reachableceo ae1344c57e fix: resolve remaining CRITICAL/HIGH/MEDIUM findings (batch 2) ...

Addresses C-01, C-03, C-04, M-03, M-06, L-01, L-05, L-07.

Changes:
- luks-kdf-configure.sh: Auto-attempt Argon2id conversion during
  installation instead of just creating a manual helper (C-01)
- run.sh: Replace --privileged with fine-grained capabilities
  (SYS_ADMIN, MKNOD, NET_ADMIN, SYS_CHROOT, SETFCAP) (C-03)
- run.sh: Restrict SB key directory to mode 700 and key files
  to mode 600 (C-04)
- security-hardening.sh: Add PAM enforcement via common-password
  with enforce_for_root (M-03)
- security-hardening.sh: Initialize AIDE database and create daily
  cron job for integrity checks (M-06)
- sudo-hardening.sh: Use atomic install -m 600 instead of touch+chmod
  to avoid race condition (L-07)
- preseed.cfg: Disable direct root login (L-01)
- run.sh: Comment explaining KNEL_BUILD_MODE cannot be env-spoofed
  since it's set from command argument (L-05)

All tests pass. Zero shellcheck warnings.
STATUS.md updated with 22/28 findings resolved.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

2026-05-08 12:19:04 -05:00

47 KiB

Executable File

Raw Blame History

View Raw