Commit Graph

57 Commits

Author SHA1 Message Date
c9107bb044 debugging 2023-01-07 16:11:48 -05:00
b7bb24f984 description 2023-01-07 16:09:11 -05:00
7cf51a1b43 Checking job queue instead of dbus 2023-01-06 21:32:57 -05:00
014d10b977 Update cold-boot-attack-defense-kexec-prepare.service 2023-01-06 13:52:09 -05:00
f463750920 Update cold-boot-attack-defense-kexec-prepare.service 2023-01-06 13:48:22 -05:00
73913ea5af Added checks 2023-01-06 12:49:34 -05:00
a7015f4ddf added files 2023-01-06 10:50:34 -05:00
2d37e3a1af copyright 2022-05-20 14:46:38 -04:00
7d73b3ffa0 add hardened malloc compatibility for haveged workaround
`/lib/systemd/system/haveged.service.d/30_security-misc.conf`

`SystemCallFilter=getrandom`

Otherwise haveged will exit with a core dump.
2021-08-17 15:21:26 -04:00
50bdd097df move /usr/lib/security-misc to /usr/libexec/security-misc as per lintian FHS 2021-08-03 12:56:31 -04:00
5a65c35479 port LKRG compatibility settings automation for VirtualBox hosts from systemd to dpkg trigger 2021-08-01 13:11:18 -04:00
257cef24ba add LKRG compatibility settings automation for VirtualBox hosts
https://github.com/openwall/lkrg/issues/82
2021-07-24 18:03:40 -04:00
41734ec523 systemd RemainAfterExit=yes
for better usability

https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/33
2021-04-03 11:44:13 -04:00
a67007f4b7 copyright 2021-03-17 09:45:21 -04:00
8851c9ed29 fix: disable proc-hidepid.service 2020-04-14 12:39:34 -04:00
72be31e870 disable proc-hidepid by default because incompatible with pkexec
and undo pkexec wrapper
2020-04-12 16:48:13 -04:00
2ceea8d1fe update copyright year 2020-04-01 08:49:59 -04:00
a37da1c968 add digits to drop-in file names 2020-01-24 04:39:06 -05:00
9c0d6b6057 copyright 2019-12-29 05:09:07 -05:00
edc08988f2 copyright 2019-12-29 05:08:53 -05:00
9156d3584c Description 2019-12-29 04:59:05 -05:00
3ea946b365 RemainAfterExit=yes 2019-12-29 04:56:51 -05:00
2787ae9765 copyright 2019-12-29 04:56:35 -05:00
6d56eb9ef0 minor 2019-12-29 04:56:18 -05:00
0e14706f32 copyright 2019-12-29 04:45:26 -05:00
617c0a0e15 disable remount-secure.service - Disable for now until development finished / tested. 2019-12-23 07:21:26 -05:00
7f20160477 comment 2019-12-20 05:24:00 -05:00
a135ae9400 use must manually enable permission-hardening.service
until development finished
2019-12-20 05:22:59 -05:00
d80bf036f3 Disable permission hardening now until development finished / tested. 2019-12-09 03:50:43 -05:00
d7e2deae92 Create permission-hardening.service 2019-12-08 16:50:54 +00:00
1227ccd1f7 After=qubes-sysinit.service 2019-12-08 04:37:53 -05:00
2954dcbccf minor 2019-12-06 12:24:55 -05:00
f3647e7478 RemainAfterExit=yes 2019-12-06 12:18:18 -05:00
470cad6e91 remount /home /tmp /dev/shm /run with nosuid,nodev (default) and noexec (opt-in)
https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707
2019-12-06 05:14:02 -05:00
e92022a21c Remove systemd sandboxing 2019-11-16 14:56:28 +00:00
203d5cfa68 copyright 2019-10-31 11:19:44 -04:00
42c1701d5c Whitelist user@.service 2019-10-15 21:00:03 +00:00
c87fc75f2a fix, run remove-system-map.service during sysinit.target 2019-10-05 09:36:21 +00:00
25b6746784 fix systemd unit file proc-hidepid.service: WantedBy=sysinit.target 2019-10-05 09:14:54 +00:00
7345287560 Use sysinit.target instead 2019-10-04 17:32:52 +00:00
e06eeec678 Disable hide-hardware-info.service by default 2019-10-03 21:42:06 +00:00
b06ab912c0 Add licensing 2019-10-03 21:37:29 +00:00
ce97e5ed82 Create hide-hardware-info.service 2019-10-03 20:45:29 +00:00
fbd1a5bde9 hidepid before sysinit.target 2019-09-10 12:23:00 -04:00
932524cbd1 Move disable-coredumps.conf to correct position 2019-07-10 15:28:48 +00:00
f82731698c re-enable PrivateNetwork=true 2019-07-01 14:53:01 +00:00
24cc8e380d comment out proc-hidepid.service hardening for now
since broken in Qubes Debian AppVMs

https://forums.whonix.org/t/kernel-hardening/7296/104
2019-07-01 03:43:02 -04:00
0bffc7a930 Merge remote-tracking branch 'origin/master' 2019-07-01 03:08:26 -04:00
3c176ce158 allow permissions openat mkdir
since required in Qubes Debian templates
2019-07-01 03:07:14 -04:00
b8f2aee905 Add licensing 2019-06-30 13:22:43 +00:00