I tried to whitelist /usr/bin/newuidmap and /usr/bin/newgidmapbinaries in AppVM according to instructions provided on Whitelist Specific SUID Binaries. I created permission-hardener.d/20_user.conf file in /usr/local/lib, since I wanted it to persist restarts but for some reason after restart the binaries get disabled again. I tried to create the configuration file in /usr/local/etc but that didn’t help either.
You need to do the whitelisting steps in the template. They won’t be persistent if you do them in an AppVM because AppVMs wipe most of their outside-of-/home state on reboot by design. I don’t believe /usr/local is excluded from this.
1 Like
I use /usr/local in other AppVMs, it is persistent, Inheritance and persistence.
Hmm, ok, I was mistaken about persistence then.
To be clear, you put this file in /usr/local/etc/permission-hardener.d/20_user.conf? That seems like it should work… I’ll try it if that’s exactly what you did.
1 Like
Yes, in Kicksecure wiki page it says to use /usr/lib/permission-hardener.d/20_user.conf, so I used /usr/local/lib instead of /usr/lib, that didn’t work. In configuration files in /usr/lib/permission-hardener.d directory it says Please use “/etc/permission-hardener.d/20_user.conf” or “/usr/local/etc/permission-hardener.d/20_user.conf” for your custom configuration. When security-misc-shared is updated, this file may be overwritten. So I tried /usr/local/etc/permission-hardener.d/20_user.conf, unfortunately it had the same effect, it didn’t persist.
Hmm, I think I know what’s happening here. The configuration is likely being respected, but the actual hardening removal isn’t persisting because the un-hardened executables are on a non-persistent part of the disk. permission-hardener doesn’t run on bootup, so it won’t do anything until you run it manually as root (which is hard to do from a user session).
Try running sudo systemctl enable permission-hardener.service in the template. That will make permission-hardener run as part of the boot process, and it should hopefully apply your hardening removal in AppVMs automatically.
(I haven’t tried whitelisting the binaries you mentioned yet, but when I reach a good breaking point in my work, I’ll try it.)
1 Like
I didn’t want permission-hardener to run on bootup in every AppVM based on the template, so instead of using permission-hardener.service in the template I put permission-hardener disable /usr/bin/newuidmap and permission-hardener disable /usr/bin/newgidmap commands in /rw/config/rc.local in the AppVM, so it would only run on bootup in this specific AppVM and it’s working. By the way, using /rw/config/rc.local script you don’t even need to use permission-hardener.d/20_user.conf file.
2 Likes
Nice, glad you found a working solution.
1 Like