Actions

Dev/Astra Linux

From Whonix

< Dev

UNFINISHED

Contents

Astra Linux Common Edition vs Astra Linux Special Edition[edit]

Astra Linux Common Edition[edit]

  • Use hardened kernel.
  • Enable console lock.
  • Enable interpreter locks.
  • Enable ufw firewall.
  • Enable system limits.
  • Disable ptrace capability.
  • Disable non-execution bit setup.
  • Enable password entry for sudo.
  • System clock is set to local time.
  • Enable autologin X session.
  • Disable automatic network configuration.
  • Install 32-bit bootloader.

Astra Linux Special Edition[edit]

  • Enable ELF signature check.
  • Disable non-execution bit setup.
  • Use hardened kernel.
  • Disable bootloader menu show up.
  • Enable swap cleanup.
  • Enable freeing regions on cleanup on EXT-paritions.
  • Enable console lock.
  • Enable interpreter locks.
  • Enable ufw firewall.
  • Enable system limits.
  • Disable ptrace capability.
  • Disable automatic network configuration.
  • Install 32-bit bootloader.

Diff[edit]

0a1,2
> * Enable ELF signature check.
> * Disable non-execution bit setup.
1a4,6
> * Disable bootloader menu show up.
> * Enable swap cleanup.
> * Enable freeing regions on cleanup on EXT-paritions.
7,10d11
< * Disable non-execution bit setup.
< * Enable password entry for sudo.
< * System clock is set to local time.
< * Enable autologin X session

/etc/apt/sources.list.d drop-in folder[edit]

  • Astra Common Edition: nothing there
  • Astra Special Edition: nothing there

Package Recompliation[edit]

Quote https://wiki.debian.org/Derivatives/Census/AstraLinux [archive] [1]

rebuilds all Debian source packages, modifies some source packages and adds new packages

All packages? No, packages such as magic-wormhole are not installable.

Recompile for what purpose? Haven't found referenced if recompiled for what purpose.

Compile Hardening Flags[edit]

Seems there is no difference.

Astra Linux Special Edition.

bash ./checksec --file=/bin/sed
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable  FILE
Partial RELRO   Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   No Symbols      Yes     4               11      /bin/sed

Debian buster.

checksec --file /bin/sed
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable  FILE
Partial RELRO   Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   No Symbols       Yes    4               11      /bin/sed

Enable ELF signature check[edit]

Special Edition only.

All binaries seem to be signed. Made a test. Copied /bin/nano to /bin/nano-test. Tried to execute nano-test. Success. Then edited a textual string inside /bin/nano-test. Tried to execute it again. Segmentation fault.

References what ELF signatures are:

Another test. Install croc [archive].

wget https://getcroc.schollz.com

mv index.html croc-installer

bash ./croc-installer

Installation was successful. Trying to execute it.

croc

That failed.

Segmentation fault

Systemd journal log showing DIGSIG error.

TODO

Could try to sign it.

bsign --sign /usr/local/bin/croc

But asks for passphrase which I don't know.

Disable[edit]

Can be disabled in /etc/digsig/digsig_initramfs.confby setting DIGSIG_ELF_MODE=0.

APT Repository[edit]

Number of Packages[edit]

Astra Linux Common Edition is said be be based on Debian stretch but its repository seems to contain less packages than Debian stretch repository.

Some packages found:

  • python-pip
  • git

Some packages missing:

  • tor

Astra Linux Common Edition APT Repository with Debian APT Repository[edit]

Possible. Test wise installed the tor package.

Mix Astra Linux Special Edition with Astra Linux Common Edition APT Repository[edit]

Possible:

  • with Enable ELF signature check. in Astra Linux Special Edition installer: No.
  • otherwise: Yes.

Special Edition[edit]

noexec[edit]

Astra Special Edition:

touch scriptname

chmod +x scriptname

./scriptname

Permission denied. Using some kind of noexec in home.

But you can still use.

bash ./scriptname

user@astra:~$ touch /tmp/a
user@astra:~$ chmod +x /tmp/a

chmod: changing permissions of '/tmp/a': Operation not permitted

Functional:

sudo chmod +x /tmp/a

root account[edit]

Is locked by default.

recovery mode boot option[edit]

Is broken by default due to locked root account.

tally[edit]

Locks user accounts after 7 wrong password entry attempts similar to security-misc by Kicksecure.

mount options[edit]

root@astra:~# mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,nosuid,relatime,size=1990036k,nr_inodes=497509,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=401328k,mode=755)
/dev/xvda1 on / type ext4 (rw,relatime,errors=remount-ro,data=ordered)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/rdma type cgroup (rw,nosuid,nodev,noexec,relatime,rdma)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,hugetlb)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=29,pgrp=1,timeout=0,minproto=5,maxproto=5,direct)
systemd-1 on /parsecfs type autofs (rw,relatime,fd=34,pgrp=1,timeout=0,minproto=5,maxproto=5,direct)
mqueue on /dev/mqueue type mqueue (rw,relatime)
/parsecfs on /parsecfs type parsecfs (rw,relatime,sync)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,relatime)
configfs on /sys/kernel/config type configfs (rw,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=401324k,mode=700,uid=1000,gid=1000)

checksec kernel[edit]

checksec 2.1.0 [archive]

Astra Linux Special Edition[edit]

sudo bash checksec --kernel
* Kernel protection information:

  Description - List the status of kernel protection mechanisms. Rather than
  inspect kernel mechanisms that may aid in the prevention of exploitation of
  userspace processes, this option lists the status of kernel configuration
  options that harden the kernel itself against attack.

  Kernel config:
NOT FOUND

Kicksecure / Whonix[edit]

sudo checksec --kernel

Contains some false positives. Documented below.

* Kernel protection information:

  Description - List the status of kernel protection mechanisms. Rather than
  inspect kernel mechanisms that may aid in the prevention of exploitation of
  userspace processes, this option lists the status of kernel configuration
  options that harden the kernel itself against attack.

  Kernel config:
/boot/config-4.19.0-6-amd64

  Warning: The config on disk may not represent running kernel config!

