forked from Kicksecure/security-misc
-
Notifications
You must be signed in to change notification settings - Fork 0
/
changelog.upstream
13584 lines (8994 loc) · 385 KB
/
changelog.upstream
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
commit 0a018bdebca167d671d8bda81a2b0d929d396945
Merge: 57fc487 0b81316
Author: Patrick Schleizer <[email protected]>
Date: Mon Mar 11 10:13:57 2024 -0400
Merge remote-tracking branch 'github-kicksecure/master'
commit 0b8131630041dbd80f1aa61dcedde446208c06f7
Merge: 57fc487 03ed546
Author: Patrick Schleizer <[email protected]>
Date: Mon Mar 11 10:12:46 2024 -0400
Merge pull request #211 from wryMitts/patch-1
Create proc group on install
commit 03ed546cd8992b29855ca1c2748ed988dd3c765d
Author: wryMitts <[email protected]>
Date: Sun Mar 10 16:55:10 2024 -0400
Create proc group on install
Fixes https://github.com/Kicksecure/security-misc/issues/210
commit 57fc487e5e5ffad765f1418236744319cc666871
Author: Patrick Schleizer <[email protected]>
Date: Sun Mar 10 13:19:26 2024 +0000
bumped changelog version
commit a5206bde336c159be065345e7dd5cb86b2b6a27f
Author: Patrick Schleizer <[email protected]>
Date: Sun Mar 10 08:44:53 2024 -0400
`proc-hidepid.service` add `gid=proc`
This allows users that are a member of the `proc` group to be excluded from `hidepid` protections.
https://github.com/Kicksecure/security-misc/issues/208
commit 0f0d9ca2a42cf9fc04e405ae90f3d67bc0794e12
Author: Patrick Schleizer <[email protected]>
Date: Mon Mar 4 11:48:30 2024 +0000
bumped changelog version
commit 6b76373395622bac0e701c6d15c6656658febced
Author: Patrick Schleizer <[email protected]>
Date: Mon Mar 4 06:44:26 2024 -0500
fix panic-on-oops started every 10s in Qubes-Whonix
by changing from a /etc/profile.d etc. related mechanism to start to a systemd unit file based approach
Thanks to @marmarek for the bug report!
https://forums.whonix.org/t/panic-on-oops-started-every-10s/19450
commit af6c6971a741c69a584ba3f92dbfed12e40784dc
Author: Patrick Schleizer <[email protected]>
Date: Mon Mar 4 06:33:51 2024 -0500
comment
commit e013070e0bfc43d006e09ae1c5ae3533f7bebc5f
Author: Patrick Schleizer <[email protected]>
Date: Mon Mar 4 06:33:21 2024 -0500
newline
commit a5cc1774f2fbf6475e7b56601fbcd84a2a63fed0
Author: Patrick Schleizer <[email protected]>
Date: Mon Feb 26 13:32:44 2024 +0000
bumped changelog version
commit 808e72f24bf30b3476ab6b87f96eb636632c195c
Author: Patrick Schleizer <[email protected]>
Date: Mon Feb 26 08:11:26 2024 -0500
use long options
https://github.com/Kicksecure/security-misc/issues/172
commit 2d1d1b246f3fe061d4f817da5cecf46010839e1d
Author: Patrick Schleizer <[email protected]>
Date: Mon Feb 26 08:07:29 2024 -0500
improve output
https://github.com/Kicksecure/security-misc/issues/172
commit d8f5376c4f36f5deb734e6dead42a62566d13480
Author: Patrick Schleizer <[email protected]>
Date: Mon Feb 26 07:58:06 2024 -0500
improve output
https://github.com/Kicksecure/security-misc/issues/172
commit cf84762a3a84d2be3b9510dddb32bdc433170dfa
Author: Patrick Schleizer <[email protected]>
Date: Mon Feb 26 07:52:41 2024 -0500
improve output
https://github.com/Kicksecure/security-misc/issues/172
commit f2958bbfa5e67ee10380a25d996826233469080a
Author: Patrick Schleizer <[email protected]>
Date: Mon Feb 26 07:49:30 2024 -0500
comment
commit bc8f9edc3197e33e75ea1d691834d9abbdcdefd0
Merge: 02d6f67 b23d167
Author: Patrick Schleizer <[email protected]>
Date: Mon Feb 26 07:48:19 2024 -0500
Merge remote-tracking branch 'github-kicksecure/master'
commit b23d167342ef242a1e9d4e91b6a4b945e80c3e7e
Merge: 02d6f67 ef44ece
Author: Patrick Schleizer <[email protected]>
Date: Mon Feb 26 07:46:02 2024 -0500
Merge pull request #204 from DanWin/sysfs-mount
Make /sys hardening optional and allow access to /sys/fs to make polkit work
commit 02d6f67741ef93d9ab39e02ac56b27c551a19dca
