Then we need to update at same time debug-misc + documentation.
Have you tested that? A number of software uses databases behind the scenes like mediawiki and discourse and bringing them to a crawl would destroy the usecase. Some IM clients use dbs too.
As long as documented then at least they will have a clue what needs to be done.
1 Like
What do you think?
1 Like
This one is fine. kernel.perf_event_paranoid=3 requires a kernel patch but some distros (such as Debian) includes this by default. If the patch isn’t used then it’ll be the same as setting it to 2.
1 Like
2 Likes
Interesting tool, anything that can contributed to it?
1 Like
Was posted here: kernel recompilation for better hardening
1 Like
That comment needs an update.
debian bug report: Please reconsider enabling the user namespaces by default
It seems that next debian version will have unpriv user ns by default.
Related:
https://forums.whonix.org/t/flathub-as-a-source-of-software/10706/6
1 Like
Related to Linux kernel user namespaces:
Debian package bubblewrapwill set kernel.unprivileged_userns_clone=1 in Debian bullseye and above. bubblewrap will be no longer suid by default.
1 Like
1 Like
Great! Merged!
What do we do with debian/control?
(Used for apt-cache show security-misc, potentially packages.debian.org APT package repository web interface for deb.whonix.org) and README_generic.md?)
Simplify debian/control so it doesn’t have to be duplicated? Delete / avoid creation of README_generic.md?
1 Like
I think it should just contain a basic description and a link to the Github repository for more detailed information.
1 Like
@madaidan GCC 12 just added a security compile time option to auto initialize auto variables. Don’t know if this is a problem in the kernel code these days anymore. Also have no idea how this can affect areas of the code related to rngs. Might be useful for other binaries we compile however.
2 Likes
The STRUCTLEAK GCC plugin already automatically initializes variables although this will likely be stronger and less hacky.
2 Likes
Now that Debian and other distributions like Arch Linux are starting to relax their user namespace restrictions (but still keeping the sysctl for users to manually configure), we should preserve them in security-misc by setting kernel.unprivileged_userns_clone=0. User namespaces are still a huge risk and a minimal setuid binary where we can tightly control the attack surface exposed is superior by far. Unfortunately, upstream doesn’t seem to care.
However, we will need to make bubblewrap setuid ourselves since the package is not setting it anymore (at least in Debian). Should we just add chmod u+s "$(which bwrap)" in the postinst script and add some details in the readme?
There is also an issue when running Chromium in sandbox-app-launcher since no_new_privs will disable the setuid fallback. Ideally, we could probably add a way to whitelist which binaries are permitted to use unprivileged user namespaces (maybe contribute to linux-hardened). Firefox is also affected, but instead, its sandbox silently fails without crashing and lies to the user about the status of the sandbox because Firefox is terrible.
2 Likes
1 Like
I wanted to port this to dracut (replacing initramfs-tools with dracut) but it seems it’s not needed. Seems like dracut has early sysctl settings by default.
https://mirrors.edge.kernel.org/pub/linux/utils/boot/dracut/dracut.html#_description_6