Collaboration & Baseline/Unification Things

[SkewedZeppelin]

Changes that should be generally accepted by any hardening projects to form a baseline.

Target audience is contributors to projects such as Brace, secureblue, and Kicksecure.

[SkewedZeppelin]

Some things I recently found:

• Fedora includes EOL intel-mediasdk package with known security issues: https://bugzilla.redhat.com/show_bug.cgi?id=2537267
• firewalld depends on libcap-ng-python3 to drop caps, but the spec only has it as a recommends, preventing it from being installed with weak deps set: https://bugzilla.redhat.com/show_bug.cgi?id=2539854
• authselect defaults to inserting nullok, the without-nullok feature must be enabled to prevent this

to completely disable avahi/bonjour/mdns/llmnr it must be configured in each systemd-resolved, networkmanager, authselect, and in gnome

• authselect disable-feature with-mdns4 with-mdns6
• resolved.conf:

[Resolve]
LLMNR=no
MulticastDNS=no

• NetworkManager

[connection]
connection.llmnr=0
connection.mdns=0

• gvfs network discovery services can be disabled via:
  • org.gnome.system.dns-sd.display-local='disabled'
  • org.gnome.system.smb.display-mode='disabled'
  • org.gnome.system.wsdd.display-mode='disabled'
• once disabled, driverless printers can still be added using lpadmin -p [name] -E -v ipp://[IP address]/ipp/print -m everywhere

[RoyalOughtness]

We already have that libcap package, but I added some validation in case upstream image builds ever change their behavior: secureblue/secureblue#2666

[RoyalOughtness]

secureblue/secureblue#2667

[SkewedZeppelin]

Some old things:

• services such as geoclue, tracker, and localsearch should be masked
  • geoclue can also be disabled in gnome: org.gnome.system.local.enabled=false
  • localsearch's fts function should be disabled in nautilus: org.gnome.nautilus.preferences.fts-enabled=false
• packages such as passim, sushi, and plocate should be removed
• thumbnailers should be globally disabled via org.{gnome,mate,cinnamon}.desktop.thumbnailers.disable-all=true
  • and further via:
    • org.gnome.nautilus.preferences.show-image-thumbnails=false
    • org.mate.caja.preferences.show-image-thumbnails=false
    • org.nemo.preferences.show-image-thumbnails=false
• automounting should be globally disabled via org.{gnome,mate,cinnamon}.desktop.media-handling.{automount,automount-open,autorun-never} set to false, false, and true respectively

[RoyalOughtness]

secureblue/secureblue#2668

[SkewedZeppelin]

re localsearch: here is an 2016 writeup someone made on it: https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-risky-design-decisions-in.html

[RoyalOughtness]

@SkewedZeppelin right but that's not a reason to abandon all indexing, just the extractions. If we remove all the extraction rules and modules, then every file will be indexed but by name, size, etc only

[scouw]

@SkewedZeppelin Why do you recommend setting org.gnome.nautilus.preferences.show-image-thumbnails=false even when org.gnome.desktop.thumbnailers.disable-all is set to true? Is it just so that the UI shows that it's disabled or does the nautilus toggle do something else that the global gnome one doesn't?

[SkewedZeppelin]

I set it because reading the code shows there may be a very slight performance benefit since it doesn't ever attempt to invoke the thumbnail factory for each file (only to return disabled).

[RoyalOughtness]

Subscribed, thanks for creating this. Github notifications tend to get lost so I'll have to make a point to check on this thread.

If you're interested in more synchronous communication you're welcome to join our discord or directly message me there or on matrix @secureblue:fedora.im

[SkewedZeppelin]

I'm not on any XMPP, Matrix, or Discord chat.

[RoyalOughtness]

@SkewedZeppelin IRC? or no chats whatsoever 😄

[SkewedZeppelin]

these fedora packages should be removed:

• core/standard: fpaste geolite2* ipcalc dhcp-client rsyslog iptstate lrzsz pinfo psacct whois whois-nls net-tools
  • many of these are obsolete or deprecated or outdated
• kerberos stuff: sssd* realmd
  • note: realmd has a known unfixed security issue where certificate validation is disabled
  • must change to local authselect backend first
• cups: mpage paps cups-browsed hplip* bluez-cups
• workstation: `ibus-typing-booster gamemode backgrounds'
  • backgrounds pulls in gtk & qt stuff irrespective of installed DE
• gnome: gtk2 sushi gnome-browser-connector gnome-extensions-app gnome-shell-extension* rygel gnome-user-share gnome-remote-desktop
• misc: compat-ffmpeg4 anaconda* passim intel-mediasdk

these packages had recent maintainer/upstream changes:

• ncdu
• bmon

these packages have current known vulnerabilities in the Fedora packaged version:

• openrgb
• caddy
• intel-mediasdk

are useful but have high attack surface:

• abrt*
• setroubleshoot*

[HastD]

Yes, we have CUPS masked by default, with a ujust script to toggle it; we also have cups-browsed masked by default with no script to unmask it, and a warning discouraging users from doing so (given its attack surface and history of vulnerabilities beyond that of the rest of the CUPS stack).

