mirror of
https://github.com/tommytran732/QubesOS-Scripts
synced 2024-11-09 12:11:34 -05:00
unpriv curl for minimal VMs
Signed-off-by: Tommy <contact@tommytran.io>
This commit is contained in:
parent
04fd34d738
commit
6dd8134451
@ -14,6 +14,10 @@
|
|||||||
# License for the specific language governing permissions and limitations under
|
# License for the specific language governing permissions and limitations under
|
||||||
# the License.
|
# the License.
|
||||||
|
|
||||||
|
unpriv(){
|
||||||
|
sudo -u nobody "$@"
|
||||||
|
}
|
||||||
|
|
||||||
# Compliance
|
# Compliance
|
||||||
systemctl mask debug-shell.service
|
systemctl mask debug-shell.service
|
||||||
systemctl mask kdump.service
|
systemctl mask kdump.service
|
||||||
@ -28,19 +32,19 @@ systemctl disable --now systemd-timesyncd
|
|||||||
systemctl mask systemd-timesyncd
|
systemctl mask systemd-timesyncd
|
||||||
|
|
||||||
# Harden SSH
|
# Harden SSH
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | tee /etc/ssh/ssh_config.d/10-custom.conf
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | tee /etc/ssh/ssh_config.d/10-custom.conf
|
||||||
chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
|
||||||
|
|
||||||
# Security kernel settings
|
# Security kernel settings
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | tee /etc/modprobe.d/30_security-misc.conf
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | tee /etc/modprobe.d/30_security-misc.conf
|
||||||
chmod 644 /etc/modprobe.d/30_security-misc.conf
|
chmod 644 /etc/modprobe.d/30_security-misc.conf
|
||||||
sed -i 's/#install msr/install msr/g' /etc/modprobe.d/30_security-misc.conf
|
sed -i 's/#install msr/install msr/g' /etc/modprobe.d/30_security-misc.conf
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf | tee /etc/sysctl.d/990-security-misc.conf
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf | tee /etc/sysctl.d/990-security-misc.conf
|
||||||
chmod 644 /etc/sysctl.d/990-security-misc.conf
|
chmod 644 /etc/sysctl.d/990-security-misc.conf
|
||||||
sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=3/g' /etc/sysctl.d/990-security-misc.conf
|
sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=3/g' /etc/sysctl.d/990-security-misc.conf
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | tee /etc/sysctl.d/30_silent-kernel-printk.conf
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | tee /etc/sysctl.d/30_silent-kernel-printk.conf
|
||||||
chmod 644 /etc/sysctl.d/30_silent-kernel-printk.conf
|
chmod 644 /etc/sysctl.d/30_silent-kernel-printk.conf
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | tee /etc/sysctl.d/30_security-misc_kexec-disable.conf
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | tee /etc/sysctl.d/30_security-misc_kexec-disable.conf
|
||||||
chmod 644 /etc/sysctl.d/30_security-misc_kexec-disable.conf
|
chmod 644 /etc/sysctl.d/30_security-misc_kexec-disable.conf
|
||||||
# Dracut doesn't seem to work - need to investigate
|
# Dracut doesn't seem to work - need to investigate
|
||||||
# dracut -f
|
# dracut -f
|
||||||
|
@ -19,19 +19,19 @@ dnf install -y @hardware-support arc-theme chrony gnome-keyring NetworkManager-w
|
|||||||
|
|
||||||
# Setup NTS
|
# Setup NTS
|
||||||
sudo rm -rf /etc/chrony.conf
|
sudo rm -rf /etc/chrony.conf
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | tee /etc/chrony.conf
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | tee /etc/chrony.conf
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | tee /etc/sysconfig/chronyd
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | tee /etc/sysconfig/chronyd
|
||||||
|
|
||||||
# Theming
|
# Theming
|
||||||
sudo mkdir -p /etc/gtk-3.0
|
sudo mkdir -p /etc/gtk-3.0
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/gtk-3.0/settings.ini | tee /etc/gtk-3.0/settings.ini
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/gtk-3.0/settings.ini | tee /etc/gtk-3.0/settings.ini
|
||||||
|
|
||||||
sudo mkdir -p /etc/gtk-4.0
|
sudo mkdir -p /etc/gtk-4.0
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/gtk-4.0/settings.ini | tee /etc/gtk-4.0/settings.ini
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/gtk-4.0/settings.ini | tee /etc/gtk-4.0/settings.ini
|
||||||
|
|
||||||
# Networking
|
# Networking
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/00-macrandomize.conf | tee /etc/NetworkManager/conf.d/00-macrandomize.conf
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/00-macrandomize.conf | tee /etc/NetworkManager/conf.d/00-macrandomize.conf
|
||||||
curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/01-transient-hostname.conf | tee /etc/NetworkManager/conf.d/01-transient-hostname.conf
|
unpriv curl --proxy http://127.0.0.1:8082 https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/01-transient-hostname.conf | tee /etc/NetworkManager/conf.d/01-transient-hostname.conf
|
||||||
sudo hostnamectl hostname 'localhost'
|
sudo hostnamectl hostname 'localhost'
|
||||||
sudo hostnamectl --transient hostname ''
|
sudo hostnamectl --transient hostname ''
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user