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 20:08:17 2024 +0000
bumped changelog version
commit d13d1aa7ec7e9ac9f1aa87e4b36228bfd3af6eb2
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 15:07:53 2024 -0500
comments
commit a1f898e3b317f49a5bb9507c8b9d3bd3c4e23abf
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 19:58:01 2024 +0000
bumped changelog version
commit c3dd178b19be8c078ed6a2f46a072bef3d144c06
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 14:57:50 2024 -0500
output
commit ef44ecea44ee516b1ba92175eb78b2e8143c4502
Author: Daniel Winzen <[email protected]>
Date: Thu Feb 22 16:51:23 2024 +0100
Add option to disabe /sys hardening
commit 3bc1765dbbd333a1d607ab6962281b4d0a5c4b60
Author: Daniel Winzen <[email protected]>
Date: Wed Feb 21 20:37:34 2024 +0100
Allow access to /sys/fs for polkit
commit 6b73e6c2a9ff1efe211e41e005e4ecaa63731d82
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 16:07:16 2024 +0000
bumped changelog version
commit 37a7abdf0c1e6d8179bd09d3c1bd0363e8bc0a96
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 11:07:01 2024 -0500
ConditionKernelCommandLine=!remountsecure=0
commit eb3e0b9292f71a5dba312500508f893779fb1b9c
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 14:52:55 2024 +0000
bumped changelog version
commit c0924321b84874ae7fc72c59fd58e4c4ae8bc6d9
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 09:52:36 2024 -0500
fix systemd unit ExecStart
commit d148a769b7106831c0b27a7ad63d91ab42257678
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 14:50:05 2024 +0000
bumped changelog version
commit 6d7cf3c12a8a772fee1cd893d5504767690b3b77
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 09:49:48 2024 -0500
output
commit f7831db197b2fff33b66eeb44efd749e482315e0
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 09:17:41 2024 -0500
do not exit non-zero if folder does not exist
commit 5bdd7b8475bdfde8dbee5318fb43d0c2a236e3b0
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 09:14:52 2024 -0500
output
commit 44a15cd97da3066e39d2d7df1f456e703036a6e9
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 09:13:56 2024 -0500
mount --make-private
https://github.com/Kicksecure/security-misc/issues/172
commit c0f98b05b609c7c8ac6f86e123af9e0642d82697
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 06:03:59 2024 -0500
comment
https://github.com/Kicksecure/security-misc/pull/202
commit 1e1613aa93dca1e7fe7f24dbd32028a0cadd21fd
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 06:02:28 2024 -0500
allow /opt exec as usually optional binaries are placed there such as firefox
https://github.com/Kicksecure/security-misc/pull/202
commit 7c7b4b24b4959f3ef96ff7ef0b11fa4c0bd48c8e
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 06:01:00 2024 -0500
fix home_noexec_maybe -> most_noexec_maybe
https://github.com/Kicksecure/security-misc/pull/202
commit 38783faf60b85c4e855bf78c87e1c07765776b50
Author: Patrick Schleizer <[email protected]>
Date: Thu Feb 22 05:58:53 2024 -0500
add more bind mounts of mount options hardening
as suggested in https://github.com/Kicksecure/security-misc/pull/202
commit ad9d913902d7e696f1114da74d84f9cdcb22bc25
Author: Patrick Schleizer <[email protected]>
Date: Sat Feb 3 18:28:27 2024 +0000
bumped changelog version
commit 02090da08cfd411314ffeeb6df95f73c701f06c6
Merge: 8037ce5 ba13657
Author: Patrick Schleizer <[email protected]>
Date: Sat Feb 3 12:51:07 2024 -0500
Merge remote-tracking branch 'github-kicksecure/master'
commit ba13657d894f2f30d8deb7c08b85e5fbc1dcea21
Merge: 8037ce5 b16c99a
Author: Patrick Schleizer <[email protected]>
Date: Sat Feb 3 12:50:28 2024 -0500
Merge pull request #197 from raja-grewal/mitigations
Additional Explicit CPU Mitigations
commit b16c99ab62a902b1f61b9d4fe63273cd614e757c
Author: raja-grewal <[email protected]>
Date: Mon Jan 29 13:39:40 2024 +0000
Remove hardcoded `spec_rstack_overflow` setting
