Mikaela/shell-things
1
0
Fork 0
mirror of https://gitea.blesmrt.net/mikaela/shell-things.git synced 2026-04-27 02:58:20 +02:00
Code Issues Projects Releases Wiki Activity

tmpfiles.d: add config for IPv6 privacy extensions & airsnitch mitigation

Browse Source
This commit is contained in:
Aminda Suomalainen 2026-04-13 10:10:04 +03:00
parent b7adc678f4
commit 3d9e50dd1a
Signed by: Mikaela
GPG Key ID: 99392F62BAE30723
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
etc/tmpfiles.d/networking-security-privacy.conf Normal file
View File

@ -0,0 +1,18 @@
# Enable IPv6 privacy extensions and prefer them to the EUI-64 address
# 2 for enabling and preferring, 1 to only enable, 0 to disable
w /proc/sys/net/ipv6/conf/all/use_tempaddr - - - - 2
w /proc/sys/net/ipv6/conf/default/use_tempaddr - - - - 2
w /proc/sys/net/ipv6/conf/eth0/use_tempaddr - - - - 2
w /proc/sys/net/ipv6/conf/wlan0/use_tempaddr - - - - 2
w /proc/sys/net/ipv6/conf/enp4s0f1/use_tempaddr - - - - 2
w /proc/sys/net/ipv6/conf/wlp3s0/use_tempaddr - - - - 2
# AirSnitch mitigation 2026-04-13 https://github.com/vanhoefm/airsnitch/blob/main/README.md#id-defense-filter-bcast
w /proc/sys/net/ipv4/conf/eth0/drop_unicast_in_l2_multicast - - - - 1
w /proc/sys/net/ipv6/conf/eth0/drop_unicast_in_l2_multicast - - - - 1
w /proc/sys/net/ipv4/conf/wlan0/drop_unicast_in_l2_multicast - - - - 1
w /proc/sys/net/ipv6/conf/wlan0/drop_unicast_in_l2_multicast - - - - 1
w /proc/sys/net/ipv4/conf/enp4s0f1/drop_unicast_in_l2_multicast - - - - 1
w /proc/sys/net/ipv6/conf/enp4s0f1/drop_unicast_in_l2_multicast - - - - 1
w /proc/sys/net/ipv4/conf/wlp3s0/drop_unicast_in_l2_multicast - - - - 1
w /proc/sys/net/ipv6/conf/wlp3s0/drop_unicast_in_l2_multicast - - - - 1

4
install
View File

@ -218,9 +218,9 @@ if [ "$(id -u)" == "0" ]; then
cp -v local/share/applications/vivaldi.desktop /usr/local/share/applications/
fi
# Attempt at classic snaps (symlink /snap to /var/lib/snapd/snap)
# SECURITY WARNING! Attempt at automatic symlinking and weird kernel configuration etc.
mkdir -vp /etc/tmpfiles.d/
cp -v etc/tmpfiles.d/snapd-classic.conf /etc/tmpfiles.d/
cp -v etc/tmpfiles.d/{snapd-classic,networking-security-privacy}.conf /etc/tmpfiles.d/
# Additional configuration for sudo SECURITY WARNING DANGER ALARM BELLS!
if [ -d /etc/sudoers.d ]; then