Repository navigation
docs+ui: disambiguate the two attack-surface controls - #31
Merged
Merged
Conversation
OptimizeLinuxASR.sh and the built-in attack_surface step were both presented as 'Attack Surface Reduction', which reads as duplicated functionality. They are not: the script stops/masks daemons and writes no config; the step writes kernel/config hardening and stops no service. - Renamed UI surfaces to 'ASR: disable unneeded services' and 'ASR: kernel + config hardening', and the stale 'network/disk tweaks' preview now says what the script actually does. - Main menu option 9 now points at the built-in step for kernel/config hardening, so the two paths are discoverable from one screen. - README documents the split in a table and records the squashfs/snap ordering interaction: disabling snapd first means a later attack_surface run blacklists squashfs, which breaks live media and squashfs images.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Answering the question of whether
OptimizeLinuxASR.shand the built-inattack_surfacestep should be merged: they should not be merged, because they do not actually overlap. They were only labelled as if they did.What each one actually does
OptimizeLinuxASR.sh(195 lines)attack_surfacestepsystemctl stop/disable/maskper daemon/etc/modprobe.d,sshd_config,login.defs,limits.confOptimizeLinuxASR.shremoves running software (rpcbind, samba, ftp, telnet, snapd...). The step hardens the kernel and config surface. Neither substitutes for the other.Merging them would mean one script that both mass-disables daemons and rewrites sshd/login config. Those are different risk models with different rollback paths, and the config half would lose the per-file backup and rollback-log treatment it currently gets.
What this PR does instead
ASR: disable unneeded servicesandASR: kernel + config hardening, so they stop reading as duplicates.--step attack_surfacefor kernel/config hardening, making both paths discoverable from one screen.squashfscarve-out keys off a snap runtime being present, so disablingsnapdvia ASR first means a laterattack_surfacerun blacklistssquashfs— which breaks live media and squashfs images.Validation: bash -n clean; all 9
attack_surface/harden_sysctlinvariants re-verified after the edits.