commit 139b10a9aad85018f87bdc4bb227e938f7955235
Author: raja-grewal <[email protected]>
Date: Mon Jan 29 12:59:13 2024 +0000
Control RAS overflow mitigation on AMD Zen CPUs
commit 6c54e35027e86ec045102cd1d95f84aa30bc55c9
Author: raja-grewal <[email protected]>
Date: Mon Jan 29 12:58:51 2024 +0000
Enable mitigations for RETBleed vulnerability and disable SMT
commit 4509a5fc95204080f2855849d22c7e05393455d9
Author: raja-grewal <[email protected]>
Date: Mon Jan 29 12:58:14 2024 +0000
Enable known mitigations for CPU vulnerabilities and disable SMT
commit 4231155efa0970d2456b67cc89c8828b0766cf7f
Author: raja-grewal <[email protected]>
Date: Mon Jan 29 12:57:48 2024 +0000
Add reference for kernel parameters
commit 8037ce52f96dcc6f8007c1567daf38ff013352d6
Author: Patrick Schleizer <[email protected]>
Date: Thu Jan 25 13:59:29 2024 +0000
bumped changelog version
commit 185bfe749787a8c6e93103ae8c6b0751a169e276
Author: Patrick Schleizer <[email protected]>
Date: Thu Jan 25 06:54:36 2024 -0500
use `interest-noawait` instead of `interest-await`
fixes https://github.com/Kicksecure/security-misc/issues/196
commit 64e41b113cae893d1f27f441f99340389ba8b9b3
Author: Patrick Schleizer <[email protected]>
Date: Thu Jan 18 14:10:51 2024 +0000
bumped changelog version
commit 1855fa08b1386b1ea8697767104e7ad0f1521c9c
Author: Patrick Schleizer <[email protected]>
Date: Thu Jan 18 08:54:39 2024 -0500
readme
commit f0e2a82b558f64611f037424c6f8f12de32737f6
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 17 19:18:25 2024 +0000
bumped changelog version
commit 314e5b490c6864b745fbf5fd6d9bb2c724d478b8
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 17 14:03:09 2024 -0500
use wildcards
instead of outdated, incomplete list
https://github.com/Kicksecure/security-misc/issues/160
commit 08619d6a7307b6ab05a3ba7e71ea33b00db20b27
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 17 13:59:36 2024 -0500
minor RPM updates
https://github.com/Kicksecure/security-misc/issues/160
commit 3048e0ac76e4eba1c53b43ba2424157505578cdd
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 17 13:54:07 2024 -0500
usrmerge
https://github.com/Kicksecure/security-misc/issues/190
commit 5a6cd4c2abd243c91575e9477a921aa290c68ba5
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 17 13:51:30 2024 -0500
remove now empty /bin from copying since it is empty after usrmerge
https://github.com/Kicksecure/security-misc/issues/190
commit 071b984a1eaaa8a8ea6a40e4ee36eabcde2d630d
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 17 13:49:05 2024 -0500
`sort -d`
https://github.com/Kicksecure/security-misc/issues/190
commit 011e55e3e52485ccd728b4bb249efbc816f38806
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 17 13:45:17 2024 -0500
remove duplicates after usrmerge
https://github.com/Kicksecure/security-misc/issues/190
commit 0efee2f50fd38feade7700c2f033cc3d4c200d34
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 17 13:39:56 2024 -0500
usrmerge
fixes https://github.com/Kicksecure/security-misc/issues/190
commit 18a06935e0cca3dc090643aad406d861e4583085
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 17 13:23:20 2024 -0500
run permission hardener when new packages are install files to /usr or /opt
(basically anywhere)
fixes https://github.com/Kicksecure/security-misc/issues/189
commit 66e6371221c3395a0523e30e8ef1a051d3e6cdd0
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 14:26:34 2024 +0000
bumped changelog version
commit 0d78ecaee37536379ad2f230f45904f57425cb19
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 09:26:21 2024 -0500
README
commit 3ba8fe586e1abe133bd41076278f8663aba7e641
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 09:23:54 2024 -0500
update permission-hardener.service
Which is now only an additional opt-in systemd unit,
because permission-hardener is run by default at security-misc
package installation time.
