divestedcg / brace

Toolkit compatible with multiple Linux distros that allows for installation of handpicked applications, along with corresponding configs that have been tuned for reasonable privacy and security.

brace

Overview

Brace is a toolkit compatible with multiple existing Linux distributions that allows for a rapid installation of handpicked applications, along with corresponding configurations that have been fine-tuned for reasonable privacy and security.

Compatibility

• Arch Linux
• CentOS 9/Stream
• Debian 12
• Fedora 39/40 (preferred)
• openSUSE Tumbleweed

License

AGPL-3.0-or-later where applicable

Prebuilts

• Fedora via Divested-RPM: https://divested.dev/index.php?page=software#divested-release
• Fedora via CI: https://gitlab.com/divested/brace/-/jobs/artifacts/master/browse?job=build_rpm
• Arch via CI: https://gitlab.com/divested/brace/-/jobs/artifacts/master/browse?job=build_arch
• Debian via CI: https://gitlab.com/divested/brace/-/jobs/artifacts/master/browse?job=build_deb

Building

• git clone [THIS REPO]
• Arch Linux: makepkg
• CentOS: rpmbuild -ba brace.spec
• Debian: dpkg-deb --root-owner-group --build brace
• Fedora: rpmbuild -ba brace.spec

Contents

• /etc/apt/apt.conf.d/90-brace = apt: enable seccomp filter during package install
• /etc/dconf/db/local.d/00-brace-* = GNOME/Cinnamon/MATE: change default settings
• /etc/dconf/profile/user = Fixup dconf overrides on select distros
• /etc/profile.d/brace-env-overrides.sh = profile: sets some environment overrides (eg. umask)
• /etc/profile.d/brace-helpers.sh = profile: adds helper aliases (eg. cleaning functions)
• /etc/tlp.d/00-brace.conf = TLP: allow for better power savings on AC too
• /usr/lib64/firefox/browser/defaults/preferences/userjs-*.js = Firefox: change default settings
  • /usr/lib64/firefox/distribution/policies.json
  • /usr/lib64/thunderbird/defaults/pref/userjs-*.js
• /etc/chromium/policies/managed/brace.json = Chromium: change default settings
  • /etc/opt/chrome/policies/managed/brace.json
• /usr/lib/modprobe.d/brace.conf = kernel: disable/block unsafe modules
• /usr/lib/modprobe.d/wireless-perf.conf = kernel: increase Wi-Fi performance for b43 and iwlwifi
• /usr/lib/NetworkManager/conf.d/30-nm-privacy.conf = NetworkManager: enables MAC randomization and IPv6 privacy extensions and disables connectivity checks
• /usr/lib/sysctl.d/60-restrict.conf = sysctl: set more restrictive defaults (dmesg, ptrace)
• /usr/lib/systemd/system/*.service.d/99-brace.conf = systemd service unit sandboxing
• /usr/lib/systemd/user/restic-backup@.* = systemd user unit for restic backups
• /usr/lib/tmpfiles.d/99-brace-proc.conf = /proc: harden permissions
• /usr/lib/tmpfiles.d/99-brace-sys.conf = /sys: harden permissions
• /usr/bin/brace-supplemental-changes = change extra default settings
• /usr/sbin/brace-enable-auto-updates = Fedora: automatic system updates using dnf-plugin-system-upgrade
• /usr/sbin/brace-enable-rpmfusion = Fedora: enable RPM Fusion 'free' repos
• /usr/sbin/brace-update-system = Fedora: helper to update to the next release
• /usr/sbin/brace-installer = unified recommended package installer
• /usr/sbin/brace-rpm-verify = RPM: verifies installed packages for corruption

Known Issues

• A reboot is required on openSUSE after install for dconf changes to take effect.
• Compatibility is best with Fedora, and that is the primary test-bed.
• Restrictions on /sys/bus/scsi in 99-brace-sys.conf can break disc drive access by some programs.

Credits

• userjs-arkenfox.js
  • @thorin-oakenpants + @earthlng + @claustromaniac
  • MIT: https://github.com/arkenfox/user.js/blob/af516315971b7c94075db1e317bee5b12dc3b781/LICENSE.txt
  • https://github.com/arkenfox/user.js
• 99-brace-proc.conf and 99-brace-sys.conf
  • Topi Miettinen (@topimiettinen)
  • GPL-2.0+: https://salsa.debian.org/corsac/hardening-runtime/-/blob/1a315536726cf41b64af6dc65c7cf9b250b5dda1/debian/copyright
  • https://salsa.debian.org/corsac/hardening-runtime/-/commit/1a315536726cf41b64af6dc65c7cf9b250b5dda1
• brace-rpm-verify
  • @doktor5000
  • CC BY-SA 3.0: https://stackoverflow.com/help/licensing
  • https://unix.stackexchange.com/a/217024
• firewalld IPv6 drop zone fix
  • Mark
  • CC BY-SA 3.0: https://stackoverflow.com/help/licensing
  • https://serverfault.com/a/775153
• restic-backup.service
  • Link Dupont
  • CC BY-SA 3.0: https://fedoramagazine.org/terms-and-conditions/
  • https://fedoramagazine.org/automate-backups-with-restic-and-systemd/
• chrony.brace.conf
  • GrapheneOS
  • MIT: https://github.com/GrapheneOS/infrastructure/blob/main/LICENSE
  • https://github.com/GrapheneOS/infrastructure/blob/main/chrony.conf
• modprobe.d/brace.conf additional module blocking
  • @madaidan
  • List likely uncopyrightable
  • https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules

Donate

• https://divested.dev/donate

brace's Issues

kernel boot parameters out of date

The following parameters are no longer recommended:

mce=0: https://github.com/Kicksecure/security-misc/pull/113/files

slub_debug=FZ: torvalds/linux@7927029

Can no longer access GNOME system monitor after installing brace

Hello,

Since I installed brace on my laptop, I can no longer access the system monitor from GNOME. I launched it from the terminal and here's what I got :

glibtop(c=27616): [ERROR] open (/proc/diskstats): Permission non accordée
zsh: IOT instruction (core dumped)  gnome-system-monitor

"Permission non accordée" means "Permission denied" by the way.

I think that could be linked to that config from /usr/lib/tmpfiles.d/99-brace-proc.conf:

z /proc/diskstats 0400 root root

Cannot install any extensions on Firefox

Hello,

I actually noticed after installing Firefox (from Fedora's repo, not Flathub/Flatpak) that I cannot install any extensions whatsoever. I noticed then that Brace blocked installations of all extensions apart from allowed ones like NoScript and Enhanced-h264ify.

Furthermore, I think that could be linked to the "ExtensionsSettings" policies visible from line 31 to 36 in :

https://github.com/divestedcg/Brace/blob/master/brace/usr/lib/firefox/distribution/policies.json

Thank you for fixing that.