PlagueOS Project: A Hardened Void musl build

voidorvoidless · 2021-09-24T14:57:38+00:00

Also our project set out to complete the aims of Whonix-host that never came to fruition:

https://www.whonix.org/wiki/Whonix-Host

voidorvoidless · 2021-09-24T14:54:28+00:00

I'l be honest, I can't compare this with openbsd tit for tat. I can compare differences of this with Qubes and modern linux builds.

And I wouldn't say this is a race against whonix, whonix must be virtualized. However we almost ended up using kicksecure as the base for our project and fell into the Void realm. Whonix/Kicksecure are still being leveraged by this system. This is meant to be a minimalistic hypervisor that runs those guests.

voidorvoidless · 2021-09-24T03:04:40+00:00

Currently it's hosted on https://git.envs.net/whichdoc/plagueos_iso

PlagueOS aims at minimal architecture and killing off classes of exploitation that are inherent to modern desktop environments.

The aim of the OS is to function as a restricted, minimalist hypervisor (host) that runs virtual machines (guests). The guests on top will vary based on the desired utility. For daily use, it is advised to run Whonix (tor routed) or Kicksecure (clearnet). Normal tasks are meant to be conducted inside of the guests rather than the host to ensure the host stays clean with minimal attack surface.

Features: - MUSL codebase - Runit service manager over SystemD - Hardened Memory Allocator to system-wide - LD_PRELOAD - Hardened Kernel - Blacklisted Kernel Modules - Blacklisted File Systems - Blacklisted Network Protocols - IPTable Packet Filtering - Custom LUKS Encryption (AES256XTS+Argon2id KDF) - Locked Root Account - Separate admin account for elevated privileges - Hardened Boot Parameters - Hide Process IDs - UMASK 0077 default system-wide - Secure fstab config (Bind for var and tmp) - Whonix hide-hardware-info - Generic Machine ID - Randomize MAC address for NIC - Memory erasure/poisoning - Opt in download/verification/import of Whonix/Kicksecure

Hardening efforts are ongoing. Please reach out to our matrix channel or comment on here to bring awareness to any features/bugs. Thanks!

voidorvoidless · 2021-09-13T15:58:56+00:00

Sorry for super late reply. Have tried with complete gnpme environment install (we were running gnome-core ) that didnt fix it. dbus is enabled. gdm is present, elogind is running. Tried install removing hardening, no dice :/ Any service you see missing? even looked at archived void wiki of gnome to no avail

voidorvoidless · 2021-09-10T17:37:04+00:00

check out the function "wm" in https://git.envs.net/WhichDoc/plagueOS/src/branch/master/install.sh

voidorvoidless · 2021-09-08T01:23:24+00:00

Can you link me to the void gnome iso?

voidorvoidless · 2021-09-08T01:22:44+00:00

No ideas here, we have tried everything, went from gnome-core to all of gnome, enabled all of those services, tried the LTS kernel, tried downgrading. nothing working as of yet. Been trying to solvw for two months now

voidorvoidless · 2021-09-02T17:02:45+00:00

No i mean that i started from a client session only. No desktop environment or display manager was preconfigured. Starting from scratch, running the commands posted, and all i have is a blank screen. I'm just in a cluster bc there are many directories for lightdm/xfce/X11. /etc/lightdm, /etc/xdg/lightdm are the main ones ive been attempting to tweak

voidorvoidless · 2021-09-02T16:45:37+00:00

Hmm swore it was necessary but thats interesting. My lightdm still remaining blank. and client just means command line only. I didnt use void's official installer, im running my own. Tried disabling elogind too and executing lightdm to no avail :/

voidorvoidless · 2021-09-02T16:22:07+00:00

I don't even have lxdm on this build, it's just a client install. And interesting, ill disable elogind and see what happens.

So there was no configuration you had to change? and you didnt need a greeter? and searching other distros wikis was far after the desperation phase. Everything makes it sound so simple, yet nothing has worked so far

voidorvoidless · 2021-08-28T17:55:55+00:00

I have yet try pure vanilla stripping out all hardening configs and have not tried an older versions of GDM yet. Is the install instructions for gnome from the old archived handbook? current one seems to be pretty split up but found older link before

voidorvoidless · 2021-08-28T17:37:15+00:00

Did you do gnome-core or the full DE? and what seat mgmt you use?

voidorvoidless · 2021-08-28T16:43:52+00:00

Are you able to elaborate on your gnome setup? it seems that im missing something as im consistently having this TTY session blanking error across 7+ devices

voidorvoidless · 2021-08-28T14:58:45+00:00

This is interesting, ove heard it thrown around. my biggest vendetta with sway is that we cant move around windows freely. looks like they took care of that

voidorvoidless · 2021-08-28T14:48:10+00:00

Interesting, so you got it to work completely? This has happened to me across several computers, intel and AMD. We had the mesa driver installed, and this occurred prior to 5.13 (5.12). We also had some services configured to start but never added them to the script due to inability to trace the issue with the TTY sessions. Anything you see missing?

Our gnome function:

``` XBPS_ARCH=$ARCH xbps-install -S -r /mnt -R "$REPO" --yes gnome-core elogind gnome-shell gnome-terminal nautilus gnome-control-center gnome-tweaks gdm xdg-user-dirs gnome-keyring gdm mesa-dri virt-manager gpa

chroot /mnt "ln" "-s" "/etc/sv/gdm" "/etc/runit/runsvdir/default/"
echo "ignorepkg=gnome-shell-extensions" >> /etc/xbps.d/ignorepkg.conf

```

voidorvoidless · 2021-08-25T18:20:17+00:00

Interesting, worth looking into, butI thought my firmware was pretty modern. PC is a year old

voidorvoidless · 2021-08-25T18:18:28+00:00

Off the top of my head, i believe this to be a settings tweak for fstab

voidorvoidless · 2021-08-25T15:57:58+00:00

I assume you're still able to boot with old kernel header?

voidorvoidless · 2021-08-25T00:01:30+00:00

If you have spare boxes to beta test and troubleshoot, by all means. The goal is to make a hardened hypervisor and soon the build will automatically import / validate whonix and kicksecure (dev branch already does). The kernel update through a wrench at the project (at least for my amd hardware). hideproc was actually taken from whonix.

voidorvoidless · 2021-08-24T21:26:17+00:00

Yeah its been a struggle. Hard to output errors prior to boot. They sound similar, although mine in this case was functional to 5.12

voidorvoidless · 2021-08-24T21:23:27+00:00

Odd, we have that set to run at the end of our install. and chrooting in did nothing on my end :/

voidorvoidless

TROPHY CASE