{"id":20677562,"url":"https://github.com/kicksecure/security-misc","last_synced_at":"2025-05-15T12:06:52.854Z","repository":{"id":38241473,"uuid":"48019158","full_name":"Kicksecure/security-misc","owner":"Kicksecure","description":"Kernel Hardening; Protect Linux User Accounts against Brute Force Attacks; Improve Entropy Collection; Strong Linux User Account Separation; Enhances Misc Security Settings - https://www.kicksecure.com/wiki/Security-misc","archived":false,"fork":false,"pushed_at":"2025-04-25T08:19:45.000Z","size":5040,"stargazers_count":533,"open_issues_count":29,"forks_count":50,"subscribers_count":24,"default_branch":"master","last_synced_at":"2025-04-25T09:31:37.887Z","etag":null,"topics":["kernel-hardening","kspp","security"],"latest_commit_sha":null,"homepage":"https://www.kicksecure.com/wiki/Impressum","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Kicksecure.png","metadata":{"files":{"readme":"README.md","changelog":"changelog.upstream","contributing":"CONTRIBUTING.md","funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2015-12-15T04:14:52.000Z","updated_at":"2025-04-25T08:19:49.000Z","dependencies_parsed_at":"2023-11-11T21:24:47.989Z","dependency_job_id":"0d8a7cea-8fbf-419e-b357-6dc09c986c44","html_url":"https://github.com/Kicksecure/security-misc","commit_stats":null,"previous_names":[],"tags_count":444,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kicksecure%2Fsecurity-misc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kicksecure%2Fsecurity-misc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kicksecure%2Fsecurity-misc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kicksecure%2Fsecurity-misc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Kicksecure","download_url":"https://codeload.github.com/Kicksecure/security-misc/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254337613,"owners_count":22054253,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kernel-hardening","kspp","security"],"created_at":"2024-11-16T21:16:19.965Z","updated_at":"2025-05-15T12:06:47.836Z","avatar_url":"https://github.com/Kicksecure.png","language":"Shell","readme":"# Enhances miscellaneous security settings\n\n## Kernel hardening\n\nThis section is inspired by the Kernel Self Protection Project (KSPP). It\nattempts to implement all recommended Linux kernel settings by the KSPP and\nmany more sources.\n\n- https://kspp.github.io/Recommended_Settings\n- https://github.com/KSPP/kspp.github.io\n\n### sysctl\n\nsysctl settings are configured via the `/usr/lib/sysctl.d/990-security-misc.conf`\nconfiguration file and significant hardening is applied to a myriad of components.\n\n#### Kernel space\n\n- Restrict access to kernel addresses through the use of kernel pointers regardless\n  of user privileges.\n\n- Restrict access to the kernel logs to `CAP_SYSLOG` as they often contain\n  sensitive information.\n\n- Prevent kernel information leaks in the console during boot.\n\n- Restrict usage of `bpf()` to `CAP_BPF` to prevent the loading of BPF programs\n  by unprivileged users.\n\n- Restrict loading TTY line disciplines to `CAP_SYS_MODULE`.\n\n- Restrict the `userfaultfd()` syscall to `CAP_SYS_PTRACE`, which reduces the\n  likelihood of use-after-free exploits.\n\n- Disable `kexec` as it can be used to replace the running kernel.\n\n- Entirely disable the SysRq key so that the Secure Attention Key (SAK)\n  can no longer be utilized. See [documentation](https://www.kicksecure.com/wiki/SysRq).\n\n- Optional - Disable all use of user namespaces.\n\n- Optional - Restrict user namespaces to `CAP_SYS_ADMIN` as they can lead to substantial\n  privilege escalation.\n\n- Restrict kernel profiling and the performance events system to `CAP_PERFMON`.\n\n- Force the kernel to panic on both \"oopses\", which can potentially indicate and thwart\n  certain kernel exploitation attempts, and also kernel warnings in the `WARN()` path.\n\n- Optional - Force immediate reboot on the occurrence of a single kernel panic and also\n  (when using Linux kernel \u003e= 6.2) limit the number of allowed panics to one.\n\n- Disable the use of legacy TIOCSTI operations which can be used to inject keypresses.\n\n- Disable asynchronous I/O (when using Linux kernel \u003e= 6.6) as `io_uring` has been\n  the source of numerous kernel exploits.