hardening-runtime (2) [PTS] [DDPO]

NEW: VCS has unreleased changes: 3 > 2

Git: https://salsa.debian.org/corsac/hardening-runtime.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: debian/master
Path: debian/changelog
Repo size: 81920
Browser: https://salsa.debian.org/corsac/hardening-runtime
Last scan: 2024-04-21 11:16:10+00
Next scan: 2024-04-30 10:02:00+00
Merge requests: 2

Debian changelog in Git:

hardening-runtime (3) UNRELEASED; urgency=medium

  [ Debian Janitor ]
  * Use set -e rather than passing -e on the shebang-line.
  * Bump debhelper from old 11 to 12.
  * Update standards version to 4.4.1, no changes needed.

  [ Topi Miettinen ]
  * Optionally use dpkg-statoverride to override package permissions

  [ Yves-Alexis Perez ]
  * sysctl: align to 80 cols
  * force kernel.unprivileged_userns_clone to 0
  * statoverrides: drop pam.d line breaking authentication (closes: #986358)
  * d/control: update standards version to 4.5.1

 -- Yves-Alexis Perez <corsac@debian.org>  Mon, 05 Apr 2021 11:07:36 +0200

This branch is 17 commits ahead of tag debian/2

Git log:

commit 50db6dc41e32c82d636179784386ddff6f6c6029
Merge: 2a37bb4 5ef560b
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Wed Sep 15 14:14:51 2021 +0000

    Merge branch 'debian/master' into 'debian/master'
    
    Update 10-hardening.conf
    
    See merge request corsac/hardening-runtime!5

commit 5ef560bccf291519e00942f5bef481e9be74eae8
Author: Unproclaimed <unproclaimed916@disroot.org>
Date:   Mon Sep 13 12:27:22 2021 +0000

    Update 10-hardening.conf

commit 2a37bb4e62573df54ca2a7ae55eb0d47880170a1
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Mon Apr 5 11:07:38 2021 +0200

    update changelog

commit 5ca386bb1884f5fba19efaa37c9be648e5b63a68
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Mon Apr 5 11:07:21 2021 +0200

    d/control: update standards version to 4.5.1

commit 91a36690614331517c8519356acef52267b10812
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Mon Apr 5 11:03:00 2021 +0200

    statoverrides: drop pam.d line breaking authentication
    
    closes: #986358

commit 1f64b0011fc3dd2930105ce74b2cb168c969ecb5
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Sun Dec 13 17:36:39 2020 +0100

    force kernel.unprivileged_userns_clone to 0

commit aa4a6eed9c46c6e20d4b5ddc80239f578f6cd2f2
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Thu May 7 15:06:00 2020 +0200

    sysctl: align to 80 cols

commit cbbec33d236cfe985e7579c43a59924be150ff82
Merge: 16fd526 7cbc04c
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Sat Jan 11 10:10:43 2020 +0000

    Merge branch 'dpkg-statoverride' into 'debian/master'
    
    Optionally use dpkg-statoverride to override package permissions
    
    See merge request corsac/hardening-runtime!3

commit 16fd5269cf7b813032990c6058c7505e19cc8fb3
Merge: 9147898 bd090e1
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Mon Dec 23 09:37:17 2019 +0000

    Merge branch 'lintian-fixes' into 'debian/master'
    
    Fix some issues reported by lintian
    
    See merge request corsac/hardening-runtime!4

commit bd090e1f6c6a2869c4740a235384a0463a26f53f
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Sun Dec 22 07:54:24 2019 +0000

    Update standards version to 4.4.1, no changes needed.
    
    Fixes lintian: out-of-date-standards-version
    See https://lintian.debian.org/tags/out-of-date-standards-version.html for more details.

commit 55e24e865837ede4091248f9111e566a1238acfd
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Sun Dec 22 07:54:02 2019 +0000

    Bump debhelper from old 11 to 12.
    
    Fixes lintian: package-uses-old-debhelper-compat-version
    See https://lintian.debian.org/tags/package-uses-old-debhelper-compat-version.html for more details.

commit 5f327c5531c06f0a938e1cfe48055a6123fb3897
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Sun Dec 22 07:53:40 2019 +0000

    Use set -e rather than passing -e on the shebang-line.
    
    Fixes lintian: maintainer-script-without-set-e
    See https://lintian.debian.org/tags/maintainer-script-without-set-e.html for more details.

commit 7cbc04cf97cc8b1baf3d323729c80cd3c6e123ea
Author: Topi Miettinen <toiwoton@gmail.com>
Date:   Sun Nov 10 17:14:44 2019 +0200

    Optionally use dpkg-statoverride to override package permissions
    
    Packages related to system administration often have files and
    directories, which need not be accessible to unprivileged tasks. The
    permissions can be changed to more restrictive using
    dpkg-statoverride(8).
    
    Signed-off-by: Topi Miettinen <toiwoton@gmail.com>

commit 9147898b7d1e90f45977e057ecbfcd1f67401c58
Merge: 29bb3e9 7e7b036
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Tue Nov 5 16:21:31 2019 +0000

    Merge branch 'update-docs-for-proc-sys' into 'debian/master'
    
    Update docs to reflect /proc and /sys permissions change
    
    See merge request corsac/hardening-runtime!2

commit 7e7b03621063b4616411157fb9b013a552fde59a
Author: Topi Miettinen <toiwoton@gmail.com>
Date:   Sun Nov 3 17:12:19 2019 +0200

    Update docs to reflect /proc and /sys permissions change

commit 29bb3e96a901a0fd453b7c68ed121375067cf794
Merge: f02a17e 1a31553
Author: Yves-Alexis Perez <corsac@debian.org>
Date:   Sun Nov 3 07:14:17 2019 +0000

    Merge branch 'harden-proc-sys-permissions' into 'debian/master'
    
    Harden permissions of /proc and /sys
    
    See merge request corsac/hardening-runtime!1

commit 1a315536726cf41b64af6dc65c7cf9b250b5dda1
Author: Topi Miettinen <toiwoton@gmail.com>
Date:   Thu Oct 31 19:23:01 2019 +0200

    Harden permissions of /proc and /sys
    
    In /proc, several files and directories are not needed to be available
    for unprivileged users, in order for user applications (even ps, task
    managers, top, vmstat) to work correctly.
    
    Likewise for /sys, applications which interface with input or audio
    devices (like Xorg, pulseaudio, systemd-networkd) may need access to
    some paths, but not for example to block devices.
    
    Signed-off-by: Topi Miettinen <toiwoton@gmail.com>