspect and modify other active processes. ## Prevents native code debugging which some programs use as a method to detect tampering. ## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE. ## -## https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html#ptrace-scope +## https://docs.kernel.org/admin-guide/LSM/Yama.html#ptrace-scope ## https://en.wikipedia.org/wiki/Ptrace ## https://grapheneos.org/features#attack-surface-reduction ## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928 ## https://github.com/netblue30/firejail/issues/2860 ## -## KSPP=partial -## KSPP sets the stricter sysctl kernel.yama.ptrace_scope=3. +## KSPP=yes +## KSPP sets the sysctl. ## -## It is possible to harden further by disabling ptrace() for all users, see documentation. -## https://github.com/Kicksecure/security-misc/pull/242 +## See /usr/lib/sysctl.d/30_security-misc_ptrace-disable.conf for implementation. ## -kernel.yama.ptrace_scope=2 +#kernel.yama.ptrace_scope=3 ## Maximize bits of entropy for improved effectiveness of mmap ASLR. ## The maximum number of bits depends on CPU architecture (the ones shown below are for x86). @@ -281,7 +333,7 @@ fs.protected_fifos=2 fs.protected_regular=2 ## Enable ASLR for mmap base, stack, VDSO pages, and heap. -## Forces shared libraries to be loaded to random addresses +## Forces shared libraries to be loaded to random addresses. ## Start location of PIE-linked binaries is randomized. ## Heap randomization can lead to breakages with legacy applications. ## @@ -325,7 +377,7 @@ vm.max_map_count=1048576 ## Can stop maliciously crafted files with specific file extensions from automatically executing. ## Breaks many scripts that do not have appropriate shebang interpreter directives (#!/bin/...). ## -## https://www.kernel.org/doc/html/latest/admin-guide/binfmt-misc.html +## https://docs.kernel.org/admin-guide/binfmt-misc.html ## https://salsa.debian.org/debian/binfmt-support ## https://access.redhat.com/solutions/1985633 ## https://en.wikipedia.org/wiki/Binfmt_misc @@ -347,7 +399,7 @@ vm.max_map_count=1048576 ## Disable core dump files by preventing any pattern names. ## This setting may be overwritten by systemd and is not comprehensive. -## Core dumps are also disabled in security-misc via other means. +## Core dumps are also disabled in security-misc-shared via other means. ## ## https://wiki.archlinux.org/title/Core_dump#Disabling_automatic_core_dumps ## @@ -356,6 +408,8 @@ kernel.core_pattern=|/bin/false ## Prevent setuid processes or otherwise protected/tainted binaries from creating core dumps. ## Any process which has changed privilege levels or is execute-only will not be dumped. ## +## https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598 +## ## KSPP=yes ## KSPP sets the sysctl. ## @@ -443,6 +497,51 @@ net.ipv4.conf.*.send_redirects=0 net.ipv6.conf.*.accept_redirects=0 #net.ipv4.conf.*.secure_redirects=1 +## Deny sending and receiving RFC1620 shared media redirects. +## Relevant mainly for network interfaces that operate over shared media such as Ethernet hubs. +## Stops the kernel from sending ICMP redirects to specific networks from the connected network. +## This variable overrides the use secure_redirects. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## https://datatracker.ietf.org/doc/html/rfc1620 +## https://www.frozentux.net/ipsysctl-tutorial/chunkyhtml/theconfvariables.html +## +net.ipv4.conf.*.shared_media=0 + +## Enable ARP (Address Resolution Protocol) filtering. +## Prevents the Linux kernel from handling the ARP table globally. +## Can mitigate some ARP spoofing and ARP cache poisoning attacks. +## Improper filtering can lead to increased ARP traffic and inadvertently block legitimate ARP requests. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## +net.ipv4.conf.*.arp_filter=1 + +## Respond to ARP (Address Resolution Protocol) requests only if the target IP address is on-link. +## Reduces IP spoofing attacks by limiting the scope of allowable ARP responses. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## https://github.com/mullvad/mullvadvpn-app/blob/main/audits/2024-12-10-X41-D-Sec.md#mllvd-cr-24-03-virtual-ip-address-of-tunnel-device-leaks-to-network-adjacent-participant-severity-medium +## https://github.com/mullvad/mullvadvpn-app/pull/7141 +## https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf +## +## Can lead to breakages with certain VM configurations that may be resolved by lowering protection to `arp_ignore=1`. +## https://github.com/Kicksecure/security-misc/pull/290 +## +net.ipv4.conf.*.arp_ignore=2 + +## Drop gratuitous ARP (Address Resolution Protocol) packets. +## Stops ARP responses sent by a device without being explicitly requested. +## Prevents ARP cache poisoning by rejecting fake ARP entries into a network. +## Prevents man-in-the-middle and denial-of-service attacks. +## May cause breakages when ARP proxies are used in the network. +## +## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf +## https://patchwork.ozlabs.org/project/netdev/patch/1428652454-1224-3-git-send-email-johannes@sipsolutions.net/ +## https://www.practicalnetworking.net/series/arp/gratuitous-arp/ +## +net.ipv4.conf.*.drop_gratuitous_arp=1 + ## Ignore ICMP echo requests. ## Prevents clock fingerprinting through ICMP timestamps and Smurf attacks. ## @@ -464,7 +563,15 @@ net.ipv4.icmp_ignore_bogus_error_responses=1 net.ipv4.conf.*.accept_source_route=0 net.ipv6.conf.*.accept_source_route=0 -## Do not accept IPv6 router advertisements and solicitations. +## Do not accept IPv6 router advertisements (RAs) and solicitations. +## RAs are unsecured and unauthenticated and any device on the local link can send and accept them without verification. +## Malicious RAs can activate IPv6 connectivity on dormant hosts leading to unauthorized access. +## Flooding the network with malicious RAs can lead to denial-of-service attacks. +## Rogue RAs can lead to interception of all network traffic by setting the attacker's system as the default gateway. +## +## https://datatracker.ietf.org/doc/html/rfc6104 +## https://datatracker.ietf.org/doc/html/rfc6105 +## https://archive.conference.hitb.org/hitbsecconf2012kul/materials/D1T2%20-%20Marc%20Heuse%20-%20IPv6%20Insecurity%20Revolutions.pdf ## net.ipv6.conf.*.accept_ra=0 @@ -498,18 +605,29 @@ net.ipv6.conf.*.accept_ra=0 ## net.ipv4.tcp_timestamps=0 +## Disable reuse of TIME_WAIT sockets for new outgoing connections. +## The safety of reusing of TIME_WAIT sockets requires enabling TCP timestamps. +## The kernel uses timestamps to verify a new connection is not a duplicate segment from an older connection. +## Hence TIME-WAIT sockets should wait the full timeout period before being made available again. +## Can lead to port exhaustion on high-traffic networks with numerous short-lived connections. +## +## https://vincent.bernat.ch/en/blog/2014-tcp-time-wait-state-linux +## +net.ipv4.tcp_tw_reuse=0 + ## Enable logging of packets with impossible source or destination addresses. ## Martian and unroutable packets may be used for malicious purposes. ## Recommended to keep a (kernel dmesg) log of these to identify suspicious packets. ## Useful for troubleshooting and diagnostics but not necessary by default. -## Known to cause performance issues, especially on systems with multiple interfaces. +## Previously known to cause performance issues, especially on systems with multiple interfaces. +## This no longer seems to be a problem. ## ## https://wiki.archlinux.org/title/Sysctl#Log_martian_packets +## https://www.cyberciti.biz/faq/linux-log-suspicious-martian-packets-un-routable-source-addresses/ +## https://support.scc.suse.com/s/kb/Martian-sources-errors-showing-in-messages-log?language=en_US ## https://github.com/Kicksecure/security-misc/issues/214 ## -## The logging of martian packets is currently disabled. -## -#net.ipv4.conf.*.log_martians=1 +net.ipv4.conf.*.log_martians=1 ## Enable IPv6 Privacy Extensions to prefer temporary addresses over public addresses. ## The temporary/privacy address is used as the source for all outgoing traffic. @@ -526,3 +644,35 @@ net.ipv4.tcp_timestamps=0 ## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. ## #net.ipv6.conf.*.use_tempaddr=2 + +## 6. CD-ROM/DVD +## +## https://github.com/Kicksecure/security-misc/issues/348 + +## Disable CD-ROM/DVD drive automatic tray closure and ejection functionality. +## Prevents scripted tray cycling attacks. +## Requires users to press physical hardware buttons to insert and eject media. +## +## https://github.com/torvalds/linux/blob/master/drivers/cdrom/cdrom.c +## https://github.com/Kicksecure/security-misc/issues/348 +## +dev.cdrom.autoclose=0 +dev.cdrom.autoeject=0 + +## Disable all CD-ROM/DVD drive debug messages. +## Prevents verbose logging that could leak drive information. +## +## https://github.com/torvalds/linux/blob/master/drivers/cdrom/cdrom.c +## https://github.com/Kicksecure/security-misc/issues/348 +## +dev.cdrom.debug=0 + +## Restrict CD-ROM/DVD drives by disabling usage and hardware access. +## Disable the kernel from checking for media changes to the drive bay. +## Lock the drive bay preventing the physical eject button from opening the tray. +## +## https://github.com/torvalds/linux/blob/master/drivers/cdrom/cdrom.c +## https://github.com/Kicksecure/security-misc/issues/348 +## +#dev.cdrom.check_media=0 +#dev.cdrom.lock=1 diff --git a/usr/lib/systemd/coredump.conf.d/30_security-misc.conf b/usr/lib/systemd/coredump.conf.d/30_security-misc.conf deleted file mode 100644 index 2cb1b1ae..00000000 --- a/usr/lib/systemd/coredump.conf.d/30_security-misc.conf +++ /dev/null @@ -1,5 +0,0 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -[Coredump] -Storage=none diff --git a/usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..2d02bc99 --- /dev/null +++ b/usr/lib/systemd/coredump.conf.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Coredump] +Storage=none diff --git a/usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..8e6ca79f --- /dev/null +++ b/usr/lib/systemd/journald.conf.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,7 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Mitigation for https://www.openwall.com/lists/oss-security/2026/04/08/1 + +[Journal] +ForwardToWall=no diff --git a/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf b/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop similarity index 69% rename from usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf rename to usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop index 59590040..70aca2c9 100644 --- a/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf +++ b/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf#security-misc-desktop @@ -1,4 +1,4 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## MAC randomisation breaks root server and VirtualBox DHCP likely due to IPv6 Privacy Extensions. @@ -7,7 +7,7 @@ ## https://github.com/Kicksecure/security-misc/pull/145 ## https://github.com/Kicksecure/security-misc/issues/184 ## -## The use of IPv6 Privacy Extenstions is currently diasbled due to these breakages. +## The use of IPv6 Privacy Extensions is currently disabled due to these breakages. #[Network] #IPv6PrivacyExtensions=kernel diff --git a/usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..9e513c62 --- /dev/null +++ b/usr/lib/systemd/pstore.conf.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[PStore] +Storage=none diff --git a/usr/lib/systemd/system-preset/50-security-misc.preset b/usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared similarity index 58% rename from usr/lib/systemd/system-preset/50-security-misc.preset rename to usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared index 37374b30..8b1c2615 100644 --- a/usr/lib/systemd/system-preset/50-security-misc.preset +++ b/usr/lib/systemd/system-preset/50-security-misc.preset#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618 @@ -17,3 +17,13 @@ disable proc-hidepid.service ## Disable due to issues. See: ## https://github.com/Kicksecure/security-misc/issues/159 disable harden-module-loading.service + +## TODO: polish, test +## Disable due to timing difficulties. See: +## https://github.com/systemd/systemd/issues/38261#issuecomment-3134580852 +disable ensure-shutdown.service +disable ensure-shutdown-trigger.service + +## memlockd is needed by emerg-shutdown, but the service is not, the user can +## enable this manually if desired. +disable memlockd.service diff --git a/usr/lib/systemd/system/block-shutdown.service#security-misc-shared b/usr/lib/systemd/system/block-shutdown.service#security-misc-shared new file mode 100644 index 00000000..3d4be21b --- /dev/null +++ b/usr/lib/systemd/system/block-shutdown.service#security-misc-shared @@ -0,0 +1,29 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This unit, if uncommented and started, will prevent the system from ever +## shutting down unless ensure-shutdown.service is enabled and correctly +## configured. If you have enabled ensure-shutdown.service and tuned the +## ENSURE_SHUTDOWN_TIMEOUT and DefaultTimeoutStopSec variables (in +## /etc/security-misc/emerg-shutdown/30_security_misc.conf and +## /etc/systemd/system.conf respectively) and want to make sure +## ensure-shutdown.service actually works, you can uncomment this unit and +## start it with `sudo systemctl start block-shutdown.service`. If the systems +## successfully powers down even with this unit started, +## ensure-shutdown.service is working. + +# [Unit] +# Description=Blocks shutdown indefinitely unless ensure-shutdown.service is enabled +# +# [Service] +# Type=exec +# ExecStart=bash -c -- "trap '' SIGTERM; sleep infinity" +# KillSignal=SIGTERM +# FinalKillSignal=SIGTERM +# RestartKillSignal=SIGTERM +# WatchdogSignal=SIGTERM +# SendSIGHUP=no +# TimeoutStopSec=infinity +# +# [Install] +# WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared b/usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared new file mode 100644 index 00000000..06c232e0 --- /dev/null +++ b/usr/lib/systemd/system/emerg-shutdown.service#security-misc-shared @@ -0,0 +1,30 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## WARNING: Do not add ANY "Requires" dependencies to this unit. If a required +## dependency terminates, systemd will terminate emerg-shutdown, and many +## services crash when the boot drive is removed. Use "Wants" instead. + +[Unit] +Description=Emergency shutdown when boot media is removed +Documentation=https://github.com/Kicksecure/security-misc +DefaultDependencies=no +Before=sysinit.target +Wants=systemd-udevd.service +After=systemd-udevd.service +Wants=local-fs.target +After=local-fs.target +ConditionPathExists=!/usr/share/qubes/marker-vm +## Do not run emerg-shutdown.service in case 'rd.live.ram' or 'rd.live.ram=1' +## is set. +## https://forums.kicksecure.com/t/how-to-run-iso-live-mode-from-ram/1542/9 +ConditionKernelCommandLine=!rd.live.ram +ConditionKernelCommandLine=!rd.live.ram=1 + +[Service] +Type=notify +ExecStart=/usr/libexec/security-misc/emerg-shutdown +NotifyAccess=main + +[Install] +WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared b/usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared new file mode 100644 index 00000000..593f08de --- /dev/null +++ b/usr/lib/systemd/system/ensure-shutdown-trigger.service#security-misc-shared @@ -0,0 +1,19 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## NOTE: If enabling this unit, also enable ensure-shutdown.service, otherwise +## this will do nothing. + +[Unit] +Description=Forcibly shut down the system if normal shutdown gets stuck (alternate trigger unit) +Documentation=https://github.com/Kicksecure/security-misc +ConditionPathExists=!/usr/share/qubes/marker-vm + +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=true +ExecStop=bash -c -- 'echo "d" > /run/emerg-shutdown-trigger' + +[Install] +WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared b/usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared new file mode 100644 index 00000000..ad124f55 --- /dev/null +++ b/usr/lib/systemd/system/ensure-shutdown.service#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## NOTE: If enabling this unit, also enable ensure-shutdown-trigger.service, +## otherwise this will likely be unable to unstick a stuck shutdown. + +[Unit] +Description=Forcibly shut down the system if normal shutdown gets stuck +Documentation=https://github.com/Kicksecure/security-misc +DefaultDependencies=no +Before=sysinit.target +Requires=systemd-udevd.service +After=systemd-udevd.service +Wants=emerg-shutdown.service +After=emerg-shutdown.service +ConditionPathExists=!/usr/share/qubes/marker-vm + +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=/usr/libexec/security-misc/ensure-shutdown +ExecStop=bash -c -- 'echo "d" > /run/emerg-shutdown-trigger' +KillMode=process + +[Install] +WantedBy=sysinit.target diff --git a/usr/lib/systemd/system/harden-module-loading.service b/usr/lib/systemd/system/harden-module-loading.service#security-misc-shared similarity index 90% rename from usr/lib/systemd/system/harden-module-loading.service rename to usr/lib/systemd/system/harden-module-loading.service#security-misc-shared index 33946238..8efea40e 100644 --- a/usr/lib/systemd/system/harden-module-loading.service +++ b/usr/lib/systemd/system/harden-module-loading.service#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] diff --git a/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf b/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared similarity index 69% rename from usr/lib/systemd/system/haveged.service.d/30_security-misc.conf rename to usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared index 97d46887..29814644 100644 --- a/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf +++ b/usr/lib/systemd/system/haveged.service.d/30_security-misc.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Service] diff --git a/usr/lib/systemd/system/hide-hardware-info.service b/usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared similarity index 84% rename from usr/lib/systemd/system/hide-hardware-info.service rename to usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared index 6d393356..659c3f57 100644 --- a/usr/lib/systemd/system/hide-hardware-info.service +++ b/usr/lib/systemd/system/hide-hardware-info.service#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] diff --git a/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared b/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared new file mode 100644 index 00000000..136ff7ae --- /dev/null +++ b/usr/lib/systemd/system/kill-vboxdrmclient-on-shutdown.service#security-misc-shared @@ -0,0 +1,15 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=kill VBoxDRMClient during shutdown to allow /tmp to be unmounted properly +ConditionVirtualization=oracle + +[Service] +Type=oneshot +RemainAfterExit=true +ExecStart=true +ExecStop=/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown + +[Install] +WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/panic-on-oops.service b/usr/lib/systemd/system/panic-on-oops.service deleted file mode 100644 index cf13053c..00000000 --- a/usr/lib/systemd/system/panic-on-oops.service +++ /dev/null @@ -1,20 +0,0 @@ -## Copyright (C) 2024 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -[Unit] -Description=Sets 'sysctl kernel.panic_on_oops=1' late during the boot process. -Documentation=https://github.com/Kicksecure/security-misc - -ConditionKernelCommandLine=!panic-on-oops=0 - -After=multi-user.target -After=graphical.target -After=getty.target - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/usr/libexec/security-misc/panic-on-oops - -[Install] -WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/panic-on-oops.service#security-misc-shared b/usr/lib/systemd/system/panic-on-oops.service#security-misc-shared new file mode 100644 index 00000000..bf97d7f2 --- /dev/null +++ b/usr/lib/systemd/system/panic-on-oops.service#security-misc-shared @@ -0,0 +1,21 @@ +## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=Sets 'sysctl' settings relating to kernel panics on both oopses and warnings late during the boot process. +Documentation=https://github.com/Kicksecure/security-misc + +ConditionKernelCommandLine=!panic-on-oops=0 + +After=multi-user.target +After=graphical.target +After=getty.