msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m51s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-21 20:20:32 +01:00
parent 8d8307c9a6
commit 9221726408
7 changed files with 64 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
func/cdi_4400_hardening/4450_hardening_memory.sh
View File

@@ -43,22 +43,27 @@ guard_sourcing
# '/etc/pam.d/common-session'
# '/etc/pam.d/common-session-noninteractive'
# Globals:
# RECOVERY
# TARGET
# VAR_ARCHITECTURE
# VAR_CODENAME
# VAR_VERSION
# VAR_RUN_RECOVERY
# Arguments:
# None
# Returns:
# 0: on success
#######################################
hardening_memory() {
mkdir -p "${TARGET}/etc/systemd/coredump.conf.d"
mkdir -p "${TARGET}/etc/systemd/system.conf.d"
### Declare Arrays, HashMaps, and Variables.
declare var_target="${TARGET}"
insert_header "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
insert_comments "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
cat << 'EOF' >> "${TARGET}/etc/security/limits.d/99-ciss-core.conf"
### Check for TARGET / RECOVERY.
[[ "${VAR_RUN_RECOVERY}" == "true" ]] && var_target="${RECOVERY}"
mkdir -p "${var_target}/etc/systemd/coredump.conf.d"
mkdir -p "${var_target}/etc/systemd/system.conf.d"
insert_header "${var_target}/etc/security/limits.d/99-ciss-core.conf"
insert_comments "${var_target}/etc/security/limits.d/99-ciss-core.conf"
cat << 'EOF' >> "${var_target}/etc/security/limits.d/99-ciss-core.conf"
# Enforce: no core dumps for all logins by default.
# Format: <domain> <type> <item> <value>
* hard core 0
@@ -70,9 +75,9 @@ root soft core 0
EOF
insert_header "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
insert_comments "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
cat << 'EOF' >> "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
insert_header "${var_target}/etc/systemd/coredump.conf.d/disable.conf"
insert_comments "${var_target}/etc/systemd/coredump.conf.d/disable.conf"
cat << 'EOF' >> "${var_target}/etc/systemd/coredump.conf.d/disable.conf"
### Do not store core images anywhere, keep the at most minimal metadata.
[Coredump]
@@ -85,20 +90,26 @@ JournalSizeMax=0
EOF
[[ -f "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf" ]] && \
mv "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf" "${TARGET}/etc/systemd/system.conf.d/10-coredump-debian.conf.bak"
[[ -f "${var_target}/etc/systemd/system.conf.d/10-coredump-debian.conf" ]] && \
mv "${var_target}/etc/systemd/system.conf.d/10-coredump-debian.conf" "${var_target}/etc/systemd/system.conf.d/10-coredump-debian.conf.bak"
insert_header "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
insert_comments "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
cat << 'EOF' >> "${TARGET}/etc/systemd/system.conf.d/99-ciss-core.conf"
insert_header "${var_target}/etc/systemd/system.conf.d/99-ciss-core.conf"
insert_comments "${var_target}/etc/systemd/system.conf.d/99-ciss-core.conf"
cat << 'EOF' >> "${var_target}/etc/systemd/system.conf.d/99-ciss-core.conf"
[Manager]
DefaultLimitCORE=0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
EOF
guard_pam_limits
### Unified in 4520()
# - write_pam_login()
# - write_pam_sshd()
# - write_pam_su()
# - write_pam_sudo()
# - write_pam_sudo-i()
# guard_pam_limits
guard_dir && return 0
}
@@ -111,7 +122,9 @@ readonly -f hardening_memory
# '/etc/pam.d/common-session'
# '/etc/pam.d/common-session-noninteractive'
# Globals:
# RECOVERY
# TARGET
# VAR_RUN_RECOVERY
# Arguments:
# None
# Returns:
@@ -119,8 +132,13 @@ readonly -f hardening_memory
#######################################
guard_pam_limits() {
### Declare Arrays, HashMaps, and Variables.
declare var_file_0="${TARGET}/etc/pam.d/common-session"
declare var_file_1="${TARGET}/etc/pam.d/common-session-noninteractive"
declare var_target="${TARGET}"
### Check for TARGET / RECOVERY.
[[ "${VAR_RUN_RECOVERY}" == "true" ]] && var_target="${RECOVERY}"
declare var_file_0="${var_target}/etc/pam.d/common-session"
declare var_file_1="${var_target}/etc/pam.d/common-session-noninteractive"
declare var_line='session required pam_limits.so' var_file=""
declare -i var_changed=0