diff options
| -rw-r--r-- | libre/linux-libre-grsec/PKGBUILD | 14 | ||||
| -rw-r--r-- | libre/linux-libre-grsec/linux-libre-grsec.install | 45 | ||||
| -rw-r--r-- | libre/linux-libre-grsec/sysctl.conf | 131 |
3 files changed, 5 insertions, 185 deletions
diff --git a/libre/linux-libre-grsec/PKGBUILD b/libre/linux-libre-grsec/PKGBUILD index f905d06c5..fd6ee3d1f 100644 --- a/libre/linux-libre-grsec/PKGBUILD +++ b/libre/linux-libre-grsec/PKGBUILD @@ -1,3 +1,4 @@ +# $Id: PKGBUILD 116869 2014-08-04 21:40:54Z thestinger $ # Maintainer (Arch): Daniel Micay <danielmicay@gmail.com> # Contributor (Arch): Tobias Powalowski <tpowa@archlinux.org> # Contributor (Arch): Thomas Baechler <thomas@archlinux.org> @@ -15,10 +16,10 @@ pkgbase=linux-libre-grsec # Build stock -libre-grsec kernel _basekernel=3.15 _sublevel=8 _grsecver=3.0 -_timestamp=201408031129 +_timestamp=201408040708 _pkgver=${_basekernel}.${_sublevel} pkgver=${_basekernel}.${_sublevel}.${_timestamp} -pkgrel=1 +pkgrel=2 _lxopkgver=${_basekernel}.8 # nearly always the same as pkgver arch=('i686' 'x86_64' 'mips64el') url="https://grsecurity.net/" @@ -38,7 +39,6 @@ source=("http://linux-libre.fsfla.org/pub/linux-libre/releases/${_basekernel}-gn 'boot-logo.patch' 'change-default-console-loglevel.patch' 'Revert-userns-Allow-unprivileged-users-to-create-use.patch' - 'sysctl.conf' "http://www.linux-libre.fsfla.org/pub/linux-libre/lemote/gnewsense/pool/debuginfo/linux-patches-${_lxopkgver}-gnu_0loongsonlibre_mipsel.tar.xz") sha256sums=('93450dc189131b6a4de862f35c5087a58cc7bae1c24caa535d2357cc3301b688' '6dfa7e972f54feef3a40047704495c00b4e163d7f164c133aaaa70871ab61afe' @@ -52,7 +52,6 @@ sha256sums=('93450dc189131b6a4de862f35c5087a58cc7bae1c24caa535d2357cc3301b688' 'f913384dd6dbafca476fcf4ccd35f0f497dda5f3074866022facdb92647771f6' 'faced4eb4c47c4eb1a9ee8a5bf8a7c4b49d6b4d78efbe426e410730e6267d182' '1b3651558fcd497c72af3d483febb21fff98cbb9fbcb456da19b24304c40c754' - 'd4d4ae0b9c510547f47d94582e4ca08a7f12e9baf324181cb54d328027305e31' '2b514ce7d678919bc923fc3a4beef38f4a757a6275717dfe7147544c2e9964f0') if [ "$CARCH" != "mips64el" ]; then # don't use the Loongson-specific patches on non-mips64el arches. @@ -154,14 +153,14 @@ build() { _package() { pkgdesc="The ${pkgbase^} kernel and modules with grsecurity/PaX patches" [ "${pkgbase}" = "linux-libre" ] && groups=('base') - depends=('coreutils' 'linux-libre-firmware' 'kmod') + depends=('coreutils' 'linux-libre-firmware' 'kmod' 'grsec-common') optdepends=('crda: to set the correct wireless channels of your country' 'gradm: to configure and enable Role Based Access Control (RBAC)' 'paxd: to enable PaX exploit mitigations and apply exceptions automatically') provides=("kernel26${_kernelname}=${pkgver}" "linux${_kernelname}=${pkgver}") conflicts=("kernel26${_kernelname}" "kernel26-libre${_kernelname}" "linux${_kernelname}") replaces=("kernel26${_kernelname}" "kernel26-libre${_kernelname}" "linux${_kernelname}") - backup=("etc/mkinitcpio.d/${pkgbase}.preset" 