Patrick Schleizer
1855fa08b1
readme
2024-01-18 08:54:39 -05:00
Patrick Schleizer
f0e2a82b55
bumped changelog version
2024-01-17 19:18:25 +00:00
Patrick Schleizer
314e5b490c
use wildcards
...
instead of outdated, incomplete list
https://github.com/Kicksecure/security-misc/issues/160
2024-01-17 14:03:09 -05:00
Patrick Schleizer
08619d6a73
minor RPM updates
...
https://github.com/Kicksecure/security-misc/issues/160
2024-01-17 13:59:36 -05:00
Patrick Schleizer
3048e0ac76
usrmerge
...
https://github.com/Kicksecure/security-misc/issues/190
2024-01-17 13:54:07 -05:00
Patrick Schleizer
5a6cd4c2ab
remove now empty /bin from copying since it is empty after usrmerge
...
https://github.com/Kicksecure/security-misc/issues/190
2024-01-17 13:51:30 -05:00
Patrick Schleizer
071b984a1e
sort -d
...
https://github.com/Kicksecure/security-misc/issues/190
2024-01-17 13:49:05 -05:00
Patrick Schleizer
011e55e3e5
remove duplicates after usrmerge
...
https://github.com/Kicksecure/security-misc/issues/190
2024-01-17 13:45:17 -05:00
Patrick Schleizer
0efee2f50f
usrmerge
...
fixes https://github.com/Kicksecure/security-misc/issues/190
2024-01-17 13:39:56 -05:00
Patrick Schleizer
18a06935e0
run permission hardener when new packages are install files to /usr or /opt
...
(basically anywhere)
fixes https://github.com/Kicksecure/security-misc/issues/189
2024-01-17 13:23:20 -05:00
Patrick Schleizer
66e6371221
bumped changelog version
2024-01-16 14:26:34 +00:00
Patrick Schleizer
0d78ecaee3
README
2024-01-16 09:26:21 -05:00
Patrick Schleizer
3ba8fe586e
update permission-hardener.service
...
Which is now only an additional opt-in systemd unit,
because permission-hardener is run by default at security-misc
package installation time.
https://github.com/Kicksecure/security-misc/pull/181
2024-01-16 09:23:54 -05:00
Patrick Schleizer
186f6015da
bumped changelog version
2024-01-16 14:14:18 +00:00
Patrick Schleizer
6aa55698ab
delete legacy folder /etc/permission-hardening.d if empty
...
https://github.com/Kicksecure/security-misc/pull/181
2024-01-16 09:10:59 -05:00
Patrick Schleizer
9cafd78fe2
rm_conffile /etc/permission-hardening.d
...
https://github.com/Kicksecure/security-misc/pull/181
2024-01-16 09:05:09 -05:00
Patrick Schleizer
fa53848b5c
bumped changelog version
2024-01-16 13:58:55 +00:00
Patrick Schleizer
4f7973bc56
comment
2024-01-16 08:56:26 -05:00
Patrick Schleizer
ed7c09fc46
permission-hardening -> permission-hardener migration
...
mv --verbose /var/lib/permission-hardening /var/lib/permission-hardener
https://github.com/Kicksecure/security-misc/pull/181
2024-01-16 08:45:13 -05:00
Patrick Schleizer
a90cd43631
fix postinst for new permission-hardener
...
https://github.com/Kicksecure/security-misc/pull/181
2024-01-16 08:32:52 -05:00
Patrick Schleizer
862bf6b5ab
Merge remote-tracking branch 'ben-grande/clean'
2024-01-16 08:19:28 -05:00
Patrick Schleizer
dc8d9eece3
bumped changelog version
2024-01-09 05:52:49 +00:00
Patrick Schleizer
1199871d7b
undo IPv6 privacy due to potential server issues
...
https://github.com/Kicksecure/security-misc/issues/184
2024-01-07 06:37:34 -05:00
Patrick Schleizer
128bb01b35
undo IPv6 privacy due to potential server issues
...
https://github.com/Kicksecure/security-misc/issues/184
2024-01-07 06:36:25 -05:00
Patrick Schleizer
df0f9d3267
README
2024-01-06 09:19:57 -05:00
Patrick Schleizer
86f91e3030
revert umask 027 by default
...