https://github.com/Kicksecure/security-misc/pull/181
commit 186f6015da7b3314c95c2833032c6fe953a71afd
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 14:14:18 2024 +0000
bumped changelog version
commit 6aa55698ab2a0f3771d28293d7ad14da2763a16f
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 09:10:59 2024 -0500
delete legacy folder /etc/permission-hardening.d if empty
https://github.com/Kicksecure/security-misc/pull/181
commit 9cafd78fe21baa3c2a36853f57e0638b2facfe5c
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 09:05:09 2024 -0500
rm_conffile /etc/permission-hardening.d
https://github.com/Kicksecure/security-misc/pull/181
commit fa53848b5cda135fbb8a3855e8508692084fc7e9
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 13:58:55 2024 +0000
bumped changelog version
commit 4f7973bc5628cdc24f5224bd98858249307635d3
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 08:56:26 2024 -0500
comment
commit ed7c09fc46b26440439adf748f597da277a3f1e4
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 08:45:13 2024 -0500
permission-hardening -> permission-hardener migration
mv --verbose /var/lib/permission-hardening /var/lib/permission-hardener
https://github.com/Kicksecure/security-misc/pull/181
commit a90cd43631216f28a18a1b3f066b9f6ef3301ac4
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 08:32:52 2024 -0500
fix postinst for new permission-hardener
https://github.com/Kicksecure/security-misc/pull/181
commit 862bf6b5ab29917138325023eb3507f5fbd5653c
Merge: dc8d9ee bc02c72
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 16 08:19:28 2024 -0500
Merge remote-tracking branch 'ben-grande/clean'
commit dc8d9eece32dec06e63c580c886a240019b3f33e
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 9 05:52:49 2024 +0000
bumped changelog version
commit 1199871d7bbc7316a7e5822d77eee0666b55b203
Author: Patrick Schleizer <[email protected]>
Date: Sun Jan 7 06:37:34 2024 -0500
undo IPv6 privacy due to potential server issues
https://github.com/Kicksecure/security-misc/issues/184
commit 128bb01b35d20e97351dfb53768f35482f9756a2
Author: Patrick Schleizer <[email protected]>
Date: Sun Jan 7 06:36:25 2024 -0500
undo IPv6 privacy due to potential server issues
https://github.com/Kicksecure/security-misc/issues/184
commit df0f9d3267644c4aea87add2dcade86044c496f0
Author: Patrick Schleizer <[email protected]>
Date: Sat Jan 6 09:19:57 2024 -0500
README
commit 86f91e3030ef0b08000fc28a3a172e6a47918e4e
Author: Patrick Schleizer <[email protected]>
Date: Sat Jan 6 09:10:45 2024 -0500
revert umask 027 by default
because broken because this also happens for root while it should not
https://github.com/Kicksecure/security-misc/issues/185
commit 3f1304403fbf04f15dac01963c66f82cd84452d4
Author: Patrick Schleizer <[email protected]>
Date: Sat Jan 6 08:15:31 2024 -0500
disable MAC randomization in Network Manager (NM) because it breaks VirtualBox DHCP
https://github.com/Kicksecure/security-misc/issues/184
commit e8f8dcd0fb1c23a62974849f55516da9dce5948e
Author: Patrick Schleizer <[email protected]>
Date: Thu Jan 4 02:03:26 2024 +0000
bumped changelog version
commit 70a86fa994c0a894643e876fc86226ad0443a741
Merge: db0503e 71060f1
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 3 05:12:48 2024 -0500
Merge remote-tracking branch 'github-kicksecure/master'
commit 71060f1f53ca7a275f10c4b6ab3e6c25585d5440
Merge: db0503e 74afcc9
Author: Patrick Schleizer <[email protected]>
Date: Wed Jan 3 05:00:41 2024 -0500
Merge pull request #182 from raja-grewal/io_uring
Clarify validity of disabling io_uring
commit 74afcc9c63ad064f20778ad2870690925c3cee81
Author: Raja Grewal <[email protected]>
Date: Wed Jan 3 17:52:23 2024 +1100
Clarify validity of disabling io_uring
commit bc02c72018d6458d4c1852dd441287b277421514
Author: Ben Grande <[email protected]>
Date: Tue Jan 2 17:08:45 2024 +0100
Fix unbound variable
- Run messages preceded by INFO;
- Comment unknown unused variables;
- Remove unnecessary variables; and
- Deal with unbound variable due to subshell by writing to a file;
commit db0503e71d5c37865cbb0a01cb8fa00af2a4e574
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 2 14:55:13 2024 +0000
bumped changelog version
commit abf72c2ee4286ec069f75e66acf05a42f3645c89
Author: Ben Grande <[email protected]>
Date: Tue Jan 2 13:34:29 2024 +0100
Rename file permission hardening script
Hardener as the script is the agent that is hardening the file
permissions.
