9459c84fbc
Security/Functional Fixes: - firewall-setup.sh: Added WireGuard allow, established/related, DHCP (was blocking ALL outbound including VPN - system was non-functional) - disable-package-management.sh: Preserve /var/lib/dpkg/ for queries (was destroying dpkg database with rm -rf) - encryption-validation.sh: Fixed inverted motd conditional (was creating file only if it already existed - backwards) - kernel-hardening.sh: Removed kernel.exec-shield (Red Hat only) Changed user.max_user_namespaces from 0 to 100 - sudo-hardening.sh: Removed Defaults requiretty (was breaking GUI-launched sudo via pkexec) - encryption-setup.sh: Fixed conflicting stdin in luksAddKey - install-scripts.sh: Fixed embedded firewall (same WireGuard bug) Replaced gutted security-hardening stub with real status checker - GRUB config: Fixed serial_console → serial (invalid terminal name) - Package list: Removed audispd-plugins (deprecated in Debian 13), removed duplicate wireguard/wireguard-tools entries Reference: Full audit findings from Session 7 JOURNAL.md 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>
33 lines
584 B
INI
33 lines
584 B
INI
set default=0
|
|
|
|
# Serial console for demo/validation mode
|
|
serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
|
|
terminal_input serial console
|
|
terminal_output gfxterm serial
|
|
|
|
if [ x$feature_default_font_path = xy ] ; then
|
|
font=unicode
|
|
else
|
|
font=$prefix/unicode.pf2
|
|
fi
|
|
|
|
if loadfont $font ; then
|
|
set gfxmode=800x600
|
|
set gfxpayload=keep
|
|
insmod efi_gop
|
|
insmod efi_uga
|
|
insmod video_bochs
|
|
insmod video_cirrus
|
|
else
|
|
set gfxmode=auto
|
|
insmod all_video
|
|
fi
|
|
|
|
insmod gfxterm
|
|
insmod png
|
|
|
|
source /boot/grub/theme.cfg
|
|
|
|
insmod play
|
|
play 960 440 1 0 4 440 1
|