kernel recompilation for better hardening

Development
,
340

madaidan via Whonix Forum:

Instead of the complexity of all those wrappers, maybe we could just use a bash alias?

alias apt="hdapt"
alias apt-get="hdapt"

I still don’t know yet. Created ⚓ T960 hardened kernel Debian packaging and APT integration - hkapt for it.

Doesn’t seem much less complex either way wrappers vs bash alias.

hdapt, not sure why I wrote that. hd what? Should be hkapt for hardened
kernel apt? My mistake.

Either way, hkapt could be developed independently. Wrappers could be
solved last.

rapt runs apt which if hardened-kernel is being used would be an alias of hdapt. If not using hardened-kernel, it would be real apt.

rapt runs as root. It ought to not parse anything in user’s home folder.
(Bash alias are run in user ~/.bashrc.)

There is no /etc/bashrc.d yet.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=675008

Therefore would probably have to take over (config-package-dev displace)
some system file which doesn’t lower complexity either.

bash aliases are probably ignored when apt is called by another tool
internally (such as for scripting / automating, whatnot).

We instruct users to use rapt when using apparmor-profile-everything and just apt when not.

One day apparmor-profile-everything hopefully becomes a default.
Therefore ideally it wouldn’t need a new command to teach all users.

1 Like