commit f138cf0f78c03e3952801d01d25d5f8065ff1457
Author: Ben Grande <[email protected]>
Date: Tue Jan 2 12:17:16 2024 +0100
Refactor permission-hardener
- Organize comments from default configuration;
- Apply and undo changes from a single file controlled by parameters;
- Arrays should be evaluated as arrays and not normal variables;
- Quote variables;
- Brackets around variables;
- Standardize test cases to "test" command;
- Test against empty or non-empty variables with "-z" and "-n";
- Show a usage message when necessary;
- Require root to run the script with informative message;
- Permit the user to see the help message without running as root;
- Do not create root directories without passing root check;
- Use long options for "set" command;
commit a94f2a3f4626a9292660bc7f98a6513f34d0f5b2
Merge: 94c0e26 8daf97a
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 2 05:30:49 2024 -0500
Merge remote-tracking branch 'github-kicksecure/master'
commit 8daf97ab0181a9cbb9e9dec57f1f00270dbb3a50
Merge: 94c0e26 f055fe5
Author: Patrick Schleizer <[email protected]>
Date: Tue Jan 2 05:29:35 2024 -0500
Merge pull request #178 from raja-grewal/io_uring
Disable asynchronous I/O
commit 94c0e26a082f61f71e89b1fb7386a58166ffa411
Author: Patrick Schleizer <[email protected]>
Date: Fri Dec 29 20:15:50 2023 +0000
bumped changelog version
commit 5b36599c0ce35857239c82459828db1ec4215411
Author: Patrick Schleizer <[email protected]>
Date: Fri Dec 29 14:57:38 2023 -0500
/dev/, /dev/shm, /tmp
https://github.com/Kicksecure/security-misc/issues/157#issuecomment-1869073716
commit e15596e7af6fc645dd652c043397baaa91954915
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 16:28:10 2023 +0000
bumped changelog version
commit f64a869bfdd4c746afd206367885851946deb692
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 11:03:22 2023 -0500
readme
commit c86c83cef760906a0d1c56ee8a8c744b2e07f212
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 10:31:58 2023 -0500
formatting
https://github.com/Kicksecure/security-misc/issues/157
commit 971ff687b1423499c54495a03e5e6fafcbfefb2a
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 10:30:35 2023 -0500
do not mount /dev/cdrom by default
https://github.com/Kicksecure/security-misc/issues/157
commit 9fce67fcd942a7e3e0dd2e874226fcdab5e33ba3
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 10:28:47 2023 -0500
remove superfluous, broken `remount` mount option
https://github.com/Kicksecure/security-misc/issues/157
commit 40fd8cb6081512e2bc0ef1a7a1ee17cd317024c2
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:51:09 2023 -0500
no `nofail` mount option to avoid breaking the boot of a system
unit testing belongs elsewhere
https://github.com/Kicksecure/security-misc/issues/157
commit 4aa645f29ff741b6e5cdf629deade1923fdcc234
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:46:33 2023 -0500
comment
https://github.com/Kicksecure/security-misc/issues/157
commit 2b7aeedb4a543d0a43a35918999338097d13bb16
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:44:51 2023 -0500
mount /dev/cdrom to /mnt/cdrom (instead of /mnt/cdrom0) and
nodev,nosuid,noexec
as per:
https://www.debian.org/doc/manuals/securing-debian-manual/ch04s10.en.html
https://github.com/Kicksecure/security-misc/issues/157
commit 0d9e9780daca563a726470a3a5d6fa8c20487240
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:37:14 2023 -0500
formatting
https://github.com/Kicksecure/security-misc/issues/157
commit 00f9ab43947795c1144d797547968c7c149d6f21
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:36:05 2023 -0500
/dev devtmpfs
https://github.com/Kicksecure/security-misc/issues/157