\n\n#### User space\n\n- Restrict usage of `ptrace()` to only processes with `CAP_SYS_PTRACE` as it\n  enables programs to inspect and modify other active processes. Optional - Disable\n  usage of `ptrace()` by all processes.\n\n- Maximize the bits of entropy used for mmap ASLR across all CPU architectures.\n\n- Prevent hardlink and symlink TOCTOU races in world-writable directories.\n\n- Disallow unintentional writes to files in world-writable directories unless\n  they are owned by the directory owner to mitigate some data spoofing attacks.\n\n- Randomize the addresses (ASLR) for mmap base, stack, VDSO pages, and heap.\n\n- Raise the minimum address a process can request for memory mapping to 64KB to\n  protect against kernel null pointer dereference vulnerabilities.\n\n- Increase the maximum number of memory map areas a process is able to utilize to 1,048,576.\n\n- Optional - Disallow registering interpreters for various (miscellaneous) binary formats based\n  on a magic number or their file extension to prevent unintended code execution.\n  See issue: https://github.com/Kicksecure/security-misc/issues/267\n\n#### Core dumps\n\n- Disable core dump files and prevent their creation. If core dump files are\n  enabled, they will be named based on `core.PID` instead of the default `core`.\n\n#### Swap space\n\n- Limit the copying of potentially sensitive content in memory to the swap device.\n\n#### Networking\n\n- Enable hardening of the BPF JIT compiler protect against JIT spraying.\n\n- Enable TCP SYN cookie protection to assist against SYN flood attacks.\n\n- Protect against TCP time-wait assassination hazards.\n\n- Enable reverse path filtering (source validation) of packets received\n  from all interfaces to prevent IP spoofing.\n\n- Disable ICMP redirect acceptance and redirect sending messages to prevent\n  man-in-the-middle attacks and minimize information disclosure.\n\n- Deny sending and receiving shared media redirects to reduce the risk of IP\n  spoofing attacks.\n\n- Enable ARP filtering to mitigate some ARP spoofing and ARP cache poisoning attacks.\n\n- Respond to ARP requests only if the target IP address is  on-link,\n  preventing some IP spoofing attacks.\n\n- Drop gratuitous ARP packets to prevent ARP cache poisoning via\n  man-in-the-middle and denial-of-service attacks.\n\n- Ignore ICMP echo requests to prevent clock fingerprinting and Smurf attacks.\n\n- Ignore bogus ICMP error responses.\n\n- Disable source routing which allows users to redirect network traffic that\n  can result in man-in-the-middle attacks.\n\n- Do not accept IPv6 router advertisements and solicitations.\n\n- Optional - Disable SACK and DSACK as they have historically been a known\n  vector for exploitation.\n\n- Disable TCP timestamps as they can allow detecting the system time.\n\n- Optional - Log packets with impossible source or destination addresses to\n  enable further inspection and analysis.\n\n- Optional - Enable IPv6 Privacy Extensions.\n\n- Documentation: https://www.kicksecure.com/wiki/Networking\n\n### Boot parameters\n\nMitigations for known CPU vulnerabilities are enabled in their strictest form\nand simultaneous multithreading (SMT) is disabled. See the\n`/etc/default/grub.d/40_cpu_mitigations.cfg` configuration file.\n\nNote, to achieve complete protection for known CPU vulnerabilities, the latest\nsecurity microcode (BIOS/UEFI) updates must be installed on the system. Furthermore,\nif using Secure Boot, the Secure Boot Forbidden Signature Database (DBX) must be kept\nup to date through [UEFI Revocation List](https://uefi.org/revocationlistfile) updates.\n\nCPU mitigations:\n\n- Disable Simultaneous Multithreading (SMT)\n\n- Spectre Side Channels (BTI and BHI)\n\n- Speculative Store Bypass (SSB)\n\n- L1 Terminal Fault (L1TF)\n\n- Microarchitectural Data Sampling (MDS)\n\n- TSX Asynchronous Abort (TAA)\n\n- iTLB Multihit\n\n- Special Register Buffer Data Sampling (SRBDS)\n\n- L1D Flushing\n\n- Processor MMIO Stale Data\n\n- Arbitrary Speculative Code Execution with Return Instructions (Retbleed)\n\n- Cross-Thread Return Address Predictions\n\n- Speculative Return Stack Overflow (SRSO)\n\n- Gather Data Sampling (GDS)\n\n- Register File Data Sampling (RFDS)\n\nBoot parameters relating to kernel hardening, DMA mitigations, and entropy\ngeneration are outlined in the `/etc/default/grub.d/40_kernel_hardening.cfg`\nconfiguration file.\n\nKernel space:\n\n- Disable merging of slabs with similar size, which reduces the risk of\n  triggering heap overflows and limits influencing slab cache layout.