From e91940bd94e4437eaab9ca5dc9fac9dec5c45de0 Mon Sep 17 00:00:00 2001 From: Denis Chevalier Date: Thu, 6 Aug 2026 16:52:49 +0200 Subject: minor tweaks --- setup.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/setup.sh b/setup.sh index 20f315c..af03727 100755 --- a/setup.sh +++ b/setup.sh @@ -76,6 +76,9 @@ paru -Qtdq | xargs -r paru -Rns --noconfirm || true # ----------------------------------------------------------------------------- log_info "Step 2: Deploying /etc System Configurations & Security Hardening..." +# Lock root account password (forces sudo-only access) +sudo passwd -l root >/dev/null + # Copy basic configuration files safely sudo cp -v ./etc/keyd/keyd.conf /etc/keyd/ sudo cp -v ./etc/pacman.conf /etc/ @@ -87,6 +90,7 @@ sudo cp -v ./etc/pam.d/greetd /etc/pam.d/ sudo cp -v ./etc/login.defs /etc/ sudo cp -v ./etc/updatedb.conf /etc/ sudo visudo -cf ./etc/sudoers.d/00-hardening && sudo cp -v ./etc/sudoers.d/00-hardening /etc/sudoers.d/ +sudo chmod 0440 /etc/sudoers.d/00-hardening sudo cp -v ./etc/systemd/coredump.conf /etc/systemd/ sudo cp -v ./etc/sysctl.d/99-security.conf /etc/sysctl.d/ sudo cp -v ./etc/cups/cupsd.conf /etc/cups/ @@ -141,6 +145,11 @@ log_info "Step 3: Reloading System Configuration & Enabling Services..." sudo sysctl --system sudo mkinitcpio -P + +if command -v sbctl >/dev/null 2>&1; then + sudo sbctl sign-all -s 2>/dev/null || true +fi + sudo systemctl daemon-reload # Enable User-Level Socket/Service Units -- cgit