feat: add additional chromium policy hardening and drop chkrootkit as its false positives make it low-utility

config/common/common-packages.yml

@@ -5,7 +5,6 @@ install:
   - lm_sensors
   - lynis
   - hardened_malloc
-  - chkrootkit
   - usbguard
   - usbguard-dbus
 

config/files/usr/etc/chromium/policies/managed/hardening.json

@@ -40,5 +40,8 @@
 	"CloudPrintSubmitEnabled": false,
 	"AutofillAddressEnabled": false,
 	"AutofillCreditCardEnabled": false,
-	"ImportSavedPasswords": false
+	"ImportSavedPasswords": false,
+	"DefaultWebUsbGuardSetting": 2,
+	"DefaultWebBluetoothGuardSetting": 2,
+	"DefaultSerialGuardSetting": 2
 }

config/files/usr/etc/chromium/policies/managed/hardening.json.readme.md

@@ -166,4 +166,16 @@
 
 **Do not import saved passwords on first run**
 
-`"ImportSavedPasswords": false`
+`"ImportSavedPasswords": false`
+
+**Disable WebUSB by default**
+
+`"DefaultWebUsbGuardSetting": 2`
+
+**Disable WebBluetooth by default**
+
+`"DefaultWebBluetoothGuardSetting": 2`
+
+**Disable serial port access by default**
+
+`"DefaultSerialGuardSetting": 2`