V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m44s
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m44s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -1,361 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.2025.hardened.installer framework.
|
||||
# SPDX-PackageName: CISS.2025.hardened.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
###########################################################################################
|
||||
# 3.8.1. Functions - installation - setup grub hardening #
|
||||
###########################################################################################
|
||||
# TODO Important insert cryptdevice=UUID=881366ae-61ee-4ee0-893c-0def27c78c9e:cryptroot root=/dev/mapper/vg00-root
|
||||
# TODO Important insert GRUB_CMDLINE_LINUX_DEFAULT="net.ifnames=0 biosdevname=0 ip=152.53.66.126::152.53.64.1:255.255.252.0:soc:ens3:none"
|
||||
###########################################################################################
|
||||
# Hardening Grub boot parameter
|
||||
# Globals:
|
||||
# DIR_BAK
|
||||
# DIR_LOG
|
||||
# GRUB_CMDLINE_LINUX
|
||||
# MODULE_ERR
|
||||
# MODULE_TXT
|
||||
# PATH_ABS
|
||||
# TARGET
|
||||
# arch
|
||||
# Arguments:
|
||||
# None
|
||||
###########################################################################################
|
||||
3_8_1_functions_installation_setup_grub_bootparameter() {
|
||||
declare -g -x MODULE_ERR="3_8_1_functions_installation_setup_grub_bootparameter"
|
||||
declare -g -x MODULE_TXT="Setup GRUB bootparameter"
|
||||
do_show_header "${MODULE_TXT}"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Kernel Hardening Preparation #
|
||||
###########################################################################################
|
||||
declare WHEREIAM
|
||||
WHEREIAM=$(virt-what)
|
||||
declare TIMESTAMP
|
||||
TIMESTAMP=$(do_get_timestamp)
|
||||
# shellcheck disable=SC2129
|
||||
echo "${TIMESTAMP}" >> "${DIR_LOG}"cpu.log
|
||||
grep . /sys/devices/system/cpu/vulnerabilities/* >> "${DIR_LOG}"cpu.log
|
||||
spectre-meltdown-checker --explain >> "${DIR_LOG}"cpu.log
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Setup Kernel Default- and Hardening-Presets #
|
||||
###########################################################################################
|
||||
cp "${PATH_ABS}"/.assets/99_local.hardened "${TARGET}"/etc/sysctl.d/99_local.hardened
|
||||
chmod 0644 "${TARGET}"/etc/sysctl.d/99_local.hardened
|
||||
cp "${PATH_ABS}"/.assets/99_local.defaults "${TARGET}"/etc/sysctl.d/99_local.defaults
|
||||
chmod 0644 "${TARGET}"/etc/sysctl.d/99_local.defaults
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Entropy collection improvements #
|
||||
###########################################################################################
|
||||
if [[ ! -d "${TARGET}"/usr/lib/modules-load.d ]]; then
|
||||
mkdir -p "${TARGET}"/usr/lib/modules-load.d
|
||||
fi
|
||||
|
||||
touch "${TARGET}"/usr/lib/modules-load.d/30_security-misc.conf
|
||||
chmod 0644 "${TARGET}"/usr/lib/modules-load.d/30_security-misc.conf
|
||||
|
||||
cat << EOF >> "${TARGET}"/usr/lib/modules-load.d/30_security-misc.conf
|
||||
## https://www.whonix.org/wiki/Dev/Entropy
|
||||
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972
|
||||
## https://forums.whonix.org/t/jitterentropy-rngd/7204
|
||||
jitterentropy_rng
|
||||
EOF
|
||||
|
||||
do_help_grub_extract_current_string
|
||||
declare -g -x MODULE_ERR="3_8_1_functions_installation_setup_grub_bootparameter"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Audit events need to be captured on processes that start up prior to auditd , #
|
||||
# so that potential malicious activity cannot go undetected. During boot if audit=1, then #
|
||||
# the backlog will hold 64 records. If more than 64 records are created during boot, #
|
||||
# auditd records will be lost and potential malicious activity could go undetected #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} audit=1 audit_backlog_limit=8192"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Distrusts CPU bootloader for initial entropy at boot #
|
||||
# Distrusts the CPU for initial entropy at boot, as it is not possible to audit, #
|
||||
# may contain weaknesses or a backdoor. #
|
||||
###########################################################################################
|
||||
