scottk/secureblue
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/secureblue.git synced 2025-11-03 20:07:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: remove all quotes from kargs for consistency

Browse Source
This commit is contained in:
RoyalOughtness
2024-10-30 20:58:19 -07:00
committed by GitHub
parent 88e6278591
commit 750d7bdd70
1 changed files with 24 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
files/system/usr/share/ublue-os/just/70-secureblue.just
View File

@@ -5,13 +5,13 @@ set-kargs-hardening:
if [[ "$YES" == [Yy]* ]]; then if [[ "$YES" == [Yy]* ]]; then
echo "Keeping 32-bit support." echo "Keeping 32-bit support."
else else
IAEMU_NO='--append-if-missing="ia32_emulation=0"' IAEMU_NO="--append-if-missing=ia32_emulation=0"
echo "Disabling 32-bit support, for the next boot." echo "Disabling 32-bit support, for the next boot."
fi fi
read -p "Would you like to set additional (unstable) hardening kargs? (Warning: Setting these kargs may lead to boot issues on some hardware.) [y/N]: " YES read -p "Would you like to set additional (unstable) hardening kargs? (Warning: Setting these kargs may lead to boot issues on some hardware.) [y/N]: " YES
if [[ "$YES" == [Yy]* ]]; then if [[ "$YES" == [Yy]* ]]; then
UNSTABLE_YES='--append-if-missing="efi=disable_early_pci_dma" \ UNSTABLE_YES="--append-if-missing=efi=disable_early_pci_dma \
--append-if-missing="debugfs=off"' --append-if-missing=debugfs=off"
echo "Setting unstable hardening kargs." echo "Setting unstable hardening kargs."
else else
echo "Not setting unstable hardening kargs." echo "Not setting unstable hardening kargs."
@@ -19,27 +19,27 @@ set-kargs-hardening:
echo "Applying boot parameters..." echo "Applying boot parameters..."
rpm-ostree kargs \ rpm-ostree kargs \
${UNSTABLE_YES:+$UNSTABLE_YES} ${IAEMU_NO:+$IAEMU_NO} \ ${UNSTABLE_YES:+$UNSTABLE_YES} ${IAEMU_NO:+$IAEMU_NO} \
--append-if-missing="init_on_alloc=1" \ --append-if-missing=init_on_alloc=1 \
--append-if-missing="init_on_free=1" \ --append-if-missing=init_on_free=1 \
--append-if-missing="slab_nomerge" \ --append-if-missing=slab_nomerge \
--append-if-missing="page_alloc.shuffle=1" \ --append-if-missing=page_alloc.shuffle=1 \
--append-if-missing="randomize_kstack_offset=on" \ --append-if-missing=randomize_kstack_offset=on \
--append-if-missing="vsyscall=none" \ --append-if-missing=vsyscall=none \
--append-if-missing="lockdown=confidentiality" \ --append-if-missing=lockdown=confidentiality \
--append-if-missing="random.trust_cpu=off" \ --append-if-missing=random.trust_cpu=off \
--append-if-missing="random.trust_bootloader=off" \ --append-if-missing=random.trust_bootloader=off \
--append-if-missing="iommu=force" \ --append-if-missing=iommu=force \
--append-if-missing="intel_iommu=on" \ --append-if-missing=intel_iommu=on \
--append-if-missing="amd_iommu=force_isolation" \ --append-if-missing=amd_iommu=force_isolation \
--append-if-missing="iommu.passthrough=0" \ --append-if-missing=iommu.passthrough=0 \
--append-if-missing="iommu.strict=1" \ --append-if-missing=iommu.strict=1 \
--append-if-missing="pti=on" \ --append-if-missing=pti=on \
--append-if-missing="module.sig_enforce=1" \ --append-if-missing=module.sig_enforce=1 \
--append-if-missing="mitigations=auto,nosmt" \ --append-if-missing=mitigations=auto,nosmt \
--append-if-missing="spectre_v2=on" \ --append-if-missing=spectre_v2=on \
--append-if-missing="spec_store_bypass_disable=on" \ --append-if-missing=spec_store_bypass_disable=on \
--append-if-missing="l1d_flush=on" \ --append-if-missing=l1d_flush=on \
--append-if-missing="gather_data_sampling=force" --append-if-missing=gather_data_sampling=force
echo "Hardening kargs applied." echo "Hardening kargs applied."
# Remove all hardening boot parameters (requires reboot) # Remove all hardening boot parameters (requires reboot)