Skip to content

Commit bcd840c

Browse files
taskettasket
committed
makefile and debian
1 parent 05d8649 commit bcd840c

File tree

11 files changed

+127
-2
lines changed

11 files changed

+127
-2
lines changed

‎Makefile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
VERSION := $(shell cat version)
2+
3+
install: install-vm
4+
5+
install-vm:
6+
bash ./install
7+
bash ./configure-sudo-prompt --force

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,11 @@ Leverage Qubes template non-persistence to fend off malware at VM startup: Lock-
1616

1717
### Installing
1818

19-
1. In a template VM, install the service files
19+
1. In a template VM, install and configure
2020
```
2121
cd Qubes-VM-hardening
2222
sudo bash install
23+
sudo bash configure-sudo-prompt
2324
```
2425

2526
2. Activate by specifying one of the following Qubes services for your VM(s)...

‎debian/changelog

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
qubes-vm-hardening (0.9.3-1) unstable; urgency=medium
2+
3+
* Initial release
4+
5+
-- Christopher Laprise <[email protected]> Mon, 2 Sep 2018 08:01:15 -0400

‎debian/compat

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
10

‎debian/control

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
Source: Qubes-VM-hardening
2+
Section: admin
3+
Priority: optional
4+
Maintainer: Christopher Laprise <[email protected]>
5+
Build-Depends: debhelper (>= 10)
6+
Standards-Version: 4.1.2
7+
Homepage: https://www.qubes-os.org
8+
9+
Package: qubes-vm-hardening
10+
Architecture: all
11+
Depends: ${misc:Depends} qubes-core-agent
12+
Description: Prevent malware persistence in Qubes virtual machines.
13+
Reconfigures Qubes VM templates to block casual sudo access,
14+
protects user startup scripts, and includes a service that can
15+
quarantine, whitelist and check file hashes at startup before
16+
the /rw volume comes online.
17+
18+
See https://www.github.com/tasket/Qubes-VM-hardening for more info.

‎debian/copyright

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
Files: debian/*
2+
Copyright: 2018-2019 Christopher Laprise <[email protected]>
3+
License: GPL-3
4+
This package is free software; you can redistribute it and/or modify
5+
it under the terms of the GNU General Public License as published by
6+
the Free Software Foundation; either version 3 of the License, or
7+
(at your option) any later version.
8+
.
9+
This package is distributed in the hope that it will be useful,
10+
but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
GNU General Public License for more details.
13+
.
14+
You should have received a copy of the GNU General Public License
15+
along with this program. If not, see <https://www.gnu.org/licenses/>
16+
.
17+
On Debian systems, the complete text of the GNU General
18+
Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".

‎debian/install

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

‎debian/postinst

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/sh
2+
# postinst script for qubes-tunnel
3+
#
4+
# see: dh_installdeb(1)
5+
6+
7+
8+
### TODO:
9+
### Fix postinst and install files in 'debian' folder.
10+
11+
12+
13+
set -e
14+
15+
# summary of how this script can be called:
16+
# * <postinst> `configure' <most-recently-configured-version>
17+
# * <old-postinst> `abort-upgrade' <new version>
18+
# * <conflictor's-postinst> `abort-remove' `in-favour' <package>
19+
# <new-version>
20+
# * <postinst> `abort-remove'
21+
# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
22+
# <failed-install-package> <version> `removing'
23+
# <conflicting-package> <version>
24+
# for details, see https://www.debian.org/doc/debian-policy/ or
25+
# the debian-policy package
26+
27+
28+
case "$1" in
29+
configure)
30+
systemctl daemon-reload
31+
systemctl enable vm-boot-protect.service
32+
;;
33+
34+
abort-upgrade|abort-remove|abort-deconfigure)
35+
;;
36+
37+
*)
38+
echo "postinst called with unknown argument \`$1'" >&2
39+
exit 1
40+
;;
41+
esac
42+
43+
# dh_installdeb will replace this with shell code automatically
44+
# generated by other debhelper scripts.
45+
46+
#DEBHELPER#
47+
48+
exit 0

‎debian/rules

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/make -f
2+
# See debhelper(7) (uncomment to enable)
3+
# output every command that modifies files on the build system.
4+
#export DH_VERBOSE = 1
5+
6+
7+
# see FEATURE AREAS in dpkg-buildflags(1)
8+
#export DEB_BUILD_MAINT_OPTIONS = hardening=+all
9+
10+
# see ENVIRONMENT in dpkg-buildflags(1)
11+
# package maintainers to append CFLAGS
12+
#export DEB_CFLAGS_MAINT_APPEND = -Wall -pedantic
13+
# package maintainers to append LDFLAGS
14+
#export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
15+
16+
17+
%:
18+
dh $@
19+
20+
21+
# dh_make generated override targets
22+
# This is example for Cmake (See https://bugs.debian.org/641051 )
23+
#override_dh_auto_configure:
24+
# dh_auto_configure -- # -DCMAKE_LIBRARY_PATH=$(DEB_HOST_MULTIARCH)
25+

‎debian/source/format

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
3.0 (quilt)

0 commit comments

Comments
 (0)