search

tasket / Qubes-VM-hardening

Fend off malware at Qubes VM startup
GNU General Public License v3.0
74 stars 11 forks source link

Installer: auto-protect /home files from root exploits #10

Closed tasket closed 5 years ago

tasket commented 6 years ago

When the service is installed, the user would be asked if either of the above should be done automatically:

  1. Generate a sha256sum list of all the protected files in /home/user dir so they are checked at startup.

  2. Copy protected /home files to /etc/default/vms.

This would cover a gap in the protection of /home when an attack achieves privilege escalation, without the user having to do manual configuration.

tasket commented 5 years ago

This is more effectively done via explicit support for /home/user that was recently added which uses /etc/skel in combination with the ability to add /home to the privdirs list.