diff options
| author | Dag-Erling Smørgrav <des@FreeBSD.org> | 2018-09-21 09:27:32 +0000 |
|---|---|---|
| committer | Dag-Erling Smørgrav <des@FreeBSD.org> | 2018-09-21 09:27:32 +0000 |
| commit | c3afb29bb65fb372e2b892a4f486da1d3b9e2173 (patch) | |
| tree | 255224f2325e18df188098d1ae99c3cf44d89403 /usr.sbin/bsdinstall | |
| parent | 5252d24a204bd142bf405dcf9fc763ca1fdda548 (diff) | |
Notes
Diffstat (limited to 'usr.sbin/bsdinstall')
| -rwxr-xr-x | usr.sbin/bsdinstall/scripts/hardening | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/usr.sbin/bsdinstall/scripts/hardening b/usr.sbin/bsdinstall/scripts/hardening index 1b82f81217539..9fea1b6aed5d1 100755 --- a/usr.sbin/bsdinstall/scripts/hardening +++ b/usr.sbin/bsdinstall/scripts/hardening @@ -30,6 +30,7 @@ echo -n > $BSDINSTALL_TMPETC/rc.conf.hardening echo -n > $BSDINSTALL_TMPETC/sysctl.conf.hardening +echo -n > $BSDINSTALL_TMPBOOT/loader.conf.hardening exec 3>&1 FEATURES=$( dialog --backtitle "FreeBSD Installer" \ @@ -46,6 +47,7 @@ FEATURES=$( dialog --backtitle "FreeBSD Installer" \ "7 disable_syslogd" "Disable opening Syslogd network socket (disables remote logging)" ${disable_syslogd:-off} \ "8 disable_sendmail" "Disable Sendmail service" ${disable_sendmail:-off} \ "9 secure_console" "Enable console password prompt" ${secure_console:-off} \ + "10 disable_ddtrace" "Disallow DTrace destructive-mode" ${disable_ddtrace:-off} \ 2>&1 1>&3 ) exec 3>&- @@ -80,5 +82,8 @@ for feature in $FEATURES; do if [ "$feature" = "secure_console" ]; then sed "s/unknown off secure/unknown off insecure/g" $BSDINSTALL_CHROOT/etc/ttys > $BSDINSTALL_TMPETC/ttys.hardening fi + if [ "$feature" = "disable_ddtrace" ]; then + echo 'security.bsd.allow_destructive_dtrace=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening + fi done |