byteio/nixos-config
1
0
Fork 0
mirror of https://github.com/librephoenix/nixos-config synced 2025-01-18 22:55:52 +05:30
Code Issues Packages Projects Releases Wiki Activity

Added hardening script for security

Browse source
This commit is contained in:
Emmet 2024-02-25 11:43:35 -06:00
parent fb7e67dbf8
commit 7a24e7507a
2 changed files with 35 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
harden.sh Executable file
View file

@ -0,0 +1,29 @@
#!/bin/sh
# This will harden the security of these dotfiles, preventing
# unpriveleged users from editing system-level (root configuration)
# files maliciously
# Run this inside of ~/.dotfiles (or whatever directory you installed
# the dotfiles to)
# Run this as root!
# BTW, this assumes your user account has a PID/GID of 1000
# After running this, the command `nix flake update` will require root
if [ "$#" = 1 ]; then
dotfilesDir=$1;
else
dotfilesDir=$(pwd);
fi
pushd $dotfilesDir &> /dev/null;
chown -R root:root system;
chown -R root:root patches;
chown root:root flake.lock;
chown root:root flake.nix
chown root:root profiles/*/configuration.nix;
chown 1000:users **/README.org;
chown root:root harden.sh;
popd &> /dev/null;

6
install.org
View file

@ -72,3 +72,9 @@ If it fails with something to the effect of "could not download {some image file
I have included a script in the [[./themes][themes directory]] named [[./themes/background-test.sh][background-test.sh]] which performs a rough test on every theme background url, reporting which are broken.
If you're having this error, navigate to the [[./flake.nix][flake.nix]] and select any theme with a good background wallpaper link. As long as it is able to download the new wallpaper, it should be able to build.
*** Do I have to put the configuration files in =~/.dotfiles=?
No. You can put them in literally any directory you want. I just prefer to use =~/.dotfiles= as a convention. If you change the directory, do keep in mind that the above scripts must be modified, replacing =~/.dotfiles= with whatever directory you want to install them to.
*** So I cloned these dotfiles into ~/.dotfiles, and now there are system-level files owned by my user account.. HOW IS THIS SECURE?!
If you're worried about someone modifying your system-level (root configuration) files as your unpriveleged user, see [[./harden.sh][harden.sh]].