Fedora-Server-40.sh

@@ -46,9 +46,7 @@ sudo chmod 700 /home/*
 # Setup NTS
 sudo rm -rf /etc/chrony.conf
 unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
-sudp chmod 644 /etc/chrony.conf
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
-sudo chmod 544 /etc/sysconfig/chronyd
 
 sudo systemctl restart chronyd
 
@@ -59,10 +57,8 @@ sudo /usr/bin/sed -i 's/\s+nullok//g' /etc/pam.d/system-auth
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
 sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf
-sudo chmod 644 /etc/ssh/sshd_config.d/10-custom.conf
 sudo mkdir -p /etc/systemd/system/sshd.service.d/
 unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | sudo tee /etc/systemd/system/sshd.service.d/override.conf
-sudo chmod 644 /etc/systemd/system/sshd.service.d/override.conf
 sudo systemctl daemon-reload
 sudo systemctl restart sshd
 
@@ -82,21 +78,17 @@ else
 fi
 
 # Disable coredump
-
+umask 022
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf | sudo tee /etc/security/limits.d/30-disable-coredump.conf
-sudo chmod 644 /etc/security/limits.d/30-disable-coredump.conf
 sudo mkdir -p /etc/systemd/coredump.conf.d
-sudo chmod 755 /etc/systemd/coredump.conf.d
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/coredump.conf.d/disable.conf | sudo tee /etc/systemd/coredump.conf.d/disable.conf
-sudo chmod 644 /etc/systemd/coredump.conf.d/disable.conf
+umask 077
 
 # Setup ZRAM
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/zram-generator.conf | sudo tee /etc/systemd/zram-generator.conf
-sudo chmod 644 /etc/systemd/zram-generator.conf
 
 # Setup DNF
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dnf/dnf.conf | sudo tee /etc/dnf/dnf.conf
-sudo chmod 644 /etc/dnf/dnf.conf
 sudo sed -i 's/^metalink=.*/&\&protocol=https/g' /etc/yum.repos.d/*
 
 # Setup automatic updates
@@ -119,10 +111,8 @@ fi
 # Setup unbound
 sudo dnf install unbound -y
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/unbound/unbound.conf | sudo tee /etc/unbound/unbound.conf
-sudo chmod 644 /etc/unbound/unbound.conf
 sudo mkdir /etc/systemd/system/unbound.service.d
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/system/unbound.service.d/override.conf | sudo tee /etc/systemd/system/unbound.service.d/override.conf
-sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf
 sudo systemctl enable --now unbound
 sudo systemctl disable systemd-resolved
 
@@ -133,7 +123,6 @@ if [ "$virtualization" = 'none' ]; then
     sudo systemctl restart fwupd
     mkdir -p /etc/systemd/system/fwupd-refresh.service.d
     unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/system/fwupd-refresh.service.d/override.conf | sudo tee /etc/systemd/system/fwupd-refresh.service.d/override.conf
-    sudo chmod 644 /etc/systemd/system/fwupd-refresh.service.d/override.conf
     sudo systemctl daemon-reload
     sudo systemctl enable --now fwupd-refresh.timer
 fi
@@ -171,22 +160,18 @@ sudo firewall-cmd --lockdown-on
 
 sudo mkdir -p /etc/systemd/system/NetworkManager.service.d
 unpriv curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | sudo tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf
-sudo chmod 644 /etc/systemd/system/NetworkManager.service.d/99-brace.conf
 sudo systemctl daemon-reload
 sudo systemctl restart NetworkManager
 
 # irqbalance hardening
 sudo mkdir -p /etc/systemd/system/irqbalance.service.d
 unpriv curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | sudo tee /etc/systemd/system/irqbalance.service.d/99-brace.conf
-sudo chmod 644 /etc/systemd/system/irqbalance.service.d/99-brace.conf
 sudo systemctl daemon-reload
 sudo systemctl restart irqbalance
 
 # Setup notices
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/issue | sudo tee /etc/issue
-sudo chmod 644 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/issue
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/issue | sudo tee /etc/issue.net
-sudo chmod 644 /etc/issue.net
 
 # Final notes to the user
 output 'Server setup complete. To use unbound for DNS, you need to reboot.'

Fedora-Workstation-40.sh

@@ -49,9 +49,8 @@ if [ "${virtualization}" = 'parallels' ]; then
 else
     sudo rm -rf /etc/chrony.conf
     unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
-    sudo chmod 644 /etc/chrony.conf
     unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
-    sudo chmod 644 /etc/sysconfig/chronyd
+
     sudo systemctl restart chronyd
 fi
 
