#940311 merge with lockdown / security-misc?

Package:
hardening-runtime
Source:
hardening-runtime
Submitter:
Patrick Schleizer
Date:
2019-09-21 11:33:05 UTC
Severity:
wishlist
#940311#5
Date:
2019-09-15 12:48:00 UTC
From:
To:
We now have (at least) three very similar packages.

* https://packages.debian.org/buster/lockdown
* https://packages.debian.org/buster/hardening-runtime
* https://github.com/Whonix/security-misc

Let's join forces before we independently reinvent everything. :)

Cheers,
Patrick
#940311#10
Date:
2019-09-15 17:14:27 UTC
From:
To:
Hi,

I'm not sure what security-misc exactly is but we try some coordination with
lockdown when I first filed an ITP (see #919226) but it didn't really go
anywhere.

Regards,
#940311#15
Date:
2019-09-15 17:14:27 UTC
From:
To:
Hi,

I'm not sure what security-misc exactly is but we try some coordination with
lockdown when I first filed an ITP (see #919226) but it didn't really go
anywhere.

Regards,
#940311#20
Date:
2019-09-21 10:02:00 UTC
From:
To:

Inspired by Kernel Self Protection Project (KSPP)

Implements most if not all recommended Linux kernel settings (sysctl)
and kernel parameters by KSPP.

https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project

On top of that does other things. These are fully documented (or at
least mentioned) in the readme:

https://github.com/Whonix/security-misc

Some changes may or may be more controversial. You tell me.


As for kernel settings (sysctl) and kernel parameters by KSPP... Our
files in

https://github.com/Whonix/security-misc/tree/master/etc/default/grub.d

and https://github.com/Whonix/security-misc/tree/master/etc/sysctl.d

could be merged into hardening-runtime?

Cheers,
Patrick
#940311#25
Date:
2019-09-21 10:02:00 UTC
From:
To:

Inspired by Kernel Self Protection Project (KSPP)

Implements most if not all recommended Linux kernel settings (sysctl)
and kernel parameters by KSPP.

https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project

On top of that does other things. These are fully documented (or at
least mentioned) in the readme:

https://github.com/Whonix/security-misc

Some changes may or may be more controversial. You tell me.


As for kernel settings (sysctl) and kernel parameters by KSPP... Our
files in

https://github.com/Whonix/security-misc/tree/master/etc/default/grub.d

and https://github.com/Whonix/security-misc/tree/master/etc/sysctl.d

could be merged into hardening-runtime?

Cheers,
Patrick
#940311#30
Date:
2019-09-21 11:31:20 UTC
From:
To:
hardening-runtime is maintained in salsa so feel free to submit merge request
for settings not already in there. I'm not against having a file per setting
but I'm unsure if it's really that helpful.

Regards,