# https://en.wikipedia.org/wiki/RDRAND#Reception
|
||||
# https://twitter.com/pid_eins/status/1149649806056280069
|
||||
# https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
||||
# https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
||||
# https://lkml.org/lkml/2022/6/5/271
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} random.trust_cpu=off"
|
||||
|
||||
###########################################################################################
|
||||
# Distrusts the bootloader for initial entropy at boot. #
|
||||
# https://lkml.org/lkml/2022/6/5/271 #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} random.trust_bootloader=off"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enables IOMMU to prevent DMA attacks. #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} intel_iommu=on amd_iommu=force_isolation"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Disable the busmaster bit on all PCI bridges during very early boot to avoid #
|
||||
# holes in IOMMU. #
|
||||
# may contain weaknesses or a backdoor. #
|
||||
###########################################################################################
|
||||
# https://mjg59.dreamwidth.org/54433.html
|
||||
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} efi=disable_early_pci_dma"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enables strict enforcement of IOMMU TLB invalidation so devices will never be #
|
||||
# able to access stale data contents. #
|
||||
# https://github.com/torvalds/linux/blob/master/drivers/iommu/Kconfig#L97 #
|
||||
# Page 11 of https://lenovopress.lenovo.com/lp1467.pdf #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} iommu=force iommu.passthrough=0 iommu.strict=1"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Disables the merging of slabs of similar sizes. #
|
||||
# Sometimes a slab can be used vulnerably, which an attacker can exploit. #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} slab_nomerge"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Zero memory at allocation and free time. #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} init_on_alloc=1 init_on_free=1"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: This option randomizes page allocator freelists, improving security by making #
|
||||
# page allocations less predictable. This also improves performance. #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} page_alloc.shuffle=1"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enables Kernel Page Table Isolation, which mitigates Meltdown, improves KASLR #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} pti=on"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: vsyscall is obsolete, are at fixed addresses and are a target for ROP. #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} vsyscall=none"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enables randomization of the kernel stack offset on syscall entries #
|
||||
# (introduced in kernel 5.13). https://lkml.org/lkml/2019/3/18/246 #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} randomize_kstack_offset=on"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Restrict access to debugfs since it can contain a lot of sensitive information.#
|
||||
# https://lkml.org/lkml/2020/7/16/122 #
|
||||
# https://github.com/torvalds/linux/blob/fb1201aececc59990b75ef59fca93ae4aa1e1444/Documentation/admin-guide/kernel-parameters.txt#L835-L848
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} debugfs=off"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Force the kernel to panic on "oopses" (which may be due to false positives). #
|
||||
# Reboot devices immediately if kernel experiences an Oops. #
|
||||
# https://kspp.github.io/Recommended_Settings #
|
||||
# https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} oops=panic panic=-1"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enable a subset of known mitigations for CPU vulnerabilities and disable SMT. #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} mitigations=auto,nosmt"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enable mitigations for both Spectre Variant 2 (indirect branch speculation) #
|
||||
# and Intel branch history injection (BHI) vulnerabilities. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} spectre_v2=on spectre_v2_user=on spectre_bhi=on"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Disable Speculative Store Bypass (Spectre Variant 4). #
|
