|
|
5124f8cebc
|
Merge pull request #61 from madaidan/disable_early_pci_dma
Avoid holes in IOMMU
|
2020-02-15 10:18:56 +00:00 |
|
|
|
ac8757a031
|
Merge pull request #59 from madaidan/ldisc
Restrict loading line disciplines to CAP_SYS_MODULE
|
2020-02-15 10:09:46 +00:00 |
|
|
|
9b767139ef
|
Avoid holes in IOMMU
|
2020-02-14 18:52:01 +00:00 |
|
|
|
ace6211176
|
Update control
|
2020-02-14 17:51:17 +00:00 |
|
|
|
0ea7dd161b
|
Restrict loading line disciplines to CAP_SYS_MODULE
|
2020-02-14 17:50:19 +00:00 |
|
|
|
ad6b766886
|
Merge pull request #57 from madaidan/sysctl
Prevent symlink/hardlink TOCTOU races
|
2020-02-13 18:40:58 +00:00 |
|
|
|
14140ad41b
|
bumped changelog version
16.2-1
|
2020-02-13 13:39:45 -05:00 |
|
|
|
d1fa191bc0
|
readme
|
2020-02-13 13:38:21 -05:00 |
|
|
|
76a51a3b45
|
Merge remote-tracking branch 'origin/master'
|
2020-02-13 13:37:34 -05:00 |
|
|
|
5ebab397b2
|
Merge pull request #58 from madaidan/mitigations
Improve CPU mitigations documentation
|
2020-02-13 18:36:41 +00:00 |
|
|
|
2796c2dd00
|
Update control
|
2020-02-12 18:43:19 +00:00 |
|
|
|
700c7ed908
|
Create 40_cpu_mitigations.cfg
|
2020-02-12 18:42:13 +00:00 |
|
|
|
ba0043b8a7
|
Update 40_kernel_hardening.cfg
|
2020-02-12 18:36:05 +00:00 |
|
|
|
14f8458374
|
Update control
|
2020-02-12 18:05:32 +00:00 |
|
|
|
5cb21d0d4d
|
Prevent symlink/hardlink TOCTOU races
|
2020-02-12 18:03:23 +00:00 |
|
|
|
163e20b886
|
bumped changelog version
16.1-1
|
2020-02-05 06:31:48 -05:00 |
|
|
|
3024006f63
|
Merge remote-tracking branch 'origin/master'
|
2020-02-04 00:24:50 -05:00 |
|
|
|
024576e330
|
Merge pull request #56 from HulaHoop0/patch-1
kvm.nx_huge_pages=force
|
2020-02-04 05:24:05 +00:00 |
|
|
|
e4c6e897cf
|
kvm.nx_huge_pages=force
|
2020-02-03 16:06:46 +00:00 |
|
|
|
8c5cd865f4
|
bumped changelog version
16.0-1
|
2020-02-03 09:23:13 -05:00 |
|
|
|
1f6ed2cc70
|
add support for passing parameters to usr/lib/security-misc/apt-get-update
|
2020-02-03 08:55:20 -05:00 |
|
|
|
2291b7f787
|
bumped changelog version
15.9-1
|
2020-02-03 08:43:31 -05:00 |
|
|
|
8627c9f76d
|
/usr/lib/security-misc/apt-get-update increase default timeout_after="600"
|
2020-01-31 12:18:02 -05:00 |
|
|
|
829e28aa90
|
/usr/lib/security-misc/apt-get-update environment variable timeout_after kill_after support
|
2020-01-31 12:17:07 -05:00 |
|
|
|
0bd0a4a647
|
bumped changelog version
15.8-1
|
2020-01-30 06:14:34 -05:00 |
|
|
|
85d2aa1365
|
hide stdout (but not stderr) by sysctl during initramfs
|
2020-01-30 06:13:42 -05:00 |
|
|
|
d69c1839cd
|
bumped changelog version
15.7-1
|
2020-01-30 06:02:26 -05:00 |
|
|
|
b9d65338bc
|
unconditionally enable all CPU bugs (spectre, meltdown, L1TF, ...)
this might reduce performance
* `spectre_v2=on`
* `spec_store_bypass_disable=on`
* `tsx=off`
* `tsx_async_abort=full,nosmt`
Thanks to @madaidan for the suggestion!
https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647
|
2020-01-30 05:55:13 -05:00 |
|
|
|
2711d0f7f0
|
bumped changelog version
15.6-1
|
2020-01-30 01:22:32 -05:00 |
|
|
|
4df0d6c01c
|
readme
|
2020-01-30 01:22:06 -05:00 |
|
|
|
c1a0da60be
|
set kernel boot parameter l1tf=full,force and nosmt=force
https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
|
2020-01-30 00:46:48 -05:00 |
|
|
|
efc40da4fb
|
bumped changelog version
15.5-1
|
2020-01-24 12:02:27 -05:00 |
|
|
|
07dcb32fc2
|
readme
|
2020-01-24 11:55:38 -05:00 |
|
|
|
f4c54881ac
|
description
|
2020-01-24 04:49:19 -05:00 |
|
|
|
25317f23e3
|
bumped changelog version
15.4-1
|
2020-01-24 04:41:16 -05:00 |
|
|
|
be79f0688a
|
readme
|
2020-01-24 04:40:20 -05:00 |
|
|
|
c0d3726b00
|
comment
|
2020-01-24 04:40:03 -05:00 |
|
|
|
a37da1c968
|
add digits to drop-in file names
|
2020-01-24 04:39:06 -05:00 |
|
|
|
2ab940c603
|
bumped changelog version
15.3-1
|
2020-01-24 04:34:18 -05:00 |
|
|
|
bac6cd601b
|
readme
|
2020-01-24 04:33:54 -05:00 |
|
|
|
3a4d283169
|
description
|
2020-01-24 04:33:30 -05:00 |
|
|
|
e0aa67677d
|
merge the many modprobe.d config files into 1
and use a name starting with double digits
to make it easier to disable settings using a lexically higher config file
|
2020-01-24 04:30:36 -05:00 |
|
|
|
6a4c493213
|
merge the many sysctl config files into 1
and use a name starting with double digits
to make it easier to disable settings using a lexically higher config file
|
2020-01-24 04:26:36 -05:00 |
|
|
|
f653b94e77
|
bumped changelog version
15.2-1
|
2020-01-24 03:49:02 -05:00 |
|
|
|
ca057713e2
|
readme
|
2020-01-24 03:39:04 -05:00 |
|
|
|
8616728ce0
|
remove duplicate
|
2020-01-24 03:35:15 -05:00 |
|
|
|
d4a37b6df2
|
remove-system.map: source /usr/lib/helper-scripts/pre.bsh
|
2020-01-24 03:18:17 -05:00 |
|
|
|
3b283ec00f
|
bumped changelog version
15.1-1
|
2020-01-22 07:10:47 -05:00 |
|
|
|
531f17cb68
|
add update initramfs trigger
https://github.com/Whonix/security-misc/pull/53
|
2020-01-22 07:08:31 -05:00 |
|
|
|
df0b2afda1
|
bumped changelog version
15.0-1
|
2020-01-21 10:12:32 -05:00 |
|