\n\n- Enable sanity checks and red zoning via slab debugging. This will implicitly\n  disable kernel pointer hashing, leaking very sensitive information to root.\n\n- Enable memory zeroing at both allocation and free time, which mitigates some\n  use-after-free vulnerabilities by erasing sensitive information in memory.\n\n- Enable the kernel page allocator to randomize free lists to limit some data\n  exfiltration and ROP attacks, especially during the early boot process.\n\n- Enable kernel page table isolation to increase KASLR effectiveness and also\n  mitigate the Meltdown CPU vulnerability.\n\n- Enable randomization of the kernel stack offset on syscall entries to harden\n  against memory corruption attacks.\n\n- Disable vsyscalls as they are vulnerable to ROP attacks and have now been\n  replaced by vDSO.\n\n- Restrict access to debugfs by not registering the file system since it can\n  contain sensitive information.\n\n- Force kernel panics on \"oopses\" to potentially indicate and thwart certain\n  kernel exploitation attempts.\n\n- Optional - Modify the machine check exception handler.\n\n- Prevent sensitive kernel information leaks in the console during boot.\n\n- Enable the kernel Electric-Fence sampling-based memory safety error detector\n  which can identify heap out-of-bounds access, use-after-free, and invalid-free errors.\n\n- Disable 32-bit vDSO mappings as they are a legacy compatibility feature.\n\n- Optional - Use kCFI as the default CFI implementation (when using Linux kernel \u003e= 6.2)\n  since it may be slightly more resilient to attacks that are able to write\n  arbitrary executables in memory.\n\n- Optional - Disable support for all x86 processes and syscalls (when using Linux kernel \u003e= 6.7)\n  to reduce attack surface.\n\nDirect memory access:\n\n- Enable strict IOMMU translation to protect against some DMA attacks via the use\n  of both CPU manufacturer-specific drivers and kernel settings.\n\n- Clear the busmaster bit on all PCI bridges during the EFI hand-off, which disables\n  DMA before the IOMMU is configured. May cause boot failure on certain hardware.\n\nEntropy:\n\n- Do not credit the CPU or bootloader as entropy sources at boot in order to\n  maximize the absolute quantity of entropy in the combined pool.\n\n- Obtain more entropy at boot from RAM as the runtime memory allocator is\n  being initialized.\n\nNetworking:\n\n- Optional - Disable the entire IPv6 stack to reduce attack surface.\n\n### mmap ASLR\n\n- The bits of entropy used for mmap ASLR for all CPU architectures are maxed\n  out via `/usr/libexec/security-misc/mmap-rnd-bits` (set to the values of\n  `CONFIG_ARCH_MMAP_RND_BITS_MAX` and `CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX`\n  that the kernel was built with), therefore improving its effectiveness.\n\n### Kernel Self Protection Project (KSPP) compliance status\n\n**Summary:**\n\n`security-misc` is in full compliance with KSPP recommendations wherever feasible. However,\nthere are a few cases of partial or non-compliance due to technical limitations.\n\n* [KSPP Recommended Settings](https://kspp.github.io/Recommended_Settings)\n\n**Full compliance:**\n\nMore than 30 kernel boot parameters and over 30 sysctl settings are fully aligned with\nthe KSPP's recommendations.\n\n**Partial compliance:**\n\n1. `sysctl kernel.yama.ptrace_scope=3`\n\nCompletely disables `ptrace()`. Can be enabled easily if needed.\n\n* [security-misc pull request #242](https://github.com/Kicksecure/security-misc/pull/242)\n\n2. `sysctl kernel.panic=-1`\n\nForces an immediate reboot on kernel panic. This can be enabled, but it may lead to unexpected\nsystem crashes.\n\n* [security-misc pull request #264](https://github.com/Kicksecure/security-misc/pull/264)\n* [security-misc pull request #268](https://github.com/Kicksecure/security-misc/pull/268)\n\n**Non-compliance:**\n\n3. `sysctl user.max_user_namespaces=0`\n\nDisables user namespaces entirely. Not recommended due to the potential for widespread breakages.\n\n* [security-misc pull request #263](https://github.com/Kicksecure/security-misc/pull/263)\n\n4. `sysctl fs.binfmt_misc.status=0`\n\nDisables the registration of interpreters for miscellaneous binary formats. Currently not\nfeasible due to compatibility issues with Firefox.