From 2474523199cde6d1ad8ef6ca085bd690bc5d619a Mon Sep 17 00:00:00 2001
From: Denis Chevalier <perso@denischevalier.fr>
Date: Thu, 6 Aug 2026 12:45:32 +0200
Subject: harden sudo

---
 etc.bash                   | 27 ++++++++++++++-------------
 etc/sudoers.d/00-hardening | 11 +++++++++++
 2 files changed, 25 insertions(+), 13 deletions(-)
 create mode 100644 etc/sudoers.d/00-hardening

diff --git a/etc.bash b/etc.bash
index 77fb690..87b67b8 100755
--- a/etc.bash
+++ b/etc.bash
@@ -1,18 +1,19 @@
 #!/bin/bash
 
-sudo cp -rv etc/keyd/* /etc/keyd/
-sudo cp -v etc/pacman.conf /etc/
-sudo cp -v etc/kernel/cmdline /etc/kernel/
-sudo cp -v etc/modprobe.d/blacklist-security.conf /etc/modprobe.d/
-sudo cp -v etc/pam.d/system-local-login /etc/pam.d/
-sudo cp -v etc/pam.d/system-login /etc/pam.d/
-sudo cp -v etc/login.defs /etc/
-sudo cp -v etc/updatedb.conf /etc/
-sudo cp -v etc/systemd/coredump.conf /etc/systemd/
-sudo cp -v etc/sysctl.d/99-security.conf /etc/sysctl.d/
+sudo cp -rv ./etc/keyd/* /etc/keyd/
+sudo cp -v ./etc/pacman.conf /etc/
+sudo cp -v ./etc/kernel/cmdline /etc/kernel/
+sudo cp -v ./etc/modprobe.d/blacklist-security.conf /etc/modprobe.d/
+sudo cp -v ./etc/pam.d/system-local-login /etc/pam.d/
+sudo cp -v ./etc/pam.d/system-login /etc/pam.d/
+sudo cp -v ./etc/login.defs /etc/
+sudo cp -v ./etc/updatedb.conf /etc/
+sudo cp -v ./etc/sudoers.d/00-hardening /etc/sudoers.d/
+sudo cp -v ./etc/systemd/coredump.conf /etc/systemd/
+sudo cp -v ./etc/sysctl.d/99-security.conf /etc/sysctl.d/
 sudo sysctl --system
 
-grep tmpfs /etc/fstab || sudo cat etc/fstab >> /etc/fstab
+grep tmpfs /etc/fstab || sudo cat ./etc/fstab >> /etc/fstab
 
 # firewall
 sudo ufw default deny incoming
@@ -25,5 +26,5 @@ sudo systemctl enable --now ufw
 sudo systemctl enable --now fstrim.timer
 
 # linux-hardened
-sudo cp -v etc/mkinitcpio.d/linux-hardened.preset /etc/mkinitcpio.d
-sudo mkinitcpio -p linux-hardened
+sudo cp -v ./etc/mkinitcpio.d/linux-hardened.preset /etc/mkinitcpio.d
+sudo mkinitcpio -P
diff --git a/etc/sudoers.d/00-hardening b/etc/sudoers.d/00-hardening
new file mode 100644
index 0000000..e1b1d08
--- /dev/null
+++ b/etc/sudoers.d/00-hardening
@@ -0,0 +1,11 @@
+# Force sudo to run in its own pseudo-terminal (prevents TTY hijacking)
+Defaults use_pty
+
+# Reset environment variables on sudo execution
+Defaults env_reset
+
+# Reduce the cached password window to 5 minutes (default is 15)
+Defaults timestamp_timeout=5
+
+# Clear screen after entering password
+Defaults lecture=never
-- 
cgit