Aaron Rainbolt
d7475e252a
Make apt-get-update able to be terminated securely
2024-11-21 20:03:42 -06:00
Patrick Schleizer
c7e9460b2a
output
2024-11-14 16:31:12 -05:00
Patrick Schleizer
ef95b3f9a5
Revert "fix panic-on-oops.service"
...
This reverts commit 862d23cb10
2024-11-14 14:41:14 -05:00
Patrick Schleizer
7c06e22c7d
deleted /usr/bin/pkexec.security-misc
...
This was not used anymore for anything. In the past, we used to `config-package-dev` `replace` `/usr/bin/pkexec` with `/usr/bin/pkexec.security-misc` for the purpose of:
> Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with hidepid.
* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040
* https://forums.whonix.org/t/cannot-use-pkexec/8129
This was a worthwhile effort, interesting approach but ultimately a dead-end.
2024-11-11 05:43:25 -05:00
Patrick Schleizer
862d23cb10
fix panic-on-oops.service
...
remove `After=multi-user.target` because already using `WantedBy=multi-user.target`
Thanks to @ArrayBolt3 for the bug report!
2024-11-11 05:36:41 -05:00
Patrick Schleizer
29ae5f5980
fix optional opt-in harden-module-loading.service
...
by making `/usr/libexec/security-misc/disable-kernel-module-loading` executable
Thanks to @ArrayBolt3 for the bug report!
2024-11-11 05:28:31 -05:00
Patrick Schleizer
5bd0a277bf
fix permission-hardener issue "Removing capabilities failed. File: '/bin/ping'"
...
no longer user end-of-options marker (`--`) for `setcap`
since setcap does not support it
Fixes https://github.com/QubesOS/qubes-issues/issues/9569
https://forums.whonix.org/t/permission-hardener-error/20719
2024-11-10 06:29:17 -05:00
Patrick Schleizer
71c58442ca
minor
2024-10-28 05:10:19 -04:00
Patrick Schleizer
cfe19e31d8
shell options
2024-10-28 05:09:53 -04:00
Patrick Schleizer
0d50615658
local
2024-10-28 05:07:00 -04:00
Patrick Schleizer
ef0eb5f7a0
refactoring
2024-10-28 05:06:26 -04:00
Patrick Schleizer
fdd1f4b7f8
refactoring
2024-10-28 05:06:05 -04:00
Patrick Schleizer
d00235897d
hide-hardware-info: also parse /usr/local/etc/hide-hardware-info.d/*.conf
2024-10-28 05:03:59 -04:00
Patrick Schleizer
6c2e808b9f
refactoring
2024-10-28 05:03:20 -04:00
Patrick Schleizer
566cda5e4b
output
2024-10-21 05:47:38 -04:00
Patrick Schleizer
5991a23049
comment
2024-10-21 05:47:25 -04:00
Aaron Rainbolt
690e8dd826
Avoid faillock lock/tally reset on reboot or timeout
2024-10-19 23:52:51 -05:00
Patrick Schleizer
b6433309fd
use end-of-options
2024-10-18 12:45:02 -04:00
raja-grewal
09fe46adc9
Clarify KSPP compliance header for the undocumented case
2024-10-14 02:54:30 +00:00
raja-grewal
0c0774f6c0
Merge branch 'master' into text_2
2024-10-06 10:48:52 +00:00
Patrick Schleizer
0e3ffa3f11
no longer set kernel.unprivileged_userns_clone=0
...
because it breaks too much
fixes https://github.com/Kicksecure/security-misc/issues/274
2024-10-03 02:58:58 -04:00
Patrick Schleizer
f401d94d5e
expand documentation on kernel.unprivileged_userns_clone=0 sysctl
...
https://github.com/Kicksecure/security-misc/issues/274
2024-10-03 02:44:06 -04:00
raja-grewal
f3b50a23c9
Add reference on unprivileged_userns_restriction
2024-09-26 13:10:01 +00:00
raja-grewal
39d063d494
Add KSPP=no definition
2024-09-26 13:09:21 +00:00
raja-grewal
870ff88605
Comment on Flatpak requiring unprivileged user namespaces
2024-09-25 10:01:45 +10:00
Patrick Schleizer
563a898013
Merge pull request #265 from raja-grewal/mmap_min_addr
...
