9a6c3f99ed
- No patches were found with incorrect authorship/From: lines - The older AndroidHardening patch repos are no longer available to verify CID. - New GrapheneOS patches do not include a CID. - *Signature_Spoofing.patch CID could not be found. - Fixed CID of *Harden_Sig_Spoofing.patch to match 14.1 - Fixed CID of *LGE_Fixes.patch to match 14.1 - Fixed CID of *Harden.patch to match 14.1 - Added edit note to *Harden.patch - Fixed CID of *PREREQ_Handle_All_Modes.patch to match 14.1 - Fixed CID of *More_Preferred_Network_Modes.patch to match 14.1 - Fixed CID of *AES256.patch to match 14.1 - Fixed CID of *0001-OTA_Keys.patch to match 18.1 - Fixed CID of *Camera_Fix.patch to match 15.1 - Fixed CID of *Connectivity.patch to match 14.1 - Fixed CID of *Fix_Calling.patch to match 14.1 - Fixed CID of *Remove_Analytics.patch to match 14.1 - Fixed CID of Unused-*.patch/audio_extn to match original Signed-off-by: Tad <tad@spotco.us>
59 lines
2.8 KiB
Diff
59 lines
2.8 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Micay <danielmicay@gmail.com>
|
|
Date: Mon, 12 Feb 2018 03:29:58 -0500
|
|
Subject: [PATCH] Harden
|
|
|
|
Change-Id: I46e3fc4ac896a509ab8ca90ae4ce09b820da434b
|
|
[tad@spotco.us]: added protected fifos and regular from newer GrapheneOS patches
|
|
[tad@spotco.us]: added IPv6 privacy options TODO split into another patch
|
|
---
|
|
init/first_stage_init.cpp | 6 +++---
|
|
rootdir/init.rc | 11 +++++++++++
|
|
2 files changed, 14 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/init/first_stage_init.cpp b/init/first_stage_init.cpp
|
|
index 2b899408a..84c2735c2 100644
|
|
--- a/init/first_stage_init.cpp
|
|
+++ b/init/first_stage_init.cpp
|
|
@@ -120,15 +120,15 @@ int FirstStageMain(int argc, char** argv) {
|
|
CHECKCALL(mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755"));
|
|
CHECKCALL(mkdir("/dev/pts", 0755));
|
|
CHECKCALL(mkdir("/dev/socket", 0755));
|
|
- CHECKCALL(mount("devpts", "/dev/pts", "devpts", 0, NULL));
|
|
+ CHECKCALL(mount("devpts", "/dev/pts", "devpts", MS_NOSUID|MS_NOEXEC, NULL));
|
|
#define MAKE_STR(x) __STRING(x)
|
|
- CHECKCALL(mount("proc", "/proc", "proc", 0, "hidepid=2,gid=" MAKE_STR(AID_READPROC)));
|
|
+ CHECKCALL(mount("proc", "/proc", "proc", MS_NOSUID|MS_NODEV|MS_NOEXEC, "hidepid=2,gid=" MAKE_STR(AID_READPROC)));
|
|
#undef MAKE_STR
|
|
// Don't expose the raw commandline to unprivileged processes.
|
|
CHECKCALL(chmod("/proc/cmdline", 0440));
|
|
gid_t groups[] = {AID_READPROC};
|
|
CHECKCALL(setgroups(arraysize(groups), groups));
|
|
- CHECKCALL(mount("sysfs", "/sys", "sysfs", 0, NULL));
|
|
+ CHECKCALL(mount("sysfs", "/sys", "sysfs", MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL));
|
|
CHECKCALL(mount("selinuxfs", "/sys/fs/selinux", "selinuxfs", 0, NULL));
|
|
|
|
CHECKCALL(mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11)));
|
|
diff --git a/rootdir/init.rc b/rootdir/init.rc
|
|
index c80acdf51..e9fba7989 100644
|
|
--- a/rootdir/init.rc
|
|
+++ b/rootdir/init.rc
|
|
@@ -145,6 +145,17 @@ on init
|
|
write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
|
|
write /proc/sys/kernel/sched_child_runs_first 0
|
|
|
|
+ write /proc/sys/kernel/dmesg_restrict 1
|
|
+ write /proc/sys/fs/protected_hardlinks 1
|
|
+ write /proc/sys/fs/protected_symlinks 1
|
|
+ write /proc/sys/fs/protected_fifos 1
|
|
+ write /proc/sys/fs/protected_regular 1
|
|
+ write /proc/sys/net/ipv6/conf/all/use_tempaddr 2
|
|
+ write /proc/sys/net/ipv6/conf/all/max_addresses 128
|
|
+ write /proc/sys/net/ipv6/conf/all/temp_prefered_lft 21600
|
|
+ write /proc/sys/net/ipv6/conf/default/use_tempaddr 2
|
|
+ write /proc/sys/net/ipv6/conf/default/max_addresses 128
|
|
+ write /proc/sys/net/ipv6/conf/default/temp_prefered_lft 21600
|
|
write /proc/sys/kernel/randomize_va_space 2
|
|
write /proc/sys/vm/mmap_min_addr 32768
|
|
write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
|