feat: make if so every file is already into this repo and disable boo…

…t services
tulilirockz · Aug 30, 2023 · 915ff4d · 915ff4d
1 parent 0987ceb
commit 915ff4d
Show file tree

Hide file tree

Showing 11 changed files with 64 additions and 28 deletions.
diff --git a/recipe-dx.yml b/recipe-dx.yml
@@ -11,7 +11,6 @@ scripts:
     - dx-extras.sh
 rpm:
   repos:
-    - https://terra.fyralabs.com/terra.repo
   install:
     - python3-pip
     - libadwaita
@@ -34,10 +33,6 @@ rpm:
     - libvirt
     - qemu-img
     - tmux
-    - code-insiders
-    - jetbrainsmono-nerd-fonts
-    - firacode-nerd-fonts
-    - firamono-nerd-fonts
   remove:
     - wpa_supplicant
 firstboot:

diff --git a/scripts/post/displaylink_remove.sh b/scripts/post/displaylink_remove.sh
diff --git a/scripts/post/faster_boot_less_services.sh b/scripts/post/faster_boot_less_services.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+systemctl disable displaylink.service bazzite-hardware-setup.service flatpak-system-install.service
diff --git a/scripts/post/hardening.sh b/scripts/post/hardening.sh
diff --git a/scripts/pre/networkmanager-realtek.sh → scripts/post/networkmanager-realtek.sh b/scripts/pre/networkmanager-realtek.sh → scripts/post/networkmanager-realtek.sh
diff --git a/scripts/post/silead_gsl-firmware.sh b/scripts/post/silead_gsl-firmware.sh
diff --git a/usr/lib/firmware/silead/mssl1680.fw b/usr/lib/firmware/silead/mssl1680.fw
diff --git a/usr/lib/firmware/silead/silead.fw b/usr/lib/firmware/silead/silead.fw
diff --git a/usr/lib/firmware/silead/silead_ts.fw b/usr/lib/firmware/silead/silead_ts.fw
diff --git a/usr/lib/systemd/NetworkManager.service.d/99-brace.conf b/usr/lib/systemd/NetworkManager.service.d/99-brace.conf
@@ -0,0 +1,28 @@
+[Service]
+# Hardening
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT
+LockPersonality=true
+MemoryDenyWriteExecute=true
+#PrivateDevices=true #breaks tun usage
+#ProtectProc=invisible
+PrivateTmp=yes
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=read-only
+ProtectKernelLogs=true
+#ProtectKernelModules=true
+#ProtectSystem=strict
+ReadOnlyPaths=/etc/NetworkManager
+ReadOnlyPaths=-/home
+ReadWritePaths=-/etc/NetworkManager/system-connections
+ReadWritePaths=-/etc/sysconfig/network-scripts
+ReadWritePaths=/var/lib/NetworkManager
+ReadWritePaths=-/var/run/NetworkManager
+ReadWritePaths=-/run/NetworkManager
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077
diff --git a/usr/lib/systemd/irqbalance.service.d/99-brace.conf b/usr/lib/systemd/irqbalance.service.d/99-brace.conf
@@ -0,0 +1,34 @@
+[Service]
+# Hardening
+#CapabilityBoundingSet="CAP_SETPCAP"
+LockPersonality=true
+MemoryDenyWriteExecute=true
+#NoNewPrivileges=true
+PrivateDevices=true
+#ProtectProc=invisible
+PrivateTmp=yes
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadOnlyPaths=-/etc/default/irqbalance
+ReadOnlyPaths=-/etc/sysconfig/irqbalance
+ReadOnlyPaths=-/etc/irqbalance
+ReadWritePaths=/proc/irq
+ReadWritePaths=-/run/irqbalance
+ReadWritePaths=-/var/run/irqbalance
+RemoveIPC=true
+RestrictAddressFamilies=~AF_INET
+RestrictAddressFamilies=~AF_INET6
+#RestrictAddressFamilies=~AF_NETLINK
+RestrictAddressFamilies=~AF_PACKET
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		#!/bin/sh
		systemctl disable displaylink.service bazzite-hardware-setup.service flatpak-system-install.service