diff --git a/README.md b/README.md index d637bd8..24e5617 100644 --- a/README.md +++ b/README.md @@ -29,11 +29,11 @@ The following are not in scope: - Installing and enabling [hardened_malloc](https://github.com/GrapheneOS/hardened_malloc) globally, including for flatpaks. [Thanks to rusty-snake's hardened_malloc spec](https://github.com/rusty-snake/fedora-extras) - Installing [hardened-chromium](https://github.com/secureblue/hardened-chromium), which is inspired by and incorporates patches from [Vanadium](https://github.com/GrapheneOS/Vanadium). [Why chromium?](https://grapheneos.org/usage#web-browsing) [Why not flatpak chromium?](https://forum.vivaldi.net/post/669805) -- Setting numerous hardened sysctl values [details](https://github.com/secureblue/secureblue/blob/live/files/system/usr/etc/sysctl.d/hardening.conf) +- Setting numerous hardened sysctl values [details](https://github.com/secureblue/secureblue/blob/live/files/system/etc/sysctl.d/hardening.conf) - Disabling coredumps in limits.conf - Disabling all ports and services for firewalld - Adds per-network MAC randomization -- Blacklisting numerous unused kernel modules to reduce attack surface [details](https://github.com/secureblue/secureblue/blob/live/files/system/usr/etc/modprobe.d/blacklist.conf) +- Blacklisting numerous unused kernel modules to reduce attack surface [details](https://github.com/secureblue/secureblue/blob/live/files/system/etc/modprobe.d/blacklist.conf) - Enabling only the [flathub-verified](https://flathub.org/apps/collection/verified/1) remote by default - Sets numerous hardening kernel arguments (Inspired by [Madaidan's Hardening Guide](https://madaidans-insecurities.github.io/guides/linux-hardening.html)) [details](https://github.com/secureblue/secureblue/blob/live/files/system/usr/share/ublue-os/just/60-custom.just.readme.md) - Reduce the sudo timeout to 1 minute