\n\n* [security-misc pull request #249](https://github.com/Kicksecure/security-misc/pull/249)\n* [security-misc issue #267](https://github.com/Kicksecure/security-misc/issues/267)\n\n### Kernel Modules\n\n#### Kernel Module Signature Verification\n\nNot yet implemented due to issues:\n\n- https://forums.whonix.org/t/enforce-kernel-module-software-signature-verification-module-signing-disallow-kernel-module-loading-by-default/7880/64\n- https://github.com/dell/dkms/issues/359\n\nSee:\n\n- `/etc/default/grub.d/40_signed_modules.cfg`\n\n#### Disables the loading of new modules to the kernel after the fact\n\nNot yet implemented due to issues:\n\n- https://github.com/Kicksecure/security-misc/pull/152\n\nA systemd service dynamically sets the kernel parameter `modules_disabled` to 1,\npreventing new modules from being loaded. Since this isn't configured directly\nwithin systemctl, it does not break the loading of legitimate and necessary\nmodules for the user, like drivers etc., given they are plugged in on startup.\n\n#### Blacklist and disable kernel modules\n\nConntrack: Deactivates Netfilter's connection tracking helper module which\nincreases kernel attack surface by enabling superfluous functionality such\nas IRC parsing in the kernel. See `/etc/modprobe.d/30_security-misc_conntrack.conf`.\n\nCertain kernel modules are blacklisted by default to reduce attack surface via\n`/etc/modprobe.d/30_security-misc_blacklist.conf`. Blacklisting prevents kernel\nmodules from automatically starting.\n\n- CD-ROM/DVD: Blacklist modules required for CD-ROM/DVD devices.\n\n- Miscellaneous: Blacklist an assortment of other modules to prevent them from\n  automatically loading.\n\nSpecific kernel modules are entirely disabled to reduce attack surface via\n`/etc/modprobe.d/30_security-misc_disable.conf`. Disabling prohibits kernel\nmodules from starting. This approach should not be considered comprehensive;\nrather, it is a form of badness enumeration. Any potential candidates for future\ndisabling should first be blacklisted for a suitable amount of time.\n\nHardware modules:\n\n- Optional - Bluetooth: Disabled to reduce attack surface.\n\n- FireWire (IEEE 1394): Disabled as they are often vulnerable to DMA attacks.\n\n- GPS: Disable GPS-related modules such as those required for Global Navigation\n  Satellite Systems (GNSS).\n\n- Optional - Intel Management Engine (ME): Provides some disabling of the interface\n  between the Intel ME and the OS. May lead to breakages in places such as firmware\n  updates, security, power management, display, and DRM. See discussion: https://github.com/Kicksecure/security-misc/issues/239\n\n- Intel Platform Monitoring Technology (PMT) Telemetry: Disable some functionality\n  of the Intel PMT components.\n\n- Thunderbolt: Disabled as they are often vulnerable to DMA attacks.\n\nFile system modules:\n\n- File Systems: Disable uncommon and legacy file systems.\n\n- Network File Systems: Disable uncommon and legacy network file systems.\n\nNetworking modules:\n\n- Network Protocols: A wide array of uncommon and legacy network protocols and drivers\n  are disabled.\n\nMiscellaneous modules:\n\n- Amateur Radios: Disabled to reduce attack surface.\n\n- Optional - CPU MSRs: Disabled as can be abused to write to arbitrary memory.\n\n- Floppy Disks: Disabled to reduce attack surface.\n\n- Framebuffer (fbdev): Disabled as these drivers are well-known to be buggy, cause\n  kernel panics, and are generally only used by legacy devices.\n\n- Replaced Modules: Disabled legacy drivers that have been entirely replaced and\n  superseded by newer drivers.\n\n- Optional - USB Video Device Class: Disables the USB-based video streaming driver for\n  devices like some webcams and digital camcorders.\n\n- Vivid: Disabled to reduce attack surface given previous vulnerabilities.\n\n### Other\n\n- A systemd service clears the System.map file on boot as these contain kernel\n  pointers. The file is completely overwritten with zeroes to ensure it cannot\n  be recovered. See:\n\n`/etc/kernel/postinst.d/30_remove-system-map`\n\n`/lib/systemd/system/remove-system-map.service`\n\n`/usr/libexec/security-misc/remove-system.map`\n\n- Coredumps are disabled as they may contain important information such as\n  encryption keys or passwords. See:\n\n`/etc/security/limits.d/30_security-misc.conf`\n\n`/etc/sysctl.d/30_security-misc.conf`\n\n`/lib/systemd/coredump.conf.d/30_security-misc.conf`\n\n- An initramfs hook sets the sysctl values in `/etc/sysctl.conf` and\n  `/etc/sysctl.d` before init is executed so sysctl hardening is enabled as\n  early as possible. This is implemented for `initramfs-tools` only because\n  this is not needed for `dracut` as `dracut` does that by default, at\n  least on `systemd` enabled systems. Not researched for non-`systemd` systems\n  by the author of this part of the readme.