msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m54s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-11 22:14:22 +01:00
parent be0a6c7c6a
commit 353568eb69
60 changed files with 2267 additions and 1163 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
.preseed/preseed.yaml
View File

@@ -359,17 +359,6 @@ grub_parameter:
##############################################################################################################################
- "randomize_kstack_offset=on"
##############################################################################################################################
# ASLR (Address Space Layout Randomization) causes central areas of memory to be assigned random addresses each time a program
# is started. These include: Stack, Heap, Shared libraries (e.g., libc), mmap regions, VDSO/VSyscall. The executable itself
# (only with PIE binaries). The aim is to make it more difficult for attackers to predict memory addresses, thereby preventing
# classic exploits that rely on known addresses from succeeding.
# 0: disabled Fixed memory addresses – insecure, testable.
# 1: Partial ASLR Heap, mmap are randomized, stack only partially randomized.
# 2: Full ASLR (default) Stack, mmap, heap, VDSO, shared libraries all randomized.
##############################################################################################################################
- "randomize_va_space=2"
##############################################################################################################################
# Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with Return Instructions) vulnerability and disable
# SMT. If 'mitigations=auto,nosmt' is set, the kernel already activates all retbleed-relevant mitigations, provided the CPU