@@ -65,10 +64,8 @@ sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
 # Security kernel settings
 if [ "${virtualization}" = 'parallels' ]; then
     unpriv curl https://raw.githubusercontent.com/TommyTran732/Kernel-Module-Blacklist/main/etc/modprobe.d/workstation-blacklist.conf | sudo tee /etc/modprobe.d/workstation-blacklist.conf
-    sudo chmod 644 /etc/modprobe.d/workstation-blacklist.conf
 else
     unpriv curl https://raw.githubusercontent.com/secureblue/secureblue/live/config/files/usr/etc/modprobe.d/blacklist.conf | sudo tee /etc/modprobe.d/workstation-blacklist.conf
-    sudo chmod 644 /etc/modprobe.d/workstation-blacklist.conf
 fi
 sudo chmod 644 /etc/modprobe.d/workstation-blacklist.conf
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysctl.d/99-workstation.conf | sudo tee /etc/sysctl.d/99-workstation.conf
@@ -92,46 +89,40 @@ else
 fi
 
 # Disable coredump
+umask 022
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf | sudo tee /etc/security/limits.d/30-disable-coredump.conf
-sudo chmod 644 /etc/security/limits.d/30-disable-coredump.conf
 sudo mkdir -p /etc/systemd/coredump.conf.d
-sudo chmod 755 /etc/systemd/coredump.conf.d
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/coredump.conf.d/disable.conf | sudo tee /etc/systemd/coredump.conf.d/disable.conf
-sudo chmod 644 /etc/systemd/coredump.conf.d/disable.conf
+umask 077
 
 # Disable XWayland
+umask 022
 sudo mkdir -p /etc/systemd/user/org.gnome.Shell@wayland.service.d
-sudo chmod 755 /etc/systemd/user/org.gnome.Shell@wayland.service.d
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/user/org.gnome.Shell%40wayland.service.d/override.conf | sudo tee /etc/systemd/user/org.gnome.Shell@wayland.service.d/override.conf
-sudo chmod 644 /etc/systemd/user/org.gnome.Shell@wayland.service.d/override.conf
+umask 077
 
 # Setup dconf
+umask 022
+mkdir -p /etc/dconf/db/local.d/locks
+
+unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/automount-disable | sudo tee /etc/dconf/db/local.d/locks/automount-disable
+unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/privacy | sudo tee /etc/dconf/db/local.d/locks/privacy
+
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/adw-gtk3-dark | sudo tee /etc/dconf/db/local.d/adw-gtk3-dark
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/automount-disable | sudo tee /etc/dconf/db/local.d/automount-disable
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/button-layout | sudo tee /etc/dconf/db/local.d/button-layout
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/prefer-dark | sudo tee /etc/dconf/db/local.d/prefer-dark
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/privacy | sudo tee /etc/dconf/db/local.d/privacy
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/touchpad | sudo tee /etc/dconf/db/local.d/touchpad
-sudo chmod 644 /etc/dconf/db/local.d/*
 
-mkdir -p /etc/dconf/db/local.d/locks
-sudo chmod 755 /etc/dconf/db/local.d/locks
-
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/automount-disable | sudo tee /etc/dconf/db/local.d/locks/automount-disable
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/privacy | sudo tee /etc/dconf/db/local.d/locks/privacy
-sudo chmod 644 /etc/dconf/db/local.d/locks/*
-
-umask 022
 sudo dconf update
 umask 077
 
 # Setup ZRAM
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/zram-generator.conf | sudo tee /etc/systemd/zram-generator.conf
-sudo chmod 644 /etc/systemd/zram-generator.conf
 
 # Setup DNF
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dnf/dnf.conf | sudo tee /etc/dnf/dnf.conf
-sudo chmod 644 /etc/dnf/dnf.conf
 sudo sed -i 's/^metalink=.*/&\&protocol=https/g' /etc/yum.repos.d/*
 
 # Remove firefox packages
@@ -162,7 +153,7 @@ sudo dnf remove -y baobab chrome-gnome-shell eog gnome-boxes gnome-calculator gn
     gnome-themes-extra gnome-tour gnome-user* gnome-weather loupe snapshot totem
 
 # Remove apps
-sudo dnf remove -y abrt* cheese evince file-roller* libreoffice* mediawriter rhythmbox yelp
+sudo dnf remove -y abrt cheese evince file-roller* libreoffice* mediawriter rhythmbox yelp
 
