{{Header}}
{{#seo:
|description=Documentation for package security-misc.
|image=Securitymisc.jpg
}}
{{title|title=
security-misc: Enhance Miscellaneous Security Settings
}}
[[image:Securitymisc.jpg|thumb]]
{{intro|
Documentation for package security-misc.
}}
= Stable Features =
[https://github.com/{{project_name_short}}/security-misc#enhances-miscellaneous-security-settings Described here].

= system map =
TODO: document

* https://forums.whonix.org/t/kernel-hardening/7296/84
* https://forums.whonix.org/t/remove-system-map-cannot-work-lib-modules-is-mounted-read-only/13324

= Testing Features =
{{Anchor|Restrict Hardware Information to Root}}
== Reduce Kernel Information Leaks ==
{{mbox
| type    = notice
| image   = [[File:Ambox_notice.png|40px|alt=Info]]
| text    = Known to make the Restart and Shut Down buttons dysfunctional in Xfce, and sometimes cause the operating system not to start.
}}

By default, on most if not all (Linux based) operating systems, the Linux kernel makes lots of information available to running programs (and therefore by extension also to [[Malware]]). There's an optional feature to reduce such kernel information leaks.

{{Testers-only}}

{{box|text=
* <u>Security Impact</u>: There are many of hardware, kernel, debug information, etc. in <code>/sys</code> and <code>/proc</code>, which is especially problematic and has been the cause of many infoleaks such as kernel pointer leaks.
* <u>Security / Privacy Impact</u>: Details about your hardware can aid attacks and can be used for identification.
* <u>Threat</u>: This information is per Debian (and probably most popular Linux distributions) available to attackers with local code execution privileges which includes,
** malicious applications collecting such information and submitting it to data collectors,
** as well as both, compromised non-privileged users and the privileged root user.
* <u>Non-Threat</u>: This information does not randomly leak to third parties on clean (non-compromised) machines through use of legitimate applications such as the APT package manager. Legitimate applications do not request the information from the kernel, let alone leak them to third-parties over the internet.
* <u>Goal</u>: This information should by default be unavailable to non-privileged users and [[Dev/boot_modes|untrusted root]].
* <u>Solution</u>: Therefore security-misc includes the <code>hide-hardware-info.service</code> systemd unit.
** Restricts access to <code>/sys</code>, <code>/proc/cpuinfo</code>, <code>/proc/bus</code>, and <code>/proc/scsi</code> to the root user only.
** This also hides most hardware identifiers.
* <u>Status</u>: This setting is disabled by default because it might break many applications. Testers-only! Call for testers and forum discussion: [https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618 Restrict Hardware Information to Root - Testers Wanted!]
* <u>Enable</u>: It can optionally be enabled by running the following command.
** {{CodeSelect|code=
sudo systemctl enable hide-hardware-info.service
}}
** Reboot required.
** A whitelist that allows specific applications to access <code>/sys</code> and <code>/proc/cpuinfo</code> is enabled by default to maintain basic functionality. <ref>
https://github.com/{{project_name_short}}/security-misc/blob/master/usr/lib/systemd/system/user%40.service.d/sysfs.conf
</ref> For example, this allows the launching of applications like Xfce.
* <u>Limitations of Solution</u>:
** <u>root compromise:</u> Attackers which gained root compromise and/or malicious/compromised whitelisted applications have access to this information.
** <u>CPUID:</u> Cannot hide [[CPUID]].
* <u>Testing:</u> See [[#Testing]]
* <u>Possible Future Enhancements</u>: [[Dev/boot_modes|untrusted root]]
}}

=== Reduce Kernel Information Leaks - Known Issues ===
* [https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/55 breaks Xfce shutdown, reboot GUI buttons] (but CLI commands for shutdown, reboot are functional) (maybe also fixed in testers repository)
* [https://forums.whonix.org/t/update-torbrowser-is-currently-broken/18279/7 breaks APT updates and update-torbrowser run from within any Template when hide-hardware-information.service is running inside Qubes sys-whonix] (fixed in testers repository)
* browsers:
** Firefox: functional 
** Chromium:
*** from packages.debian.org: broken, fails with an error popup, because it attempts to read <code>/proc/cpuinfo</code>.
*** from flatpak: functional
* ISO image to USB writer tools:
** breaks balanaEtcher

=== Whitelisting Applications ===

To whitelist applications, they must be run under the <code>sysfs</code> group (if allowing access to <code>/sys</code>) and/or the <code>cpuinfo</code> group (if allowing access to <code>/proc/cpuinfo</code>).

