diff options
| author | Denis Chevalier <perso@denischevalier.fr> | 2026-08-06 12:41:37 +0200 |
|---|---|---|
| committer | Denis Chevalier <perso@denischevalier.fr> | 2026-08-06 12:41:37 +0200 |
| commit | f37a43fab076b7f061f8a8ba55b80690904c7b6b (patch) | |
| tree | 4fb1f5f7827414124a73853bb511ace58f97b198 | |
| parent | a76d46969a25863dc25466004280e861f9037dac (diff) | |
| download | postinstall-f37a43fab076b7f061f8a8ba55b80690904c7b6b.tar.gz postinstall-f37a43fab076b7f061f8a8ba55b80690904c7b6b.tar.bz2 postinstall-f37a43fab076b7f061f8a8ba55b80690904c7b6b.zip | |
Hardened mount options
| -rwxr-xr-x | etc.bash | 2 | ||||
| -rw-r--r-- | etc/fstab | 7 |
2 files changed, 9 insertions, 0 deletions
@@ -12,6 +12,8 @@ sudo cp -v etc/systemd/coredump.conf /etc/systemd/ sudo cp -v etc/sysctl.d/99-security.conf /etc/sysctl.d/ sudo sysctl --system +grep tmpfs /etc/fstab || sudo cat etc/fstab >> /etc/fstab + # firewall sudo ufw default deny incoming sudo ufw default allow outgoing diff --git a/etc/fstab b/etc/fstab new file mode 100644 index 0000000..9cdf203 --- /dev/null +++ b/etc/fstab @@ -0,0 +1,7 @@ + +# Restrict shared memory +tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0 + +# Restrict /tmp (keep noexec off to allow dev strict directly run out of /tmp) +tmpfs /tmp tmpfs defaults,nodev,nosuid 0 0 + |