 # Remove other packages
  sudo dnf remove -y lvm2 rng-tools thermald '*perl*' yajl
@@ -197,6 +188,7 @@ flatpak update -y
 # Install Microsoft Edge if x86_64
 MACHINE_TYPE=$(uname -m)
 if [ "${MACHINE_TYPE}" == 'x86_64' ]; then
+    umask 022
     output 'x86_64 machine, installing Microsoft Edge.'
     echo '[microsoft-edge]
 name=microsoft-edge
@@ -204,17 +196,13 @@ baseurl=https://packages.microsoft.com/yumrepos/edge/
 enabled=1
 gpgcheck=1
 gpgkey=https://packages.microsoft.com/keys/microsoft.asc' | sudo tee /etc/yum.repos.d/microsoft-edge.repo
-    sudo chmod 644 /etc/yum.repos.d/microsoft-edge.repo
     sudo dnf install -y microsoft-edge-stable
     sudo mkdir -p /etc/opt/edge/policies/managed/ /etc/opt/edge/policies/recommended/
-    sudo chmod 755 /etc/opt/edge/policies/managed/ /etc/opt/edge/policies/recommended/
     unpriv curl https://raw.githubusercontent.com/TommyTran732/Microsoft-Edge-Policies/main/Linux/managed.json | sudo tee /etc/opt/edge/policies/managed/managed.json
     unpriv curl https://raw.githubusercontent.com/TommyTran732/Microsoft-Edge-Policies/main/Linux/recommended.json | sudo tee /etc/opt/edge/policies/recommended/recommended.json
-    sudo chmod 644 /etc/opt/edge/policies/managed/managed.json /etc/opt/edge/policies/recommended/recommended.json
     sudo mkdir -p /usr/local/share/applications
-    sudo chmod 755 /usr/local/share/applications
     sed 's/^Exec=\/usr\/bin\/microsoft-edge-stable/& --ozone-platform=wayland --start-maximized/g' /usr/share/applications/microsoft-edge.desktop | sudo tee /usr/local/share/applications/microsoft-edge.desktop
-    sudo chmod 644 /usr/local/share/applications/microsoft-edge.desktop
+    umask 077
 fi
 
 # Setup fwupd
@@ -252,16 +240,13 @@ sudo firewall-cmd --reload
 sudo firewall-cmd --lockdown-on
 
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/00-macrandomize.conf | sudo tee /etc/NetworkManager/conf.d/00-macrandomize.conf
-sudo chmod 644 /etc/NetworkManager/conf.d/00-macrandomize.conf
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/01-transient-hostname.conf | sudo tee /etc/NetworkManager/conf.d/01-transient-hostname.conf
-sudo chmod 644 /etc/NetworkManager/conf.d/01-transient-hostname.conf
 sudo nmcli general reload conf
 sudo hostnamectl hostname 'localhost'
 sudo hostnamectl --transient hostname ''
 
 sudo mkdir -p /etc/systemd/system/NetworkManager.service.d
 unpriv curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | sudo tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf
-sudo chmod 644 /etc/systemd/system/NetworkManager.service.d/99-brace.conf
 sudo systemctl daemon-reload
 sudo systemctl restart NetworkManager
 

Proxmox-8.sh

@@ -25,6 +25,7 @@ systemctl mask debug-shell.service
 
 ## Avoid phased updates
 curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades | tee /etc/apt/apt.conf.d/99sane-upgrades
+chmod 644 /etc/apt/apt.conf.d/99sane-upgrades
 
 # Setup NTS
 rm -rf /etc/chrony/chrony.conf
@@ -33,7 +34,9 @@ systemctl restart chronyd
 
 # Harden SSH
 curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | tee /etc/ssh/sshd_config.d/10-custom.conf
+chmod 644 /etc/ssh/sshd_config.d/10-custom.conf
 curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | tee /etc/ssh/ssh_config.d/10-custom.conf
+chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
 mkdir -p /etc/systemd/system/ssh.service.d
 curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | tee /etc/systemd/system/ssh.service.d/override.conf
 systemctl daemon-reload
@@ -71,17 +74,21 @@ proxmox-boot-tool refresh
 
 # Kernel hardening
 curl https://raw.githubusercontent.com/secureblue/secureblue/live/config/files/usr/etc/modprobe.d/blacklist.conf | tee /etc/modprobe.d/server-blacklist.conf
+chmod 644 /etc/modprobe.d/server-blacklist.conf
 sed -i 's/kernel_io_uring_disable = 2/#ernel_io_uring_disable = 2/g'
 curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysctl.d/99-server.conf | tee /etc/sysctl.d/99-server.conf
+chmod 644 /etc/sysctl.d/99-server.conf
 sysctl -p
 
 # Rebuild initramfs
 update-initramfs -u
 
 # Disable coredump
+umask 022
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf | tee /etc/security/limits.d/30-disable-coredump.conf
 mkdir -p /etc/systemd/coredump.conf.d
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/coredump.conf.d/disable.conf | tee /etc/systemd/coredump.conf.d/disable.conf
+umask 077
 
 # Harden SSH
 sed -i 's/#GSSAPIAuthentication no/GSSAPIAuthentication no/g' /etc/ssh/sshd_config

RHEL-9.sh

@@ -40,9 +40,7 @@ sudo chmod 700 /home/*
 
 # Setup NTS
 unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
-sudo chmod 644 /etc/chrony.conf
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
-sudo chmod 644 /etc/sysconfig/chronyd
 
 sudo systemctl restart chronyd
 
@@ -69,15 +67,14 @@ sudo sysctl -p
 sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1 console=tty0 console=ttyS0,115200'
 