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/security-misc/panic-on-oops enable +ExecStop=/usr/libexec/security-misc/panic-on-oops disable + +[Install] +WantedBy=multi-user.target diff --git a/usr/lib/systemd/system/permission-hardener.service b/usr/lib/systemd/system/permission-hardener.service#security-misc-shared similarity index 73% rename from usr/lib/systemd/system/permission-hardener.service rename to usr/lib/systemd/system/permission-hardener.service#security-misc-shared index 99d4c37d..1285bf06 100644 --- a/usr/lib/systemd/system/permission-hardener.service +++ b/usr/lib/systemd/system/permission-hardener.service#security-misc-shared @@ -1,8 +1,8 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] -Description=Permission Hardener at Boot Time (opt-in in addition to security-misc package installation time hardening) +Description=Permission Hardener at Boot Time (opt-in in addition to security-misc-shared package installation time hardening) Documentation=https://github.com/Kicksecure/security-misc DefaultDependencies=no diff --git a/usr/lib/systemd/system/proc-hidepid.service b/usr/lib/systemd/system/proc-hidepid.service#security-misc-shared similarity index 84% rename from usr/lib/systemd/system/proc-hidepid.service rename to usr/lib/systemd/system/proc-hidepid.service#security-misc-shared index f48211da..d7ea4d9e 100644 --- a/usr/lib/systemd/system/proc-hidepid.service +++ b/usr/lib/systemd/system/proc-hidepid.service#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] diff --git a/usr/lib/systemd/system/remount-secure.service b/usr/lib/systemd/system/remount-secure.service#security-misc-shared similarity index 89% rename from usr/lib/systemd/system/remount-secure.service rename to usr/lib/systemd/system/remount-secure.service#security-misc-shared index 414bba64..2489d347 100644 --- a/usr/lib/systemd/system/remount-secure.service +++ b/usr/lib/systemd/system/remount-secure.service#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] diff --git a/usr/lib/systemd/system/remove-system-map.service b/usr/lib/systemd/system/remove-system-map.service#security-misc-shared similarity index 83% rename from usr/lib/systemd/system/remove-system-map.service rename to usr/lib/systemd/system/remove-system-map.service#security-misc-shared index 51041f2d..1e36d61c 100644 --- a/usr/lib/systemd/system/remove-system-map.service +++ b/usr/lib/systemd/system/remove-system-map.service#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] diff --git a/usr/lib/systemd/system/sysinit-post.target b/usr/lib/systemd/system/sysinit-post.target#security-misc-shared similarity index 54% rename from usr/lib/systemd/system/sysinit-post.target rename to usr/lib/systemd/system/sysinit-post.target#security-misc-shared index 336133b8..81fb65bf 100644 --- a/usr/lib/systemd/system/sysinit-post.target +++ b/usr/lib/systemd/system/sysinit-post.target#security-misc-shared @@ -1,8 +1,8 @@ -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Unit] -Description=sys-init.target by security-misc +Description=sysinit-post.target by security-misc-shared After=sysinit.target Before=basic.target diff --git a/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..24cb0da2 --- /dev/null +++ b/usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,8 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +ConditionPathExists=/sys/bus/usb + +[Service] +ExecCondition=/usr/libexec/security-misc/check-for-usb-controller diff --git a/usr/lib/systemd/system/user@.service.d/sysfs.conf b/usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared similarity index 53% rename from usr/lib/systemd/system/user@.service.d/sysfs.conf rename to usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared index 2c27ce59..3a9129d2 100644 --- a/usr/lib/systemd/system/user@.service.d/sysfs.conf +++ b/usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [Service] diff --git a/usr/lib/systemd/user/fm-shim.service#security-misc-shared b/usr/lib/systemd/user/fm-shim.service#security-misc-shared new file mode 100644 index 00000000..b372859c --- /dev/null +++ b/usr/lib/systemd/user/fm-shim.service#security-misc-shared @@ -0,0 +1,16 @@ +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +Description=org.freedesktop.FileManager1 handler +StartLimitIntervalSec=10 +StartLimitBurst=3 + +[Service] +Type=notify +NotifyAccess=main +ExecStart=/usr/bin/fm-shim-backend +Restart=always + +[Install] +WantedBy=default.target diff --git a/usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared b/usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared new file mode 100644 index 00000000..70accafb --- /dev/null +++ b/usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared @@ -0,0 +1,5 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +[Unit] +ConditionPathExists=/sys/bus/usb diff --git a/usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared b/usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared new file mode 100644 index 00000000..051af9fe --- /dev/null +++ b/usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared @@ -0,0 +1,9 @@ +SUBSYSTEM!="input", GOTO="end" + +# new keyboard or mouse attached or removed, restart emerg-shutdown +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEYBOARD}=="1", RUN+="/usr/bin/systemctl restart emerg-shutdown.service" +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEYBOARD}=="1", GOTO="end" +KERNEL=="event*", ACTION=="remove", ENV{ID_INPUT_KEYBOARD}=="1", RUN+="/usr/bin/systemctl restart emerg-shutdown.service" +KERNEL=="event*", ACTION=="remove", ENV{ID_INPUT_KEYBOARD}=="1", GOTO="end" + +LABEL="end" diff --git a/usr/libexec/security-misc/apt-get-update b/usr/libexec/security-misc/apt-get-update deleted file mode 100755 index 9c5dde15..00000000 --- a/usr/libexec/security-misc/apt-get-update +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -sigterm_trap() { - if [ "$lastpid" = "" ]; then - exit 143 - fi - ps -p "$lastpid" >/dev/null 2>&1 - if [ ! "$?" = "0" ]; then - ## Already terminated. - exit 143 - fi - kill -s sigterm "$lastpid" - exit 143 -} - -trap "sigterm_trap" SIGTERM SIGINT - -[ -n "$timeout_after" ] || timeout_after="600" -[ -n "$kill_after" ] || kill_after="10" - -timeout \ - --kill-after="$kill_after" \ - "$timeout_after" \ - apt-get update --error-on=any "$@" & - -lastpid="$!" -wait "$lastpid" - -exit "$?" diff --git a/usr/libexec/security-misc/apt-get-update-sanity-test b/usr/libexec/security-misc/apt-get-update-sanity-test deleted file mode 100755 index a363fae7..00000000 --- a/usr/libexec/security-misc/apt-get-update-sanity-test +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -x -set -e -set -o pipefail - -wc -L "/var/lib/apt/lists/"*InRelease -wc -L "/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}' diff --git a/usr/libexec/security-misc/askpass b/usr/libexec/security-misc/askpass deleted file mode 100755 index c3bb41a6..00000000 --- a/usr/libexec/security-misc/askpass +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -title="$0: password required for $(whoami) to perform action as superuser" - -zenity --password --title="$title" diff --git a/usr/libexec/security-misc/askpass#security-misc-shared b/usr/libexec/security-misc/askpass#security-misc-shared new file mode 100755 index 00000000..64d36fd8 --- /dev/null +++ b/usr/libexec/security-misc/askpass#security-misc-shared @@ -0,0 +1,15 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +title="$0: password required for $(whoami) to perform action as superuser" + +yad --password --title="${title}" diff --git a/usr/libexec/security-misc/block-unsafe-logins#security-misc-shared b/usr/libexec/security-misc/block-unsafe-logins#security-misc-shared new file mode 100755 index 00000000..3000c688 --- /dev/null +++ b/usr/libexec/security-misc/block-unsafe-logins#security-misc-shared @@ -0,0 +1,146 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +source /usr/libexec/helper-scripts/package_installed_check.sh + +if [ -z "${PAM_USER:-}" ]; then + true "$0: ERROR: Environment variable 'PAM_USER' is unset!" + ## 'exit 0' here to let the appropriate PAM module handle this. + exit 0 +fi +if [ -z "${PAM_SERVICE:-}" ]; then + true "$0: ERROR: Environment variable 'PAM_SERVICE' is unset!" + ## 'exit 0' here to let the appropriate PAM module handle this. + exit 0 +fi + +if ! pkg_installed 'user-sysmaint-split' ; then + true "$0: INFO: user-sysmaint-split not installed. Proceeding, ok." + exit 0 +fi + +kernel_cmdline='' +if [ -r /proc/cmdline ]; then + kernel_cmdline="$(cat /proc/cmdline)" +elif [ -r /proc/1/cmdline ]; then + kernel_cmdline="$(cat /proc/1/cmdline)" +fi + +if [[ "$kernel_cmdline" =~ 'boot-role=sysmaint' ]]; then + true "INFO: session type: sysmaint session" + if [ "$PAM_USER" != 'sysmaint' ]; then + printf '%s\n' "ERROR: Rejecting non-sysmaint account '$PAM_USER' in sysmaint session!" + exit 1 + fi + true 'INFO: Running in sysmaint session and authenticating as sysmaint account, allowing authentication to proceed.' + exit 0 +fi + +true "INFO: session type: user session" + +if [ "$PAM_USER" = 'sysmaint' ]; then + printf '%s\n' 'ERROR: Rejecting sysmaint account in user session!' + exit 1 +fi + +## Threat model: +## https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#Block_Unsafe_Logins + +login_service_list=( 'login' 'greetd' 'sshd' 'swaylock' ) +for login_service in "${login_service_list[@]}"; do + if [ "$PAM_SERVICE" = "$login_service" ]; then + true "INFO: Login service '$PAM_SERVICE' is considered safe, allowing authentication to proceed." + exit 0 + fi +done + +true "INFO: Login service '$PAM_SERVICE' is potentially unsafe, checking if account is sensitive and passwordless." + +if ! user_list_str="$(/usr/libexec/helper-scripts/get-user-list)"; then + printf '%s\n' 'ERROR: Failed to get user list!' + exit 1 +fi +readarray -t user_list <<< "$user_list_str" +if [ "${#user_list[@]}" = '0' ] || [ -z "${user_list[0]}" ]; then + printf '%s\n' 'ERROR: No user accounts found!' + exit 1 +fi + +## Minor race condition here, quick deletion of users during this process +## could result in user_list and passwd_status_list becoming misaligned. This +## attack would require root privileges to execute though, so this is likely +## not a concern. We do this before checking if $PAM_USER is in the list of +## interactive users to keep the race window as short as possible. +## +## NOTE: PAM modules may run as non-root in some instances (such as when used +## by Swaylock). +if [ "$(id -u)" = '0' ]; then + passwd_status_list_cmd=( + '/usr/libexec/helper-scripts/get-password-status-list' + ) +else + passwd_status_list_cmd=( 'leaprun' 'get-password-status-list' ) +fi +if ! password_status_list_str="$("${passwd_status_list_cmd[@]}")"; then + printf '%s\n' 'ERROR: Failed to get password status list!' + exit 1 +fi +readarray -t passwd_status_list <<< "$password_status_list_str" +if [ "${#passwd_status_list[@]}" = '0' ] \ + || [ -z "${passwd_status_list[0]}" ] \ + || (( ${#passwd_status_list[@]} != ${#user_list[@]} )); then + printf '%s\n' 'ERROR: Unexpected number of password status entries!' + exit 1 +fi + +interactive_user_idx='-1' +for user_idx in "${!user_list[@]}"; do + if [ "${user_list[user_idx]}" = "$PAM_USER" ]; then + interactive_user_idx="$user_idx" + break + fi +done +if [ "$interactive_user_idx" = '-1' ]; then + ## This isn't a user account we care about (it's not an interactive + ## account), therefore allow authentication to proceed. + true "INFO: Account '$PAM_USER' is not an interactive account, allowing authentication to proceed." + exit 0 +fi + +IFS=' ' read -r -a user_gid_list < <(id --groups -- "$PAM_USER") +sensitive_group_list=( 'sudo' 'root' 'sysmaint' ) +is_user_sensitive='false' + +for sensitive_group in "${sensitive_group_list[@]}"; do + sensitive_gid="$(accountctl "$sensitive_group" get-entry group gid)" + for user_gid in "${user_gid_list[@]}"; do + if [ "$sensitive_gid" = "$user_gid" ]; then + is_user_sensitive='true' + break + fi + done + if [ "$is_user_sensitive" = 'true' ]; then + break + fi +done + +if [ "$is_user_sensitive" = 'true' ]; then + if [ "${passwd_status_list[interactive_user_idx]}" = 'Absent' ]; then + ## User account is sensitive and passwordless, deny authentication + printf '%s\n' "ERROR: Rejecting passwordless sensitive account '$PAM_USER'!" + exit 1 + else + true "INFO: Account '$PAM_USER' is sensitive but protected, allowing authentication to proceed." + exit 0 + fi +fi + +true "INFO: Account '$PAM_USER' is not sensitive, allowing authentication to proceed." +exit 0 diff --git a/usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared b/usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared new file mode 100755 index 00000000..c66662cb --- /dev/null +++ b/usr/libexec/security-misc/build-emerg-shutdown#security-misc-shared @@ -0,0 +1,36 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +export LC_ALL=C + +## Compile to a temporary file first, then atomically move into place. +## This prevents leaving a corrupted binary if compilation is interrupted. +tmp_output="$(mktemp -- /usr/bin/emerg-shutdown.XXXXXX)" + +cleanup() { + rm -f -- "${tmp_output}" +} +trap cleanup EXIT + +/usr/libexec/security-misc/compile-emerg-shutdown \ + /usr/src/security-misc/emerg-shutdown.c \ + "${tmp_output}" \ + || { + printf '%s\n' 'Could not compile emerg-shutdown executable!' + exit 1 + } + +chmod 0755 -- "${tmp_output}" +mv -f -- "${tmp_output}" /usr/bin/emerg-shutdown +trap - EXIT diff --git a/usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared b/usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared new file mode 100755 index 00000000..af4c53f8 --- /dev/null +++ b/usr/libexec/security-misc/build-fm-shim-backend#security-misc-shared @@ -0,0 +1,29 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +export LC_ALL=C + +## Compile to a temporary file first, then atomically move into place. +## This prevents leaving a corrupted binary if compilation is interrupted. +tmp_output="$(mktemp -- /usr/bin/fm-shim-backend.XXXXXX)" +trap 'rm -f -- "${tmp_output}"' EXIT + +/usr/libexec/security-misc/compile-fm-shim-backend \ + /usr/src/security-misc/fm-shim-backend.c \ + "${tmp_output}" \ + || { + printf "%s\n" 'Could not compile fm-shim-backend executable!' + rm -f -- "${tmp_output}" + exit 1 + } + +chmod 0755 -- "${tmp_output}" +mv -f -- "${tmp_output}" /usr/bin/fm-shim-backend +trap - EXIT diff --git a/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared new file mode 100755 index 00000000..efb7641d --- /dev/null +++ b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared @@ -0,0 +1,25 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## security-misc-shared Depends on helper-scripts. +# shellcheck source=../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh + +## Package 'pciutils' provides tool 'lspci'. +has lspci + +if lspci | grep -- '^[^ ]* USB controller: ' >/dev/null; then + exit 0 +fi + +exit 1 diff --git a/usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared b/usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared new file mode 100755 index 00000000..1954de3f --- /dev/null +++ b/usr/libexec/security-misc/compile-emerg-shutdown#security-misc-shared @@ -0,0 +1,79 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Compile emerg-shutdown.c with the project's standard hardening +## flag set, statically linked. +## +## Usage: +## compile-emerg-shutdown +## +## Used by: +## * usr/libexec/security-misc/build-emerg-shutdown +## * ci/codeql-build.sh (CodeQL static analysis prebuild) + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +export LC_ALL=C + +if [ "$#" -ne 2 ]; then + printf '%s\n' "usage: ${BASH_SOURCE[0]} " >&2 + exit 64 +fi + +source_file="$1" +output_binary="$2" + +gcc_hardening_options=( + "-O2" "-Wall" "-Wextra" "-Wformat" "-Wformat=2" "-Wconversion" + "-Wimplicit-fallthrough" "-Werror=format-security" "-Werror=implicit" + "-Werror=int-conversion" "-Werror=incompatible-pointer-types" + "-Wformat-overflow" "-Wformat-signedness" "-Wformat-truncation" + "-Wnull-dereference" "-Winit-self" + "-Wmissing-include-dirs" "-Wshift-negative-value" "-Wshift-overflow" + "-Wswitch-default" "-Wuninitialized" "-Walloca" "-Warray-bounds" + "-Wfloat-equal" "-Wshadow" "-Wpointer-arith" "-Wundef" "-Wunused-macros" + "-Wbad-function-cast" "-Wcast-qual" "-Wcast-align" "-Wwrite-strings" + "-Wdate-time" "-Wstrict-prototypes" "-Wold-style-definition" + "-Wredundant-decls" "-Winvalid-utf8" "-Wvla" "-Wdisabled-optimization" + "-Wstack-protector" "-Wdeclaration-after-statement" "-Wtrampolines" + "-Wbidi-chars=any,ucn" "-Wformat-overflow=2" "-Wformat-truncation=2" + "-Wshift-overflow=2" "-Wtrivial-auto-var-init" "-Wstringop-overflow=3" + "-Wstrict-flex-arrays" "-Walloc-zero" "-Warray-bounds=2" + "-Wattribute-alias=2" "-Wduplicated-branches" "-Wduplicated-cond" + "-Wcast-align=strict" "-Wjump-misses-init" "-Wlogical-op" "-U_FORTIFY_SOURCE" + "-D_FORTIFY_SOURCE=3" "-fstack-clash-protection" "-fstack-protector-all" + "-fno-delete-null-pointer-checks" "-fno-strict-aliasing" + "-fno-strict-overflow" "-fstrict-flex-arrays=3" + "-ftrivial-auto-var-init=pattern" "-fPIE" +) + +gcc_machine="$(gcc -dumpmachine)" +if [ "${gcc_machine}" = 'x86_64-linux-gnu' ]; then + gcc_hardening_options+=( '-fcf-protection=full' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +elif [ "${gcc_machine}" = 'aarch64-linux-gnu' ]; then + gcc_hardening_options+=( '-mbranch-protection=standard' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +fi + +gcc_hardening_options+=( + "-Wl,-z,nodlopen" "-Wl,-z,noexecstack" "-Wl,-z,relro" "-Wl,-z,now" + "-Wl,-z,separate-code" "-Wl,--as-needed" "-Wl,--no-copy-dt-needed-entries" + "-pie" +) + +gcc \ + -g \ + "${source_file}" \ + -o "${output_binary}" \ + -static \ + "${gcc_hardening_options[@]}" diff --git a/usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared b/usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared new file mode 100755 index 00000000..ffebdbb1 --- /dev/null +++ b/usr/libexec/security-misc/compile-fm-shim-backend#security-misc-shared @@ -0,0 +1,91 @@ +#!/bin/bash + +## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## AI-Assisted + +## Compile fm-shim-backend.c with the project's standard hardening +## flag set. Pure compile - the helper does not chmod, mv, or +## otherwise install the produced binary; the caller decides. +## +## Usage: +## compile-fm-shim-backend +## +## Used by: +## * usr/libexec/security-misc/build-fm-shim-backend (postinst-time +## compile-and-install on the user's machine) +## * ci/codeql-build.sh (CodeQL static +## analysis prebuild) +## +## Holding the gcc command in one place keeps the runtime build path +## and the CI analysis path from drifting on hardening flags. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +export LC_ALL=C + +if [ "$#" -ne 2 ]; then + printf '%s\n' "usage: ${BASH_SOURCE[0]} " >&2 + exit 64 +fi + +source_file="$1" +output_binary="$2" + +gcc_hardening_options=( + "-O2" "-Wall" "-Wextra" "-Wformat" "-Wformat=2" "-Wconversion" + "-Wimplicit-fallthrough" "-Werror=format-security" "-Werror=implicit" + "-Werror=int-conversion" "-Werror=incompatible-pointer-types" + "-Wformat-overflow" "-Wformat-signedness" "-Wformat-truncation" + "-Wnull-dereference" "-Winit-self" + "-Wmissing-include-dirs" "-Wshift-negative-value" "-Wshift-overflow" + "-Wswitch-default" "-Wuninitialized" "-Walloca" "-Warray-bounds" + "-Wfloat-equal" "-Wshadow" "-Wpointer-arith" "-Wundef" "-Wunused-macros" + "-Wbad-function-cast" "-Wcast-qual" "-Wcast-align" "-Wwrite-strings" + "-Wdate-time" "-Wstrict-prototypes" "-Wold-style-definition" + "-Wredundant-decls" "-Winvalid-utf8" "-Wvla" "-Wdisabled-optimization" + "-Wstack-protector" "-Wdeclaration-after-statement" "-Wtrampolines" + "-Wbidi-chars=any,ucn" "-Wformat-overflow=2" "-Wformat-truncation=2" + "-Wshift-overflow=2" "-Wtrivial-auto-var-init" "-Wstringop-overflow=3" + "-Wstrict-flex-arrays" "-Walloc-zero" "-Warray-bounds=2" + "-Wattribute-alias=2" "-Wduplicated-branches" "-Wduplicated-cond" + "-Wcast-align=strict" "-Wjump-misses-init" "-Wlogical-op" "-U_FORTIFY_SOURCE" + "-D_FORTIFY_SOURCE=3" "-fstack-clash-protection" "-fstack-protector-all" + "-fno-delete-null-pointer-checks" "-fno-strict-aliasing" + "-fno-strict-overflow" "-fstrict-flex-arrays=3" + "-ftrivial-auto-var-init=pattern" "-fPIE" +) + +gcc_machine="$(gcc -dumpmachine)" +if [ "${gcc_machine}" = 'x86_64-linux-gnu' ]; then + gcc_hardening_options+=( '-fcf-protection=full' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +elif [ "${gcc_machine}" = 'aarch64-linux-gnu' ]; then + gcc_hardening_options+=( '-mbranch-protection=standard' ) + gcc_hardening_options+=( '-fzero-call-used-regs=all' ) +fi + +gcc_hardening_options+=( + "-Wl,-z,nodlopen" "-Wl,-z,noexecstack" "-Wl,-z,relro" "-Wl,-z,now" + "-Wl,-z,separate-code" "-Wl,--as-needed" "-Wl,--no-copy-dt-needed-entries" + "-pie" +) + +## NOTE: pkg-config subshells intentionally are not quoted; pkg-config +## output is designed to be word-split by shells safely and would be +## broken by quoting. (See AGENTS.md "pkg-config quoting in build +## script".) +# shellcheck disable=SC2046 +gcc \ + -g \ + $(pkg-config --cflags dbus-1) \ + $(pkg-config --cflags libsystemd) \ + "${source_file}" \ + -o "${output_binary}" \ + $(pkg-config --libs dbus-1) \ + $(pkg-config --libs libsystemd) \ + "${gcc_hardening_options[@]}" diff --git a/usr/libexec/security-misc/disable-kernel-module-loading b/usr/libexec/security-misc/disable-kernel-module-loading deleted file mode 100644 index 1916cc0e..00000000 --- a/usr/libexec/security-misc/disable-kernel-module-loading +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2023 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -x -set -e - -sysctl -w kernel.modules_disabled=1 - -true "The loading of new modules to the kernel has been disabled by security-misc." diff --git a/usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared b/usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared new file mode 100755 index 00000000..ae0ccd34 --- /dev/null +++ b/usr/libexec/security-misc/disable-kernel-module-loading#security-misc-shared @@ -0,0 +1,16 @@ +#!