change default umask

Patrick · November 3, 2023, 1:18pm

Add more hardening options to the default profile in etc

Kicksecure:master ← monsieuremre:profile

opened 01:56PM - 02 Nov 23 UTC

Disabling coredumps and setting a secure umask value. Comments explain more in d…etail. I am really sorry for the many pull requests, this is the last one. I don't mean to spam the project. They are mostly really small but significant changes. I thought that it would be easier to manage for the maintainer if they are seperated.

Useful for places outside the /home folder such as for example /tmp.

Patrick · January 6, 2024, 2:09pm

github.com/Kicksecure/security-misc

Restrict umask to 027 except for sudo/root broken

opened 02:09PM - 06 Jan 24 UTC

adrelanos

Currently umask is set to `027` (read, write for owner and group only). (Group …is OK because Debian uses `usergroups` by default, [`UPG`](https://wiki.debian.org/UserPrivateGroups) (UserPrivateGroups)). This however should not be the case for files created by root as this is super confusing, causing issues when creating files in `/etc` (or `/usr`) as these won't be readable by applications normally suppose to be able to read these running as non-root. That part is broken. Therefore unfortunately this feature has to be reverted until this can be fixed. This was discussed before here: * https://github.com/Kicksecure/security-misc/pull/18 The following unfortunately has to be removed. [`/usr/share/pam-configs/umask-security-misc`](https://github.com/Kicksecure/security-misc/blob/master/usr/share/pam-configs/umask-security-misc) ``` Name: Restrict umask to 027 (by package security-misc) Default: yes Priority: 100 Session-Type: Additional Session-Interactive-Only: yes Session: [success=1 default=ignore] pam_succeed_if.so uid eq 0 optional pam_umask.so umask=027 ``` I cannot even just out-comment it to make it easier to tinker as folder `/usr/share/pam-configs` does not support comments. Populating `/etc/pam.d` from `/usr/share/pam-configs` is a Debian / Ubunut feature. * https://unix.stackexchange.com/questions/337808/where-is-the-official-documentation-for-the-files-in-usr-share-pam-configs-in * https://wiki.ubuntu.com/PAMConfigFrameworkSpec ---- Command for testing: touch a && ls -la a && rm a I tried various stuff to fix it: * delete `Session-Interactive-Only: yes` * ``` [success=2 default=ignore] pam_succeed_if.so debug uid eq 0 [success=1 default=ignore] pam_succeed_if.so debug use_uid uid eq 0 optional pam_umask.so debug umask=027 ``` ---- This issue is only happening in non-Qubes. Not reproducible in Qubes Debian. This might be because Qubes login session work differently. This is probably also why I did not spot this issue beforehand. ---- Contributing: I don't necessarily need the config snippet for `/usr/share/pam-configs` as I might be able to figure that out but the config snipped required for `/etc/pam.d` would very useful.

Patrick · November 29, 2024, 7:07am

github.com/Kicksecure/security-misc

Enable umask hardening

Kicksecure:master ← ArrayBolt3:arraybolt3/umask

opened 09:48PM - 28 Nov 24 UTC

ArrayBolt3

+22 -5

This pull request enables umask hardening, preventing unauthorized access to use…r-created files. ## Changes * Reinstates `[/usr/share/pam-configs/umask-security-misc](https://github.com/Kicksecure/security-misc/blob/master/usr/share/pam-configs/umask-security-misc)`, which sets a restrictive umask of 027 by default for all logins. * Adds sudoers configuration to `/etc/sudoers.d/security-misc` that sets the umask to a less restrictive setting of 022. * Updates README.md as appropriate. ## Mandatory Checklist - [x] Legal agreements accepted. By contributing to this organisation, you acknowledge you have read, understood, and agree to be bound by these these agreements: [Terms of Service](https://www.kicksecure.com/wiki/Terms_of_Service), [Privacy Policy](https://www.kicksecure.com/wiki/Privacy_Policy), [Cookie Policy](https://www.kicksecure.com/wiki/Cookie_Policy), [E-Sign Consent](https://www.kicksecure.com/wiki/E-Sign_Consent), [DMCA](https://www.kicksecure.com/wiki/DMCA), [Imprint](https://www.kicksecure.com/wiki/Imprint) ## Optional Checklist The following items are optional but might be requested in certain cases. - [x] I have tested it locally - [x] I have reviewed and updated any documentation if relevant - [ ] I am providing new code and test(s) for it Fixes #185 ## Notes The following scenarios should be covered properly and have their umask set appropriately with this configuration: * Console login * Goes through PAM, thus set to 027 for users and 022 for root * Graphical login * Goes through PAM, thus set to 027 for users * SSH login * Goes through PAM on Debian, thus set to 027 for users and 022 for root * Graphical remote management * Tools that reuse a session (x11vnc, etc.) * Requires a pre-existing login, which goes through PAM, thus set to 027 for users * Tools that create a new session (xrdp) * Will depend on the tool, xrdp goes through PAM, thus set to 027 for users * Privilege escalation * umask overridden to 022 via sudoers configuration, thus when escalating from `user` to `root` **or to any other user,** umask will become 022 * Worthy of note, this will affect escalations to users like `debian-tor` as well. Additionally, when dropping privileges from root to a non-root user, the non-root shell will still have umask set to 022. This may or may not be considered intended behavior, but is probably safest for a default. Users who wish to change this can modify `~/.profile` and `~/.zprofile` to set umask to 027 or any other preferred value. System services are considered out-of-scope, systemd manages the umask for those via the `UMask` setting in systemd units.