  Vanilla Kernel ASLR:                    Full
  Protected symlinks:                     Enabled
  Protected hardlinks:                    Enabled
  Ipv4 reverse path filtering:            Disabled
  Ipv6 reverse path filtering:            Disabled
  Kernel heap randomization:              Enabled
  GCC stack protector support:            Enabled
  SLAB freelist randomization:            Enabled
  Virtually-mapped kernel stack:          Enabled
  Enforce read-only kernel data:          Enabled
  Enforce read-only module data:          Enabled
  Exec Shield:                            Disabled

  Hardened Usercopy:                      Enabled
  Hardened Usercopy Pagespan:             Disabled
  Harden str/mem functions:               Enabled
  Restrict /dev/mem access:               Enabled
  Restrict I/O access to /dev/mem:        Enabled
  Restrict /dev/kmem access:              Enabled

* X86 only:            
  Address space layout randomization:     Enabled

* SELinux:                                Disabled

  SELinux infomation available here: 
    http://selinuxproject.org/

* grsecurity / PaX:                       No GRKERNSEC

  The grsecurity / PaX patchset is available here:
    http://grsecurity.net/


False-positives:

CONFIG_HARDENED_USERCOPY_PAGESPAN:

/boot[edit]

root@astra:~# ls -la /boot
total 112388
drwxr-xr-x  3 root root     4096 Dec  5 09:35 .
drwxr-xr-x 24 root root     4096 Dec  3 16:47 ..
-rw-r--r--  1 root root   215474 Oct 24  2018 config-4.15.3-1-generic
drwxr-xr-x  5 root root     4096 Dec  3 16:47 grub
-rw-r--r--  1 root root 46648441 Dec  3 16:48 initrd.img-4.15.3-1-generic
-rw-r--r--  1 root root 45729880 Dec  5 09:34 initrd.img-4.15.3-1-hardened
-rw-------  1 root root  3976127 Oct 24  2018 System.map-4.15.3-1-generic
-rw-------  1 root root  3193521 Oct 24  2018 System.map-4.15.3-1-hardened
-rw-------  1 root root  8058736 Oct 24  2018 vmlinuz-4.15.3-1-generic
-rw-------  1 root root  7235440 Oct 24  2018 vmlinuz-4.15.3-1-hardened

cat /proc/cmdline[edit]

cat /proc/cmdline 
BOOT_IMAGE=/boot/vmlinuz-4.15.3-1-hardened root=UUID=6c536f99-734f-4e8f-a683-71b52e7df7d3 ro parsec.max_ilev=63 quiet net.ifnames=0 ipv6.disable=1 slub_debug=P page_poison=1 slab_nomerge pti=on user.max_user_namespaces=0 kernel.kptr_restrict=1 vsyscall=none ipv6.disable=1

dpkg -l | grep astra-[edit]

dpkg -l | grep astra-

ii  astra-extra                                   1.0-0.0                               all          Configuration Astra linux
ii  astra-safepolicy                              1.0.62                                all          Global security policy checker
ii  astra-version                                 1.6                                   amd64        Update Astra version
ii  linux-astra-modules                           4.15.3-1astra4                        amd64        Non-free Astra Linux kernel modules
ii  linux-astra-modules-4.15.3-1-generic          4.15.3-1.astra25                      amd64        Non-free Astra Linux kernel modules for version 4.15.3 on x86/x86_64
ii  linux-astra-modules-4.15.3-1-hardened         4.15.3-1.astra25                      amd64        Non-free Astra Linux kernel modules for version 4.15.3 on x86/x86_64
ii  linux-astra-modules-common                    4.15.3-1.astra25                      all          Common stuff 4 non-free Astra Linux kernel modules
ii  linux-astra-modules-generic                   4.15.3-1astra4                        amd64        Non-free Astra Linux kernel modules
ii  linux-astra-modules-hardened                  4.15.3-1astra4                        amd64        Non-free Astra Linux kernel modules

dpkg -l | grep smolensk-[edit]

dpkg -l | grep smolensk-
ii  smolensk-security                             2.0.11                                amd64        metapackage for security management console

dpkg -l | grep fly-[edit]

