Wintermute/Privatee

A Linux system privacy enhancer and hardener. The main idea revolves around this program being the first thing you run when you have a fresh distribution.

Abstract

The idea is simple, a dashboard UI that can help Linux desktop users with privacy and security hardening options. Most commonly used Linux distributions come out-of-the-box without kernel hardening features, enabled kernel modules that will never be used, and unneeded running services unheard of even by experienced users. The options for basic security and privacy hardening exist but vanilla (or even meta-packaged) distros tend to not use them.

Linux Desktop users should have easy access to customize the security of their installation to a degree that makes sense to them instead of the maintainers. Experienced users have their own shell-scripts and ansible playbooks to do this on their systems, but this can be time-consuming and cause false-positive behavior across system upgrades. It's hard to maintain on a per-individual basis and even harder to extend them to cover all of their systems.

The solution would be a dashboard that can "toggle" useful options and categorize them properly, while giving references to users to external resources that can explain what is happening on the background or how enhancements to the system might be approached.

Key features

The key features we would like to support are the following:

1. Linux Kernel configuration hardening
2. Network options hardening including IPv4 and IPv6 hardening/disabling
3. Systemd hardened configuration options
4. CPU mitigation options against known spectre-like bugs
5. Kernel attack surface reduction via module blacklisting
6. I/O level toggles for disabling hardware devices (e.g. microphone, camera, network interfaces) for privacy
7. User accounts and system options common hardening techniques (e.g. root access, file permissions, PAM hardening)
8. Recommendations and installation of additional software for privacy and security (OpenSnitch, kloak, hardened kernel )

The above protections cover a wide spectra of configurations that can happen either in the sysctl level or in other parts of the system. They can provide what we deem "a functional prototype" and can be expanded by users interested to contibute. Additionally (or in parallel with the above features), more experimental features can be included or recommended, such as keystroke randomization, hardened malloc or alternative libc installation and guides around software mirror selection and firmware-bootloader security.

Technical details

For the actual changes to the system we intend to use Ansible playbooks that can categorize these settings and make them available either via cli or UI. While Ansible adds a dependency cost, its YAML format means that transitioning from it to something else is possible and configurations can be mutations on the state of the system, "disconnecting" the actions from the state. Additionally, it's a tool that we feel comfortable with and can be a reliable basis for the project.

There is extensive hardening knowhow spread across the Ansible community which can be reused purposefully, and additionally it's a tool more commonly used by developers to mutate the state of the system than a language like Rust or Go. It is slow, but it is also easily extensible and can be used by people that do not like UI interfaces.

A PyQt UI dashboard will provide the user with the ability to see which of the options they already have enabled and which they might be interested to turn on to further improve the system. Concerning the scope with regards to Linux systems, our initial goal is to support Debian and then iteratively expand to other distributions (Ubuntu, Arch). Such a goal comes from the fact that the Debian system stands as the basis for a wide variety of Desktop distributions.

Goals

• Offer common privacy enhancements to users.
• Hardening of Linux desktop systems to prevent exploitation and lateral/horizontal privesc.
• Group together hardening and security options.

Similar Projects

• Kicksecure
• Lynis
• security-misc
• kernel-hardening-checker