Commit Graph

555 Commits

Author SHA1 Message Date
Patrick Schleizer
3135a03e21
Merge remote-tracking branch 'github-kicksecure/master' 2024-12-19 00:34:56 -05:00
Patrick Schleizer
c7f7196471
Merge pull request #287 from raja-grewal/patch
Refactor and add two CPU mitigations
2024-12-19 00:31:25 -05:00
Patrick Schleizer
f0c611d9ed
comment 2024-12-19 00:18:25 -05:00
Patrick Schleizer
4f681be774
Merge remote-tracking branch 'github-kicksecure/master' 2024-12-19 00:17:44 -05:00
Patrick Schleizer
4cf5757575
Merge pull request #282 from ArrayBolt3/arraybolt3/umask
Enable umask hardening
2024-12-19 00:08:56 -05:00
raja-grewal
0dff2cd28f
Minor additions 2024-12-18 03:32:35 +00:00
raja-grewal
3e96fdd9cc
Enable kvm.mitigate_smt_rsb=1 2024-12-17 11:44:11 +00:00
raja-grewal
45355aabdc
Enable kvm-intel.vmentry_l1d_flush=always 2024-12-17 11:42:52 +00:00
raja-grewal
defba1f245
Refactor CPU mitigations 2024-12-17 11:42:03 +00:00
raja-grewal
943c421889
Minor refactoring 2024-12-17 11:40:38 +00:00
Aaron Rainbolt
4c3ca68453
Disable unnecessary sudoers exceptions 2024-12-16 02:56:52 -05:00
Patrick Schleizer
9d06341c91
Merge pull request #285 from Kicksecure/permission-hardener-mount
Permission Hardener: treat mount same as umount
2024-12-14 15:18:56 -05:00
Aaron Rainbolt
439fa7f3be
Harden/disable recovery mode options 2024-12-08 03:42:54 -06:00
Patrick Schleizer
5b88e92e5c
permission hardner: treat mount the same way we treat umount
Thanks to @the-moog for the bug report!

fixes https://github.com/Kicksecure/security-misc/issues/284
2024-12-06 09:48:58 -05:00
Patrick Schleizer
93b51819d4
permission hardener mount chmod change from 745 to 755
https://github.com/Kicksecure/security-misc/issues/284
2024-12-06 09:47:08 -05:00
Aaron Rainbolt
1708a03e1e
Enable umask hardening 2024-11-28 15:39:59 -06:00
Patrick Schleizer
7987a3914d
deleted no longer used and out-commented /etc/sudoers.d/xfce-security-misc leftover 2024-11-12 02:29:42 -05:00
Patrick Schleizer
8c2e8e6979
deleted no longer used and out-commented etc/sudoers.d/pkexec-security-misc leftover 2024-11-12 01:41:12 -05:00
Patrick Schleizer
50161f5d79
moved /etc/dkms/framework.conf.d/30_security-misc.conf (renamed) to usability-misc 2024-11-11 05:48:11 -05:00
Patrick Schleizer
ef05b1a160
disable legacy matroxfb_base framebuffer driver
fix typo matroxfb_bases -> matroxfb_base

Thanks to @ArrayBolt3 for the bug report!
2024-11-11 05:40:41 -05:00
raja-grewal
8107782fa5
Enable ssbd=force-on 2024-11-08 15:36:04 +11:00
Aaron Rainbolt
690e8dd826
Avoid faillock lock/tally reset on reboot or timeout 2024-10-19 23:52:51 -05:00
raja-grewal
09fe46adc9
Clarify KSPP compliance header for the undocumented case 2024-10-14 02:54:30 +00:00
raja-grewal
39d063d494
Add KSPP=no definition 2024-09-26 13:09:21 +00:00
Patrick Schleizer
3280dbd5d5
Fix VirtualBox audio device ICH AC97.
no longer `blacklist snd_intel8x0`

Breaks VirtualBox audio device ICH AC97, which is unfortunately still required by some users.
https://www.kicksecure.com/wiki/Dev/audio

Fixes https://github.com/Kicksecure/security-misc/issues/271
2024-09-13 22:52:47 -04:00
Raja Grewal
2c356e8b0e
Add KSPP notice definitions 2024-08-26 11:34:12 +10:00
raja-grewal
9dbd200be4
Merge branch 'Kicksecure:master' into kspp_compliance 2024-08-26 11:08:21 +10:00
Raja Grewal
e4909b5e28
Add details on kernel panics 2024-08-25 12:47:04 +10:00
Raja Grewal
18ed77ecc9
Refactor modprobe.d to minimise potential future merge conflicts 2024-08-21 12:50:14 +10:00
Raja Grewal
56b28e3826
Typo 2024-08-19 11:50:08 +10:00
Raja Grewal
94dab1b7c5
Partial compliance with the KSPP on kernel panics 2024-08-19 10:53:05 +10:00
Raja Grewal
248e094b8e
Include KSPP compliance notices 2024-08-17 01:06:21 +10:00
Patrick Schleizer
305467c652
Merge pull request #245 from raja-grewal/blacklist_to_disable
Update `/etc/modprobe.d/*`
2024-08-16 04:25:43 -04:00
Raja Grewal
e3a3207a44
Clarify DMA hardening 2024-08-16 12:41:36 +10:00
Raja Grewal
73db68dbf9
Add details on KFENCE 2024-08-09 14:27:30 +10:00
Raja Grewal
15c638acad
Add reference on RDRAND 2024-08-09 13:36:47 +10:00
Raja Grewal
d8bcec881f
Add some notices for future Debian 13 rebase 2024-08-09 13:33:32 +10:00
Raja Grewal
e5a38fc856
Typo 2024-08-09 13:30:15 +10:00
Raja Grewal
a5373afc55
Details on disabled fbdev kernel modules 2024-08-07 14:44:14 +10:00
Raja Grewal
50fa721fd5
Update docs regarding Intel module disabling 2024-08-07 14:01:49 +10:00
Patrick Schleizer
a25aaf900a
Merge pull request #260 from raja-grewal/vdso32
Enable `vdso32=0`
2024-08-06 09:55:20 -04:00
Patrick Schleizer
6bc039a430
Merge pull request #259 from raja-grewal/kfence
Enable `kfence.sample_interval=100`
2024-08-06 09:52:56 -04:00
Raja Grewal
8559079312
Enable vdso32=0 2024-08-05 15:10:02 +10:00
Raja Grewal
d102ec1997
Enable kfence.sample_interval=100 2024-08-05 15:07:56 +10:00
Raja Grewal
aa34d86598
Enable slab_debug=FZ 2024-08-05 14:27:17 +10:00
Patrick Schleizer
6d97408a6d
Merge pull request #255 from raja-grewal/SLUB
Restore option to enable `slub_debug=FZ`
2024-08-04 16:11:46 -04:00
Raja Grewal
6f14d68cdc
Update legacy name slub_debug -> slab_debug 2024-08-03 15:12:15 +10:00
Raja Grewal
22b6cee80c
Add details about slub_debug 2024-08-03 15:11:14 +10:00
Raja Grewal
b77d1a2b98
Revert "Remove the optional slub_debug parameter since it is no longer recommended"
This reverts commit 48e1ac4163.
2024-08-03 14:49:48 +10:00
Raja Grewal
52aeacb4da
Provide option to disable 32 bit vDSO mappings 2024-08-03 00:13:38 +10:00