root@astra:~# dpkg -l | grep fly-
ii  fly-admin-ald-client                          0.2.4                                 amd64        ALD client GUI configution tool
ii  fly-admin-alternatives                        1.1.5                                 amd64        Manage Debian alternatives
ii  fly-admin-autostart                           0.2.8                                 amd64        Fly Autostart
ii  fly-admin-center                              1.2.6                                 amd64        Control center
ii  fly-admin-cron                                1.2.5                                 amd64        Cron management
ii  fly-admin-date                                2.3.8                                 amd64        Date and time tool (for Desktop)
ii  fly-admin-date-helper                         2.3.8                                 amd64        System DBus helper for Date and time tool
ii  fly-admin-device-manager                      1.1.5                                 amd64        FLY admin device manager
ii  fly-admin-digsig                              0.2.12                                amd64        Digital signature manager
ii  fly-admin-dm                                  1.1.10                                amd64        Configure fly-dm
ii  fly-admin-env                                 1.1.2                                 amd64        Fly Environment Variables Editor
ii  fly-admin-fonts                               2.1.7                                 amd64        System fonts manager
ii  fly-admin-gmc                                 0.1.42                                amd64        management console
ii  fly-admin-grub2                               1.0.0                                 all          GRUB2 editor
ii  fly-admin-int-check                           1.4.4                                 amd64        tool for check system integrity for Fly Desktop
ii  fly-admin-iso                                 0.2.2                                 amd64        Utility for writing iso image to removable drive
ii  fly-admin-kiosk                               1.3.3                                 amd64        System kiosk management application
ii  fly-admin-local                               0.1.48                                amd64        management console
ii  fly-admin-local-se                            0.1.46                                amd64        management console
ii  fly-admin-marker                              2.1.5                                 amd64        Marker template editor for secure CUPS version
ii  fly-admin-mic                                 0.1.14                                amd64        management console
ii  fly-admin-mouse                               1.0.0                                 all          Mouse settings
ii  fly-admin-policykit-1                         1.2.3                                 amd64        PolicyKit-1 policies manager
ii  fly-admin-power                               2.0.1                                 all          Power settings
ii  fly-admin-printer                             1.9.15                                amd64        FlyDE printing system management
ii  fly-admin-printer-mac                         1.7.6                                 amd64        FlyDE printing system management MAC support
ii  fly-admin-reflex                              1.3.7                                 amd64        Fly hotplug event processing setup util
ii  fly-admin-screen                              1.0.1                                 all          Screen settings
ii  fly-admin-security-monitor                    0.1.6                                 amd64        management console
ii  fly-admin-service                             0.1.31                                amd64        management console
ii  fly-admin-service-se                          0.1.37                                amd64        management console
ii  fly-admin-viewaudit                           3.5.6                                 amd64        Parsec view audit control
ii  fly-admin-winprops                            1.2.5                                 amd64        Configure window properties
ii  fly-admin-wm                                  2.4.16                                amd64        fly-admin-wm - admin utils for Fly window manager
ii  fly-all-games                                 2.6.37se                              amd64        Dummy package to have all FLY games packages
ii  fly-all-main                                  2.6.37se                              amd64        Dummy package to have all FLY main packages
ii  fly-all-optional                              2.6.37se                              amd64        Dummy package to have all FLY optional packages
ii  fly-all-qml                                   2.6.37se                              amd64        Dummy package to have all FLY qml packages
ii  fly-brightness                                0.2.6                                 amd64        Fly brightness control
ii  fly-calc                                      2.0.9                                 amd64        Fly Calculator
ii  fly-camera                                    1.2.3                                 amd64        Fly Camera
ii  fly-contacts                                  2.0.9                                 amd64        Fly Contacts
ii  fly-data                                      2.4.44se                              all          Data files (cursors, icon themes, etc.) for Fly desktop
ii  fly-data-mobile                               1.0.4                                 amd64        Data files for Fly mobile session
ii  fly-date                                      1.0.8                                 amd64        Fly Date
ii  fly-dm                                        2.6.14se                              amd64        Fly Display Manager (service part)
ii  fly-fm                                        1.6.5.7                               amd64        Fly desktop environment file manager
ii  fly-fm-audit                                  1.0.6                                 amd64        fly-fm audit plugin
ii  fly-fm-bsign                                  1.0.5                                 amd64        fly-fm bsign plugin
ii  fly-fm-crypt                                  1.2.0                                 amd64        fly-fm crypt plugin
ii  fly-fm-libs                                   1.6.5.7                               amd64        Libraries for the Fly desktop environment file mananger
ii  fly-fm-mac                                    0.4.9                                 amd64        Parsec mac plugin
ii  fly-fm-searchfilters                          1.6.5.7                               all          Search filters for the Fly desktop environment file mananger
ii  fly-fontconfig-settings                       0.0.5                                 all          fontconfig local settings for Fly Desktop
ii  fly-gallery                                   0.7.2                                 amd64        Fly Gallery
ii  fly-gps                                       1.0.9                                 amd64        Fly GPS
ii  fly-jobviewer                                 1.9.15                                amd64        FlyDE printer queue viewer
ii  fly-launcher                                  1.5.2                                 amd64        Fly Launcher
ii  fly-launcher-libs                             0.1.1                                 amd64        Fly Launcher Libraries
ii  fly-mac-dialog                                0.12.15                               amd64        MAClabel selecting dialog for Fly desktop
ii  fly-mail                                      2.0.12                                amd64        Fly Mail
ii  fly-music                                     0.5.5                                 amd64        Fly Music
ii  fly-notes                                     2.0.11                                amd64        Fly Notes
ii  fly-orientation                               0.1.6                                 amd64        Application for controlling the orientation of the screen
ii  fly-pdfview                                   0.3.1                                 amd64        Fly PDF Viewer
ii  fly-phone-db-client                           1.0.3                                 amd64        Fly Phone Database lib
ii  fly-phone-dbus                                1.0.7                                 amd64        Fly Phone Dbus Notifier lib
ii  fly-phone-widgets                             1.0.7                                 amd64        Fly Phone Desktop Widgets
ii  fly-plastique-style                           1.1.4                                 amd64        FlyPlastique style for Qt4
ii  fly-print-monitor                             1.9.15                                amd64        FlyDE printer monitor for system tray
ii  fly-qdm                                       2.4.22                                amd64        Fly Display Manager (GUI part)
ii  fly-qml-components                            1.1.3                                 amd64        Fly QML Components
ii  fly-qml-dialer                                1.0.8                                 amd64        Fly Dialer
ii  fly-record                                    2.0.11                                amd64        Fly Record
ii  fly-reflex                                    1.3.7                                 amd64        Fly hotplug event processing service
ii  fly-reflex-service                            1.3.7                                 amd64        Fly hotplug event processing service
ii  fly-run                                       0.5.5                                 amd64        Fly Command Runner
ii  fly-run-sumac                                 1.1.6                                 amd64        sumac plugin for fly-run
ii  fly-scan                                      1.3.4                                 amd64        Fly Scanner Dialog
ii  fly-shutdown-dialog                           1.0.23                                amd64        fly-shutdown-dialog - shutdown dialog for Fly desktop
ii  fly-sms                                       1.0.9                                 amd64        Fly SMS
ii  fly-start-panel                               2.4.5                                 amd64        Fly start panel and menu
ii  fly-su                                        0.2.9                                 amd64        Graphical su
ii  fly-system-monitor-widget                     0.1.2                                 amd64        CPU load display widget
ii  fly-term                                      1.4.5                                 amd64        Fly Terminal Emulation
ii  fly-videocamera                               1.2.3                                 amd64        Fly Webcam
ii  fly-vkbd                                      1.1.5                                 amd64        Virtual keyboard
ii  fly-weather                                   0.1.4                                 amd64        Fly Weather
ii  fly-winprops-service                          1.2.5                                 amd64        Windows properties service
ii  fly-wm                                        2.17.51se1c                           amd64        fly-wm - Window Manager for Fly Desktop
ii  fly-wm-decor                                  2.17.51se1c                           amd64        fly-wm-decor - additional themes for for Fly Desktop
ii  fly-xkbmap                                    1.1.5                                 amd64        Keyboard layout setup
ii  libfly-admin-printer                          1.9.15                                amd64        FlyDE printing system management

Packages[edit]

astra-extra[edit]

