mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-25 02:25:33 +07:00
Code Issues Packages Projects Releases Wiki Activity

minor mmap-rnd-bits improvements

Browse Source
This commit is contained in:
Patrick Schleizer 2023-05-05 14:44:29 +00:00
parent 15d0ee1008
commit d6d79e96c9
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
3 changed files with 21 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
debian/security-misc.postinst vendored
View File

@ -58,7 +58,7 @@ you should fix running 'update-grub', otherwise your system might no longer \
boot." >&2 boot." >&2
fi fi
/usr/libexec/security-misc/mmap-rnd-bits /usr/libexec/security-misc/mmap-rnd-bits || true
true "INFO: debhelper beginning here." true "INFO: debhelper beginning here."

4
debian/security-misc.triggers vendored
View File

@ -15,6 +15,10 @@ activate-noawait update-initramfs
## LKRG /usr/share/security-misc/lkrg/lkrg-virtualbox ## LKRG /usr/share/security-misc/lkrg/lkrg-virtualbox
interest-noawait /usr/bin/vboxmanage interest-noawait /usr/bin/vboxmanage
## /usr/libexec/security-misc/mmap-rnd-bits
## auto generates:
## /etc/sysctl.d/30_security-misc_aslr-mmap.conf
## sets:
## vm.mmap_rnd_bits ## vm.mmap_rnd_bits
interest-noawait /boot interest-noawait /boot

33
usr/libexec/security-misc/mmap-rnd-bits
View File

@ -1,41 +1,39 @@
#!/usr/bin/env bash #!/usr/bin/env bash
set -euo pipefail
shopt -s failglob
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## This script enforces the maximum ASLR hardening settings for mmap, given the ## This script enforces the maximum ASLR hardening settings for mmap, given the
## installed Linux config. ## installed Linux config.
set -euo pipefail
shopt -s failglob
## Defaults in case Linux config detection fails. These are likely to work fine ## Defaults in case Linux config detection fails. These are likely to work fine
## on x86_64, probably not elsewhere. ## on x86_64, probably not elsewhere.
BITS_MAX_DEFAULT=32 BITS_MAX_DEFAULT=32
COMPAT_BITS_MAX_DEFAULT=16 COMPAT_BITS_MAX_DEFAULT=16
## Find the most recently modified Linux config file. ## Find the most recently modified Linux config file.
if compgen -G "/boot/config-*" > /dev/null && CONFIG=$(ls -1 -t /boot/config-* | head -n 1) if compgen -G "/boot/config-*" > /dev/null && CONFIG=$(ls -1 -t /boot/config-* | head -n 1) ; then
then
## Find the relevant config options. ## Find the relevant config options.
if ! BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) if ! BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) ; then
then echo "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_BITS_MAXQ Using built-in default." >&2
echo "Error detecting CONFIG_ARCH_MMAP_RND_BITS_MAX"
BITS_MAX="${BITS_MAX_DEFAULT}" BITS_MAX="${BITS_MAX_DEFAULT}"
fi fi
if ! COMPAT_BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) if ! COMPAT_BITS_MAX=$(grep -E '^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=[0-9]+$' "${CONFIG}" | cut -d "=" -f 2) ; then
then echo "$0: ERROR: Error detecting CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX! Using built-in default." >&2
echo "Error detecting CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX"
COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}" COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}"
fi fi
else else
echo "Error detecting Linux config" echo "$0: ERROR: Error detecting Linux config! Using built-in defaults." >&2
BITS_MAX="${BITS_MAX_DEFAULT}" BITS_MAX="${BITS_MAX_DEFAULT}"
COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}" COMPAT_BITS_MAX="${COMPAT_BITS_MAX_DEFAULT}"
fi fi
## Generate a sysctl.d conf file. ## Generate a sysctl.d conf file.
SYSCTL="## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> SYSCTL="\
## Copyright (C) 2019 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
## This file is automatically generated, do not edit! ## This file is automatically generated, do not edit!
@ -45,9 +43,10 @@ vm.mmap_rnd_bits=${BITS_MAX}
vm.mmap_rnd_compat_bits=${COMPAT_BITS_MAX}" vm.mmap_rnd_compat_bits=${COMPAT_BITS_MAX}"
## Write the sysctl.d conf file. ## Write the sysctl.d conf file.
if ! echo "${SYSCTL}" | tee /etc/sysctl.d/30_security-misc_aslr-mmap.conf > /dev/null if echo "${SYSCTL}" | tee /etc/sysctl.d/30_security-misc_aslr-mmap.conf > /dev/null ; then
then exit 0
echo "Error writing ASLR map config"
fi fi
exit 0 echo "$0: ERROR: Error writing ASLR map config file '/etc/sysctl.d/30_security-misc_aslr-mmap.conf'!" >&2
exit 1