Browse code
Revert "Fix Security Hardening bugs 1618534 & 1618528"
This reverts commit 928363a1010fc5a4c969cb3892348d6209b29720.
Change-Id: Ic90f0bbc2d658c8359ffd0684b62173672646da4
Reviewed-on: http://photon-jenkins.eng.vmware.com/638
Reviewed-by: suezzelur <anishs@vmware.com>
Tested-by: suezzelur <anishs@vmware.com>
suezzelur authored on 2016/03/16 04:30:42Showing 3 changed files
- SPECS/distrib-compat/50-security-hardening.conf
- SPECS/distrib-compat/distrib-compat.spec
- SPECS/linux/linux.spec
| 1 | 1 |
deleted file mode 100644 |
| ... | ... |
@@ -1,10 +0,0 @@ |
| 1 |
-#Enabling the strongest form of native Linux Address Space Layout Randomization (ASLR). |
|
| 2 |
-kernel.randomize_va_space=2 |
|
| 3 |
-#Restrict revealing kernel addresses |
|
| 4 |
-kernel.kptr_restrict=2 |
|
| 5 |
-#Preventing non-root users from viewing the kernel ring buffer. |
|
| 6 |
-kernel.dmesg_restrict = 1 |
|
| 7 |
-# To avoid potential information disclosure |
|
| 8 |
-net.ipv4.tcp_timestamps = 0 |
|
| 9 |
-# disabling an unused feature |
|
| 10 |
-kernel.sysrq=0 |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: Set of scripts and tools to get compatbility with other distributions. |
| 2 | 2 |
Name: distrib-compat |
| 3 | 3 |
Version: 0.1 |
| 4 |
-Release: 6%{?dist}
|
|
| 4 |
+Release: 5%{?dist}
|
|
| 5 | 5 |
License: GPLv2 |
| 6 | 6 |
URL: http://photon.org |
| 7 | 7 |
Group: System Environment/Base |
| ... | ... |
@@ -13,7 +13,6 @@ Source1: rc.status |
| 13 | 13 |
Source2: 90-va-tune-up.conf |
| 14 | 14 |
Source3: ifup |
| 15 | 15 |
Source4: ifdown |
| 16 |
-Source5: 50-security-hardening.conf |
|
| 17 | 16 |
%description |
| 18 | 17 |
Set of scripts and tools to get compatbility with other distributions. |
| 19 | 18 |
It includes: rc.status, startproc, killproc, checkproc, ifup and ifdown. |
| ... | ... |
@@ -28,7 +27,6 @@ install -m 0644 %{SOURCE1} %{buildroot}/%{_sysconfdir}
|
| 28 | 28 |
install -m 0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysctl.d
|
| 29 | 29 |
install -m 0755 %{SOURCE3} %{buildroot}/sbin
|
| 30 | 30 |
install -m 0755 %{SOURCE4} %{buildroot}/sbin
|
| 31 |
-install -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysctl.d
|
|
| 32 | 31 |
touch %{buildroot}/%{_sysconfdir}/sysctl.d/99-compat.conf
|
| 33 | 32 |
chmod 644 %{buildroot}/%{_sysconfdir}/sysctl.d/99-compat.conf
|
| 34 | 33 |
ln -s sysctl.d/99-compat.conf %{buildroot}/%{_sysconfdir}/sysctl.conf
|
| ... | ... |
@@ -37,8 +35,6 @@ ln -s sysctl.d/99-compat.conf %{buildroot}/%{_sysconfdir}/sysctl.conf
|
| 37 | 37 |
%{_sysconfdir}/*
|
| 38 | 38 |
/sbin/* |
| 39 | 39 |
%changelog |
| 40 |
-* Thu Mar 10 2016 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 0.1-6 |
|
| 41 |
-- Added the security hardening configuration file. |
|
| 42 | 40 |
* Thu Feb 11 2016 Mahmoud Bassiouny <mbassiouny@vmware.com> 0.1-5 |
| 43 | 41 |
- Move ifup and ifdown outside the sources tar.gz |
| 44 | 42 |
* Wed Feb 10 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 0.2-2 |
| ... | ... |
@@ -2,7 +2,7 @@ |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux |
| 4 | 4 |
Version: 4.2.8 |
| 5 |
-Release: 2%{?dist}
|
|
| 5 |
+Release: 1%{?dist}
|
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| 8 | 8 |
Group: System Environment/Kernel |
| ... | ... |
@@ -100,9 +100,6 @@ cp -v arch/x86/boot/bzImage %{buildroot}/boot/vmlinuz-%{version}
|
| 100 | 100 |
cp -v System.map %{buildroot}/boot/system.map-%{version}
|
| 101 | 101 |
cp -v .config %{buildroot}/boot/config-%{version}
|
| 102 | 102 |
cp -r Documentation/* %{buildroot}%{_defaultdocdir}/%{name}-%{version}
|
| 103 |
- |
|
| 104 |
-chmod -v 400 %{buildroot}/boot/system.map-%{version}
|
|
| 105 |
- |
|
| 106 | 103 |
cat > %{buildroot}/boot/%{name}-%{version}-%{release}.cfg << "EOF"
|
| 107 | 104 |
# GRUB Environment Block |
| 108 | 105 |
photon_cmdline=net.ifnames=0 init=/lib/systemd/systemd ro loglevel=3 quiet plymouth.enable=0 |
| ... | ... |
@@ -171,8 +168,6 @@ ln -sf %{name}-%{version}-%{release}.cfg /boot/photon.cfg
|
| 171 | 171 |
/lib/modules/%{version}/kernel/arch/x86/oprofile/
|
| 172 | 172 |
|
| 173 | 173 |
%changelog |
| 174 |
-* Thu Mar 10 2016 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 4.2.8-2 |
|
| 175 |
-- Restrict the permissions of the /boot/System.map-X file |
|
| 176 | 174 |
* Wed Mar 09 2016 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 4.2.8-1 |
| 177 | 175 |
- Upgraded to version 4.2.8 |
| 178 | 176 |
* Fri Mar 04 2016 Alexey Makhalov <amakhalov@vmware.com> 4.2.0-21 |