commit 55709b3aa0acd6cad0c9fedb8782c49fbea79689
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:30:57 2023 -0500
/tmp tmpfs
https://github.com/Kicksecure/security-misc/issues/157
commit b0dd967611c27f5b8e2472bb74a664aead7a229e
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:27:45 2023 -0500
usrmerge
https://github.com/Kicksecure/security-misc/issues/157
commit 269fada14a616c53d7421e88e662f6893eb1fd88
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:25:14 2023 -0500
combine bind lines
https://github.com/Kicksecure/security-misc/issues/157
commit 0810c1ce3c9e19c745b8f0d2cd9410353b172779
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:10:31 2023 -0500
fix bluetooth in readme
fixes https://github.com/Kicksecure/security-misc/issues/180
commit 37b4ab15a823134e616a2a0fe1dda18d5ebfa3c0
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 09:04:10 2023 -0500
readme
commit 79f398d219b9c4cdf8ea0f9e3135a08fa32659a8
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 08:45:20 2023 -0500
formatting
commit c90ada3c398205227d906e2b2108d36d92edcf3c
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 08:37:23 2023 -0500
pandoc -f markdown -t markdown --wrap=auto --columns=80 README.md -o README.md
commit 34bf297bd17af2adf59804bd133a00b7dc1942b7
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 08:32:34 2023 -0500
formatting
commit d5fc9f620169b6975c8d3ef685f47e62cb6b9262
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 25 08:26:03 2023 -0500
improve bluetooth in readme
as suggested by @monsieuremre
https://github.com/Kicksecure/security-misc/issues/180
commit 7fa597deca7ff2b2932a5f5fad56be57bd78b6cf
Author: Patrick Schleizer <[email protected]>
Date: Fri Dec 22 16:31:58 2023 +0000
bumped changelog version
commit f70a034da2b4b615855504e7080baf1a7e7b461c
Author: Patrick Schleizer <[email protected]>
Date: Fri Dec 22 08:31:58 2023 -0500
exclude hardened malloc from SUID disabler
fixes https://github.com/Kicksecure/security-misc/issues/179
commit f055fe5da2219b68f46c3c577d79fcfd7e79cfc6
Author: Raja Grewal <[email protected]>
Date: Fri Dec 15 08:33:36 2023 +0000
Disable asynchronous I/O
io_uring creation is disabled for all processes. io_uring_setup always fails with -EPERM. Existing io_uring instances can still be used.
commit 99f2edd4f685cdc9a47b32107125408e12a294c2
Author: Patrick Schleizer <[email protected]>
Date: Tue Dec 12 16:51:21 2023 +0000
bumped changelog version
commit 039de1dc9bd6f3cc6595d66f54d0d88d9b537b17
Author: Patrick Schleizer <[email protected]>
Date: Tue Dec 12 11:50:11 2023 -0500
add hardened fstab `/usr/share/doc/security-misc/fstab-vm`
to the documentation folder as an example
not directly used by security-misc
will later be used by Kicksecure VM build process
https://github.com/Kicksecure/security-misc/issues/157
commit dcaafa6c8bf380dd990942e9c10e280943b442a6
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 17:06:45 2023 +0000
bumped changelog version
commit 5a73817a9575fe5bcaf3fd354e5f175db7d45ba4
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 11:38:49 2023 -0500
move to `/usr/lib/issue.d/20_security-misc.issue`
https://github.com/Kicksecure/security-misc/pull/167
commit dfaea492c76a277b9cbe84982a135cb4f03a557c
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 11:37:02 2023 -0500
remove `etc/issue.net.d/20_security-misc`
since not mentioned on debian.org
commit 69c895af09f05000ace5f273f3e5032aabf8c64e
Merge: c9ea7a4 36850f8
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 11:27:53 2023 -0500
Merge remote-tracking branch 'github-kicksecure/master'
commit 36850f89fb07678ca24eb580a18247e593eac608