 # Disable coredump
+umask 022
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf | sudo tee /etc/security/limits.d/30-disable-coredump.conf
-sudo chmod 644 /etc/security/limits.d/30-disable-coredump.conf
 sudo mkdir -p /etc/systemd/coredump.conf.d
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/coredump.conf.d/disable.conf | sudo tee /etc/systemd/coredump.conf.d/disable.conf
-sudo chmod 644 /etc/systemd/coredump.conf.d/disable.conf
+umask 077
 
 # Setup DNF
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dnf/dnf.conf | sudo tee /etc/dnf/dnf.conf
-sudo chmod 644 /etc/dnf/dnf.conf
 sudo sed -i 's/^metalink=.*/&\&protocol=https/g' /etc/yum.repos.d/*
 
 # Setup automatic updates
@@ -127,8 +124,6 @@ forward-zone:
   forward-addr: 2606:4700:4700::1112@853#security.cloudflare-dns.com
   forward-addr: 2606:4700:4700::1002@853#security.cloudflare-dns.com' | sudo tee /etc/unbound/unbound.conf
 
-sudo chmod 644 /etc/unbound/unbound.conf
-
 mkdir -p /etc/systemd/system/unbound.service.d
 echo $'[Service]
 MemoryDenyWriteExecute=true
@@ -149,8 +144,6 @@ SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete
 RestrictNamespaces=yes
 LockPersonality=yes' | sudo tee /etc/systemd/system/unbound.service.d/override.conf
 
-sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf
-
 sudo systemctl enable --now unbound
 
 # Setup yara
@@ -165,7 +158,6 @@ if [ "$virtualization" = 'none' ]; then
     sudo systemctl restart fwupd
     mkdir -p /etc/systemd/system/fwupd-refresh.service.d
     unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/system/fwupd-refresh.service.d/override.conf | sudo tee /etc/systemd/system/fwupd-refresh.service.d/override.conf
-    sudo chmod 644 /etc/systemd/system/fwupd-refresh.service.d/override.conf
     sudo systemctl daemon-reload
     sudo systemctl enable --now fwupd-refresh.timer
 fi
@@ -214,22 +206,18 @@ sudo firewall-cmd --lockdown-on
 
 sudo mkdir -p /etc/systemd/system/NetworkManager.service.d
 unpriv curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | sudo tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf
-sudo chmod 644 /etc/systemd/system/NetworkManager.service.d/99-brace.conf
 sudo systemctl daemon-reload
 sudo systemctl restart NetworkManager
 
 # irqbalance hardening
 sudo mkdir -p /etc/systemd/system/irqbalance.service.d
 unpriv curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | sudo tee /etc/systemd/system/irqbalance.service.d/99-brace.conf
-sudo chmod 644 /etc/systemd/system/irqbalance.service.d/99-brace.conf
 sudo systemctl daemon-reload
 sudo systemctl restart irqbalance
 
 # Setup notices
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/issue | sudo tee /etc/issue
-sudo chmod 644 /etc/issue
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/issue | sudo tee /etc/issue.net
-sudo chmod 644 /etc/issue.net
 
 # Final notes to the user
 output 'Server setup complete. To use unbound for DNS, you need to run the following commands:'