Remember that any whitelisted applications add to the attack surface. An attacker can attempt to exploit a vulnerability in the whitelisted application(s) to gain access to hardware information.

==== addgroup method ====
'''1.''' For example, to add user <code>user</code> to group <code>cpuinfo</code>, run the following command. (Note, this is weakening protections.)

{{CodeSelect|code=
sudo addgroup user cpuinfo
}}

'''2.''' For example, to add user <code>user</code> to group <code>sysfs</code>, run the following command. (Note, this is weakening protections.)

{{CodeSelect|code=
sudo addgroup user sysfs
}}

'''3.''' Re-login required after changing groups.

Easiest: reboot. <ref>
No reboot required: Use the execute command as different group ID command line utility <code>sg</code> to execute the <code>cpu-info</code> (from Debian package <code>cpuinfo</code>) application under group <code>cpuinfo</code>.

{{CodeSelect|code=
sg cpuinfo cpu-info
}}
</ref> <ref>
Also no reboot required:

{{CodeSelect|code=
sudo -u user bash
}}

{{CodeSelect|code=
cpu-info
}}

Or.

{{CodeSelect|code=
sudo -u user cpu-info
}}
</ref>

{{CodeSelect|code=
sudo reboot
}}

'''4.''' Done.

For example, after reboot it would be possible to run the <code>cpu-info</code> utility (from Debian package <code>cpuinfo</code>).

{{CodeSelect|code=
cpu-info
}}

==== systemd ====
For example, to run a systemd service as the <code>sysfs</code> group, create a [[Configuration_Files#Configuration_Drop-In_Folders|drop-in directory]] and add the following.

{{CodeSelect|code=
[Service]
SupplementaryGroups=sysfs
}}

==== setgid method ====
To run a specific binary as the <code>sysfs</code> group, the binary must be owned by the <code>sysfs</code> group and be made setgid. To achieve this,

'''1.''' change the ownership of the binary by running the following.

{{CodeSelect|code=
sudo chgrp sysfs /path/to/binary
}}

'''2.''' Then make the binary setgid.

{{CodeSelect|code=
sudo chmod g+s /path/to/binary
}}

'''3.''' Done.

The binary will now run with the permissions of the <code>sysfs</code> group and have access to <code>/sys</code>.

All of these steps can also be applied to the <code>cpuinfo</code> group.

=== Disable the Whitelist ===

In order to reduce the attack surface as much as possible, optionally the whitelist can be disabled entirely.

{{mbox
| image   = [[File:Ambox_warning_pn.svg.png|40px|alt=warning]]
| text    =
'''Warning:'''

Note that this setting will break many applications; for example, the desktop environment will not even start. Do not perform this action unless you understand the implications and can reverse the change.
}}

'''1.''' {{Open with root rights|filename=
/etc/hide-hardware-info.d/50_user.conf
}}

'''2.''' Add.

{{CodeSelect|code=
sysfs_whitelist=0
cpuinfo_whitelist=0
}}

'''3.''' Save.

'''4.''' Done.

=== Testing ===
Optional: Users who wish to verify the functionality can perform the instructions in the following box.

{{box|text=
'''1.''' Install <code>pciutils</code>.

{{Install Package|package=
pciutils
}}

'''2.''' Run <code>lspci</code>.

{{CodeSelect|code=
lspci
}}

Expected printout:

<pre>
pcilib: Cannot open /proc/bus/pci
lspci: Cannot find any working access method.</pre>

'''3.''' Attempt to view contents of virtual file <code>/proc/cpuinfo</code>:

{{CodeSelect|code=
cat /proc/cpuinfo
}}

Expected printout:

<pre>
cat: /proc/cpuinfo: Permission denied
</pre>

Note: [[CPUID|CPUID is still not hidden]].
}}

== SUID Disabler and Permission Hardener ==
See [[SUID Disabler and Permission Hardener]].

== hidepid ==
TODO: document

<u>Warning:</u> This can break many things such as <code>pkexec</code>. This might cause symptoms similar to the ones mentioned in forum discussion [https://forums.whonix.org/t/cannot-use-pkexec/8129 cannot use pkexec].

'''1.''' Enable.

{{CodeSelect|code=
sudo systemctl enable proc-hidepid.service
}}

'''2.''' Start.

{{CodeSelect|code=
sudo systemctl start proc-hidepid.service
}}

'''3.''' Done.

hidepid has been enabled.

'''4.''' Testing.