/bin/bash + +## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +sysctl -w kernel.modules_disabled=1 + +true "The loading of new modules to the kernel has been disabled by package security-misc-shared." diff --git a/usr/libexec/security-misc/echo-path b/usr/libexec/security-misc/echo-path deleted file mode 100755 index 4a82272c..00000000 --- a/usr/libexec/security-misc/echo-path +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -echo "$PATH" diff --git a/usr/libexec/security-misc/echo-path#security-misc-shared b/usr/libexec/security-misc/echo-path#security-misc-shared new file mode 100755 index 00000000..f5d0d00f --- /dev/null +++ b/usr/libexec/security-misc/echo-path#security-misc-shared @@ -0,0 +1,13 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +printf '%s\n' "${PATH}" diff --git a/usr/libexec/security-misc/emerg-shutdown#security-misc-shared b/usr/libexec/security-misc/emerg-shutdown#security-misc-shared new file mode 100755 index 00000000..10ac93b5 --- /dev/null +++ b/usr/libexec/security-misc/emerg-shutdown#security-misc-shared @@ -0,0 +1,67 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +## Make sure globs sort in a predictable, reproducible fashion +export LC_ALL=C + +in_dracut='false' +if [ -f '/dracut-state.sh' ]; then + in_dracut='true' +fi +binary_prefix='/run' +EMERG_SHUTDOWN_KEYS='' +root_devices[0]='' + +## Read emergency shutdown key configuration +for config_file in /etc/security-misc/emerg-shutdown/*.conf /usr/local/etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + bash -n "${config_file}" + source "${config_file}" + fi +done + +if [ "${in_dracut}" = 'true' ]; then + binary_prefix='' + modprobe evdev || { + printf '%s\n' 'Failed to load evdev driver!' + exit 1 + } + ## modules may not work immediately after loaded, give them time to + ## initialize + sleep 0.1 +else + ## Find the devices that make up the root device + readarray -t root_devices < <(/usr/libexec/helper-scripts/get-backing-devices-for-mountpoint '/') || true; + + if [ ! -f '/run/emerg-shutdown' ]; then + if [ -f '/usr/bin/emerg-shutdown' ]; then + cp -- /usr/bin/emerg-shutdown /run/emerg-shutdown + else + /usr/libexec/security-misc/compile-emerg-shutdown \ + /usr/src/security-misc/emerg-shutdown.c \ + /run/emerg-shutdown \ + || { + printf '%s\n' 'Could not compile emerg-shutdown executable!' + exit 1 + } + fi + fi + + ## memlockd daemonizes itself, so no need to background it. + memlockd -c /usr/share/security-misc/security-misc-memlockd.cfg || true +fi + +systemd-notify --ready + +## Launch emerg-shutdown +IFS=',' +"${binary_prefix}/emerg-shutdown" "--devices=${root_devices[*]}" "--keys=${EMERG_SHUTDOWN_KEYS}" diff --git a/usr/libexec/security-misc/ensure-shutdown#security-misc-shared b/usr/libexec/security-misc/ensure-shutdown#security-misc-shared new file mode 100755 index 00000000..9a1cf1cf --- /dev/null +++ b/usr/libexec/security-misc/ensure-shutdown#security-misc-shared @@ -0,0 +1,31 @@ +#!/bin/bash + +# Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +# See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +source /usr/libexec/helper-scripts/strings.bsh + +## Make sure globs sort in a predictable, reproducible fashion +export LC_ALL=C + +## Read emergency shutdown key configuration +for config_file in /etc/security-misc/emerg-shutdown/*.conf /usr/local/etc/security-misc/emerg-shutdown/*.conf; do + if [ -f "${config_file}" ]; then + bash -n "${config_file}" + source "${config_file}" + fi +done +if [ -z "${ENSURE_SHUTDOWN_TIMEOUT:-}" ] \ + || ! is_whole_number "${ENSURE_SHUTDOWN_TIMEOUT}"; then + ENSURE_SHUTDOWN_TIMEOUT=30; +fi + +/run/emerg-shutdown --monitor-fifo "--timeout=${ENSURE_SHUTDOWN_TIMEOUT}" & +sleep 1 +disown +exit 0 diff --git a/usr/libexec/security-misc/hide-hardware-info b/usr/libexec/security-misc/hide-hardware-info deleted file mode 100755 index f6a963b7..00000000 --- a/usr/libexec/security-misc/hide-hardware-info +++ /dev/null @@ -1,133 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -run_cmd() { - echo "INFO: normal executing : $@" - "$@" -} - -run_cmd_whitelist() { - echo "INFO: whitelist executing: $@" - "$@" -} - -echo "$0: INFO: START" - -sysfs_whitelist=1 -cpuinfo_whitelist=1 - -sysfs=1 - -## https://www.kicksecure.com/wiki/Security-misc#selinux -selinux=0 - -shopt -s nullglob - -## Allows for disabling the whitelist. -for i in /etc/hide-hardware-info.d/*.conf -do - bash -n "${i}" - source "${i}" -done - -create_whitelist() { - if [ "${1}" = "sysfs" ]; then - whitelist_path="/sys" - elif [ "${1}" = "cpuinfo" ]; then - whitelist_path="/proc/cpuinfo" - else - echo "ERROR: ${1} is not a correct parameter." - exit 1 - fi - - if grep -q "${1}" /etc/group; then - ## Changing the permissions of /sys recursively - ## causes errors as the permissions of /sys/kernel/debug - ## and /sys/fs/cgroup cannot be changed. - run_cmd_whitelist chgrp --quiet --recursive "${1}" "${whitelist_path}" || true - - run_cmd_whitelist chmod o-rwx "${whitelist_path}" - else - echo "ERROR: The ${1} group does not exist, the ${1} whitelist was not created." - fi -} - -## sysfs and debugfs expose a lot of information -## that should not be accessible by an unprivileged -## user which includes hardware info, debug info and -## more. This restricts /sys, /proc/cpuinfo, /proc/bus -## and /proc/scsi to the root user only. This hides -## many hardware identifiers from ordinary users -## and increases security. -for i in /proc/cpuinfo /proc/bus /proc/scsi /sys -do - if [ -e "${i}" ]; then - if [ "${i}" = "/sys" ]; then - if [ "${sysfs}" = "1" ]; then - ## Whitelist for /sys. - if [ "${sysfs_whitelist}" = "1" ]; then - create_whitelist sysfs - else - echo "INFO: The sysfs whitelist is not enabled. Some things may not work properly. Full sysfs hardening..." - run_cmd chmod og-rwx /sys - fi - fi - elif [ "${i}" = "/proc/cpuinfo" ]; then - if [ "${cpuinfo_whitelist}" = "1" ]; then - create_whitelist cpuinfo - else - echo "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly. Full cpuinfo hardening..." - run_cmd chmod og-rwx /proc/cpuinfo - fi - else - run_cmd chmod og-rwx "${i}" - fi - else - ## /proc/scsi doesn't exist on Debian so errors - ## are expected here. - if ! [ "${i}" = "/proc/scsi" ]; then - echo "ERROR: ${i} could not be found." - fi - fi -done - - -if [ "${sysfs}" = "1" ]; then - ## restrict permissions on everything but - ## what is needed - for i in /sys/* /sys/fs/* - do - ## Using '|| true': - ## https://github.com/Kicksecure/security-misc/pull/108 - if [ "${sysfs_whitelist}" = "1" ]; then - run_cmd chmod o-rwx "${i}" || true - else - run_cmd chmod og-rwx "${i}" || true - fi - done - - ## polkit needs stat access to /sys/fs/cgroup - ## to function properly - run_cmd chmod o+rx /sys /sys/fs - - ## on SELinux systems, at least /sys/fs/selinux - ## must be visible to unprivileged users, else - ## SELinux userspace utilities will not function - ## properly - if [ -d /sys/fs/selinux ]; then - echo "INFO: SELinux detected because folder /sys/fs/selinux exists. See also:" - echo "https://www.kicksecure.com/wiki/Security-misc#selinux" - if [ "${selinux}" = "1" ]; then - run_cmd chmod o+rx /sys /sys/fs /sys/fs/selinux - echo "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function." - else - echo "INFO: SELinux detected, but SELinux mode is not enabled. Some userspace utilities may not work properly." - fi - fi -fi - -echo "$0: INFO: END" diff --git a/usr/libexec/security-misc/hide-hardware-info#security-misc-shared b/usr/libexec/security-misc/hide-hardware-info#security-misc-shared new file mode 100755 index 00000000..081e06e9 --- /dev/null +++ b/usr/libexec/security-misc/hide-hardware-info#security-misc-shared @@ -0,0 +1,138 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail +shopt -s nullglob + +run_cmd() { + printf '%s\n' "INFO: normal executing : $@" + "$@" +} + +run_cmd_whitelist() { + printf '%s\n' "INFO: whitelist executing: $@" + "$@" +} + +printf '%s\n' "$0: INFO: START" + +default_variables_set() { + sysfs_whitelist=1 + cpuinfo_whitelist=1 + sysfs=1 + ## https://www.kicksecure.com/wiki/Security-misc#selinux + selinux=0 +} + +parse_configuration() { + ## Allows for disabling the whitelist. + local i + for i in /usr/local/etc/hide-hardware-info.d/*.conf /etc/hide-hardware-info.d/*.conf ; do + bash -n -- "${i}" + source "${i}" + done +} + +create_whitelist() { + if [ "${1}" = "sysfs" ]; then + whitelist_path="/sys" + elif [ "${1}" = "cpuinfo" ]; then + whitelist_path="/proc/cpuinfo" + else + printf '%s\n' "ERROR: ${1} is not a correct parameter." + exit 1 + fi + + if getent group -- "${1}" >/dev/null; then + ## Changing the permissions of /sys recursively + ## causes errors as the permissions of /sys/kernel/debug + ## and /sys/fs/cgroup cannot be changed. + run_cmd_whitelist chgrp --quiet --recursive -- "${1}" "${whitelist_path}" || true + + run_cmd_whitelist chmod -- o-rwx "${whitelist_path}" + else + printf '%s\n' "ERROR: The ${1} group does not exist, the ${1} whitelist was not created." + fi +} + +default_variables_set +parse_configuration + +## sysfs and debugfs expose a lot of information +## that should not be accessible by an unprivileged +## user which includes hardware info, debug info and +## more. This restricts /sys, /proc/cpuinfo, /proc/bus +## and /proc/scsi to the root user only. This hides +## many hardware identifiers from ordinary users +## and increases security. +for i in /proc/cpuinfo /proc/bus /proc/scsi /sys ; do + if [ -e "${i}" ]; then + if [ "${i}" = "/sys" ]; then + if [ "${sysfs}" = "1" ]; then + ## Whitelist for /sys. + if [ "${sysfs_whitelist}" = "1" ]; then + create_whitelist sysfs + else + printf '%s\n' "INFO: The sysfs whitelist is not enabled. Some things may not work properly. Full sysfs hardening..." + run_cmd chmod -- og-rwx /sys + fi + fi + elif [ "${i}" = "/proc/cpuinfo" ]; then + if [ "${cpuinfo_whitelist}" = "1" ]; then + create_whitelist cpuinfo + else + printf '%s\n' "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly. Full cpuinfo hardening..." + run_cmd chmod -- og-rwx /proc/cpuinfo + fi + else + run_cmd chmod -- og-rwx "${i}" + fi + else + ## /proc/scsi doesn't exist on Debian so errors + ## are expected here. + if ! [ "${i}" = "/proc/scsi" ]; then + printf '%s\n' "ERROR: ${i} could not be found." + fi + fi +done + + +if [ "${sysfs}" = "1" ]; then + ## restrict permissions on everything but + ## what is needed + for i in /sys/* /sys/fs/* ; do + ## Using '|| true': + ## https://github.com/Kicksecure/security-misc/pull/108 + if [ "${sysfs_whitelist}" = "1" ]; then + run_cmd chmod -- o-rwx "${i}" || true + else + run_cmd chmod -- og-rwx "${i}" || true + fi + done + + ## polkit needs stat access to /sys/fs/cgroup + ## to function properly + run_cmd chmod -- o+rx /sys /sys/fs + + ## on SELinux systems, at least /sys/fs/selinux + ## must be visible to unprivileged users, else + ## SELinux userspace utilities will not function + ## properly + if [ -d /sys/fs/selinux ]; then + printf '%s\n' "INFO: SELinux detected because folder /sys/fs/selinux exists. See also:" + printf '%s\n' "https://www.kicksecure.com/wiki/Security-misc#selinux" + if [ "${selinux}" = "1" ]; then + run_cmd chmod -- o+rx /sys /sys/fs /sys/fs/selinux + printf '%s\n' "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function." + else + printf '%s\n' "INFO: SELinux detected, but SELinux mode is not enabled. Some userspace utilities may not work properly." + fi + fi +fi + +printf '%s\n' "$0: INFO: END" diff --git a/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared b/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared new file mode 100755 index 00000000..677dc90b --- /dev/null +++ b/usr/libexec/security-misc/kill-vboxdrmclient-on-shutdown#security-misc-shared @@ -0,0 +1,29 @@ +#!/bin/bash + +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o errtrace +set -o pipefail + +vboxdrmclient_sock='/tmp/.iprt-localipc-DRMIpcServer' + +if ! [ -S "$vboxdrmclient_sock" ]; then + printf '%s\n' "INFO: Socket file '$vboxdrmclient_sock' does not exist or is not a socket, ok." + exit 0 +fi + +sock_pid="$(/usr/libexec/helper-scripts/query-sock-pid "$vboxdrmclient_sock")" || true +if [ -z "$sock_pid" ]; then + printf '%s\n' "INFO: Cannot get PID listening on '$vboxdrmclient_sock', ok." + exit 0 +fi +if kill -SIGKILL -- "$sock_pid"; then + printf '%s\n' "INFO: Killed VBoxDRMClient ('$sock_pid'), ok." + exit 0 +fi + +printf '%s\n' "ERROR: Could not kill VBoxDRMClient ('$sock_pid')!" +exit 1 diff --git a/usr/libexec/security-misc/mmap-rnd-bits b/usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared similarity index 53% rename from usr/libexec/security-misc/mmap-rnd-bits rename to usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared index 74078fa0..c7ec5782 100755 --- a/usr/libexec/security-misc/mmap-rnd-bits +++ b/usr/libexec/security-misc/mmap-rnd-bits#security-misc-shared @@ -1,6 +1,6 @@ #!/usr/bin/env bash -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## This script enforces the maximum ASLR hardening settings for mmap, given the @@ -8,26 +8,31 @@ ## See also: ## https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514 -set -euo pipefail +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose shopt -s failglob more_info_link="https://forums.whonix.org/t/automate-mmap-randomisation-to-fix-ppc64el/16514" aslr_mmap_config_file="/etc/sysctl.d/30_security-misc_aslr-mmap.conf" exit_with_error() { - echo "$0: SEE ALSO:" >&2 - echo "" >&2 - echo "$more_info_link" >&2 + printf '%s\n' "$0: SEE ALSO:" >&2 + printf '%s\n' "" >&2 + printf '%s\n' "${more_info_link}" >&2 exit 1 } if ! test -d /etc/sysctl.d ; then - echo "$0: ERROR: Folder /etc/sysctl.d does not exist!" >&2 + printf '%s\n' "$0: ERROR: Folder /etc/sysctl.d does not exist!" >&2 exit_with_error fi if ! test -w /etc/sysctl.d ; then - echo "$0: ERROR: Folder /etc/sysctl.d not writeable! This script is supposed to be run as root." >&2 + printf '%s\n' "$0: ERROR: Folder /etc/sysctl.d not writeable! This script is supposed to be run as root." >&2 exit_with_error fi @@ -37,45 +42,49 @@ BITS_MAX_DEFAULT=32 COMPAT_BITS_MAX_DEFAULT=16 ## Find the most recently modified Linux config file. -if compgen -G "/boot/config-*" > /dev/null && CONFIG=$(ls -1 -t /boot/config-* | head -n 1) ; then +## Kernel config filenames are /boot/config-: no spaces or newlines, +## so the ls-parsing hazard SC2012 warns about is not reachable here, and a +## find-based newest-file rewrite would be a behaviour risk for no gain. +# shellcheck disable=SC2012 +if compgen -G "/boot/config-*" > /dev/null && CONFIG=$(ls -1 -t /boot/config-* | head -n1) ; then ## Find the relevant config options. if ! BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) ; then - echo "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_BITS_MAX! Using built-in default." >&2 + printf '%s\n' "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_BITS_MAX! Using built-in default." >&2 BITS_MAX="${BITS_MAX_DEFAULT}" fi if ! COMPAT_BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) ; then - echo "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX! Using built-in default." >&2 + printf '%s\n' "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX! Using built-in default." >&2 COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}" fi else ## Could be a chroot. - echo "$0: INFO: No Linux config file detected in folder /boot/ (starting with 'config-'). Therefore using built-in defaults." >&2 + printf '%s\n' "$0: INFO: No Linux config file detected in folder /boot/ (starting with 'config-'). Therefore using built-in defaults." >&2 BITS_MAX="${BITS_MAX_DEFAULT}" COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}" fi ## Generate a sysctl.d conf file. SYSCTL="\ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## This file is automatically generated by: ## $0 ## Do not edit! ## See also: -## $more_info_link +## ${more_info_link} ## Improves ASLR effectiveness for mmap. vm.mmap_rnd_bits=${BITS_MAX} vm.mmap_rnd_compat_bits=${COMPAT_BITS_MAX}" ## Write the sysctl.d conf file. -if echo "${SYSCTL}" | tee "$aslr_mmap_config_file" > /dev/null ; then - echo "$0: INFO: Successfully written ASLR map config file: -$aslr_mmap_config_file" +if printf '%s\n' "${SYSCTL}" | tee "${aslr_mmap_config_file}" > /dev/null ; then + printf '%s\n' "$0: INFO: Successfully written ASLR map config file: +${aslr_mmap_config_file}" exit 0 fi -echo "$0: ERROR: Error writing ASLR map config file: -$aslr_mmap_config_file" >&2 +printf '%s\n' "$0: ERROR: Error writing ASLR map config file: +${aslr_mmap_config_file}" >&2 exit_with_error diff --git a/usr/libexec/security-misc/pam-abort-on-locked-password b/usr/libexec/security-misc/pam-abort-on-locked-password deleted file mode 100755 index bb1a3ee8..00000000 --- a/usr/libexec/security-misc/pam-abort-on-locked-password +++ /dev/null @@ -1,53 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## This is only a usability feature to avoid needlessly bumping pam_faillock -## counter. This is not a security feature. -## https://forums.whonix.org/t/restrict-root-access/7658/1 - -passwd_bin="$(type -P "passwd")" - -if ! test -x "$passwd_bin" ; then - echo "\ -$0: ERROR: passwd_bin \"$passwd_bin\" is not executable. -See https://www.whonix.org/wiki/SUID_Disabler_and_Permission_Hardener#passwd" >&2 - ## Identifiable exit codes in case stdout / stderr is not logged in journal. - exit 2 -fi - -if ! passwd_output="$("$passwd_bin" -S "$PAM_USER" 2>/dev/null)" ; then - echo "$0: ERROR: user \"$PAM_USER\" does not exist." >&2 - exit 3 -fi - -password_status_field="$(echo "$passwd_output" | cut -d ' ' -f 2)" - -if [ "$password_status_field" = "P" ]; then - true "$0: INFO: user \"$PAM_USER\" has a usable password." -elif [ "$password_status_field" = "NP" ]; then - true "$0: INFO: user \"$PAM_USER\" has no password." -elif [ "$password_status_field" = "L" ]; then - echo "$0: INFO: Password for user \"$PAM_USER\" is locked." - - if [ -f /usr/share/whonix/marker ] || [ -f /usr/share/kicksecure/marker ]; then - if [ "$PAM_USER" = "root" ]; then - echo "$0: ERROR: root account is locked by default. See:" >&2 - echo "https://www.kicksecure.com/wiki/root" >&2 - echo "" >&2 - exit 4 - fi - fi - - ## Should not unconditionally 'exit 1' here. - ## Locked user accounts might have valid sudoers exceptions. - ## https://forums.whonix.org/t/pam-abort-on-locked-password-and-running-privileged-command-from-web-browser/10521 - ## 'exit 1' would be good for usability here because then the user would get - ## faster feedback. A new login attempt would not be needlessly delayed. - exit 0 -else - echo "$0: INFO: Password status field for user \"$PAM_USER\" could not be parsed. Please report this bug." -fi - -exit 0 diff --git a/usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared