Stable Features[edit]

Testing Features[edit]

Reduce Kernel Information Leaks[edit]

Security Impact: There are many of hardware, kernel, debug information, etc. in /sys, which is especially problematic and has been the cause of many infoleaks such as kernel pointer leaks.
Privacy/Anonymity Impact: Details about your hardware can be used for identification.
Threat: This information is per Debian (and probably most popular Linux distributions) available to attackers with local code execution privileges which includes,
- malicious applications collecting such information and submitting it to data collectors,
- as well as both, compromised non-privileged users and the privileged root user.
Non-Threat: This information does not randomly leak to third parties on clean (non-compromised) machines through use of legitimate applications such as the APT package manager.
Goal: This information should by default be unavailable to non-privileged users and untrusted root.
Solution: Therefore security-misc includes the hide-hardware-info.service systemd unit.
- Restricts access to /sys, /proc/cpuinfo, /proc/bus, and /proc/scsi to the root user only.
- This also hides most hardware identifiers.
Status: This setting is disabled by default because it might break many applications. Testers-only! Call for testers and forum discussion: Restrict Hardware Information to Root - Testers Wanted! ^[archive]
Enable: It can optionally be enabled by running the following command.
- ```
sudo systemctl enable hide-hardware-info.service
```
  sudo systemctl enable hide-hardware-info.service
- Reboot required.
- A whitelist that allows specific applications to access /sys and /proc/cpuinfo is enabled by default to maintain basic functionality. ^[1] For example, this allows the launching of applications like XFCE.
Limitations of Solution:
- Attackers which gained root compromise and/or malicious/compromised whitelisted applications have access to this information.
- Cannot hide CPUID ^[archive]. ^[2]
Possible Future Enhancements: untrusted root

Whitelisting Applications[edit]

To whitelist applications, they must be run under the sysfs group (if allowing access to /sys) and/or the cpuinfo group (if allowing access to /proc/cpuinfo).

Remember that any whitelisted applications add to the attack surface. An attacker can attempt to exploit a vulnerability in the whitelisted application(s) to gain access to hardware information.

addgroup method[edit]

For example, to add user user to group cpuinfo, run the following command. (Note, this is weakening protections.)

sudo addgroup user cpuinfo

sudo addgroup user cpuinfo

For example, to add user user to group sysfs, run the following command. (Note, this is weakening protections.)

sudo addgroup user sysfs

sudo addgroup user sysfs

Re-login required after changing groups. Easiest: reboot. ^[3] ^[4]

For example, after reboot it would be possible to run the cpu-info utility (from Debian package cpuinfo).

cpu-info

cpu-info

systemd[edit]

For example, to run a systemd service as the sysfs group, create a drop-in directory and add the following.

[Service]
SupplementaryGroups=sysfs

[Service]
SupplementaryGroups=sysfs

setgid method[edit]

To run a specific binary as the sysfs group, the binary must be owned by the sysfs group and be made setgid. To achieve this, change the ownership of the binary by running the following.

sudo chgrp sysfs /path/to/binary

sudo chgrp sysfs /path/to/binary

Then make the binary setgid.

sudo chmod g+s /path/to/binary

sudo chmod g+s /path/to/binary

The binary will now run with the permissions of the sysfs group and have access to /sys.

All of these steps can also be applied to the cpuinfo group.

Disable the Whitelist[edit]

In order to reduce the attack surface as much as possible, optionally the whitelist can be disabled entirely.

Warning:

Note that this setting will break many applications; for example, the desktop environment will not even start. Do not perform this action unless you understand the implications and can reverse the change.

1. Open file /etc/hide-hardware-info.d/50_user.conf in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security ^[archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/hide-hardware-info.d/50_user.conf

sudoedit /etc/hide-hardware-info.d/50_user.conf

2. Add.

sysfs_whitelist=0
cpuinfo_whitelist=0

sysfs_whitelist=0
cpuinfo_whitelist=0

3. Save.

4. Done.

SUID Disabler and Permission Hardener[edit]

See SUID Disabler and Permission Hardener.

hidepid[edit]

TODO: document

sudo systemctl enable proc-hidepid.service

Experimental Features[edit]

Unreleased. (Developers only.) Will flow into other repositories as per usual.