[SkewedZeppelin]

• dhcp-client is EOL/deprecated and pulls in geolite2* (which itself is eol) and ipcalc
  • it shouldn't actually be included in workstation anymore, but should be checked
• rsyslog: systemd has its own remote logging function, and rsyslog frequently has security issues
• lrzsz: ancient modem support
• whois whois-nls: deprecated in favor of rdap, many of the servers have even been turned off
• net-tools: obsolete
• pinfo: man covers more
• iptstate: deprecated in favor of nftables
• psacct: included but not enabled by default, so remove it
• fpaste: can inadvertently send off detailed system info to public pastebin

[RoyalOughtness]

Our ujust toggle keeps browsed off and warns users not to use it:

https://github.com/secureblue/secureblue/blob/live/files/system/usr/libexec/secureblue/inner/cups.py#L26

[SkewedZeppelin]

re kerberos: you'll have to decide that. I doubt any enterprise is using brace so I purged it all.

[RoyalOughtness]

@SkewedZeppelin fpaste is kind of nice to use though :P

we use it for having users send us logs of stuff for support

[SkewedZeppelin]

luks tpm unlock should never ever be used its own without a second factor
reason: it can be trivially bypassed

there is a really good writeup on how/why from like a year ago, I can't seem to find it

[RoyalOughtness]

When you say second factor are you including a pin?

[SkewedZeppelin]

if one considers a pin sufficient enough, sure

password + argon iterations cranked (due to the benchmark mechanism, the default can be very low like 512mb at 2 iterations) is what I'd recommend, eg.:

cryptsetup luksConvertKey /dev/nvme0n1p3 --pbkdf argon2id --pbkdf-memory 4194304 --pbkdf-parallel 4 --pbkdf-force-iterations=16

[SkewedZeppelin]

related: notes on opal: fwupd/fwupd#10624 (comment)

[RoyalOughtness]

@SkewedZeppelin In that case yeah, tpm unlock on its own just ties unlocking to tpm pcrs, rather than actually securing the data on the disk. Unless someone decided to steal just a disk and not the corresponding cpu 😄

[SkewedZeppelin]

some environment variable stuff

zero vram of amd and noveuau:

export R600_DEBUG=zerovram; #r600
export AMD_DEBUG=zerovram; #radeonsi
export radeonsi_zerovram=true;
export RADV_DEBUG=zerovram; #radv
export radv_zero_vram=true;
export NVK_DEBUG=zero_memory; #nvk
export vk_zero_vram=true;

disable glibc malloc thread local cache (credit to Tails):

export GLIBC_TUNABLES='glibc.malloc.tcache_count=0'

[SkewedZeppelin]

it is also possible to disable unwanted gstreamer plugins (there are like 1,200 of them) via:

GST_PLUGIN_FEATURE_RANK=pluginA:NONE,pluginB:NONE...

I have a wip thing that lets only av1/opus work for example. need to add the rest of the common ones

[SkewedZeppelin]

some kernel args:

prevent amdgpu iommu bypass added in v7.4 to maintain current behavior: amdgpu.iommu_perfopt=0
see https://www.phoronix.com/news/AMD-PerfOpt-Linux-7.4
will also need to re-test force_isolation and see if it is improved or not

disable kvm nested virtualization (numerous recent issues): kvm-intel.nested=0 kvm-amd.nested=0

cc: @raja-grewal

[HastD]

I agree that opting out of the amdgpu iommu bypass makes sense. As for KVM nested paging, do you have more info on the issues related to that? At a first look, I'm not sure why nested paging would be less secure than software-managed shadow page tables.

[SkewedZeppelin]

• https://www.openwall.com/lists/oss-security/2026/03/30/5
• https://www.openwall.com/lists/oss-security/2026/07/06/7
• https://www.openwall.com/lists/oss-security/2026/08/06/6
• https://www.openwall.com/lists/oss-security/2026/09/16/14
• https://www.openwall.com/lists/oss-security/2026/09/29/5

[SkewedZeppelin]

also not sure how much you want to read into it, but considering the timeline and their "Winter is coming." comment, there could literally be more currently embargoed issues that'll be revealed soon.

edit: also what even are the usecases?

for example if you want to use gVisor:

For best performance, use the KVM platform on bare-metal machines only. If you have to run gVisor within a virtual machine, the systrap platform will often yield better performance than KVM.

[HastD]

Makes sense, I agree it'd be good to disable that too.

[HastD]

These kernel arguments have now been added to secureblue: secureblue/secureblue@4ca4172

[SkewedZeppelin]

I was reading Ubuntu's recent talk about rust coreutils and it seems you can swap cleanly in Fedora for a few months now:

sudo dnf swap coreutils uutils-coreutils

however F44 is currently on 0.7.0 whereas latest is 0.12.0, so likely quite undesirable.
F45 and rawhide doesn't seem better either right now

I see secureblue discussed this last year here: secureblue/secureblue#933
selinux support did land and is enabled at least

edit: nvm it looks like it at first, but it actually just additionally installs coreutils-single which is still gnu version.
will have to revisit this even further in future.

[RoyalOughtness]

I would not use uutils at least not now. See secureblue/secureblue#933 (comment)

[RoyalOughtness]

@SkewedZeppelin fyi secureblue/secureblue#2711

[SkewedZeppelin]

yea my old kaby lake thinkpad does that. I didn't find a good way to handle it yet.

setting it to auto, you may as well just comment it instead since it won't do anything?

[RoyalOughtness]

@SkewedZeppelin For a generic image auto becomes essential. Commenting it won't warn users that they need to switch from on to auto per our current auditing system.