b/usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared new file mode 100755 index 00000000..5452a1af --- /dev/null +++ b/usr/libexec/security-misc/pam-abort-on-locked-password#security-misc-shared @@ -0,0 +1,62 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This is only a usability feature to avoid needlessly bumping pam_faillock +## counter. This is not a security feature. +## https://forums.whonix.org/t/restrict-root-access/7658/1 + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +PAM_USER="${PAM_USER:-}" + +passwd_bin="$(type -P -- "passwd")" + +if ! test -x "${passwd_bin}" ; then + printf '%s\n' "\ +$0: ERROR: passwd_bin \"${passwd_bin}\" is not executable. +See https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener#passwd" >&2 + ## Identifiable exit codes in case stdout / stderr is not logged in journal. + exit 2 +fi + +if ! passwd_output="$("${passwd_bin}" -S -- "${PAM_USER}" 2>/dev/null)" ; then + printf '%s\n' "$0: ERROR: user \"${PAM_USER}\" does not exist." >&2 + exit 3 +fi + +password_status_field="$(printf '%s\n' "${passwd_output}" | cut -d ' ' -f 2)" + +if [ "${password_status_field}" = "P" ]; then + true "$0: INFO: user \"${PAM_USER}\" has a usable password." +elif [ "${password_status_field}" = "NP" ]; then + true "$0: INFO: user \"${PAM_USER}\" has no password." +elif [ "${password_status_field}" = "L" ]; then + printf '%s\n' "$0: INFO: Password for user \"${PAM_USER}\" is locked." + + if [ -f /usr/share/whonix/marker ] || [ -f /usr/share/kicksecure/marker ]; then + if [ "${PAM_USER}" = "root" ]; then + printf '%s\n' "$0: ERROR: root account is locked by default. See:" >&2 + printf '%s\n' "https://www.kicksecure.com/wiki/root" >&2 + printf '%s\n' "" >&2 + exit 4 + fi + fi + + ## Should not unconditionally 'exit 1' here. + ## Locked user accounts might have valid sudoers exceptions. + ## https://forums.whonix.org/t/pam-abort-on-locked-password-and-running-privileged-command-from-web-browser/10521 + ## 'exit 1' would be good for usability here because then the user would get + ## faster feedback. A new login attempt would not be needlessly delayed. + exit 0 +else + printf '%s\n' "$0: INFO: Password status field for user \"${PAM_USER}\" could not be parsed. Please report this bug." +fi + +exit 0 diff --git a/usr/libexec/security-misc/pam-info b/usr/libexec/security-misc/pam-info deleted file mode 100755 index aa730de8..00000000 --- a/usr/libexec/security-misc/pam-info +++ /dev/null @@ -1,208 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## To enable debug log, run: -## sudo touch /etc/pam-info-debug -## -## Debug log if enabled can be found in file: -## /root/pam-info-debug.txt - -true "$0: START PHASE 1" - -if test -f /etc/pam-info-debug || test -f /usr/local/etc/pam-info-debug ; then - set -x - exec 5>&1 1>> ~/pam-info-debug.txt - exec 6>&2 2>> ~/pam-info-debug.txt -fi - -true "$0: START PHASE 2" - -set -o pipefail - -## Debugging. -who_ami="$(whoami)" -true "$0: who_ami: $who_ami" -true "$0: PAM_USER: $PAM_USER" -true "$0: SUDO_USER: $SUDO_USER" - -if [ "$PAM_USER" = "" ]; then - true "$0: ERROR: Environment variable PAM_USER is unset!" - exit 0 -fi - -grep_result="$(grep "accessfile=/etc/security/access-security-misc.conf" /etc/pam.d/common-account 2>/dev/null)" - -## Check if grep matched something. -if [ ! "$grep_result" = "" ]; then - ## Yes, grep matched. - - ## Check if not out commented. - if ! echo "$grep_result" | grep -q "#" ; then - ## Not out commented indeed. - - ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592 - - if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console"; then - console_allowed=true - fi - if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console-unrestricted"; then - console_allowed=true - fi - - if [ ! "$console_allowed" = "true" ]; then - echo "\ -$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console' -To unlock, run the following command as superuser: -(If you still have a sudo/root shell somewhere.) - -adduser $PAM_USER console - -However, possibly unlock procedure is required. -First boot into recovery mode at grub boot menu and then run above command. -See also: -https://www.kicksecure.com/wiki/root#console -" >&2 - exit 0 - fi - fi -fi - -## https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698 - -## Does not work (yet) for login, pam_securetty runs before and aborts. -## Also this should only run for login since securetty covers only login. -# if [ "$PAM_USER" = "root" ]; then -# if [ -f /etc/securetty ]; then -# grep_result="$(grep "^[^#]" /etc/securetty)" -# if [ "$grep_result" = "" ]; then -# echo "\ -# $0: ERROR: Root login is disabled. -# ERROR: This is because /etc/securetty is empty. -# See also: -# https://www.kicksecure.com/wiki/root#login -# " >&2 -# exit 0 -# fi -# fi -# fi - -## as user "user" -## /usr/sbin/faillock -u user -## faillock: Error opening /var/log/tallylog for update: Permission denied -## /usr/sbin/faillock: Authentication error -## -## xscreensaver runs as user "user", therefore pam_faillock cannot function. -## xscreensaver has its own failed login counter. -## -## https://askubuntu.com/questions/983183/how-lock-the-unlock-screen-after-wrong-password-attempts -## -## https://www.whonix.org/pipermail/whonix-devel/2019-September/001439.html -## -## Checking exit code to avoid breaking when read-only disk boot but -## without ro-mode-init or grub-live being used. -if ! pam_faillock_output="$(faillock --user "$PAM_USER")" ; then - true "$0: faillock non-zero exit code." - exit 0 -fi - -if [ "$pam_faillock_output" = "" ]; then - true "$0: no failed login" - exit 0 -fi - -## example pam_faillock_output (stdout): -## user: -## When Type Source Valid -## 2021-08-10 16:26:33 RHOST V -## 2021-08-10 16:26:54 RHOST V - -## example pam_faillock_output (stderr): -## faillock: No user name supplied. -## Usage: faillock [--dir /path/to/tally-directory] [--user username] [--reset] - -## Get first line. -#pam_faillock_output_first_line="$(echo "$pam_faillock_output" | head --lines=1)" -while read -t 10 -r pam_faillock_output_first_line ; do - break -done <<< "$pam_faillock_output" - -true "pam_faillock_output_first_line: '$pam_faillock_output_first_line'" -## example pam_faillock_output_first_line: -## user: - -user_name="$(echo "$pam_faillock_output_first_line" | LANG=C str_replace ":" "")" -## example user_name: -## user -## root - -pam_faillock_output_count="$(echo "$pam_faillock_output" | wc -l)" -## example pam_faillock_output_count: -## 2 -## example pam_faillock_output_count: -## 4 - -## Do not count the first two informational textual output lines -## (starting with "user:" and "When"). -failed_login_counter=$(( pam_faillock_output_count - 2 )) - -## example failed_login_counter: -## 2 - -if [ "$failed_login_counter" = "0" ]; then - true "$0: INFO: Failed login counter is 0, ok." - exit 0 -fi - -## pam_faillock default if it cannot be determined below. -deny=3 - -if test -f /etc/security/faillock.conf ; then - deny_line=$(grep --invert-match "#" /etc/security/faillock.conf | grep "deny =") - deny="$(echo "$deny_line" | LANG=C str_replace "=" "" | LANG=C str_replace "deny" "" | LANG=C str_replace " " "")" - ## Example: - #deny=50 -fi - -if [[ "$deny" == *[!0-9]* ]]; then - echo "\ -$0: ERROR: deny is not numeric. deny: '$deny' -ERROR: Please report this bug. -" >&2 - exit 0 -fi - -remaining_attempts="$(( $deny - $failed_login_counter ))" - -if [ "$remaining_attempts" -le "0" ]; then - echo "\ -$0: ERROR: Login blocked after $failed_login_counter attempts. -To unlock, run the following command as superuser: -(If you still have a sudo/root shell somewhere.) - -faillock --reset --user $PAM_USER - -However, most likely unlock procedure is required. -First boot into recovery mode at grub boot menu and then run above command. -See also: -https://www.kicksecure.com/wiki/root#unlock -" >&2 - exit 0 -fi - -echo "\ -$0: WARNING: $failed_login_counter failed login attempts for user_name '$user_name'. -Login will be blocked after $deny attempts. -You have $remaining_attempts more attempts before unlock procedure is required. -" >&2 - -if [ "$PAM_SERVICE" = "su" ]; then - echo "\ -$0: NOTE: Type the password. When entering the password, no password feedback (no asterisk (\"*\") symbol) will be shown. -" >&2 -fi - -true "$0: END" - -exit 0 diff --git a/usr/libexec/security-misc/pam-info#security-misc-shared b/usr/libexec/security-misc/pam-info#security-misc-shared new file mode 100755 index 00000000..70e0d98d --- /dev/null +++ b/usr/libexec/security-misc/pam-info#security-misc-shared @@ -0,0 +1,299 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## To enable debug log, run: +## sudo touch /etc/pam-info-debug +## +## Debug log if enabled can be found in file: +## /root/pam-info-debug.txt + +true "$0: START PHASE 1" + +if test -f /etc/pam-info-debug || test -f /usr/local/etc/pam-info-debug ; then + set -x + exec 5>&1 1>> ~/pam-info-debug.txt + exec 6>&2 2>> ~/pam-info-debug.txt +fi + +true "$0: START PHASE 2" + +set -o errexit +set -o errtrace +set -o pipefail +set -o nounset + +error_handler() { + exit_code="$?" + printf '%s\n' "\ +$0: ERROR: Unexpected error. +BASH_COMMAND: '$BASH_COMMAND' +exit_code: '$exit_code' +ERROR: Please report this bug." >&2 + exit 1 +} + +trap error_handler ERR + +if ! printf '%s\n' "" | wc -l >/dev/null ; then + printf '%s\n' "\ +$0: ERROR: command 'wc' test failed! Do not ignore this! + +'wc' can core dump. Example: +zsh: illegal hardware instruction (core dumped) wc -l +https://github.com/rspamd/rspamd/issues/5137" >&2 + exit 1 +fi + +command -v str_replace &>/dev/null + +## Named constants. +pam_faillock_state_dir="/var/lib/security-misc/faillock" + +[[ -v PAM_USER ]] || PAM_USER="" +[[ -v SUDO_USER ]] || SUDO_USER="" + +## Debugging. +who_ami="$(whoami)" +true "$0: who_ami: $who_ami" +true "$0: PAM_USER: $PAM_USER" +true "$0: SUDO_USER: $SUDO_USER" + +if [ "$PAM_USER" = "" ]; then + true "$0: ERROR: Environment variable PAM_USER is unset!" + exit 0 +fi + +## PAM_USER is set by the PAM stack and is generally trusted. +## Sanity check: reject control characters and values starting with '-' +## to prevent option injection into commands like faillock. +if [[ "$PAM_USER" =~ [[:cntrl:]] ]] || [[ "$PAM_USER" == -* ]]; then + true "$0: ERROR: PAM_USER contains suspicious characters: '$(printf '%q' "$PAM_USER")'" + exit 0 +fi + +grep_result="$(grep -- "accessfile=/etc/security/access-security-misc.conf" /etc/pam.d/common-account 2>/dev/null)" || true + +## Check if grep matched something. +if [ ! "$grep_result" = "" ]; then + ## Yes, grep matched. + + ## Check if not out commented. + if ! printf '%s\n' "$grep_result" | grep --quiet -- "#" ; then + ## Not out commented indeed. + + ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592 + + console_allowed="" + if id --name --groups --zero -- "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings -- "console"; then + console_allowed=true + fi + if id --name --groups --zero -- "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings -- "console-unrestricted"; then + console_allowed=true + fi + + if [ ! "$console_allowed" = "true" ]; then + printf '%s\n' "\ +$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console' +To unlock, run the following command as superuser: +(If you still have a sudo/root shell somewhere.) + +adduser $PAM_USER console + +However, possibly unlock procedure is required. +First boot into recovery mode at grub boot menu and then run above command. +See also: +https://www.kicksecure.com/wiki/root#console +" >&2 + exit 0 + fi + fi +fi + +if [ "$PAM_USER" = 'sysmaint' ]; then + sysmaint_passwd_info="$(passwd --status sysmaint 2>/dev/null)" || true + sysmaint_lock_info="$(cut -d' ' -f2 <<< "${sysmaint_passwd_info}")" + if [ "${sysmaint_lock_info}" = 'L' ]; then + printf '%s\n' "$0: ERROR: Reboot and choose 'PERSISTENT Mode - SYSMAINT Session' for system maintenance. See https://www.kicksecure.com/wiki/Sysmaint" >&2 + fi +fi + +kernel_cmdline='' +if [ -f /proc/cmdline ]; then + kernel_cmdline="$(cat -- /proc/cmdline)" || true +elif [ -f /proc/1/cmdline ]; then + kernel_cmdline="$(cat -- /proc/1/cmdline)" || true +fi + +if [ "$PAM_USER" != 'sysmaint' ]; then + if [[ "${kernel_cmdline}" =~ 'boot-role=sysmaint' ]]; then + printf '%s\n' "$0: WARNING: Use account 'sysmaint' for system maintenance. See https://www.kicksecure.com/wiki/Sysmaint" >&2 + fi +fi + +## https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698 + +## Does not work (yet) for login, pam_securetty runs before and aborts. +## Also this should only run for login since securetty covers only login. +# if [ "$PAM_USER" = "root" ]; then +# if [ -f /etc/securetty ]; then +# grep_result="$(grep -- "^[^#]" /etc/securetty)" +# if [ "$grep_result" = "" ]; then +# printf '%s\n' "\ +# $0: ERROR: Root login is disabled. +# ERROR: This is because file '/etc/securetty' is empty. +# See also: +# https://www.kicksecure.com/wiki/root#login +# " >&2 +# exit 0 +# fi +# fi +# fi + +## under account "user" +## /usr/sbin/faillock -u user +## faillock: Error opening /var/log/tallylog for update: Permission denied +## /usr/sbin/faillock: Authentication error +## +## xscreensaver runs under account "user", therefore pam_faillock cannot function. +## xscreensaver has its own failed login counter. +## +## https://askubuntu.com/questions/983183/how-lock-the-unlock-screen-after-wrong-password-attempts +## +## https://web.archive.org/web/20200919221439/https://www.whonix.org/pipermail/whonix-devel/2019-September/001439.html +## +## Checking exit code to avoid breaking when read-only disk boot but +## without ro-mode-init or grub-live being used. +## +## end-of-options ("--") unsupported by faillock. +if ! pam_faillock_output="$(faillock --dir "$pam_faillock_state_dir" --user "$PAM_USER")" ; then + true "$0: faillock non-zero exit code." + exit 0 +fi + +if [ "$pam_faillock_output" = "" ]; then + true "$0: no failed login" + exit 0 +fi + +## example pam_faillock_output (stdout): +## user: +## When Type Source Valid +## 2021-08-10 16:26:33 RHOST V +## 2021-08-10 16:26:54 RHOST V + +## example pam_faillock_output (stderr): +## faillock: No user name supplied. +## Usage: faillock [--dir /path/to/tally-directory] [--user username] [--reset] + +## Get first line. +#pam_faillock_output_first_line="$(printf '%s\n' "$pam_faillock_output" | head --lines=1)" +while read -t 10 -r pam_faillock_output_first_line ; do + break +done <<< "$pam_faillock_output" + +true "pam_faillock_output_first_line: '$pam_faillock_output_first_line'" +## example pam_faillock_output_first_line: +## user: + +user_name="$(printf '%s\n' "$pam_faillock_output_first_line" | str_replace ":" "")" +## example user_name: +## user +## root + +if [ "$PAM_USER" != "$user_name" ]; then + printf '%s\n' "\ +$0: ERROR: Variable 'PAM_USER' '$PAM_USER' does not match variable 'user_name' '$user_name'. +ERROR: Please report this bug. +" >&2 + exit 1 +fi + +pam_faillock_output_count="$(printf '%s\n' "$pam_faillock_output" | wc -l)" +## example pam_faillock_output_count: +## 2 +## example pam_faillock_output_count: +## 4 + +if [[ "$pam_faillock_output_count" == *[!0-9]* ]]; then + printf '%s\n' "\ +$0: ERROR: Variable 'pam_faillock_output_count' is not numeric. pam_faillock_output_count: '$pam_faillock_output_count' +ERROR: Please report this bug. +" >&2 + exit 0 +fi + +## Do not count the first two informational textual output lines (starting with "user:" and "When") if present, +failed_login_counter=$(( pam_faillock_output_count - 2 )) + +## example failed_login_counter: +## 2 + +## Ensuring failed_login_counter is not set to a negative value. +## https://github.com/Kicksecure/security-misc/pull/305 +if [ "$failed_login_counter" -lt "0" ]; then + true "$0: WARNING: Failed login counter is negative. Resetting to 0." + failed_login_counter=0 +fi + +if [ "$failed_login_counter" = "0" ]; then + true "$0: INFO: Failed login counter is 0, ok." + exit 0 +fi + +## pam_faillock default if it cannot be determined below. +deny=3 + +if test -f /etc/security/faillock.conf ; then + deny_line=$(grep --invert-match "#" -- /etc/security/faillock.conf | grep -- "deny =") || true + deny="$(printf '%s\n' "$deny_line" | str_replace "=" "" | str_replace "deny" "" | str_replace " " "")" + ## Restore the default if no uncommented 'deny =' line was found; an empty + ## value would slip past the numeric guard below and incorrectly report a + ## lockout. + [ -n "$deny" ] || deny=3 + ## Example: + #deny=50 +fi + +if [[ "$deny" == *[!0-9]* ]]; then + printf '%s\n' "\ +$0: ERROR: Variable 'deny' is not numeric. deny: '$deny' +ERROR: Please report this bug. +" >&2 + exit 0 +fi + +remaining_attempts="$(( deny - failed_login_counter ))" + +if [ "$remaining_attempts" -le "0" ]; then + printf '%s\n' "\ +$0: ERROR: Login blocked after $failed_login_counter attempts. +To unlock, run the following command as superuser: +(If you still have a sudo/root shell somewhere.) + +faillock --dir $pam_faillock_state_dir --reset --user $PAM_USER + +However, most likely unlock procedure is required. +First boot into recovery mode at grub boot menu and then run above command. +See also: +https://www.kicksecure.com/wiki/root#unlock +" >&2 + exit 0 +fi + +printf '%s\n' "\ +$0: WARNING: $failed_login_counter failed login attempts for account '$user_name'. +Login will be blocked after $deny attempts. +You have $remaining_attempts more attempts before unlock procedure is required. +" >&2 + +if [ "$PAM_SERVICE" = "su" ]; then + printf '%s\n' "\ +$0: NOTE: Type the password. When entering the password, no password feedback (no asterisk (\"*\") symbol) will be shown. +" >&2 +fi + +true "$0: END" + +exit 0 diff --git a/usr/libexec/security-misc/pam_faillock_not_if_x b/usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared similarity index 71% rename from usr/libexec/security-misc/pam_faillock_not_if_x rename to usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared index edfa35d6..4cb725a8 100755 --- a/usr/libexec/security-misc/pam_faillock_not_if_x +++ b/usr/libexec/security-misc/pam_faillock_not_if_x#security-misc-shared @@ -1,13 +1,21 @@ #!