\n\n## Network hardening\n\nNot yet implemented due to issues:\n\n- https://github.com/Kicksecure/security-misc/pull/145\n\n- https://github.com/Kicksecure/security-misc/issues/184\n\n- Unlike version 4, IPv6 addresses can provide information not only about the\n  originating network but also the originating device. We prevent this from\n  happening by enabling the respective privacy extensions for IPv6.\n\n- In addition, we deny the capability to track the originating device in the\n  network at all, by using randomized MAC addresses per connection by\n  default.\n\nSee:\n\n- `/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf`\n- `/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf`\n- `/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf`\n\n## Bluetooth Hardening\n\n### Bluetooth Status: Enabled but Defaulted to Off\n\n- **Default Behavior**: Although Bluetooth capability is 'enabled' in the kernel,\n  security-misc deviates from the usual behavior by starting with Bluetooth\n  turned off at system start. This setting remains until the user explicitly opts\n  to activate Bluetooth.\n\n- **User Control**: Users have the freedom to easily switch Bluetooth on and off\n  in the usual way, exercising their own discretion. This can be done via the\n  Bluetooth toggle through the usual way, that is either through GUI settings\n  application or command line commands.\n\n- **Enhanced Privacy Settings**: We enforce more private defaults for Bluetooth\n  connections. This includes the use of private addresses and strict timeout\n  settings for discoverability and visibility.\n\n- **Security Considerations**: Despite these measures, it's important to note that\n  Bluetooth technology, by its nature, may still be prone to exploits due to its\n  history of security vulnerabilities. Thus, we recommend users to opt-out of\n  using Bluetooth when possible.\n\n### Configuration Details\n\n- See configuration: `/etc/bluetooth/30_security-misc.conf`\n- For more information and discussion: [GitHub Pull Request](https://github.com/Kicksecure/security-misc/pull/145)\n\n### Understanding Bluetooth Terms\n\n- **Disabling Bluetooth**: This means the absence of the Bluetooth kernel module.\n  When disabled, Bluetooth is non-existent in the system - it cannot be seen, set,\n  configured, or interacted with in any way.\n\n- **Turning Bluetooth On/Off**: This refers to a software toggle. Normally, on\n  Debian systems, Bluetooth is 'on' when the system boots up. It actively searches\n  for known devices to auto-connect and may be discoverable or visible under certain\n  conditions. Our default ensures that Bluetooth is off on startup. However, it\n  remains 'enabled' in the kernel, meaning the kernel can use the Bluetooth protocol\n  and has the necessary modules.\n\n### Quick Toggle Guide\n\n- **Turning Bluetooth On**: Simply click the Bluetooth button in the settings\n  application or on the tray, and switch the toggle. It's a straightforward action\n  that can be completed in less than a second.\n\n- **Turning Bluetooth Off**: Follow the same procedure as turning it on but switch\n  the toggle to the off position.\n\n## Entropy collection improvements\n\n- The `jitterentropy_rng` kernel module is loaded as early as possible during\n  boot to gather more entropy via the\n  `/usr/lib/modules-load.d/30_security-misc.conf` configuration file.\n\n- Distrusts the CPU for initial entropy at boot as it is not possible to\n  audit, may contain weaknesses or a backdoor. Similarly, do not credit the\n  bootloader seed for initial entropy. For references, see:\n  `/etc/default/grub.d/40_kernel_hardening.cfg`\n\n- Gathers more entropy during boot if using the linux-hardened kernel patch.\n\n## Restrictive mount options\n\nA systemd service is triggered on boot to remount all sensitive partitions and\ndirectories with significantly more secure hardened mount options. Since this\nwould require manual tuning for a given specific system, we handle it by\ncreating a very solid configuration file for that very system on package\ninstallation.