Remount Secure[edit]

Feature not ready!

sudo touch /etc/noexec

sudo touch /etc/noexec

Installation of security-misc[edit]

This chapter is only required for users which aren't users of Whonix or Kicksecure. That is because security-misc is installed by default in Whonix and Kicksecure.

Prerequisites:

1. Confirm prerequisites are met.

Debian bullseye is installed.
User account user exists.

2. Become root. ^[5]

su

su

3. Install sudo and adduser packages.

1. Update the package lists.

apt-get update

apt-get update

2. Upgrade the system.

apt-get dist-upgrade

apt-get dist-upgrade

3. Install sudo and adduser packages.

apt-get install --no-install-recommends sudo adduser

apt-get install --no-install-recommends sudo adduser

4. Set user rights.

The following commands must be run either by root or using sudo. ^[6]

Create group console.

/usr/sbin/addgroup --system console

/usr/sbin/addgroup --system console

Add user user to group console.

/usr/sbin/adduser user console

/usr/sbin/adduser user console

Add user user to group sudo.

/usr/sbin/adduser user sudo

/usr/sbin/adduser user sudo

5. Reboot.

/sbin/reboot

/sbin/reboot

Add Whonix ™ Repository.

Choose either: Option A, Option B OR Option C.

Option A: Add Whonix ™ Onion Repository.

To add Whonix ™ Repository over Onion please press on expand on the right.

Install apt-transport-tor from the Debian repository.

sudo apt-get install apt-transport-tor

sudo apt-get install apt-transport-tor

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was bullseye.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option B: Add Whonix ™ Clearnet Repository over Tor.

To add Whonix ™ Repository over torified clearnet please press on expand on the right.

Install apt-transport-tor from the Debian repository.

sudo apt-get install apt-transport-tor

sudo apt-get install apt-transport-tor

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was bullseye.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.whonix.org bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.whonix.org bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option C: Add Whonix Clearnet Repository over clearnet.

To add Whonix ™ Repository over clearnet please press on expand on the right.

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was bullseye.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.whonix.org bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.whonix.org bullseye main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Install security-misc.

1. Update the package lists.

sudo apt-get update

sudo apt-get update

2. Upgrade the system.

sudo apt-get dist-upgrade

sudo apt-get dist-upgrade

3. Install the security-misc package.

Using apt-get command line parameter --no-install-recommends is in most cases optional.

sudo apt-get install --no-install-recommends security-misc

sudo apt-get install --no-install-recommends security-misc

The procedure of installing security-misc is complete.

selinux[edit]

Community Support Only!:
	`Community Support Only` means Whonix ™ developers are unlikely to provide free support for wiki chapters or pages with this tag. See Community Support for further information, including implications and possible alternatives.

References[edit]

↑ https://gitlab.com/whonix/security-misc/-/blob/master/lib/systemd/system/user@.service.d/sysfs.conf ^[archive]
↑
- https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/26 ^[archive]
- https://security.stackexchange.com/questions/220357/fake-output-of-cpuid-instruction ^[archive]
↑
No reboot required: Use the execute command as different group ID command line utility sg to execute the cpu-info (from Debian package cpuinfo) application under group cpuinfo.
```
sg cpuinfo cpu-info
```
sg cpuinfo cpu-info
↑
Also no reboot required:
```
sudo -u user bash
```
sudo -u user bash
```
cpu-info
```
cpu-info
Or.
```
sudo -u user cpu-info
```
sudo -u user cpu-info
↑ Other methods are possible.
↑
It is necessary to use the full path to addgroup, adduser and reboot because when using su the PATH environment variable is not adjusted for use with root rights. See echo "$PATH". user rights PATH:
```
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
```
root rights PATH:
```
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
```
When using sudo using /full/path/to/application is not required.