minor tweaks

1 files changed, 9 insertions, 0 deletions

diff --git a/setup.sh b/setup.sh
index 20f315c..af03727 100755
--- a/setup.sh
+++ b/setup.sh
@@ -76,6 +76,9 @@ paru -Qtdq | xargs -r paru -Rns --noconfirm || true
 # -----------------------------------------------------------------------------
 log_info "Step 2: Deploying /etc System Configurations & Security Hardening..."
 
+# Lock root account password (forces sudo-only access)
+sudo passwd -l root >/dev/null
+
 # Copy basic configuration files safely
 sudo cp -v ./etc/keyd/keyd.conf /etc/keyd/
 sudo cp -v ./etc/pacman.conf /etc/
@@ -87,6 +90,7 @@ sudo cp -v ./etc/pam.d/greetd /etc/pam.d/
 sudo cp -v ./etc/login.defs /etc/
 sudo cp -v ./etc/updatedb.conf /etc/
 sudo visudo -cf ./etc/sudoers.d/00-hardening && sudo cp -v ./etc/sudoers.d/00-hardening /etc/sudoers.d/
+sudo chmod 0440 /etc/sudoers.d/00-hardening
 sudo cp -v ./etc/systemd/coredump.conf /etc/systemd/
 sudo cp -v ./etc/sysctl.d/99-security.conf /etc/sysctl.d/
 sudo cp -v ./etc/cups/cupsd.conf /etc/cups/
@@ -141,6 +145,11 @@ log_info "Step 3: Reloading System Configuration & Enabling Services..."
 
 sudo sysctl --system
 sudo mkinitcpio -P
+
+if command -v sbctl >/dev/null 2>&1; then
+    sudo sbctl sign-all -s 2>/dev/null || true
+fi
+
 sudo systemctl daemon-reload
 
 # Enable User-Level Socket/Service Units