Set `sysctl vm.mmap_min_addr=65536`
2024-09-04 10:11:48 -04:00
Patrick Schleizer
175945ec9a
Merge pull request #268 from raja-grewal/panic_on_warn
...
Enable `panic_on_warn=1`
2024-09-04 10:05:47 -04:00
raja-grewal
7393ba1591
Typo
2024-09-04 23:23:24 +10:00
Raja Grewal
6294729c8e
Follow-up on f70fe308a9
2024-08-29 15:34:24 +10:00
Raja Grewal
3101035a3f
Enable panic_on_warn=1
2024-08-29 01:57:32 +10:00
Patrick Schleizer
f70fe308a9
no longer set sysctl fs.binfmt_misc.status=0 /
...
no longer disallow registering interpreters for miscellaneous binary formats
causing file/folder permissions issue `d????????? ? ? ? ? ? .`
Firefox no longer starting (probably not not a Firefox issue)
https://github.com/Kicksecure/security-misc/issues/267
2024-08-28 06:49:50 -04:00
Raja Grewal
9e91c98cc9
Add details on BPF hardening and split the sysctls
2024-08-26 12:40:04 +10:00
Raja Grewal
2c356e8b0e
Add KSPP notice definitions
2024-08-26 11:34:12 +10:00
Raja Grewal
ac6602ac35
Add detail on disabling user namespaces breaking UPower
2024-08-26 11:19:20 +10:00
raja-grewal
9dbd200be4
Merge branch 'Kicksecure:master' into kspp_compliance
2024-08-26 11:08:21 +10:00
Patrick Schleizer
73900b59db
Merge pull request #263 from raja-grewal/max_user_namespaces
...
Provide option to disable user namespaces
2024-08-25 11:00:51 -04:00
Patrick Schleizer
43d13b70f1
Merge remote-tracking branch 'raja/syntax'
2024-08-25 10:55:52 -04:00
Raja Grewal
32de5e7c49
Add details on oopses and warnings
2024-08-25 12:57:22 +10:00
Raja Grewal
e4909b5e28
Add details on kernel panics
2024-08-25 12:47:04 +10:00
Raja Grewal
56b28e3826
Typo
2024-08-19 11:50:08 +10:00
Raja Grewal
e61027a40e
Set sysctl vm.mmap_min_addr=65536
2024-08-19 11:32:20 +10:00
Raja Grewal
94dab1b7c5
Partial compliance with the KSPP on kernel panics
2024-08-19 10:53:05 +10:00
Raja Grewal
1f51d4eeb2
Add details on user namespaces
2024-08-18 13:53:11 +10:00
Raja Grewal
248e094b8e
Include KSPP compliance notices
2024-08-17 01:06:21 +10:00
Raja Grewal
759aee8150
Provide option to disable user namespaces
2024-08-16 22:54:57 +10:00
Raja Grewal
fae586c3c5
Patch bug in existing rp_filter sysctl
2024-08-16 19:23:48 +10:00
Patrick Schleizer
305467c652
Merge pull request #245 from raja-grewal/blacklist_to_disable
...
Update `/etc/modprobe.d/*`
2024-08-16 04:25:43 -04:00
raja-grewal
81bf7a8f90
Merge branch 'Kicksecure:master' into docs
2024-08-16 16:57:01 +10:00
Patrick Schleizer
ef60c5b153
Merge pull request #249 from raja-grewal/binfmt_misc
...
Disallow registering interpreters for miscellaneous binary formats
2024-08-16 02:43:57 -04:00
Raja Grewal
cea8e75378
Consistent formating
2024-08-16 14:55:22 +10:00
