From patchwork Tue May 5 20:19:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 3057 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 49Grg369K2z3xXv for ; Tue, 5 May 2020 20:19:43 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 49Grg22T8pz24X; Tue, 5 May 2020 20:19:42 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 49Grg21JbSz2yDC; Tue, 5 May 2020 20:19:42 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 49Grfz6msCz2yC7 for ; Tue, 5 May 2020 20:19:39 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 49Grfy6n87z24X for ; Tue, 5 May 2020 20:19:38 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1588709979; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pR9Tq0hR5cIGhOYkYum85YFp10LhdLeJmDhv4k/kAuM=; b=KpoZOjynQ9Hc99Th00pHPXrfu+2nfkMjmPn8LcZE3UGKyym7Xkg6Uhz+B1aDd9WvbNdZ9j ow6wdQZnY2UuKlDA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1588709979; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pR9Tq0hR5cIGhOYkYum85YFp10LhdLeJmDhv4k/kAuM=; b=naBiDyZOTvCpZb3IREEqZiaarM7f9TQ2QYmDhGuOYaC7FvqGCHz8/cskjODJZKW8H+gNU/ zHBnQ7z2EaBPnfHV4t8glx0S99tsWxrPYRKdfsf3x0KVe/dKyTOOD804iTwzNu0A6DqIGP hv9+ytbWaTA0xbaXTthD+0bcmbiZlSuxdMiyU7lMWgXlskGmlxq4fJgsUkVCzktpMcTJD6 Kker8yg//cBuSQbC7+4P0IrATVMb+qp/7vVNGCqpFHHlh3mmbJzd4JSoPCPWY7PQkWoLlD 61ioEmhHbEJ0KsQ5YXpkhvuOS1FjwqpajsxUby3hohIHj82OS5j+38Oj/+DC8w== To: "IPFire: Development-List" From: =?utf-8?q?Peter_M=C3=BCller?= Subject: [PATCH] sysctl.conf: Turn on hard- and symlink protection Message-ID: <5bc92613-66bb-8f0d-0caa-4532863a9236@ipfire.org> Date: Tue, 5 May 2020 22:19:36 +0200 MIME-Version: 1.0 Content-Language: en-US Authentication-Results: mail01.ipfire.org; auth=pass smtp.mailfrom=peter.mueller@ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This backports 29a8992b7228771fb2cfc68679596598fb01105a into IPFire 3.x Signed-off-by: Peter Müller --- setup/setup.nm | 2 +- setup/sysctl/kernel-hardening.conf | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/setup/setup.nm b/setup/setup.nm index 09d94e23d..cc8454bfa 100644 --- a/setup/setup.nm +++ b/setup/setup.nm @@ -5,7 +5,7 @@ name = setup version = 3.0 -release = 14 +release = 15 arch = noarch groups = Base Build System/Base diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-hardening.conf index 33e096c7c..d92485d61 100644 --- a/setup/sysctl/kernel-hardening.conf +++ b/setup/sysctl/kernel-hardening.conf @@ -7,3 +7,7 @@ kernel.dmesg_restrict = 1 # Improve KASLR effectiveness for mmap. vm.mmap_rnd_bits = 32 vm.mmap_rnd_compat_bits = 16 + +# Turn on hard- and symlink protection +fs.protected_symlinks = 1 +fs.protected_hardlinks = 1