Ubuntu-24.04-Desktop.sh

@@ -1,243 +0,0 @@
-#!/bin/bash
-
-# Copyright (C) 2021-2024 Thien Tran
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not
-# use this file except in compliance with the License. You may obtain a copy of
-# the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations under
-# the License.
-
-#Please note that this is how I PERSONALLY setup my computer - I do some stuff such as not using anything to download GNOME extensions from extensions.gnome.org and installing the extensions as a package instead
-
-output(){
-    echo -e '\e[36m'"$1"'\e[0m';
-}
-
-unpriv(){
-    sudo -u nobody "$@"
-}
-
-virtualization=$(systemd-detect-virt)
-
-# Compliance and updates
-sudo systemctl mask debug-shell.service
-
-# Setting umask to 077
-umask 077
-sudo sed -i 's/^UMASK.*/UMASK 077/g' /etc/login.defs
-sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /etc/login.defs
-sudo sed -i 's/^USERGROUPS_ENAB.*/USERGROUPS_ENAB no/g' /etc/login.defs
-
-# Make home directory private
-sudo chmod 700 /home/*
-
-# Setup NTS
-sudo systemctl disable --now systemd-timesyncd
-sudo systemctl mask systemd-timesyncd
-
-if [ "${virtualization}" = "parallels" ]; then
-    sudo apt install -y chrony
-    unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
-    sudo chmod 644 /etc/chrony/chrony.conf
-    sudo systemctl restart chronyd
-fi
-
-# Harden SSH
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf
-sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
-
-# Security kernel settings
-if [ "${virtualization}" = 'parallels' ]; then
-    unpriv curl https://raw.githubusercontent.com/TommyTran732/Kernel-Module-Blacklist/main/etc/modprobe.d/workstation-blacklist.conf | sudo tee /etc/modprobe.d/workstation-blacklist.conf
-    sudo chmod 644 /etc/modprobe.d/workstation-blacklist.conf
-else
-    unpriv curl https://raw.githubusercontent.com/secureblue/secureblue/live/config/files/usr/etc/modprobe.d/blacklist.conf | sudo tee /etc/modprobe.d/workstation-blacklist.conf
-    sudo chmod 644 /etc/modprobe.d/workstation-blacklist.conf
-fi
-sudo chmod 644 /etc/modprobe.d/workstation-blacklist.conf
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysctl.d/99-workstation.conf | sudo tee /etc/sysctl.d/99-workstation.conf
-sudo chmod 644 /etc/sysctl.d/99-workstation.conf
-sudo sysctl -p
-
-# Rebuild initramfs
-sudo update-initramfs -u
-
-# Disable coredump
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf | sudo tee /etc/security/limits.d/30-disable-coredump.conf
-sudo chmod 644 /etc/security/limits.d/30-disable-coredump.conf
-sudo mkdir -p /etc/systemd/coredump.conf.d
-sudo chmod 755 /etc/systemd/coredump.conf.d
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/coredump.conf.d/disable.conf | sudo tee /etc/systemd/coredump.conf.d/disable.conf
-sudo chmod 644 /etc/systemd/coredump.conf.d/disable.conf
-
-# Update GRUB config
-sed -i 's/splash/splash mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off/g' /etc/default/grub
-sudo update-grub
-
-# Systemd Hardening
-sudo mkdir -p /etc/systemd/system/irqbalance.service.d
-sudo chmod 755 /etc/systemd/system/irqbalance.service.d
-unpriv curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | sudo tee /etc/systemd/system/irqbalance.service.d/99-brace.conf
-sudo chmod 644 /etc/systemd/system/irqbalance.service.d/99-brace.conf
-
-# Disable XWayland
-sudo mkdir -p /etc/systemd/user/org.gnome.Shell@wayland.service.d
-sudo chmod 755 /etc/systemd/user/org.gnome.Shell@wayland.service.d
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/user/org.gnome.Shell%40wayland.service.d/override.conf | sudo tee /etc/systemd/user/org.gnome.Shell@wayland.service.d/override.conf
-sudo chmod 644 /etc/systemd/user/org.gnome.Shell@wayland.service.d/override.conf
-
-# Setup dconf
-# Does not work - need to investigate
-
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/apport-disable | sudo tee /etc/dconf/db/local.d/apport-disable
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/automount-disable | sudo tee /etc/dconf/db/local.d/automount-disable
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/button-layout | sudo tee /etc/dconf/db/local.d/button-layout
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/prefer-dark | sudo tee /etc/dconf/db/local.d/prefer-dark
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/privacy | sudo tee /etc/dconf/db/local.d/privacy
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/touchpad | sudo tee /etc/dconf/db/local.d/touchpad
-sudo chmod 644 /etc/dconf/db/local.d/*
-
-sudo mkdir -p /etc/dconf/db/local.d/locks
-chmod 755 /etc/dconf/db/local.d/locks
-
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/apport-disable | sudo tee /etc/dconf/db/local.d/locks/apport-disable
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/automount-disable | sudo tee /etc/dconf/db/local.d/locks/automount-disable
-sudo chmod 644 /etc/dconf/db/local.d/locks/*
-
-umask 022
-sudo dconf update
-umask 077
-
-ubuntu-report -f send no
-sudo systemctl disable --now apport.service
-sudo systemctl mask apport.service
-sudo systemctl disable --now whoopsie.service
-sudo systemctl mask whoopsie.service
-sudo systemctl disable --now whoopsie.path
-sudo systemctl mask whoopsie.path
-
-# Update packages
-sudo apt update -y
-sudo apt full-upgrade -y
-
-## Avoid phased updates
-sudo apt install -y curl 
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades | sudo tee /etc/apt/apt.conf.d/99sane-upgrades
-sudo chmod 644 /etc/apt/apt.conf.d/99sane-upgrades
-
-# Update system
-sudo apt update -y
-sudo apt full-upgrade -y
-sudo apt autoremove -y
-
-# Remove unneeded packages
