#81 2018-01-07 21:41:48

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

^ Well, it's only a local vulnerability and it doesn't seem likely (or possible) that anybody would boot the ISO and then have several other users log in and thus allow one of them to exploit the hole.

I don't think firefox-esr allows for the context switching that the exploit is based on so the setup should be OK otherwise (AFAIK).

---

Para todos todo, para nosotros nada

brontosaurusrex

Middle Office

Registered: 2015-09-29

Posts: 2,746

Re: SharpBang (♯!) "live" ISO image

I missed the "local" bit, from what i read it could be a web page (theoretically), but can't find the proper link right now.

edit, this: https://www.bleepingcomputer.com/news/s … e-attacks/

Last edited by brontosaurusrex (2018-01-08 09:56:35)

---

My website full of interesting stuff.

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

Firefox v57.0.3 could be used as an attack vector, yes, but v57.0.4 has had it's fancy timing system crippled to break this.

The firefox-esr package used by #! (and BL) does not have this "feature" and so is "safe" to use.

---

Para todos todo, para nosotros nada

Eon

Member

From: Earth

Registered: 2015-09-29

Posts: 76

Re: SharpBang (♯!) "live" ISO image

Holy cow, just bumped upon this thread and sounds really interesting. Honestly I'm willing to experiment with anything that runs on less and less resources, so I will definitely give this a try.

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

Updated the image to kernel 4.15.5, it now has full generic retpoline and __user pointer sanitisation along with the PTI mitigation so both Spectre and Meltdown are covered.

---

Para todos todo, para nosotros nada

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

Added dnssec-trigger because my "hardcoded" configuration didn't work and also a menu entry for the network manager (grml-network).

---

Para todos todo, para nosotros nada

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

OK, finally fixed the resolv.conf issue and stopped dhclient from overwriting the namesevers.

New version uploaded now.

---

Para todos todo, para nosotros nada

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

Updated the image and managed to strip 60MiB off after realising that /boot/* isn't needed in the live system.

It's now at 809MiB, which is pretty good for the functionality on offer.

I also now have the means to produce an installable system for this — if there was any interest I could package up the configuration changes and push out an installer ISO.

---

Para todos todo, para nosotros nada

beaker

Unverified Muppet

Registered: 2016-03-06

Posts: 198

Re: SharpBang (♯!) "live" ISO image

— if there was any interest I could package up the configuration changes and push out an installer ISO.

I would be interested

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

^ Noted

It may take a while but it should be fairly simple because I have removed all of the BunsenLabs packages from this desktop and it uses pure Debian repositories (apart from the Liquorix kernel) and so only needs some configuration files in a single package to set it all up 8)

---

Para todos todo, para nosotros nada

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

Updated the image to kernel 4.15.11

Also added xserver-xorg-video-qxl for improved performance under KVM/QEMU with SPICE.

---

Para todos todo, para nosotros nada

beaker

Unverified Muppet

Registered: 2016-03-06

Posts: 198

Re: SharpBang (♯!) "live" ISO image

Is this an installable iso?

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

^ No, not yet, that will have to wait until after Helium is released so it doesn't distract me too much

---

Para todos todo, para nosotros nada

beaker

Unverified Muppet

Registered: 2016-03-06

Posts: 198

Re: SharpBang (♯!) "live" ISO image

ok - no worries

Head_on_a_Stick

Member

From: London

Registered: 2015-09-29

Posts: 9,093

Website

Re: SharpBang (♯!) "live" ISO image

Another image update: new kernel & firefox-esr version.

Under the hood I have restructured the configuration from a hacky /etc/skel method to a more refined sharp-user-setup script activated by /etc/X11/Xsession.d/22-sharp-user-setup (this is in line with BunsenLabs' method).

The obsession package has been removed and replaced with sharp-exit.

Now that the Helium release is imminent I will start to look at packaging up the configuration (perhaps with a sharpbang-desktop-task) and making an installable ISO image.

---

Para todos todo, para nosotros nada

or1o9

Member

Registered: 2017-11-15

Posts: 246

Re: SharpBang (♯!) "live" ISO image

Awesome work Head_on_a_Stick.

https://head-on-a-stick.github.io/

MALsPa

Member

From: albuquerque

Registered: 2016-06-20

Posts: 239

Re: SharpBang (♯!) "live" ISO image

Awesome work Head_on_a_Stick.

https://head-on-a-stick.github.io/

I know this is an old thread, but...

Thanks, Head_on_a_Stick! I got a new laptop and used sharpbang-buster-10.5.0-amd64.hybrid.iso for the installation. Of course I've tweaked a bunch of things to suit my own tastes, but this was a great way to get up and running.