\n\nNot enabled by default yet. In development. Help welcome.\n\n- https://www.kicksecure.com/wiki/Dev/remount-secure\n- https://github.com/Kicksecure/security-misc/issues/157\n- https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/\n\n## Root access restrictions\n\n- `su` is restricted to only users within the group `sudo` which prevents\n  users from using `su` to gain root access or to switch user accounts -\n  `/usr/share/pam-configs/wheel-security-misc` (which results in a change in\n  file `/etc/pam.d/common-auth`).\n\n- Add user `root` to group `sudo`. This is required due to the above\n  restriction so that logging in from a virtual console is still possible -\n  `debian/security-misc.postinst`\n\n- Abort login for users with locked passwords -\n  `/usr/libexec/security-misc/pam-abort-on-locked-password`.\n\n- Logging into the root account from a virtual, serial, or other console is\n  prevented by shipping an existing and empty `/etc/securetty` file (deletion\n  of `/etc/securetty` has a different effect).\n\nThis package does not yet automatically lock the root account password. It is\nnot clear if this would be sane in such a package, although it is recommended to\nlock and expire the root account.\n\nIn new Kicksecure builds, the root account will be locked by package\ndist-base-files.\n\nSee:\n\n- https://www.kicksecure.com/wiki/Root\n- https://www.kicksecure.com/wiki/Dev/Permissions\n- https://forums.whonix.org/t/restrict-root-access/7658\n\nHowever, a locked root password will break rescue and emergency shell.\nTherefore, this package enables passwordless rescue and emergency shell. This is\nthe same solution that Debian will likely adopt for the Debian installer:\nhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802211\n\nSee:\n\n- `/etc/systemd/system/emergency.service.d/override.conf`\n- `/etc/systemd/system/rescue.service.d/override.conf`\n\nAdverse security effects can be prevented by setting up BIOS password\nprotection, GRUB password protection, and/or full disk encryption.\n\n## Console lockdown\n\nThis uses pam_access to allow members of group `console` to use the console but\nrestrict everyone else (except members of group `console-unrestricted`) from\nusing the console with ancient, unpopular login methods such as `/bin/login` over\nnetworks as this might be exploitable. (CVE-2001-0797)\n\nThis is not enabled by default in this package since this package does not know\nwhich users should be added to group 'console' and thus, would break console access.\n\nSee:\n\n- `/usr/share/pam-configs/console-lockdown-security-misc`\n- `/etc/security/access-security-misc.conf`\n\n## Brute force attack protection\n\nUser accounts are locked after 50 failed login attempts using `pam_faillock`.\n\nInformational output during Linux PAM:\n\n- Show failed and remaining password attempts.\n- Document unlock procedure if Linux user account got locked.\n- Point out that there is no password feedback for `su`.\n- Explain locked root account if locked.\n\nSee:\n\n- `/usr/share/pam-configs/tally2-security-misc`\n- `/usr/libexec/security-misc/pam-info`\n- `/usr/libexec/security-misc/pam-abort-on-locked-password`\n\n## Access rights restrictions\n\n### Strong user account separation\n\n#### Permission Lockdown\n\nRead, write, and execute access for \"others\" are removed during package\ninstallation, upgrade, or PAM `mkhomedir` for all users who have home folders in\n`/home` by running, for example:\n\n```\nchmod o-rwx /home/user\n```\n\nThis will be done only once per folder in `/home` so users who wish to relax\nfile permissions are free to do so. This is to protect files in a home folder\nthat were previously created with lax file permissions prior to the installation\nof this package.\n\nSee:\n\n- `debian/security-misc.postinst`\n- `/usr/libexec/security-misc/permission-lockdown`\n- `/usr/share/pam-configs/mkhomedir-security-misc`\n\n#### umask\n\nThe default `umask` is set to `027` for files created by non-root users, such\nas the account `user`.\n\nThis is done using the PAM module `pam_mkhomedir.so umask=027`.\n\nThis configuration ensures that files created by non-root users cannot be read\nby other non-root users by default. While Permission Lockdown already protects\nthe `/home` folder, this setting extends protection to other folders such as\n`/tmp`.