-sudo apt purge -y apport baobab cups* eog gedit firefox* gnome-calculator gnome-characters* gnome-clocks gnome-font-viewer gnome-logs gnome-power-manager gnome-shell-extension-prefs gnome-system-monitor gnome-text-editor libreoffice* seahorse tcpdump whoopsie
-sudo apt autoremove -y
-sudo snap remove firefox gnome-text-editor snap-store
-
-sudo rm -rf /usr/share/hplip
-
-# Install packages that I use
-sudo apt install -y gnome-console gnome-software-plugin-flatpak
-sudo snap install gnome-text-editor
-
-# Install appropriate virtualization drivers
-if [ "$virtualization" = 'kvm' ]; then
-    sudo apt install -y qemu-guest-agent spice-vdagent
-fi
-
-# Setup Flatpak
-sudo flatpak override --system --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
-flatpak override --user --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
-flatpak remote-add --if-not-exists --user flathub https://dl.flathub.org/repo/flathub.flatpakrepo
-flatpak --user install org.gnome.Extensions com.github.tchx84.Flatseal org.gnome.Loupe -y
-flatpak --user override com.github.tchx84.Flatseal --filesystem=/var/lib/flatpak/app:ro --filesystem=xdg-data/flatpak/app:ro --filesystem=xdg-data/flatpak/overrides:create
-flatpak --user override org.gnome.Extensions --talk-name=org.gnome.Shell.Extensions
-flatpak update -y
-
-# Rosetta setup
-if [ -f /media/psf/RosettaLinux/rosetta ] || [ -f /media/rosetta/rosetta ]; then
-    if [ -f /media/rosetta/rosetta ]; then
-        sudo /usr/sbin/update-binfmts --install rosetta /media/rosetta/rosetta --magic "\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x3e\x00" --mask "\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff" --credentials yes --preserve no --fix-binary yes
-    fi
-    sed -i 's/fs.binfmt_misc.status = 0/#fs.binfmt_misc.status = 0/g' /etc/sysctl.d/99-workstation.conf
-    unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/sources.list.d/rosetta.sources | sudo tee /etc/apt/sources.list.d/ubuntu.sources
-    sudo chmod 644 /etc/apt/sources.list.d/ubuntu.sources
-    sudo dpkg --add-architecture amd64
-    sudo apt update
-    sudo apt full-upgrade -y
-fi
-
-# Install Microsoft Edge if x86_64
-MACHINE_TYPE=$(uname -m)
-if [ "${MACHINE_TYPE}" == 'x86_64' ] || [ -f /media/psf/RosettaLinux/rosetta ] || [ -f /media/rosetta/rosetta ]; then
-    output 'x86_64 machine, installing Microsoft Edge.'
-    unpriv curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /usr/share/keyrings/microsoft.gpg
-    chmod 644  /usr/share/keyrings/microsoft.gpg
-    unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/sources.list.d/microsoft-edge.sources | sudo tee /etc/apt/sources.list.d/microsoft-edge.sources
-    sudo chmod 644 /etc/apt/sources.list.d/microsoft-edge.sources
-    sudo apt update
-    sudo apt full-upgrade -y
-    sudo apt install -y microsoft-edge-stable
-    sudo mkdir -p /etc/opt/edge/policies/managed/ /etc/opt/edge/policies/recommended/
-    sudo chmod 755  /etc/opt/edge/policies/managed/ /etc/opt/edge/policies/recommended/
-    unpriv curl https://raw.githubusercontent.com/TommyTran732/Microsoft-Edge-Policies/main/Linux/managed.json | sudo tee /etc/opt/edge/policies/managed/managed.json
-    unpriv curl https://raw.githubusercontent.com/TommyTran732/Microsoft-Edge-Policies/main/Linux/recommended.json | sudo tee /etc/opt/edge/policies/recommended/recommended.json
-    sudo chmod 644 /etc/opt/edge/policies/managed/managed.json /etc/opt/edge/policies/recommended/recommended.json
-    if [ -f /media/psf/RosettaLinux/rosetta ] || [ -f /media/rosetta/rosetta ]; then
-        #Edge does not seem to work on Wayland with Rosetta - dunno why yet. Probably missing libraries?
-        sudo rm -rf /etc/systemd/user/org.gnome.Shell@wayland.service.d
-    else
-        sudo mkdir -p /usr/local/share/applications
-        sudo chmod 755 /usr/local/share/applications
-        sed 's/^Exec=\/usr\/bin\/microsoft-edge-stable/& --ozone-platform=wayland --start-maximized/g' /usr/share/applications/microsoft-edge.desktop | sudo tee /usr/local/share/applications/microsoft-edge.desktop
-        chmod 644 /usr/local/share/applications/microsoft-edge.desktop
-    fi
-fi
-
-# Enable fstrim.timer
-sudo systemctl enable --now fstrim.timer
-
-### Differentiating bare metal and virtual installs
-
-# Setup tuned
-if [ "$virtualization" = 'none' ]; then
-    output "Bare Metal installation. Tuned will not be set up here - PPD should take care of it."
-else
-    sudo apt purge -y power-profiles-daemon
-    sudo apt install -y tuned
-    systemctl enable --now tuned
-    sudo tuned-adm profile virtual-guest
-fi
-
-# Setup fwupd
-echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
-sudo systemctl restart fwupd
-
-# Setup networking
-
-# UFW Snap is strictly confined, unlike its .deb counterpart
-sudo apt purge -y ufw
-sudo snap install ufw
-sudo ufw enable
-
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/00-macrandomize.conf | sudo tee /etc/NetworkManager/conf.d/00-macrandomize.conf
-sudo chmod 644 /etc/NetworkManager/conf.d/00-macrandomize.conf
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/01-transient-hostname.conf | sudo tee /etc/NetworkManager/conf.d/01-transient-hostname.conf
-sudo chmod 644 /etc/NetworkManager/conf.d/01-transient-hostname.conf
-sudo nmcli general reload conf
-sudo hostnamectl hostname 'localhost'
-sudo hostnamectl --transient hostname ''
-
-sudo mkdir -p /etc/systemd/system/NetworkManager.service.d
-unpriv curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | sudo tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf
-sudo chmod 644 /etc/systemd/system/NetworkManager.service.d/99-brace.conf
-sudo systemctl daemon-reload
-sudo systemctl restart NetworkManager