Description: Configuration Astra linux

This deb-package configurate Astra linux after updates

apt-file list astra-extra

astra-extra: /boot/grub/splash.xpm.gz
astra-extra: /usr/share/astra-extra/debian-logo.png
astra-extra: /usr/share/astra-extra/star.png
astra-extra: /usr/share/doc/astra-extra/changelog.Debian.gz
astra-extra: /usr/share/doc/astra-extra/copyright

astra-safepolicy[edit]

Description: Global security policy checker

Package checks and sets security settings of the computer.
Conffiles:
 /etc/astra-safepolicy.conf
 /etc/modprobe.d/blacklist-astra.conf
 /etc/sysctl.d/999-astra.conf

Next.

cat /etc/astra-safepolicy.conf

output:

CFG_GRUBPASS=''
CFG_QUOTAS=''
CFG_ULIMITS=''
CFG_CRACKLEN='8'
CFG_SECRM=''
CFG_NCX=''
CFG_IPT=''
CFG_SWAPS=''
CFG_TALLY='8'

Next.

 cat /etc/modprobe.d/blacklist-astra.conf

output:

# Astra blacklist

blacklist ast
blacklist mgag200

Next.

cat /etc/sysctl.d/999-astra.conf

output:

# Astra sysctl config

kernel.sysrq = 0
fs.suid_dumpable = 0
kernel.randomize_va_space = 2
net.ipv6.conf.all.disable_ipv6 = 1
kernel.yama.ptrace_scope=3

astra-version[edit]

Description: Update Astra version

apt-file list astra-version

output:

astra-version: /usr/share/base-files/update/astra_version
astra-version: /usr/share/base-files/update/lsb-release
astra-version: /usr/share/base-files/update/os-release
astra-version: /usr/share/doc/astra-version/changelog.gz
astra-version: /usr/share/doc/astra-version/copyright

Next.

root@astra:~# cat /usr/share/base-files/update/astra_version
SE 1.6 (smolensk)
root@astra:~# cat /usr/share/base-files/update/lsb-release
DISTRIB_ID="AstraLinux"
DISTRIB_DESCRIPTION="Astra Linux  1.6 (Smolensk)"
DISTRIB_RELEASE=1.6
DISTRIB_CODENAME=smolensk
root@astra:~# cat /usr/share/base-files/update/os-release
PRETTY_NAME="Astra Linux (Smolensk 1.6)"
NAME="Astra Linux (Smolensk)"
ID=astra
ID_LIKE=debian
ANSI_COLOR="1;31"
HOME_URL="http://astralinux.ru"
SUPPORT_URL="http://astralinux.ru/support"
VARIANT_ID=smolensk
VARIANT=Smolensk
VERSION_ID=1.6
root@astra:~# 

linux-astra-modules[edit]

Description: Non-free Astra Linux kernel modules

This package will always depend on the latest complete Astra Linux modules.

meta package

linux-astra-modules-generic[edit]

Description: Non-free Astra Linux kernel modules

This package will always depend on the latest complete Astra Linux modules.

meta package

linux-astra-modules-4.15.3-1-generic[edit]

apt-cache show linux-astra-modules-4.15.3-1-generic

snip

Description: Non-free Astra Linux kernel modules for version 4.15.3 on x86/x86_64
 This package provides restricted modules for Linux version 4.15.3 on
 x86/x86_64.
 .
 These modules are "restricted" because they are not available under a
 completely Free licence.

next

root@astra:~# apt-file list linux-astra-modules-4.15.3-1-generic
root@astra:~# 

astra-nochmodx-module-4.15.3-1-hardened[edit]

Description: nochmodx kernel modules for version 4.15.3 on x86/x86_64
 This package provides nochmodx modules for Linux version 4.15.3 on
 x86/x86_64.
 .
 These modules are "restricted" because they are not available under a
 completely Free licence.

astra-nochmodx-module-common[edit]

apt-cache show astra-nochmodx-module-common

Description: Common stuff for nochmodx kernel modules
 This package provides common stuff for nochmodx modules for Astra Linux CE.
 .
 These modules are "restricted" because they are not available under a
 completely Free licence.

parsec[edit]

Package: parsec
Depends: libparsec-base2, libpdp, parsec-mac, parsec-aud, parsec-cap, parsec-log, parsec-tools, dpkg (>= 1.16.16astra.se0)
Description: metapackage for PARSEC system
 This metapackage depends on all base PARSEC components.

Package: parsec-tools
Description: additional PARSEC system utilities
 This package contains additional PARSEC utilities. These utilities
 deal with several PARSEC subsystems simultaneously and so cannot be included to
 subsystem specific utilities package.

Package: parsec-mac
Conffiles:
 /etc/parsec/mac_categories bc1a3c7f33d982d8683336ca3d67c53c
 /etc/parsec/mac_levels 7aa5c6b6acf877a966c170ff7de44d85
 /etc/parsec/mlinks d6dc284d34815fa61550996fc281e04c
Description: mandate labels base utils for PARSEC security system
 This package contains the utilities to control PARSEC mandate labels.
 These utilities can set or get mandate labels for processes and files.
 It's a component of PARSEC security system.

Package: parsec-aud
Conffiles:
 /etc/parsec/audit 33a04c4633bc97d625e9fde1e28cb017
Description: audit base utils for PARSEC security system
 This package contains the
 utilities to control PARSEC security events audit. These utilities
 can set or get audit events for processes and files.
 It's a component of PARSEC security system.

Package: parsec-log
Conffiles:
 /etc/logrotate.d/parlogd.logrotate b4b35dbcb595c736ec27d70bd02f0f0e
 /etc/parsec/mlog/events_custom.conf 4bd7a4a18fe84c93698436c74de3fa42
 /etc/parsec/mlog/events_user.conf f97aa3b797aa5250b7c86187e5df29b5
Description: audit log base utils for PARSEC security system
 This package contains PARSEC audit log files parser, system daemon for
 reliable audit message delivery. It creates kernel and user log files.
 It's a component of PARSEC security system.