'etc/sysctl.d/05-grsecurity.conf') + backup=("etc/mkinitcpio.d/${pkgbase}.preset") install=${pkgbase}.install if [ "$CARCH" = "mips64el" ]; then optdepends+=('mkinitcpio: to make the initramfs (needs reinstall of this package)') @@ -243,9 +242,6 @@ _package() { mkdir -p "$pkgdir/usr/lib/modules/${_kernver}/build/tools/gcc/size_overflow_plugin" install -m644 tools/gcc/size_overflow_plugin/Makefile tools/gcc/size_overflow_plugin/*.so \ "$pkgdir/usr/lib/modules/${_kernver}/build/tools/gcc/size_overflow_plugin" - - # install sysctl configuration for grsecurity switches - install -Dm600 "${srcdir}/sysctl.conf" "${pkgdir}/etc/sysctl.d/05-grsecurity.conf" } _package-headers() { diff --git a/libre/linux-libre-grsec/linux-libre-grsec.install b/libre/linux-libre-grsec/linux-libre-grsec.install index 22a798dfa..572c893d1 100644 --- a/libre/linux-libre-grsec/linux-libre-grsec.install +++ b/libre/linux-libre-grsec/linux-libre-grsec.install @@ -15,46 +15,6 @@ EOF fi } -_add_groups() { - if getent group tpe-trusted >/dev/null; then - groupmod -g 200 -n tpe tpe-trusted - fi - - if ! getent group tpe >/dev/null; then - groupadd -g 200 -r tpe - fi - - if ! getent group audit >/dev/null; then - groupadd -g 201 -r audit - fi - - if getent group socket-deny-all >/dev/null; then - groupmod -g 202 socket-deny-all - else - groupadd -g 202 -r socket-deny-all - fi - - if getent group socket-deny-client >/dev/null; then - groupmod -g 203 socket-deny-client - else - groupadd -g 203 -r socket-deny-client - fi - - if getent group socket-deny-server >/dev/null; then - groupmod -g 204 socket-deny-server - else - groupadd -g 204 -r socket-deny-server - fi -} - -_remove_groups() { - for group in tpe socket-deny-server socket-deny-client socket-deny-all; do - if getent group $group >/dev/null; then - groupdel $group - fi - done -} - post_install () { # updating module dependencies echo ">>> Updating module dependencies. Please wait ..." @@ -64,7 +24,6 @@ post_install () { mkinitcpio -p linux-libre${KERNEL_NAME} fi - _add_groups _uderef_warning } @@ -91,8 +50,6 @@ post_upgrade() { echo ">>> include the 'keyboard' hook in your mkinitcpio.conf." fi - _add_groups - if [[ $(vercmp $2 3.15.6.201407232200-2) -lt 0 ]]; then _uderef_warning fi @@ -102,6 +59,4 @@ post_remove() { # also remove the compat symlinks rm -f boot/initramfs-linux-libre${KERNEL_NAME}.img rm -f boot/initramfs-linux-libre${KERNEL_NAME}-fallback.img - - _remove_groups } diff --git a/libre/linux-libre-grsec/sysctl.conf b/libre/linux-libre-grsec/sysctl.conf deleted file mode 100644 index a5f6bf83e..000000000 --- a/libre/linux-libre-grsec/sysctl.conf +++ /dev/null @@ -1,131 +0,0 @@ -# All features in the kernel.grsecurity namespace are disabled by default in -# the kernel and must be enabled here. - -# -# Disable PaX enforcement by default. -# -# The `paxd` package sets softmode back to 0 in a configuration file loaded -# after this one. It automatically handles setting exceptions from the PaX -# exploit mitigations after