arch-secure-install.sh

DO NOT USE THIS SCRIPT

I'm testing AI capabilities into hardening an OS. This should be intent for studies purpose only. If you want a secure OS you should use QubesOS or at least SecureblueOS.

Autogenerate README

This repository contains a Master Orchestrator script designed to automate the security hardening of Arch Linux. It follows a "security-in-depth" approach, combining kernel-level restrictions, network privacy, and advanced memory protection using Hardened Malloc.

🚀 Overview

The main script, arch-secure-install.sh, acts as a generator. When executed, it creates and runs a series of modular scripts that handle different aspects of system security:

1. System Hardening (01_system_harden.sh): Kernel parameters and filesystem restrictions.
2. Memory Security (02_malloc_builder.sh): Compiles and installs GrapheneOS's Hardened Malloc from source.
3. Network Privacy (03_network_harden.sh): MAC address randomization for iwd.

---

🛡️ Key Security Features

1. Advanced Memory Protection

Unlike standard setups, this script compiles Hardened Malloc directly from the GrapheneOS source code.

• Hardened Malloc: Replaces the standard glibc allocator with a security-focused one that protects against heap overflows and use-after-free vulnerabilities.
• The Stability Helper (libno_rlimit_as.so): A custom-compiled library that intercepts setrlimit calls. This prevents Chromium-based browsers and Bubblewrap (bwrap) from crashing due to the large virtual memory address space required by the hardened allocator.

2. Filesystem & Process Hiding

The script applies hidepid=2 to /proc, making processes invisible to other users.

• The Portal Fix: To prevent breaking XDG Desktop Portals (which would stop file-picker dialogs from working), the script automatically detects your wheel group GID and applies a GID exception in /etc/fstab.

3. Kernel Hardening

Applies a comprehensive set of sysctl rules:

• Restricts dmesg access to privileged users.
• Hardens the BPF JIT compiler and restricts kernel pointer leaks.
• Enables protection against symlink/hardlink attacks.
• Hardens the network stack against IP spoofing and redirect attacks.

4. Network Anonymity

Configures iwd (iNet Wireless Daemon) for enhanced privacy:

• MAC Randomization: Generates a random MAC address during scanning.
• Per-Network MAC: Assigns a stable but unique MAC address for each SSID to maintain privacy without breaking network authentication.

---

🛠️ Usage

1. Clone the repository:

git clone https://github.com/yourusername/arch-hardening
cd arch-hardening

2. Run the Orchestrator:

sudo ./arch-secure-install.sh

3. Reboot: A system reboot is mandatory to apply kernel parameters, the new mount options for /proc, and the global LD_PRELOAD configuration.

⚠️ Important Considerations

• AppArmor: The script enables the AppArmor service, but you must manually ensure that apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf is added to your bootloader's kernel parameters.
• Systemd Limits: The script sets DefaultLimitAS=infinity in system.conf.d to ensure system services remain stable while using the hardened allocator.

---