Hardening (#30)

* set build-argument for environment

* hardening remove dangerous commands

* add hardening scripts for base and final image
This commit is contained in:
Stefan Allius
2023-11-22 21:57:42 +01:00
committed by GitHub
parent f10207b5ba
commit e2873ffce7
6 changed files with 59 additions and 9 deletions

19
app/hardening_base.sh Normal file
View File

@@ -0,0 +1,19 @@
#!/bin/sh
rm -fr /var/spool/cron
rm -fr /etc/crontabs
rm -fr /etc/periodic
# Remove every user and group but root
sed -i -r '/^(root)/!d' /etc/group
sed -i -r '/^(root)/!d' /etc/passwd
# Remove init scripts since we do not use them.
rm -fr /etc/inittab
# Remove kernel tunables since we do not need them.
rm -fr /etc/sysctl*
rm -fr /etc/modprobe.d
# Remove fstab since we do not need it.
rm -f /etc/fstab