Package: parsec-cap
Conffiles:
 /etc/parsec/privsock.conf 28745f9d4b6a46382ebed7183f579671
 /etc/sudoers.d/zzz-parsec 2097e99bdf29360bf54bfc11a6167fa5
Description: capabilities base utils for PARSEC security system
 This package contains the utilities to control system capabilities
 (standard Linux capabilities and special PARSEC capabilities).
 It's a component of PARSEC security system.

smolensk-security[edit]

smolensk-security
Depends: gmc-common, gmc-miscellaneous, fly-admin-gmc, fly-admin-local, gmc-miscellaneous-se, fly-admin-local-se, fly-admin-int-check, fly-admin-viewaudit, fly-admin-marker, fly-admin-mic, fly-admin-service, fly-admin-service-se, fly-admin-digsig, fly-admin-security-monitor
Description: metapackage for security management console
 Metapackage for security management console.

ksysguard-mac[edit]

root@astra:~# apt-cache show ksysguard-mac
Maintainer: Alexander Volkov <support@rusbitech.ru>
Description: MAC plugin for ksysguard
 This package contains a plugin for a modified ksysguard
 that allows to show an additional info about processes,
 such as mandatory level and category, and integrity level.

kcm-grub2[edit]

root@astra:~# apt-cache show kcm-grub2
Package: kcm-grub2
Description: KDE Control Module for configuring the GRUB2 bootloader
 Smoothly integrated in KDE System Settings, it is the central place
 for managing your GRUB2 configuration. Supports many GRUB2 configuration
 options.

afick[edit]

Conffiles:
 /etc/afick.conf 6daf827d6d70c8e2be08b81338b8586b
 /etc/cron.daily/afick_cron 419fd1ca81d8ef852a2df1220db73c5b
 /etc/logrotate.d/afick 54a30fdfeb75ff39db1cd01aeea4fd03
Description: Another file integrity checker
 It allows to monitor the changes on your files systems,
 and so can detect intrusions.
Description-md5: d9fe3b435153ac5a4a78c3c84a291ca0
Homepage: http://afick.sourceforge.net/

tasksel --list-tasks[edit]

u Base  Base packages
u Fly   Fly desktop
u Fly-qml       Fly apps for working on devices with touchscreen
u Internet      Internet suite
u Office        Office suite
u Features      Astra Linux features
u Database      Databases
u Fly-ssh       SSH server
u Fly-web       Secure WEB server
u Fly-virtualization    Virtualization tools
u Multimedia    Multimedia

Files[edit]

empty

  • /usr/lib/modules-load.d
  • /etc/apt/sources.list.d
  • /etc/apt/preferences.d

standard + trust CD ROM setting

  • /etc/apt/apt.conf.d

kernel modules[edit]

grep /lib/modules[edit]

sudo grep -r -i rusbitech /lib/modules

output:

Binary file /lib/modules/4.15.3-1-generic/misc/parsec.ko matches
Binary file /lib/modules/4.15.3-1-generic/misc/digsig_verif.ko matches
Binary file /lib/modules/4.15.3-1-hardened/misc/parsec.ko matches
Binary file /lib/modules/4.15.3-1-hardened/misc/digsig_verif.ko matches

Next.

sudo grep -r -i astra /lib/modules

output:

Binary file /lib/modules/4.15.3-1-generic/kernel/ubuntu/xr-usb-serial/xr_usb_serial_common.ko matches
Binary file /lib/modules/4.15.3-1-generic/kernel/drivers/isdn/hardware/eicon/diva_mnt.ko matches
Binary file /lib/modules/4.15.3-1-generic/kernel/drivers/usb/class/cdc-acm.ko matches
Binary file /lib/modules/4.15.3-1-generic/misc/parsec-cifs.ko matches
Binary file /lib/modules/4.15.3-1-hardened/kernel/ubuntu/xr-usb-serial/xr_usb_serial_common.ko matches
Binary file /lib/modules/4.15.3-1-hardened/kernel/drivers/isdn/hardware/eicon/diva_mnt.ko matches
Binary file /lib/modules/4.15.3-1-hardened/kernel/drivers/usb/class/cdc-acm.ko matches
Binary file /lib/modules/4.15.3-1-hardened/misc/parsec-cifs.ko matches

parsec[edit]

sudo modinfo parsec

output:

filename:       /lib/modules/4.15.3-1-hardened/misc/parsec.ko
license:        RusBiTech (c)
srcversion:     B52B5902B8DE1A3B73F51E0
depends:        
retpoline:      Y
name:           parsec
vermagic:       4.15.3-1-hardened SMP mod_unload modversions 
parm:           max_ilev:Maximal integrity level (uint)
parm:           reset_ilev_on_chroot:Reset Label on chroot()/pivot_root() (bool)
parm:           noload_files:Reject load modules at low integrity level (bool)
parm:           ccnr_reject:Disallow root to set CCNR* flags (bool)
parm:           ccnr_relax:CCNR relax (bool)
parm:           enable_exec_on_fuse:Enable to execute files from FUSE (bool)

parsec-cifs[edit]

sudo modinfo parsec-cifs

output

filename:       /lib/modules/4.15.3-1-hardened/misc/parsec-cifs.ko
softdep:        pre: ccm
softdep:        pre: aead2
softdep:        pre: sha256
softdep:        pre: cmac
softdep:        pre: aes
softdep:        pre: nls
softdep:        pre: md5
softdep:        pre: md4
softdep:        pre: hmac
softdep:        pre: ecb
softdep:        pre: des
softdep:        pre: arc4
softdep:        pre: parsec
version:        2.10
description:    VFS to access servers complying with the SNIA CIFS Specification e.g. Samba and Windows
license:        GPL
author:         Steve French <sfrench@us.ibm.com>
alias:          fs-cifs
srcversion:     013CF28D0310D01121F08C9
depends:        fscache,parsec
retpoline:      Y
name:           parsec_cifs
vermagic:       4.15.3-1-hardened SMP mod_unload modversions 
parm:           CIFSMaxBufSize:Network buffer size (not including header). Default: 16384 Range: 8192 to 130048 (uint)
parm:           cifs_min_rcv:Network buffers in pool. Default: 4 Range: 1 to 64 (uint)
parm:           cifs_min_small:Small network buffers in pool. Default: 30 Range: 2 to 256 (uint)
parm:           cifs_max_pending:Simultaneous requests to server. Default: 32767 Range: 2 to 32767. (uint)
parm:           enable_oplocks:Enable or disable oplocks. Default: y/Y/1 (bool)

digsig_verif[edit]