\n\n`group` read permissions are not removed. This is unnecessary due to Debian's\nuse of User Private Groups (UPGs). See also:\nhttps://wiki.debian.org/UserPrivateGroups\n\nThe default `umask` is unchanged for root because configuration files created\nin `/etc` by the system administrator would otherwise be unreadable by\n\"others,\" potentially breaking applications. Examples include `/etc/firefox-esr`\nand `/etc/thunderbird`. Additionally, the `umask` is set to `022` via `sudoers`\nconfiguration, ensuring that files created as root are world-readable, even\nwhen using commands such as `sudo vi /etc/file` or `sudo -i; touch /etc/file`.\n\nWhen using `sudo`, the `umask` is set to `022` rather than `027` to ensure\ncompatibility with commands such as `sudo vi /etc/configfile` and\n`sudo -i; touch /etc/file`.\n\nSee:\n\n- `/usr/share/pam-configs/umask-security-misc`\n\n### SUID / SGID removal and permission hardening\n\n#### SUID / SGID removal\n\nA systemd service removes SUID / SGID bits from non-essential binaries as these\nare often used in privilege escalation attacks.\n\n#### File permission hardening\n\nVarious file permissions are reset with more secure and hardened defaults. These\ninclude but are not limited to:\n\n- Limiting `/home` and `/root` to the root only.\n- Limiting crontab to root as well as all the configuration files for cron.\n- Limiting the configuration for cups and ssh.\n- Protecting the information of sudoers from others.\n- Protecting various system-relevant files and modules.\n\n##### permission-hardener\n\n`permission-hardener` removes SUID / SGID bits from non-essential binaries as\nthese are often used in privilege escalation attacks. It is enabled by default\nand applied at security-misc package installation and upgrade time.\n\nThere is also an optional systemd unit which does the same at boot time that\ncan be enabled by running `systemctl enable permission-hardener.service` as\nroot. The hardening at boot time is not the default because this slows down\nthe boot process too much.\n\nSee:\n\n* `/usr/bin/permission-hardener`\n* `debian/security-misc.postinst`\n* `/lib/systemd/system/permission-hardener.service`\n* `/etc/permission-hardener.d`\n* https://forums.whonix.org/t/disable-suid-binaries/7706\n* https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener\n\n### Access rights relaxations\n\nThis is not enabled yet because hidepid is not enabled by default.\n\nCalls to `pkexec` are redirected to `lxqt-sudo` because `pkexec` is\nincompatible with `hidepid=2`.\n\nSee:\n\n* `/usr/bin/pkexec.security-misc`\n* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040\n* https://forums.whonix.org/t/cannot-use-pkexec/8129\n\n## Application-specific hardening\n\n- Enables \"`apt-get --error-on=any`\" which makes apt exit non-zero for\n  transient failures. - `/etc/apt/apt.conf.d/40error-on-any`.\n- Enables APT seccomp-BPF sandboxing - `/etc/apt/apt.conf.d/40sandbox`.\n- Deactivates previews in Dolphin.\n- Deactivates previews in Nautilus -\n  `/usr/share/glib-2.0/schemas/30_security-misc.gschema.override`.\n- Deactivates thumbnails in Thunar.\n  - Rationale: lower attack surface when using the file manager\n  - https://forums.whonix.org/t/disable-preview-in-file-manager-by-default/18904\n- Thunderbird is hardened with the following options:\n  - Displays domain names in punycode to prevent IDN homograph attacks (a\n    form of phishing).\n  - Strips email client information from sent email headers.\n  - Strips user time information from sent email headers by replacing the\n    originating time zone with UTC and rounding the timestamp to the nearest\n    minute.\n  - Disables scripting when viewing PDF files.\n  - Disables implicit outgoing connections.\n  - Disables all and any kind of telemetry.\n- Security and privacy enhancements for gnupg's config file\n  `/etc/skel/.gnupg/gpg.conf`. See also:\n  - https://raw.github.com/ioerror/torbirdy/master/gpg.conf\n  - https://github.com/ioerror/torbirdy/pull/11\n\n### Project scope of application-specific hardening\n\nAdded in December 2023.\n\nBefore sending pull requests to harden arbitrary applications, please note the\nscope of security-misc is limited to default installed applications in\nKicksecure and Whonix. This includes:\n\n- Thunderbird, VLC Media Player, KeePassXC\n- Debian Specific System Components (APT, DPKG)\n- System Services (NetworkManager IPv6 privacy options, MAC address\n  randomization)\n- Actually used development utilities such as `git`.