Merge remote-tracking branch 'origin/master'

debian/control

@@ -116,6 +116,9 @@ Description: enhances misc security settings
  .
   * The vivid kernel module is blacklisted as it's only required for testing
  and has been the cause of multiple vulnerabilities.
+ .
+  * An initramfs hook sets the sysctl values in /etc/sysctl.d before init
+ is executed so our hardening is enabled as early as possible.
  .
   * The kernel panics on oopses to prevent it from continuing to run a flawed
  process and to deter brute forcing.

etc/initramfs-tools/hooks/sysctl-initramfs

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
+## See the file COPYING for copying conditions.
+
+set -e
+
+PREREQ=""
+prereqs()
+{
+        echo "$PREREQ"
+}
+case $1 in
+prereqs)
+       prereqs
+       exit 0
+       ;;
+esac
+
+. /usr/share/initramfs-tools/hook-functions
+copy_exec /sbin/sysctl /sbin

etc/initramfs-tools/scripts/init-bottom/sysctl-initramfs

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
+## See the file COPYING for copying conditions.
+
+PREREQ=""
+prereqs()
+{
+        echo "$PREREQ"
+}
+case $1 in
+prereqs)
+        prereqs
+        exit 0
+        ;;
+esac
+
+sysctl -p ${rootmnt}/etc/sysctl.d/*.conf