Ubuntu-24.04-Server.sh

@@ -45,7 +45,6 @@ sudo systemctl disable --now systemd-timesyncd
 sudo systemctl mask systemd-timesyncd
 sudo apt install -y chrony
 unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
-sudo chmod 644 /etc/chrony/chrony.conf
 sudo systemctl restart chronyd
 
 # Harden SSH
@@ -55,7 +54,6 @@ unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/m
 sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
 sudo mkdir -p /etc/systemd/system/ssh.service.d
 unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | sudo tee /etc/systemd/system/ssh.service.d/override.conf
-sudo chmod 644 /etc/systemd/system/ssh.service.d/override.conf
 sudo systemctl daemon-reload
 sudo systemctl restart ssh
 
@@ -70,12 +68,11 @@ sudo sysctl -p
 sudo update-initramfs -u
 
 # Disable coredump
+umask 022
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf | sudo tee /etc/security/limits.d/30-disable-coredump.conf
-sudo chmod 644 /etc/security/limits.d/30-disable-coredump.conf
 sudo mkdir -p /etc/systemd/coredump.conf.d
-sudo chmod 755 /etc/systemd/coredump.conf.d
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/coredump.conf.d/disable.conf | sudo tee /etc/systemd/coredump.conf.d/disable.conf
-sudo chmod 644 /etc/systemd/coredump.conf.d/disable.conf
+umask 077
 
 # Update GRUB config
 if [ ! -d /boot/efi/EFI/ZBM ]; then
@@ -127,7 +124,6 @@ if [ "$virtualization" = 'none' ]; then
     sudo systemctl restart fwupd
     mkdir -p /etc/systemd/system/fwupd-refresh.service.d
     unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/system/fwupd-refresh.service.d/override.conf | sudo tee /etc/systemd/system/fwupd-refresh.service.d/override.conf
-    sudo chmod 644 /etc/systemd/system/fwupd-refresh.service.d/override.conf
     sudo systemctl daemon-reload
     sudo systemctl enable --now fwupd-refresh.timer
 fi
@@ -169,8 +165,6 @@ forward-zone:
   forward-addr: 2606:4700:4700::1112@853#security.cloudflare-dns.com
   forward-addr: 2606:4700:4700::1002@853#security.cloudflare-dns.com' | sudo tee /etc/unbound/unbound.conf.d/custom.conf
 
-sudo chmod 644 /etc/unbound/unbound.conf.d/custom.conf
-
 mkdir -p /etc/systemd/system/unbound.service.d
 echo $'[Service]
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
@@ -203,8 +197,6 @@ BindReadOnlyPaths=-/run/systemd/notify:@UNBOUND_CHROOT_DIR@/run/systemd/notify
 BindReadOnlyPaths=-/dev/urandom:@UNBOUND_CHROOT_DIR@/dev/urandom
 BindPaths=-/dev/log:@UNBOUND_CHROOT_DIR@/dev/log' | sudo tee /etc/systemd/system/unbound.service.d/override.conf
 
-sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf
-
 sudo systemctl daemon-reload
 sudo systemctl restart unbound
 sudo systemctl disable systemd-resolved

