aboutsummaryrefslogtreecommitdiff
path: root/usr.sbin/bsdinstall/scripts/hardening
Commit message (Collapse)AuthorAgeFilesLines
* bsdinstall: avoid conflicts with fd 3Lars Kellogg-Stedman2023-09-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Throughout the bsdinstall script fd 3 is used by f_dprintf (set through $TERMINAL_STDOUT_PASSTHRU). In several places in the bsdinstalls scripts, we use fd 3 to juggle stdout when calling out to other tools, which can cause the installer to fail with a "Bad file descriptor" error when f_dprintf attempts to use it. This commit replaces all constructs like this: exec 3>&1 SOME_VARIABLE=$(some command 2>&1 1>&3) exec 3>&- With: exec 5>&1 SOME_VARIABLE=$(some command 2>&1 1>&5) exec 5>&- PR: 273148 Reviewed by: corvink Fixes: 1f7746d81f53447ac15cc99395bb714d4dd0a4da ("bsdinstall: stop messing with file descriptors") MFC after: 1 week
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-161-1/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* bsdinstall: remove sendmail hardening optionBaptiste Daroussin2023-06-011-6/+2
| | | | | | | sendmail is fully disabled in 14.0 by default Reviewed by: imp, emaste Differential Revision: https://reviews.freebsd.org/D40367
* bsdinstall: allow whitelabeling the scriptsBrad Davis2022-05-241-1/+4
| | | | | | Approved by: allanjude, asiciliano Differential Revision: https://reviews.freebsd.org/D35197 Sponsored by: Rubicon Communications, LLC ("Netgate")
* bsdinstall hardening: Replace dialog with bsddialogAlfonso S. Siciliano2022-03-221-3/+7
| | | | | | | | bsdinstall/scripts/hardening: Replace (LGPL) dialog utility with (BSD-2-CLAUSE) dialog utility. Approved by: bapt (mentor) Differential Revision: https://reviews.freebsd.org/D34102
* Revert "bsdinstall: add knob to set ASLR sysctls"Marcin Wojtas2021-11-161-18/+0
| | | | | | | | | | | | | This reverts commit 020f4112559ebf7e94665c9a69f89d21929ce82a. Because now ASLR is enabled by default for 64-bit architectures and the purpose of the installation menu is to allow choosing additional 'mitigation'/'hardening' options that are originally disabled, remove the ASLR knob from bsdinstall. Discussed with: emaste Obtained from: Semihalf Sponsored by: Stormshield
* bsdinstall: add knob to set ASLR sysctlsEd Maste2021-02-201-0/+18
| | | | | | Reviewed by: mw Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D28418
* bsdinstall: replace multiple ifs with caseEd Maste2021-02-201-22/+24
| | | | | | | Reduce copy-paste and use a more typical construct. Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D28417
* Add an installer option to disable destructive dtrace.Dag-Erling Smørgrav2018-09-211-0/+5
| | | | | | | | | | Submitted by: Jörg Pernfuß <code.jpe@gmail.com> Approved by: re (kib) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D12474 Notes: svn path=/head/; revision=338852
* bsdinstall(8) hardening menu: Utilize new kern.randompid=1 behaviourAllan Jude2017-10-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Enabling the PID randomization option in bsdinstall(8)'s hardening menu now randomizes the effective value of kern.randompid on each boot. Previous behaviour: When kern.randompid was enabled via the the bsdinstall(8) hardening menu, a random value was generated and placed in the systems /etc/sysctl.conf as kern.randompid=value This makes the value of kern.randompid static across reboots. New behaviour: When kern.randompid is enabled via the bsdinstall(8) hardening menu, the line kern.randompid=1 is placed in the systems /etc/sysctl.conf. This takes advantage of a new kernel feature and makes the value of kern.randompid be randomized by the kernel on each reboot. Submitted by: Marie Helene Kvello-Aune <marieheleneka@gmail.com> Reviewed by: des MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D12433 Notes: svn path=/head/; revision=324206
* Remove stack guard option from hardening menu.Bartek Rutkowski2017-07-211-8/+4
