V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.preseed/preseed.yaml

@@ -25,8 +25,8 @@ installer:
 apt:
   contrib: true                # Optionally, install contrib software.
   deb_sources: true            # Optionally includes deb-src entries for source repositories.
-  default_list: true           # By default, source repositories are listed in '/etc/apt/sources.list'. This MUST be "true".
+  default_list: false          # By default, source repositories are listed in '/etc/apt/sources.list'. This MUST be "true".
-  default_deb822: false        # Since Trixie, source repositories are listed in '/etc/apt/sources.list.d/' in deb.822 format.
+  default_deb822: true         # Since Trixie, source repositories are listed in '/etc/apt/sources.list.d/' in deb.822 format.
   full_upgrade: true           # Whether to upgrade packages after debootstrap.
   install_recommends: true     # Configure APT to not install recommended packages by default.
   non_free: true               # Optionally, install non-free software.

func/cdi_1000_helper/1082_helper_modules.sh

@@ -114,6 +114,8 @@ insert_comments() {
     *)           var_name="${of_file}"           ;;
   esac
 
+  guard_trace on
+
   sed -i '/^# SPDX-Security-Contact: security@coresecret\.eu$/a\
 \
 # Static file system information: '"${var_name}"'\
@@ -121,6 +123,9 @@ insert_comments() {
 # Architecture: '"${VAR_ARCHITECTURE}"'\
 # Distribution: '"${VAR_CODENAME}"'
 ' "${of_file}"
+
+  guard_trace off
+
   return 0
 }
 
@@ -134,6 +139,8 @@ insert_comments() {
 #   0: on success
 #######################################
 insert_header() {
+  guard_trace on
+
   cat << EOF >| "${1}"
 # SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
@@ -146,7 +153,11 @@ insert_header() {
 # SPDX-Security-Contact: security@coresecret.eu
 
 EOF
+
+  guard_trace off
+
   chmod 0644 "${1}"
+
   return 0
 }
 

func/cdi_4400_hardening/4460_hardening_memory.sh

@@ -54,77 +54,51 @@ guard_sourcing
 #######################################
 hardening_memory() {
   mkdir -p "${TARGET}/etc/systemd/coredump.conf.d"
+  mkdir -p "${TARGET}/etc/systemd/system.conf.d"
 
-  cat << EOF >| "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
-# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
 
-# Static file system information: /etc/systemd/coredump.conf.d/disable.conf
+
-# Generated by CISS.debian.installer ${VAR_VERSION}
+  insert_header "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
-# Architecture: ${VAR_ARCHITECTURE}
+  insert_comments "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
-# Distribution: ${VAR_CODENAME}
+  cat << EOF >> "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
+# Enforce: no core dumps for all logins by default.
+# Format: <domain> <type> <item> <value>
+*     hard core 0
+*     soft core 0
+root  hard core 0
+root  soft core 0
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
+EOF
+
+
+  insert_header "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
+  insert_comments "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
+  cat << 'EOF' >> "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
+### Do not store core images anywhere, keep the at most minimal metadata.
 
 [Coredump]
 Storage=none
+ProcessSizeMax=0
+ExternalSizeMax=0
+JournalSizeMax=0
 
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
-  chmod 0644 "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
 
-  cat << EOF >| "${TARGET}/etc/security/limits.d/90-ciss-core.conf"
-# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
 
-# Static file system information: /etc/security/limits.d/90-ciss-core.conf
+  [[ -f  "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf" ]] && \
-# Generated by CISS.debian.installer ${VAR_VERSION}
+    mv "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf" "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf.bak"
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
 
-# Format: <domain> <type> <item> <value>
-*	soft	core	0
-*	hard	core	0
-
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
-EOF
-  chmod 0644 "${TARGET}/etc/security/limits.d/90-ciss-core.conf"
-
-  mkdir -p "${TARGET}/etc/systemd/system.conf.d"
-  cat << EOF >| "${TARGET}/etc/systemd/system.conf.d/90-ciss-core.conf"
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/systemd/system.conf.d/90-ciss-core.conf"
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
 
+  insert_header "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
+  insert_comments "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
+  cat << EOF >> "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
 [Manager]
 DefaultLimitCORE=0
 
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
-  chmod 0644 "${TARGET}/etc/systemd/system.conf.d/90-ciss-core.conf"
 
   guard_pam_limits
 

includes/target/etc/sysctl.d/99_local.hardened

@@ -180,7 +180,7 @@ vm.mmap_rnd_compat_bits=16
 # settings.
 ###########################################################################################
 fs.suid_dumpable=0
-kernel.core_pattern= | /bin/false
+kernel.core_pattern=|/bin/false
 
 ### Disable User Namespaces, as it opens up a large attack surface to unprivileged users.
 #user.max_user_namespaces=0