Kernel Hardening - security-misc

[Patrick]

@Patrick

# Disable User Namespaces, as it opens up a large attack surface to unprivileged users.
# On Debian kernel.unprivileged_userns_clone is set to 0 by default as well
user.max_user_namespaces = 0

That comment needs an update.

debian bug report: Please reconsider enabling the user namespaces by default

It seems that next debian version will have unpriv user ns by default.

userns: Enable unprivileged user namespaces by default (Closes: #898446)...

Related:

System-wide sandboxing framework - sandbox-app-launcher

There is 1 issue with this though and that’s that we need unprivileged user namespaces enabled for it to work. bubblewrap sets the no_new_privs flag which prevents executing setuid binaries (which Firefox/Chromium fallback to when there are no user namespaces). So, we need to set the kernel.unprivileged_userns_clone=1 sysctl for sandbox-app-launcher to work with the Firefox/Chromium sandbox. Chromium fails with an error when starting it without user namespaces: The setuid sandbox is not runn…

Chromium Browser for Kicksecure Discussions (not Whonix)

There are some issues with Dev/Chromium - Kicksecure Chromium Doesnt give your Freedom of Modifications Chromium has chrome://flags which is similar to about:config. For the example mentioned, there is the #legacy-tls-enforced option. Distribution of Adobe “Pepper” Flash Player proprietary plugin Chromium hasn’t shipped with Flash for a long time. Chromium reduced capabilities to plugin with adblocker The goal of manifest v3 is not to neuter ad blockers. It allows content filtering i…

https://forums.whonix.org/t/flathub-as-a-source-of-software/10706/6