V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-08-13 10:29:32 +02:00
parent 0236984834
commit 5d28e91bcb
4 changed files with 44 additions and 59 deletions
--- a/.preseed/preseed.yaml
+++ b/.preseed/preseed.yaml
@@ -25,8 +25,8 @@ installer:
 apt:
  contrib: true                # Optionally, install contrib software.
  deb_sources: true            # Optionally includes deb-src entries for source repositories.
-  default_list: true           # By default, source repositories are listed in '/etc/apt/sources.list'. This MUST be "true".
-  default_deb822: false        # Since Trixie, source repositories are listed in '/etc/apt/sources.list.d/' in deb.822 format.
+  default_list: false          # By default, source repositories are listed in '/etc/apt/sources.list'. This MUST be "true".
+  default_deb822: true         # Since Trixie, source repositories are listed in '/etc/apt/sources.list.d/' in deb.822 format.
  full_upgrade: true           # Whether to upgrade packages after debootstrap.
  install_recommends: true     # Configure APT to not install recommended packages by default.
  non_free: true               # Optionally, install non-free software.
--- a/func/cdi_1000_helper/1082_helper_modules.sh
+++ b/func/cdi_1000_helper/1082_helper_modules.sh
@@ -114,6 +114,8 @@ insert_comments() {
    *)           var_name="${of_file}"           ;;
  esac

+  guard_trace on
+
  sed -i '/^# SPDX-Security-Contact: security@coresecret\.eu$/a\
 \
 # Static file system information: '"${var_name}"'\
@@ -121,6 +123,9 @@ insert_comments() {
 # Architecture: '"${VAR_ARCHITECTURE}"'\
 # Distribution: '"${VAR_CODENAME}"'
 ' "${of_file}"
+
+  guard_trace off
+
  return 0
 }

@@ -134,6 +139,8 @@ insert_comments() {
 #   0: on success
 #######################################
 insert_header() {
+  guard_trace on
+
  cat << EOF >| "${1}"
 # SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
@@ -146,7 +153,11 @@ insert_header() {
 # SPDX-Security-Contact: security@coresecret.eu

 EOF
+
+  guard_trace off
+
  chmod 0644 "${1}"
+
  return 0
 }

--- a/func/cdi_4400_hardening/4460_hardening_memory.sh
+++ b/func/cdi_4400_hardening/4460_hardening_memory.sh
@@ -54,77 +54,51 @@ guard_sourcing
 #######################################
 hardening_memory() {
  mkdir -p "${TARGET}/etc/systemd/coredump.conf.d"
+  mkdir -p "${TARGET}/etc/systemd/system.conf.d"

-  cat << EOF >| "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
-# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu

-# Static file system information: /etc/systemd/coredump.conf.d/disable.conf
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
+
+  insert_header "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
+  insert_comments "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
+  cat << EOF >> "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
+# Enforce: no core dumps for all logins by default.
+# Format: <domain> <type> <item> <value>
+*     hard core 0
+*     soft core 0
+root  hard core 0
+root  soft core 0
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
+EOF
+
+
+  insert_header "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
+  insert_comments "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
+  cat << 'EOF' >> "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
+### Do not store core images anywhere, keep the at most minimal metadata.

 [Coredump]
 Storage=none
+ProcessSizeMax=0
+ExternalSizeMax=0
+JournalSizeMax=0

-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
-  chmod 0644 "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"

-  cat << EOF >| "${TARGET}/etc/security/limits.d/90-ciss-core.conf"
-# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu

-# Static file system information: /etc/security/limits.d/90-ciss-core.conf
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
+  [[ -f  "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf" ]] && \
+    mv "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf" "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf.bak"

-# Format: <domain> <type> <item> <value>
-*	soft	core	0
-*	hard	core	0
-
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
-EOF
-  chmod 0644 "${TARGET}/etc/security/limits.d/90-ciss-core.conf"
-
-  mkdir -p "${TARGET}/etc/systemd/system.conf.d"
-  cat << EOF >| "${TARGET}/etc/systemd/system.conf.d/90-ciss-core.conf"
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/systemd/system.conf.d/90-ciss-core.conf"
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}

+  insert_header "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
+  insert_comments "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
+  cat << EOF >> "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
 [Manager]
 DefaultLimitCORE=0

-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
-  chmod 0644 "${TARGET}/etc/systemd/system.conf.d/90-ciss-core.conf"

  guard_pam_limits