because broken because this also happens for root while it should not
https://github.com/Kicksecure/security-misc/issues/185
2024-01-06 09:11:54 -05:00
Patrick Schleizer
3f1304403f
disable MAC randomization in Network Manager (NM) because it breaks VirtualBox DHCP
...
https://github.com/Kicksecure/security-misc/issues/184
2024-01-06 08:15:31 -05:00
Patrick Schleizer
e8f8dcd0fb
bumped changelog version
2024-01-04 02:03:26 +00:00
Patrick Schleizer
70a86fa994
Merge remote-tracking branch 'github-kicksecure/master'
2024-01-03 05:12:48 -05:00
Patrick Schleizer
71060f1f53
Merge pull request #182 from raja-grewal/io_uring
...
Clarify validity of disabling io_uring
2024-01-03 05:00:41 -05:00
Raja Grewal
74afcc9c63
Clarify validity of disabling io_uring
2024-01-03 17:52:23 +11:00
Ben Grande
bc02c72018
Fix unbound variable
...
- Run messages preceded by INFO;
- Comment unknown unused variables;
- Remove unnecessary variables; and
- Deal with unbound variable due to subshell by writing to a file;
2024-01-02 17:08:45 +01:00
Patrick Schleizer
db0503e71d
bumped changelog version
2024-01-02 14:55:13 +00:00
Ben Grande
abf72c2ee4
Rename file permission hardening script
...
Hardener as the script is the agent that is hardening the file
permissions.
2024-01-02 13:34:29 +01:00
Ben Grande
f138cf0f78
Refactor permission-hardener
...
- Organize comments from default configuration;
- Apply and undo changes from a single file controlled by parameters;
- Arrays should be evaluated as arrays and not normal variables;
- Quote variables;
- Brackets around variables;
- Standardize test cases to "test" command;
- Test against empty or non-empty variables with "-z" and "-n";
- Show a usage message when necessary;
- Require root to run the script with informative message;
- Permit the user to see the help message without running as root;
- Do not create root directories without passing root check;
- Use long options for "set" command;
2024-01-02 12:17:16 +01:00
Patrick Schleizer
a94f2a3f46
Merge remote-tracking branch 'github-kicksecure/master'
2024-01-02 05:30:49 -05:00
Patrick Schleizer
8daf97ab01
Merge pull request #178 from raja-grewal/io_uring
...
Disable asynchronous I/O
2024-01-02 05:29:35 -05:00
Patrick Schleizer
94c0e26a08
bumped changelog version
2023-12-29 20:15:50 +00:00
Patrick Schleizer
5b36599c0c
/dev/, /dev/shm, /tmp
...
https://github.com/Kicksecure/security-misc/issues/157#issuecomment-1869073716
2023-12-29 14:57:38 -05:00
Patrick Schleizer
e15596e7af
bumped changelog version
2023-12-25 16:28:10 +00:00
Patrick Schleizer
f64a869bfd
readme
2023-12-25 11:03:22 -05:00
Patrick Schleizer
c86c83cef7
formatting
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 10:31:58 -05:00
Patrick Schleizer
971ff687b1
do not mount /dev/cdrom by default
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 10:30:35 -05:00
Patrick Schleizer
9fce67fcd9
remove superfluous, broken remount mount option
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 10:28:47 -05:00
Patrick Schleizer
40fd8cb608
no nofail mount option to avoid breaking the boot of a system
...
unit testing belongs elsewhere
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:51:09 -05:00
Patrick Schleizer
4aa645f29f
comment
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:46:33 -05:00
Patrick Schleizer
2b7aeedb4a
mount /dev/cdrom to /mnt/cdrom (instead of /mnt/cdrom0) and
...
nodev,nosuid,noexec
as per:
https://www.debian.org/doc/manuals/securing-debian-manual/ch04s10.en.html
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:44:51 -05:00
Patrick Schleizer
0d9e9780da
formatting
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:37:14 -05:00
Patrick Schleizer
00f9ab4394
/dev devtmpfs
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:36:05 -05:00
Patrick Schleizer
55709b3aa0
/tmp tmpfs
...
https://github.com/Kicksecure/security-misc/issues/157
2023-12-25 09:30:57 -05:00