| | | | | | | | | | | | | | | Since kib's change the stack guard is now ON by default, this option in hardening menu of bsdinstall is no longer needed. Submitted by: Bartlomiej Rutkowski <robak@FreeBSD.org> Reviewed by: bapt Approved by: bapt MFC after: 1 day Sponsored by: Pixeware LTD Differential Revision: https://reviews.freebsd.org/D11686 Notes: svn path=/head/; revision=321326
* usr.sbin/bsdinstall/scripts/hardening: fix options numbersBartek Rutkowski2017-07-061-1/+1
| | | | | | | | | | | Submitted by: Bartek Rutkowski <robak@FreeBSD.org> Reviewed by: bapt Approved by: bapt MFC after: 1 day Differential Revision: https://reviews.freebsd.org/D11505 Notes: svn path=/head/; revision=320732
* Add option to bsdinstall to disable insecure console, update stack guard optionBartek Rutkowski2017-07-051-2/+6
| | | | | | | | | | | | | | | | This patch adds new bsdinstall option to hardening section that allows users to change this behaviour to secure one and updates stack guard option so it would set the value of relevant sysctl to 512 (2MB) Submitted by: Bartek Rutkowski Reviewed by: adrian, bapt, emaste Approved by: bapt, emaste MFC after: 1 day Sponsored by: Pixeware LTD Differential Revision: https://reviews.freebsd.org/D9700 Notes: svn path=/head/; revision=320674
* Add hardening menu item for security.bsd.see_jail_procSteve Wills2017-06-291-7/+11
| | | | | | | | Approved by: allanjude Differential Revision: https://reviews.freebsd.org/D11283 Notes: svn path=/head/; revision=320473
* Revert changes introduced in r314036 on demand by jhb and bapt.Bartek Rutkowski2017-03-171-9/+9
| | | | | | | Approved by: bapt, jhb Notes: svn path=/head/; revision=315447
* Enable bsdinstall hardening options by default.Bartek Rutkowski2017-02-211-9/+9
| | | | | | | | | | | | | | | As discussed previously, in order to introduce new OS hardening defaults, we've added them to bsdinstall in 'off by default' mode. It has been there for a while, so the next step is to change them to 'on by defaul' mode, so that in future we could simply enable them in base OS. Reviewed by: brd Approved by: adrian Differential Revision: https://reviews.freebsd.org/D9641 Notes: svn path=/head/; revision=314036
* Add 0-8 as shortcuts for jumping to menu items in the hardening menu.Bartek Rutkowski2017-02-161-10/+10
| | | | | | | | | | Submitted by: skreuzer Reviewed by: allanjude, robak Approved by: allanjude Differential Revision: https://reviews.freebsd.org/D6826 Notes: svn path=/head/; revision=313815
* Write kern.randompid to /etc/sysctl.confSteven Kreuzer2016-08-091-2/+3
| | | | | | | | | | | | PR: 211471 Reported by: survo@protonmail.com Reviewed by: robak@ Approved by: allanjude@ MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D7440 Notes: svn path=/head/; revision=303877
* Fix non-functional bsdinstall services dialog.Dimitry Andric2016-08-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The most recent version of bsdinstall does not seem to respect any of the checkboxes in the "Choose the services you would like to be started at boot" dialog. None of the chosen services end up in the rc.conf file that is installed onto the target system. This is caused by the bsdinstall/scripts/hardening script, which implements the new hardening options dialog. The script starts by overwriting the previously written rc.conf.services file: echo -n > $BSDINSTALL_TMPETC/rc.conf.services which is obviously incorrect. It should clear out rc.conf.hardening instead. Reviewed by: allanjude PR: 211506 MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D7387 Notes: svn path=/head/; revision=303631
* Add new System Hardening menu and options to bsdinstall.Bartek Rutkowski2016-07-151-0/+79
This patch add new 'hardening' file responsible for new bsdinstall 'System Hardening' menu allowing users to set some sane and carefully picked system security options (like random process id's, hiding other users/groups processes and others). All options are OFF by default in this patch due to POLA principle with intention to turn change some of them to ON by default in future. Reviewed by: adrian, allanjude, bdrewery, nwhitehorn Approved by: adrian, allanjude MFC after: 7 days Notes: svn path=/head/; revision=302897
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-17 06:02:12 +0000