Repository navigation
root-ubuntu.sh: second runs keep the kernel hardening; /root is never taken for dotfiles - #201
Merged
Merged
Conversation
…/root for dotfiles Two flip-flops found while porting this script to W3BS OS (root-w3bs-os.sh, #198): - sysctl floors: run 1 raised the keys below the floor and wrote 62-profullstack-confine.conf; run 2 saw the raised running values, wrote nothing and DELETED the file, so the next boot lost the hardening. A key at the floor because of our own file now keeps its line (same for fs.suid_dumpable = 0). - dotfiles: run from /root (the documented way), run 2 found the .zshrc run 1 put there, took /root for the team's dotfiles and copied root's shell config into every account. The script's own directory now counts only when it is a git checkout. Regression tests for both; the suid test sets CONFINE_SYSCTL_CONF instead of rewriting the function. vitest root-ubuntu: 193 passed; no new shellcheck warnings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ThreatCrush Security Scan41 finding(s) HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the two bugs the root-w3bs-os.sh port found (#198), as Anthony asked ("fix them").
1. Kernel hardening lost at the next boot.
/etc/sysctl.d/62-profullstack-confine.conf.fs.suid_dumpable = 0.2. Root's shell config copied into every account.
/root. On run 2, the.zshrcthat run 1 put there made/rootlook like a dotfiles checkout.Tests:
/rootwith a.zshrcrejected, a real git checkout accepted.CONFINE_SYSCTL_CONFinstead of rewriting the function with sed. Otherwise it would have silently written to the real/etc.vitest run test/root-ubuntu.test.ts: 193 passed. No new shellcheck warnings.These are the same fixes
root-w3bs-os.shships.🤖 Generated with Claude Code