d220bb3bc4
suid /usr/lib/chromium/chrome-sandbox whitelist
2019-12-20 13:07:01 -05:00
77b3dd5d6b
comments
2019-12-20 13:02:33 -05:00
d7bd477e73
add "/usr/lib/xorg/Xorg.wrap whitelist"
...
until this is researched
https://manpages.debian.org/buster/xserver-xorg-legacy/Xorg.wrap.1.en.html
https://lwn.net/Articles/590315/
2019-12-20 12:59:27 -05:00
17e8605119
add matchwhitelist feature
...
add "/usr/lib/virtualbox/ matchwhitelist"
2019-12-20 12:57:24 -05:00
3fab387669
suid /usr/bin/firejail whitelist
...
There is a controversy about firejail but those who choose to install it
should be able to use it.
https://www.whonix.org/wiki/Dev/Firejail#Security
2019-12-20 12:50:35 -05:00
d3f16a5bf4
sgid /usr/lib/qubes/qfile-unpacker whitelist
2019-12-20 12:47:10 -05:00
508ec0c6fa
comment
2019-12-20 12:34:07 -05:00
1b569ea790
comment
2019-12-20 12:32:36 -05:00
e28da89253
/bin/sudo whitelist / /bin/bwrap whitelist
2019-12-20 09:48:06 -05:00
6d30e3b4a2
do not remove suid from whitelisted binaries ever
...
https://forums.whonix.org/t/permission-hardening/8655/13
2019-12-20 08:13:23 -05:00
48fe7312bf
update config
2019-12-20 05:57:41 -05:00
87d820d84c
comment
2019-12-20 05:54:16 -05:00
46466c12ad
parse drop-in config folder rather than only one config file
2019-12-20 05:49:11 -05:00
6c8127e3cd
remove "/lib/ nosuid" from permission hardening
...
Takes 1 minute to parse. No SUID binaries there by default.
remount-secure mounts it with nosuid anyhow.
Therefore no processing it here.
2019-12-20 05:29:37 -05:00
788a2c1ba3
comment
2019-12-20 03:45:01 -05:00
9df7407286
Remove SUID bits
2019-12-19 17:01:33 +00:00
729fa26eca
use pam_acccess only for /etc/pam.d/login
...
remove "Allow members of group 'ssh' to login."
remove "+:ssh:ALL EXCEPT LOCAL"
2019-12-12 09:00:08 -05:00
6c564f6e95
Create permission-hardening.conf
2019-12-08 16:50:11 +00:00
9432d16378
/usr/bin/cat mrix,
2019-12-07 12:13:42 -05:00
c1800b13fe
separate group "ssh" for incoming ssh console permission
...
Thanks to @madaidan
https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/16
2019-12-07 11:26:39 -05:00
8636d2f629
add securetty
2019-12-07 06:51:10 -05:00
8b3f5a555b
add console lockdown to pam info output
2019-12-07 06:25:45 -05:00
021b06dac9
add hvc0 to hvc9
2019-12-07 06:04:45 -05:00
8a59662a44
comment
2019-12-07 06:02:45 -05:00
cda6724755
add pts/0 to pts/9
2019-12-07 05:56:57 -05:00
218cbddba9
comment
2019-12-07 05:52:06 -05:00
6479c883bf
Console Lockdown.
...
Allow members of group 'console' to use tty1 to tty7. Everyone else except
members of group 'console-unrestricted' are restricted from using console
using ancient, unpopular login methods such as using /bin/login over networks,
which might be exploitable. (CVE-2001-0797)
Not enabled by default in this package since this package does not know which
users shall be added to group 'console'.
In new Whonix builds, user 'user" will be added to group 'console' and
pam console-lockdown enabled by package anon-base-files.
/usr/share/pam-configs/console-lockdown
/etc/security/access-security-misc.conf
https://forums.whonix.org/t/etc-security-hardening/8592
2019-12-07 05:40:20 -05:00
8cf5ed990a
comment
2019-12-05 15:52:24 -05:00
30289c68c2
Enable reverse path filtering
2019-12-05 20:13:10 +00:00
0c25a96b59
description / comments
2019-12-03 02:18:32 -05:00
5da2a27bf0
Distrust the CPU for initial entropy
2019-12-02 16:43:00 +00:00
d9d6d07714
/dev/pts/[0-9]* rw,
2019-11-26 17:12:12 +00:00
d32024a3da
/usr/sbin/pam_tally2 mrix,
...
https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/152
2019-11-23 05:53:19 -05:00
81e4f580af
etc/apparmor.d/usr.lib.security-misc.permission-lockdown: /usr/bin/chmod mrix,
2019-11-19 15:29:02 +00:00
477d476bb1
etc/apparmor.d/usr.lib.security-misc.pam_tally2-info: add '#include <abstractions/base>'
2019-11-10 08:29:44 -05:00
11dc23bf08
etc/apparmor.d/usr.lib.security-misc.permission-lockdown: add '#include <abstractions/base>'
2019-11-10 08:28:32 -05:00
9f2932faab
/usr/bin/id rix,
2019-11-09 13:32:21 -05:00
94d40c68d4
do not set kernel boot parameter page_poison=1 in Qubes since does not work
...
https://github.com/QubesOS/qubes-issues/issues/5212#issuecomment-533873012
2019-11-05 10:02:55 -05:00
f57702c158
comments; copyright
2019-11-05 09:55:43 -05:00
b55c2fd62e
Enables punycode (network.IDN_show_punycode) by default in Thunderbird
...
to make phising attacks more difficult. Fixing URL not showing real Domain
Name (Homograph attack).
https://forums.whonix.org/t/enable-network-idn-show-punycode-by-default-in-thunderbird-to-fix-url-not-showing-real-domain-name-homograph-attack-punycode/8415
2019-11-03 02:50:51 -05:00
e1375802eb
apparmor fix
...
https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/67
2019-10-31 16:32:28 +00:00
203d5cfa68
copyright
2019-10-31 11:19:44 -04:00
0e49bdc45f
Licensing
2019-10-28 14:26:14 +00:00
5d5ad92638
Licensing
2019-10-28 14:26:05 +00:00
1b8b3610b1
Create usr.lib.security-misc.pam_tally2-info
2019-10-28 14:20:59 +00:00
29b05546e4
Create usr.lib.security-misc.permission-lockdown
2019-10-28 14:20:08 +00:00
40707e70db
Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with hidepid.
...
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040
https://forums.whonix.org/t/cannot-use-pkexec/8129
Thanks to AnonymousUser for the bug report!
2019-10-21 05:46:49 -04:00
0b8725306f
renamed: etc/hide-hardware-info.d/30_whitelist.conf -> etc/hide-hardware-info.d/30_default.conf
2019-10-17 06:13:44 -04:00
8a42c5b023
Merge pull request #34 from madaidan/whitelist
...
Add a whitelist for /sys and /proc/cpuinfo
2019-10-17 09:59:12 +00:00
4f5b7816ec
Elaborate
2019-10-16 19:01:49 +00:00