sudo modinfo digsig_verif

output:

filename:       /lib/modules/4.15.3-1-hardened/misc/digsig_verif.ko
author:         DIGSIG Team. Rusbitech support@rusbitech.ru
description:    Distributed Security Infrastructure Module
license:        GPL
srcversion:     CCFE23AF0D192900B8313F3
depends:        
retpoline:      Y
name:           digsig_verif
vermagic:       4.15.3-1-hardened SMP mod_unload modversions 
parm:           dsi_cache_buckets:Number of cache buckets for signatures validations.
 (int)
parm:           elf_mode:Enforce Digsig restriction for elf (2=debug).
 (int)
parm:           xattr_mode:Enforce Digsig restriction for xattr (2=debug).
 (int)
parm:           ignore_xattr_keys:Ignore XATTR user keys.
 (int)
parm:           ignore_i_mode:Ignore files if (inode i_mode & ignore_i_mode).
 (int)
parm:           ignore_gost2001:Ignore obsolete GOST R34.10-2001 signatures
 (int)

lsmod[edit]

root@astra:~# lsmod
Module                  Size  Used by
bluetooth             360448  2
ecdh_generic           24576  1 bluetooth
intel_rapl             20480  0
crct10dif_pclmul       16384  0
crc32_pclmul           16384  0
ghash_clmulni_intel    16384  0
pcbc                   16384  0
aesni_intel           188416  0
aes_x86_64             20480  1 aesni_intel
crypto_simd            16384  1 aesni_intel
glue_helper            16384  1 aesni_intel
cryptd                 24576  3 crypto_simd,ghash_clmulni_intel,aesni_intel
intel_rapl_perf        16384  0
joydev                 20480  0
input_leds             16384  0
serio_raw              16384  0
mac_hid                16384  0
parport_pc             32768  0
binfmt_misc            16384  1
ppdev                  20480  0
lp                     20480  0
parport                49152  3 parport_pc,lp,ppdev
ip_tables              28672  0
x_tables               40960  1 ip_tables
autofs4                36864  3
hid_generic            16384  0
usbhid                 49152  0
hid                   118784  2 usbhid,hid_generic
psmouse               131072  0
floppy                 77824  0
i2c_piix4              20480  0
pata_acpi              16384  0
parsec                159744  2
digsig_verif          491520  0

systemctl list-units[edit]