Pacman operations. Altering the setting here rather -# than using `paxd` is not recommended. -# - -kernel.pax.softmode = 1 - -# -# Memory protections -# - -#kernel.grsecurity.disable_priv_io = 1 -kernel.grsecurity.deter_bruteforce = 1 - -# -# Race free SymLinksIfOwnerMatch for web servers -# -# symlinkown_gid: http group -# - -kernel.grsecurity.enforce_symlinksifowner = 1 -kernel.grsecurity.symlinkown_gid = 33 - -# -# FIFO restrictions -# -# Prevent writing to a FIFO in a world-writable sticky directory (e.g. /tmp), -# unless the owner of the FIFO is the same owner of the directory it's held in. -# - -kernel.grsecurity.fifo_restrictions = 1 - -# -# Deny any further rw mounts -# - -#kernel.grsecurity.romount_protect = 1 - -# -# chroot restrictions (the commented options will break containers) -# - -#kernel.grsecurity.chroot_caps = 1 -#kernel.grsecurity.chroot_deny_chmod = 1 -#kernel.grsecurity.chroot_deny_chroot = 1 -kernel.grsecurity.chroot_deny_fchdir = 1 -#kernel.grsecurity.chroot_deny_mknod = 1 -#kernel.grsecurity.chroot_deny_mount = 1 -#kernel.grsecurity.chroot_deny_pivot = 1 -kernel.grsecurity.chroot_deny_shmat = 1 -kernel.grsecurity.chroot_deny_sysctl = 1 -kernel.grsecurity.chroot_deny_unix = 1 -kernel.grsecurity.chroot_enforce_chdir = 1 -kernel.grsecurity.chroot_findtask = 1 -#kernel.grsecurity.chroot_restrict_nice = 1 - -# -# Kernel auditing -# -# audit_group: Restrict exec/chdir logging to a group. -# audit_gid: audit group -# - -#kernel.grsecurity.audit_group = 1 -kernel.grsecurity.audit_gid = 201 -#kernel.grsecurity.exec_logging = 1 -#kernel.grsecurity.resource_logging = 1 -#kernel.grsecurity.chroot_execlog = 1 -#kernel.grsecurity.audit_ptrace = 1 -#kernel.grsecurity.audit_chdir = 1 -#kernel.grsecurity.audit_mount = 1 -#kernel.grsecurity.signal_logging = 1 -#kernel.grsecurity.forkfail_logging = 1 -#kernel.grsecurity.timechange_logging = 1 -kernel.grsecurity.rwxmap_logging = 1 - -# -# Executable protections -# - -kernel.grsecurity.harden_ptrace = 1 -kernel.grsecurity.ptrace_readexec = 1 -kernel.grsecurity.consistent_setxid = 1 -kernel.grsecurity.harden_ipc = 1 - -# -# Trusted Path Execution -# -# tpe_gid: tpe group -# - -#kernel.grsecurity.tpe = 1 -kernel.grsecurity.tpe_gid = 200 -#kernel.grsecurity.tpe_invert = 1 -#kernel.grsecurity.tpe_restrict_all = 1 - -# -# Network protections -# -# socket_all_gid: socket-deny-all group -# socket_client_gid: socket-deny-client group -# socket_server_gid: socket-deny-server group -# - -#kernel.grsecurity.ip_blackhole = 1 -kernel.grsecurity.lastack_retries = 4 -kernel.grsecurity.socket_all = 1 -kernel.grsecurity.socket_all_gid = 202 -kernel.grsecurity.socket_client = 1 -kernel.grsecurity.socket_client_gid = 203 -kernel.grsecurity.socket_server = 1 -kernel.grsecurity.socket_server_gid = 204 - -# -# Prevent any new USB devices from being recognized by the OS. -# - -#kernel.grsecurity.deny_new_usb = 1 - -# -# Restrict grsec sysctl changes after this was set -# - -kernel.grsecurity.grsec_lock = 0 |