<code>pkexec</code> test command (requires X11, will not work in Wayland):

{{CodeSelect|code=
pkexec mousepad /tmp/testfile
}}

Error message if broken:

<pre>
Error checking for authorization org.xfce.mousepad: GDBus.Error:org.gtk.GDBus.UnmappedGError.Quark._g_2dfile_2derror_2dquark.Code4: Failed to open file ?/proc/1423/status?: No such file or directory
</pre>

Hopefully X11 and Wayland compatible.

{{CodeSelect|code=
pkexec nano /tmp/testfile
}}

{{Install Package|package=
gparted
}}

{{CodeSelect|code=
gparted
}}

= Experimental Features =
Unreleased. (Developers only.) Will flow into other repositories as per usual.

== Harden Module Loading ==
<u>Warning:</u> Breaks desktop. <u>Might</u> work on servers.

{{CodeSelect|code=
sudo systemctl enable harden-module-loading.service
}}

{{anchor|suid}}

== Remount Secure ==
{{Developers-only}}

See also:

* [[Dev/remount-secure]]
* [[noexec|Enhanced Security via Mount Options and Compiler Restrictions]]

Design:

* runs at early boot
* no user freedom restriction
* can be disabled
* manual fstab hardening is possible
* broken applications? tb-starter?

The Remount Secure feature is currently not ready for use.

'''x.''' Maybe enable dracut module.

The following instructions based on kernel command line modification depend on a dracut module that is currently disabled by default.

/usr/lib/dracut/modules.d-disabled would need to be moved to /usr/lib/dracut/modules.d

{{CodeSelect|code=
sudo mv usr/lib/dracut/modules.d-disabled/20remount-secure /usr/lib/dracut/modules.d/
}}

{{CodeSelect|code=
sudo dracut -f
}}

'''x.''' Maybe enable systemd unit.

Do this only if not using the dracut module

{{CodeSelect|code=
sudo systemctl enable remount-secure
}}

{{CodeSelect|code=
sudo systemctl start remount-secure
}}

'''1.''' Create a new configuration file.

You'll need to make changes to the kernel boot parameters (see also [[grub]]).

Only useful if using the dracut module.

{{Open_with_root_rights|
filename=/etc/default/grub.d/50_user.cfg
}}

'''2.''' Add the required kernel parameters based on the security level you prefer:

* '''Option A (No Security):''' Disable Remount Secure:
** {{CodeSelect|code=
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=0"
}}
* '''Option B (Low Security):''' Re-mount with <code>nodev</code>, <code>nosuid</code>:
** {{CodeSelect|code=
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=1"
}}
* '''Option C (Medium Security):''' Re-mount with <code>nodev</code>, <code>nosuid</code>, <code>noexec</code> for most mount points, excluding <code>/home</code>.
** {{CodeSelect|code=
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=2"
}}
* '''Option D (Highest Security):''' Re-mount with <code>nodev</code>, <code>nosuid</code>, <code>noexec</code> for all mount points including <code>/home</code>.
** {{CodeSelect|code=
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX remountsecure=3"
}}

'''3.''' Save the configuration file.

'''4.''' Regenerate the grub configuration:
{{CodeSelect|code=
sudo update-grub
}}

'''5.''' Reboot your system.

A reboot is necessary for the kernel parameter changes to take effect.

'''6.''' Completion.

You have successfully enabled the Remount Secure feature.

For more details and developer information, see the following resources:
<ref>
* [https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/27 Forum discussion]
* [https://github.com/{{project_name_short}}/security-misc/blob/master/usr/bin/remount-secure remount-secure script]
* [https://github.com/Kicksecure/security-misc/tree/master/usr/lib/dracut/modules.d-disabled/20remount-secure remount-secure dracut module]
* [[Dev/remount-secure]]
* {{CodeSelect|code=
ls -la /var/run/remount-secure
}}
</ref>

{{Anchor|install}}

= Installation of security-misc =
{{mbox
| image   = [[File:Ambox_notice.png|40px|alt=Info]]
| text    =
This chapter is only required for users which aren't users of {{project_name_long}} or its derivatives (such as {{Whonix}}). That is because security-misc is installed by default in {{project_name_long}} and {{project_name_long}} derivatives.
}}

Prerequisites:

{{Prerequisites}}

{{Box|text=
{{Project-APT-Repository-Add Easy}}
}}

{{Box|text=
Install <code>security-misc</code>.

{{Install Package|package=
security-misc
}}
}}

= selinux =
{{Community_Support|scope=chapter}}

* https://github.com/{{project_name_short}}/security-misc/pull/100
* https://forums.whonix.org/t/restrict-hardware-information-to-root/7329/88

= References =
{{reflist|close=1}}

{{Footer}}

[[Category:Documentation]]