etc/apt/rosetta-sources.list

@@ -0,0 +1,63 @@
+# deb cdrom:[Ubuntu 22.04.3 LTS _mantic Jellyfish_ - Release arm64 (20240119)]/ mantic main restricted
+
+# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
+# newer versions of the distribution.
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic main restricted
+deb [arch=amd64] http://us.archive.ubuntu.com/ubuntu/ mantic main restricted
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports/ mantic main restricted
+
+## Major bug fix updates produced after the final release of the
+## distribution.
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic-updates main restricted
+deb [arch=amd64] http://us.archive.ubuntu.com/ubuntu/ mantic-updates main restricted
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports/ mantic-updates main restricted
+
+## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
+## team. Also, please note that software in universe WILL NOT receive any
+## review or updates from the Ubuntu security team.
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic universe
+deb [arch=amd64] http://us.archive.ubuntu.com/ubuntu/ mantic universe
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports/ mantic universe
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic-updates universe
+deb [arch=amd64] http://us.archive.ubuntu.com/ubuntu/ mantic-updates universe
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports/ mantic-updates universe
+
+## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
+## team, and may not be under a free licence. Please satisfy yourself as to
+## your rights to use the software. Also, please note that software in
+## multiverse WILL NOT receive any review or updates from the Ubuntu
+## security team.
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic multiverse
+deb [arch=amd64] http://us.archive.ubuntu.com/ubuntu/ mantic multiverse
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports/ mantic multiverse
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic-updates multiverse
+deb [arch=amd64] http://us.archive.ubuntu.com/ubuntu/ mantic-updates multiverse
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports/ mantic-updates multiverse
+
+## N.B. software from this repository may not have been tested as
+## extensively as that contained in the main release, although it includes
+## newer versions of some applications which may provide useful features.
+## Also, please note that software in backports WILL NOT receive any review
+## or updates from the Ubuntu security team.
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic-backports main restricted universe multiverse
+deb [arch=amd64] http://us.archive.ubuntu.com/ubuntu/ mantic-backports main restricted universe multiverse
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports/ mantic-backports main restricted universe multiverse
+
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic-security main restricted
+deb [arch=amd64] http://security.ubuntu.com/ubuntu/ mantic-security main restricted
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports mantic-security main restricted
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic-security universe
+deb [arch=amd64] http://security.ubuntu.com/ubuntu/ mantic-security universe
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports mantic-security universe
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic-security multiverse
+deb [arch=amd64] http://security.ubuntu.com/ubuntu/ mantic-security multiverse
+# deb-src http://us.ports.ubuntu.com/ubuntu-ports mantic-security multiverse
+
+deb [arch=arm64] http://us.ports.ubuntu.com/ubuntu-ports/ mantic-proposed main restricted
+deb [arch=amd64] http://us.archive.ubuntu.com/ubuntu/ mantic-proposed main restricted
+
+# This system was installed using small removable media
+# (e.g. netinst, live or single CD). The matching "deb cdrom"
+# entries were disabled at the end of the installation process.
+# For information about how to configure apt package sources,
+# see the sources.list(5) manual.

etc/apt/sources.list.d/microsoft-edge.list

@@ -0,0 +1 @@
+deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/edge stable main

etc/apt/sources.list.d/microsoft-edge.sources

@@ -1,6 +0,0 @@
-Types: deb
-URIs: https://packages.microsoft.com/repos/edge
-Suites: stable
-Components: main
-Signed-By: /usr/share/keyrings/microsoft.gpg
-Architectures: amd64

etc/apt/sources.list.d/rosetta.sources

@@ -1,27 +0,0 @@
-Types: deb
-URIs: http://ports.ubuntu.com/ubuntu-ports/
-Suites: noble noble-updates noble-backports
-Components: main restricted universe multiverse
-Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
-Architectures: arm64
-
-Types: deb
-URIs: http://ports.ubuntu.com/ubuntu-ports/
-Suites: noble-security
-Components: main restricted universe multiverse
-Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
-Architectures: arm64
-
-Types: deb
-URIs: http://archive.ubuntu.com/ubuntu/
-Suites: noble noble-updates noble-backports
-Components: main restricted universe multiverse
-Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
-Architectures: amd64
-
-Types: deb
-URIs: http://archive.ubuntu.com/ubuntu/
-Suites: noble-security
-Components: main restricted universe multiverse
-Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
-Architectures: amd64

etc/sysctl.d/99-workstation.conf

@@ -3,8 +3,7 @@
 dev.tty.ldisc_autoload = 0
 
 # https://access.redhat.com/solutions/1985633
-# Seems dangerous.
+# Seems dangerous
-# Roseta need this though, so if you use it comment this out.
 fs.binfmt_misc.status = 0
 
 # https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-userspace
@@ -15,7 +14,7 @@ fs.protected_symlinks = 1
 fs.protected_hardlinks = 1
 
 # https://madaidans-insecurities.github.io/guides/linux-hardening.html#core-dumps
-# Disable coredumps.
+# Disable coredumps
 # For additional safety, disable coredumps using ulimit and systemd too.
 kernel.core_pattern=|/bin/false
 fs.suid_dumpable = 0
@@ -43,6 +42,8 @@ net.core.bpf_jit_harden = 2
 kernel.unprivileged_userns_clone = 1
 
 # Disable ptrace. Not needed on workstations.
+# Also, the Debian gVisor package from Google will just take priority over this with their
+# /etc/sysctl.d/999-gvisor.conf file.
 kernel.yama.ptrace_scope = 3
 
 # https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl