msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 52s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-08-13 10:29:32 +02:00
parent 0236984834
commit 5d28e91bcb
4 changed files with 44 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
func/cdi_1000_helper/1082_helper_modules.sh
View File

@@ -114,6 +114,8 @@ insert_comments() {
*) var_name="${of_file}" ;;
esac
guard_trace on
sed -i '/^# SPDX-Security-Contact: security@coresecret\.eu$/a\
\
# Static file system information: '"${var_name}"'\
@@ -121,6 +123,9 @@ insert_comments() {
# Architecture: '"${VAR_ARCHITECTURE}"'\
# Distribution: '"${VAR_CODENAME}"'
' "${of_file}"
guard_trace off
return 0
}
@@ -134,6 +139,8 @@ insert_comments() {
# 0: on success
#######################################
insert_header() {
guard_trace on
cat << EOF >| "${1}"
# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
@@ -146,7 +153,11 @@ insert_header() {
# SPDX-Security-Contact: security@coresecret.eu
EOF
guard_trace off
chmod 0644 "${1}"
return 0
}

86
func/cdi_4400_hardening/4460_hardening_memory.sh
View File

@@ -54,77 +54,51 @@ guard_sourcing
#######################################
hardening_memory() {
mkdir -p "${TARGET}/etc/systemd/coredump.conf.d"
mkdir -p "${TARGET}/etc/systemd/system.conf.d"
cat << EOF >| "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# Static file system information: /etc/systemd/coredump.conf.d/disable.conf
# Generated by CISS.debian.installer ${VAR_VERSION}
# Architecture: ${VAR_ARCHITECTURE}
# Distribution: ${VAR_CODENAME}
insert_header "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
insert_comments "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
cat << EOF >> "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
# Enforce: no core dumps for all logins by default.
# Format: <domain> <type> <item> <value>
* hard core 0
* soft core 0
root hard core 0
root soft core 0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
EOF
insert_header "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
insert_comments "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
cat << 'EOF' >> "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
### Do not store core images anywhere, keep the at most minimal metadata.
[Coredump]
Storage=none
ProcessSizeMax=0
ExternalSizeMax=0
JournalSizeMax=0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
EOF
chmod 0644 "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
cat << EOF >| "${TARGET}/etc/security/limits.d/90-ciss-core.conf"
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# Static file system information: /etc/security/limits.d/90-ciss-core.conf
# Generated by CISS.debian.installer ${VAR_VERSION}
# Architecture: ${VAR_ARCHITECTURE}
# Distribution: ${VAR_CODENAME}
[[ -f "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf" ]] && \
mv "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf" "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf.bak"
# Format: <domain> <type> <item> <value>
* soft core 0
* hard core 0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
EOF
chmod 0644 "${TARGET}/etc/security/limits.d/90-ciss-core.conf"
mkdir -p "${TARGET}/etc/systemd/system.conf.d"
cat << EOF >| "${TARGET}/etc/systemd/system.conf.d/90-ciss-core.conf"
# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# Static file system information: /etc/systemd/system.conf.d/90-ciss-core.conf"
# Generated by CISS.debian.installer ${VAR_VERSION}
# Architecture: ${VAR_ARCHITECTURE}
# Distribution: ${VAR_CODENAME}
insert_header "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
insert_comments "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
cat << EOF >> "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
[Manager]
DefaultLimitCORE=0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
EOF
chmod 0644 "${TARGET}/etc/systemd/system.conf.d/90-ciss-core.conf"
guard_pam_limits