Kernel Hardening - security-misc

[madaidan]

@Patrick

Yes, stuff we don’t use (such as pkexec ) should surely have SUID removed.

pkexec is used internally by a bunch of applications like cannot use pkexec - #3 by AnonymousUser

@Patrick

For now, we shouldn’t remove SUID from sudo , right?

Yes, SUID in sudo should stay.

@Patrick

Maybe first remove all SUID, then opt-in re-add sudo ?

Yes, the commands are executed in order so as long as the sudo line is below the lines that remove SUID, we’ll be fine.

@Patrick

For the upcoming boot to auto login into admin vs limited user boot option (multiple boot modes for better security: persistent + root | persistent + noroot | live + root | live + noroot) it would be great to automatically create a configuration file snippet that whitelists sudo or removes sudo from whitelist. My idea was for boot to auto login into limited user to even have SUID on sudo removed.

We can create a /etc/permission-hardening.d/ directory for configuration snippets. Maybe create a systemd service to create /etc/permission-hardening.d/no-sudo.conf or similar.