Builds of the project have been prepared. , based on the 32-bit version of Slackware-Current and supplied with 32- and 64-bit variants of the Linux kernel 4.19. Size 800 MB.
Key , compared to the original Slackware:
- Installation on 4 partitions: "/", "/boot", "/var", and "/home". The partitions "/" and "/boot" are mounted in read-only mode, while "/home" and "/var" are in noexec mode (execution prohibited);
- Kernel patch CONFIG_SETCAP. The setcap module can disable specified system capabilities or enable them for all users. The module is configured by the superuser during system operation via the sysctl interface or the /proc/sys/setcap files and can be frozen from changes until the next reboot.
By default, the system disables CAP_CHOWN(0), CAP_DAC_OVERRIDE(1), CAP_DAC_READ_SEARCH(2), CAP_FOWNER(3), and 21(CAP_SYS_ADMIN). The system can be returned to its normal state using the tinyware-beforeadmin command (mounting and capabilities). Based on the module, a securelevels wrapper can be developed. - Kernel patch PROC_RESTRICT_ACCESS. This option restricts access to the /proc/pid directories in the /proc filesystem from 555 to 750, with the group for all directories set to root. As a result, users only see their processes via the "ps" command. Root still sees all processes on the system.
- Kernel patch CONFIG_FS_ADVANCED_CHOWN, allowing regular users to change ownership of files and subdirectories within their directories.
- Some default setting changes (for example, UMASK is set to 077).
Source: opennet.ru