/bin/bash -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose -true "PAM_SERVICE: $PAM_SERVICE" +PAM_SERVICE="${PAM_SERVICE:-}" + +true "PAM_SERVICE: ${PAM_SERVICE}" ## PAM configuration notes ## @@ -23,8 +31,8 @@ true "PAM_SERVICE: $PAM_SERVICE" ## This list can later be extended as needed. pam_service_exclusion_list="dovecot sshd" -for pam_service_exclusion_item in $pam_service_exclusion_list ; do - if [ "$PAM_SERVICE" = "$pam_service_exclusion_item" ]; then +for pam_service_exclusion_item in ${pam_service_exclusion_list} ; do + if [ "${PAM_SERVICE}" = "${pam_service_exclusion_item}" ]; then ## exit success so [success=1 default=ignore] will result in skipping the ## next PAM module (the pam_faillock module). exit 0 @@ -33,8 +41,4 @@ done ## exit failure so [success=1 default=ignore] will result in running the ## next PAM module (the pam_faillock module). -## -## Causes confusing error message: -## pam_exec(sudo:auth): /usr/libexec/security-misc/pam_faillock_not_if_x failed: exit code 1 -## https://github.com/linux-pam/linux-pam/issues/329 exit 1 diff --git a/usr/libexec/security-misc/pam_only_if_login b/usr/libexec/security-misc/pam_only_if_login deleted file mode 100755 index f81592eb..00000000 --- a/usr/libexec/security-misc/pam_only_if_login +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files - -set -x - -true "PAM_SERVICE: $PAM_SERVICE" - -if [ "$PAM_SERVICE" = "login" ]; then - ## FIXME: - ## Creates unwanted journal log entry. - ## pam_exec(login:account): /usr/libexec/security-misc/pam_only_if_login failed: exit code 1 - exit 1 -else - ## exit success so [success=1 default=ignore] will result in skipping the - ## next pam module. - exit 0 -fi diff --git a/usr/libexec/security-misc/pam_only_if_login#security-misc-shared b/usr/libexec/security-misc/pam_only_if_login#security-misc-shared new file mode 100755 index 00000000..a462e19a --- /dev/null +++ b/usr/libexec/security-misc/pam_only_if_login#security-misc-shared @@ -0,0 +1,24 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +true "PAM_SERVICE: ${PAM_SERVICE:-}" + +if [ "${PAM_SERVICE:-}" = "login" ]; then + exit 1 +else + ## exit success so [success=1 default=ignore] will result in skipping the + ## next pam module. + exit 0 +fi diff --git a/usr/libexec/security-misc/pam_only_if_su#security-misc-shared b/usr/libexec/security-misc/pam_only_if_su#security-misc-shared new file mode 100755 index 00000000..eeef759e --- /dev/null +++ b/usr/libexec/security-misc/pam_only_if_su#security-misc-shared @@ -0,0 +1,23 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## Similar to: +## /usr/libexec/security-misc/pam_only_if_login + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +true "PAM_SERVICE: ${PAM_SERVICE:-}" + +if [ "${PAM_SERVICE:-}" = "su" ]; then + exit 1 +else + exit 0 +fi diff --git a/usr/libexec/security-misc/panic-on-oops b/usr/libexec/security-misc/panic-on-oops deleted file mode 100755 index 73c22d0d..00000000 --- a/usr/libexec/security-misc/panic-on-oops +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -set -e - -if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then - ## pre.bsh would `source` the following folders: - ## /etc/panic-on-oops_pre.d/*.conf - ## /usr/local/etc/panic-on-oops_pre.d/*.conf - source /usr/libexec/helper-scripts/pre.bsh -fi - -## Makes the kernel panic on oopses and warnings. This prevents the -## kernel from continuing to run a flawed processes. Many kernel -## exploits will also cause an oops, these settings will make the -## kernel kill the offending processes. -#sysctl kernel.panic=-1 -sysctl kernel.panic_on_oops=1 -sysctl kernel.panic_on_warn=1 -#sysctl kernel.oops_limit=1 -#sysctl kernel.warn_limit=1 diff --git a/usr/libexec/security-misc/panic-on-oops#security-misc-shared b/usr/libexec/security-misc/panic-on-oops#security-misc-shared new file mode 100755 index 00000000..a89bbd0d --- /dev/null +++ b/usr/libexec/security-misc/panic-on-oops#security-misc-shared @@ -0,0 +1,39 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + ## pre.bsh would `source` the following folders: + ## /etc/panic-on-oops_pre.d/*.conf + ## /usr/local/etc/panic-on-oops_pre.d/*.conf + source /usr/libexec/helper-scripts/pre.bsh +fi + +action="${1:-}" + +if [ "${action}" = 'enable' ]; then + ## Makes the kernel immediately panic on both oopses and warnings. + ## These settings force a full system crash rather than continuing + ## to run after an inconsistent state is triggered by a potentially + ## flawed processes. The reasons for the errors could be kernel + ## exploit attempts but may also simply be general software bugs. + ## + ## https://docs.kernel.org/admin-guide/sysctl/kernel.html#oops-limit + sysctl kernel.oops_limit=1 + ## https://docs.kernel.org/admin-guide/sysctl/kernel.html#warn-limit + sysctl kernel.warn_limit=1 +elif [ "${action}" = 'disable' ]; then + sysctl kernel.oops_limit=0 + sysctl kernel.warn_limit=0 +else + printf '%s\n' "ERROR: Unrecognized action '${action}'!" + exit 1 +fi diff --git a/usr/libexec/security-misc/permission-lockdown b/usr/libexec/security-misc/permission-lockdown#security-misc-shared similarity index 86% rename from usr/libexec/security-misc/permission-lockdown rename to usr/libexec/security-misc/permission-lockdown#security-misc-shared index a5623b23..5b226475 100755 --- a/usr/libexec/security-misc/permission-lockdown +++ b/usr/libexec/security-misc/permission-lockdown#security-misc-shared @@ -1,9 +1,16 @@ #!/bin/bash -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## Doing this for all users would create many issues. +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + # /usr/libexec/security-misc/permission-lockdown: user: root | chmod o-rwx "/root" # /usr/libexec/security-misc/permission-lockdown: user: daemon | chmod o-rwx "/usr/sbin" # /usr/libexec/security-misc/permission-lockdown: user: bin | chmod o-rwx "/bin" @@ -25,6 +32,7 @@ # /usr/libexec/security-misc/permission-lockdown: user: stunnel4 | chmod o-rwx "/var/run/stunnel4" # /usr/libexec/security-misc/permission-lockdown: user: iodine | chmod o-rwx "/var/run/iodine" # /usr/libexec/security-misc/permission-lockdown: user: apt-cacher-ng | chmod o-rwx "/var/cache/apt-cacher-ng" +# /usr/libexec/security-misc/permission-lockdown: user: approx | chmod o-rwx "/var/cache/approx" # /usr/libexec/security-misc/permission-lockdown: user: statd | chmod o-rwx "/var/lib/nfs" # /usr/libexec/security-misc/permission-lockdown: user: timidity | chmod o-rwx "/etc/timidity" # /usr/libexec/security-misc/permission-lockdown: user: uuidd | chmod o-rwx "/run/uuidd" @@ -35,10 +43,10 @@ home_folder_access_rights_lockdown() { mkdir --parents /var/cache/security-misc/state-files local user for user in $(dir /home); do ## lists directories only - if [ -f "/var/cache/security-misc/state-files/$user" ]; then + if [ -f "/var/cache/security-misc/state-files/${user}" ]; then continue fi - folder_name="/home/$user" + folder_name="/home/${user}" ## chmod: ## The 'g' for 'group' is not needed. ## Debian by default uses USERGROUPS=yes in /etc/adduser.conf. @@ -50,9 +58,9 @@ home_folder_access_rights_lockdown() { ## required to run is sudo addgroup user1 user2. ## See also: user private groups UPGs ## https://wiki.debian.org/UserPrivateGroups - echo "$0: chmod o-rwx \"$folder_name\"" - chmod o-rwx "$folder_name" - touch "/var/cache/security-misc/state-files/$user" + printf '%s\n' "$0: chmod o-rwx \"${folder_name}\"" + chmod o-rwx "${folder_name}" || true + touch "/var/cache/security-misc/state-files/${user}" || true done } diff --git a/usr/libexec/security-misc/placeholder#security-misc-server b/usr/libexec/security-misc/placeholder#security-misc-server new file mode 100755 index 00000000..6cfad57b --- /dev/null +++ b/usr/libexec/security-misc/placeholder#security-misc-server @@ -0,0 +1,14 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +printf '%s\n' "$0: This is just a placeholder until security-misc-server gets implemented." +exit 0 diff --git a/usr/libexec/security-misc/remove-system.map b/usr/libexec/security-misc/remove-system.map deleted file mode 100755 index 53418447..00000000 --- a/usr/libexec/security-misc/remove-system.map +++ /dev/null @@ -1,42 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then - ## pre.bsh would `source` the following folders: - ## /etc/remove-system.map_pre.d/*.conf - ## /usr/local/etc/remove-system.map_pre.d/*.conf - source /usr/libexec/helper-scripts/pre.bsh -fi - -shopt -s nullglob - -system_map_location="/boot/System.map* /usr/src/*/System.map* /lib/modules/*/*/System.map* /System.map*" - -counter=0 -for filename in ${system_map_location} ; do - counter=$(( counter + 1 )) -done - -if [ "$counter" -ge "1" ]; then - echo "INFO: Deleting system.map files..." -fi - -## Removes the System.map files as they are only used for debugging or malware. -for filename in ${system_map_location} ; do - if [ -f "${filename}" ]; then - if [ -w "${filename}" ]; then - ## 'shred' with '--verbose' is too chatty. (7 lines) - shred --force --zero -u "${filename}" - echo "INFO: removed '${filename}'" - else - echo "NOTE: Cannot delete '${filename}' - read-only. For details, see: https://www.kicksecure.com/wiki/security-misc#system_map" - exit 0 - fi - fi -done - -if [ "$counter" -ge "1" ]; then - echo "INFO: Done. Success." -fi diff --git a/usr/libexec/security-misc/remove-system.map#security-misc-shared b/usr/libexec/security-misc/remove-system.map#security-misc-shared new file mode 100755 index 00000000..a0dff730 --- /dev/null +++ b/usr/libexec/security-misc/remove-system.map#security-misc-shared @@ -0,0 +1,60 @@ +#!/bin/bash + +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose + +if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then + ## pre.bsh would `source` the following folders: + ## /etc/remove-system.map_pre.d/*.conf + ## /usr/local/etc/remove-system.map_pre.d/*.conf + source /usr/libexec/helper-scripts/pre.bsh +fi + +shopt -s nullglob + +system_map_list=( /boot/System.map* /usr/src/*/System.map* /lib/modules/*/*/System.map* /System.map* ) + +if [ "${#system_map_list[@]}" -gt 0 ]; then + printf '%s\n' "INFO: Deleting system.map files..." +fi + +failed_list=() + +## Removes the System.map files as they are only used for debugging or malware. +for filename in "${system_map_list[@]}"; do + if ! [ -f "${filename}" ]; then + continue + fi + ## The immutable and append-only file attributes prevent deletion. + ## System.map files have no reason to have either. + chattr -ia -- "${filename}" >/dev/null 2>&1 || true + + ## 'shred' with '--verbose' is too chatty. (7 lines) + ## 'shred' stderr is suppressed because failure is expected on read-only + ## file systems. + if shred --force --zero -u -- "${filename}" 2>/dev/null; then + printf '%s\n' "INFO: removed '${filename}'" + continue + fi + failed_list+=( "${filename}" ) +done + +if [ "${#failed_list[@]}" -gt 0 ]; then + for filename in "${failed_list[@]}"; do + printf '%s\n' "NOTE: Could not remove '${filename}'." + done + printf '%s\n' "NOTE: For details, see: https://www.kicksecure.com/wiki/security-misc#system_map" +elif [ "${#system_map_list[@]}" -gt 0 ]; then + printf '%s\n' "INFO: Done. Success." +fi + +## Deliberately exits 0 even on partial failure. A non-zero exit code would fail +## the kernel package's postinst hook and the oneshot unit on every boot. +exit 0 diff --git a/usr/libexec/security-misc/virusforget b/usr/libexec/security-misc/virusforget#security-misc-shared similarity index 94% rename from usr/libexec/security-misc/virusforget rename to usr/libexec/security-misc/virusforget#security-misc-shared index 62b6823e..dbab06dd 100755 --- a/usr/libexec/security-misc/virusforget +++ b/usr/libexec/security-misc/virusforget#security-misc-shared @@ -1,6 +1,6 @@ #!/bin/bash -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## VirusForget is inspired by Christopher Laprise. @@ -85,6 +85,10 @@ parse_cmd_options() { echo "ERROR: must set --user username" >&2 exit 1 fi + if ! id -u "$user_name" >/dev/null 2>&1; then + echo "ERROR: User '$user_name' does not appear to exist!" >&2 + exit 1 + fi } variables() { @@ -270,7 +274,7 @@ unexpected_file() { elif [ "$clean" = "true" ]; then echo "unexpected symlink. Removing... unlink '$full_path_original'" >&2 unlink "$full_path_original" - echo "Removed unexpect symlink." >&2 + echo "Removed unexpected symlink." >&2 fi else if [ "$test_mode" = "true" ]; then @@ -294,6 +298,13 @@ unexpected_file() { } restore_file() { + ## An extraneous file has no baseline backup to restore from; the caller + ## has already removed it, which is the correct action. Return early so the + ## 'cp' below does not fail on the missing backup and abort the entire + ## '--clean' run (via 'set -e') on the first extraneous file encountered. + if [ ! -e "$full_path_backup" ]; then + return 0 + fi if [ "$test_mode" = "true" ]; then echo "Simulate restoring file... $full_path_original" >&2 echo cp --no-dereference --archive "$full_path_backup" "$full_path_original" diff --git a/usr/share/doc/security-misc/fstab-vm b/usr/share/doc/security-misc/fstab-vm#security-misc-shared similarity index 100% rename from usr/share/doc/security-misc/fstab-vm rename to usr/share/doc/security-misc/fstab-vm#security-misc-shared diff --git a/usr/share/glib-2.0/schemas/30_security-misc.gschema.override b/usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared similarity index 60% rename from usr/share/glib-2.0/schemas/30_security-misc.gschema.override rename to usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared index 92b53484..2f568050 100644 --- a/usr/share/glib-2.0/schemas/30_security-misc.gschema.override +++ b/usr/share/glib-2.0/schemas/30_security-misc.gschema.override#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2017 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2017 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. [org.gnome.nautilus.preferences] diff --git a/usr/share/lintian/overrides/security-misc b/usr/share/lintian/overrides/security-misc deleted file mode 100644 index 0a24ab06..00000000 --- a/usr/share/lintian/overrides/security-misc +++ /dev/null @@ -1,17 +0,0 @@ -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## The whole point of the package. -security-misc: package-contains-file-in-etc-skel [etc/skel/*] - -## Wrapper script. -security-misc: no-manual-page [usr/bin/pkexec.security-misc] - -## Non-ideal but still a good solution. -security-misc: file-in-unusual-dir [var/cache/security-misc/state-files/placeholder] - -## False-positive. Just a comment mentioning dpkg's folder. -security-misc: uses-dpkg-database-directly [usr/bin/remount-secure] - -## Special target to make sure this runs as non-parallelized as possible to avoid race conditions. -security-misc: systemd-service-file-refers-to-unusual-wantedby-target sysinit-post.target [usr/lib/systemd/system/remount-secure.service] diff --git a/usr/share/lintian/overrides/security-misc-shared#security-misc-shared b/usr/share/lintian/overrides/security-misc-shared#security-misc-shared new file mode 100644 index 00000000..0735aaa3 --- /dev/null +++ b/usr/share/lintian/overrides/security-misc-shared#security-misc-shared @@ -0,0 +1,26 @@ +## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## The whole point of the package. +security-misc-shared: package-contains-file-in-etc-skel [etc/skel/*] + +## Wrapper script. +security-misc-shared: no-manual-page [usr/bin/pkexec.security-misc] + +## Non-ideal but still a good solution. +security-misc-shared: file-in-unusual-dir [var/cache/security-misc/state-files/placeholder] + +## False-positive. Just a comment mentioning dpkg's folder. +security-misc-shared: uses-dpkg-database-directly [usr/bin/remount-secure] + +## Special target to make sure this runs as non-parallelized as possible to avoid race conditions. +security-misc-shared: systemd-service-file-refers-to-unusual-wantedby-target sysinit-post.target [usr/lib/systemd/system/remount-secure.service] + +## False-positive. Unit is commented out by default. +security-misc-shared: systemd-service-file-missing-install-key [usr/lib/systemd/system/block-shutdown.service] + +## Minor bug: Unknown. +security-misc-shared: package-contains-empty-directory [usr/share/security-misc-shared/] + +## Lintian doesn't know that set -o errexit is the same as set -e. +security-misc-shared: maintainer-script-ignores-errors [postinst] diff --git a/usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared b/usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared new file mode 100644 index 00000000..eec6702b --- /dev/null +++ b/usr/share/pam-configs/block-unsafe-logins-security-misc#security-misc-shared @@ -0,0 +1,6 @@ +Name: block unsafe passwordless login (by package security-misc-shared) +Default: yes +Priority: 1100 +Auth-Type: Primary +Auth: + requisite pam_exec.so seteuid stdout /usr/libexec/security-misc/block-unsafe-logins diff --git a/usr/share/pam-configs/console-lockdown-security-misc b/usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared similarity index 60% rename from usr/share/pam-configs/console-lockdown-security-misc rename to usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared index df57a853..d760d5fe 100644 --- a/usr/share/pam-configs/console-lockdown-security-misc +++ b/usr/share/pam-configs/console-lockdown-security-misc#security-misc-shared @@ -1,7 +1,7 @@ -Name: allow only members of group console to use login (by package security-misc) +Name: allow only members of group console to use login (by package security-misc-shared) Default: no Priority: 280 Account-Type: Primary Account: - [success=1 default=ignore] pam_exec.so seteuid quiet /usr/libexec/security-misc/pam_only_if_login + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_only_if_login required pam_access.so accessfile=/etc/security/access-security-misc.conf debug diff --git a/usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared b/usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared new file mode 100644 index 00000000..41c61f9a --- /dev/null +++ b/usr/share/pam-configs/faillock-preauth-security-misc#security-misc-shared @@ -0,0 +1,8 @@ +Name: lock accounts after 50 failed authentication attempts (preauth component) (by package security-misc-shared) +Default: yes +Priority: 1024 +Auth-Type: Primary +Auth: + optional pam_exec.so debug stdout seteuid /usr/libexec/security-misc/pam-info + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + required pam_faillock.so preauth diff --git a/usr/share/pam-configs/faillock-security-misc b/usr/share/pam-configs/faillock-security-misc deleted file mode 100644 index d3376901..00000000 --- a/usr/share/pam-configs/faillock-security-misc +++ /dev/null @@ -1,11 +0,0 @@ -Name: lock accounts after 50 failed authentication attempts (part 1) (by package security-misc) -Default: yes -Priority: 290 -Auth-Type: Primary -Auth: - optional pam_exec.so debug stdout seteuid /usr/libexec/security-misc/pam-info - [success=1 default=ignore] pam_exec.so seteuid quiet /usr/libexec/security-misc/pam_faillock_not_if_x - required pam_faillock.so preauth -Account-Type: Primary -Account: - requisite pam_faillock.so diff --git a/usr/share/pam-configs/faillock2-security-misc b/usr/share/pam-configs/faillock2-security-misc deleted file mode 100644 index 7bc5fb73..00000000 --- a/usr/share/pam-configs/faillock2-security-misc +++ /dev/null @@ -1,8 +0,0 @@ -Name: lock accounts after 50 failed authentication attempts (part 2) (by package security-misc) -Default: yes -Priority: 245 -Auth-Type: Primary -Auth: - [success=2 default=ignore] pam_exec.so seteuid quiet /usr/libexec/security-misc/pam_faillock_not_if_x - [default=die] pam_faillock.so authfail - sufficient pam_faillock.so authsucc diff --git a/usr/share/pam-configs/mkhomedir-security-misc b/usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared similarity index 64% rename from usr/share/pam-configs/mkhomedir-security-misc rename to usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared index 326013c0..03b11e4e 100644 --- a/usr/share/pam-configs/mkhomedir-security-misc +++ b/usr/share/pam-configs/mkhomedir-security-misc#security-misc-shared @@ -1,4 +1,4 @@ -Name: Create home directory on login (by package security-misc) +Name: Create home directory on login (by package security-misc-shared) Default: yes Priority: 100 Session-Type: Additional diff --git a/usr/share/pam-configs/pam-abort-on-locked-password-security-misc b/usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared similarity index 70% rename from usr/share/pam-configs/pam-abort-on-locked-password-security-misc rename to usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared index 4d2ffa22..02cd2a35 100644 --- a/usr/share/pam-configs/pam-abort-on-locked-password-security-misc +++ b/usr/share/pam-configs/pam-abort-on-locked-password-security-misc#security-misc-shared @@ -1,4 +1,4 @@ -Name: abort on locked password (by package security-misc) +Name: abort on locked password (by package security-misc-shared) Default: yes Priority: 300 Auth-Type: Primary diff --git a/usr/share/pam-configs/umask-security-misc#security-misc-shared b/usr/share/pam-configs/umask-security-misc#security-misc-shared new file mode 100644 index 00000000..3b34c25f --- /dev/null +++ b/usr/share/pam-configs/umask-security-misc#security-misc-shared @@ -0,0 +1,9 @@ +Name: Restrict umask to 027 for non-root users (by package security-misc-shared) +Default: yes +Priority: 100 +Session-Type: Additional +Session: + [success=1 default=ignore] pam_succeed_if.so uid eq 0 + optional pam_umask.so umask=027 + [success=1 default=ignore] pam_succeed_if.so uid ne 0 + optional pam_umask.so umask=022 diff --git a/usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared b/usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared new file mode 100644 index 00000000..0950f2ad --- /dev/null +++ b/usr/share/pam-configs/unix-faillock-security-misc#security-misc-shared @@ -0,0 +1,20 @@ +Name: Unix authentication with faillock (by package security-misc-shared) +Default: yes +Priority: 384 +Auth-Type: Primary +Auth: + [success=3 default=ignore] pam_unix.so nullok try_first_pass + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + [default=die] pam_faillock.so authfail + requisite pam_deny.so + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + optional pam_faillock.so authsucc + required pam_permit.so +Auth-Initial: + [success=3 default=ignore] pam_unix.so nullok + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + [default=die] pam_faillock.so authfail + requisite pam_deny.so + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_faillock_not_if_x + optional pam_faillock.so authsucc + required pam_permit.so diff --git a/usr/share/pam-configs/wheel-security-misc