\n\nIt will not be possible to review and merge \"1500\" settings profiles for\narbitrary applications outside of this context.\n\nThe main objective of security-misc is to harden Kicksecure and its derivatives,\nsuch as Whonix, by implementing robust security settings. It's designed to be\ncompatible with Debian, reflecting a commitment to clean implementation and\nsound design principles. However, it's important to note that security-misc is a\ncomponent of Kicksecure, not a substitute for it. The intention isn't to\nrecreate Kicksecure within security-misc. Instead, specific security\nenhancements, like recommending a curated list of security-focused\ndefault packages (e.g., `libpam-tmpdir`), should be integrated directly into\nthose appropriate areas of Kicksecure (e.g. `kicksecure-meta-packages`).\n\nDiscussion: https://github.com/Kicksecure/security-misc/issues/154\n\n### Development philosophy\n\nAdded in December 2023.\n\nMaintainability is a key priority \\[1\\]. Before modifying settings in the\ndownstream security-misc, it's essential to first engage with upstream\ndevelopers to propose these changes as defaults. This step should only be\nbypassed if there's a clear, prior indication from upstream that such changes\nwon't be accepted. Additionally, before implementing any workarounds, consulting\nwith upstream is necessary to avoid future unmaintainable complexity.\n\nIf debugging features are disabled, pull requests won't be merged until there is\na corresponding pull request for the debug-misc package to re-enable these. This\nis to avoid configuring the system into a corner where it can no longer be\ndebugged.\n\n\\[1\\] https://www.kicksecure.com/wiki/Dev/maintainability\n\n## Opt-in hardening\n\nSome hardening is opt-in as it causes too much breakage to be enabled by\ndefault.\n\n- An optional systemd service mounts `/proc` with `hidepid=2` at boot to\n  prevent users from seeing another user's processes. This is disabled by\n  default because it is incompatible with `pkexec`. It can be enabled by\n  executing `systemctl enable proc-hidepid.service` as root.\n\n- A systemd service restricts `/proc/cpuinfo`, `/proc/bus`, `/proc/scsi`, and\n  `/sys` to the root user. This hides a lot of hardware identifiers from\n  unprivileged users and increases security as `/sys` exposes a lot of\n  information that shouldn't be accessible to unprivileged users. As this will\n  break many things, it is disabled by default and can optionally be enabled\n  by executing `systemctl enable hide-hardware-info.service` as root.\n\n## Miscellaneous\n\n- Hardened malloc compatibility for haveged workaround\n  `/lib/systemd/system/haveged.service.d/30_security-misc.conf`\n\n- Set `dracut` `reproducible=yes` setting\n\n## Legal\n\n`/usr/lib/issue.d/20_security-misc.issue`\n\nhttps://github.com/Kicksecure/security-misc/pull/167\n\n## Related\n\n-   Linux Kernel Runtime Guard (LKRG)\n-   tirdad - TCP ISN CPU Information Leak Protection.\n-   Kicksecure (TM) - a security-hardened Linux Distribution\n-   And more.\n-   https://www.kicksecure.com/wiki/Linux_Kernel_Runtime_Guard_LKRG\n-   https://github.com/Kicksecure/tirdad\n-   https://www.kicksecure.com\n-   https://github.com/Kicksecure\n\n## Discussion\n\nHappening primarily in forums.\n\nhttps://forums.whonix.org/t/kernel-hardening/7296\n\n## How to install `security-misc`\n\nSee https://www.kicksecure.com/wiki/Security-misc#install\n\n## How to Build deb Package from Source Code\n\nCan be build using standard Debian package build tools such as:\n\n    dpkg-buildpackage -b\n\nSee instructions. (Replace `generic-package` with the actual name of this\npackage `security-misc`.)\n\n-   **A)**\n    [easy](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package/easy),\n    *OR*\n-   **B)** [including verifying software\n    signatures](https://www.kicksecure.com/wiki/Dev/Build_Documentation/generic-package)\n\n## Contact\n\n-   [Free Forum Support](https://forums.kicksecure.com)\n-   [Professional Support](https://www.kicksecure.com/wiki/Professional_Support)\n\n## Donate\n\n`security-misc` requires [donations](https://www.kicksecure.com/wiki/Donate) to\nstay alive!\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkicksecure%2Fsecurity-misc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkicksecure%2Fsecurity-misc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkicksecure%2Fsecurity-misc/lists"}