fix: 9.5.0 audit hardening batch (config.txt, SSH lockout, state) - #11
Merged
Conversation
Resolves a full multi-agent audit: 2 critical, 14 high, plus medium/low fixes and de-duplication. Affected tasks bump their version so corrected values re-apply on upgrade. Critical: - ensure_config_key_value keyed every dtparam=NAME=value line on the bare word "dtparam", so writing one wiped unrelated stock dtparam lines (audio/i2c/spi). dtparam/dtoverlay are now keyed by parameter name. - SSH-port detection reads the effective config via `sshd -T`, honouring sshd_config.d drop-ins, so UFW no longer opens 22 while sshd listens on a custom port and drops the operator's session. High: - --force no longer wipes completion markers of opt-in tasks not re-requested; --diff/--dry-run no longer mutate state.json (proxy/ufw re-run detection moved to dry-run-safe value_changed hooks). - ipv6_disable records the file it creates so --undo reverses it. - boot_config replaces existing keys instead of appending duplicates. - usb_uas_quirks merges the usb-storage.quirks token instead of appending. - tailscale installs via ensure_packages (dpkg-lock wait). - var_log_tmpfs journal archive is 0600 under /var/backups (was world-readable in /var/log). - snapshot excludes config-optimisations.json like state.json. - TUI keeps a non-default zram algo, runs value-typed tasks set in the Values menu, and no longer drops default-enabled tasks in unvisited categories. Safer defaults (review): - IP forwarding no longer enabled by default in sysctl. - remove_bloat no longer purges Raspberry Pi Connect. - disable_services no longer disables rsyslog (volatile journald + tmpfs /var/log otherwise left no persistent log after reboot). Other correctness: dns_cache backs up resolv.conf before repointing; eeprom_config records its backup + revert command; config.yaml zram.algo validated; Compute Module 4/5 mapped to their Pi generation; --diff no longer launches the TUI (menu-skip flags derived from the task registry); pi_rollback_release resolves paths before comparing; libliftoff stops uncommenting disabled overlays and collapses duplicate KMS lines; install.sh distinguishes a 404 ref from a network error. Refactor: shared apply_config_entries / pi_curl_secure / write_systemd_unit helpers; run and --diff share one entry source per task; oc_conservative and underclock use a per-model table; removed dead validate_timezone, is_pi500, fstab_root_has_option; pi_daemon_reload_now now has callers; implemented pi_supports_eeprom; inline list-unit-files replaced with unit_exists. CI/tests: release fails if tag, SCRIPT_VERSION and man footer disagree; ShellCheck/bash -n cover the test harness and stubs; integration matrix runs against Trixie and Bookworm; stub invocation log is now exercised; bundle shebang-parity gate actually checks the shebang.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardening release from a full multi-agent audit (43 confirmed findings):
2 critical, 14 high, plus medium/low fixes, safer defaults, and
de-duplication. Bumps to 9.5.0. Affected tasks bump their version so
corrected values re-apply on upgrade.
Critical
dtparam=NAME=valuelines no longer clobber each other(was silently disabling stock audio/i2c/spi via
--disable-ledsetc.).sshd -T(honourssshd_config.ddrop-ins), so UFW can't lock out a custom-port host.High
--forceno longer wipes opt-in task markers;--diff/--dry-runnolonger mutate
state.json(re-run detection moved to value_changed hooks).ipv6_disableundo works;boot_configreplaces keys;usb_uas_quirksmerges the quirks token;
tailscaleusesensure_packages.var_log_tmpfsjournal archive is now 0600 under/var/backups.config-optimisations.jsonlikestate.json.dropping default-enabled tasks in unvisited categories.
Changed (safer defaults — please review)
sysctl).remove_bloat).rsyslogno longer disabled (disable_services) — volatile journald +tmpfs
/var/logotherwise left no persistent log after reboot.Refactor / CI
apply_config_entries/pi_curl_secure/write_systemd_unithelpers; run and
--diffshare one entry source per task;oc_conservative/underclock use a per-model table; dead code removed.
SCRIPT_VERSION/man footer disagree; ShellCheck +bash -ncover the test harness and stubs; integration matrix now runson Trixie and Bookworm; stub invocation log is exercised.
Test plan
bash -non all shell files (main, lib, install, tests, stubs)shellcheck --severity=warningclean across the same set--version/--help/--list-tasks(54 tasks)scripts/build-bundle.shbuilds; standalone--version= 9.5.0cmdline merge, libliftoff, overclock plan, write_systemd_unit
Deferred (documented)
main()decomposition and a package-bundle task registry (refactor-only,high churn / low ROI).
state.jsonlocking test (couldn't make deterministicwithout flakiness; shipped the stub-log test instead).