change default umask

Patrick · November 3, 2023, 1:18pm

Add more hardening options to the default profile in etc

Kicksecure:master ← monsieuremre:profile

opened 01:56PM - 02 Nov 23 UTC

Disabling coredumps and setting a secure umask value. Comments explain more in d…etail. I am really sorry for the many pull requests, this is the last one. I don't mean to spam the project. They are mostly really small but significant changes. I thought that it would be easier to manage for the maintainer if they are seperated.

Useful for places outside the /home folder such as for example /tmp.

Patrick · January 6, 2024, 2:09pm

github.com/Kicksecure/security-misc

Restrict umask to 027 except for sudo/root broken

opened 02:09PM - 06 Jan 24 UTC

adrelanos

Currently umask is set to `027` (read, write for owner and group only). (Group …is OK because Debian uses `usergroups` by default, [`UPG`](https://wiki.debian.org/UserPrivateGroups) (UserPrivateGroups)). This however should not be the case for files created by root as this is super confusing, causing issues when creating files in `/etc` (or `/usr`) as these won't be readable by applications normally suppose to be able to read these running as non-root. That part is broken. Therefore unfortunately this feature has to be reverted until this can be fixed. This was discussed before here: * https://github.com/Kicksecure/security-misc/pull/18 The following unfortunately has to be removed. [`/usr/share/pam-configs/umask-security-misc`](https://github.com/Kicksecure/security-misc/blob/master/usr/share/pam-configs/umask-security-misc) ``` Name: Restrict umask to 027 (by package security-misc) Default: yes Priority: 100 Session-Type: Additional Session-Interactive-Only: yes Session: [success=1 default=ignore] pam_succeed_if.so uid eq 0 optional pam_umask.so umask=027 ``` I cannot even just out-comment it to make it easier to tinker as folder `/usr/share/pam-configs` does not support comments. Populating `/etc/pam.d` from `/usr/share/pam-configs` is a Debian / Ubunut feature. * https://unix.stackexchange.com/questions/337808/where-is-the-official-documentation-for-the-files-in-usr-share-pam-configs-in * https://wiki.ubuntu.com/PAMConfigFrameworkSpec ---- Command for testing: touch a && ls -la a && rm a I tried various stuff to fix it: * delete `Session-Interactive-Only: yes` * ``` [success=2 default=ignore] pam_succeed_if.so debug uid eq 0 [success=1 default=ignore] pam_succeed_if.so debug use_uid uid eq 0 optional pam_umask.so debug umask=027 ``` ---- This issue is only happening in non-Qubes. Not reproducible in Qubes Debian. This might be because Qubes login session work differently. This is probably also why I did not spot this issue beforehand. ---- Contributing: I don't necessarily need the config snippet for `/usr/share/pam-configs` as I might be able to figure that out but the config snipped required for `/etc/pam.d` would very useful.