b/usr/share/pam-configs/wheel-security-misc#security-misc-shared similarity index 50% rename from usr/share/pam-configs/wheel-security-misc rename to usr/share/pam-configs/wheel-security-misc#security-misc-shared index 323ff72e..12d72100 100644 --- a/usr/share/pam-configs/wheel-security-misc +++ b/usr/share/pam-configs/wheel-security-misc#security-misc-shared @@ -1,6 +1,7 @@ -Name: group sudo membership required to use su (by package security-misc) +Name: group sudo membership required to use su (by package security-misc-shared) Default: yes -Priority: 280 +Priority: 1050 Auth-Type: Primary Auth: + [success=1 default=ignore] pam_exec.so seteuid quiet quiet_log /usr/libexec/security-misc/pam_only_if_su requisite pam_wheel.so group=sudo debug diff --git a/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared b/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared new file mode 100644 index 00000000..176b14e1 --- /dev/null +++ b/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc#security-misc-shared @@ -0,0 +1,335 @@ + + + + + The Flatpak Project + https://github.com/flatpak/flatpak + package-x-generic + + + Install signed application + Authentication is required to install software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.app-update org.freedesktop.Flatpak.runtime-install org.freedesktop.Flatpak.runtime-update + + + + Install signed runtime + Authentication is required to install software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-update + + + + Update signed application + Authentication is required to update software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-install org.freedesktop.Flatpak.runtime-update + + + + Update signed runtime + Authentication is required to update software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update remote metadata + Authentication is required to update remote info + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update system repository + Authentication is required to modify a system repository + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Install bundle + Authentication is required to install software from $(path) + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-install org.freedesktop.Flatpak.runtime-update + + + + Uninstall runtime + Authentication is required to uninstall software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Uninstall app + Authentication is required to uninstall $(ref) + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + org.freedesktop.Flatpak.runtime-uninstall + + + + Configure Remote + Authentication is required to configure software repositories + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Configure + Authentication is required to configure software installation + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update appstream + Authentication is required to update information about software + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Update metadata + Authentication is required to update metadata + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + + + Override parental controls for installs + Authentication is required to install software which is restricted by your parental controls policy + package-x-generic + + auth_admin + auth_admin + auth_admin + + org.freedesktop.Flatpak.override-parental-controls-update + + + + Override parental controls for updates + Authentication is required to update software which is restricted by your parental controls policy + package-x-generic + + auth_admin + auth_admin + auth_admin_keep + + + diff --git a/usr/share/security-misc/dolphinrc b/usr/share/security-misc/dolphinrc#security-misc-shared similarity index 50% rename from usr/share/security-misc/dolphinrc rename to usr/share/security-misc/dolphinrc#security-misc-shared index 00e7768a..9028487f 100644 --- a/usr/share/security-misc/dolphinrc +++ b/usr/share/security-misc/dolphinrc#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions [PreviewSettings] diff --git a/usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared b/usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared new file mode 100644 index 00000000..8de5412f --- /dev/null +++ b/usr/share/security-misc/emerg-shutdown-initramfs.service#security-misc-shared @@ -0,0 +1,21 @@ +## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +## This file should not be installed on the host system, it is intended for +## inclusion in a dracut initramfs only. + +[Unit] +Description=Emergency shutdown when boot media is removed +Documentation=https://github.com/Kicksecure/security-misc +DefaultDependencies=no +Before=sysinit.target +Requires=systemd-udevd.service +After=systemd-udevd.service + +[Service] +Type=notify +ExecStart=/usr/libexec/security-misc/emerg-shutdown +NotifyAccess=main + +[Install] +WantedBy=sysinit.target diff --git a/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf b/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared similarity index 90% rename from usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf rename to usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared index e1485b61..87de7e08 100644 --- a/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf +++ b/usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf#security-misc-shared @@ -1,4 +1,4 @@ -## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC ## See the file COPYING for copying conditions. ## LKRG VirtualBox host configuration @@ -13,7 +13,7 @@ ## /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf ## to: ## /etc/sysctl.d/30-lkrg-virtualbox.conf -## by package security-misc, files: +## by package security-misc-shared, files: ## /usr/share/security-misc/lkrg/lkrg-virtualbox ## /usr/lib/systemd/system/lkrg.service.d/40-virtualbox.conf diff --git a/usr/share/security-misc/lkrg/lkrg-virtualbox b/usr/share/security-misc/lkrg/lkrg-virtualbox deleted file mode 100755 index 3b4a0614..00000000 --- a/usr/share/security-misc/lkrg/lkrg-virtualbox +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2021 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -#set -x -set -e - -if ! command -v vboxmanage &>/dev/null ; then - if test -f /etc/sysctl.d/30-lkrg-virtualbox.conf ; then - rm --force --verbose /etc/sysctl.d/30-lkrg-virtualbox.conf - fi - exit 0 -fi - -if ! test -d /etc/sysctl.d ; then - exit 0 -fi - -if ! test -f /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf ; then - exit 0 -fi - -cp --verbose /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf /etc/sysctl.d/30-lkrg-virtualbox.conf diff --git a/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared new file mode 100755 index 00000000..a64cb9fe --- /dev/null +++ b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared @@ -0,0 +1,42 @@ +#!/bin/bash + +## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC +## See the file COPYING for copying conditions. + +#set -x +set -o errexit +set -o nounset +set -o pipefail +set -o errtrace +shopt -s inherit_errexit +shopt -s shift_verbose +export LC_ALL=C + +## security-misc-shared Depends on helper-scripts. +# shellcheck source=../../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh + +## Check if the VirtualBox host software is installed. +if ! has vboxmanage ; then + ## VirtualBox host software is not installed. + if test -f /etc/sysctl.d/30-lkrg-virtualbox.conf ; then + ## Delete using '--verbose' so user is notified. + safe-rm --force --verbose -- /etc/sysctl.d/30-lkrg-virtualbox.conf + fi + exit 0 +fi + +if ! test -d /etc/sysctl.d ; then + exit 0 +fi + +if ! test -f /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf ; then + exit 0 +fi + +if ! package-installed-check "lkrg" ; then + exit 0 +fi + +## Delete using '--verbose' so user is notified. +cp --verbose -- /usr/share/security-misc/lkrg/30-lkrg-virtualbox.conf /etc/sysctl.d/30-lkrg-virtualbox.conf diff --git a/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared b/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared new file mode 100644 index 00000000..d40c552c --- /dev/null +++ b/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded#security-misc-shared @@ -0,0 +1,36 @@ +root root 644 /etc/passwd- +root root 755 /etc/cron.monthly +root root 755 /etc/sudoers.d +root shadow 2755 /usr/bin/expiry +root root 4755 /usr/bin/umount +root root 4755 /usr/bin/gpasswd +root root 755 /usr/lib/modules +root root 644 /etc/issue.net +root root 644 /etc/group- +root root 4755 /usr/bin/newgrp +root root 755 /etc/cron.weekly +root root 644 /etc/hosts.deny +root root 4755 /usr/bin/su +root root 644 /etc/hosts.allow +root root 700 /root +root root 755 /etc/cron.daily +root root 755 /bin/ping +root root 777 /etc/motd.kicksecure +root root 777 /etc/motd.whonix +root root 755 /boot +root root 755 /home +root shadow 2755 /usr/bin/chage +root root 4755 /usr/bin/chsh +root root 4755 /usr/bin/passwd +root root 4755 /usr/bin/chfn +root root 644 /etc/group +root root 755 /etc/permission-hardener.d +root root 644 /etc/passwd +root root 755 /usr/src +root root 4755 /usr/bin/mount +root root 777 /etc/issue.kicksecure +root root 777 /etc/issue.whonix +root root 755 /etc/cron.d +root root 4755 /usr/bin/sudo +root root 4755 /usr/bin/pkexec +root root 4755 /usr/lib/polkit-1/polkit-agent-helper-1 diff --git a/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared b/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared new file mode 100644 index 00000000..d1b3a806 --- /dev/null +++ b/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded#security-misc-shared @@ -0,0 +1,26 @@ +root root 700 /etc/cron.monthly +root root 700 /etc/sudoers.d +root shadow 744 /usr/bin/expiry +root root 755 /usr/bin/umount +root root 744 /usr/bin/gpasswd +root root 700 /usr/lib/modules +root root 744 /usr/bin/newgrp +root root 700 /etc/cron.weekly +root root 744 /usr/bin/su +root root 700 /etc/cron.daily +root root 755 /bin/ping +root root 644 /etc/motd.kicksecure +root root 644 /etc/motd.whonix +root _ssh 744 /usr/bin/ssh-agent +root root 700 /boot +root shadow 744 /usr/bin/chage +root root 744 /usr/lib/openssh/ssh-keysign +root root 744 /usr/bin/chsh +root root 755 /usr/bin/passwd +root root 744 /usr/bin/chfn +root root 600 /etc/permission-hardener.d +root root 700 /usr/src +root root 755 /usr/bin/mount +root root 644 /etc/issue.kicksecure +root root 644 /etc/issue.whonix +root root 700 /etc/cron.d diff --git a/usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared b/usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared new file mode 100644 index 00000000..12439b3e --- /dev/null +++ b/usr/share/security-misc/security-misc-memlockd.cfg#security-misc-shared @@ -0,0 +1,2 @@ +# Lock systemd and all of its library dependencies into memory ++/usr/lib/systemd/systemd diff --git a/usr/src/security-misc/emerg-shutdown.c#security-misc-shared b/usr/src/security-misc/emerg-shutdown.c#security-misc-shared new file mode 100644 index 00000000..95cd3371 --- /dev/null +++ b/usr/src/security-misc/emerg-shutdown.c#security-misc-shared @@ -0,0 +1,1110 @@ +/* + * Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC + * See the file COPYING for copying conditions. + */ + +/* + * This program is designed specifically to immediately and forcibly power off + * the system in the event the device providing the root filesystem is + * abruptly removed from the system. The idea is that a user can shut down + * a portable installation of Kicksecure by simply yanking the USB drive + * containing the installation from the computer. Tails provides essentially + * the same feature, however it is known for occasionally failing to do its + * job properly. + * + * The fact that we're triggering a shutdown when the device containing the + * root filesystem vanishes presents a number of significant challenges: + * + * - The device providing the entire operating system is gone. The only things + * we will still have left are the kernel, files loaded into RAM (for + * instance under /run), and anything that happens to still be in the + * system's disk cache. + * - Virtually any process on the system may abruptly crash at any time. This + * isn't just because applications may be unable to access files. The Linux + * kernel's virtual memory subsystem doesn't just page out RAM contents to a + * swap file, it will sometimes simply erase pages containing executable + * code from memory if it can reload that code from disk later when needed. + * If part of a program isn't present in memory, and then the root device + * vanishes, any attempt to use code in the absent part of the application + * will result in the application crashing. (Attempts to access data in RAM + * that happened to be paged out will result in a similar crash.) + * - We have no control over what is and isn't in the disk cache, which makes + * it unsafe to launch any dynamically linked executable. What happens if we + * need to load a missing part of libc? What if the dynamic linker itself + * needs loaded from disk? + * - Systemd could lock up at any time, since the init process isn't immune to + * having bits of it erased from RAM to free up memory. If systemd receives + * a SIGSEGV, rather than crashing (which would panic the kernel), it goes + * into an "emergency mode" that tries to keep the system as operational as + * possible even though PID 1 is now out of service. + * + * Circumventing this set of difficulties is not easy, and it might not even + * be entirely possible. To give our feature the highest chance of success: + * + * - We use memlockd to lock systemd and all libraries it depends on into + * memory. It can hold its own pretty well in the event of a segfault, but + * if its crash handler ends up re-segfaulting, that could get ugly. + * - We compile the utility at boot time, statically link it against all of + * its dependencies (really only one, glibc), and load it into /run. This + * allows for decent architecture independence while removing any dependency + * on anything that isn't in RAM, thus (hopefully!) making the process + * crash-immune. + * - Because we're static-linking against glibc, we cannot call anything + * defined in stdio.h. This is because glibc uses dlopen() to load iconv + * modules, which are used internally by glibc for locale support. Things + * defined in stdio.h may use iconv, so calling anything there will + * basically make our static-linked executable become dynamically linked, + * which could segfault it since the root filesystem is gone. We can't call + * anything that could touch Name Service Switch (NSS) either, but we have + * no need to do so, so we should be safe there. See + * https://stackoverflow.com/questions/57476533/why-is-statically-linking-glibc-discouraged + * - We can't use udev either because libudev is only available as a dynamic + * library. That means we have to listen to kernel uevents directly to + * determine when the root device vanishes. Thankfully this isn't as much of + * a pain as it might sound like. + * - We don't call out to any external process, since those external processes + * could segfault. + * + * This is likely superior to Tails' implementation, which uses udev (and thus + * dynamic linking), uses an interpreter-driven script to shut down the system + * when the root device vanishes, and calls out to external executables to + * actually shut the system down. These issues are likely why Tails' + * implementation of emergency shutdown occasionally fails. See + * https://www.reddit.com/r/tails/comments/xh8njn/tails_wont_shutdown_when_i_pull_usb_stick/ + * (there are other similar posts as well). + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +//#define fd_stdin 0 +//#define fd_stdout 1 +#define fd_stderr 2 + +#define max_inputs 255 +#define input_path_size 20 +#define key_flags_len 12 + +#define hw_monitor_val 1 +#define fifo_monitor_val 2 + +#define max_sig_num 31 + +int console_fd = -1; + +/* Adapted from kloak/src/keycodes.c */ +struct name_value { + const char *name; + const uint32_t value; +}; +static struct name_value key_table[] = { + {"KEY_ESC", KEY_ESC}, + {"KEY_1", KEY_1}, + {"KEY_2", KEY_2}, + {"KEY_3", KEY_3}, + {"KEY_4", KEY_4}, + {"KEY_5", KEY_5}, + {"KEY_6", KEY_6}, + {"KEY_7", KEY_7}, + {"KEY_8", KEY_8}, + {"KEY_9", KEY_9}, + {"KEY_0", KEY_0}, + {"KEY_MINUS", KEY_MINUS}, + {"KEY_EQUAL", KEY_EQUAL}, + {"KEY_BACKSPACE", KEY_BACKSPACE}, + {"KEY_TAB", KEY_TAB}, + {"KEY_Q", KEY_Q}, + {"KEY_W", KEY_W}, + {"KEY_E", KEY_E}, + {"KEY_R", KEY_R}, + {"KEY_T", KEY_T}, + {"KEY_Y", KEY_Y}, + {"KEY_U", KEY_U}, + {"KEY_I", KEY_I}, + {"KEY_O", KEY_O}, + {"KEY_P", KEY_P}, + {"KEY_LEFTBRACE", KEY_LEFTBRACE}, + {"KEY_RIGHTBRACE", KEY_RIGHTBRACE}, + {"KEY_ENTER", KEY_ENTER}, + {"KEY_LEFTCTRL", KEY_LEFTCTRL}, + {"KEY_A", KEY_A}, + {"KEY_S", KEY_S}, + {"KEY_D", KEY_D}, + {"KEY_F", KEY_F}, + {"KEY_G", KEY_G}, + {"KEY_H", KEY_H}, + {"KEY_J", KEY_J}, + {"KEY_K", KEY_K}, + {"KEY_L", KEY_L}, + {"KEY_SEMICOLON", KEY_SEMICOLON}, + {"KEY_APOSTROPHE", KEY_APOSTROPHE}, + {"KEY_GRAVE", KEY_GRAVE}, + {"KEY_LEFTSHIFT", KEY_LEFTSHIFT}, + {"KEY_BACKSLASH", KEY_BACKSLASH}, + {"KEY_Z", KEY_Z}, + {"KEY_X", KEY_X}, + {"KEY_C", KEY_C}, + {"KEY_V", KEY_V}, + {"KEY_B", KEY_B}, + {"KEY_N", KEY_N}, + {"KEY_M", KEY_M}, + {"KEY_COMMA", KEY_COMMA}, + {"KEY_DOT", KEY_DOT}, + {"KEY_SLASH", KEY_SLASH}, + {"KEY_RIGHTSHIFT", KEY_RIGHTSHIFT}, + {"KEY_KPASTERISK", KEY_KPASTERISK}, + {"KEY_LEFTALT", KEY_LEFTALT}, + {"KEY_SPACE", KEY_SPACE}, + {"KEY_CAPSLOCK", KEY_CAPSLOCK}, + {"KEY_F1", KEY_F1}, + {"KEY_F2", KEY_F2}, + {"KEY_F3", KEY_F3}, + {"KEY_F4", KEY_F4}, + {"KEY_F5", KEY_F5}, + {"KEY_F6", KEY_F6}, + {"KEY_F7", KEY_F7}, + {"KEY_F8", KEY_F8}, + {"KEY_F9", KEY_F9}, + {"KEY_F10", KEY_F10}, + {"KEY_NUMLOCK", KEY_NUMLOCK}, + {"KEY_SCROLLLOCK", KEY_SCROLLLOCK}, + {"KEY_KP7", KEY_KP7}, + {"KEY_KP8", KEY_KP8}, + {"KEY_KP9", KEY_KP9}, + {"KEY_KPMINUS", KEY_KPMINUS}, + {"KEY_KP4", KEY_KP4}, + {"KEY_KP5", KEY_KP5}, + {"KEY_KP6", KEY_KP6}, + {"KEY_KPPLUS", KEY_KPPLUS}, + {"KEY_KP1", KEY_KP1}, + {"KEY_KP2", KEY_KP2}, + {"KEY_KP3", KEY_KP3}, + {"KEY_KP0", KEY_KP0}, + {"KEY_KPDOT", KEY_KPDOT}, + {"KEY_ZENKAKUHANKAKU", KEY_ZENKAKUHANKAKU}, + {"KEY_102ND", KEY_102ND}, + {"KEY_F11", KEY_F11}, + {"KEY_F12", KEY_F12}, + {"KEY_RO", KEY_RO}, + {"KEY_KATAKANA", KEY_KATAKANA}, + {"KEY_HIRAGANA", KEY_HIRAGANA}, + {"KEY_HENKAN", KEY_HENKAN}, + {"KEY_KATAKANAHIRAGANA", KEY_KATAKANAHIRAGANA}, + {"KEY_MUHENKAN", KEY_MUHENKAN}, + {"KEY_KPJPCOMMA", KEY_KPJPCOMMA}, + {"KEY_KPENTER", KEY_KPENTER}, + {"KEY_RIGHTCTRL", KEY_RIGHTCTRL}, + {"KEY_KPSLASH", KEY_KPSLASH}, + {"KEY_SYSRQ", KEY_SYSRQ}, + {"KEY_RIGHTALT", KEY_RIGHTALT}, + {"KEY_LINEFEED", KEY_LINEFEED}, + {"KEY_HOME", KEY_HOME}, + {"KEY_UP", KEY_UP}, + {"KEY_PAGEUP", KEY_PAGEUP}, + {"KEY_LEFT", KEY_LEFT}, + {"KEY_RIGHT", KEY_RIGHT}, + {"KEY_END", KEY_END}, + {"KEY_DOWN", KEY_DOWN}, + {"KEY_PAGEDOWN", KEY_PAGEDOWN}, + {"KEY_INSERT", KEY_INSERT}, + {"KEY_DELETE", KEY_DELETE}, + {"KEY_MACRO", KEY_MACRO}, + {"KEY_MUTE", KEY_MUTE}, + {"KEY_VOLUMEDOWN", KEY_VOLUMEDOWN}, + {"KEY_VOLUMEUP", KEY_VOLUMEUP}, + {"KEY_POWER", KEY_POWER}, + {"KEY_POWER2", KEY_POWER2}, + {"KEY_KPEQUAL", KEY_KPEQUAL}, + {"KEY_KPPLUSMINUS", KEY_KPPLUSMINUS}, + {"KEY_PAUSE", KEY_PAUSE}, + {"KEY_SCALE", KEY_SCALE}, + {"KEY_KPCOMMA", KEY_KPCOMMA}, + {"KEY_HANGEUL", KEY_HANGEUL}, + {"KEY_HANGUEL", KEY_HANGUEL}, + {"KEY_HANJA", KEY_HANJA}, + {"KEY_YEN", KEY_YEN}, + {"KEY_LEFTMETA", KEY_LEFTMETA}, + {"KEY_RIGHTMETA", KEY_RIGHTMETA}, + {"KEY_COMPOSE", KEY_COMPOSE}, + {"KEY_F13", KEY_F13}, + {"KEY_F14", KEY_F14}, + {"KEY_F15", KEY_F15}, + {"KEY_F16", KEY_F16}, + {"KEY_F17", KEY_F17}, + {"KEY_F18", KEY_F18}, + {"KEY_F19", KEY_F19}, + {"KEY_F20", KEY_F20}, + {"KEY_F21", KEY_F21}, + {"KEY_F22", KEY_F22}, + {"KEY_F23", KEY_F23}, + {"KEY_F24", KEY_F24}, + {"KEY_UNKNOWN", KEY_UNKNOWN}, + {NULL, 0} +}; +uint32_t lookup_keycode(const char *name) { + struct name_value *p; + for (p = key_table; p->name != NULL; ++p) { + if (strcmp(p->name, name) == 0) { + return p->value; + } + } + return 0; +} + +/* Adapted from systemd/src/login/logind-button.c */ +bool bitset_get(const uint64_t *bits, uint32_t i) { + return (bits[i / 64] >> (i % 64)) & 1UL; +} + +void print(int fd, const char *str) { + size_t len = strlen(str); + while (len > 0) { + ssize_t write_len = write(fd, str, len); + if (write_len < 0) { + /* File descriptor was closed, continue regardless */ + return; + } + len -= (size_t)write_len; + str += write_len; + } +} + +void print_usage(void) { + print(fd_stderr, "Usage:\n"); + print(fd_stderr, " emerg-shutdown [OPTIONS...]