|
|
ae1344c57e
|
fix: resolve remaining CRITICAL/HIGH/MEDIUM findings (batch 2)
Addresses C-01, C-03, C-04, M-03, M-06, L-01, L-05, L-07.
Changes:
- luks-kdf-configure.sh: Auto-attempt Argon2id conversion during
installation instead of just creating a manual helper (C-01)
- run.sh: Replace --privileged with fine-grained capabilities
(SYS_ADMIN, MKNOD, NET_ADMIN, SYS_CHROOT, SETFCAP) (C-03)
- run.sh: Restrict SB key directory to mode 700 and key files
to mode 600 (C-04)
- security-hardening.sh: Add PAM enforcement via common-password
with enforce_for_root (M-03)
- security-hardening.sh: Initialize AIDE database and create daily
cron job for integrity checks (M-06)
- sudo-hardening.sh: Use atomic install -m 600 instead of touch+chmod
to avoid race condition (L-07)
- preseed.cfg: Disable direct root login (L-01)
- run.sh: Comment explaining KNEL_BUILD_MODE cannot be env-spoofed
since it's set from command argument (L-05)
All tests pass. Zero shellcheck warnings.
STATUS.md updated with 22/28 findings resolved.
💘 Generated with Crush
Assisted-by: GLM-5.1 via Crush <crush@charm.land>
|
2026-05-08 12:19:04 -05:00 |
|
reachableceo
|
9459c84fbc
|
fix: resolve all audit findings in hooks, config, and package list
Security/Functional Fixes:
- firewall-setup.sh: Added WireGuard allow, established/related, DHCP
(was blocking ALL outbound including VPN - system was non-functional)
- disable-package-management.sh: Preserve /var/lib/dpkg/ for queries
(was destroying dpkg database with rm -rf)
- encryption-validation.sh: Fixed inverted motd conditional
(was creating file only if it already existed - backwards)
- kernel-hardening.sh: Removed kernel.exec-shield (Red Hat only)
Changed user.max_user_namespaces from 0 to 100
- sudo-hardening.sh: Removed Defaults requiretty
(was breaking GUI-launched sudo via pkexec)
- encryption-setup.sh: Fixed conflicting stdin in luksAddKey
- install-scripts.sh: Fixed embedded firewall (same WireGuard bug)
Replaced gutted security-hardening stub with real status checker
- GRUB config: Fixed serial_console → serial (invalid terminal name)
- Package list: Removed audispd-plugins (deprecated in Debian 13),
removed duplicate wireguard/wireguard-tools entries
Reference: Full audit findings from Session 7 JOURNAL.md
💘 Generated with Crush
Assisted-by: GLM-5.1 via Crush <crush@charm.land>
|
2026-05-07 08:41:52 -05:00 |
|
reachableceo
|
62d20604a6
|
fix: resolve critical build bugs and add missing PRD requirements
Critical fixes:
- Fix security-hardening.sh live hook: removed broken source from
/build/src/ which doesn't exist during live-build; made hook
self-contained by inlining all config generation
- Fix firewall-setup.sh live hook: removed broken source from
/build/src/; hook already had inline nftables config
- Fix install-scripts.sh: replaced /workspace/src/ references with
embedded inline scripts (installed system has no /workspace)
- Fix UKI cmdline in standalone uki_build(): added
lockdown=confidentiality and module.sig_enforce=1 to match the
inline Secure Boot hook
- Fix WiFi blacklist: expanded from 6 entries to 19, now covers all
PRD FR-005 driver families (rtl*, iwl*, ath*, brcm*, mwifi*, rt2*)
Missing PRD requirements added:
- kernel-hardening.sh (FR-007): sysctl parameters for ASLR, ptrace
restriction, kptr_restrict, dmesg_restrict, kexec disabled, SUID
dumpable disabled, hardlink/symlink protection, network hardening
- service-hardening.sh (FR-007): disables and masks avahi-daemon,
cups, bluetooth, NetworkManager, ModemManager, whoopsie, apport
- sudo-hardening.sh (FR-007): requiretty, logging (input/output),
timestamp timeout, env_reset, restricted football user commands
- mount-hardening.sh (FR-007): nodev/nosuid/noexec on /tmp,
nodev/nosuid on /home, /dev/shm hardening
Test improvements:
- Rewrote security-hardening_comprehensive_test.bats: tests now
source scripts, call functions, and verify generated output files
- Rewrote firewall-setup_comprehensive_test.bats: tests now create
WireGuard configs, call parse_wg_endpoint, verify nftables output
- Added new-hooks_test.bats: 42 tests for kernel hardening, service
hardening, sudo hardening, mount hardening, self-containment
verification, and WiFi blacklist completeness
- Total: 788 tests passing, 0 failures, 0 shellcheck warnings
Reference: docs/PRD.md FR-005, FR-007, security-model.md
💘 Generated with Crush
Assisted-by: GLM-5.1 via Crush <crush@charm.land>
|
2026-05-01 09:50:15 -05:00 |
|