Merge: c9ea7a4 0d7af97
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 11:27:16 2023 -0500
Merge pull request #167 from monsieuremre/patch-4
Non-Identifiable and Generic Issue Banners that include the Recommended Keywords
commit c9ea7a4dca6e985c3a1044a3b4ddda83909fbc51
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 11:02:55 2023 -0500
use `amd_iommu=force_isolation` instead of `amd_iommu=force_enable`
because we set `iommu=force` already anyhow
fixes https://github.com/Kicksecure/security-misc/issues/175
commit e83c1d7ed662bb0533c670dd5b7a6745a75e9ca4
Merge: c4e21ca befd21e
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 11:01:02 2023 -0500
Merge remote-tracking branch 'github-kicksecure/master'
commit befd21e0c0c38eaf91c7096e9f60120f533a5842
Merge: c4e21ca f2ad838
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 11:00:29 2023 -0500
Merge pull request #176 from monsieuremre/patch-1
Iommu Kernel Parameters
commit c4e21ca5f49fbc2d67853eebca647539acbca815
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 10:58:16 2023 -0500
added development philosophy
https://github.com/Kicksecure/security-misc/issues/154
commit feab1432f9d0966118ca233c9f88270b98c3f120
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 10:48:27 2023 -0500
clarify scope
https://github.com/Kicksecure/security-misc/issues/154
commit dc04040cb3644c9e3be9b44a34da4a5f7b61f2cc
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 10:36:48 2023 -0500
typo
commit 2634dbff2bd9d7482e7b02be2b5b6fa1c58ef6c7
Author: Patrick Schleizer <[email protected]>
Date: Mon Dec 4 10:36:21 2023 -0500
shuffle
commit f2ad8383cfea4bba42e8b246b05b85101d707641
Author: monsieuremre <[email protected]>
Date: Sun Dec 3 19:51:38 2023 +0000
fix
commit dd15823a97e953750d7a8288c7d3b8d5f554d6f9
Author: monsieuremre <[email protected]>
Date: Sun Dec 3 19:50:07 2023 +0000
undo superfluousness
commit 83e13bb62d028cfeea7a4d3f3def3bff8d2b5eaa
Author: monsieuremre <[email protected]>
Date: Sun Dec 3 19:42:34 2023 +0000
Update 40_enable_iommu.cfg
commit 0d7af9707f802fb600d9eb39bbe0b3bd4a65e3b0
Author: monsieuremre <[email protected]>
Date: Sun Dec 3 19:31:12 2023 +0000
Update 20_security-misc
commit 04d27a10b0cd1c22cb166c9fccb93a09d5f388f0
Author: monsieuremre <[email protected]>
Date: Sun Dec 3 19:30:55 2023 +0000
Update 20_security-misc
commit 7963f811e1bb6f5e0e2ba41e96b14e4a3a70f847
Merge: c8b9f5a 82bd913
Author: monsieuremre <[email protected]>
Date: Sun Dec 3 19:30:22 2023 +0000
Merge branch 'Kicksecure:master' into patch-4
commit 82bd9138de750a3590be9c91c898cbd04c550e7e
Author: Patrick Schleizer <[email protected]>
Date: Mon Nov 20 13:13:10 2023 +0000
bumped changelog version
commit c2b3ff5243c69c4e1ba28e9966bf0ffd3ce550ce
Author: Patrick Schleizer <[email protected]>
Date: Mon Nov 20 04:40:28 2023 -0500
moved libpam-tmpdir dependency to kicksecure-meta-packages
https://github.com/Kicksecure/security-misc/pull/147
commit c8b9f5a917e6c415575d6763a65930f1a91a7c78
Author: monsieuremre <[email protected]>
Date: Sat Nov 18 10:03:19 2023 +0000
net
commit 3b614f3753608bd62ff6bc6e56e15f280994c646
Author: monsieuremre <[email protected]>
Date: Sat Nov 18 10:02:16 2023 +0000
20_security-misc
commit 4e4df5dd7c6b5cf1deb179a2c3f8fe7a8844884d
Author: Patrick Schleizer <[email protected]>
Date: Sat Nov 11 22:29:57 2023 +0000
bumped changelog version
commit a51674410cb8a7ac2119ea7c85f986223ce8fc25
Author: Patrick Schleizer <[email protected]>
Date: Sat Nov 11 17:29:37 2023 -0500
fix
commit 8d58077d68e6363313cdc62f7fac14840f5d9a8e
Author: Patrick Schleizer <[email protected]>
Date: Sat Nov 11 20:22:34 2023 +0000
bumped changelog version