walled garden, firewall whitelisting, application whitelisting, sudo lockdown, superuser mode, protected mode

[Patrick]

@madaidan

Root could be locked down

Untrusted Root - improve Security by Restricting Root

Is it currently being argued towards Untrusted Root? I.e. do you think it is a good idea to try to restrict malware which gained root access? examples which may point into that direction: Blacklist more kernel modules to reduce attack surface - #8 by Algernon enforce kernel module software signature verification [module signing] / disallow kernel module loading by default enable Linux kernel gpg verification in grub and/or enable Secure Boot by default Goal of untrusted root could be: t…

Restrict root access

It would be good to restrict root access to make it a lot harder to login as root. Uncommenting, auth required pam_wheel.so in /etc/pam.d/su will make it so only users in the root group can use su. This can prevent a compromised system user (e.g. the whonixcheck user) from switching to another user and/or gaining root. The user user can be added to the root group so they can use su normally or they can also be restricted and will have to use sudo. Emptying the /etc/securetty file can p…

@madaidan

A lot of dangerous binaries (su, sudo etc.) could be disabled by setting their mode to 000.

SUID Disabler and Permission Hardener

Automate vm sudo authorization setup · Issue #2695 · QubesOS/qubes-issues · GitHub has interesting ideas. Quote Solar Designer (someone that Joanna Rutkowska respects): Ideally, there should be no SUID binaries reachable from the user account, as otherwise significant extra attack surface inside the VM is exposed (dynamic linker, libc startup, portions of Linux kernel including ELF loader, etc.) No idea yet. Related: walled garden, firewall whitelisting, application whitelisting, sudo loc…