3 ms·
> [top of readme] lockdown a newly installed linux os > [bottom of readme] Supported OS: Debian Not all Linux is Debian or a Debian derivative. > Remounts /t
by amarshall 6y ago
> [top of readme] lockdown a newly installed linux os
> [bottom of readme] Supported OS: Debian
Not all Linux is Debian or a Debian derivative.
> Remounts /tmp /proc /dev /run to be more restrictive
Unfortunately it only appears to remount, which will not persist across reboots (unless I’m missing something).
> Restrict access to compilers
Is this actually meaningful from a security perspective? If one can get some source onto a machine and execute a compiler and then execute that binary, how is that substantially different than them just getting a binary onto the machine and executing that instead?
- hwerehqrw 6y agothe whole script is a beautiful exercise in cargo-cult security it's so far out there that I almost think it's intended as performance art, rather than something anyone is supposed to actually use
- q3k 6y ago> Unfortunately it only appears to remount, which will not persist across reboots (unless I’m missing something). Yeah and then it also reboots immediately. What's the point? Has this even been tested?