\n"); + print(fd_stderr, "Options:\n"); + print(fd_stderr, " --devices=DEVICE1[,DEVICE2...]\n"); + print(fd_stderr, " A comma-separated list of devices. If any of these devices are\n"); + print(fd_stderr, " removed from the system, an emergency shutdown will occur.\n"); + print(fd_stderr, " --keys=KEY_1[,KEY_2|KEY_3...]\n"); + print(fd_stderr, " A comma-separated list of keys. If all of the specified keys are\n"); + print(fd_stderr, " pressed at the same time, an emergency shutdown will occur.\n"); + print(fd_stderr, " Keys separated with a pipe will be treated as aliases of each\n"); + print(fd_stderr, " other.\n"); + print(fd_stderr, " --paranoid\n"); + print(fd_stderr, " Watches for the removal of any removable device whatsoever. An\n"); + print(fd_stderr, " emergency shutdown will be triggered if any device is removed.\n"); + print(fd_stderr, " Cannot be combined with --devices.\n"); + print(fd_stderr, " --instant-shutdown\n"); + print(fd_stderr, " Immediately triggers an emergency shutdown. Cannot be combined\n"); + print(fd_stderr, " with other options.\n"); + print(fd_stderr, " --monitor-fifo\n"); + print(fd_stderr, " Used internally to implement the ensure-shutdown service. Do\n"); + print(fd_stderr, " not use.\n"); + print(fd_stderr, " --timeout=TIMEOUT\n"); + print(fd_stderr, " Used internally to implement the ensure-shutdown service. Do\n"); + print(fd_stderr, " not use.\n"); + print(fd_stderr, "Example:\n"); + print(fd_stderr, " emerg-shutdown --devices=/dev/sda3 --keys=KEY_POWER\n"); + print(fd_stderr, "See /etc/security-misc/emerg-shutdown/30_security-misc.conf to\n"); + print(fd_stderr, "configure the emerg-shutdown service.\n"); +} + +void *safe_calloc(size_t nmemb, size_t size) { + void *ret_buf = calloc(nmemb, size); + if (ret_buf == NULL) { + print(fd_stderr, "Out of memory!\n"); + exit(1); + } + return ret_buf; +} + +void *safe_reallocarray(void *ptr, size_t nmemb, size_t size) { + void *ret_buf = reallocarray(ptr, nmemb, size); + if (ret_buf == NULL) { + print(fd_stderr, "Out of memory!\n"); + exit(1); + } + return ret_buf; +} + +/* Inspired by https://www.strudel.org.uk/itoa/ */ +char *int_to_str(uint32_t val) { + static char buf[11]; + int8_t i; + char *rslt = NULL; + const char *digits = "0123456789"; + + buf[10] = '\0'; + + for (i = 9; i >= 0; i--) { + buf[i] = digits[val % 10]; + val /= 10; + if (val == 0) { + break; + } + } + assert(i >= 0); + + rslt = safe_calloc(1, 11 - (uint8_t)(i)); + memcpy(rslt, buf + i, 11 - (uint8_t)(i)); + return rslt; +} + +void load_list(const char *arg, size_t *result_list_len_ref, char ***result_list_ref, const char *sep, bool parse_opt) { + char **result_list = NULL; + size_t result_list_len = 0; + size_t arg_copy_len = strlen(arg) + 1; + char *arg_copy = safe_calloc(1, arg_copy_len); + char *arg_val; + char *arg_part; + + memcpy(arg_copy, arg, arg_copy_len); + if (parse_opt) { + /* returns "--whatever" */ + arg_val = strtok(arg_copy, "="); + /* returns everything after the = sign */ + arg_val = strtok(NULL, ""); + } else { + arg_val = arg_copy; + } + + arg_part = strtok(arg_val, sep); + if (arg_part == NULL) { + free(arg_copy); + return; + } + + do { + result_list_len++; + result_list = safe_reallocarray(result_list, result_list_len, sizeof(char *)); + result_list[result_list_len - 1] = safe_calloc(1, strlen(arg_part) + 1); + strcpy(result_list[result_list_len - 1], arg_part); + } while ((arg_part = strtok(NULL, sep)) != NULL); + + *result_list_len_ref = result_list_len; + *result_list_ref = result_list; + free(arg_copy); +} + +void kill_system(void) { + /* + * It isn't safe to simply call the reboot syscall here - there is a + * graphics driver bug in the i915 driver on Bookworm that will throw a + * kernel warning during shutdown. Kicksecure sets panic_on_oops and + * panic_on_warn to 1 during bootup, which means this bug will cause a + * kernel panic and thus hang the system rather than shutting down. + * + * To mitigate this, we do two things: + * + * - We disable the panic_on_oops and panic_on_warn kernel settings before + * calling the reboot syscall. This way if a warn or oops does occur, at + * least it isn't as likely to block shutdown. + * - We switch virtual terminals before initiating the shutdown. This should + * hopefully keep whatever is going wrong from going wrong in the first + * place. + * + * This is probably a good idea for any system, because switching TTYs is a + * rather basic operation that is likely to work, while forcibly shutting + * down while X11 or Wayland still has control of the display is probably + * not as well tested (if it's been tested at all). + * + * Above all else though, we want to at least *try* to shutdown. Even if all + * our attempts to switch VTs fail and /proc isn't available for us to tweak + * kernel settings, we still need to try. Therefore we absolutely do not + * crash or block, except when waiting for a VT to become activated. (If VT + * activation blocks forever, the kernel is probably horribly broken and + * would probably panic imminently anyway.) + */ + + const char *panic_on_oops_path = "/proc/sys/kernel/panic_on_oops"; + const char *panic_on_warn_path = "/proc/sys/kernel/panic_on_warn"; + + int ret = 0; + int tgt_vt = 0; + int sysctl_fd = 0; + + /* Turn off panic_on_oops. */ + sysctl_fd = open(panic_on_oops_path, O_WRONLY); + if (sysctl_fd != -1) { + /* We intentionally ignore the return from `write` here. */ +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wunused-result" + write(sysctl_fd, "0", 1); +#pragma GCC diagnostic pop + close(sysctl_fd); + } + + /* Turn off panic_on_warn. */ + sysctl_fd = open(panic_on_warn_path, O_WRONLY); + if (sysctl_fd != -1) { + /* We intentionally ignore the return from `write` here. */ +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wunused-result" + write(sysctl_fd, "0", 1); +#pragma GCC diagnostic pop + close(sysctl_fd); + } + + /* Determine which VT to switch to. Anything that isn't open yet will do. */ + ret = ioctl(console_fd, VT_OPENQRY, &tgt_vt); + if (ret == -1) { + goto trykill; + } + + /* Try to switch to it. */ + ret = ioctl(console_fd, VT_ACTIVATE, tgt_vt); + if (ret == -1) { + goto trykill; + } + + /* Wait for it to become active. */ + ioctl(console_fd, VT_WAITACTIVE, tgt_vt); + +trykill: + syscall(SYS_reboot, LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, + LINUX_REBOOT_CMD_POWER_OFF, NULL); + /* + * This syscall can return, and if we exit after it returns but before the + * system shuts down, the system may not shut down. Wait for shutdown to + * occur. + */ + sleep(60); + exit(0); +} + +/* Ignore all signals, except SIGSEGV and (optionally) SIGTERM. */ +void ignore_signals(bool also_sigterm) { + struct sigaction sigact_swallow = { 0 }; + int sig_idx = 0; + + /* Swallow all signals that we can. */ + sigact_swallow.sa_handler = SIG_IGN; + for (sig_idx = 1; sig_idx <= max_sig_num; sig_idx++) { + if (sig_idx == SIGSTOP) { + continue; + } + if (sig_idx == SIGKILL) { + continue; + } + if (sig_idx == SIGSEGV) { + continue; + } + if (sig_idx == SIGTERM && !also_sigterm) { + continue; + } + if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) { + print(fd_stderr, "Failed to set up signal ignores!\n"); + exit(1); + } + } + for (sig_idx = SIGRTMIN; sig_idx <= SIGRTMAX; sig_idx++) { + if (sigaction(sig_idx, &sigact_swallow, NULL) == -1) { + print(fd_stderr, "Failed to set up real-time signal ignores!\n"); + exit(1); + } + } +} + +/* Monitor for device removal and emergency shutdown key combos. */ +void hw_monitor(int argc, char **argv) { + /* Working variables */ + size_t target_dev_list_len = 0; + char **target_dev_name_raw_list = NULL; + size_t panic_key_list_len = 0; + char **panic_key_str_list = NULL; + char **target_dev_list = NULL; + uint32_t **panic_key_list = NULL; + bool *panic_key_active_list = NULL; + size_t event_fd_list_len = 0; + int *event_fd_list = NULL; + char input_path_buf[input_path_size]; + struct pollfd *pollfd_list = NULL; + struct input_event ie_buf[64]; + bool paranoid_mode = false; + + /* Index variables */ + int arg_idx = 0; + size_t tdl_idx = 0; + size_t tdp_char_idx = 0; + size_t pkl_idx = 0; + uint32_t input_idx = 0; + size_t efl_idx = 0; + int ie_idx = 0; + size_t kg_idx = 0; + + /* Socket management */ + struct sockaddr_nl sa = { 0 }; + int ns = 0; + int ret = 0; + + for (arg_idx = 1; arg_idx < argc; arg_idx++) { + if (strncmp(argv[arg_idx], "--devices=", strlen("--devices=")) == 0) { + if (target_dev_name_raw_list != NULL) { + print(fd_stderr, "--devices cannot be passed more than once!\n"); + print_usage(); + exit(1); + } + load_list(argv[arg_idx], &target_dev_list_len, &target_dev_name_raw_list, ",", true); + } else if (strcmp(argv[arg_idx], "--paranoid") == 0) { + paranoid_mode = true; + } else if (strncmp(argv[arg_idx], "--keys=", strlen("--keys=")) == 0) { + if (panic_key_str_list != NULL) { + print(fd_stderr, "--keys cannot be passed more than once!\n"); + print_usage(); + exit(1); + } + load_list(argv[arg_idx], &panic_key_list_len, &panic_key_str_list, ",", true); + } else { + print(fd_stderr, "Unrecognized argument '"); + print(fd_stderr, argv[arg_idx]); + print(fd_stderr, "' passed!\n"); + print_usage(); + exit(1); + } + } + if (target_dev_name_raw_list != NULL && paranoid_mode) { + print(fd_stderr, "--devices and --paranoid are mutually exclusive!\n"); + print_usage(); + exit(1); + } + + ignore_signals(false); /* ignore all but SIGTERM */ + + console_fd = open("/dev/console", O_RDWR); + if (console_fd == -1) { + print(fd_stderr, "Could not open /dev/console!\n"); + exit(1); + } + + target_dev_list = safe_calloc(target_dev_list_len, sizeof(char *)); + panic_key_list = safe_calloc(panic_key_list_len, sizeof(uint32_t *)); + panic_key_active_list = safe_calloc(panic_key_list_len, sizeof(bool)); + + for (tdl_idx = 0; tdl_idx < target_dev_list_len; tdl_idx++) { + char *target_dev_path = target_dev_name_raw_list[tdl_idx]; + size_t device_path_slash_count = 0; + char *target_dev_parse = safe_calloc(1, strlen(target_dev_path) + 1); + char *target_dev_name = NULL; + + if (access(target_dev_path, F_OK) != 0) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' does not exist!\n"); + print_usage(); + exit(1); + } + + if (strncmp(target_dev_path, "/dev/sr", strlen("/dev/sr")) != 0 + && strncmp(target_dev_path, "/dev/nvme", strlen("/dev/nvme")) != 0 + && strncmp(target_dev_path, "/dev/sd", strlen("/dev/sd")) != 0 + && strncmp(target_dev_path, "/dev/mmc", strlen("/dev/mmc")) != 0 + && strncmp(target_dev_path, "/dev/vd", strlen("/dev/vd")) != 0 + && strncmp(target_dev_path, "/dev/xvd", strlen("/dev/xvd")) != 0 + && strncmp(target_dev_path, "/dev/hd", strlen("/dev/hd")) != 0) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' is not supported!\n"); + print_usage(); + exit(1); + } + + for (tdp_char_idx = 0; tdp_char_idx < strlen(target_dev_path); tdp_char_idx++) { + if (target_dev_path[tdp_char_idx] == '/') { + device_path_slash_count++; + } + } + if (device_path_slash_count != 2) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' is not supported!\n"); + print_usage(); + exit(1); + } + + memcpy(target_dev_parse, target_dev_path, strlen(target_dev_path) + 1); + + /* returns "dev" */ + target_dev_name = strtok(target_dev_parse, "/"); + /* returns the actual device name we want */ + target_dev_name = strtok(NULL, "/"); + if (target_dev_name == NULL) { + print(fd_stderr, "The device '"); + print(fd_stderr, target_dev_path); + print(fd_stderr, "' is not supported!\n"); + print_usage(); + exit(1); + } + + target_dev_list[tdl_idx] = calloc(1, strlen(target_dev_name) + 1); + memcpy(target_dev_list[tdl_idx], target_dev_name, strlen(target_dev_name) + 1); + free(target_dev_parse); + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + size_t keygroup_str_list_len = 0; + char **keygroup_str_list = NULL; + uint32_t *pkl_element = NULL; + + load_list(panic_key_str_list[pkl_idx], &keygroup_str_list_len, &keygroup_str_list, "|", false); + pkl_element = safe_calloc(keygroup_str_list_len + 1, sizeof(uint32_t)); + + pkl_element[keygroup_str_list_len] = 0; + for (kg_idx = 0; kg_idx < keygroup_str_list_len; kg_idx++) { + uint32_t keycode = lookup_keycode(keygroup_str_list[kg_idx]); + if (keycode == 0) { + print(fd_stderr, "Invalid key code '"); + print(fd_stderr, keygroup_str_list[kg_idx]); + print(fd_stderr, "'!\n"); + print_usage(); + exit(1); + } + pkl_element[kg_idx] = keycode; + free(keygroup_str_list[kg_idx]); + } + + free(keygroup_str_list); + panic_key_list[pkl_idx] = pkl_element; + } + + /* Device event listener setup */ + sa.nl_family = AF_NETLINK; + sa.nl_pad = 0; + sa.nl_pid = (uint32_t)getpid(); + sa.nl_groups = NETLINK_KOBJECT_UEVENT; + ns = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_KOBJECT_UEVENT); + if (ns < 0) { + print(fd_stderr, "Failed to create netlink socket!\n"); + exit(1); + } + ret = bind(ns, (struct sockaddr *) &sa, sizeof(sa)); + if (ret < 0) { + print(fd_stderr, "Failed to bind netlink socket!\n"); + exit(1); + } + + /* Keyboard event listener setup + * Heavily inspired by systemd/src/login/logind-button.c and + * kloak/src/main.c */ + for (input_idx = 0; input_idx <= max_inputs; input_idx++) { + int tmp_fd = 0; + uint64_t key_flags[key_flags_len]; + bool supports_panic = true; + char *loop_str = NULL; + + strcpy(input_path_buf, "/dev/input/event"); + loop_str = int_to_str(input_idx); + strcat(input_path_buf, loop_str); + free(loop_str); + + tmp_fd = open(input_path_buf, O_RDONLY | O_CLOEXEC | O_NOCTTY | O_NONBLOCK); + if (tmp_fd < 0) { + continue; + } + + if (ioctl(tmp_fd, EVIOCGBIT(EV_SYN, sizeof(key_flags)), key_flags) < 0) { + print(fd_stderr, "Failed to query properties of input device '"); + print(fd_stderr, input_path_buf); + print(fd_stderr, "'!\n"); + exit(1); + } + + if (!bitset_get(key_flags, EV_KEY)) { + close(tmp_fd); + continue; + } + + if (ioctl(tmp_fd, EVIOCGBIT(EV_KEY, sizeof(key_flags)), key_flags) < 0) { + print(fd_stderr, "Failed to query keys available on input device '"); + print(fd_stderr, input_path_buf); + print(fd_stderr, "'!\n"); + exit(1); + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + bool group_supported = false; + for (kg_idx = 0; panic_key_list[pkl_idx][kg_idx] != 0; kg_idx++) { + if (bitset_get(key_flags, panic_key_list[pkl_idx][kg_idx])) { + group_supported = true; + break; + } + } + if (!group_supported) { + supports_panic = false; + break; + } + } + if (!supports_panic) { + close(tmp_fd); + continue; + } + + event_fd_list_len++; + event_fd_list = safe_reallocarray(event_fd_list, event_fd_list_len, sizeof(int)); + event_fd_list[event_fd_list_len - 1] = tmp_fd; + } + + if (event_fd_list_len == 0) { + print(fd_stderr, "Failed to find any input device supporting panic keys!\n"); + exit(1); + } + + /* Poll setup */ + pollfd_list = safe_calloc(event_fd_list_len + 1, sizeof(struct pollfd)); + for (efl_idx = 0; efl_idx < event_fd_list_len; efl_idx++) { + pollfd_list[efl_idx].fd = event_fd_list[efl_idx]; + pollfd_list[efl_idx].events = POLLIN; + } + pollfd_list[event_fd_list_len].fd = ns; + pollfd_list[event_fd_list_len].events = POLLIN; + + /* Event loop */ + while (poll(pollfd_list, event_fd_list_len + 1, -1) != -1) { + size_t ie_max_idx = 0; + + /* Panic key handler */ + for (efl_idx = 0; efl_idx < event_fd_list_len; efl_idx++) { + ssize_t ieread_bytes = 0; + if (!(pollfd_list[efl_idx].revents & POLLIN)) { + continue; + } + + ieread_bytes = read(event_fd_list[efl_idx], ie_buf, + sizeof(struct input_event) * 64); + + if (ieread_bytes <= 0 + || ((size_t)ieread_bytes % sizeof(struct input_event)) != 0) { + /* This will probably terminate the service if the user unplugs a + * keyboard or similar, however systemd can start it again. The + * alternative is to handle device hotplug, which sounds like a + * recipe for bugs. */ + print(fd_stderr, "Error reading from input device!\n"); + exit(1); + } + + ie_max_idx = (size_t)ieread_bytes / sizeof(struct input_event); + assert(ie_max_idx < INT_MAX); + for (ie_idx = 0; ie_idx < (int)(ie_max_idx); ie_idx++) { + if (ie_buf[ie_idx].type != EV_KEY) { + continue; + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + for (kg_idx = 0; panic_key_list[pkl_idx][kg_idx] != 0; kg_idx++) { + if (ie_buf[ie_idx].code == panic_key_list[pkl_idx][kg_idx]) { + if (ie_buf[ie_idx].value == 0) { + panic_key_active_list[pkl_idx] = false; + } else { + panic_key_active_list[pkl_idx] = true; + } + break; /* only breaks inner loop */ + } + } + } + + for (pkl_idx = 0; pkl_idx < panic_key_list_len; pkl_idx++) { + if (!panic_key_active_list[pkl_idx]) { + break; + } + if (pkl_idx == (panic_key_list_len - 1)) { + kill_system(); + } + } + } + } + + /* Netlink socket handler */ + if (pollfd_list[event_fd_list_len].revents & POLLIN) { + /* + * So, you looked at `man 7 netlink`, then looked at this code, and can't + * figure out how on earth any of this makes sense? Well guess what, turns + * out NETLINK_KOBJECT_UEVENT messages break all of the rules about how + * netlink messages work specified in that manpage. What you actually + * get... well, depends. + * + * - The messages we actually want are just NUL-separated string lists. + * These are the actual kernel uevents. + * - Mixed in with those will be uevents generated by systemd-udevd, which + * use a different format and are unsuitable for our purposes. We have + * to ignore those. Thankfully those messages start with the + * NUL-terminated string "libudev" so they're easy to filter out. + */ + + ssize_t len; + /* + * 32 kB buffer is recommended by + * https://www.kernel.org/doc/html/v6.12/userspace-api/netlink/intro.html + */ + char buf[32768]; + struct iovec iov = { buf, sizeof(buf) }; + struct sockaddr_nl sa2; + struct msghdr msg = { 0 }; + char *tmpbuf = NULL; + bool device_removed = false; + bool device_changed = false; + bool disk_media_changed = false; + + memset(buf, 0, 32768); + + msg.msg_name = &sa2; + msg.msg_namelen = sizeof(sa2); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = NULL; + msg.msg_controllen = 0; + msg.msg_flags = 0; + + len = recvmsg(ns, &msg, 0); + if (len == -1) { + kill_system(); + } + + if (len < 8) { + /* There aren't any super-short messages we're interested in, discard + * them */ + continue; + } + if (memcmp(buf, "libudev", 8) == 0) { + /* udevd message, ignore */ + continue; + } + + tmpbuf = buf; + /* + * Ensure buffer is NUL-terminated to prevent out-of-bounds reads on + * truncated netlink messages. + */ + buf[sizeof(buf) - 1] = '\0'; + while (len > 0) { + size_t entry_len = strlen(tmpbuf) + 1; + + if (strcmp(tmpbuf, "ACTION=remove") == 0) { + device_removed = true; + goto next_str; + } + if (strcmp(tmpbuf, "ACTION=change") == 0) { + device_changed = true; + goto next_str; + } + if (strcmp(tmpbuf, "DISK_MEDIA_CHANGE=1") == 0) { + disk_media_changed = true; + goto next_str; + } + + if (strncmp(tmpbuf, "DEVNAME=", strlen("DEVNAME=")) == 0) { + if (device_removed || device_changed) { + char *rem_devname_line = NULL; + char *rem_dev_name = NULL; + + /* + * Try to allocate the memory needed to check DEVNAME in a loop. We + * really do not want to simply abort here due to an out of memory + * condition, because that would result in the shutdown never + * occurring. We also don't want to force a shutdown when memory + * runs out, as that could result in the user losing work because + * they opened too many browser tabs. + */ + while(true) { + rem_devname_line = calloc(1, strlen(tmpbuf) + 1); + if (rem_devname_line == NULL) { + print(fd_stderr, "Out of memory while parsing devname, retrying in one second\n"); + sleep(1); + continue; + } else { + break; + } + } + + memcpy(rem_devname_line, tmpbuf, strlen(tmpbuf) + 1); + /* returns DEVNAME */ + rem_dev_name = strtok(rem_devname_line, "="); + /* returns the actual device name */ + rem_dev_name = strtok(NULL, "="); + if (rem_dev_name == NULL) { + free(rem_devname_line); + goto next_str; + } + + if (device_changed && strncmp(rem_dev_name, "sr", 2) != 0) { + free(rem_devname_line); + goto next_str; + } + + if (device_changed && !disk_media_changed) { + free(rem_devname_line); + goto next_str; + } + + if (paranoid_mode) { + /* Something was removed, we don't care what, shut down now */ + kill_system(); + } + + for (tdl_idx = 0; tdl_idx < target_dev_list_len; tdl_idx++) { + if (strcmp(rem_dev_name, target_dev_list[tdl_idx]) == 0) { + kill_system(); + } + } + + free(rem_devname_line); + } + } + +next_str: + len -= (ssize_t)entry_len; + tmpbuf += entry_len; + } + } + } + + print(fd_stderr, "Hardware monitor poll gave up!