root@astra:~# systemctl --no-pager list-units
UNIT                                              LOAD   ACTIVE SUB       DESCRIPTION                                                       
parsecfs.automount                                loaded active running   Automount PARSEC File System                                      
proc-sys-fs-binfmt_misc.automount                 loaded active running   Arbitrary Executable File Formats File System Automount Point     
sys-devices-platform-serial8250-tty-ttyS0.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS0                        
sys-devices-platform-serial8250-tty-ttyS1.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS1                        
sys-devices-platform-serial8250-tty-ttyS10.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS10                       
sys-devices-platform-serial8250-tty-ttyS11.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS11                       
sys-devices-platform-serial8250-tty-ttyS12.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS12                       
sys-devices-platform-serial8250-tty-ttyS13.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS13                       
sys-devices-platform-serial8250-tty-ttyS14.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS14                       
sys-devices-platform-serial8250-tty-ttyS15.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS15                       
sys-devices-platform-serial8250-tty-ttyS16.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS16                       
sys-devices-platform-serial8250-tty-ttyS17.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS17                       
sys-devices-platform-serial8250-tty-ttyS18.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS18                       
sys-devices-platform-serial8250-tty-ttyS19.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS19                       
sys-devices-platform-serial8250-tty-ttyS2.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS2                        
sys-devices-platform-serial8250-tty-ttyS20.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS20                       
sys-devices-platform-serial8250-tty-ttyS21.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS21                       
sys-devices-platform-serial8250-tty-ttyS22.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS22                       
sys-devices-platform-serial8250-tty-ttyS23.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS23                       
sys-devices-platform-serial8250-tty-ttyS24.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS24                       
sys-devices-platform-serial8250-tty-ttyS25.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS25                       
sys-devices-platform-serial8250-tty-ttyS26.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS26                       
sys-devices-platform-serial8250-tty-ttyS27.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS27                       
sys-devices-platform-serial8250-tty-ttyS28.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS28                       
sys-devices-platform-serial8250-tty-ttyS29.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS29                       
sys-devices-platform-serial8250-tty-ttyS3.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS3                        
sys-devices-platform-serial8250-tty-ttyS30.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS30                       
sys-devices-platform-serial8250-tty-ttyS31.device loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS31                       
sys-devices-platform-serial8250-tty-ttyS4.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS4                        
sys-devices-platform-serial8250-tty-ttyS5.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS5                        
sys-devices-platform-serial8250-tty-ttyS6.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS6                        
sys-devices-platform-serial8250-tty-ttyS7.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS7                        
sys-devices-platform-serial8250-tty-ttyS8.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS8                        
sys-devices-platform-serial8250-tty-ttyS9.device  loaded active plugged   /sys/devices/platform/serial8250/tty/ttyS9                        
sys-devices-vbd\x2d51712-block-xvda-xvda1.device  loaded active plugged   /sys/devices/vbd-51712/block/xvda/xvda1                           
sys-devices-vbd\x2d51712-block-xvda-xvda2.device  loaded active plugged   /sys/devices/vbd-51712/block/xvda/xvda2                           
sys-devices-vbd\x2d51712-block-xvda-xvda5.device  loaded active plugged   /sys/devices/vbd-51712/block/xvda/xvda5                           
sys-devices-vbd\x2d51712-block-xvda.device        loaded active plugged   /sys/devices/vbd-51712/block/xvda                                 
sys-devices-vbd\x2d51728-block-xvdb.device        loaded active plugged   /sys/devices/vbd-51728/block/xvdb                                 
sys-devices-vbd\x2d51744-block-xvdc.device        loaded active plugged   /sys/devices/vbd-51744/block/xvdc                                 
sys-devices-vif\x2d0-net-eth0.device              loaded active plugged   /sys/devices/vif-0/net/eth0                                       
sys-devices-virtual-misc-rfkill.device            loaded active plugged   /sys/devices/virtual/misc/rfkill                                  
sys-devices-virtual-tty-hvc0.device               loaded active plugged   /sys/devices/virtual/tty/hvc0                                     
sys-devices-virtual-tty-hvc1.device               loaded active plugged   /sys/devices/virtual/tty/hvc1                                     
sys-devices-virtual-tty-hvc2.device               loaded active plugged   /sys/devices/virtual/tty/hvc2                                     
sys-devices-virtual-tty-hvc3.device               loaded active plugged   /sys/devices/virtual/tty/hvc3                                     
sys-devices-virtual-tty-hvc4.device               loaded active plugged   /sys/devices/virtual/tty/hvc4                                     
sys-devices-virtual-tty-hvc5.device               loaded active plugged   /sys/devices/virtual/tty/hvc5                                     
sys-devices-virtual-tty-hvc6.device               loaded active plugged   /sys/devices/virtual/tty/hvc6                                     
sys-devices-virtual-tty-hvc7.device               loaded active plugged   /sys/devices/virtual/tty/hvc7                                     
sys-devices-virtual-tty-ttyprintk.device          loaded active plugged   /sys/devices/virtual/tty/ttyprintk                                
sys-module-configfs.device                        loaded active plugged   /sys/module/configfs                                              
sys-module-fuse.device                            loaded active plugged   /sys/module/fuse                                                  
sys-subsystem-net-devices-eth0.device             loaded active plugged   /sys/subsystem/net/devices/eth0                                   
-.mount                                           loaded active mounted   Root Mount                                                        
dev-mqueue.mount                                  loaded active mounted   POSIX Message Queue File System                                   
parsecfs.mount                                    loaded active mounted   PARSEC File System                                                
proc-sys-fs-binfmt_misc.mount                     loaded active mounted   Arbitrary Executable File Formats File System                     
run-user-1000.mount                               loaded active mounted   /run/user/1000                                                    
sys-fs-fuse-connections.mount                     loaded active mounted   FUSE Control File System                                          
sys-kernel-config.mount                           loaded active mounted   Configuration File System                                         
sys-kernel-debug.mount                            loaded active mounted   Debug File System                                                 
acpid.path                                        loaded active running   ACPI Events Check                                                 
cups.path                                         loaded active running   CUPS Scheduler                                                    
systemd-ask-password-plymouth.path                loaded active waiting   Forward Password Requests to Plymouth Directory Watch             
systemd-ask-password-wall.path                    loaded active waiting   Forward Password Requests to Wall Directory Watch                 
init.scope                                        loaded active running   System and Service Manager                                        
session-2.scope                                   loaded active running   Session 2 of user user                                            
session-5.scope                                   loaded active running   Session 5 of user user                                            
acpi-support.service                              loaded active exited    LSB: Start some power management scripts                          
acpid.service                                     loaded active running   ACPI event daemon                                                 
avahi-daemon.service                              loaded active running   Avahi mDNS/DNS-SD Stack                                           
console-setup.service                             loaded active exited    Set console font and keymap                                       
cron.service                                      loaded active running   Regular background program processing daemon                      
cups.service                                      loaded active running   CUPS Scheduler                                                    
dbus.service                                      loaded active running   D-Bus System Message Bus                                          
fly-dm.service                                    loaded active running   The FLY login manager                                             
getty@tty1.service                                loaded active running   Getty on tty1                                                     
keyboard-setup.service                            loaded active exited    Set the console keyboard layout                                   
kmod-static-nodes.service                         loaded active exited    Create list of required static device nodes for the current kernel
libflygetexe-bin.service                          loaded active running   The FLY get exec service                                          
networking.service                                loaded active exited    Raise network interfaces                                          
NetworkManager-wait-online.service                loaded active exited    Network Manager Wait Online                                       
NetworkManager.service                            loaded active running   Network Manager                                                   
nscd.service                                      loaded active running   Name Service Cache Daemon                                         
nslcd.service                                     loaded active running   LSB: LDAP connection daemon                                       
ofono.service                                     loaded active running   oFono Mobile telephony stack                                      
parlogd.service                                   loaded active running   PARSec events logging daemon                                      
parsec.service                                    loaded active exited    Intitialize Parsec Subsystem                                      
polkit.service                                    loaded active running   Authorization Manager                                             
quota.service                                     loaded active exited    Initial Check File System Quotas                                  
rpcbind.service                                   loaded active running   RPC bind portmap service                                          
rsyslog.service                                   loaded active running   System Logging Service                                            
serial-getty@hvc0.service                         loaded active running   Serial Getty on hvc0                                              
ssh.service                                       loaded active running   OpenBSD Secure Shell server                                       
swap-wiper.service                                loaded active exited    Swap Wiper                                                        
systemd-binfmt.service                            loaded active exited    Set Up Additional Binary Formats                                  
systemd-journal-flush.service                     loaded active exited    Flush Journal to Persistent Storage                               
systemd-journald.service                          loaded active running   Journal Service                                                   
systemd-logind.service                            loaded active running   Login Service                                                     
systemd-modules-load.service                      loaded active exited    Load Kernel Modules                                               
systemd-random-seed.service                       loaded active exited    Load/Save Random Seed                                             
systemd-remount-fs.service                        loaded active exited    Remount Root and Kernel File Systems                              
systemd-sysctl.service                            loaded active exited    Apply Kernel Variables                                            
systemd-tmpfiles-setup-dev.service                loaded active exited    Create Static Device Nodes in /dev                                
systemd-tmpfiles-setup.service                    loaded active exited    Create Volatile Files and Directories                             
systemd-udev-trigger.service                      loaded active exited    udev Coldplug all Devices                                         
systemd-udevd.service                             loaded active running   udev Kernel Device Manager                                        
systemd-update-utmp.service                       loaded active exited    Update UTMP about System Boot/Shutdown                            
systemd-user-sessions.service                     loaded active exited    Permit User Sessions                                              
udisks2.service                                   loaded active running   Disk Manager                                                      
ufw.service                                       loaded active exited    Uncomplicated firewall                                            
upower.service                                    loaded active running   Daemon for power management                                       
user@1000.service                                 loaded active running   User Manager for UID 1000                                         
-.slice                                           loaded active active    Root Slice                                                        
system-getty.slice                                loaded active active    system-getty.slice                                                
system-serial\x2dgetty.slice                      loaded active active    system-serial\x2dgetty.slice                                      
system.slice                                      loaded active active    System Slice                                                      
user-1000.slice                                   loaded active active    User Slice of user                                                
user.slice                                        loaded active active    User and Session Slice                                            
acpid.socket                                      loaded active running   ACPID Listen Socket                                               
avahi-daemon.socket                               loaded active running   Avahi mDNS/DNS-SD Stack Activation Socket                         
cups.socket                                       loaded active running   CUPS Scheduler                                                    
dbus.socket                                       loaded active running   D-Bus System Message Bus Socket                                   
gpsd.socket                                       loaded active listening GPS (Global Positioning System) Daemon Sockets                    
rpcbind.socket                                    loaded active running   RPCbind Server Activation Socket                                  
syslog.socket                                     loaded active running   Syslog Socket                                                     
systemd-fsckd.socket                              loaded active listening fsck to fsckd communication Socket                                
systemd-initctl.socket                            loaded active listening /dev/initctl Compatibility Named Pipe                             
systemd-journald-audit.socket                     loaded active running   Journal Audit Socket                                              
systemd-journald-dev-log.socket                   loaded active running   Journal Socket (/dev/log)                                         
systemd-journald.socket                           loaded active running   Journal Socket                                                    
systemd-rfkill.socket                             loaded active listening Load/Save RF Kill Switch Status /dev/rfkill Watch                 
systemd-udevd-control.socket                      loaded active running   udev Control Socket                                               
systemd-udevd-kernel.socket                       loaded active running   udev Kernel Socket                                                
basic.target                                      loaded active active    Basic System                                                      
cryptsetup.target                                 loaded active active    Encrypted Volumes                                                 
getty.target                                      loaded active active    Login Prompts                                                     
graphical.target                                  loaded active active    Graphical Interface                                               
local-fs-pre.target                               loaded active active    Local File Systems (Pre)                                          
local-fs.target                                   loaded active active    Local File Systems                                                
multi-user.target                                 loaded active active    Multi-User System                                                 
network-online.target                             loaded active active    Network is Online                                                 
network.target                                    loaded active active    Network                                                           
paths.target                                      loaded active active    Paths                                                             
remote-fs-pre.target                              loaded active active    Remote File Systems (Pre)                                         
remote-fs.target                                  loaded active active    Remote File Systems                                               
rpcbind.target                                    loaded active active    RPC Port Mapper                                                   
slices.target                                     loaded active active    Slices                                                            
sockets.target                                    loaded active active    Sockets                                                           
sysinit.target                                    loaded active active    System Initialization                                             
time-sync.target                                  loaded active active    System Time Synchronized                                          
timers.target                                     loaded active active    Timers                                                            
anacron.timer                                     loaded active waiting   Trigger anacron every hour                                        
apt-daily-upgrade.timer                           loaded active waiting   Daily apt upgrade and clean activities                            
apt-daily.timer                                   loaded active waiting   Daily apt download activities                                     
systemd-tmpfiles-clean.timer                      loaded active waiting   Daily Cleanup of Temporary Directories                            