||||
# https://www.suse.com/support/kb/doc/?id=000019189 #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} spec_store_bypass_disable=on nospec_store_bypass_disable=off"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enable mitigations for the L1TF vulnerability through disabling SMT and L1D #
|
||||
# flush runtime control. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} l1tf=full,force"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enable mitigations for the MDS vulnerability through clearing buffer cache #
|
||||
# and disabling SMT. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} mds=full,nosmt"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Patches the TAA vulnerability by disabling TSX and enables mitigations using #
|
||||
# TSX Async Abort along with disabling SMT. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} tsx=off tsx_async_abort=full,nosmt"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} kvm.nx_huge_pages=force"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Force disable SMT as it has caused numerous CPU vulnerabilities. #
|
||||
# The only full mitigation of cross-HT attacks is to disable SMT. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html #
|
||||
# https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} nosmt=force"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enables the prctl interface to prevent leaks from L1D on context switches. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} l1d_flush=on"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} mmio_stale_data=full,nosmt"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with #
|
||||
# Return Instructions) vulnerability and disable SMT. #
|
||||
# https://www.suse.com/support/kb/doc/?id=000020693 #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} retbleed=auto,nosmt"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enables kernel lockdown mode with a focus on confidentiality. The kernel is #
|
||||
# configured in such a way that even privileged users (such as root) have limited access #
|
||||
# to kernel data and debug mechanisms. 'confidentiality': Maximum restriction to ensure #
|
||||
# the security and integrity of the system. This prevents direct access to hardware and #
|
||||
# debug interfaces, for example. Useful for highly secure environments as it reduces the #
|
||||
# attack surface to kernel data. However, some applications that require debugging or #
|
||||
# hardware access may have problems. #
|
||||
# https://blog.cloudflare.com/de-de/linux-kernel-hardening/ #
|
||||
# https://www.linux-magazine.com/Issues/2020/239/Lockdown-Mode #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} lockdown=confidentiality"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Enables 'Read-Only Data Protection', which implements read-only memory areas #
|
||||
# for kernel data structures. This protects the kernel from certain types of exploit #
|
||||
# (e.g., buffer overflows). 'on': Forces the corresponding areas to remain read-only. #
|
||||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} rodata=on"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Meaning:Enables initialization or overwriting of released memory so-called #
|
||||
# 'poisoning' with special values. This helps to detect errors caused by the use of #
|
||||
# already released memory (Use-After-Free). '1': Enables the function. Good for debugging #
|
||||
# and security checks, but can slightly affect performance. #
|
||||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} page_poison=1"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Kernel Electric-Fence (KFENCE) is a low-overhead sampling-based memory safety #
|
||||
# error detector. KFENCE detects heap out-of-bounds access, use-after-free, and #
|
||||
# invalid-free errors. KFENCE is designed to be enabled in production kernels, and has #
|
||||
# near zero performance overhead. Compared to KASAN, KFENCE trades performance for #
|
||||
# precision. The main motivation behind KFENCE’s design is that with enough total uptime #
|
||||
# KFENCE will detect bugs in code paths not typically exercised by non-production test #
|
||||
# workloads. One way to quickly achieve a large enough total uptime is when the tool is #
|
