Looks all good and quite in Whonix 15.0.1.5.1.
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed Advanced Search
Advanced Search
Advanced Search
Sep 28 2020
Sep 28 2020
May 14 2020
May 14 2020
- https://github.com/Whonix/security-misc/commit/3cd7b144bba1a92ca771b16fc5215073c7561a1a
- https://github.com/Whonix/debug-misc/commit/5a856595c1cf0a4a3b08e6ea75bd2fe2b3f2f398
- https://github.com/Whonix/debug-misc/commit/9e1ea579ca0a2d4399f2e1126b2ae2f583410947
- https://github.com/Whonix/debug-misc/commit/2cac2bed7169ae4d5477cbca1f2916bae110a450
Apr 23 2020
Apr 23 2020
Setting quiet loglevel=0 in that exact order as per https://github.com/Whonix/security-misc/commit/6485df8126b52a2072824fa442e8d1dd5cb18981 does now hide [sda] Incomplete mode parameter data. However, messages by LKRG are not yet hidden.
Apr 16 2020
Apr 16 2020
Even kernel parameter quiet loglevel=3 rd.systemd.show_status=auto rd.udev.log_priority=3
(from https://wiki.archlinux.org/index.php/Silent_boot)
does not hide [sda] Incomplete mode parameter data.
Patrick updated the task description for T950: set kernel.printk sysctl to prevent kernel info leaks.
Patrick updated the task description for T950: set kernel.printk sysctl to prevent kernel info leaks.
kernel.printk = 3 3 3 3
Patrick updated the task description for T950: set kernel.printk sysctl to prevent kernel info leaks.
And of course these messages are attributed to whatever Whonix issue someone is having.
Mar 22 2020
Mar 22 2020
Not fully fixed.
Thanks!
Mar 21 2020
Mar 21 2020
This issue is fixed now due to the quiet boot parameter. kernel.printk=3 3 3 3 isn't needed anymore.
Jan 15 2020
Jan 15 2020
In T950#19249, @Patrick wrote:
Jan 1 2020
Jan 1 2020
In T950#19231, @madaidan wrote:quiet
Dec 25 2019
Dec 25 2019
Patrick updated the task description for T950: set kernel.printk sysctl to prevent kernel info leaks.
Patrick updated the task description for T950: set kernel.printk sysctl to prevent kernel info leaks.
Dec 24 2019
Dec 24 2019
This just prevents writing to /dev/kmsg. It doesn't stop kernel logs being displayed during boot.
Still wondering if initramfs modification this can be avoided... Still wondering if kernel.printk can be set through a kernel parameter. Looking again at https://github.com/torvalds/linux/blob/master/Documentation/admin-guide/kernel-parameters.txt...
Sounds good.
We can use a sysctl.d drop-in and an initramfs hook in security-misc so non-initramfs users will still be mostly protected.
I guess because a sysctl.d drop-in config file is easy and catches most.
initramfs hook covers only initramfs users. Not dracut. But
security-misc initramfs hook sounds good enough. dracut support can
come later, if ever. Please implement.
Why not use an initramfs hook in security-misc? Not everyone will have security-misc and apparmor-profile-everything installed. Users with just security-misc installed will still have some kernel logs shown during early boot.
Yes. Probably both. initramfs for apparmor-profile-everything users and
/etc/sysctl.d/ security-misc.
Dec 23 2019
Dec 23 2019
Should this be set in the initramfs?
madaidan added a comment to T945: /etc/default/grub.d/40_kernel_hardening.cfg fails to detect kernel upgrade.
That worked.
Patrick triaged T948: /tmp etc. separation through polyinstantiation by using namespaces.conf as Normal priority.
Patrick triaged T945: /etc/default/grub.d/40_kernel_hardening.cfg fails to detect kernel upgrade as Normal priority.
Dec 7 2019
Dec 7 2019
Patrick renamed T937: make /boot and /lib/modules unreadable for non-root users from make /boot unreadable for non-root users to make /boot and /lib/modules unreadable for non-root users.
Nov 23 2019
Nov 23 2019
Jun 20 2019
Jun 20 2019
Jun 14 2019
Jun 14 2019
Mar 7 2018
Mar 7 2018
Feb 19 2017
Feb 19 2017
Dec 7 2016
Dec 7 2016
Apr 21 2016
Apr 21 2016
Whonix OLD Issue Tracker · PLEASE DO NOT POST NEW TICKETS HERE · OLD Issue Tracker - Unread Notifications · OLD Issue Tracker - Feed · OLD Issue Tracker - Open Issues · NEW Issue Tracker · Homepage · Blog · Forum · Legal · Imprint · Privacy Policy · Terms of Use · Disclaimer