From 097aba97d8cb0a848f1f21018f65c58d48ef3cb2 Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Thu, 14 Mar 2019 12:01:43 +0000 Subject: Hardening compressors (#2594) * Harden atool * Harden cpio * Fix ordering in private-* options * Harden gzip * Harden tar * Harden bsdtar * Harden+ tar * Harden+ gzip * Harden+ cpio * Create bzip2.profile * Description for bunzip2 * Add bzip2/bunzip2 to firecfg --- etc/bsdtar.profile | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'etc/bsdtar.profile') diff --git a/etc/bsdtar.profile b/etc/bsdtar.profile index b6b673976..f964438bc 100644 --- a/etc/bsdtar.profile +++ b/etc/bsdtar.profile @@ -10,16 +10,20 @@ blacklist /tmp/.X11-unix include disable-common.inc # include disable-devel.inc +include disable-exec.inc include disable-interpreters.inc include disable-passwdmgr.inc include disable-programs.inc +apparmor caps.drop all hostname bsdtar ipc-namespace +machine-id netfilter no3d nodvd +nodbus nogroups nonewprivs # noroot @@ -34,5 +38,8 @@ tracelog # support compressed archives private-bin sh,bash,bsdcat,bsdcpio,bsdtar,gtar,compress,gzip,lzma,xz,bzip2,lbzip2,lzip,lzop,lz4,libarchive +private-cache private-dev private-etc alternatives,passwd,group,localtime + +memory-deny-write-execute -- cgit v1.2.3-70-g09d2