\n"); + exit(1); +} + +/* + * Monitor for a kill command on a fifo. Two commands are recognized: + * + * - 'k': Instantly kill the system. + * - 'd': Wait 15 seconds, then kill the system. This is used to keep systemd + * from delaying shutdown excessively. + */ +void fifo_monitor(char **argv) { + long monitor_fifo_timeout = 0; + char *arg_copy = NULL; + char *arg_part = NULL; + char *arg_num_end = NULL; + const char *trigger_fifo_path = "/run/emerg-shutdown-trigger"; + int trigger_fifo_fd = 0; + struct pollfd trigger_fifo_poll = { 0 }; + char trigger_fifo_charbuf = '\0'; + ssize_t trigger_fifo_readlen = 0; + + if (strncmp(argv[2], "--timeout=", strlen("--timeout=")) != 0) { + print(fd_stderr, "Timeout not passed for --monitor-fifo!\n"); + print_usage(); + exit(1); + } + + arg_copy = safe_calloc(1, strlen(argv[2]) + 1); + memcpy(arg_copy, argv[2], strlen(argv[2]) + 1); + /* returns "--timeout" */ + arg_part = strtok(arg_copy, "="); + /* returns everything after the = sign */ + arg_part = strtok(NULL, ""); + if (arg_part == NULL) { + print(fd_stderr, "Timeout value is missing!\n"); + print_usage(); + exit(1); + } + errno = 0; + monitor_fifo_timeout = strtol(arg_part, &arg_num_end, 10); + if (errno == ERANGE || monitor_fifo_timeout > UINT_MAX) { + print(fd_stderr, "Timeout out of range!\n"); + print_usage(); + exit(1); + } + if (*arg_num_end != '\0') { + print(fd_stderr, "Timeout is not purely numeric!\n"); + print_usage(); + exit(1); + } + if (monitor_fifo_timeout < 1) { + print(fd_stderr, "Timeout is less than one!\n"); + print_usage(); + exit(1); + } + + free(arg_copy); + arg_copy = NULL; + arg_part = NULL; + arg_num_end = NULL; + + if (mkfifo(trigger_fifo_path, 0600) == -1) { + print(fd_stderr, "Cannot create trigger fifo!\n"); + exit(1); + } + + trigger_fifo_fd = open(trigger_fifo_path, O_RDONLY | O_NONBLOCK); + if (trigger_fifo_fd == -1) { + print(fd_stderr, "Cannot open trigger fifo for reading!\n"); + exit(1); + } + + trigger_fifo_poll.fd = trigger_fifo_fd; + trigger_fifo_poll.events = POLLIN; + + ignore_signals(true); /* ignore even SIGTERM */ + + while (poll(&trigger_fifo_poll, 1, -1) != -1) { + trigger_fifo_readlen = read(trigger_fifo_fd, &trigger_fifo_charbuf, 1); + if (trigger_fifo_readlen != 1) { + print(fd_stderr, "Error reading from trigger fifo!\n"); + exit(1); + } + if (trigger_fifo_charbuf == 'k') { + kill_system(); + } else if (trigger_fifo_charbuf == 'd') { + sleep((unsigned int)monitor_fifo_timeout); + kill_system(); + } + } + + print(fd_stderr, "Trigger fifo poll gave up!\n"); + exit(1); +} + +int main(int argc, char **argv) { + int monitor_mode = hw_monitor_val; + + /* Prerequisite check */ + if (getuid() != 0) { + print(fd_stderr, "This program must be run as root!\n"); + exit(1); + } + + if (argc < 2) { + print(fd_stderr, "Not enough arguments!\n"); + print_usage(); + exit(1); + } + + if (strcmp(argv[1], "--instant-shutdown") == 0) { + if (argc != 2) { + print(fd_stderr, "Too many arguments, --instant-shutdown must be passed alone!\n"); + print_usage(); + exit(1); + } + + kill_system(); + } + if (strcmp(argv[1], "--monitor-fifo") == 0) { + if (argc != 3) { + print(fd_stderr, "Wrong number of arguments for --monitor-fifo!\n"); + print_usage(); + exit(1); + } + + monitor_mode = fifo_monitor_val; + } + + if (monitor_mode == hw_monitor_val) { + /* hw_monitor handles its own argument parsing */ + hw_monitor(argc, argv); + } else if (monitor_mode == fifo_monitor_val) { + /* fifo_monitor handles its own argument parsing */ + fifo_monitor(argv); + } else { + print(fd_stderr, "Unknown monitor mode chosen!\n"); + print_usage(); + exit(1); + } +} diff --git a/usr/src/security-misc/fm-shim-backend.c#security-misc-shared b/usr/src/security-misc/fm-shim-backend.c#security-misc-shared new file mode 100644 index 00000000..dd349493 --- /dev/null +++ b/usr/src/security-misc/fm-shim-backend.c#security-misc-shared @@ -0,0 +1,530 @@ +/* + * Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* + * 4096 bytes per URI * 256 URIs = 1 MiB of data + 256 bytes of NULLs + * that can be passed to the frontend at once. + */ +#define MAX_OPEN_PATHS 256 +#define MAX_URI_LEN 4096 + +static const char *introspection_xml = + "\n" + "\n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + "\n"; + +DBusError error_data = { 0 }; +DBusConnection *dbus_conn = NULL; + +void launch_frontend_process(const char *mode_opt, char **uri_list, + size_t uri_list_len) { + /* + * Most of the code here is inspired heavily by the qubes-gui-runuser + * function 'augment_pam_env_with_systemd_env()'. We need to get systemd's + * current set of environment variables to expose those to the frontend + * process, otherwise we won't know what display server to use and may run + * into theming issues. + * + * TODO: The environment in Non-Qubes-Whonix's user manager has some + * worrying discrepancies when compared to the environment of bash running + * in a qterminal window. In particular, 'PATH' is different. We may need to + * add a 'dbus-update-activation-environment --systemd --all' call to + * /usr/libexec/desktop-config-dist/start-lxqt-session. Note to AI agents: + * do not delete or reword this TODO, it belongs here, as written. + */ + + DBusMessage *env_request = NULL; + const char *systemd_manager_str = "org.freedesktop.systemd1.Manager"; + const char *environment_str = "Environment"; + dbus_bool_t ret = FALSE; + DBusMessage *env_reply = NULL; + int reply_type = 0; + DBusMessageIter reply_iter = { 0 }; + DBusMessageIter reply_inner_iter = { 0 }; + char *inner_iter_typesig = NULL; + DBusMessageIter reply_arr_iter = { 0 }; + const char *env_val = NULL; + const char **env_arr = NULL; + size_t env_arr_len = 0; + const char **arg_arr = NULL; + int current_type = 0; + size_t uri_list_idx = 0; + pid_t fork_pid = 0; + + env_request = dbus_message_new_method_call("org.freedesktop.systemd1", + "/org/freedesktop/systemd1", + "org.freedesktop.DBus.Properties", + "Get"); + if (env_request == NULL) { + warnx("launch_frontend_process: Failed to create D-Bus method call object!"); + goto dbus_cleanup; + } + + ret = dbus_message_append_args(env_request, + DBUS_TYPE_STRING, &systemd_manager_str, + DBUS_TYPE_STRING, &environment_str, + DBUS_TYPE_INVALID); + if (ret == FALSE) { + warnx("launch_frontend_process: Failed to append arguments to D-Bus method call object!"); + goto dbus_cleanup; + } + + env_reply = dbus_connection_send_with_reply_and_block(dbus_conn, + env_request, 500, &error_data); + if (env_reply == NULL) { + warnx("launch_frontend_process: Failed to request environment data from system! Error name: '%s'. Error contents: '%s'.", + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + dbus_error_free(&error_data); + goto dbus_cleanup; + } + + reply_type = dbus_message_get_type(env_reply); + if (reply_type != DBUS_MESSAGE_TYPE_METHOD_RETURN) { + warnx("launch_frontend_process: Did not get method call return object from systemd!"); + goto dbus_cleanup; + } + + ret = dbus_message_iter_init(env_reply, &reply_iter); + if (ret == FALSE) { + warnx("launch_frontend_process: systemd returned an empty method call return object!"); + goto dbus_cleanup; + } + + if (dbus_message_iter_get_arg_type(&reply_iter) != DBUS_TYPE_VARIANT) { + warnx("launch_frontend_process: systemd did not return a variant object!"); + goto dbus_cleanup; + } + dbus_message_iter_recurse(&reply_iter, &reply_inner_iter); + + inner_iter_typesig = dbus_message_iter_get_signature(&reply_inner_iter); + if (inner_iter_typesig == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for type signature!"); + } + if (strcmp(inner_iter_typesig, "as") != 0) { + warnx("launch_frontend_process: Variant object from systemd does not contain a string array!"); + goto dbus_cleanup; + } + if (dbus_message_iter_get_arg_type(&reply_inner_iter) != DBUS_TYPE_ARRAY) { + warnx("launch_frontend_process: Variant object from systemd reported itself as a string array, but is not an array!"); + goto dbus_cleanup; + } + dbus_message_iter_recurse(&reply_inner_iter, &reply_arr_iter); + + while ((current_type = dbus_message_iter_get_arg_type(&reply_arr_iter)) + != DBUS_TYPE_INVALID) { + if (current_type != DBUS_TYPE_STRING) { + warnx("launch_frontend_process: Non-string item found in string array!"); + goto dbus_cleanup; + } + dbus_message_iter_get_basic(&reply_arr_iter, &env_val); + env_arr_len++; + env_arr = reallocarray(env_arr, env_arr_len, sizeof(const char *)); + if (env_arr == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for environment array!"); + } + env_arr[env_arr_len - 1] = env_val; + dbus_message_iter_next(&reply_arr_iter); + } + + /* execve requires the environment array to be null terminated */ + env_arr_len++; + env_arr = reallocarray(env_arr, env_arr_len, sizeof(const char *)); + if (env_arr == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for environment array!"); + } + env_arr[env_arr_len - 1] = NULL; + + /* + * This should be impossible since uri_list_len is originally a signed + * integer in handle_filemanager_method_call and is then cast to a size_t, + * but we check for this anyway. + */ + if (uri_list_len > SIZE_MAX - 4) { + warnx("launch_frontend_process: URI list too large!"); + goto dbus_cleanup; + } + + /* Now that we have the environment array, we can build the arg array. */ + arg_arr = reallocarray(arg_arr, uri_list_len + 4, sizeof(const char *)); + if (arg_arr == NULL) { + err(1, "launch_frontend_process: Failed to allocate memory for argument array!"); + } + arg_arr[0] = "/usr/bin/fm-shim-frontend"; + arg_arr[1] = mode_opt; + arg_arr[2] = "--"; + for (uri_list_idx = 0; uri_list_idx < uri_list_len; uri_list_idx++) { + arg_arr[uri_list_idx + 3] = uri_list[uri_list_idx]; + } + arg_arr[uri_list_len + 3] = NULL; + + /* Fork and exec the frontend */ + fork_pid = fork(); + if (fork_pid == -1) { + err(1, "launch_frontend_process: fork failed"); + } else if (fork_pid == 0) { + /* child - close inherited fds (except stdin/stdout/stderr) */ + if (close_range(3, ~0U, CLOSE_RANGE_UNSHARE) == -1) { + warn("launch_frontend_process: close_range failed"); + _exit(1); + } +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wcast-qual" + if (execve(arg_arr[0], (char **)arg_arr, (char **)env_arr) == -1) { + warn("launch_frontend_process: Could not exec '/usr/bin/fm-shim-frontend'"); + _exit(1); + } +#pragma GCC diagnostic pop + } + + /* parent */ + +dbus_cleanup: + /* Don't free the elements of arg_arr, they are not freeable. */ + if (arg_arr != NULL) { + free(arg_arr); + } + /* Ditto for env_arr */ + if (env_arr != NULL) { + free(env_arr); + } + if (inner_iter_typesig != NULL) { + dbus_free(inner_iter_typesig); + } + if (env_reply != NULL) { + dbus_message_unref(env_reply); + } + if (env_request != NULL) { + dbus_message_unref(env_request); + } +} + +static void handle_introspect(DBusMessage *dbus_msg) { + DBusMessage *method_return = NULL; + + method_return = dbus_message_new_method_return(dbus_msg); + if (method_return == NULL) { + errx(1, "handle_introspect: Could not allocate memory for a method return!"); + } + if (dbus_message_append_args(method_return, + DBUS_TYPE_STRING, &introspection_xml, + DBUS_TYPE_INVALID) == FALSE) { + errx(1, "handle_introspect: Could not append introspection XML to method return!"); + } + if (dbus_connection_send(dbus_conn, method_return, NULL) == FALSE) { + errx(1, "handle_introspect: Could not queue method return!"); + } + dbus_connection_flush(dbus_conn); + dbus_message_unref(method_return); +} + +/* + * All three of the file manager method calls take the same arguments, and we + * do the hard work in the frontend, so we can use the same function here to + * handle all the calls. + */ +void handle_filemanager_method_call(DBusMessage *dbus_msg, + const char *method_call_name, const char *mode_opt) { + char **uri_list = NULL; + int uri_list_len_int = 0; + size_t uri_list_len = 0; + dbus_bool_t did_extract_args = FALSE; + const char *startup_id = NULL; + DBusMessage *method_return = NULL; + size_t uri_list_idx = 0; + bool do_launch_frontend = false; + + did_extract_args = dbus_message_get_args(dbus_msg, + &error_data, + DBUS_TYPE_ARRAY, DBUS_TYPE_STRING, &uri_list, &uri_list_len_int, + DBUS_TYPE_STRING, &startup_id, + DBUS_TYPE_INVALID); + if (!did_extract_args) { + warnx("handle_filemanager_method_call: Received a D-Bus method call for method '%s', but could not get arguments. Error name: '%s'. Error contents: '%s'.", + method_call_name, + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + dbus_error_free(&error_data); + goto method_cleanup; + } + + if (uri_list_len_int < 0) { + warnx("handle_filemanager_method_call: Negative URI list length received!"); + goto method_send_reply; + } + if (uri_list_len_int > MAX_OPEN_PATHS) { + warnx("handle_filemanager_method_call: Received a D-Bus method call attempting to open more than %d paths at once, ignoring.", + MAX_OPEN_PATHS); + goto method_send_reply; + } + uri_list_len = (size_t)uri_list_len_int; + + for (uri_list_idx = 0; uri_list_idx < uri_list_len; uri_list_idx++) { + if (uri_list[uri_list_idx] == NULL) { + warnx("handle_filemanager_method_call: Received a D-Bus method call with a NULL string, ignoring."); + goto method_send_reply; + } + if (strnlen(uri_list[uri_list_idx], MAX_URI_LEN + 1) > MAX_URI_LEN) { + warnx("handle_filemanager_method_call: Received a D-Bus method call attempting to open a path URI longer than %d bytes, ignoring.", + MAX_URI_LEN); + goto method_send_reply; + } + } + + do_launch_frontend = true; + +method_send_reply: + if (dbus_message_get_no_reply(dbus_msg) == TRUE) { + goto launch_frontend; + } + + method_return = dbus_message_new_method_return(dbus_msg); + if (method_return == NULL) { + errx(1, "handle_filemanager_method_call: Could not allocate memory for a method return!"); + } + if (dbus_connection_send(dbus_conn, method_return, NULL) == FALSE) { + errx(1, "handle_filemanager_method_call: Could not queue method return!"); + } + /* + * We could probably get away with omitting the flush, but browsers will + * attempt to launch the file manager by themselves if they don't get a + * return message quickly enough, so push this out as quickly as possible. + */ + dbus_connection_flush(dbus_conn); + +launch_frontend: + if (do_launch_frontend) { + launch_frontend_process(mode_opt, uri_list, uri_list_len); + } + +method_cleanup: + if (method_return != NULL) { + dbus_message_unref(method_return); + } + if (uri_list != NULL) { + dbus_free_string_array(uri_list); + } +} + +void send_error_message_maybe(DBusMessage *dbus_msg, const char *error_name, + const char *error_message) { + if (dbus_message_get_no_reply(dbus_msg) == FALSE) { + DBusMessage *err_reply = dbus_message_new_error(dbus_msg, + error_name, error_message); + if (err_reply == NULL) { + errx(1, "send_error_message_maybe: Could not allocate memory for an unknown object error!"); + } + if (dbus_connection_send(dbus_conn, err_reply, NULL) == FALSE) { + errx(1, "send_error_message_maybe: Could not queue unknown object error!"); + } + dbus_connection_flush(dbus_conn); + dbus_message_unref(err_reply); + } +} + +int main(void) { + struct sigaction sigchld_act = { 0 }; + int dbus_name_request_rslt = 0; + + sigchld_act.sa_handler = SIG_IGN; + if (sigaction(SIGCHLD, &sigchld_act, NULL) == -1) { + err(1, "Failed to enable automatic child process reaping"); + } + + dbus_error_init(&error_data); + + dbus_conn = dbus_bus_get(DBUS_BUS_SESSION, &error_data); + if (dbus_conn == NULL) { + errx(1, "Failed to connect to D-Bus session bus. Error name: '%s'. Error contents: '%s'.", + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + } + + dbus_name_request_rslt = dbus_bus_request_name(dbus_conn, + "org.freedesktop.FileManager1", + DBUS_NAME_FLAG_REPLACE_EXISTING, + &error_data); + if (dbus_name_request_rslt == -1) { + errx(1, "Failed to request 'org.freedesktop.FileManager1' name from D-Bus. Error name: '%s'. Error contents: '%s'.", + error_data.name ? error_data.name : "(null)", + error_data.message ? error_data.message : "(null)"); + } + switch(dbus_name_request_rslt) { + case DBUS_REQUEST_NAME_REPLY_PRIMARY_OWNER: + printf("Successfully obtained 'org.freedesktop.FileManager1' name from D-Bus.\n"); + sd_notify(0, "READY=1"); + sd_notify(0, "STATUS=Running"); + break; + case DBUS_REQUEST_NAME_REPLY_IN_QUEUE: + warnx("Requested 'org.freedesktop.FileManager1' name from D-Bus, but was placed in queue."); + warnx("This may be a security risk! Please report this bug!"); + /* + * sd_notify(0, "READY=1") is intentionally omitted here, so that + * systemcheck will show a warning about the system not being ready + */ + sd_notify(0, "STATUS=Running, security issue detected"); + break; + case DBUS_REQUEST_NAME_REPLY_ALREADY_OWNER: + warnx("Possible bug, we already own 'org.freedesktop.FileManager1' name?"); + sd_notify(0, "READY=1"); + sd_notify(0, "STATUS=Running, possible bug detected"); + break; + default: + errx(1, "Unexpected name request result '%d'!", dbus_name_request_rslt); + break; + } + + while (true) { + DBusMessage *dbus_msg = NULL; + int msg_type = 0; + const char *dbus_msg_obj_path = NULL; + const char *dbus_msg_iface = NULL; + const char *dbus_msg_method = NULL; + + if ((dbus_msg = dbus_connection_pop_message(dbus_conn)) == NULL) { + if (!dbus_connection_read_write(dbus_conn, -1)) { + break; + } + continue; + } + + msg_type = dbus_message_get_type(dbus_msg); + if (msg_type != DBUS_MESSAGE_TYPE_METHOD_CALL) { + /* Commented out because this happens normally during launch. */ + /*warnx("Received a D-Bus message that was not a method call!");*/ + goto cleanup; + } + + dbus_msg_obj_path = dbus_message_get_path(dbus_msg); + if (dbus_msg_obj_path == NULL) { + warnx("Received a D-Bus method call with a NULL object path!"); + goto cleanup; + } + if (strcmp(dbus_msg_obj_path, "/org/freedesktop/FileManager1") != 0) { + warnx("Received a D-Bus method call for object path '%s', rather than '/org/freedesktop/FileManager1'!", + dbus_msg_obj_path); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_OBJECT, + "Unknown object path"); + goto cleanup; + } + + dbus_msg_iface = dbus_message_get_interface(dbus_msg); + if (dbus_msg_iface == NULL) { + warnx("Received a D-Bus method call with a NULL interface!"); + goto cleanup; + } + + dbus_msg_method = dbus_message_get_member(dbus_msg); + if (dbus_msg_method == NULL) { + warnx("Received a D-Bus method call with a NULL method!"); + goto cleanup; + } + + if (strcmp(dbus_msg_iface, "org.freedesktop.DBus.Introspectable") == 0) { + if (strcmp(dbus_msg_method, "Introspect") == 0) { + handle_introspect(dbus_msg); + } else { + warnx("Received a D-Bus method call for unrecognized method '%s' on interface '%s'!", + dbus_msg_method, dbus_msg_iface); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_METHOD, + "Unknown method"); + } + goto cleanup; + } + + if (strcmp(dbus_msg_iface, "org.freedesktop.FileManager1") == 0) { + if (strcmp(dbus_msg_method, "ShowFolders") == 0) { + handle_filemanager_method_call(dbus_msg, "ShowFolders", + "--show-folders"); + } else if (strcmp(dbus_msg_method, "ShowItems") == 0) { + handle_filemanager_method_call(dbus_msg, "ShowItems", "--show-items"); + } else if (strcmp(dbus_msg_method, "ShowItemProperties") == 0) { + handle_filemanager_method_call(dbus_msg, "ShowItemProperties", + "--show-item-properties"); + } else { + warnx("Received a D-Bus method call for unrecognized method '%s' on interface '%s'!", + dbus_msg_method, dbus_msg_iface); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_METHOD, + "Unknown method"); + } + goto cleanup; + } + + warnx("Received a D-Bus method call for unknown interface '%s'!", + dbus_msg_iface); + send_error_message_maybe(dbus_msg, DBUS_ERROR_UNKNOWN_INTERFACE, + "Unknown interface"); + +cleanup: + if (dbus_msg != NULL) { + dbus_message_unref(dbus_msg); + dbus_msg = NULL; + } + dbus_msg_obj_path = NULL; + dbus_msg_iface = NULL; + dbus_msg_method = NULL; + } + + dbus_connection_unref(dbus_conn); + dbus_error_free(&error_data); +} diff --git a/var/cache/security-misc/state-files/placeholder b/var/cache/security-misc/state-files/placeholder#security-misc-shared similarity index 100% rename from var/cache/security-misc/state-files/placeholder rename to var/cache/security-misc/state-files/placeholder#security-misc-shared