reachableceo
2b422cf62c
Addresses findings C-02, C-05, H-01, H-02, H-03, H-04, H-07, H-08, M-01, M-02, M-05, M-07, M-08, M-12, plus encryption script fixes. Changes: - run.sh: Enforce host FDE check (C-02), make sbverify fatal (H-07), add module.sig_enforce to Docker-embedded UKI (H-08) - usb-automount.sh: Add noexec,nosuid,nodev mount options (C-05), restrict dmask/fmask, add input validation, add audit logging (M-08) - security-hardening.sh (live): Set StrictHostKeyChecking yes (H-01), remove sshd_config generation (H-02), expand WiFi blacklist (M-12) - firewall-setup.sh (live): Remove inbound ICMP echo, narrow WG port range to 51820 only (M-05) - firewall-setup.sh (src): Add ct state established,related (H-03) - security-hardening.sh (src): Fix apply_security_hardening to call configure_ssh_client and configure_fim with separate output paths (M-01) - install-scripts.sh: Remove football from sudo group (M-02) - mount-hardening.sh: Ensure /tmp,/var/tmp,/dev/shm always hardened even without existing fstab entries (M-07) - encryption-setup.sh: Fix cryptsetup stdin syntax (H-05), add dynamic LUKS device discovery (H-06), fix recovery key generation (M-04), fix crypttab sed pattern - qr-code-import.sh: Restrict temp file permissions (H-04) - Tests updated to match new security posture All 786+ tests pass. Zero shellcheck warnings. Reference: DeepReport-2026-05-08.md findings C-02, C-05, H-01 through H-08, M-01, M-02, M-05, M-07, M-08, M-12 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>
110 lines
2.8 KiB
Bash
Executable File
110 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# Configure USB automount support
|
|
set -euo pipefail
|
|
|
|
echo "Configuring USB automount support..."
|
|
|
|
# Create udev rules for USB devices
|
|
mkdir -p /etc/udev/rules.d
|
|
|
|
cat >/etc/udev/rules.d/99-usb-automount.rules <<'EOF'
|
|
# USB automount rules for KNEL-Football
|
|
ACTION=="add", SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="filesystem", RUN+="/usr/local/bin/usb-automount.sh %k"
|
|
ACTION=="remove", SUBSYSTEM=="block", RUN+="/usr/local/bin/usb-unmount.sh %k"
|
|
EOF
|
|
|
|
# Create USB automount script
|
|
cat >/usr/local/bin/usb-automount.sh <<'EOF'
|
|
#!/bin/bash
|
|
# USB automount script
|
|
set -euo pipefail
|
|
|
|
DEVICE="/dev/${1}"
|
|
DEVICE_NAME="${1}"
|
|
MOUNT_BASE="/media/usb-${DEVICE_NAME}"
|
|
|
|
# Validate device name to prevent injection
|
|
if [[ ! "${DEVICE_NAME}" =~ ^[a-zA-Z0-9]+$ ]]; then
|
|
echo "Invalid device name" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Create mount point if it doesn't exist
|
|
mkdir -p "${MOUNT_BASE}"
|
|
|
|
# Determine filesystem type and mount with appropriate options
|
|
# PRD FR-008: noexec,nosuid,nodev mandatory for USB security
|
|
if blkid "${DEVICE}" | grep -q "TYPE=\"vfat\""; then
|
|
mount -t vfat -o rw,noexec,nosuid,nodev,uid=1000,gid=1000,dmask=077,fmask=177 "${DEVICE}" "${MOUNT_BASE}"
|
|
elif blkid "${DEVICE}" | grep -q "TYPE=\"ntfs\""; then
|
|
mount -t ntfs-3g -o rw,noexec,nosuid,nodev,uid=1000,gid=1000,dmask=077,fmask=177 "${DEVICE}" "${MOUNT_BASE}"
|
|
elif blkid "${DEVICE}" | grep -q "TYPE=\"ext4\""; then
|
|
mount -t ext4 -o rw,noexec,nosuid,nodev "${DEVICE}" "${MOUNT_BASE}"
|
|
else
|
|
mount -t auto -o rw,noexec,nosuid,nodev,uid=1000,gid=1000 "${DEVICE}" "${MOUNT_BASE}"
|
|
fi
|
|
|
|
# Audit log USB mount event
|
|
logger -t usb-automount "USB device ${DEVICE} mounted at ${MOUNT_BASE} (noexec,nosuid,nodev)"
|
|
echo "USB device ${DEVICE} mounted at ${MOUNT_BASE}"
|
|
EOF
|
|
|
|
# Create USB unmount script
|
|
cat >/usr/local/bin/usb-unmount.sh <<'EOF'
|
|
#!/bin/bash
|
|
# USB unmount script
|
|
set -euo pipefail
|
|
|
|
DEVICE_NAME="${1}"
|
|
MOUNT_BASE="/media/usb-${DEVICE_NAME}"
|
|
|
|
# Unmount if mounted
|
|
if mountpoint -q "${MOUNT_BASE}"; then
|
|
umount "${MOUNT_BASE}"
|
|
rmdir "${MOUNT_BASE}"
|
|
echo "USB device ${DEVICE_NAME} unmounted"
|
|
fi
|
|
EOF
|
|
|
|
# Make scripts executable
|
|
chmod +x /usr/local/bin/usb-automount.sh
|
|
chmod +x /usr/local/bin/usb-unmount.sh
|
|
|
|
# Add user to plugdev group for USB access
|
|
usermod -a -G plugdev football 2>/dev/null || true
|
|
|
|
# Create PCManFM configuration for better file management
|
|
mkdir -p /etc/skel/.config/pcmanfm
|
|
cat >/etc/skel/.config/pcmanfm/default/pcmanfm.conf <<'EOF'
|
|
[config]
|
|
bm_open_method=0
|
|
su_cmd=xdg-su -c '%s'
|
|
|
|
[volume]
|
|
mount_on_startup=0
|
|
mount_removable=1
|
|
autorun=0
|
|
|
|
[ui]
|
|
always_show_tabs=0
|
|
hide_close_btn=0
|
|
win_width=640
|
|
win_height=480
|
|
|
|
[desktop]
|
|
show_wallpaper=0
|
|
wallpaper_mode=0
|
|
wallpaper_file=
|
|
wallpaper_common=1
|
|
desktop_bg=#000000
|
|
desktop_fg=#ffffff
|
|
desktop_shadow=#ffffff
|
|
desktop_font="Sans 12"
|
|
show_wm_menu=1
|
|
show_documents=1
|
|
show_trash=1
|
|
show_mounts=1
|
|
EOF
|
|
|
|
echo "USB automount support configured successfully."
|