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.

157 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.

Mandatory Access Control MAC[edit]

AppArmor[edit]

AppArmor apparently not installed.

root@astra:~# aa-status
bash: aa-status: command not found

root@astra:~# which aa-status
root@astra:~# 

root@astra:~# dpkg -l | grep apparmor
ii  libapparmor1:amd64                            2.11.0-3+deb9u2                       amd64        changehat AppArmor library
root@astra:~# 

SELinux[edit]

SELinux apparently not installed.

root@astra:~# semanage
bash: semanage: command not found
root@astra:~# 

Next.

root@astra:~# dpkg -l | grep selinux
ii  libselinux1:amd64                             2.6-3                                 amd64        SELinux runtime shared libraries

Smack[edit]

Smack apparently not installed.

user@astra:~$ dpkg -l | grep -i smack
user@astra:~$ 
root@astra:~# smackload 
bash: smackload: command not found

tomoyo[edit]

Tomoyo apparently not installed.

root@astra:~# dpkg -l | grep tomoyo
root@astra:~# 
root@astra:~# /usr/sbin/tomoyo-auditd
bash: /usr/sbin/tomoyo-auditd: No such file or directory
root@astra:~# 

firejail[edit]

Installed.

dpkg -l | grep firejail
ii  firejail                                      0.9.44.8-2                            amd64        sandbox to restrict the application environment

bubblewrap[edit]

Not installed.

root@astra:~# dpkg -l | grep bubblewrap
root@astra:~# 

Other Mandatory Access Control MAC installed?[edit]

?

sudoers[edit]

It edits /etc/sudoers instead of dropping snippets into /etc/sudoers.d for enabling passwordless sudo. This is not following practices. When sudo package is updated and /etc/sudoers changed by upstream, it will show an dpkg interactive conflict resolution dialog. And even if astra linux forked the package and prevents this, this results in them carrying the maintenance load of that diff.

wormhole installation hint[edit]

sudo apt install python-pip

sudo pip install magic-wormhole

wormhole send /path/to/filename

Number of Developers[edit]

Unknown. Trying to guess. Looking at cat /var/lib/dpkg/status | grep @rusbitech | sort --unique showing 20 different full names.

Questions[edit]

  • How can I ELF sign binaries?
  • Can Astra Special Edition be updated through an online APT repository?

Footnotes[edit]



Search engines: YaCy | Qwant | ecosia | MetaGer | peekier


Follow: Twitter.png Facebook.png 1280px-Gab text logo.svg.png Iconfinder news 18421.png Rss.png Matrix logo.svg.png 1024px-Telegram 2019 Logo.svg.png Discourse logo.svg Reddit.jpg Diaspora.png Gnusocial.png Mewe.png 500px-Tumblr Wordmark.svg.png Iconfinder youtube 317714.png 200px-Minds logo.svg.png 200px-Mastodon Logotype (Simple).svg.png 200px-LinkedIn Logo 2013.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate whonix.png United Federation of Planets 1000px.png

Share: Twitter | Facebook

Want to make Whonix safer and more usable? We're looking for helping hands. Check out the Open Issues [archive] and development forum [archive].

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.