||||
# deployed across a large fleet of machines. #
|
||||
# https://docs.kernel.org/dev-tools/kfence.html #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} kfence.sample_interval=100"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: CFI Ensures that only controlled, predefined transitions are possible in the #
|
||||
# programs' control flow. kcfi (Kernel Control Flow Integrity): Specific implementation of#
|
||||
# CFI for the Linux kernel that is particularly robust and provides accurate control flow #
|
||||
# validation. kcfi relies on compiler-based technologies (e.g., LLVM) that insert special #
|
||||
# checks and instrumentation into the kernel code. #
|
||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} cfi=kcfi"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Remove additional (32-bit) attack surface, unless you really need them. #
|
||||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html #
|
||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options #
|
||||
###########################################################################################
|
||||
GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX} ia32_emulation=0"
|
||||
|
||||
do_help_grub_finalize_string
|
||||
MODULE_ERR="3_8_1_functions_installation_setup_grub_bootparameter"
|
||||
|
||||
###########################################################################################
|
||||
# Remarks: Generally, it is best to let the hypervisor handle CPU microcode updates #
|
||||
###########################################################################################
|
||||
case "${arch,,}" in
|
||||
|
||||
amd64)
|
||||
|
||||
if [[ -f "${TARGET}"/etc/default/amd64-microcode && ${WHEREIAM} != kvm ]]; then
|
||||
|
||||
cp -u /etc/default/amd64-microcode "${DIR_BAK}"amd64-microcode.bak
|
||||
chmod 644 "${DIR_BAK}"amd64-microcode.bak
|
||||
sed -i "s/#AMD64UCODE_INITRAMFS=auto/AMD64UCODE_INITRAMFS=early/" "${TARGET}"/etc/default/amd64-microcode
|
||||
|
||||
fi
|
||||
|
||||
if [[ -f "${TARGET}"/etc/modprobe.d/amd64-microcode-blacklist.conf && ${WHEREIAM} != kvm ]]; then
|
||||
|
||||
cp -u "${TARGET}"/etc/modprobe.d/amd64-microcode-blacklist.conf "${DIR_BAK}"amd64-microcode-blacklist.conf.bak
|
||||
chmod 0644 "${DIR_BAK}"amd64-microcode-blacklist.conf.bak
|
||||
sed -i "s/blacklist microcode/# blacklist microcode/" "${TARGET}"/etc/modprobe.d/amd64-microcode-blacklist.conf
|
||||
|
||||
fi
|
||||
;;
|
||||
|
||||
intel64)
|
||||
|
||||
if [[ -f "${TARGET}"/etc/default/intel-microcode && ${WHEREIAM} != kvm ]]; then
|
||||
|
||||
cp -u "${TARGET}"/etc/default/intel-microcode "${DIR_BAK}"intel-microcode.bak
|
||||
chmod 0644 "${DIR_BAK}"intel-microcode.bak
|
||||
sed -i "s/#IUCODE_TOOL_INITRAMFS=auto/IUCODE_TOOL_INITRAMFS=early/" "${TARGET}"/etc/default/intel-microcode
|
||||
sed -i "s/#IUCODE_TOOL_SCANCPUS=yes/IUCODE_TOOL_SCANCPUS=yes/" "${TARGET}"/etc/default/intel-microcode
|
||||
|
||||
fi
|
||||
|
||||
if [[ -f "${TARGET}"/etc/modprobe.d/intel-microcode-blacklist.conf && ${WHEREIAM} != kvm ]]; then
|
||||
|
||||
cp -u "${TARGET}"/etc/modprobe.d/intel-microcode-blacklist.conf "${DIR_BAK}"intel-microcode-blacklist.conf.bak
|
||||
chmod 0644 "${DIR_BAK}"intel-microcode-blacklist.conf.bak
|
||||
sed -i "s/blacklist microcode/# blacklist microcode/" "${TARGET}"/etc/modprobe.d/intel-microcode-blacklist.conf
|
||||
|
||||
fi
|
||||
;;
|
||||
|
||||
esac
|
||||
|
||||
do_in_target "${TARGET}" update-grub
|
||||
do_log "info" "false" "GRUB hardening of bootparameters, executed in: '${TARGET}'."
|
||||
|
||||
do_show_footer "${MODULE_TXT}"
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
|
||||
@@ -10,6 +10,8 @@
|
||||
# SPDX-PackageName: CISS.2025.hardened.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
# TODO Important insert cryptdevice=UUID=881366ae-61ee-4ee0-893c-0def27c78c9e:cryptroot root=/dev/mapper/vg00-root
|
||||
# TODO Important insert GRUB_CMDLINE_LINUX_DEFAULT="net.ifnames=0 biosdevname=0 ip=152.53.66.126::152.53.64.1:255.255.252.0:soc:ens3:none"
|
||||
###########################################################################################
|
||||
# 3.7.7. Functions - installation - kernel #
|
||||
###########################################################################################
|
||||
|
||||
Reference in New Issue
Block a user